[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_116":-5,"_20":117,"_22":118,"_119":120,"_121":122,"_25":123,"_24":-5,"_124":-5,"_125":-5,"_126":53,"_127":128,"_129":44,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","zyrxun","name","helmCheckout","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","bbdf6189-0bb8-4fb0-86ff-1ec25d92a768","main.ts","fileId","fd0579f8-5b00-11f1-8330-ee650bb23af1","parentId","branchId","fd0288e2-5b00-11f1-8330-ee650bb23af1","branchVersion",8,"latest",true,"createdAt",["D",1782716069613],7,"fileType","http","content","// Val.town: zyrxun/helmCheckout\n// Required Val.town env vars (set in Val.town environment — never hardcode values here):\n// HELM_LICENSE_PRIVATE_KEY (Ed25519 private key, PEM format)\n// STRIPE_WEBHOOK_SECRET\n// RESEND_API_KEY\n// HELM_FROM_EMAIL\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport {\n createHash,\n createHmac,\n createPrivateKey,\n KeyObject,\n randomBytes,\n sign as cryptoSign,\n} from \"node:crypto\";\n\n// ── Rate limiting ─────────────────────────────────────────────────────────────\nconst WINDOW_MS = 15 * 60 * 1000;\nconst MAX_ATTEMPTS = 15;\n\nasync function rateLimit(req: Request): Promise {\n const ip = req.headers.get(\"x-forwarded-for\")?.split(\",\")[0].trim() ??\n \"unknown\";\n // Bucket key uses the same WINDOW_MS as the in-bucket sliding reset so the\n // two time constants agree — \"MAX_ATTEMPTS per WINDOW_MS\" means exactly that.\n const windowBucket = Math.floor(Date.now() / WINDOW_MS);\n const ipHash = createHash(\"sha256\").update(ip).digest(\"hex\").slice(0, 12);\n const blobKey = `helm_rl_${windowBucket}_${ipHash}`;\n const now = Date.now();\n\n let record: { count: number; windowStart: number; v: number } =\n (await blob.getJSON(blobKey)) ?? { count: 0, windowStart: now, v: now };\n\n if (now - record.windowStart > WINDOW_MS) {\n record = { count: 0, windowStart: now, v: now };\n }\n\n if (record.count >= MAX_ATTEMPTS) {\n return Response.json({ ok: false, reason: \"rate_limited\" }, {\n status: 429,\n });\n }\n\n record.count++;\n const fresh: typeof record | null = await blob.getJSON(blobKey);\n\n if (fresh && fresh.v !== record.v) {\n const freshCount = fresh.count ?? 0;\n if (freshCount >= MAX_ATTEMPTS) {\n return Response.json({ ok: false, reason: \"rate_limited\" }, {\n status: 429,\n });\n }\n await blob.setJSON(blobKey, {\n count: freshCount + 1,\n windowStart: fresh.windowStart ?? now,\n v: Date.now(),\n });\n } else {\n await blob.setJSON(blobKey, {\n count: record.count,\n windowStart: record.windowStart,\n v: Date.now(),\n });\n }\n\n return null;\n}\n\n// ── PEM normalization ─────────────────────────────────────────────────────────\n// Env-var UIs often flatten a multi-line PEM into one line or insert literal\n// \"\\n\"; rebuild a canonical PEM so createPrivateKey accepts it regardless.\nfunction normalizePem(raw: string, label: string): string {\n const body = String(raw)\n .replace(/\\\\[nrt]/g, \"\")\n .replace(/-----BEGIN [^-]+-----/g, \"\")\n .replace(/-----END [^-]+-----/g, \"\")\n .replace(/[^A-Za-z0-9+/=]/g, \"\");\n const wrapped = body.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\n// ── Stripe webhook signature verification ─────────────────────────────────────\nfunction verifyStripeSignature(\n rawBody: string,\n header: string,\n secret: string,\n toleranceSec = 300,\n): boolean {\n try {\n const parts = Object.fromEntries(\n header.split(\",\").map((p) => p.split(\"=\")),\n );\n const ts = parts[\"t\"];\n const sig = parts[\"v1\"];\n if (!ts || !sig) return false;\n // Reject stale or future-dated timestamps so a captured webhook body+signature\n // cannot be replayed indefinitely. Matches Stripe's own 5-minute default.\n const tsSec = Number(ts);\n if (\n !Number.isFinite(tsSec) ||\n Math.abs(Date.now() / 1000 - tsSec) > toleranceSec\n ) return false;\n const payload = `${ts}.${rawBody}`;\n const expected = createHmac(\"sha256\", secret).update(payload).digest(\"hex\");\n if (sig.length !== expected.length) return false;\n let diff = 0;\n for (let i = 0; i < sig.length; i++) {\n diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n }\n return diff === 0;\n } catch {\n return false;\n }\n}\n\n// ── Key minting ───────────────────────────────────────────────────────────────\n// Ed25519-signed key. The matching public key lives in\n// electron/runtime-config.js so clients can verify offline without ever\n// holding the minting secret.\nfunction mintKey(email: string, privateKey: KeyObject): string {\n const nonce = randomBytes(4).toString(\"hex\");\n const encodedEmail = Buffer.from(email).toString(\"base64url\");\n const message = Buffer.from(`HLM:${encodedEmail}:${nonce}`);\n const signature = cryptoSign(null, message, privateKey).toString(\"base64url\");\n // '.' is not a base64url character, so splitting on it is unambiguous.\n return `HLM.${encodedEmail}.${nonce}.${signature}`;\n}\n\n// ── Email delivery via Resend ─────────────────────────────────────────────────\nasync function sendLicenseEmail(\n to: string,\n key: string,\n resendKey: string,\n fromEmail: string,\n) {\n const body = {\n from: fromEmail,\n to: [to],\n subject: \"Your Helm license key\",\n html: `\n

Here is your Helm Pro license key:

${key}

Open Helm and click I have a key to activate.

This key works on up to 2 Macs. Keep it somewhere safe.

\n`,\n };\n const res = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${resendKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(body),\n });\n if (!res.ok) {\n throw new Error(`Resend error ${res.status}: ${await res.text()}`);\n }\n}\n\n// ── Input validation ──────────────────────────────────────────────────────────\nconst STRIPE_BODY_MAX = 65536; // 64 KB — Stripe payloads are well under this\n\nfunction isSafeEmail(e: unknown): e is string {\n return typeof e === \"string\" && e.length <= 254 &&\n /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(e);\n}\n\n// ── Handler ───────────────────────────────────────────────────────────────────\nexport default async function (req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n // Reject oversized bodies before rate limiting to save blob writes on floods\n const contentLength = parseInt(req.headers.get(\"content-length\") ?? \"0\", 10);\n if (contentLength > STRIPE_BODY_MAX) {\n return Response.json({ ok: false, reason: \"payload_too_large\" }, {\n status: 413,\n });\n }\n\n const limited = await rateLimit(req);\n if (limited) return limited;\n\n const webhookSecret = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\") ?? \"\";\n const licensePrivate = Deno.env.get(\"HELM_LICENSE_PRIVATE_KEY\") ?? \"\";\n const resendKey = Deno.env.get(\"RESEND_API_KEY\") ?? \"\";\n const fromEmail = Deno.env.get(\"HELM_FROM_EMAIL\") ?? \"\";\n let licenseKeyObj: KeyObject | null = null;\n if (licensePrivate) {\n try {\n licenseKeyObj = createPrivateKey(\n normalizePem(licensePrivate, \"PRIVATE KEY\"),\n );\n } catch {\n licenseKeyObj = null;\n }\n }\n\n const rawBody = await req.text();\n if (rawBody.length > STRIPE_BODY_MAX) {\n return Response.json({ ok: false, reason: \"payload_too_large\" }, {\n status: 413,\n });\n }\n const sigHeader = req.headers.get(\"stripe-signature\") ?? \"\";\n\n // Fail loud when the webhook secret is missing. Without it the Stripe\n // signature can't be verified, and returning 200 would make Stripe treat the\n // purchase as delivered — no key minted, no email, no retry. A 500 makes\n // Stripe retry and surfaces the misconfiguration instead of hiding it.\n if (webhookSecret === \"whsec_PLACEHOLDER\" || webhookSecret === \"\") {\n console.error(\n \"helmCheckout: STRIPE_WEBHOOK_SECRET not configured — rejecting\",\n );\n return Response.json({ ok: false, reason: \"server_misconfigured\" }, {\n status: 500,\n });\n }\n\n if (!verifyStripeSignature(rawBody, sigHeader, webhookSecret)) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n\n let payload: any;\n try {\n payload = JSON.parse(rawBody);\n } catch {\n return new Response(\"Bad Request\", { status: 400 });\n }\n\n if (payload.type !== \"checkout.session.completed\") {\n return Response.json({ received: true });\n }\n\n const email = payload.data?.object?.customer_details?.email;\n if (!isSafeEmail(email)) {\n return Response.json({ ok: false, reason: \"no_email\" }, { status: 400 });\n }\n\n if (!licenseKeyObj) {\n return Response.json({ ok: false, reason: \"server_misconfigured\" }, {\n status: 500,\n });\n }\n\n // Idempotency: Stripe delivers events at-least-once and retries on any non-2xx,\n // and the mint nonce is random — so without this each redelivery would produce\n // a new valid key (each good for 2 machines). Key the mint on the Checkout\n // Session id; redelivery returns the same key instead of minting again.\n const sessionId = payload.data?.object?.id;\n const mintBlobKey =\n typeof sessionId === \"string\" && sessionId.length > 0 &&\n sessionId.length <= 128\n ? \"helm_minted_\" +\n createHash(\"sha256\").update(sessionId).digest(\"hex\").slice(0, 32)\n : null;\n\n // Mint is idempotent (key stable per session), but email delivery is tracked\n // separately: a transient Resend failure on the first delivery must NOT\n // permanently block the email on retry. So a redelivery whose stored record has\n // emailSent=false re-attempts the email with the same key.\n let key: string;\n let emailAlreadySent = false;\n if (mintBlobKey) {\n const prior: { key: string; emailSent?: boolean } | null = await blob\n .getJSON(mintBlobKey);\n if (prior?.key) {\n key = prior.key;\n emailAlreadySent = prior.emailSent === true;\n } else {\n key = mintKey(email, licenseKeyObj);\n // Persist before emailing so a delivery failure can't cause a re-mint on retry.\n await blob.setJSON(mintBlobKey, {\n key,\n email,\n emailSent: false,\n at: Date.now(),\n });\n }\n } else {\n key = mintKey(email, licenseKeyObj);\n }\n\n if (emailAlreadySent) return Response.json({ ok: true });\n\n if (resendKey && resendKey !== \"re_PLACEHOLDER\" && fromEmail) {\n try {\n await sendLicenseEmail(email, key, resendKey, fromEmail);\n if (mintBlobKey) {\n await blob.setJSON(mintBlobKey, {\n key,\n email,\n emailSent: true,\n at: Date.now(),\n });\n }\n } catch (err) {\n console.error(\"Email delivery failed:\", err);\n return Response.json({ ok: true, warning: \"email_failed\" });\n }\n } else {\n // Don't log the raw key — it's a bearer credential and lands in Val.town\n // dashboard logs. Hash prefix + email is enough to correlate.\n const keyHash = createHash(\"sha256\").update(key).digest(\"hex\").slice(0, 12);\n console.log(\n `helmCheckout: email not configured, minted key for ${email} (sha256:${keyHash})`,\n );\n }\n\n return Response.json({ ok: true });\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1782716069613],"children",[],[35],"fd01b4ee-5b00-11f1-8330-ee650bb23af1",["D",1780019522806],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","6672ef94-066d-4947-9570-5b0ce7f352d5","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e306a-94bf-733b-a503-3575488085e4","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_115":111},"org",{"_11":12,"_108":109,"_110":111,"_70":71,"_112":113,"_114":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Richard Xun","avatar","https://lh3.googleusercontent.com/a/ACg8ocLWG-UJ5cFmJNKhsROFvQZEkojxEI1DiAh7HQRUHjFCOK5FRw=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":150,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":151,"_95":152,"_97":153,"_99":53},[147],"files",[147],"counts",{"_136":77,"_137":138,"_139":77,"_31":140,"_141":142},[134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":135},[35],"pulls","branches",1,"forks",{"_143":145,"_146":77},"connections",{"_143":77,"_144":77},"count","unfilledCount",5,"emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":148,"_18":149},[],[35],["D",1780019522806],{"_11":12,"_115":111},{"_11":12,"_108":109,"_110":111,"_70":71,"_112":113,"_114":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_131":187,"_188":189,"_190":191,"_192":53,"_193":53,"_194":53,"_195":44,"_196":-5,"_197":-7,"_198":-7,"_199":77,"_200":53,"_201":53,"_202":-5,"_203":53,"_204":53,"_205":53,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":16,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]