[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_152":153,"_154":155},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_115":-5,"_20":116,"_22":117,"_118":119,"_120":121,"_25":122,"_24":-5,"_123":-5,"_124":-5,"_125":53,"_126":127,"_128":44,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","theguythatmakesstuff","name","reborn-auth","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":-5,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","483f97d8-e468-11f0-96a1-42dde27851f2","main.ts","fileId","3ce96c0c-e467-11f0-98f4-42dde27851f2","parentId","branchId","3ce7ef76-e467-11f0-98f4-42dde27851f2","branchVersion",5,"latest",true,"createdAt",["D",1766979698827],4,"fileType","http","content","// Learn more: https://docs.val.town/vals/http\n// Single-file HTTP val handler with zero external packages.\n// Implements minimal auth: /health, /, /auth/login, /auth/me, /auth/logout\n\n// --- Config (edit these for val.run) ---\nconst AUTH_SHARED_SECRET = \"replace-with-strong-secret\"; // required\nconst AUTH_ALLOWED_EMAILS = [\"user@example.com\", \"admin@example.com\"]; // [] allows any email\nconst AUTH_PASSWORD = \"replace-with-demo-password\"; // required\nconst AUTH_TOKEN_TTL = \"1h\"; // e.g., \"3600s\", \"60m\", \"1h\"\nconst COOKIE_DOMAIN = \"\"; // set to your domain to enable cookie mode\nconst NODE_ENV = \"production\";\n\n// --- Helpers ---\nconst te = new TextEncoder();\nconst td = new TextDecoder();\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);\n return btoa(binary);\n}\n\nfunction base64ToBytes(base64: string): Uint8Array {\n const binary = atob(base64);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n return out;\n}\n\nfunction base64urlEncode(bytes: Uint8Array): string {\n const str = bytesToBase64(bytes);\n return str.replace(/=+$/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n}\n\nfunction base64urlEncodeJSON(obj: unknown): string {\n const json = JSON.stringify(obj);\n return base64urlEncode(te.encode(json));\n}\n\nfunction base64urlDecodeToJSON(b64: string): T | null {\n try {\n const normalized = b64.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (b64.length % 4)) % 4);\n const bytes = base64ToBytes(normalized);\n const json = td.decode(bytes);\n return JSON.parse(json) as T;\n } catch {\n return null;\n }\n}\n\nfunction parseTTL(ttl: string): number {\n const m = ttl.match(/^(\\d+)([smh])$/);\n if (!m) return 3600; // default 1h\n const n = Number(m[1]);\n const unit = m[2];\n if (unit === \"s\") return n;\n if (unit === \"m\") return n * 60;\n if (unit === \"h\") return n * 3600;\n return 3600;\n}\n\nasync function importHMACKey(secret: string): Promise {\n return crypto.subtle.importKey(\n \"raw\",\n te.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"]\n );\n}\n\nasync function hmacSign(secret: string, data: string): Promise {\n const key = await importHMACKey(secret);\n const sig = await crypto.subtle.sign(\"HMAC\", key, te.encode(data));\n return base64urlEncode(new Uint8Array(sig));\n}\n\nasync function hmacVerify(secret: string, data: string, signature: string): Promise {\n const key = await importHMACKey(secret);\n const normalized = signature.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (signature.length % 4)) % 4);\n const sigBytes = base64ToBytes(normalized);\n return crypto.subtle.verify(\"HMAC\", key, sigBytes, te.encode(data));\n}\n\n// --- Bot detection ---\nfunction isLikelyBot(req: Request): boolean {\n const ua = (req.headers.get(\"user-agent\") || \"\").toLowerCase();\n if (!ua) return true; // missing UA is suspicious\n const patterns = [\n \"bot\",\n \"spider\",\n \"crawl\",\n \"slurp\",\n \"fetch\",\n \"monitor\",\n \"headlesschrome\",\n \"phantom\",\n \"facebookexternalhit\",\n \"twitterbot\",\n \"slackbot\",\n \"discordbot\",\n \"telegrambot\",\n \"applebot\",\n \"baiduspider\",\n \"bingbot\",\n \"duckduckbot\",\n \"yandexbot\",\n \"ahrefsbot\",\n \"semrush\",\n \"curl\",\n \"wget\",\n \"postman\",\n \"insomnia\",\n \"httpclient\",\n \"okhttp\",\n \"guzzle\",\n \"libwww-perl\",\n \"python-requests\",\n \"aiohttp\",\n \"scrapy\",\n ];\n return patterns.some((p) => ua.includes(p));\n}\n\nfunction withBotHeader(req: Request, headers: HeadersInit = {}): HeadersInit {\n const isBot = isLikelyBot(req);\n return { ...headers, \"x-is-bot\": String(isBot) };\n}\n\n// --- Minimal JWT (HS256) ---\nasync function jwtSignHS256(payload: Record, secret: string): Promise {\n const header = { alg: \"HS256\", typ: \"JWT\" };\n const exp = Math.floor(Date.now() / 1000) + parseTTL(AUTH_TOKEN_TTL);\n const fullPayload = { ...payload, exp };\n const h = base64urlEncodeJSON(header);\n const p = base64urlEncodeJSON(fullPayload);\n const data = `${h}.${p}`;\n const sig = await hmacSign(secret, data);\n return `${data}.${sig}`;\n}\n\nasync function jwtVerifyHS256(token: string, secret: string): Promise | null> {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n const [h, p, s] = parts;\n const ok = await hmacVerify(secret, `${h}.${p}`, s);\n if (!ok) return null;\n const payload = base64urlDecodeToJSON>(p);\n if (!payload) return null;\n const exp = Number((payload as any).exp || 0);\n if (!exp || Math.floor(Date.now() / 1000) > exp) return null;\n return payload;\n}\n\nfunction json(status: number, body: unknown, headers: HeadersInit = {}): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...headers },\n });\n}\n\nfunction notFound(): Response {\n return json(404, { error: \"Not found\" });\n}\n\nfunction unauthorized(msg = \"Unauthorized\"): Response {\n return json(401, { error: msg });\n}\n\nfunction parseCookies(req: Request): Record {\n const raw = req.headers.get(\"cookie\") || \"\";\n const out: Record = {};\n raw.split(\";\").forEach((part) => {\n const [k, ...rest] = part.trim().split(\"=\");\n if (!k) return;\n out[k] = decodeURIComponent(rest.join(\"=\"));\n });\n return out;\n}\n\nfunction getTokenFromReq(req: Request): string | null {\n const auth = req.headers.get(\"authorization\") || \"\";\n if (auth.startsWith(\"Bearer \")) return auth.slice(7);\n const cookies = parseCookies(req);\n return cookies[\"auth_token\"] || null;\n}\n\nasync function handleLogin(req: Request): Promise {\n let body: any = {};\n try {\n body = await req.json();\n } catch {}\n const email = String(body?.email || \"\").trim();\n const password = String(body?.password || \"\").trim();\n if (!email || !password) return json(400, { error: \"Invalid request\" });\n\n const allowed = AUTH_ALLOWED_EMAILS.length === 0 || AUTH_ALLOWED_EMAILS.includes(email);\n const passwordOk = password === AUTH_PASSWORD;\n if (!allowed || !passwordOk) return unauthorized(\"Invalid credentials\");\n\n const token = await jwtSignHS256({ email }, AUTH_SHARED_SECRET);\n\n if (COOKIE_DOMAIN) {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=${token}; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=${parseTTL(AUTH_TOKEN_TTL)}`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n }\n return json(200, { token, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nasync function handleMe(req: Request): Promise {\n const token = getTokenFromReq(req);\n if (!token) return unauthorized(\"Missing token\");\n const payload = await jwtVerifyHS256(token, AUTH_SHARED_SECRET);\n if (!payload) return unauthorized(\"Invalid token\");\n return json(200, { user: { email: (payload as any).email }, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nfunction handleLogout(req: Request): Response {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=0`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const { pathname } = url;\n\n if (req.method === \"GET\" && pathname === \"/health\") {\n return json(200, { ok: true, env: NODE_ENV, isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"GET\" && pathname === \"/\") {\n return json(200, { status: \"Auth server ready\", isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"POST\" && pathname === \"/auth/login\") {\n return handleLogin(req);\n }\n if (req.method === \"GET\" && pathname === \"/auth/me\") {\n return handleMe(req);\n }\n if (req.method === \"POST\" && pathname === \"/auth/logout\") {\n return handleLogout(req);\n }\n if (req.method === \"GET\" && pathname === \"/bot\") {\n return json(200, { isBot: isLikelyBot(req), userAgent: req.headers.get(\"user-agent\") || \"\" }, withBotHeader(req));\n }\n return notFound();\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1766979698827],"children",[],[35],"3ce7af70-e467-11f0-98f4-42dde27851f2",["D",1766979250303],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","019b67f9-870c-75ac-9bb3-2238af5e603d","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019b67f9-870c-75ac-9bb3-24210d3c5641","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_114":110},"org",{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zN1Y2Yk5SZFd1TU41ZU1TbXB4Nnc3Q1VnU2wifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":148,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":-5,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":149,"_95":150,"_97":151,"_99":53},[145],"files",[145],"counts",{"_135":77,"_136":137,"_138":77,"_31":139,"_140":141},[133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":134},[35],"pulls","branches",1,"forks",{"_142":77,"_144":77},"connections",{"_142":77,"_143":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":146,"_18":147},[],[35],["D",1766979250303],{"_11":12,"_114":110},{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_130":185,"_186":187,"_188":189,"_190":53,"_191":53,"_192":53,"_193":44,"_194":-5,"_195":-7,"_196":-7,"_197":77,"_198":53,"_199":53,"_200":-5,"_201":53,"_202":53,"_203":53,"_204":-5},"ENV",{"_156":157,"_158":159,"_160":16,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]