[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_169":170,"_171":172},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_61":138,"_16":-7,"_139":-5,"_17":140,"_141":142,"_28":143,"_21":144,"_23":145,"_146":-5,"_147":-5,"_148":-5,"_149":36,"_150":151,"_152":34,"_153":-5,"_154":-5,"_155":156},"routes/_app.x.$handle.$name._index",{"_11":12,"_13":14,"_15":-7,"_16":-7,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-7,"_26":-5,"_27":-5,"_28":29,"_30":-5,"_31":-5,"_32":-5,"_33":34,"_35":36,"_37":34},"handle","zyrxun","name","helmActivate","branchName","version","project",{"_39":79,"_13":14,"_50":80,"_81":-5,"_82":36,"_83":84,"_85":84,"_86":87,"_88":-5,"_89":90,"_91":-5,"_92":36,"_93":-5,"_94":-5,"_95":67,"_96":97,"_98":99,"_100":101,"_102":103,"_104":-5,"_105":106,"_107":106,"_108":109,"_110":109,"_111":109,"_112":106,"_113":106,"_114":115,"_116":117,"_118":119,"_120":36},"tags",[],"counts",{"_66":67,"_68":69,"_70":67,"_71":72,"_73":74},"contents",[63],"readme","upstream","pull","files",[38],"preview","ahead","behind","showHomeCustomizationHint",true,"showHTTPPreviewSettingsHint",false,"hasHTTPFiles",{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":51,"_16":52,"_53":54,"_55":56,"_57":36,"_58":-5,"_59":60,"_61":62},"id","67be576c-138e-46f2-8fad-4fce2c9b7868","main.ts","fileId","0bc04820-5afb-11f1-9093-ee650bb23af1","parentId","branchId","0bbcf6a2-5afb-11f1-9093-ee650bb23af1","branchVersion",12,"latest","createdAt",["D",1781341666966],11,"fileType","http","content","// Val.town: zyrxun/helmActivate\n// Replace the existing val body with this content.\n// Required Val.town env vars:\n// HELM_LICENSE_PUBLIC_KEY (Ed25519 public key, PEM — verifies license keys)\n// HELM_RECEIPT_PRIVATE_KEY (Ed25519 private key, PEM — signs activation receipts; SF-2)\n// This val verifies license signatures (public key only — never the minting private\n// key, which lives in helmCheckout) and, on success, signs a short-lived activation\n// receipt the client needs for offline Pro. The receipt keypair is SEPARATE from the\n// license keypair: helmActivate holds the receipt *private* key and the client embeds\n// the matching receipt *public* key (runtime-config.js). If HELM_RECEIPT_PRIVATE_KEY\n// is unset, no receipt is issued (rollout-safe; the client falls back to legacy\n// offline grace until both sides are configured).\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport {\n createHash,\n createPrivateKey,\n createPublicKey,\n KeyObject,\n sign as cryptoSign,\n verify as cryptoVerify,\n} from \"node:crypto\";\n\n// ── Activation receipt (SF-2) ─────────────────────────────────────────────────\n// 60-day TTL; the client refreshes it on every successful online re-verify, so a\n// machine that stays online keeps a fresh receipt and a machine offline longer than\n// the TTL must reconnect once. Format: ..\nconst RECEIPT_TTL_SEC = 60 * 24 * 60 * 60;\nfunction issueReceipt(\n keyFp: string,\n machineId: string,\n priv: KeyObject,\n): string {\n const payload = JSON.stringify({\n k: keyFp,\n m: machineId,\n exp: Math.floor(Date.now() / 1000) + RECEIPT_TTL_SEC,\n });\n const payloadBytes = Buffer.from(payload, \"utf8\");\n const sig = cryptoSign(null, payloadBytes, priv).toString(\"base64url\");\n return `${payloadBytes.toString(\"base64url\")}.${sig}`;\n}\n\n// ── Rate limiting ─────────────────────────────────────────────────────────────\nconst WINDOW_MS = 15 * 60 * 1000;\nconst MAX_ATTEMPTS = 15;\n\nasync function rateLimit(req: Request): Promise {\n const ip = req.headers.get(\"x-forwarded-for\")?.split(\",\")[0].trim() ??\n \"unknown\";\n // Bucket key uses the same WINDOW_MS as the in-bucket sliding reset so the\n // two time constants agree — \"MAX_ATTEMPTS per WINDOW_MS\" means exactly that.\n const windowBucket = Math.floor(Date.now() / WINDOW_MS);\n const ipHash = createHash(\"sha256\").update(ip).digest(\"hex\").slice(0, 12);\n const blobKey = `helm_rl_${windowBucket}_${ipHash}`;\n const now = Date.now();\n\n let record: { count: number; windowStart: number; v: number } =\n (await blob.getJSON(blobKey)) ?? { count: 0, windowStart: now, v: now };\n\n if (now - record.windowStart > WINDOW_MS) {\n record = { count: 0, windowStart: now, v: now };\n }\n\n if (record.count >= MAX_ATTEMPTS) {\n return Response.json({ ok: false, reason: \"rate_limited\" }, {\n status: 429,\n });\n }\n\n record.count++;\n const fresh: typeof record | null = await blob.getJSON(blobKey);\n\n if (fresh && fresh.v !== record.v) {\n const freshCount = fresh.count ?? 0;\n if (freshCount >= MAX_ATTEMPTS) {\n return Response.json({ ok: false, reason: \"rate_limited\" }, {\n status: 429,\n });\n }\n await blob.setJSON(blobKey, {\n count: freshCount + 1,\n windowStart: fresh.windowStart ?? now,\n v: Date.now(),\n });\n } else {\n await blob.setJSON(blobKey, {\n count: record.count,\n windowStart: record.windowStart,\n v: Date.now(),\n });\n }\n\n return null;\n}\n\n// ── PEM normalization ─────────────────────────────────────────────────────────\n// Env-var UIs (Val.town included) often flatten a multi-line PEM into one line\n// or insert literal \"\\n\" — both of which createPublicKey rejects. Rebuild a\n// canonical PEM from whatever survived, so the key loads regardless of mangling.\nfunction normalizePem(raw: string, label: string): string {\n const body = String(raw)\n .replace(/\\\\[nrt]/g, \"\")\n .replace(/-----BEGIN [^-]+-----/g, \"\")\n .replace(/-----END [^-]+-----/g, \"\")\n .replace(/[^A-Za-z0-9+/=]/g, \"\");\n const wrapped = body.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\n// ── Key verification ──────────────────────────────────────────────────────────\n// Key format: HLM....\n// '.' is not a base64url character, so split is unambiguous.\nfunction verifyKey(\n key: string,\n publicKey: KeyObject,\n): { valid: boolean; email: string | null } {\n try {\n const parts = key.split(\".\");\n if (parts.length !== 4 || parts[0] !== \"HLM\") {\n return { valid: false, email: null };\n }\n const [, encodedEmail, nonce, signature] = parts;\n if (!encodedEmail || !nonce || !signature) {\n return { valid: false, email: null };\n }\n const message = Buffer.from(`HLM:${encodedEmail}:${nonce}`);\n const sig = Buffer.from(signature, \"base64url\");\n const ok = cryptoVerify(null, message, publicKey, sig);\n if (!ok) return { valid: false, email: null };\n const email = Buffer.from(encodedEmail, \"base64url\").toString(\"utf8\");\n return { valid: true, email };\n } catch {\n return { valid: false, email: null };\n }\n}\n\n// ── Input validation ──────────────────────────────────────────────────────────\n// key format: HLM--<8 hex>-<64 hex> — max ~200 chars in practice\nconst KEY_MAX = 300;\nconst MACHINE_MAX = 64;\nconst BODY_SIZE_MAX = 2048; // bytes\n\nfunction isSafeKey(k: unknown): k is string {\n // HLM..<8 hex nonce>.<86-char base64url Ed25519 sig>.\n return typeof k === \"string\" && k.length >= 10 && k.length <= KEY_MAX &&\n /^HLM\\.[A-Za-z0-9_-]+\\.[0-9a-f]{8}\\.[A-Za-z0-9_-]{86}$/.test(k);\n}\n\nfunction isSafeMachineId(m: unknown): m is string {\n return typeof m === \"string\" && m.length >= 4 && m.length <= MACHINE_MAX &&\n /^[0-9a-f]+$/.test(m);\n}\n\n// ── Handler ───────────────────────────────────────────────────────────────────\nexport default async function (req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n // Reject oversized bodies before reading\n const contentLength = parseInt(req.headers.get(\"content-length\") ?? \"0\", 10);\n if (contentLength > BODY_SIZE_MAX) {\n return Response.json({ ok: false, reason: \"payload_too_large\" }, {\n status: 413,\n });\n }\n\n const limited = await rateLimit(req);\n if (limited) return limited;\n\n const publicPem = Deno.env.get(\"HELM_LICENSE_PUBLIC_KEY\") ?? \"\";\n if (!publicPem) {\n return Response.json({ ok: false, reason: \"server_misconfigured\" }, {\n status: 500,\n });\n }\n let publicKey: KeyObject;\n try {\n publicKey = createPublicKey(normalizePem(publicPem, \"PUBLIC KEY\"));\n } catch {\n return Response.json({ ok: false, reason: \"server_misconfigured\" }, {\n status: 500,\n });\n }\n\n let body: { key?: unknown; machineId?: unknown };\n try {\n const raw = await req.text();\n if (raw.length > BODY_SIZE_MAX) {\n return Response.json({ ok: false, reason: \"payload_too_large\" }, {\n status: 413,\n });\n }\n body = JSON.parse(raw);\n } catch {\n return Response.json({ ok: false, reason: \"bad_request\" }, { status: 400 });\n }\n\n const { key, machineId } = body;\n if (!isSafeKey(key)) {\n return Response.json({ ok: false, reason: \"invalid_key\" }, { status: 400 });\n }\n if (!isSafeMachineId(machineId)) {\n return Response.json({ ok: false, reason: \"invalid_machine\" }, {\n status: 400,\n });\n }\n\n const { valid, email } = verifyKey(key, publicKey);\n if (!valid) {\n return Response.json({ ok: false, reason: \"invalid_key\" }, { status: 403 });\n }\n\n // Load the receipt signing key (optional during rollout). The receipt fingerprint\n // matches the client's keyFingerprint() = sha256(key)[:16].\n const keyFp = createHash(\"sha256\").update(key).digest(\"hex\").slice(0, 16);\n let receiptKey: KeyObject | null = null;\n const receiptPem = Deno.env.get(\"HELM_RECEIPT_PRIVATE_KEY\") ?? \"\";\n if (receiptPem) {\n try {\n receiptKey = createPrivateKey(normalizePem(receiptPem, \"PRIVATE KEY\"));\n } catch {\n receiptKey = null;\n }\n }\n const receiptFor = (\n m: string,\n ) => (receiptKey ? issueReceipt(keyFp, m, receiptKey) : undefined);\n\n const activationKey = \"helm_activation_\" + keyFp;\n\n const existing: { machines: string[] } =\n (await blob.getJSON(activationKey)) ?? { machines: [] };\n\n if (existing.machines.includes(machineId)) {\n return Response.json({ ok: true, email, receipt: receiptFor(machineId) });\n }\n\n if (existing.machines.length >= 2) {\n return Response.json({ ok: false, reason: \"limit_reached\" }, {\n status: 403,\n });\n }\n\n const recheck: { machines: string[] } = (await blob.getJSON(activationKey)) ??\n { machines: [] };\n if (!recheck.machines.includes(machineId) && recheck.machines.length >= 2) {\n return Response.json({ ok: false, reason: \"limit_reached\" }, {\n status: 403,\n });\n }\n\n const updated = {\n machines: Array.from(new Set([...recheck.machines, machineId])),\n email,\n };\n await blob.setJSON(activationKey, updated);\n\n return Response.json({ ok: true, email, receipt: receiptFor(machineId) });\n}","deleted","label","children",[],"path",[41],{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":64,"_16":52,"_53":54,"_55":56,"_57":36,"_58":-5,"_61":65},["D",1781341666966],[41],"pulls",0,"branches",1,"forks","envVars",{"_75":77,"_78":67},"connections",{"_75":67,"_76":67},"count","unfilledCount",2,"emptyCount","0bbbf40a-5afb-11f1-9093-ee650bb23af1",["D",1780016970534],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Helm key ","imageUrl","userId","6672ef94-066d-4947-9570-5b0ce7f352d5","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019e306a-94bf-733b-a503-3575488085e4","tursoName","0bbbf40a5afb11f19093ee650bb23af1","tursoHostname","0bbbf40a5afb11f19093ee650bb23af1-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789512044203],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_137":133},"org",{"_11":12,"_130":131,"_132":133,"_89":90,"_134":135,"_136":36},"branch",{"_16":48,"_13":121,"_39":46,"_122":79,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":-5,"_128":14,"_129":12},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Richard Xun","avatar","https://lh3.googleusercontent.com/a/ACg8ocLWG-UJ5cFmJNKhsROFvQZEkojxEI1DiAh7HQRUHjFCOK5FRw=s96-c","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_39":79,"_13":14,"_50":164,"_81":-5,"_82":36,"_83":84,"_85":84,"_86":87,"_88":-5,"_89":90,"_91":-5,"_92":36,"_93":-5,"_94":-5,"_95":67,"_96":97,"_98":99,"_100":101,"_102":165,"_104":-5,"_105":106,"_107":106,"_108":109,"_110":109,"_111":109,"_112":106,"_113":106,"_114":166,"_116":167,"_118":168,"_120":36},"tree",[161],[161],{"_66":67,"_68":69,"_70":67,"_71":159,"_73":160},[157],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":64,"_16":52,"_53":54,"_55":56,"_57":36,"_58":-5,"_61":158},[41],{"_75":77,"_78":67},{"_75":67,"_76":67},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":51,"_16":52,"_53":54,"_55":56,"_57":36,"_58":-5,"_59":162,"_61":163},[],[41],["D",1780016970534],["D",1789512044203],{"_11":12,"_137":133},{"_11":12,"_130":131,"_132":133,"_89":90,"_134":135,"_136":36},{"_16":48,"_13":121,"_39":46,"_122":79,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":-5,"_128":14,"_129":12},"ctx",{"_114":-5,"_154":202,"_203":204,"_205":206,"_207":36,"_208":36,"_209":36,"_210":34,"_211":-5,"_212":-7,"_213":-7,"_214":67,"_215":36,"_216":36,"_217":-5,"_218":36,"_219":36,"_220":36,"_221":-5},"ENV",{"_173":174,"_175":176,"_177":121,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]