[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_174":175,"_176":177},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_132":-5,"_20":133,"_22":134,"_135":136,"_137":138,"_25":139,"_24":-5,"_140":-5,"_141":-5,"_142":54,"_143":144,"_145":45,"_146":-5,"_147":-5,"_148":149},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","divendeng","name","file-vault","branchName","main","version","path","","project",{"_34":74,"_13":14,"_46":75,"_76":-5,"_77":54,"_78":79,"_80":79,"_81":82,"_83":-5,"_84":85,"_86":38,"_87":45,"_88":-5,"_89":-5,"_90":48,"_91":92,"_93":94,"_95":96,"_97":98,"_99":-5,"_100":101,"_102":101,"_103":104,"_105":104,"_106":104,"_107":101,"_108":101,"_109":110,"_111":112,"_113":114,"_115":54},"tree",[65,66],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":48,"_49":62,"_51":63,"_53":54,"_55":-5,"_18":64},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":56},"id","191108a0-5eb8-11f1-b358-1607ee4eb77e","main.tsx","fileId","1911094a-5eb8-11f1-b358-1607ee4eb77e","parentId","branchId","fc4f0fb4-5eb7-11f1-8e7e-1607ee4eb77e","branchVersion",1,"latest",true,"createdAt",["D",1780428021261],0,"fileType","http","content","/** @jsxImportSource https://esm.sh/hono@4.5.6/jsx */\nimport { Hono } from \"npm:hono@4.5.6\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { blob } from \"https://esm.town/v/std/blob\";\n\n// ---------------------------------------------------------------------------\n// File Vault — a minimal multi-tenant file storage MVP on Val Town\n//\n// This is a working, single-instance proof-of-concept of the requirements doc:\n// - multi-tenant isolation (every query is scoped by tenant_id)\n// - public vs private files\n// - metadata stored in SQLite, bytes stored in blob storage\n// - private files require an auth check before returning a short-lived link\n//\n// NOTE: The original spec targets Remix + Vercel + Cloudflare R2 + Postgres with\n// *direct-to-R2* upload/download. Val Town can't host that exact stack, so this\n// MVP keeps the same data model + access-control logic and uses Val Town's\n// SQLite (metadata) + Blob storage (bytes). The architecture maps cleanly to\n// R2 later — see the README for the migration notes.\n// ---------------------------------------------------------------------------\n\nconst app = new Hono();\n\n// --- one-time schema setup -------------------------------------------------\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS files_v1 (\n id TEXT PRIMARY KEY,\n tenant_id TEXT NOT NULL,\n object_key TEXT NOT NULL,\n visibility TEXT NOT NULL, -- 'public' | 'private'\n original_name TEXT NOT NULL,\n mime_type TEXT,\n size_bytes INTEGER NOT NULL,\n uploaded_by TEXT,\n status TEXT NOT NULL DEFAULT 'ready',\n created_at INTEGER NOT NULL,\n deleted_at INTEGER\n )`,\n]);\n\n// --- tiny helpers ----------------------------------------------------------\nconst now = () => Date.now();\nconst ulid = () =>\n Date.now().toString(36) + \"-\" + crypto.randomUUID().replace(/-/g, \"\").slice(0, 16);\n\n// In a real system the tenant comes from the authenticated session.\n// For this MVP we read it from a header (default \"demo\") so isolation is\n// demonstrable without a full auth flow yet.\nconst tenantOf = (c: any) => c.req.header(\"x-tenant-id\") || \"demo\";\n\n// object key: never leaks original filename / db id, not enumerable\nfunction makeObjectKey(tenantId: string, fileId: string) {\n const d = new Date();\n const yy = String(d.getUTCFullYear()).slice(2);\n const mm = String(d.getUTCMonth() + 1).padStart(2, \"0\");\n const rand = crypto.randomUUID().slice(0, 8);\n return `tenant/${tenantId}/${yy}/${mm}/${rand}/${fileId}`;\n}\n\n// blob key namespace for actual bytes\nconst blobKey = (objectKey: string) => `filevault/${objectKey}`;\n\n// ---------------------------------------------------------------------------\n// API\n// ---------------------------------------------------------------------------\n\n// Upload: accepts the bytes here for the MVP (Val Town has no presigned R2 yet).\n// Returns the created file record. Validates size + visibility.\napp.post(\"/api/files\", async (c) => {\n const tenantId = tenantOf(c);\n const form = await c.req.formData();\n const file = form.get(\"file\") as File | null;\n const visibility = String(form.get(\"visibility\") || \"private\");\n\n if (!file) return c.json({ error: \"no file provided\" }, 400);\n if (![\"public\", \"private\"].includes(visibility))\n return c.json({ error: \"invalid visibility\" }, 400);\n\n const MAX = 25 * 1024 * 1024; // 25MB MVP limit\n if (file.size > MAX) return c.json({ error: \"file too large (max 25MB)\" }, 413);\n\n const id = ulid();\n const objectKey = makeObjectKey(tenantId, id);\n const bytes = new Uint8Array(await file.arrayBuffer());\n await blob.set(blobKey(objectKey), bytes);\n\n await sqlite.execute({\n sql: `INSERT INTO files_v1\n (id, tenant_id, object_key, visibility, original_name, mime_type, size_bytes, uploaded_by, status, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'ready', ?)`,\n args: [id, tenantId, objectKey, visibility, file.name, file.type || \"application/octet-stream\", file.size, \"demo-user\", now()],\n });\n\n return c.json({ id, visibility, original_name: file.name, size_bytes: file.size });\n});\n\n// List files for the current tenant (soft-deleted hidden). Optional ?visibility=\napp.get(\"/api/files\", async (c) => {\n const tenantId = tenantOf(c);\n const vis = c.req.query(\"visibility\");\n const where = [\"tenant_id = ?\", \"deleted_at IS NULL\"];\n const args: any[] = [tenantId];\n if (vis && [\"public\", \"private\"].includes(vis)) {\n where.push(\"visibility = ?\");\n args.push(vis);\n }\n const res = await sqlite.execute({\n sql: `SELECT id, visibility, original_name, mime_type, size_bytes, created_at\n FROM files_v1 WHERE ${where.join(\" AND \")} ORDER BY created_at DESC LIMIT 100`,\n args,\n });\n return c.json({ files: res.rows });\n});\n\n// Soft delete (tenant-scoped)\napp.delete(\"/api/files/:id\", async (c) => {\n const tenantId = tenantOf(c);\n const id = c.req.param(\"id\");\n const res = await sqlite.execute({\n sql: `UPDATE files_v1 SET deleted_at = ? WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL`,\n args: [now(), id, tenantId],\n });\n if (res.rowsAffected === 0) return c.json({ error: \"not found\" }, 404);\n return c.json({ ok: true });\n});\n\n// Request a short-lived download link for a PRIVATE file (auth check happens here).\n// Returns a signed token URL that expires in <5 min, matching the spec.\nconst DL_SECRET = Deno.env.get(\"DL_SECRET\") || \"dev-only-secret-change-me\";\nasync function sign(payload: string, exp: number) {\n const key = await crypto.subtle.importKey(\n \"raw\", new TextEncoder().encode(DL_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(`${payload}.${exp}`));\n return btoa(String.fromCharCode(...new Uint8Array(sig))).replace(/[+/=]/g, (m) => ({ \"+\": \"-\", \"/\": \"_\", \"=\": \"\" }[m]!));\n}\n\napp.post(\"/api/files/:id/download\", async (c) => {\n const tenantId = tenantOf(c);\n const id = c.req.param(\"id\");\n const res = await sqlite.execute({\n sql: `SELECT id, visibility FROM files_v1 WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL`,\n args: [id, tenantId],\n });\n if (res.rows.length === 0) return c.json({ error: \"not found or access denied\" }, 404);\n const exp = now() + 4 * 60 * 1000; // 4 minutes\n const token = await sign(`${tenantId}:${id}`, exp);\n const url = new URL(c.req.url);\n return c.json({\n downloadUrl: `${url.origin}/dl/${id}?t=${token}&e=${exp}&tn=${encodeURIComponent(tenantId)}`,\n expiresAt: new Date(exp).toISOString(),\n });\n});\n\n// Public file: direct access, no auth.\napp.get(\"/public/:id\", async (c) => {\n const id = c.req.param(\"id\");\n const res = await sqlite.execute({\n sql: `SELECT object_key, original_name, mime_type, visibility FROM files_v1 WHERE id = ? AND deleted_at IS NULL`,\n args: [id],\n });\n const row = res.rows[0];\n if (!row || row[3] !== \"public\") return c.text(\"Not found\", 404);\n const data = await blob.get(blobKey(row[0] as string));\n return new Response(data.body, {\n headers: {\n \"Content-Type\": (row[2] as string) || \"application/octet-stream\",\n \"Content-Disposition\": `inline; filename=\"${row[1]}\"`,\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n});\n\n// Signed download endpoint (used by the short-lived link above).\napp.get(\"/dl/:id\", async (c) => {\n const id = c.req.param(\"id\");\n const token = c.req.query(\"t\") || \"\";\n const exp = Number(c.req.query(\"e\") || 0);\n const tenantId = decodeURIComponent(c.req.query(\"tn\") || \"\");\n if (now() > exp) return c.text(\"Link expired\", 410);\n const expected = await sign(`${tenantId}:${id}`, exp);\n if (token !== expected) return c.text(\"Invalid signature\", 403);\n\n const res = await sqlite.execute({\n sql: `SELECT object_key, original_name, mime_type FROM files_v1 WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL`,\n args: [id, tenantId],\n });\n const row = res.rows[0];\n if (!row) return c.text(\"Not found\", 404);\n const data = await blob.get(blobKey(row[0] as string));\n return new Response(data.body, {\n headers: {\n \"Content-Type\": (row[2] as string) || \"application/octet-stream\",\n \"Content-Disposition\": `attachment; filename=\"${row[1]}\"`,\n },\n });\n});\n\n// --- UI --------------------------------------------------------------------\napp.get(\"/\", (c) => {\n return c.html(`\n\nFile Vault\n\n\n

📦 File Vault

Multi-tenant storage MVP · tenant: demo

\n\n \n\n

\n\n`);\n});\n\nexport default app.fetch;\n","deleted",false,"label",[36],"20419c52-5eb8-11f1-a544-1607ee4eb77e","app.js","20419d2e-5eb8-11f1-a544-1607ee4eb77e",2,["D",1780428033325],"script","// File Vault — client. Vanilla JS, no build step.\nconst $ = (s) => document.querySelector(s);\nconst fmt = (n) => (n < 1024 ? n + \" B\" : n < 1048576 ? (n / 1024).toFixed(1) + \" KB\" : (n / 1048576).toFixed(1) + \" MB\");\n\nasync function load() {\n const res = await fetch(\"/api/files\");\n const { files } = await res.json();\n const list = $(\"#list\");\n if (!files.length) {\n list.innerHTML = `

No files yet. Upload one above.

`;\n return;\n }\n list.innerHTML = files.map((f) => {\n // rows are [id, visibility, original_name, mime_type, size_bytes, created_at]\n const [id, vis, name, , size] = f;\n const badge = vis === \"public\"\n ? `public`\n : `private`;\n return `

${name} ${badge}

${fmt(size)}

\n \n \n

`;\n }).join(\"\");\n}\n\n$(\"#up\").addEventListener(\"submit\", async (e) => {\n e.preventDefault();\n const msg = $(\"#msg\");\n msg.textContent = \"Uploading…\";\n const res = await fetch(\"/api/files\", { method: \"POST\", body: new FormData(e.target) });\n const data = await res.json();\n if (!res.ok) { msg.textContent = \"❌ \" + (data.error || \"failed\"); return; }\n msg.textContent = \"✅ uploaded\";\n e.target.reset();\n load();\n});\n\n$(\"#list\").addEventListener(\"click\", async (e) => {\n const dl = e.target.getAttribute(\"data-dl\");\n const del = e.target.getAttribute(\"data-del\");\n if (dl) {\n if (e.target.getAttribute(\"data-vis\") === \"public\") {\n window.open(\"/public/\" + dl, \"_blank\");\n } else {\n const res = await fetch(`/api/files/${dl}/download`, { method: \"POST\" });\n const data = await res.json();\n if (res.ok) window.open(data.downloadUrl, \"_blank\");\n else alert(data.error || \"access denied\");\n }\n }\n if (del) {\n if (!confirm(\"Delete this file?\")) return;\n await fetch(\"/api/files/\" + del, { method: \"DELETE\" });\n load();\n }\n});\n\nload();\n",[58],{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":48,"_49":62,"_51":63,"_53":54,"_55":-5,"_68":72,"_18":73},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_68":69,"_18":70},["D",1780428021261],"children",[],[36],["D",1780428033325],[],[58],"fc4d5d72-5eb7-11f1-8e7e-1607ee4eb77e",["D",1780427973014],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Multi-tenant file storage with public/private access","imageUrl","userId","ebcfe771-cf77-4c3a-b695-d9da37ce76d3","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019e89c5-d559-700d-ac2d-d02a7eb47430","tursoName","fc4d5d725eb711f18e7e1607ee4eb77e","tursoHostname","fc4d5d725eb711f18e7e1607ee4eb77e-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789588922309],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_131":127},"org",{"_11":12,"_124":125,"_126":127,"_84":85,"_128":129,"_130":54},"branch",{"_17":60,"_13":16,"_34":41,"_116":74,"_117":-5,"_118":-5,"_119":-5,"_120":-5,"_121":-5,"_122":14,"_123":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Diven Deng","avatar","https://lh3.googleusercontent.com/a/ACg8ocJXW3ZktoUfYc30ZxE8PxJTMUoOz29BW2A-g_gtfTpDchc5mEk=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":74,"_13":14,"_46":169,"_76":-5,"_77":54,"_78":79,"_80":79,"_81":82,"_83":-5,"_84":85,"_86":38,"_87":45,"_88":-5,"_89":-5,"_90":48,"_91":92,"_93":94,"_95":96,"_97":170,"_99":-5,"_100":101,"_102":101,"_103":104,"_105":104,"_106":104,"_107":101,"_108":101,"_109":171,"_111":172,"_113":173,"_115":54},[163,164],"files",[163,164],"counts",{"_154":48,"_155":43,"_156":48,"_31":157,"_158":159},[150,151],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":48,"_49":62,"_51":63,"_53":54,"_55":-5,"_18":153},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":152},[36],[58],"pulls","branches","forks",{"_160":48,"_162":48},"connections",{"_160":48,"_161":48},"count","unfilledCount","emptyCount",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":48,"_49":62,"_51":63,"_53":54,"_55":-5,"_68":167,"_18":168},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_68":165,"_18":166},[],[36],[],[58],["D",1780427973014],["D",1789588922309],{"_11":12,"_131":127},{"_11":12,"_124":125,"_126":127,"_84":85,"_128":129,"_130":54},{"_17":60,"_13":16,"_34":41,"_116":74,"_117":-5,"_118":-5,"_119":-5,"_120":-5,"_121":-5,"_122":14,"_123":12},"ctx",{"_109":-5,"_147":207,"_208":209,"_210":211,"_212":54,"_213":54,"_214":54,"_215":45,"_216":-5,"_217":-7,"_218":-7,"_219":48,"_220":54,"_221":54,"_222":-5,"_223":54,"_224":54,"_225":54,"_226":-5},"ENV",{"_178":179,"_180":181,"_182":16,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","a3e067d4463eea85f6334f8e583e8516ae58c4f6","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]