[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_184":185,"_186":187},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_61":148,"_16":-7,"_149":-5,"_17":150,"_151":152,"_28":153,"_21":154,"_23":155,"_156":-5,"_157":-5,"_158":-5,"_159":35,"_160":161,"_162":38,"_163":-5,"_164":-5,"_165":166},"routes/_app.x.$handle.$name._index",{"_11":12,"_13":14,"_15":-7,"_16":-7,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-7,"_26":-5,"_27":-5,"_28":29,"_30":31,"_32":-5,"_33":-5,"_34":35,"_36":35,"_37":38},"handle","divendeng","name","file-vault","branchName","version","project",{"_39":89,"_13":14,"_50":90,"_91":-5,"_92":35,"_93":94,"_95":94,"_96":97,"_98":-5,"_99":100,"_101":43,"_102":38,"_103":-5,"_104":-5,"_105":52,"_106":107,"_108":109,"_110":111,"_112":113,"_114":-5,"_115":116,"_117":116,"_118":119,"_120":119,"_121":119,"_122":116,"_123":116,"_124":125,"_126":127,"_128":129,"_130":35},"tags",[],"counts",{"_79":52,"_80":48,"_81":52,"_82":83,"_84":85},"contents",[73,74],"readme","upstream","pull","files",[63,31],"preview",{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":51,"_16":52,"_53":54,"_55":56,"_57":35,"_58":-5,"_59":60,"_61":62},"ahead","behind","showHomeCustomizationHint",false,"showHTTPPreviewSettingsHint","hasHTTPFiles",true,"id","191108a0-5eb8-11f1-b358-1607ee4eb77e","main.tsx","fileId","1911094a-5eb8-11f1-b358-1607ee4eb77e","parentId","branchId","fc4f0fb4-5eb7-11f1-8e7e-1607ee4eb77e","branchVersion",1,"latest","createdAt",["D",1780428021261],0,"fileType","http","content","/** @jsxImportSource https://esm.sh/hono@4.5.6/jsx */\nimport { Hono } from \"npm:hono@4.5.6\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { blob } from \"https://esm.town/v/std/blob\";\n\n// ---------------------------------------------------------------------------\n// File Vault — a minimal multi-tenant file storage MVP on Val Town\n//\n// This is a working, single-instance proof-of-concept of the requirements doc:\n// - multi-tenant isolation (every query is scoped by tenant_id)\n// - public vs private files\n// - metadata stored in SQLite, bytes stored in blob storage\n// - private files require an auth check before returning a short-lived link\n//\n// NOTE: The original spec targets Remix + Vercel + Cloudflare R2 + Postgres with\n// *direct-to-R2* upload/download. Val Town can't host that exact stack, so this\n// MVP keeps the same data model + access-control logic and uses Val Town's\n// SQLite (metadata) + Blob storage (bytes). The architecture maps cleanly to\n// R2 later — see the README for the migration notes.\n// ---------------------------------------------------------------------------\n\nconst app = new Hono();\n\n// --- one-time schema setup -------------------------------------------------\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS files_v1 (\n id TEXT PRIMARY KEY,\n tenant_id TEXT NOT NULL,\n object_key TEXT NOT NULL,\n visibility TEXT NOT NULL, -- 'public' | 'private'\n original_name TEXT NOT NULL,\n mime_type TEXT,\n size_bytes INTEGER NOT NULL,\n uploaded_by TEXT,\n status TEXT NOT NULL DEFAULT 'ready',\n created_at INTEGER NOT NULL,\n deleted_at INTEGER\n )`,\n]);\n\n// --- tiny helpers ----------------------------------------------------------\nconst now = () => Date.now();\nconst ulid = () =>\n Date.now().toString(36) + \"-\" + crypto.randomUUID().replace(/-/g, \"\").slice(0, 16);\n\n// In a real system the tenant comes from the authenticated session.\n// For this MVP we read it from a header (default \"demo\") so isolation is\n// demonstrable without a full auth flow yet.\nconst tenantOf = (c: any) => c.req.header(\"x-tenant-id\") || \"demo\";\n\n// object key: never leaks original filename / db id, not enumerable\nfunction makeObjectKey(tenantId: string, fileId: string) {\n const d = new Date();\n const yy = String(d.getUTCFullYear()).slice(2);\n const mm = String(d.getUTCMonth() + 1).padStart(2, \"0\");\n const rand = crypto.randomUUID().slice(0, 8);\n return `tenant/${tenantId}/${yy}/${mm}/${rand}/${fileId}`;\n}\n\n// blob key namespace for actual bytes\nconst blobKey = (objectKey: string) => `filevault/${objectKey}`;\n\n// ---------------------------------------------------------------------------\n// API\n// ---------------------------------------------------------------------------\n\n// Upload: accepts the bytes here for the MVP (Val Town has no presigned R2 yet).\n// Returns the created file record. Validates size + visibility.\napp.post(\"/api/files\", async (c) => {\n const tenantId = tenantOf(c);\n const form = await c.req.formData();\n const file = form.get(\"file\") as File | null;\n const visibility = String(form.get(\"visibility\") || \"private\");\n\n if (!file) return c.json({ error: \"no file provided\" }, 400);\n if (![\"public\", \"private\"].includes(visibility))\n return c.json({ error: \"invalid visibility\" }, 400);\n\n const MAX = 25 * 1024 * 1024; // 25MB MVP limit\n if (file.size > MAX) return c.json({ error: \"file too large (max 25MB)\" }, 413);\n\n const id = ulid();\n const objectKey = makeObjectKey(tenantId, id);\n const bytes = new Uint8Array(await file.arrayBuffer());\n await blob.set(blobKey(objectKey), bytes);\n\n await sqlite.execute({\n sql: `INSERT INTO files_v1\n (id, tenant_id, object_key, visibility, original_name, mime_type, size_bytes, uploaded_by, status, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'ready', ?)`,\n args: [id, tenantId, objectKey, visibility, file.name, file.type || \"application/octet-stream\", file.size, \"demo-user\", now()],\n });\n\n return c.json({ id, visibility, original_name: file.name, size_bytes: file.size });\n});\n\n// List files for the current tenant (soft-deleted hidden). Optional ?visibility=\napp.get(\"/api/files\", async (c) => {\n const tenantId = tenantOf(c);\n const vis = c.req.query(\"visibility\");\n const where = [\"tenant_id = ?\", \"deleted_at IS NULL\"];\n const args: any[] = [tenantId];\n if (vis && [\"public\", \"private\"].includes(vis)) {\n where.push(\"visibility = ?\");\n args.push(vis);\n }\n const res = await sqlite.execute({\n sql: `SELECT id, visibility, original_name, mime_type, size_bytes, created_at\n FROM files_v1 WHERE ${where.join(\" AND \")} ORDER BY created_at DESC LIMIT 100`,\n args,\n });\n return c.json({ files: res.rows });\n});\n\n// Soft delete (tenant-scoped)\napp.delete(\"/api/files/:id\", async (c) => {\n const tenantId = tenantOf(c);\n const id = c.req.param(\"id\");\n const res = await sqlite.execute({\n sql: `UPDATE files_v1 SET deleted_at = ? WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL`,\n args: [now(), id, tenantId],\n });\n if (res.rowsAffected === 0) return c.json({ error: \"not found\" }, 404);\n return c.json({ ok: true });\n});\n\n// Request a short-lived download link for a PRIVATE file (auth check happens here).\n// Returns a signed token URL that expires in <5 min, matching the spec.\nconst DL_SECRET = Deno.env.get(\"DL_SECRET\") || \"dev-only-secret-change-me\";\nasync function sign(payload: string, exp: number) {\n const key = await crypto.subtle.importKey(\n \"raw\", new TextEncoder().encode(DL_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(`${payload}.${exp}`));\n return btoa(String.fromCharCode(...new Uint8Array(sig))).replace(/[+/=]/g, (m) => ({ \"+\": \"-\", \"/\": \"_\", \"=\": \"\" }[m]!));\n}\n\napp.post(\"/api/files/:id/download\", async (c) => {\n const tenantId = tenantOf(c);\n const id = c.req.param(\"id\");\n const res = await sqlite.execute({\n sql: `SELECT id, visibility FROM files_v1 WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL`,\n args: [id, tenantId],\n });\n if (res.rows.length === 0) return c.json({ error: \"not found or access denied\" }, 404);\n const exp = now() + 4 * 60 * 1000; // 4 minutes\n const token = await sign(`${tenantId}:${id}`, exp);\n const url = new URL(c.req.url);\n return c.json({\n downloadUrl: `${url.origin}/dl/${id}?t=${token}&e=${exp}&tn=${encodeURIComponent(tenantId)}`,\n expiresAt: new Date(exp).toISOString(),\n });\n});\n\n// Public file: direct access, no auth.\napp.get(\"/public/:id\", async (c) => {\n const id = c.req.param(\"id\");\n const res = await sqlite.execute({\n sql: `SELECT object_key, original_name, mime_type, visibility FROM files_v1 WHERE id = ? AND deleted_at IS NULL`,\n args: [id],\n });\n const row = res.rows[0];\n if (!row || row[3] !== \"public\") return c.text(\"Not found\", 404);\n const data = await blob.get(blobKey(row[0] as string));\n return new Response(data.body, {\n headers: {\n \"Content-Type\": (row[2] as string) || \"application/octet-stream\",\n \"Content-Disposition\": `inline; filename=\"${row[1]}\"`,\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n});\n\n// Signed download endpoint (used by the short-lived link above).\napp.get(\"/dl/:id\", async (c) => {\n const id = c.req.param(\"id\");\n const token = c.req.query(\"t\") || \"\";\n const exp = Number(c.req.query(\"e\") || 0);\n const tenantId = decodeURIComponent(c.req.query(\"tn\") || \"\");\n if (now() > exp) return c.text(\"Link expired\", 410);\n const expected = await sign(`${tenantId}:${id}`, exp);\n if (token !== expected) return c.text(\"Invalid signature\", 403);\n\n const res = await sqlite.execute({\n sql: `SELECT object_key, original_name, mime_type FROM files_v1 WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL`,\n args: [id, tenantId],\n });\n const row = res.rows[0];\n if (!row) return c.text(\"Not found\", 404);\n const data = await blob.get(blobKey(row[0] as string));\n return new Response(data.body, {\n headers: {\n \"Content-Type\": (row[2] as string) || \"application/octet-stream\",\n \"Content-Disposition\": `attachment; filename=\"${row[1]}\"`,\n },\n });\n});\n\n// --- UI --------------------------------------------------------------------\napp.get(\"/\", (c) => {\n return c.html(`\n\nFile Vault\n\n\n

📦 File Vault

Multi-tenant storage MVP · tenant: demo

\n\n \n\n

\n\n`);\n});\n\nexport default app.fetch;\n","deleted","label","children",[],"path",[41],{"_39":64,"_13":65,"_42":66,"_44":-5,"_45":46,"_47":67,"_49":38,"_50":68,"_16":52,"_53":69,"_55":70,"_57":35,"_58":-5,"_59":71,"_61":72},"20419c52-5eb8-11f1-a544-1607ee4eb77e","app.js","20419d2e-5eb8-11f1-a544-1607ee4eb77e",2,["D",1780428033325],"script","// File Vault — client. Vanilla JS, no build step.\nconst $ = (s) => document.querySelector(s);\nconst fmt = (n) => (n < 1024 ? n + \" B\" : n < 1048576 ? (n / 1024).toFixed(1) + \" KB\" : (n / 1048576).toFixed(1) + \" MB\");\n\nasync function load() {\n const res = await fetch(\"/api/files\");\n const { files } = await res.json();\n const list = $(\"#list\");\n if (!files.length) {\n list.innerHTML = `

No files yet. Upload one above.

`;\n return;\n }\n list.innerHTML = files.map((f) => {\n // rows are [id, visibility, original_name, mime_type, size_bytes, created_at]\n const [id, vis, name, , size] = f;\n const badge = vis === \"public\"\n ? `public`\n : `private`;\n return `

${name} ${badge}

${fmt(size)}

\n \n \n

`;\n }).join(\"\");\n}\n\n$(\"#up\").addEventListener(\"submit\", async (e) => {\n e.preventDefault();\n const msg = $(\"#msg\");\n msg.textContent = \"Uploading…\";\n const res = await fetch(\"/api/files\", { method: \"POST\", body: new FormData(e.target) });\n const data = await res.json();\n if (!res.ok) { msg.textContent = \"❌ \" + (data.error || \"failed\"); return; }\n msg.textContent = \"✅ uploaded\";\n e.target.reset();\n load();\n});\n\n$(\"#list\").addEventListener(\"click\", async (e) => {\n const dl = e.target.getAttribute(\"data-dl\");\n const del = e.target.getAttribute(\"data-del\");\n if (dl) {\n if (e.target.getAttribute(\"data-vis\") === \"public\") {\n window.open(\"/public/\" + dl, \"_blank\");\n } else {\n const res = await fetch(`/api/files/${dl}/download`, { method: \"POST\" });\n const data = await res.json();\n if (res.ok) window.open(data.downloadUrl, \"_blank\");\n else alert(data.error || \"access denied\");\n }\n }\n if (del) {\n if (!confirm(\"Delete this file?\")) return;\n await fetch(\"/api/files/\" + del, { method: \"DELETE\" });\n load();\n }\n});\n\nload();\n",[],[65],{"_39":64,"_13":65,"_42":66,"_44":-5,"_45":46,"_47":67,"_49":38,"_50":77,"_16":52,"_53":69,"_55":70,"_57":35,"_58":-5,"_61":78},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":75,"_16":52,"_53":54,"_55":56,"_57":35,"_58":-5,"_61":76},["D",1780428021261],[41],["D",1780428033325],[65],"pulls","branches","forks","envVars",{"_86":52,"_88":52},"connections",{"_86":52,"_87":52},"count","unfilledCount","emptyCount","fc4d5d72-5eb7-11f1-8e7e-1607ee4eb77e",["D",1780427973014],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Multi-tenant file storage with public/private access","imageUrl","userId","ebcfe771-cf77-4c3a-b695-d9da37ce76d3","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019e89c5-d559-700d-ac2d-d02a7eb47430","tursoName","fc4d5d725eb711f18e7e1607ee4eb77e","tursoHostname","fc4d5d725eb711f18e7e1607ee4eb77e-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789588922309],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_147":143},"org",{"_11":12,"_140":141,"_142":143,"_99":100,"_144":145,"_146":35},"branch",{"_16":67,"_13":131,"_39":46,"_132":89,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":-5,"_138":14,"_139":12},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Diven Deng","avatar","https://lh3.googleusercontent.com/a/ACg8ocJXW3ZktoUfYc30ZxE8PxJTMUoOz29BW2A-g_gtfTpDchc5mEk=s96-c","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_39":89,"_13":14,"_50":179,"_91":-5,"_92":35,"_93":94,"_95":94,"_96":97,"_98":-5,"_99":100,"_101":43,"_102":38,"_103":-5,"_104":-5,"_105":52,"_106":107,"_108":109,"_110":111,"_112":180,"_114":-5,"_115":116,"_117":116,"_118":119,"_120":119,"_121":119,"_122":116,"_123":116,"_124":181,"_126":182,"_128":183,"_130":35},"tree",[173,174],[173,174],{"_79":52,"_80":48,"_81":52,"_82":171,"_84":172},[167,168],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_39":64,"_13":65,"_42":66,"_44":-5,"_45":46,"_47":67,"_49":38,"_50":77,"_16":52,"_53":69,"_55":70,"_57":35,"_58":-5,"_61":170},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":75,"_16":52,"_53":54,"_55":56,"_57":35,"_58":-5,"_61":169},[41],[65],{"_86":52,"_88":52},{"_86":52,"_87":52},{"_39":64,"_13":65,"_42":66,"_44":-5,"_45":46,"_47":67,"_49":38,"_50":68,"_16":52,"_53":69,"_55":70,"_57":35,"_58":-5,"_59":177,"_61":178},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":51,"_16":52,"_53":54,"_55":56,"_57":35,"_58":-5,"_59":175,"_61":176},[],[41],[],[65],["D",1780427973014],["D",1789588922309],{"_11":12,"_147":143},{"_11":12,"_140":141,"_142":143,"_99":100,"_144":145,"_146":35},{"_16":67,"_13":131,"_39":46,"_132":89,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":-5,"_138":14,"_139":12},"ctx",{"_124":-5,"_164":217,"_218":219,"_220":221,"_222":35,"_223":35,"_224":35,"_225":38,"_226":-5,"_227":-7,"_228":-7,"_229":52,"_230":35,"_231":35,"_232":-5,"_233":35,"_234":35,"_235":35,"_236":-5},"ENV",{"_188":189,"_190":191,"_192":131,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]