[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_157":158,"_159":160},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_119":-5,"_20":120,"_22":121,"_122":123,"_124":125,"_25":126,"_24":-5,"_127":-5,"_128":-5,"_129":53,"_130":131,"_132":44,"_133":-5,"_134":-5,"_135":136},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","colel","name","upload-single-page-html","branchName","main","version","path","","project",{"_33":62,"_13":14,"_45":63,"_64":-5,"_65":53,"_66":67,"_68":67,"_69":-5,"_70":-5,"_71":72,"_73":-5,"_74":53,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":82,"_83":84,"_85":86,"_87":-5,"_88":89,"_90":89,"_91":92,"_93":92,"_94":92,"_95":89,"_96":89,"_97":98,"_99":100,"_101":102,"_103":53},"tree",[57],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_18":56},"id","2a4fbe8e-32a5-11f1-94dc-42dde27851f2","main.ts","fileId","8043de48-06d5-11f1-95fd-42dde27851f2","parentId","branchId","8041bb90-06d5-11f1-95fd-42dde27851f2","branchVersion",51,"latest",true,"createdAt",["D",1775582038582],20,"fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite@14-main/main.ts\";\n\n// --- Init DB (idempotent) ---\nawait sqlite.execute(`\n CREATE TABLE IF NOT EXISTS uploads (\n id TEXT PRIMARY KEY,\n content_type TEXT NOT NULL,\n description TEXT,\n data BLOB NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n expires_at TEXT\n )\n`);\n\n// Migration: add description column if missing (for existing tables)\ntry {\n await sqlite.execute(`ALTER TABLE uploads ADD COLUMN description TEXT`);\n} catch {\n // Column already exists — ignore\n}\n\n// Migration: add expires_at column if missing\ntry {\n await sqlite.execute(`ALTER TABLE uploads ADD COLUMN expires_at TEXT`);\n} catch {\n // Column already exists — ignore\n}\n\n// --- Helpers ---\n\nfunction randomHex(bytes: number): string {\n const arr = new Uint8Array(bytes);\n crypto.getRandomValues(arr);\n return [...arr].map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction sanitizeFilename(name: string): string {\n // Strip any directory components\n const base = name.split(/[\\\\\\/]/).pop() || \"upload\";\n return base\n .replace(/[^a-zA-Z0-9._-]/g, \"-\")\n .replace(/-+/g, \"-\")\n .replace(/^-|-$/g, \"\")\n .toLowerCase() || \"upload\";\n}\n\nfunction sanitizeSlug(text: string): string {\n return text\n .replace(/[^a-zA-Z0-9\\s-]/g, \"\")\n .trim()\n .replace(/\\s+/g, \"-\")\n .replace(/-+/g, \"-\")\n .replace(/^-|-$/g, \"\")\n .toLowerCase()\n .slice(0, 48) || \"\";\n}\n\n/**\n * Build the upload ID from optional description, filename override, and the\n * actual file name. Format: {hex}-{vanity-slug}-{filename}\n * - vanity slug comes from the description (if provided)\n * - filename comes from the explicit `filename` field, falling back to the\n * file's original name\n */\nfunction buildUploadId(\n opts: { description?: string; filenameOverride?: string; originalName: string },\n): string {\n const hex = randomHex(3);\n const safeName = sanitizeFilename(opts.filenameOverride || opts.originalName);\n const slug = opts.description ? sanitizeSlug(opts.description) : \"\";\n\n if (slug) {\n return `${hex}-${slug}-${safeName}`;\n }\n return `${hex}-${safeName}`;\n}\n\nasync function gzip(data: Uint8Array): Promise {\n const cs = new CompressionStream(\"gzip\");\n const writer = cs.writable.getWriter();\n writer.write(data);\n writer.close();\n const chunks: Uint8Array[] = [];\n const reader = cs.readable.getReader();\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n chunks.push(value);\n }\n const total = chunks.reduce((s, c) => s + c.length, 0);\n const result = new Uint8Array(total);\n let offset = 0;\n for (const chunk of chunks) {\n result.set(chunk, offset);\n offset += chunk.length;\n }\n return result;\n}\n\nasync function gunzip(data: Uint8Array): Promise {\n const ds = new DecompressionStream(\"gzip\");\n const writer = ds.writable.getWriter();\n writer.write(data);\n writer.close();\n const chunks: Uint8Array[] = [];\n const reader = ds.readable.getReader();\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n chunks.push(value);\n }\n const total = chunks.reduce((s, c) => s + c.length, 0);\n const result = new Uint8Array(total);\n let offset = 0;\n for (const chunk of chunks) {\n result.set(chunk, offset);\n offset += chunk.length;\n }\n return result;\n}\n\nfunction authenticate(req: Request, formPassword?: string): boolean {\n const token = Deno.env.get(\"UPLOAD_TOKEN\");\n if (!token) return false;\n\n // Check Authorization: Bearer header\n const auth = req.headers.get(\"Authorization\");\n if (auth?.startsWith(\"Bearer \") && auth.slice(7) === token) return true;\n\n // Check form password field\n if (formPassword && formPassword === token) return true;\n\n return false;\n}\n\nfunction checkBasicAuth(req: Request): boolean {\n const token = Deno.env.get(\"UPLOAD_TOKEN\");\n if (!token) return false;\n\n // Check for HTTP Basic Auth\n const auth = req.headers.get(\"Authorization\");\n if (auth?.startsWith(\"Basic \")) {\n const credentials = atob(auth.slice(6));\n const colonIdx = credentials.indexOf(\":\");\n const password = colonIdx >= 0 ? credentials.slice(colonIdx + 1) : credentials;\n return password === token;\n }\n\n return false;\n}\n\n/**\n * Compute the expiration ISO string from an `expires_in` value.\n * Accepted values: \"7d\", \"14d\", \"never\", or an ISO 8601 string.\n * Returns null for \"never\" (no expiration).\n */\nfunction resolveExpiration(expiresIn?: string | null): string | null {\n if (!expiresIn || expiresIn === \"7d\" || expiresIn === undefined) {\n // Default: 7 days\n const d = new Date();\n d.setDate(d.getDate() + 7);\n return d.toISOString();\n }\n if (expiresIn === \"14d\") {\n const d = new Date();\n d.setDate(d.getDate() + 14);\n return d.toISOString();\n }\n if (expiresIn === \"never\" || expiresIn === \"\") {\n return null;\n }\n // Try parsing as ISO 8601 date\n const date = new Date(expiresIn);\n if (isNaN(date.getTime())) {\n return undefined as any; // signals invalid\n }\n return date.toISOString();\n}\n\n// --- Allowed content types ---\nconst ALLOWED_TYPES = new Set([\n \"text/html\",\n \"text/css\",\n \"text/javascript\",\n \"application/javascript\",\n \"application/json\",\n \"image/png\",\n \"image/jpeg\",\n \"image/gif\",\n \"image/webp\",\n \"image/svg+xml\",\n \"audio/mpeg\",\n \"audio/ogg\",\n \"video/mp4\",\n \"video/webm\",\n \"application/pdf\",\n \"application/octet-stream\",\n]);\n\nfunction isAllowedType(contentType: string): boolean {\n // Be permissive: allow if it starts with a known prefix or is in the set\n if (ALLOWED_TYPES.has(contentType)) return true;\n if (contentType.startsWith(\"image/\")) return true;\n if (contentType.startsWith(\"audio/\")) return true;\n if (contentType.startsWith(\"video/\")) return true;\n if (contentType.startsWith(\"text/\")) return true;\n return false;\n}\n\n// --- Size limit: 10MB raw ---\nconst MAX_SIZE = 10 * 1024 * 1024;\n\n// --- Upload form HTML ---\nfunction buildUploadFormHtml(origin: string): string {\n return `\n\n\n \n \n Upload\n \n\n\n

\n\n

Upload

Static file hosting service — HTML, images, media

\n\n \n

Upload

\n \n

\n\n \n

Recent Uploads

\n \n

\n\n \n

API Reference

\n\n

POST /upload

Upload a file via multipart/form-data. Returns JSON with the public URL of the uploaded file.

\n\n

Authentication

\n \n \n \n \n

Method	Detail
Bearer token	`Authorization: Bearer <token>`
Form field	`password` field in the multipart body

\n\n

Fields

\n \n \n \n \n \n \n \n

Field	Type		Detail
`file`	file	Required	HTML, PNG, JPEG, PDF, etc.
`filename`	text	Optional	Override filename in URL
`description`	text	Optional	Readable slug, stored as metadata
`expires_in`	text	Optional	`7d` (default), `14d`, or `never`
`password`	text	Optional	Auth token (alternative to header)

\n\n

Response

{ \"url\": \"/uploads/a3f1b2-my-report-dashboard.html\",\n  \"expiresAt\": \"2026-02-24T12:00:00.000Z\" }

\n\n

GET /uploads/{id}

Serves the file publicly before expiration. After expiration, requires authentication with the same token used for uploads.

\n\n

Examples

\n\n

Basic upload (defaults to 7-day expiration)

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@page.html\"

\n\n

Upload with 14-day expiration

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@report.pdf\" \\\\\n  -F \"expires_in=14d\"

\n\n

Upload without expiration

curl -X POST ${origin}/upload \\\\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\\\n  -F \"file=@permanent.html\" \\\\\n  -F \"expires_in=never\"

\n\n

Retrieve after expiration (Basic Auth)

curl -u :YOUR_TOKEN ${origin}/uploads/a3f1b2-report.pdf

\n\n

Expiration Behavior

Default: All uploads expire after 7 days.

\n\n

Before expiration: Files are publicly accessible with no authentication required.

\n\n

After expiration: Files require authentication using your UPLOAD_TOKEN via:

HTTP Basic Auth: curl -u :YOUR_TOKEN <url>

\n\n

URL Format

IDs follow the pattern {hex}-{slug}-{filename}

\n \n \n \n \n \n

Provided	Example
File only	`/uploads/a3f1b2-screenshot.png`
+ filename	`/uploads/a3f1b2-hero.png`
+ description	`/uploads/a3f1b2-team-photo-hero.png`

\n\n

Limits

10 MB maximum file size.
Accepted: HTML, CSS, JS, JSON, images, audio, video, PDF.

\n\n \n\n

\n \n\n`;\n}\n\n// --- Main Handler ---\nexport default async function(req: Request): Promise {\n const url = new URL(req.url);\n\n // GET / — show upload form + API docs\n if (req.method === \"GET\" && url.pathname === \"/\") {\n return new Response(buildUploadFormHtml(url.origin), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n // POST /upload — authenticated file upload\n if (req.method === \"POST\" && url.pathname === \"/upload\") {\n let formData: FormData;\n try {\n formData = await req.formData();\n } catch {\n return jsonResponse({ error: \"Invalid form data. Send multipart/form-data with a 'file' field.\" }, 400);\n }\n\n const password = formData.get(\"password\")?.toString();\n\n if (!authenticate(req, password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n const file = formData.get(\"file\");\n if (!(file instanceof File)) {\n return jsonResponse({ error: \"No file provided. Include a 'file' field in your form data.\" }, 400);\n }\n\n const rawBytes = new Uint8Array(await file.arrayBuffer());\n if (rawBytes.length === 0) {\n return jsonResponse({ error: \"File is empty.\" }, 400);\n }\n if (rawBytes.length > MAX_SIZE) {\n return jsonResponse({ error: `File too large. Max size is ${MAX_SIZE / 1024 / 1024}MB.` }, 413);\n }\n\n const contentType = file.type || \"application/octet-stream\";\n if (!isAllowedType(contentType)) {\n return jsonResponse({ error: `Content type '${contentType}' is not allowed.` }, 415);\n }\n\n const filenameOverride = formData.get(\"filename\")?.toString().trim() || undefined;\n const description = formData.get(\"description\")?.toString().trim() || undefined;\n const expiresIn = formData.get(\"expires_in\")?.toString().trim() || undefined;\n\n const expiresAt = resolveExpiration(expiresIn);\n if (expiresAt === undefined) {\n return jsonResponse({ error: \"Invalid expires_in value. Use '7d', '14d', or 'never'.\" }, 400);\n }\n\n const compressed = await gzip(rawBytes);\n const id = buildUploadId({\n description,\n filenameOverride,\n originalName: file.name || \"upload\",\n });\n\n try {\n await sqlite.execute({\n sql: \"INSERT INTO uploads (id, content_type, description, data, expires_at) VALUES (?, ?, ?, ?, ?)\",\n args: [id, contentType, description ?? null, compressed, expiresAt],\n });\n } catch (err: any) {\n // Handle unlikely collision — retry with longer hex prefix\n if (err.message?.includes(\"UNIQUE constraint\")) {\n const retryId = `${randomHex(5)}-${id.slice(7)}`; // replace 6-char hex with 10-char\n await sqlite.execute({\n sql: \"INSERT INTO uploads (id, content_type, description, data, expires_at) VALUES (?, ?, ?, ?, ?)\",\n args: [retryId, contentType, description ?? null, compressed, expiresAt],\n });\n return jsonResponse({\n url: `/uploads/${retryId}`,\n id: retryId,\n filename: filenameOverride || file.name || \"upload\",\n description: description ?? null,\n contentType,\n size: rawBytes.length,\n createdAt: new Date().toISOString(),\n expiresAt,\n });\n }\n throw err;\n }\n\n return jsonResponse({\n url: `/uploads/${id}`,\n id,\n filename: filenameOverride || file.name || \"upload\",\n description: description ?? null,\n contentType,\n size: rawBytes.length,\n createdAt: new Date().toISOString(),\n expiresAt,\n });\n }\n\n // GET /uploads/{id} — serve uploaded content\n const uploadMatch = url.pathname.match(/^\\/uploads\\/(.+)$/);\n if (req.method === \"GET\" && uploadMatch) {\n const id = decodeURIComponent(uploadMatch[1]);\n\n const result = await sqlite.execute({\n sql: \"SELECT content_type, data, expires_at FROM uploads WHERE id = ?\",\n args: [id],\n });\n\n if (!result.rows.length) {\n return new Response(\"Not Found\", { status: 404 });\n }\n\n const row = result.rows[0];\n const contentType = (row as any).content_type;\n const data = (row as any).data;\n const expiresAt = (row as any).expires_at;\n\n // Check if file has expired\n if (expiresAt) {\n const now = new Date();\n const expiry = new Date(expiresAt);\n\n if (now > expiry) {\n // File has expired — require UPLOAD_TOKEN via Basic Auth or ?password=\n if (!checkBasicAuth(req)) {\n return new Response(\"Unauthorized: This file has expired and requires authentication.\", {\n status: 401,\n headers: {\n \"WWW-Authenticate\": 'Basic realm=\"Expired Upload\", charset=\"UTF-8\"',\n \"Content-Type\": \"text/plain\",\n },\n });\n }\n }\n }\n\n // Convert data to Uint8Array if needed\n const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);\n\n const acceptEncoding = req.headers.get(\"Accept-Encoding\") || \"\";\n if (acceptEncoding.includes(\"gzip\")) {\n return new Response(bytes, {\n headers: {\n \"Content-Type\": contentType,\n \"Content-Encoding\": \"gzip\",\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n \"Vary\": \"Accept-Encoding\",\n },\n });\n }\n\n // Rare fallback: client doesn't support gzip\n const decompressed = await gunzip(bytes);\n return new Response(decompressed, {\n headers: {\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n },\n });\n }\n\n return new Response(\"Not Found\", { status: 404 });\n}\n\nfunction jsonResponse(data: Record, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n","deleted",false,"label","p6r-uploads",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":58,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_59":60,"_18":61},["D",1775582038582],"children",[],[35],"80416848-06d5-11f1-95fd-42dde27851f2",["D",1770764947473],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","c821e8f7-4cc4-4c23-96f1-319b8f33d4b7","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","6b193d60-e165-45a9-869c-c3f886455f3e","tursoName","8041684806d511f195fd42dde27851f2","tursoHostname","8041684806d511f195fd42dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789447273596],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_118":114},"org",{"_11":12,"_112":-5,"_113":114,"_71":72,"_115":116,"_117":53},"branch",{"_17":42,"_13":16,"_33":40,"_104":62,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":14,"_111":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvdXBsb2FkZWQvaW1nXzJ6RVZCOExVNXBIT3FrVDh5a0VZQTNRRG5ycCJ9","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":62,"_13":14,"_45":152,"_64":-5,"_65":53,"_66":67,"_68":67,"_69":-5,"_70":-5,"_71":72,"_73":-5,"_74":53,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":82,"_83":84,"_85":153,"_87":-5,"_88":89,"_90":89,"_91":92,"_93":92,"_94":92,"_95":89,"_96":89,"_97":154,"_99":155,"_101":156,"_103":53},[149],"files",[149],"counts",{"_139":78,"_140":141,"_142":78,"_31":143,"_144":145},[137],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_18":138},[35],"pulls","branches",1,"forks",{"_146":141,"_148":78},"connections",{"_146":78,"_147":78},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":58,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_59":150,"_18":151},[],[35],["D",1770764947473],["D",1789447273596],{"_11":12,"_118":114},{"_11":12,"_112":-5,"_113":114,"_71":72,"_115":116,"_117":53},{"_17":42,"_13":16,"_33":40,"_104":62,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":14,"_111":12},"ctx",{"_97":-5,"_134":190,"_191":192,"_193":194,"_195":53,"_196":53,"_197":53,"_198":44,"_199":-5,"_200":-7,"_201":-7,"_202":78,"_203":53,"_204":53,"_205":-5,"_206":53,"_207":53,"_208":53,"_209":-5},"ENV",{"_161":162,"_163":164,"_165":16,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code