[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_388":389,"_390":391},"routes/_app.x.$handle.$name",{"_100":99,"_33":46,"_108":90,"_28":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":27,"_123":124,"_125":25,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_33":46,"_39":47,"_48":-5,"_49":27,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":25,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":27},"version",43,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":27,"_28":29,"_30":29},"file",{"_31":32,"_33":29,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":27},"previous",{"_31":32,"_33":29,"_34":35,"_36":37},"deleted",true,"deletedHere",false,"path","_synctest.ts","latestPath","fileId","f16b0a80-6745-11f1-8981-1607ee4eb77e","name","fileType","script","content","import { fullSync } from \"./sync/ghToVal.ts\";\n\nconst VT = Deno.env.get(\"VT_DEV_TOKEN\")!;\n// throwaway public dest val (public avoids any private-val limit)\nconst create = await fetch(\"https://api.val.town/v2/vals\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${VT}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ name: \"ghsyncsvctest3dest\" + Date.now(), privacy: \"public\" }),\n});\nconst val = await create.json();\nconsole.log(\"create:\", create.status, \"val_id:\", val.id, \"slug:\", val.name);\n\nconst conn = {\n id: -1,\n user_id: \"test\",\n val_id: val.id,\n val_slug: val.name,\n repo: \"stevekrouse/7minuteworkout\",\n branch: \"main\",\n direction: \"github\",\n vt_token: \"env:VT_DEV_TOKEN\",\n gh_token: null,\n installation_id: 140085460,\n webhook_secret: null,\n last_sync_at: null,\n last_result: null,\n created_at: \"\",\n};\n\nconst results = await fullSync(conn as any);\nconsole.log(\"synced files:\", results.filter((r) => r.startsWith(\"synced\")).length);\nconsole.log(\"sample:\", JSON.stringify(results.slice(0, 8)));\nconsole.log(\"CLEANUP_VAL_ID:\", val.id);\n","import { fullSync } from \"./sync/ghToVal.ts\";\n\nconst VT = Deno.env.get(\"VT_DEV_TOKEN\")!;\n// throwaway public dest val (public avoids any private-val limit)\nconst create = await fetch(\"https://api.val.town/v2/vals\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${VT}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ name: \"ghsyncsvctest3dest\" + Date.now(), privacy: \"public\" }),\n});\nconst val = await create.json();\nconsole.log(\"create:\", create.status, \"val_id:\", val.id, \"slug:\", val.name);\n\nconst conn = {\n id: -1,\n user_id: \"test\",\n val_id: val.id,\n val_slug: val.name,\n repo: \"stevekrouse/7minuteworkout\",\n branch: \"main\",\n direction: \"github\",\n vt_token: \"env:VT_DEV_TOKEN\",\n gh_token: null,\n installation_id: 140085460,\n webhook_secret: null,\n last_sync_at: null,\n last_result: null,\n created_at: \"\",\n};\n\nconst { ghTokenFor } = await import(\"./lib/creds.ts\");\nconst { gh } = await import(\"./lib/github.ts\");\nconst tok = await ghTokenFor(conn as any);\nconst repo = await gh(tok, \"/repos/stevekrouse/7minuteworkout\");\n(conn as any).branch = repo.default_branch;\nconsole.log(\"default_branch:\", repo.default_branch);\nconst results = await fullSync(conn as any);\nconsole.log(\"synced files:\", results.filter((r) => r.startsWith(\"synced\")).length);\nconsole.log(\"sample:\", JSON.stringify(results.slice(0, 8)));\nconsole.log(\"CLEANUP_VAL_ID:\", val.id);\n","createdAt",["D",1781368588010],"branchVersion","branchId","503392e9-5051-4383-a7b7-4f37bc194007","id","bb036e1b-8dcf-48ee-9796-68ffb44b04ef","githubsync",["D",1781310279766],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Hosted GitHub <-> Val Town sync service prototype","imageUrl","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","2cfaf97a-66bf-11f1-9471-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","e81e7335-6d4c-4764-a902-d0962bbfa9f7","tursoName","bb036e1b8dcf48ee979668ffb44b04ef","tursoHostname","bb036e1b8dcf48ee979668ffb44b04ef-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509672838],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_107":103},"org",{"_100":99,"_101":-5,"_102":103,"_18":56,"_104":105,"_106":27},"branch",{"_13":89,"_33":90,"_44":43,"_91":45,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":46,"_98":99},"isOwned",46,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","stevekrouse","handle","displayName","avatar","https://images.clerk.dev/uploaded/img_2PqHa2Gsy93xQrjh2w78Xu0cChW.jpeg","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_33":46,"_39":383,"_48":-5,"_49":27,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":25,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":384,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":385,"_84":386,"_86":387,"_88":27},"tree",[219,224,229,232,237,238,239,240,241,242],"files",[219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"counts",{"_209":63,"_210":167,"_211":63,"_212":213,"_214":215},"contents",[130,131,132,133,134,135,136,137,138,139],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":203,"_33":204,"_31":205,"_142":-5,"_42":43,"_41":206,"_144":25,"_39":207,"_13":63,"_34":189,"_36":-5,"_24":27,"_149":-5,"_28":208},{"_44":197,"_33":198,"_31":199,"_142":-5,"_42":43,"_41":200,"_144":25,"_39":201,"_13":63,"_34":189,"_36":-5,"_24":27,"_149":-5,"_28":202},{"_44":191,"_33":192,"_31":193,"_142":-5,"_42":43,"_41":194,"_144":25,"_39":195,"_13":63,"_34":189,"_36":-5,"_24":27,"_149":-5,"_28":196},{"_44":184,"_33":185,"_31":186,"_142":-5,"_42":43,"_41":187,"_144":25,"_39":188,"_13":63,"_34":189,"_36":-5,"_24":27,"_149":-5,"_28":190},{"_44":176,"_33":177,"_31":178,"_142":-5,"_42":43,"_41":179,"_144":27,"_39":180,"_13":181,"_34":20,"_36":182,"_24":27,"_149":-5,"_28":183},{"_44":169,"_33":170,"_31":171,"_142":-5,"_42":43,"_41":172,"_144":27,"_39":173,"_13":63,"_34":35,"_36":174,"_24":27,"_149":-5,"_28":175},{"_44":165,"_33":29,"_31":32,"_142":-5,"_42":43,"_41":14,"_144":27,"_39":166,"_13":167,"_34":35,"_36":38,"_24":27,"_149":-5,"_28":168},{"_44":157,"_33":158,"_31":159,"_142":-5,"_42":43,"_41":160,"_144":25,"_39":161,"_13":63,"_34":162,"_36":163,"_24":27,"_149":-5,"_28":164},{"_44":151,"_33":152,"_31":153,"_142":-5,"_42":43,"_41":146,"_144":25,"_39":154,"_13":63,"_34":35,"_36":155,"_24":27,"_149":-5,"_28":156},{"_44":140,"_33":141,"_31":58,"_142":-5,"_42":43,"_41":143,"_144":25,"_39":145,"_13":146,"_34":147,"_36":148,"_24":27,"_149":-5,"_28":150},"c7b34ae9-b86b-4bc8-82d3-9cdba0e1d9f6","index.tsx","parentId",27,"latest",["D",1781354605238],2,"http","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { getOAuthUserData, oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { listConnections, listInstallations, upsertUser } from \"./db.ts\";\nimport { sharedApp } from \"./lib/app.ts\";\nimport { listMyVals } from \"./lib/valtown.ts\";\nimport connections from \"./routes/connections.tsx\";\nimport dev from \"./routes/dev.ts\";\nimport githubApp from \"./routes/githubApp.tsx\";\nimport webhook from \"./routes/webhook.ts\";\nimport Dashboard from \"./views/Dashboard.tsx\";\nimport Landing from \"./views/Landing.tsx\";\nimport Layout from \"./views/Layout.tsx\";\n\nconst app = new Hono();\n\napp.route(\"/webhook\", webhook);\napp.route(\"/dev\", dev);\napp.route(\"/connections\", connections);\napp.route(\"/github\", githubApp);\n\napp.get(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session) {\n return c.html(\n \n \n ,\n );\n }\n // Persist tokens so webhooks and crons can sync without a cookie present.\n await upsertUser(\n session.user.id,\n session.user.username,\n session.accessToken,\n session.refreshToken ?? null,\n );\n let vals: string[] = [];\n let valsError: string | null = null;\n try {\n vals = await listMyVals(session.accessToken);\n } catch (e) {\n valsError = e.message;\n }\n let appSlug: string | null = null;\n try {\n appSlug = sharedApp().slug;\n } catch { /* shared app not configured */ }\n return c.html(\n \n \n ,\n );\n});\n\nexport default oauthMiddleware(\n { scopes: [\"openid\", \"offline_access\", \"profile\", \"user_r\", \"project_rw\"] },\n (req: Request) => app.fetch(req),\n);\n","label",[141],"346b227e-45f9-4f66-bf07-0b28f36fec8b","db.ts","c3e688dc-66be-11f1-9ff7-1607ee4eb77e",["D",1781310494158],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst TABLES = [\n `CREATE TABLE IF NOT EXISTS users (\n user_id TEXT PRIMARY KEY,\n username TEXT NOT NULL,\n access_token TEXT NOT NULL,\n refresh_token TEXT,\n updated_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS apps (\n app_id INTEGER PRIMARY KEY,\n slug TEXT NOT NULL,\n client_id TEXT NOT NULL,\n client_secret TEXT NOT NULL,\n webhook_secret TEXT NOT NULL,\n pem TEXT NOT NULL,\n owner_user_id TEXT,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS installations (\n installation_id INTEGER PRIMARY KEY,\n app_id INTEGER NOT NULL,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS connections (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id TEXT NOT NULL,\n val_id TEXT NOT NULL,\n val_slug TEXT NOT NULL,\n repo TEXT NOT NULL,\n branch TEXT NOT NULL DEFAULT 'main',\n direction TEXT NOT NULL CHECK (direction IN ('github','valtown')),\n vt_token TEXT NOT NULL,\n gh_token TEXT,\n installation_id INTEGER,\n webhook_secret TEXT,\n last_sync_at TEXT,\n last_result TEXT,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS events (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n connection_id INTEGER NOT NULL,\n ts TEXT NOT NULL,\n kind TEXT NOT NULL,\n detail TEXT\n )`,\n];\nfor (const sql of TABLES) await sqlite.execute(sql);\n\nfunction asObjects(rs: { columns: string[]; rows: unknown[] }): T[] {\n const rows = rs.rows ?? [];\n if (rows.length === 0) return [];\n if (!Array.isArray(rows[0])) return rows as T[];\n return (rows as unknown[][]).map((r) =>\n Object.fromEntries(rs.columns.map((c, i) => [c, r[i]])) as T\n );\n}\n\nconst now = () => new Date().toISOString();\n\nexport type Connection = {\n id: number;\n user_id: string;\n val_id: string;\n val_slug: string;\n repo: string;\n branch: string;\n direction: \"github\" | \"valtown\";\n vt_token: string;\n gh_token: string | null;\n installation_id: number | null;\n webhook_secret: string | null;\n last_sync_at: string | null;\n last_result: string | null;\n created_at: string;\n};\n\nexport type App = {\n app_id: number;\n slug: string;\n client_id: string;\n client_secret: string;\n webhook_secret: string;\n pem: string;\n owner_user_id: string | null;\n created_at: string;\n};\n\nexport type SyncEvent = {\n id: number;\n connection_id: number;\n ts: string;\n kind: string;\n detail: string | null;\n};\n\nexport async function upsertUser(\n userId: string,\n username: string,\n accessToken: string,\n refreshToken: string | null,\n) {\n await sqlite.execute({\n sql: `INSERT INTO users (user_id, username, access_token, refresh_token, updated_at)\n VALUES (?, ?, ?, ?, ?)\n ON CONFLICT(user_id) DO UPDATE SET\n username = excluded.username,\n access_token = excluded.access_token,\n refresh_token = excluded.refresh_token,\n updated_at = excluded.updated_at`,\n args: [userId, username, accessToken, refreshToken, now()],\n });\n}\n\nexport async function insertApp(a: Omit) {\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO apps\n (app_id, slug, client_id, client_secret, webhook_secret, pem, owner_user_id, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [a.app_id, a.slug, a.client_id, a.client_secret, a.webhook_secret, a.pem, a.owner_user_id, now()],\n });\n}\n\nexport async function getApp(): Promise {\n const rs = await sqlite.execute(`SELECT * FROM apps ORDER BY created_at DESC LIMIT 1`);\n return asObjects(rs)[0] ?? null;\n}\n\nexport async function insertInstallation(installationId: number, appId: number) {\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO installations (installation_id, app_id, created_at) VALUES (?, ?, ?)`,\n args: [installationId, appId, now()],\n });\n}\n\nexport async function listInstallations(): Promise<{ installation_id: number; app_id: number }[]> {\n const rs = await sqlite.execute(`SELECT * FROM installations ORDER BY created_at DESC`);\n return asObjects(rs);\n}\n\nexport async function insertConnection(\n c: Omit,\n): Promise {\n const rs = await sqlite.execute({\n sql: `INSERT INTO connections\n (user_id, val_id, val_slug, repo, branch, direction, vt_token, gh_token, installation_id, webhook_secret, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n c.user_id, c.val_id, c.val_slug, c.repo, c.branch, c.direction,\n c.vt_token, c.gh_token, c.installation_id, c.webhook_secret, now(),\n ],\n });\n return Number(rs.lastInsertRowid);\n}\n\nexport async function getConnection(id: number): Promise {\n const rs = await sqlite.execute({ sql: `SELECT * FROM connections WHERE id = ?`, args: [id] });\n return asObjects(rs)[0] ?? null;\n}\n\nexport async function listConnections(userId?: string): Promise {\n const rs = userId\n ? await sqlite.execute({\n sql: `SELECT * FROM connections WHERE user_id = ? OR user_id = 'dev' ORDER BY id DESC`,\n args: [userId],\n })\n : await sqlite.execute(`SELECT * FROM connections ORDER BY id DESC`);\n return asObjects(rs);\n}\n\nexport async function connectionsForRepo(repo: string, direction: string): Promise {\n const rs = await sqlite.execute({\n sql: `SELECT * FROM connections WHERE repo = ? AND direction = ?`,\n args: [repo, direction],\n });\n return asObjects(rs);\n}\n\nexport async function valtownSourceConnections(): Promise {\n const rs = await sqlite.execute(`SELECT * FROM connections WHERE direction = 'valtown'`);\n return asObjects(rs);\n}\n\nexport async function updateSyncResult(id: number, result: string) {\n await sqlite.execute({\n sql: `UPDATE connections SET last_sync_at = ?, last_result = ? WHERE id = ?`,\n args: [now(), result.slice(0, 500), id],\n });\n}\n\nexport async function deleteConnection(id: number) {\n await sqlite.execute({ sql: `DELETE FROM events WHERE connection_id = ?`, args: [id] });\n await sqlite.execute({ sql: `DELETE FROM connections WHERE id = ?`, args: [id] });\n}\n\nexport async function recordEvent(connectionId: number, kind: string, detail: string) {\n await sqlite.execute({\n sql: `INSERT INTO events (connection_id, ts, kind, detail) VALUES (?, ?, ?, ?)`,\n args: [connectionId, now(), kind, detail.slice(0, 2000)],\n });\n}\n\nexport async function recentEvents(connectionId: number, limit = 20): Promise {\n const rs = await sqlite.execute({\n sql: `SELECT * FROM events WHERE connection_id = ? ORDER BY id DESC LIMIT ?`,\n args: [connectionId, limit],\n });\n return asObjects(rs);\n}\n",[152],"adc555d1-ea1f-430d-bd12-e5ac34c0a6b5","cron.ts","2f515804-66bf-11f1-978b-1607ee4eb77e",18,["D",1781310674370],"interval","import { recordEvent, updateSyncResult, valtownSourceConnections } from \"./db.ts\";\nimport { pushValToRepo } from \"./sync/valToGh.ts\";\n\n// Sweep every Val-Town-as-source connection. Unchanged connections cost 3 GitHub\n// reads and make no commit, so a tight schedule is safe.\nexport default async function () {\n const conns = await valtownSourceConnections();\n for (const conn of conns) {\n try {\n const result = await pushValToRepo(conn);\n await updateSyncResult(conn.id, result);\n if (!result.startsWith(\"up to date\")) {\n await recordEvent(conn.id, \"cron-push\", result);\n }\n console.log(`#${conn.id} ${conn.val_slug} -> ${conn.repo}: ${result}`);\n } catch (e) {\n await updateSyncResult(conn.id, `error: ${e.message}`);\n await recordEvent(conn.id, \"error\", e.message);\n console.error(`#${conn.id} ${conn.val_slug} -> ${conn.repo}: ${e.message}`);\n }\n }\n}\n",[158],"d25d8243-102b-4033-8c4c-94f98e2141a9",["D",1781368588010],1,[29],"01883c4f-34bd-4b69-8965-d7ff4e9f4a95","_diag.ts","a52e6216-6745-11f1-a0f1-1607ee4eb77e",41,["D",1781368424674],"import { sharedApp } from \"./lib/app.ts\";\nimport { appJwt, gh, installationToken } from \"./lib/github.ts\";\n\nconst app = sharedApp();\nconst jwt = appJwt(app.app_id, app.pem);\nconst info = await gh(jwt, \"/app\");\nconsole.log(JSON.stringify({\n envSlug: app.slug,\n appName: info.name,\n appSlug: info.slug,\n owner: info.owner?.login,\n ownerType: info.owner?.type,\n installs: info.installations_count,\n}));\nconst insts = await gh(jwt, \"/app/installations\");\nfor (const i of insts) {\n const tok = await installationToken({ app_id: app.app_id, pem: app.pem }, i.id);\n const repos = await gh(tok, \"/installation/repositories\");\n console.log(JSON.stringify({\n installation_id: i.id,\n account: i.account?.login,\n selection: i.repository_selection,\n repos: (repos.repositories ?? []).map((r: any) => r.full_name),\n }));\n}\n",[170],"58e38e4c-86dc-4f95-af0c-a6f17f555f4a","README.md","44204278-66be-11f1-b28c-1607ee4eb77e",37,["D",1781354661628],4,"# githubsync\n\nHosted GitHub <-> Val Town sync service prototype. Connect a val to a GitHub repo;\nwe keep them in sync.\n\n## How it works\n\nEach connection pairs one val with one repo and names exactly one side the source of truth:\n\n- GitHub as source: a push webhook mirrors added/modified/removed files into the val.\n Force pushes and 20+-commit pushes fall back to a full tree sync (including deletes).\n- Val Town as source: a 1-minute cron diffs the val's files against the repo HEAD by\n computing git blob shas locally and pushes one commit per change set. No diff, no commit.\n\n## Onboarding flow\n\n1. Sign in with Val Town (`/auth/login`, std/oauth with the `project_rw` scope).\n2. Install the shared GitHub App: `/github/install` redirects to\n `https://github.com/apps//installations/new`. After install, GitHub\n redirects back to `/github/setup?installation_id=...`, which records the installation.\n A pasted GitHub token is the labeled dev fallback.\n3. Pick a val, a repo, a branch, and a source of truth; Connect a repo runs the initial\n backfill and shows a status page with recent events and a Resync button.\n\n## The shared GitHub App\n\nThere is ONE GitHub App that all users install (not one per user). Its credentials live\nin `GH_APP_*` env vars, which are the single source of truth (`lib/app.ts` -> `sharedApp()`).\nInstallation tokens for sync are minted with `installationToken(sharedApp(), installation_id)`\nand the webhook HMAC is verified against `GH_APP_WEBHOOK_SECRET`.\n\nCreating a brand-new app (operator-only, rarely needed) still lives behind\n`/github/new-app` + `/github/manifest-callback`, guarded by `DEV_SECRET`. After creating\none, copy its credentials into the `GH_APP_*` env vars to promote it.\n\n## Dev mode\n\n`POST /dev/connect` with `Authorization: Bearer $DEV_SECRET` and JSON\n`{val, repo, direction, vt_token, gh_token, branch?, register_webhook?}` creates a\nconnection without the browser flows. Token values of the form `env:NAME` resolve\nfrom this val's environment at use time and never land in the database.\n\n## Environment variables\n\n- `OAUTH_STATE_ENCRYPTION_KEY` - required by std/oauth\n- `DEV_SECRET` - bearer token guarding `/dev/*` and the operator-only `/github/new-app`\n- `VT_DEV_TOKEN`, `GITHUB_DEV_TOKEN` - dev-mode credentials referenced as `env:` tokens\n- `GH_APP_ID`, `GH_APP_SLUG`, `GH_APP_CLIENT_ID`, `GH_APP_CLIENT_SECRET`,\n `GH_APP_WEBHOOK_SECRET`, `GH_APP_PEM` - the shared GitHub App (single source of truth)\n\n## File map\n\n- `index.tsx` - HTTP entrypoint: oauth middleware + routes + dashboard\n- `cron.ts` - 1-minute sweep of Val-Town-as-source connections\n- `db.ts` - SQLite schema (users, apps, installations, connections, events) + queries\n- `lib/app.ts` - the shared GitHub App from `GH_APP_*` env vars (`sharedApp()`, `installUrl()`)\n- `lib/github.ts` - GitHub API, app JWT (PKCS#1 pem via node:crypto), blob sha, webhook registration\n- `lib/valtown.ts` - Val Town v2 API: list/read/upsert/delete val files\n- `lib/creds.ts` - env-token resolution, per-connection credential lookup, dev auth\n- `sync/ghToVal.ts` - incremental (webhook payload) and full (tree) repo-to-val sync\n- `sync/valToGh.ts` - blob-sha diff, one-commit val-to-repo push\n- `routes/` - webhook, dev API, connections CRUD, GitHub App install/setup (+ operator create)\n- `views/` - Layout, Landing, Dashboard, Status (Hono JSX + Tailwind)\n\n## Known limits (prototype)\n\n- Text files only; >80k-char files skipped (Val Town file API limit); only one branch per connection.\n- New val files arrive as type `script`/`file`; trigger types need setting once by hand.\n- OAuth access tokens stored at connect time are not yet refreshed when they expire;\n the refresh-token flow is the next step. Dev-mode `env:` tokens do not expire.\n- The webhook on a repo is not removed when a connection is deleted.\n",[177],"5ef8c3f2-ec35-42b8-acec-e06fd75aa810","views","8439d568-2859-4034-9d9d-dda5df5c702e",10,["D",1781310591315],"directory",[185],"0f97f978-6838-46a4-abf2-05b0c4751b4a","sync","91476b4f-e132-4c92-bb12-67166e8574f5",6,["D",1781310546326],[192],"6a03e418-b02f-44a1-8e11-2ad90bc19cbf","routes","165a136c-f6d1-45c0-99f2-259223c2e53a",8,["D",1781310572920],[198],"9c70151a-a2a2-4ce0-b510-626634ee1fe5","lib","640e6044-ddfa-454d-bb57-f42fb8b69d43",3,["D",1781310508175],[204],"pulls","branches","forks","envVars",{"_216":187,"_218":63},"connections",{"_216":63,"_217":63},"count","unfilledCount","emptyCount",{"_44":203,"_33":204,"_31":205,"_142":-5,"_42":43,"_41":206,"_144":25,"_39":380,"_13":63,"_34":189,"_36":-5,"_24":27,"_149":-5,"_244":381,"_28":382},{"_44":372,"_33":373,"_31":374,"_142":205,"_42":43,"_41":375,"_144":25,"_39":376,"_13":63,"_34":35,"_36":377,"_24":27,"_149":-5,"_244":378,"_28":379},{"_44":364,"_33":365,"_31":366,"_142":205,"_42":43,"_41":367,"_144":25,"_39":368,"_13":146,"_34":35,"_36":369,"_24":27,"_149":-5,"_244":370,"_28":371},{"_44":357,"_33":358,"_31":359,"_142":205,"_42":43,"_41":206,"_144":25,"_39":360,"_13":63,"_34":35,"_36":361,"_24":27,"_149":-5,"_244":362,"_28":363},{"_44":350,"_33":351,"_31":352,"_142":205,"_42":43,"_41":181,"_144":25,"_39":353,"_13":63,"_34":35,"_36":354,"_24":27,"_149":-5,"_244":355,"_28":356},{"_44":197,"_33":198,"_31":199,"_142":-5,"_42":43,"_41":200,"_144":25,"_39":347,"_13":63,"_34":189,"_36":-5,"_24":27,"_149":-5,"_244":348,"_28":349},{"_44":339,"_33":340,"_31":341,"_142":199,"_42":43,"_41":342,"_144":25,"_39":343,"_13":63,"_34":35,"_36":344,"_24":27,"_149":-5,"_244":345,"_28":346},{"_44":331,"_33":332,"_31":333,"_142":199,"_42":43,"_41":334,"_144":25,"_39":335,"_13":63,"_34":35,"_36":336,"_24":27,"_149":-5,"_244":337,"_28":338},{"_44":323,"_33":324,"_31":325,"_142":199,"_42":43,"_41":326,"_144":25,"_39":327,"_13":167,"_34":35,"_36":328,"_24":27,"_149":-5,"_244":329,"_28":330},{"_44":315,"_33":316,"_31":317,"_142":199,"_42":43,"_41":318,"_144":25,"_39":319,"_13":146,"_34":35,"_36":320,"_24":27,"_149":-5,"_244":321,"_28":322},{"_44":191,"_33":192,"_31":193,"_142":-5,"_42":43,"_41":194,"_144":25,"_39":312,"_13":63,"_34":189,"_36":-5,"_24":27,"_149":-5,"_244":313,"_28":314},{"_44":305,"_33":306,"_31":307,"_142":193,"_42":43,"_41":194,"_144":25,"_39":308,"_13":63,"_34":35,"_36":309,"_24":27,"_149":-5,"_244":310,"_28":311},{"_44":297,"_33":298,"_31":299,"_142":193,"_42":43,"_41":300,"_144":25,"_39":301,"_13":63,"_34":35,"_36":302,"_24":27,"_149":-5,"_244":303,"_28":304},{"_44":184,"_33":185,"_31":186,"_142":-5,"_42":43,"_41":187,"_144":25,"_39":294,"_13":63,"_34":189,"_36":-5,"_24":27,"_149":-5,"_244":295,"_28":296},{"_44":285,"_33":286,"_31":287,"_142":186,"_42":43,"_41":288,"_144":25,"_39":289,"_13":290,"_34":35,"_36":291,"_24":27,"_149":-5,"_244":292,"_28":293},{"_44":277,"_33":278,"_31":279,"_142":186,"_42":43,"_41":280,"_144":25,"_39":281,"_13":167,"_34":35,"_36":282,"_24":27,"_149":-5,"_244":283,"_28":284},{"_44":270,"_33":271,"_31":272,"_142":186,"_42":43,"_41":187,"_144":25,"_39":273,"_13":63,"_34":35,"_36":274,"_24":27,"_149":-5,"_244":275,"_28":276},{"_44":262,"_33":263,"_31":264,"_142":186,"_42":43,"_41":265,"_144":25,"_39":266,"_13":63,"_34":35,"_36":267,"_24":27,"_149":-5,"_244":268,"_28":269},{"_44":176,"_33":177,"_31":178,"_142":-5,"_42":43,"_41":179,"_144":27,"_39":259,"_13":181,"_34":20,"_36":182,"_24":27,"_149":-5,"_244":260,"_28":261},{"_44":169,"_33":170,"_31":171,"_142":-5,"_42":43,"_41":172,"_144":27,"_39":256,"_13":63,"_34":35,"_36":174,"_24":27,"_149":-5,"_244":257,"_28":258},{"_44":165,"_33":29,"_31":32,"_142":-5,"_42":43,"_41":14,"_144":27,"_39":253,"_13":167,"_34":35,"_36":38,"_24":27,"_149":-5,"_244":254,"_28":255},{"_44":157,"_33":158,"_31":159,"_142":-5,"_42":43,"_41":160,"_144":25,"_39":250,"_13":63,"_34":162,"_36":163,"_24":27,"_149":-5,"_244":251,"_28":252},{"_44":151,"_33":152,"_31":153,"_142":-5,"_42":43,"_41":146,"_144":25,"_39":247,"_13":63,"_34":35,"_36":155,"_24":27,"_149":-5,"_244":248,"_28":249},{"_44":140,"_33":141,"_31":58,"_142":-5,"_42":43,"_41":143,"_144":25,"_39":243,"_13":146,"_34":147,"_36":148,"_24":27,"_149":-5,"_244":245,"_28":246},["D",1781354605238],"children",[],[141],["D",1781310494158],[],[152],["D",1781310674370],[],[158],["D",1781368588010],[],[29],["D",1781368424674],[],[170],["D",1781354661628],[],[177],"a51b9b38-650e-4aa9-ac36-1700d726cdce","Status.tsx","12c88f04-66bf-11f1-8e28-1607ee4eb77e",13,["D",1781310626501],"/** @jsxImportSource npm:hono@4/jsx */\nimport type { Connection, SyncEvent } from \"../db.ts\";\n\nexport default function Status({ conn, events }: { conn: Connection; events: SyncEvent[] }) {\n const source = conn.direction === \"github\" ? \"GitHub\" : \"Val Town\";\n return (\n

\n {conn.val_slug} and {conn.repo}\n

\n Source of truth: {source}. Branch: {conn.branch}.\n

\n Last sync: {conn.last_sync_at ?? \"never\"} - {conn.last_result ?? \"no result yet\"}\n

\n\n

\n \n \n

\n\n

Recent events

\n {events.length === 0 ?

No events yet.

: (\n \n \n \n \n \n \n \n \n \n {events.map((e) => (\n \n \n \n \n \n ))}\n \n

Time	Kind	Detail
{e.ts}	{e.kind}	{e.detail}

\n )}\n

\n );\n}\n",[],[185,263],"b8a6320f-99c6-4b7d-b12c-7d7d0187580f","Layout.tsx","fdef2796-66be-11f1-b28c-1607ee4eb77e",["D",1781310591315],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport default function Layout({ title, children }: { title: string; children?: unknown }) {\n return (\n \n \n \n \n {title}\n \n \n \n

\n githubsync\n GitHub and Val Town, in sync\n

\n {children}\n

\n \n \n );\n}\n",[],[185,271],"2212350e-a506-48df-a227-ff033fd82052","Landing.tsx","00805520-66bf-11f1-8aa2-1607ee4eb77e",33,["D",1781354638184],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport default function Landing() {\n return (\n

\n Connect a val to a GitHub repo. We keep them in sync.\n

\n Pick a val, pick a repo, pick which side is the source of truth. Pushes to the repo\n land in the val within seconds; edits to the val land in the repo as clean commits.\n

\n \n Sign in with Val Town\n \n

Sign in with Val Town (grants the API access we sync with)
Install the GitHub App on the repos you want to sync
Pick a val, a repo, and a direction - then connect a repo

\n );\n}\n",[],[185,278],"3e18a2f3-3274-49ce-9065-5a61ed4cb278","Dashboard.tsx","0ecf4bf4-66bf-11f1-bfe7-1607ee4eb77e",32,["D",1781354633103],5,"/** @jsxImportSource npm:hono@4/jsx */\nimport type { Connection } from \"../db.ts\";\n\nfunction ConnectionRow({ conn }: { conn: Connection }) {\n const arrow = conn.direction === \"github\" ? \"repo to val\" : \"val to repo\";\n return (\n \n \n {conn.val_slug}\n \n {conn.repo}\n {arrow}\n {conn.last_result ?? \"never synced\"}\n \n );\n}\n\nexport default function Dashboard(props: {\n username: string;\n vals: string[];\n valsError: string | null;\n connections: Connection[];\n appSlug: string | null;\n installations: { installation_id: number }[];\n}) {\n const { username, vals, valsError, connections, appSlug, installations } = props;\n return (\n

\n Signed in as {username}\n

\n \n

\n\n

Connections

\n {connections.length === 0\n ?

No connections yet.

\n : (\n \n \n \n \n \n \n \n \n \n \n {connections.map((conn) => )}\n \n

Val	Repo	Direction	Last sync

\n )}\n

\n\n

GitHub

\n \n Install the GitHub App\n {\" \"}\n on the repos you want to sync. You grant it Contents read/write; we never ask for a\n personal access token.\n

\n Installations: {installations.length === 0\n ? \"none yet\"\n : installations.map((i) => String(i.installation_id)).join(\", \")}\n

\n\n

Connect a repo

\n Val\n {valsError\n ?

Could not list your vals: {valsError}. Log out and back in.

\n : (\n \n )}\n

\n GitHub repo (owner/name)\n \n

\n Branch\n \n

\n Source of truth\n \n {\" \"}\n GitHub - pushes to the repo overwrite the val\n \n \n {\" \"}\n Val Town - edits to the val are committed to the repo\n \n

\n {installations.length > 0 && (\n

\n GitHub App installation\n \n \n {installations.map((i) => (\n \n ))}\n \n

\n )}\n

\n \n GitHub token (dev fallback - used instead of the GitHub App; needs Contents\n read/write on the repo)\n \n \n

\n \n

\n );\n}\n",[],[185,286],["D",1781310591315],[233,234,235,236],[185],"0f4366d0-d3bb-4884-a5e6-c83013d50af6","valToGh.ts","e988f200-66be-11f1-bfe7-1607ee4eb77e",7,["D",1781310557274],"import { type Connection } from \"../db.ts\";\nimport { ghTokenFor, vtTokenFor } from \"../lib/creds.ts\";\nimport { gh, gitBlobSha, toBase64 } from \"../lib/github.ts\";\nimport { listValFiles, readValFileBytes } from \"../lib/valtown.ts\";\n\n// Diff the val's files against the repo HEAD by computing git blob shas locally;\n// push one commit covering all adds, edits, and deletions. No diff => no commit.\nexport async function pushValToRepo(conn: Connection): Promise {\n const vtToken = vtTokenFor(conn);\n const ghToken = await ghTokenFor(conn);\n const { repo, branch } = conn;\n\n const files = await listValFiles(vtToken, conn.val_id);\n const entries = await Promise.all(\n files.map(async (f) => {\n const bytes = await readValFileBytes(vtToken, conn.val_id, f.path);\n return { path: f.path, bytes, sha: await gitBlobSha(bytes) };\n }),\n );\n\n const ref = await gh(ghToken, `/repos/${repo}/git/ref/heads/${branch}`);\n const headSha: string = ref.object.sha;\n const headCommit = await gh(ghToken, `/repos/${repo}/git/commits/${headSha}`);\n const headTree = await gh(ghToken, `/repos/${repo}/git/trees/${headCommit.tree.sha}?recursive=1`);\n if (headTree.truncated) throw new Error(\"repo tree truncated - cannot diff safely\");\n const repoShas = new Map(\n headTree.tree.filter((t: any) => t.type === \"blob\").map((t: any) => [t.path, t.sha]),\n );\n\n const changed = entries.filter((e) => repoShas.get(e.path) !== e.sha);\n const deleted = [...repoShas.keys()].filter((p) => !entries.some((e) => e.path === p));\n if (changed.length === 0 && deleted.length === 0) {\n return `up to date with ${repo}@${headSha.slice(0, 7)} - no commit`;\n }\n\n for (const e of changed) {\n const blob = await gh(ghToken, `/repos/${repo}/git/blobs`, {\n method: \"POST\",\n body: JSON.stringify({ content: toBase64(e.bytes), encoding: \"base64\" }),\n });\n if (blob.sha !== e.sha) {\n throw new Error(`blob sha mismatch for ${e.path}: ${blob.sha} != ${e.sha}`);\n }\n }\n\n // Full tree, no base_tree: omitted paths are deletions.\n const tree = await gh(ghToken, `/repos/${repo}/git/trees`, {\n method: \"POST\",\n body: JSON.stringify({\n tree: entries.map((e) => ({ path: e.path, mode: \"100644\", type: \"blob\", sha: e.sha })),\n }),\n });\n\n const summary = `githubsync: ${changed.length} changed, ${deleted.length} deleted`;\n const commit = await gh(ghToken, `/repos/${repo}/git/commits`, {\n method: \"POST\",\n body: JSON.stringify({\n message: `${summary}\\n\\nsource: https://www.val.town/x/${conn.val_slug}`,\n tree: tree.sha,\n parents: [headSha],\n }),\n });\n // force:false — a concurrent push 422s here and the next run recovers.\n await gh(ghToken, `/repos/${repo}/git/refs/heads/${branch}`, {\n method: \"PATCH\",\n body: JSON.stringify({ sha: commit.sha, force: false }),\n });\n return `pushed ${commit.sha.slice(0, 7)} to ${repo}@${branch}: ${summary}`;\n}\n",[],[192,298],"194c3ea0-9712-4b89-be22-ccdb5a89e5e2","ghToVal.ts","e2febbea-66be-11f1-9f5d-1607ee4eb77e",["D",1781310546326],"import { type Connection } from \"../db.ts\";\nimport { ghTokenFor, vtTokenFor } from \"../lib/creds.ts\";\nimport { fetchRepoFile, fetchRepoTree } from \"../lib/github.ts\";\nimport { deleteValFile, listValFiles, upsertValFile } from \"../lib/valtown.ts\";\n\nconst SKIP_PREFIXES = [\".github/\"];\nconst shouldSkip = (path: string) => SKIP_PREFIXES.some((p) => path.startsWith(p));\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nasync function syncOneFile(\n vtToken: string,\n ghToken: string,\n conn: Connection,\n path: string,\n ref: string,\n): Promise {\n const bytes = await fetchRepoFile(ghToken, conn.repo, path, ref);\n let content: string;\n try {\n content = decoder.decode(bytes); // throws on binary\n } catch {\n return `skipped (binary): ${path}`;\n }\n if (content.length > 80_000) return `skipped (>80k chars, API limit): ${path}`;\n await upsertValFile(vtToken, conn.val_id, path, content);\n return `synced: ${path}`;\n}\n\n// Fold the push payload's commit list in order so the final action per path wins.\nexport async function incrementalSync(conn: Connection, payload: any): Promise {\n const vtToken = vtTokenFor(conn);\n const ghToken = await ghTokenFor(conn);\n const actions = new Map();\n for (const commit of payload.commits) {\n for (const p of [...commit.added, ...commit.modified]) actions.set(p, \"upsert\");\n for (const p of commit.removed) actions.set(p, \"remove\");\n }\n const results: string[] = [];\n for (const [path, action] of actions) {\n if (shouldSkip(path)) {\n results.push(`skipped (rule): ${path}`);\n } else if (action === \"upsert\") {\n results.push(await syncOneFile(vtToken, ghToken, conn, path, payload.after));\n } else {\n await deleteValFile(vtToken, conn.val_id, path);\n results.push(`deleted: ${path}`);\n }\n }\n return results;\n}\n\n// Mirror the whole repo tree into the val, deleting val files not in the repo.\nexport async function fullSync(conn: Connection, ref?: string): Promise {\n const vtToken = vtTokenFor(conn);\n const ghToken = await ghTokenFor(conn);\n const r = ref ?? conn.branch;\n const repoPaths = (await fetchRepoTree(ghToken, conn.repo, r)).filter((p) => !shouldSkip(p));\n const results: string[] = [];\n for (const path of repoPaths) {\n results.push(await syncOneFile(vtToken, ghToken, conn, path, r));\n }\n const repoSet = new Set(repoPaths);\n const valFiles = await listValFiles(vtToken, conn.val_id);\n for (const { path } of valFiles) {\n if (!repoSet.has(path) && !shouldSkip(path)) {\n await deleteValFile(vtToken, conn.val_id, path);\n results.push(`deleted (not in repo): ${path}`);\n }\n }\n return results;\n}\n",[],[192,306],["D",1781310546326],[230,231],[192],"4d27136a-704d-4edc-af40-711880a25e0f","webhook.ts","f2da73c4-66be-11f1-aae1-1607ee4eb77e",24,["D",1781354574722],"import { Hono } from \"npm:hono@4\";\nimport { connectionsForRepo, recordEvent, updateSyncResult } from \"../db.ts\";\nimport { sharedApp } from \"../lib/app.ts\";\nimport { resolveSecret } from \"../lib/creds.ts\";\nimport { fullSync, incrementalSync } from \"../sync/ghToVal.ts\";\n\nasync function validSignature(\n secret: string,\n body: Uint8Array,\n sigHeader: string | null,\n): Promise {\n if (!sigHeader?.startsWith(\"sha256=\")) return false;\n const hex = sigHeader.slice(\"sha256=\".length);\n if (!/^[0-9a-f]{64}$/.test(hex)) return false;\n const sig = new Uint8Array(hex.match(/../g)!.map((b) => parseInt(b, 16)));\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"verify\"],\n );\n return await crypto.subtle.verify(\"HMAC\", key, sig, body); // timing-safe\n}\n\nconst webhook = new Hono();\n\nwebhook.post(\"/github\", async (c) => {\n const body = new Uint8Array(await c.req.arrayBuffer());\n const event = c.req.header(\"x-github-event\");\n if (event === \"ping\") return c.json({ ok: true, pong: true });\n if (event !== \"push\") return c.json({ ok: true, ignored: `event ${event}` });\n\n const payload = JSON.parse(new TextDecoder().decode(body));\n const repo = payload.repository?.full_name;\n if (!repo) return c.json({ ok: true, ignored: \"no repository in payload\" });\n\n const conns = await connectionsForRepo(repo, \"github\");\n if (conns.length === 0) return c.json({ ok: true, ignored: `no connections for ${repo}` });\n\n // Candidate secrets: each connection's repo-webhook secret (dev/PAT path) plus the\n // shared app's webhook secret (app installations deliver pushes via the app webhook).\n const sig = c.req.header(\"x-hub-signature-256\") ?? null;\n const secrets = conns.map((x) => resolveSecret(x.webhook_secret)).filter(Boolean) as string[];\n try {\n secrets.push(sharedApp().webhook_secret);\n } catch { /* shared app not configured; fall back to per-connection secrets */ }\n let verified = false;\n for (const s of secrets) {\n if (await validSignature(s, body, sig)) {\n verified = true;\n break;\n }\n }\n if (!verified) return c.text(\"bad signature\", 401);\n\n if (payload.deleted) return c.json({ ok: true, ignored: \"branch deletion\" });\n\n const results: Record = {};\n for (const conn of conns) {\n if (payload.ref !== `refs/heads/${conn.branch}`) {\n results[conn.id] = `ignored ref ${payload.ref} (only syncing ${conn.branch})`;\n continue;\n }\n try {\n // GitHub truncates the commits array at 20; force pushes rewrite history.\n const needFull = payload.forced || payload.commits.length >= 20;\n const r = needFull ? await fullSync(conn, payload.after) : await incrementalSync(conn, payload);\n await updateSyncResult(conn.id, `${needFull ? \"full\" : \"incremental\"} sync: ${r.length} files`);\n await recordEvent(\n conn.id,\n \"push\",\n JSON.stringify({ after: payload.after?.slice(0, 7), results: r }),\n );\n results[conn.id] = r;\n } catch (e) {\n await updateSyncResult(conn.id, `error: ${e.message}`);\n await recordEvent(conn.id, \"error\", e.message);\n results[conn.id] = `error: ${e.message}`;\n }\n }\n console.log(`push ${payload.after?.slice(0, 7)} to ${repo}:`, results);\n return c.json({ ok: true, results });\n});\n\nexport default webhook;\n",[],[198,316],"c6d37e26-5fc7-4645-86c0-2e693a713ef0","githubApp.tsx","26503bda-66bf-11f1-8863-1607ee4eb77e",25,["D",1781354593536],"/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { getOAuthUserData } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { insertApp, insertInstallation } from \"../db.ts\";\nimport { installUrl, sharedApp } from \"../lib/app.ts\";\nimport { devAuthorized } from \"../lib/creds.ts\";\n\nconst githubApp = new Hono();\n\n// Normal user path: install the ONE shared GitHub App on the repos you want to sync.\n// `state` is optional and round-trips back to /github/setup after install.\ngithubApp.get(\"/install\", (c) => {\n const state = c.req.query(\"state\") ?? undefined;\n return c.redirect(installUrl(state));\n});\n\n// Post-install redirect carries the installation id; tie it to the shared app.\ngithubApp.get(\"/setup\", async (c) => {\n const installationId = Number(c.req.query(\"installation_id\") || 0);\n if (installationId) {\n await insertInstallation(installationId, sharedApp().app_id);\n }\n return c.redirect(\"/\");\n});\n\n// ---------------------------------------------------------------------------\n// Operator-only, one-time: create a NEW GitHub App via the manifest flow. This\n// is NOT part of the normal user path — users install the shared app instead.\n// Guarded by DEV_SECRET so it isn't reachable from the public dashboard. After\n// running it once, promote the resulting app's credentials into the GH_APP_*\n// env vars (which are the single source of truth) by hand.\n// ---------------------------------------------------------------------------\ngithubApp.get(\"/new-app\", (c) => {\n if (!devAuthorized(c.req.raw)) return c.text(\"unauthorized (operator-only route)\", 401);\n const origin = new URL(c.req.url).origin;\n const manifest = JSON.stringify({\n name: `valtown-sync-${crypto.randomUUID().slice(0, 6)}`,\n url: origin,\n hook_attributes: { url: `${origin}/webhook/github`, active: true },\n redirect_url: `${origin}/github/manifest-callback`,\n setup_url: `${origin}/github/setup`,\n public: false,\n default_events: [\"push\"],\n default_permissions: { contents: \"write\" },\n });\n // Returns a tiny auto-submitting form so the operator can POST the manifest.\n return c.html(\n \n \n \n \n ,\n );\n});\n\ngithubApp.get(\"/manifest-callback\", async (c) => {\n const code = c.req.query(\"code\");\n if (!code) return c.text(\"missing code\", 400);\n const res = await fetch(`https://api.github.com/app-manifests/${code}/conversions`, {\n method: \"POST\",\n headers: { Accept: \"application/vnd.github+json\", \"User-Agent\": \"githubsync-val\" },\n });\n if (!res.ok) return c.text(`manifest conversion failed: ${res.status} ${await res.text()}`, 500);\n const a = await res.json();\n const session = await getOAuthUserData(c.req.raw);\n // Stored in the DB for reference only; the GH_APP_* env vars remain the source\n // of truth. The operator must copy these into the env vars to promote the app.\n await insertApp({\n app_id: a.id,\n slug: a.slug,\n client_id: a.client_id,\n client_secret: a.client_secret,\n webhook_secret: a.webhook_secret,\n pem: a.pem,\n owner_user_id: session?.user?.id ?? null,\n });\n return c.text(\n `App created: id=${a.id} slug=${a.slug}. Promote these into the GH_APP_* env vars, ` +\n `then install via /github/install.`,\n );\n});\n\nexport default githubApp;\n",[],[198,324],"51d120f1-e985-4b8e-a0fd-9bb83af9c6d6","dev.ts","f85353de-66be-11f1-bdd6-1607ee4eb77e",9,["D",1781310582110],"import { Hono } from \"npm:hono@4\";\nimport { getConnection, insertConnection, recordEvent, updateSyncResult } from \"../db.ts\";\nimport { devAuthorized, ghTokenFor, resolveSecret } from \"../lib/creds.ts\";\nimport { registerPushWebhook } from \"../lib/github.ts\";\nimport { getValId } from \"../lib/valtown.ts\";\nimport { fullSync } from \"../sync/ghToVal.ts\";\nimport { pushValToRepo } from \"../sync/valToGh.ts\";\n\n// Dev-mode API: create a connection without the browser OAuth + GitHub App flow.\n// Auth: Authorization: Bearer . Tokens may be passed as \"env:NAME\" to\n// resolve from this val's environment so they never land in the database.\nconst dev = new Hono();\n\ndev.post(\"/connect\", async (c) => {\n if (!devAuthorized(c.req.raw)) return c.text(\"unauthorized\", 401);\n const b = await c.req.json();\n for (const field of [\"val\", \"repo\", \"direction\", \"vt_token\"]) {\n if (!b[field]) return c.json({ error: `missing ${field}` }, 400);\n }\n const vtToken = resolveSecret(b.vt_token);\n if (!vtToken) return c.json({ error: \"vt_token did not resolve\" }, 400);\n const valId = await getValId(vtToken, b.val);\n const webhookSecret = crypto.randomUUID().replaceAll(\"-\", \"\");\n const id = await insertConnection({\n user_id: \"dev\",\n val_id: valId,\n val_slug: b.val,\n repo: b.repo,\n branch: b.branch ?? \"main\",\n direction: b.direction,\n vt_token: b.vt_token,\n gh_token: b.gh_token ?? null,\n installation_id: b.installation_id ?? null,\n webhook_secret: webhookSecret,\n });\n const conn = (await getConnection(id))!;\n\n let hookId: number | null = null;\n if (b.direction === \"github\" && b.register_webhook !== false) {\n const url = `${new URL(c.req.url).origin}/webhook/github`;\n hookId = (await registerPushWebhook(await ghTokenFor(conn), b.repo, url, webhookSecret)).id;\n }\n\n let backfill: unknown;\n try {\n backfill = b.direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(id, \"backfill ok\");\n await recordEvent(id, \"backfill\", JSON.stringify(backfill));\n } catch (e) {\n backfill = `error: ${e.message}`;\n await updateSyncResult(id, `backfill error: ${e.message}`);\n await recordEvent(id, \"error\", e.message);\n }\n return c.json({ id, hookId, backfill });\n});\n\nexport default dev;\n",[],[198,332],"c91b7956-89cf-4b95-bfe1-edc08c61b6c9","connections.tsx","2125abd6-66bf-11f1-a63a-1607ee4eb77e",15,["D",1781310650599],"/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { getOAuthUserData } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport {\n deleteConnection,\n getConnection,\n insertConnection,\n recentEvents,\n recordEvent,\n updateSyncResult,\n} from \"../db.ts\";\nimport { devAuthorized, ghTokenFor } from \"../lib/creds.ts\";\nimport { registerPushWebhook } from \"../lib/github.ts\";\nimport { getValId } from \"../lib/valtown.ts\";\nimport { fullSync } from \"../sync/ghToVal.ts\";\nimport { pushValToRepo } from \"../sync/valToGh.ts\";\nimport Layout from \"../views/Layout.tsx\";\nimport Status from \"../views/Status.tsx\";\n\nconst connections = new Hono();\n\nasync function authorizedFor(c: any, connUserId: string): Promise {\n if (devAuthorized(c.req.raw)) return true;\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return false;\n return connUserId === \"dev\" || connUserId === session.user.id;\n}\n\n// Create a connection from the dashboard form.\nconnections.post(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return c.redirect(\"/\");\n const form = await c.req.formData();\n const val = String(form.get(\"val\") ?? \"\");\n const repo = String(form.get(\"repo\") ?? \"\");\n const direction = String(form.get(\"direction\") ?? \"github\") as \"github\" | \"valtown\";\n const branch = String(form.get(\"branch\") || \"main\");\n const ghToken = String(form.get(\"gh_token\") ?? \"\");\n const installationId = Number(form.get(\"installation_id\") || 0) || null;\n\n const token = session.accessToken;\n const valId = await getValId(token, val);\n const webhookSecret = crypto.randomUUID().replaceAll(\"-\", \"\");\n const id = await insertConnection({\n user_id: session.user.id,\n val_id: valId,\n val_slug: val,\n repo,\n branch,\n direction,\n vt_token: token,\n gh_token: ghToken || null,\n installation_id: installationId,\n webhook_secret: webhookSecret,\n });\n const conn = (await getConnection(id))!;\n\n // App installations deliver pushes via the app-level webhook; a pasted token needs a repo hook.\n if (direction === \"github\" && ghToken) {\n await registerPushWebhook(\n await ghTokenFor(conn),\n repo,\n `${new URL(c.req.url).origin}/webhook/github`,\n webhookSecret,\n );\n }\n\n try {\n const backfill = direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(id, \"backfill ok\");\n await recordEvent(id, \"backfill\", JSON.stringify(backfill));\n } catch (e) {\n await updateSyncResult(id, `backfill error: ${e.message}`);\n await recordEvent(id, \"error\", e.message);\n }\n return c.redirect(`/connections/${id}`);\n});\n\nconnections.get(\"/:id\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.redirect(\"/\");\n const events = await recentEvents(conn.id);\n return c.html(\n \n \n ,\n );\n});\n\nconnections.post(\"/:id/resync\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.text(\"unauthorized\", 401);\n let result: unknown;\n try {\n result = conn.direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(conn.id, \"manual resync ok\");\n await recordEvent(conn.id, \"resync\", JSON.stringify(result));\n } catch (e) {\n result = `error: ${e.message}`;\n await updateSyncResult(conn.id, `resync error: ${e.message}`);\n await recordEvent(conn.id, \"error\", e.message);\n }\n if (devAuthorized(c.req.raw)) return c.json({ id: conn.id, result });\n return c.redirect(`/connections/${conn.id}`);\n});\n\nconnections.post(\"/:id/delete\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.text(\"unauthorized\", 401);\n await deleteConnection(conn.id);\n if (devAuthorized(c.req.raw)) return c.json({ deleted: conn.id });\n return c.redirect(\"/\");\n});\n\nexport default connections;\n",[],[198,340],["D",1781310572920],[225,226,227,228],[198],"d7918672-98d4-40bb-9cb1-0abbca6de573","valtown.ts","d6048f50-66be-11f1-8d6e-1607ee4eb77e",["D",1781310524554],"const VT_API = \"https://api.val.town\";\n\nasync function vt(\n token: string,\n method: string,\n pathAndQuery: string,\n body?: unknown,\n): Promise {\n return await fetch(`${VT_API}${pathAndQuery}`, {\n method,\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n}\n\nasync function vtJson(token: string, method: string, pathAndQuery: string, body?: unknown) {\n const res = await vt(token, method, pathAndQuery, body);\n if (!res.ok) {\n throw new Error(\n `Val Town ${method} ${pathAndQuery} -> ${res.status}: ${(await res.text()).slice(0, 300)}`,\n );\n }\n return res.json();\n}\n\nexport async function getValId(token: string, slug: string): Promise {\n const [handle, name] = slug.split(\"/\");\n if (!handle || !name) throw new Error(`bad val slug: ${slug} (expected handle/name)`);\n return (await vtJson(token, \"GET\", `/v2/alias/vals/${handle}/${name}`)).id;\n}\n\nexport async function listMyVals(token: string): Promise {\n const slugs: string[] = [];\n for (let offset = 0;; offset += 100) {\n const { data } = await vtJson(token, \"GET\", `/v2/me/vals?limit=100&offset=${offset}`);\n for (const v of data) slugs.push(`${v.author.username}/${v.name}`);\n if (data.length < 100) break;\n }\n return slugs;\n}\n\nexport async function listValFiles(token: string, valId: string): Promise<{ path: string }[]> {\n const files: { path: string; type: string }[] = [];\n for (let offset = 0;; offset += 100) {\n const { data } = await vtJson(\n token,\n \"GET\",\n `/v2/vals/${valId}/files?path=&recursive=true&limit=100&offset=${offset}`,\n );\n files.push(...data);\n if (data.length < 100) break;\n }\n return files.filter((f) => f.type !== \"directory\");\n}\n\nexport async function readValFileBytes(\n token: string,\n valId: string,\n path: string,\n): Promise {\n const res = await vt(token, \"GET\", `/v2/vals/${valId}/files/content?path=${encodeURIComponent(path)}`);\n if (!res.ok) throw new Error(`Val Town read ${path} -> ${res.status}`);\n return new Uint8Array(await res.arrayBuffer());\n}\n\n// PUT updates an existing file; on 404 create it (and parent directories) with POST.\nexport async function upsertValFile(token: string, valId: string, path: string, content: string) {\n const q = `?path=${encodeURIComponent(path)}`;\n const put = await vt(token, \"PUT\", `/v2/vals/${valId}/files${q}`, { content });\n if (put.ok) return;\n if (put.status !== 404) throw new Error(`PUT ${path}: ${put.status} ${await put.text()}`);\n const parts = path.split(\"/\");\n for (let i = 1; i < parts.length; i++) {\n const dir = parts.slice(0, i).join(\"/\");\n await vt(token, \"POST\", `/v2/vals/${valId}/files?path=${encodeURIComponent(dir)}`, {\n type: \"directory\",\n });\n }\n const type = /\\.(ts|tsx|js|jsx)$/.test(path) ? \"script\" : \"file\";\n const post = await vt(token, \"POST\", `/v2/vals/${valId}/files${q}`, { content, type });\n if (!post.ok) throw new Error(`POST ${path}: ${post.status} ${await post.text()}`);\n}\n\nexport async function deleteValFile(token: string, valId: string, path: string) {\n const res = await vt(\n token,\n \"DELETE\",\n `/v2/vals/${valId}/files?path=${encodeURIComponent(path)}&recursive=false`,\n );\n if (!res.ok && res.status !== 404) {\n throw new Error(`DELETE ${path}: ${res.status} ${await res.text()}`);\n }\n}\n",[],[204,351],"3e8cec39-311d-4c87-a4e1-ce28d00c5ab7","github.ts","cc420920-66be-11f1-86c9-1607ee4eb77e",["D",1781310508175],"import { createPrivateKey, createSign } from \"node:crypto\";\n\nconst GH_API = \"https://api.github.com\";\n\nexport async function gh(token: string, path: string, init: RequestInit = {}): Promise {\n const res = await fetch(`${GH_API}${path}`, {\n ...init,\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github+json\",\n \"Content-Type\": \"application/json\",\n \"X-GitHub-Api-Version\": \"2022-11-28\",\n \"User-Agent\": \"githubsync-val\",\n ...(init.headers ?? {}),\n },\n });\n if (!res.ok) {\n throw new Error(\n `GitHub ${init.method ?? \"GET\"} ${path} -> ${res.status}: ${(await res.text()).slice(0, 300)}`,\n );\n }\n return res.status === 204 ? null : res.json();\n}\n\nexport async function fetchRepoFile(\n token: string,\n repo: string,\n path: string,\n ref: string,\n): Promise {\n const encPath = path.split(\"/\").map(encodeURIComponent).join(\"/\");\n const res = await fetch(`${GH_API}/repos/${repo}/contents/${encPath}?ref=${ref}`, {\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github.raw+json\",\n \"User-Agent\": \"githubsync-val\",\n },\n });\n if (!res.ok) throw new Error(`GitHub file ${repo}/${path}@${ref} -> ${res.status}`);\n return new Uint8Array(await res.arrayBuffer());\n}\n\nexport async function fetchRepoTree(token: string, repo: string, ref: string): Promise {\n const tree = await gh(token, `/repos/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=1`);\n if (tree.truncated) throw new Error(\"Repo tree truncated - repo too large for full sync\");\n return tree.tree\n .filter((e: { type: string }) => e.type === \"blob\")\n .map((e: { path: string }) => e.path);\n}\n\nexport async function registerPushWebhook(token: string, repo: string, url: string, secret: string) {\n return await gh(token, `/repos/${repo}/hooks`, {\n method: \"POST\",\n body: JSON.stringify({\n name: \"web\",\n active: true,\n events: [\"push\"],\n config: { url, content_type: \"json\", secret },\n }),\n });\n}\n\n// sha1(\"blob \\0\" + bytes) — git blob sha, computed locally for diffing\nexport async function gitBlobSha(bytes: Uint8Array): Promise {\n const header = new TextEncoder().encode(`blob ${bytes.length}\\0`);\n const buf = new Uint8Array(header.length + bytes.length);\n buf.set(header);\n buf.set(bytes, header.length);\n const digest = await crypto.subtle.digest(\"SHA-1\", buf);\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function toBase64(bytes: Uint8Array): string {\n let bin = \"\";\n for (let i = 0; i < bytes.length; i += 0x8000) {\n bin += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n }\n return btoa(bin);\n}\n\nfunction b64url(input: string | Uint8Array): string {\n const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n}\n\n// GitHub App JWT. The manifest-conversion pem is PKCS#1; node:crypto accepts it as-is.\nexport function appJwt(appId: number | string, pem: string): string {\n const nowSec = Math.floor(Date.now() / 1000);\n const header = b64url(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" }));\n const payload = b64url(JSON.stringify({ iat: nowSec - 60, exp: nowSec + 540, iss: String(appId) }));\n const signer = createSign(\"RSA-SHA256\");\n signer.update(`${header}.${payload}`);\n const sig = signer.sign(createPrivateKey(pem));\n return `${header}.${payload}.${b64url(new Uint8Array(sig))}`;\n}\n\nexport async function installationToken(\n app: { app_id: number; pem: string },\n installationId: number,\n): Promise {\n const jwt = appJwt(app.app_id, app.pem);\n const res = await fetch(`${GH_API}/app/installations/${installationId}/access_tokens`, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${jwt}`,\n Accept: \"application/vnd.github+json\",\n \"User-Agent\": \"githubsync-val\",\n },\n });\n if (!res.ok) throw new Error(`installation token -> ${res.status}: ${await res.text()}`);\n return (await res.json()).token;\n}\n",[],[204,358],"aa825a9f-69c9-4948-8afd-54a51acafe08","creds.ts","d8b32ad6-66be-11f1-82b8-1607ee4eb77e",22,["D",1781354566309],"import { type Connection } from \"../db.ts\";\nimport { sharedApp } from \"./app.ts\";\nimport { installationToken } from \"./github.ts\";\n\n// Secrets stored as \"env:NAME\" resolve from this val's environment at use time,\n// so dev-mode tokens never live in the database.\nexport function resolveSecret(v: string | null | undefined): string | undefined {\n if (!v) return undefined;\n return v.startsWith(\"env:\") ? Deno.env.get(v.slice(4)) : v;\n}\n\nexport function vtTokenFor(conn: Connection): string {\n const t = resolveSecret(conn.vt_token);\n if (!t) throw new Error(`connection ${conn.id}: missing Val Town token`);\n return t;\n}\n\nexport async function ghTokenFor(conn: Connection): Promise {\n const pat = resolveSecret(conn.gh_token);\n if (pat) return pat;\n if (conn.installation_id) {\n return await installationToken(sharedApp(), conn.installation_id);\n }\n throw new Error(`connection ${conn.id}: no GitHub credential`);\n}\n\nexport function devAuthorized(req: Request): boolean {\n const secret = Deno.env.get(\"DEV_SECRET\");\n return !!secret && req.headers.get(\"authorization\") === `Bearer ${secret}`;\n}\n",[],[204,365],"11388e0a-e238-4fc5-afbf-31da76112b59","app.ts","5d52c18c-6725-11f1-8a46-1607ee4eb77e",20,["D",1781354560229],"// The shared GitHub App is the single source of truth, configured via env vars.\n// Users INSTALL this one app on their repos; nobody creates their own app.\n// The per-app `apps` SQLite table is no longer the user-creation target — see\n// routes/githubApp.tsx for the (operator-only) legacy manifest-create path.\n\nexport type SharedApp = {\n app_id: number;\n slug: string;\n client_id: string;\n client_secret: string;\n webhook_secret: string;\n pem: string;\n};\n\nfunction reqEnv(key: string): string {\n const v = Deno.env.get(key);\n if (!v) throw new Error(`missing env var ${key} (shared GitHub App is not configured)`);\n return v;\n}\n\n/** The single shared GitHub App, read from GH_APP_* env vars. */\nexport function sharedApp(): SharedApp {\n return {\n app_id: Number(reqEnv(\"GH_APP_ID\")),\n slug: reqEnv(\"GH_APP_SLUG\"),\n client_id: reqEnv(\"GH_APP_CLIENT_ID\"),\n client_secret: reqEnv(\"GH_APP_CLIENT_SECRET\"),\n webhook_secret: reqEnv(\"GH_APP_WEBHOOK_SECRET\"),\n pem: reqEnv(\"GH_APP_PEM\"),\n };\n}\n\n/** The install URL users are sent to. `state` is optional and round-tripped back to /github/setup. */\nexport function installUrl(state?: string): string {\n const slug = reqEnv(\"GH_APP_SLUG\");\n const base = `https://github.com/apps/${slug}/installations/new`;\n return state ? `${base}?state=${encodeURIComponent(state)}` : base;\n}\n",[],[204,373],["D",1781310508175],[220,221,222,223],[204],["D",1781310279766],["D",1789509672838],{"_100":99,"_107":103},{"_100":99,"_101":-5,"_102":103,"_18":56,"_104":105,"_106":27},{"_13":89,"_33":90,"_44":43,"_91":45,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":46,"_98":99},"ctx",{"_82":-5,"_127":421,"_422":423,"_424":425,"_426":27,"_427":27,"_428":27,"_429":25,"_430":-5,"_431":-7,"_432":-7,"_433":63,"_434":27,"_435":27,"_436":-5,"_437":27,"_438":27,"_439":27,"_440":-5},"ENV",{"_392":393,"_394":395,"_396":90,"_397":398,"_399":400,"_401":402,"_403":404,"_405":406,"_407":408,"_409":410,"_411":412,"_413":414,"_415":416,"_417":418,"_419":420},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v43