[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_116":-5,"_20":117,"_22":118,"_119":120,"_121":122,"_25":123,"_24":-5,"_124":-5,"_125":-5,"_126":53,"_127":128,"_129":44,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","zyrxun","name","helmWaitList","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","a8794f38-6da9-4fc7-b550-855d2da09da6","main.ts","fileId","4209f72a-5edc-11f1-a973-1607ee4eb77e","parentId","branchId","4206468e-5edc-11f1-a973-1607ee4eb77e","branchVersion",11,"latest",true,"createdAt",["D",1781342360550],10,"fileType","http","content","// Val.town: zyrxun/helmWaitlist (the val behind the website email form —\n// https://zyrxun--4209f72a5edc11f1a9731607ee4eb77e.web.val.run)\n// Replace the existing val body with this content.\n//\n// Required Val.town env vars (on THIS val — env vars are per-val):\n// RESEND_API_KEY (the new key — the original \"Helm\" key was revoked in the B1 rotation)\n// HELM_FROM_EMAIL (noreply@get-helm.app — domain verified at resend.com/domains)\n// WAITLIST_NOTIFY (optional — your own address; you get a ping per signup)\n//\n// Response contract (the website form only checks res.ok):\n// { ok: true, duplicate: boolean, emailSent: boolean }\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { createHash } from \"node:crypto\";\n\n// ── Rate limiting ─────────────────────────────────────────────────────────────\nconst WINDOW_MS = 15 * 60 * 1000;\nconst MAX_ATTEMPTS = 15;\n\nasync function rateLimit(req: Request): Promise {\n const ip = req.headers.get(\"x-forwarded-for\")?.split(\",\")[0].trim() ??\n \"unknown\";\n const windowBucket = Math.floor(Date.now() / WINDOW_MS);\n const ipHash = createHash(\"sha256\").update(ip).digest(\"hex\").slice(0, 12);\n const blobKey = `helm_rl_wl_${windowBucket}_${ipHash}`;\n\n const record: { count: number } = (await blob.getJSON(blobKey)) ??\n { count: 0 };\n if (record.count >= MAX_ATTEMPTS) {\n return Response.json({ ok: false, reason: \"rate_limited\" }, {\n status: 429,\n });\n }\n await blob.setJSON(blobKey, { count: record.count + 1 });\n return null;\n}\n\n// ── Validation ────────────────────────────────────────────────────────────────\nconst BODY_SIZE_MAX = 1024;\n\nfunction isSafeEmail(e: unknown): e is string {\n return typeof e === \"string\" && e.length <= 254 &&\n /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(e);\n}\n\n// ── Welcome email via Resend ──────────────────────────────────────────────────\nasync function sendWelcomeEmail(\n to: string,\n resendKey: string,\n fromEmail: string,\n): Promise {\n const body = {\n from: fromEmail,\n to: [to],\n subject: \"You're on the Helm list\",\n html: `\n

You're on the list.

Helm launches July 1. One click from your menu bar opens your entire app\nstack — every app in position, every tab loaded.

We send one email when it ships. That's it.

Helm — Take the wheel.

\n`,\n };\n const res = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${resendKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(body),\n });\n if (!res.ok) throw new Error(`Resend ${res.status}: ${await res.text()}`);\n}\n\n// ── Handler ───────────────────────────────────────────────────────────────────\nexport default async function (req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n const contentLength = parseInt(req.headers.get(\"content-length\") ?? \"0\", 10);\n if (contentLength > BODY_SIZE_MAX) {\n return Response.json({ ok: false, reason: \"payload_too_large\" }, {\n status: 413,\n });\n }\n\n const limited = await rateLimit(req);\n if (limited) return limited;\n\n let body: { email?: unknown };\n try {\n const raw = await req.text();\n if (raw.length > BODY_SIZE_MAX) {\n return Response.json({ ok: false, reason: \"payload_too_large\" }, {\n status: 413,\n });\n }\n body = JSON.parse(raw);\n } catch {\n return Response.json({ ok: false, reason: \"bad_request\" }, { status: 400 });\n }\n\n const { email } = body;\n if (!isSafeEmail(email)) {\n return Response.json({ ok: false, reason: \"invalid_email\" }, {\n status: 400,\n });\n }\n\n // Per-email blob key: dedupe is natural, no read-modify-write race on a\n // shared list. Export the list later with blob.list(\"helm_waitlist_\").\n const normalized = email.trim().toLowerCase();\n const entryKey = \"helm_waitlist_\" +\n createHash(\"sha256\").update(normalized).digest(\"hex\").slice(0, 24);\n\n const existing = await blob.getJSON(entryKey);\n const duplicate = !!existing;\n if (!duplicate) {\n await blob.setJSON(entryKey, { email: normalized, at: Date.now() });\n }\n\n // Email send is best-effort: a failure must not lose the signup. But it is\n // never silent — the reason lands in the val logs and the response carries\n // emailSent so a broken Resend config is visible, not invisible.\n let emailSent = false;\n const resendKey = Deno.env.get(\"RESEND_API_KEY\") ?? \"\";\n const fromEmail = Deno.env.get(\"HELM_FROM_EMAIL\") ?? \"\";\n if (!duplicate && resendKey && fromEmail) {\n try {\n await sendWelcomeEmail(normalized, resendKey, fromEmail);\n emailSent = true;\n } catch (err) {\n console.error(\"helmWaitlist: welcome email failed:\", String(err));\n }\n } else if (!duplicate) {\n console.error(\n \"helmWaitlist: RESEND_API_KEY or HELM_FROM_EMAIL not set — signup stored, no email sent\",\n );\n }\n\n // Optional self-notification so signups are visible without checking blobs.\n const notify = Deno.env.get(\"WAITLIST_NOTIFY\") ?? \"\";\n if (!duplicate && notify && resendKey && fromEmail) {\n try {\n await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${resendKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: fromEmail,\n to: [notify],\n subject: \"Helm waitlist signup\",\n text: `${normalized} joined the waitlist.`,\n }),\n });\n } catch (_) { /* notification only — never affects the signup */ }\n }\n\n return Response.json({ ok: true, duplicate, emailSent });\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1781342360550],"children",[],[35],"4205838e-5edc-11f1-a973-1607ee4eb77e",["D",1780443551866],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","6672ef94-066d-4947-9570-5b0ce7f352d5","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e306a-94bf-733b-a503-3575488085e4","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_115":111},"org",{"_11":12,"_108":109,"_110":111,"_70":71,"_112":113,"_114":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Richard Xun","avatar","https://lh3.googleusercontent.com/a/ACg8ocLWG-UJ5cFmJNKhsROFvQZEkojxEI1DiAh7HQRUHjFCOK5FRw=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":150,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":151,"_95":152,"_97":153,"_99":53},[147],"files",[147],"counts",{"_136":77,"_137":138,"_139":77,"_31":140,"_141":142},[134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":135},[35],"pulls","branches",1,"forks",{"_143":145,"_146":77},"connections",{"_143":77,"_144":77},"count","unfilledCount",2,"emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":148,"_18":149},[],[35],["D",1780443551866],{"_11":12,"_115":111},{"_11":12,"_108":109,"_110":111,"_70":71,"_112":113,"_114":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_131":187,"_188":189,"_190":191,"_192":53,"_193":53,"_194":53,"_195":44,"_196":-5,"_197":-7,"_198":-7,"_199":77,"_200":53,"_201":53,"_202":-5,"_203":53,"_204":53,"_205":53,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":16,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code