[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_172":173,"_174":175},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_106":87,"_27":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":25,"_121":122,"_123":124,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":25},"version",32,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","f4962492-7b22-11f1-b1b8-1607ee4eb77e","name","fileType","http","content","const CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, PUT, DELETE, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n};\n\nfunction res(data: unknown, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { ...CORS, \"Content-Type\": \"application/json\" },\n });\n}\n\nconst DB = () => Deno.env.get(\"DB_URL\");\nconst SEC = () => Deno.env.get(\"FB_SECRET\");\n\nasync function fbGet(path: string) {\n const r = await fetch(`${DB()}/${path}.json?auth=${SEC()}`);\n if (!r.ok) throw new Error(\"db \" + r.status);\n return r.json();\n}\n\nasync function fbSet(path: string, data: unknown) {\n const r = await fetch(`${DB()}/${path}.json?auth=${SEC()}`, {\n method: \"PUT\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(data),\n });\n if (!r.ok) throw new Error(\"db \" + r.status);\n return r.json();\n}\n\nasync function fbIncrement(path: string, amount = 1) {\n const r = await fetch(`${DB()}/${path}.json?auth=${SEC()}`, {\n method: \"PUT\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ \".sv\": { \"increment\": amount } }),\n });\n if (!r.ok) throw new Error(\"db \" + r.status);\n return r.json();\n}\n\nasync function fbDelete(path: string) {\n const r = await fetch(`${DB()}/${path}.json?auth=${SEC()}`, {\n method: \"DELETE\",\n });\n if (!r.ok) throw new Error(\"db \" + r.status);\n return r.json();\n}\n\nfunction genToken() {\n const b = crypto.getRandomValues(new Uint8Array(24));\n return [...b].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function verifySession(tok: string) {\n if (!tok) return null;\n const session = await fbGet(`sessions/${tok}`);\n if (!session || !session.username) return null;\n const user = await fbGet(`Users/${session.username}`);\n if (!user) return null;\n return { username: session.username, ...user };\n}\n\nasync function cleanOldUserSessions(usernameKey: string) {\n try {\n const allSessions = (await fbGet(\"sessions\")) || {};\n const now = Date.now();\n const MAX_AGE = 14 * 24 * 60 * 60 * 1000;\n for (\n const [tok, sess] of Object.entries(\n allSessions as Record,\n )\n ) {\n if (sess && sess.username === usernameKey) {\n if (!sess.createdAt || (now - (sess.createdAt || 0)) > MAX_AGE) {\n await fbDelete(`sessions/${tok}`);\n }\n }\n }\n } catch (_) {}\n}\n\nfunction isValidUrl(str: string) {\n try {\n const u = new URL(str);\n return u.protocol === \"http:\" || u.protocol === \"https:\";\n } catch {\n return false;\n }\n}\n\nfunction cleanModuleNameForAlias(rawName: string): string {\n const normalized = rawName.normalize(\"NFD\").replace(/[\\u0300-\\u036f]/g, \"\");\n const asciiConverted = [...normalized].map((char) => {\n const code = char.codePointAt(0) || 0;\n if (code >= 0x1d400 && code <= 0x1d7ff) {\n if (code >= 0x1d400 && code <= 0x1d419) {\n return String.fromCharCode(65 + (code - 0x1d400));\n }\n if (code >= 0x1d41a && code <= 0x1d433) {\n return String.fromCharCode(97 + (code - 0x1d41a));\n }\n if (code >= 0x1d434 && code <= 0x1d44d) {\n return String.fromCharCode(65 + (code - 0x1d434));\n }\n if (code >= 0x1d44e && code <= 0x1d467) {\n return String.fromCharCode(97 + (code - 0x1d44e));\n }\n if (code >= 0x1d468 && code <= 0x1d481) {\n return String.fromCharCode(65 + (code - 0x1d468));\n }\n if (code >= 0x1d482 && code <= 0x1d49b) {\n return String.fromCharCode(97 + (code - 0x1d482));\n }\n if (code >= 0x1d7ce && code <= 0x1d7d7) {\n return String.fromCharCode(48 + (code - 0x1d7ce));\n }\n if (code >= 0x1d7d8 && code <= 0x1d7e1) {\n return String.fromCharCode(48 + (code - 0x1d7d8));\n }\n }\n return char;\n }).join(\"\");\n const cleanText = asciiConverted.replace(/[^a-zA-Z0-9]/g, \"\");\n return cleanText || \"Module\";\n}\n\nasync function generateShortlink(\n originalUrl: string,\n rawName: string,\n updateCount: number,\n): Promise {\n try {\n const cleanName = cleanModuleNameForAlias(rawName);\n const slug = updateCount === 0\n ? `Mod-${cleanName}`\n : `Mod-${cleanName}-v${updateCount}`;\n const proxyApi =\n `https://gexcysanchez--52fe6c529a7b11f194ec1607ee4eb77e.web.val.run?url=${\n encodeURIComponent(originalUrl)\n }&alias=${encodeURIComponent(slug)}`;\n const r = await fetch(proxyApi);\n if (r.ok) {\n const d = await r.json();\n if (d.shortLink) return d.shortLink;\n }\n } catch {}\n return \"\";\n}\n\nconst _loginAttempts: Record = {};\nconst LOGIN_WINDOW = 15 * 60 * 1000;\nconst LOGIN_MAX = 5;\n\nfunction checkLoginRateLimit(key: string): string | null {\n const now = Date.now();\n if (!_loginAttempts[key]) _loginAttempts[key] = [];\n _loginAttempts[key] = _loginAttempts[key].filter((t) =>\n now - t < LOGIN_WINDOW\n );\n if (_loginAttempts[key].length >= LOGIN_MAX) {\n const waitMs = LOGIN_WINDOW - (now - _loginAttempts[key][0]);\n const waitMin = Math.ceil(waitMs / 60000);\n return `Too many failed attempts. Please wait ${waitMin} minute${\n waitMin !== 1 ? \"s\" : \"\"\n }.`;\n }\n return null;\n}\n\nexport default async function (req: Request) {\n if (req.method === \"OPTIONS\") return new Response(null, { headers: CORS });\n\n const url = new URL(req.url);\n const segs = url.pathname.replace(/^\\/+/, \"\").split(\"/\").filter(Boolean);\n const m = req.method;\n\n try {\n if (m === \"POST\" && segs[0] === \"register\") {\n const { username, password } = await req.json();\n if (!username || !password) return res({ error: \"Missing fields\" }, 400);\n if (/\\s/.test(username)) {\n return res({ error: \"Username cannot contain spaces\" }, 400);\n }\n\n const key = username.toLowerCase().trim();\n const existing = await fbGet(`Users/${key}`);\n if (existing) return res({ error: \"Username already taken\" }, 409);\n\n const userData = {\n username: key,\n displayName: username,\n password,\n image: \"\",\n bio: \"\",\n status: null,\n createdAt: Date.now(),\n };\n await fbSet(`Users/${key}`, userData);\n await cleanOldUserSessions(key);\n const tok = genToken();\n await fbSet(`sessions/${tok}`, { username: key, createdAt: Date.now() });\n return res({\n username: key,\n displayName: username,\n image: \"\",\n bio: \"\",\n status: null,\n sessionToken: tok,\n });\n }\n\n if (m === \"POST\" && segs[0] === \"login\") {\n const { username, password } = await req.json();\n if (!username || !password) return res({ error: \"Missing fields\" }, 400);\n const key = username.toLowerCase().trim();\n\n const limitMsg = checkLoginRateLimit(key);\n if (limitMsg) return res({ error: limitMsg }, 429);\n\n const user = await fbGet(`Users/${key}`);\n if (!user || user.password !== password) {\n if (!_loginAttempts[key]) _loginAttempts[key] = [];\n _loginAttempts[key].push(Date.now());\n const remaining = LOGIN_MAX -\n _loginAttempts[key].filter((t) => Date.now() - t < LOGIN_WINDOW)\n .length;\n return res({\n error: `Incorrect username or password.${\n remaining > 0\n ? ` ${remaining} attempt${remaining !== 1 ? \"s\" : \"\"} remaining.`\n : \"\"\n }`,\n }, 401);\n }\n\n delete _loginAttempts[key];\n await cleanOldUserSessions(key);\n const tok = genToken();\n await fbSet(`sessions/${tok}`, { username: key, createdAt: Date.now() });\n return res({\n username: key,\n displayName: user.displayName || key,\n image: user.image || \"\",\n bio: user.bio || \"\",\n status: user.status || null,\n sessionToken: tok,\n });\n }\n\n if (m === \"POST\" && segs[0] === \"logout\") {\n const { sessionToken } = await req.json();\n if (sessionToken) {\n await fbDelete(`sessions/${sessionToken}`);\n }\n return res({ ok: true });\n }\n\n if (m === \"POST\" && segs[0] === \"restore\") {\n const { sessionToken } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Invalid session\" }, 401);\n return res({\n username: user.username,\n displayName: user.displayName || user.username,\n image: user.image || \"\",\n bio: user.bio || \"\",\n status: user.status || null,\n });\n }\n\n if (m === \"GET\" && segs[0] === \"profile\" && segs[1]) {\n const targetUser = segs[1].toLowerCase().trim();\n const user = await fbGet(`Users/${targetUser}`);\n if (!user) return res({ error: \"User not found\" }, 404);\n return res({\n username: user.username,\n displayName: user.displayName || user.username,\n image: user.image || \"\",\n bio: user.bio || \"\",\n });\n }\n\n if (m === \"POST\" && segs[0] === \"profile\" && segs[1] === \"update\") {\n const body = await req.json();\n const {\n sessionToken,\n bio,\n currentPassword,\n newPassword,\n image,\n newUsername,\n newDisplayName,\n } = body;\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n\n if (newPassword) {\n if (!currentPassword || user.password !== currentPassword) {\n return res({ error: \"Current password is incorrect\" }, 400);\n }\n }\n\n if (newUsername) {\n const newKey = newUsername.toLowerCase().trim();\n if (/\\s/.test(newUsername)) {\n return res({ error: \"Username cannot contain spaces\" }, 400);\n }\n if (newKey !== user.username) {\n const taken = await fbGet(`Users/${newKey}`);\n if (taken) return res({ error: \"Username already taken\" }, 409);\n\n const oldKey = user.username;\n const resolvedDisplayName = newDisplayName\n ? newDisplayName.trim().slice(0, 40)\n : (user.displayName || newKey);\n const updated = {\n username: newKey,\n displayName: resolvedDisplayName,\n password: newPassword ? newPassword : user.password,\n image: image !== undefined ? image : user.image,\n bio: bio !== undefined ? bio.trim().slice(0, 150) : user.bio,\n status: user.status || null,\n createdAt: user.createdAt,\n };\n await fbSet(`Users/${newKey}`, updated);\n await fbDelete(`Users/${oldKey}`);\n\n const allSessions = (await fbGet(\"sessions\")) || {};\n for (\n const [tok, sess] of Object.entries(\n allSessions as Record,\n )\n ) {\n if (sess && sess.username === oldKey) {\n await fbSet(`sessions/${tok}`, { ...sess, username: newKey });\n }\n }\n\n const allMods = (await fbGet(\"modules\")) || {};\n for (\n const [mKey, mVal] of Object.entries(\n allMods as Record>,\n )\n ) {\n if (mVal && (mVal.owner === oldKey || mVal.creator === oldKey)) {\n await fbSet(`modules/${mKey}`, {\n ...mVal,\n owner: mVal.owner === oldKey ? newKey : mVal.owner,\n creator: mVal.creator === oldKey ? newKey : mVal.creator,\n });\n }\n }\n\n return res({\n ok: true,\n username: newKey,\n displayName: updated.displayName,\n bio: updated.bio,\n image: updated.image,\n });\n }\n }\n\n const resolvedDisplayName = newDisplayName\n ? newDisplayName.trim().slice(0, 40)\n : (user.displayName || user.username);\n\n const updated = {\n ...user,\n displayName: resolvedDisplayName,\n bio: bio !== undefined ? bio.trim().slice(0, 150) : user.bio,\n password: newPassword ? newPassword : user.password,\n image: image !== undefined ? image : user.image,\n };\n await fbSet(`Users/${user.username}`, updated);\n return res({\n ok: true,\n username: user.username,\n displayName: updated.displayName,\n bio: updated.bio,\n image: updated.image,\n });\n }\n\n if (m === \"POST\" && segs[0] === \"profile\" && segs[1] === \"delete\") {\n const { sessionToken, confirmPhrase } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n\n const expectedPhrase = `delete/${user.username}`;\n if (!confirmPhrase || confirmPhrase.trim() !== expectedPhrase) {\n return res({ error: \"Confirmation phrase does not match\" }, 400);\n }\n\n const allMods = (await fbGet(\"modules\")) || {};\n for (\n const [mKey, mVal] of Object.entries(\n allMods as Record>,\n )\n ) {\n if (mVal && mVal.owner === user.username) {\n await fbDelete(`modules/${mKey}`);\n }\n }\n\n await fbDelete(`comments/${user.username}`);\n await fbDelete(`Users/${user.username}`);\n if (sessionToken) await fbDelete(`sessions/${sessionToken}`);\n return res({ ok: true });\n }\n\n if (m === \"GET\" && segs[0] === \"modules\") {\n const rawMods = (await fbGet(\"modules\")) || {};\n const rawComments = (await fbGet(\"comments\")) || {};\n\n const modules: Record = {};\n for (\n const [key, mod] of Object.entries(\n rawMods as Record>,\n )\n ) {\n const modCommentsObj =\n (rawComments as Record>)[key] || {};\n const commentsList = Object.values(modCommentsObj).sort(\n (a, b) =>\n ((a as { createdAt: number }).createdAt || 0) -\n ((b as { createdAt: number }).createdAt || 0),\n );\n modules[key] = { ...mod, comments: commentsList };\n }\n return res({ modules });\n }\n\n if (m === \"PUT\" && segs[0] === \"modules\" && segs[1]) {\n const key = segs[1];\n const { sessionToken, ...moduleData } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n\n const userLink = String(moduleData.link || \"\").trim();\n if (!userLink || !isValidUrl(userLink)) {\n return res(\n { error: \"A valid HTTP/HTTPS download link is required.\" },\n 400,\n );\n }\n\n const existing = (await fbGet(`modules/${key}`)) as\n | Record\n | null;\n if (\n existing && existing.owner && existing.owner !== user.username &&\n user.status !== \"admin\"\n ) {\n return res({ error: \"Module belongs to another creator.\" }, 403);\n }\n\n let shortLink = existing ? (existing.shortLink as string || \"\") : \"\";\n let updateCount = (existing && typeof existing.updateCount === \"number\")\n ? existing.updateCount\n : 0;\n let linkChanged = false;\n\n const existingLink = String(existing?.link || \"\").trim();\n const linkUnchanged = Boolean(\n existing &&\n existingLink !== \"\" &&\n existingLink === userLink &&\n existing.shortLink,\n );\n\n if (!linkUnchanged) {\n linkChanged = true;\n if (existing) updateCount += 1;\n shortLink = await generateShortlink(\n userLink,\n moduleData.name,\n updateCount,\n );\n }\n\n const originalCreator = existing\n ? (existing.creator as string)\n : (moduleData.creator || user.displayName || user.username);\n\n const resolvedImage =\n (moduleData.image && typeof moduleData.image === \"string\" &&\n moduleData.image.trim() !== \"\")\n ? moduleData.image.trim()\n : (existing ? (existing.image as string || \"\") : \"\");\n\n const record: Record = {\n name: moduleData.name,\n version: moduleData.version,\n creator: originalCreator,\n description: moduleData.description,\n link: userLink,\n shortLink,\n updateCount,\n image: resolvedImage,\n downloads: existing ? (existing.downloads || 0) : 0,\n reviews: existing ? (existing.reviews || {}) : {},\n owner: existing ? existing.owner : user.username,\n createdAt: existing ? (existing.createdAt || Date.now()) : Date.now(),\n };\n\n if (linkChanged) {\n record.updatedAt = Date.now();\n } else if (existing && existing.updatedAt) {\n record.updatedAt = existing.updatedAt;\n }\n\n await fbSet(`modules/${key}`, record);\n return res({ ok: true, module: record });\n }\n\n if (m === \"DELETE\" && segs[0] === \"modules\" && segs[1]) {\n const key = segs[1];\n const { sessionToken } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n const mod = (await fbGet(`modules/${key}`)) as\n | Record\n | null;\n if (!mod) return res({ error: \"Not found\" }, 404);\n if (mod.owner !== user.username && user.status !== \"admin\") {\n return res({ error: \"Forbidden\" }, 403);\n }\n await fbDelete(`modules/${key}`);\n await fbDelete(`comments/${key}`);\n return res({ ok: true });\n }\n\n if (\n m === \"POST\" && segs[0] === \"modules\" && segs[1] && segs[2] === \"download\"\n ) {\n const key = segs[1];\n const mod = (await fbGet(`modules/${key}`)) as\n | Record\n | null;\n if (!mod) return res({ error: \"Not found\" }, 404);\n\n const newCount = await fbIncrement(`modules/${key}/downloads`, 1);\n\n const downloadUrl = (mod.shortLink && typeof mod.shortLink === \"string\" &&\n mod.shortLink.trim() !== \"\")\n ? mod.shortLink\n : (mod.link as string);\n return res({ ok: true, downloads: newCount, url: downloadUrl });\n }\n\n if (\n m === \"POST\" && segs[0] === \"modules\" && segs[1] && segs[2] === \"review\"\n ) {\n const key = segs[1];\n const { sessionToken, rating } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n if (!rating || rating < 1 || rating > 5) {\n return res({ error: \"Invalid rating\" }, 400);\n }\n await fbSet(`modules/${key}/reviews/${user.username}`, {\n rating: Number(rating),\n updatedAt: Date.now(),\n });\n return res({ ok: true });\n }\n\n if (\n m === \"POST\" && segs[0] === \"modules\" && segs[1] && segs[2] === \"comment\"\n ) {\n const key = segs[1];\n const { sessionToken, text, replyTo, parentId } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n if (!text || !text.trim()) return res({ error: \"Empty comment\" }, 400);\n\n const commentId = genToken();\n const newComment: Record = {\n id: commentId,\n moduleKey: key,\n username: user.username,\n displayName: user.displayName || user.username,\n userImage: user.image || \"\",\n text: text.trim(),\n createdAt: Date.now(),\n };\n if (replyTo && typeof replyTo === \"string\" && replyTo.trim()) {\n newComment.replyTo = replyTo.trim();\n }\n if (parentId && typeof parentId === \"string\" && parentId.trim()) {\n newComment.parentId = parentId.trim();\n }\n await fbSet(`comments/${key}/${commentId}`, newComment);\n return res({ ok: true, comment: newComment });\n }\n\n return res({ error: \"Route not found\" }, 404);\n } catch (e) {\n return res({ error: (e as Error).message }, 500);\n }\n}","const CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, PUT, DELETE, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n};\n\nfunction res(data: unknown, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { ...CORS, \"Content-Type\": \"application/json\" },\n });\n}\n\nconst DB = () => Deno.env.get(\"DB_URL\");\nconst SEC = () => Deno.env.get(\"FB_SECRET\");\n\nasync function fbGet(path: string) {\n const r = await fetch(`${DB()}/${path}.json?auth=${SEC()}`);\n if (!r.ok) throw new Error(\"db \" + r.status);\n return r.json();\n}\n\nasync function fbSet(path: string, data: unknown) {\n const r = await fetch(`${DB()}/${path}.json?auth=${SEC()}`, {\n method: \"PUT\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(data),\n });\n if (!r.ok) throw new Error(\"db \" + r.status);\n return r.json();\n}\n\nasync function fbIncrement(path: string, amount = 1) {\n const r = await fetch(`${DB()}/${path}.json?auth=${SEC()}`, {\n method: \"PUT\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ \".sv\": { \"increment\": amount } }),\n });\n if (!r.ok) throw new Error(\"db \" + r.status);\n return r.json();\n}\n\nasync function fbDelete(path: string) {\n const r = await fetch(`${DB()}/${path}.json?auth=${SEC()}`, {\n method: \"DELETE\",\n });\n if (!r.ok) throw new Error(\"db \" + r.status);\n return r.json();\n}\n\nfunction genToken() {\n const b = crypto.getRandomValues(new Uint8Array(24));\n return [...b].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function verifySession(tok: string) {\n if (!tok) return null;\n const session = await fbGet(`sessions/${tok}`);\n if (!session || !session.username) return null;\n const user = await fbGet(`Users/${session.username}`);\n if (!user) return null;\n return { username: session.username, ...user };\n}\n\nasync function cleanOldUserSessions(usernameKey: string) {\n try {\n const allSessions = (await fbGet(\"sessions\")) || {};\n for (\n const [tok, sess] of Object.entries(\n allSessions as Record,\n )\n ) {\n if (sess && sess.username === usernameKey) {\n await fbDelete(`sessions/${tok}`);\n }\n }\n } catch (_) {}\n}\n\nfunction isValidUrl(str: string) {\n try {\n const u = new URL(str);\n return u.protocol === \"http:\" || u.protocol === \"https:\";\n } catch {\n return false;\n }\n}\n\nfunction cleanModuleNameForAlias(rawName: string): string {\n const normalized = rawName.normalize(\"NFD\").replace(/[\\u0300-\\u036f]/g, \"\");\n const asciiConverted = [...normalized].map((char) => {\n const code = char.codePointAt(0) || 0;\n if (code >= 0x1d400 && code <= 0x1d7ff) {\n if (code >= 0x1d400 && code <= 0x1d419) {\n return String.fromCharCode(65 + (code - 0x1d400));\n }\n if (code >= 0x1d41a && code <= 0x1d433) {\n return String.fromCharCode(97 + (code - 0x1d41a));\n }\n if (code >= 0x1d434 && code <= 0x1d44d) {\n return String.fromCharCode(65 + (code - 0x1d434));\n }\n if (code >= 0x1d44e && code <= 0x1d467) {\n return String.fromCharCode(97 + (code - 0x1d44e));\n }\n if (code >= 0x1d468 && code <= 0x1d481) {\n return String.fromCharCode(65 + (code - 0x1d468));\n }\n if (code >= 0x1d482 && code <= 0x1d49b) {\n return String.fromCharCode(97 + (code - 0x1d482));\n }\n if (code >= 0x1d7ce && code <= 0x1d7d7) {\n return String.fromCharCode(48 + (code - 0x1d7ce));\n }\n if (code >= 0x1d7d8 && code <= 0x1d7e1) {\n return String.fromCharCode(48 + (code - 0x1d7d8));\n }\n }\n return char;\n }).join(\"\");\n const cleanText = asciiConverted.replace(/[^a-zA-Z0-9]/g, \"\");\n return cleanText || \"Module\";\n}\n\nasync function generateShortlink(\n originalUrl: string,\n rawName: string,\n updateCount: number,\n): Promise {\n try {\n const cleanName = cleanModuleNameForAlias(rawName);\n const slug = updateCount === 0\n ? `Mod-${cleanName}`\n : `Mod-${cleanName}-v${updateCount}`;\n const proxyApi =\n `https://gexcysanchez--52fe6c529a7b11f194ec1607ee4eb77e.web.val.run?url=${\n encodeURIComponent(originalUrl)\n }&alias=${encodeURIComponent(slug)}`;\n const r = await fetch(proxyApi);\n if (r.ok) {\n const d = await r.json();\n if (d.shortLink) return d.shortLink;\n }\n } catch {}\n return \"\";\n}\n\nconst _loginAttempts: Record = {};\nconst LOGIN_WINDOW = 15 * 60 * 1000;\nconst LOGIN_MAX = 5;\n\nfunction checkLoginRateLimit(key: string): string | null {\n const now = Date.now();\n if (!_loginAttempts[key]) _loginAttempts[key] = [];\n _loginAttempts[key] = _loginAttempts[key].filter((t) =>\n now - t < LOGIN_WINDOW\n );\n if (_loginAttempts[key].length >= LOGIN_MAX) {\n const waitMs = LOGIN_WINDOW - (now - _loginAttempts[key][0]);\n const waitMin = Math.ceil(waitMs / 60000);\n return `Too many failed attempts. Please wait ${waitMin} minute${\n waitMin !== 1 ? \"s\" : \"\"\n }.`;\n }\n return null;\n}\n\nexport default async function (req: Request) {\n if (req.method === \"OPTIONS\") return new Response(null, { headers: CORS });\n\n const url = new URL(req.url);\n const segs = url.pathname.replace(/^\\/+/, \"\").split(\"/\").filter(Boolean);\n const m = req.method;\n\n try {\n if (m === \"POST\" && segs[0] === \"register\") {\n const { username, password } = await req.json();\n if (!username || !password) return res({ error: \"Missing fields\" }, 400);\n if (/\\s/.test(username)) {\n return res({ error: \"Username cannot contain spaces\" }, 400);\n }\n\n const key = username.toLowerCase().trim();\n const existing = await fbGet(`Users/${key}`);\n if (existing) return res({ error: \"Username already taken\" }, 409);\n\n const userData = {\n username: key,\n displayName: username,\n password,\n image: \"\",\n bio: \"\",\n status: null,\n createdAt: Date.now(),\n };\n await fbSet(`Users/${key}`, userData);\n await cleanOldUserSessions(key);\n const tok = genToken();\n await fbSet(`sessions/${tok}`, { username: key, createdAt: Date.now() });\n return res({\n username: key,\n displayName: username,\n image: \"\",\n bio: \"\",\n status: null,\n sessionToken: tok,\n });\n }\n\n if (m === \"POST\" && segs[0] === \"login\") {\n const { username, password } = await req.json();\n if (!username || !password) return res({ error: \"Missing fields\" }, 400);\n const key = username.toLowerCase().trim();\n\n const limitMsg = checkLoginRateLimit(key);\n if (limitMsg) return res({ error: limitMsg }, 429);\n\n const user = await fbGet(`Users/${key}`);\n if (!user || user.password !== password) {\n if (!_loginAttempts[key]) _loginAttempts[key] = [];\n _loginAttempts[key].push(Date.now());\n const remaining = LOGIN_MAX -\n _loginAttempts[key].filter((t) => Date.now() - t < LOGIN_WINDOW)\n .length;\n return res({\n error: `Incorrect username or password.${\n remaining > 0\n ? ` ${remaining} attempt${remaining !== 1 ? \"s\" : \"\"} remaining.`\n : \"\"\n }`,\n }, 401);\n }\n\n delete _loginAttempts[key];\n await cleanOldUserSessions(key);\n const tok = genToken();\n await fbSet(`sessions/${tok}`, { username: key, createdAt: Date.now() });\n return res({\n username: key,\n displayName: user.displayName || key,\n image: user.image || \"\",\n bio: user.bio || \"\",\n status: user.status || null,\n sessionToken: tok,\n });\n }\n\n if (m === \"POST\" && segs[0] === \"logout\") {\n const { sessionToken } = await req.json();\n if (sessionToken) {\n await fbDelete(`sessions/${sessionToken}`);\n }\n return res({ ok: true });\n }\n\n if (m === \"POST\" && segs[0] === \"restore\") {\n const { sessionToken } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Invalid session\" }, 401);\n return res({\n username: user.username,\n displayName: user.displayName || user.username,\n image: user.image || \"\",\n bio: user.bio || \"\",\n status: user.status || null,\n });\n }\n\n if (m === \"GET\" && segs[0] === \"profile\" && segs[1]) {\n const targetUser = segs[1].toLowerCase().trim();\n const user = await fbGet(`Users/${targetUser}`);\n if (!user) return res({ error: \"User not found\" }, 404);\n return res({\n username: user.username,\n displayName: user.displayName || user.username,\n image: user.image || \"\",\n bio: user.bio || \"\",\n });\n }\n\n if (m === \"POST\" && segs[0] === \"profile\" && segs[1] === \"update\") {\n const body = await req.json();\n const {\n sessionToken,\n bio,\n currentPassword,\n newPassword,\n image,\n newUsername,\n newDisplayName,\n } = body;\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n\n if (newPassword) {\n if (!currentPassword || user.password !== currentPassword) {\n return res({ error: \"Current password is incorrect\" }, 400);\n }\n }\n\n if (newUsername) {\n const newKey = newUsername.toLowerCase().trim();\n if (/\\s/.test(newUsername)) {\n return res({ error: \"Username cannot contain spaces\" }, 400);\n }\n if (newKey !== user.username) {\n const taken = await fbGet(`Users/${newKey}`);\n if (taken) return res({ error: \"Username already taken\" }, 409);\n\n const oldKey = user.username;\n const resolvedDisplayName = newDisplayName\n ? newDisplayName.trim().slice(0, 40)\n : (user.displayName || newKey);\n const updated = {\n username: newKey,\n displayName: resolvedDisplayName,\n password: newPassword ? newPassword : user.password,\n image: image !== undefined ? image : user.image,\n bio: bio !== undefined ? bio.trim().slice(0, 150) : user.bio,\n status: user.status || null,\n createdAt: user.createdAt,\n };\n await fbSet(`Users/${newKey}`, updated);\n await fbDelete(`Users/${oldKey}`);\n\n const allSessions = (await fbGet(\"sessions\")) || {};\n for (\n const [tok, sess] of Object.entries(\n allSessions as Record,\n )\n ) {\n if (sess && sess.username === oldKey) {\n await fbSet(`sessions/${tok}`, { ...sess, username: newKey });\n }\n }\n\n const allMods = (await fbGet(\"modules\")) || {};\n for (\n const [mKey, mVal] of Object.entries(\n allMods as Record>,\n )\n ) {\n if (mVal && (mVal.owner === oldKey || mVal.creator === oldKey)) {\n await fbSet(`modules/${mKey}`, {\n ...mVal,\n owner: mVal.owner === oldKey ? newKey : mVal.owner,\n creator: mVal.creator === oldKey ? newKey : mVal.creator,\n });\n }\n }\n\n return res({\n ok: true,\n username: newKey,\n displayName: updated.displayName,\n bio: updated.bio,\n image: updated.image,\n });\n }\n }\n\n const resolvedDisplayName = newDisplayName\n ? newDisplayName.trim().slice(0, 40)\n : (user.displayName || user.username);\n\n const updated = {\n ...user,\n displayName: resolvedDisplayName,\n bio: bio !== undefined ? bio.trim().slice(0, 150) : user.bio,\n password: newPassword ? newPassword : user.password,\n image: image !== undefined ? image : user.image,\n };\n await fbSet(`Users/${user.username}`, updated);\n return res({\n ok: true,\n username: user.username,\n displayName: updated.displayName,\n bio: updated.bio,\n image: updated.image,\n });\n }\n\n if (m === \"POST\" && segs[0] === \"profile\" && segs[1] === \"delete\") {\n const { sessionToken, confirmPhrase } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n\n const expectedPhrase = `delete/${user.username}`;\n if (!confirmPhrase || confirmPhrase.trim() !== expectedPhrase) {\n return res({ error: \"Confirmation phrase does not match\" }, 400);\n }\n\n const allMods = (await fbGet(\"modules\")) || {};\n for (\n const [mKey, mVal] of Object.entries(\n allMods as Record>,\n )\n ) {\n if (mVal && mVal.owner === user.username) {\n await fbDelete(`modules/${mKey}`);\n }\n }\n\n await fbDelete(`comments/${user.username}`);\n await fbDelete(`Users/${user.username}`);\n if (sessionToken) await fbDelete(`sessions/${sessionToken}`);\n return res({ ok: true });\n }\n\n if (m === \"GET\" && segs[0] === \"modules\") {\n const rawMods = (await fbGet(\"modules\")) || {};\n const rawComments = (await fbGet(\"comments\")) || {};\n\n const modules: Record = {};\n for (\n const [key, mod] of Object.entries(\n rawMods as Record>,\n )\n ) {\n const modCommentsObj =\n (rawComments as Record>)[key] || {};\n const commentsList = Object.values(modCommentsObj).sort(\n (a, b) =>\n ((a as { createdAt: number }).createdAt || 0) -\n ((b as { createdAt: number }).createdAt || 0),\n );\n modules[key] = { ...mod, comments: commentsList };\n }\n return res({ modules });\n }\n\n if (m === \"PUT\" && segs[0] === \"modules\" && segs[1]) {\n const key = segs[1];\n const { sessionToken, ...moduleData } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n\n const userLink = String(moduleData.link || \"\").trim();\n if (!userLink || !isValidUrl(userLink)) {\n return res(\n { error: \"A valid HTTP/HTTPS download link is required.\" },\n 400,\n );\n }\n\n const existing = (await fbGet(`modules/${key}`)) as\n | Record\n | null;\n if (\n existing && existing.owner && existing.owner !== user.username &&\n user.status !== \"admin\"\n ) {\n return res({ error: \"Module belongs to another creator.\" }, 403);\n }\n\n let shortLink = existing ? (existing.shortLink as string || \"\") : \"\";\n let updateCount = (existing && typeof existing.updateCount === \"number\")\n ? existing.updateCount\n : 0;\n let linkChanged = false;\n\n const existingLink = String(existing?.link || \"\").trim();\n const linkUnchanged = Boolean(\n existing &&\n existingLink !== \"\" &&\n existingLink === userLink &&\n existing.shortLink,\n );\n\n if (!linkUnchanged) {\n linkChanged = true;\n if (existing) updateCount += 1;\n shortLink = await generateShortlink(\n userLink,\n moduleData.name,\n updateCount,\n );\n }\n\n const originalCreator = existing\n ? (existing.creator as string)\n : (moduleData.creator || user.displayName || user.username);\n\n const resolvedImage =\n (moduleData.image && typeof moduleData.image === \"string\" &&\n moduleData.image.trim() !== \"\")\n ? moduleData.image.trim()\n : (existing ? (existing.image as string || \"\") : \"\");\n\n const record: Record = {\n name: moduleData.name,\n version: moduleData.version,\n creator: originalCreator,\n description: moduleData.description,\n link: userLink,\n shortLink,\n updateCount,\n image: resolvedImage,\n downloads: existing ? (existing.downloads || 0) : 0,\n reviews: existing ? (existing.reviews || {}) : {},\n owner: existing ? existing.owner : user.username,\n createdAt: existing ? (existing.createdAt || Date.now()) : Date.now(),\n };\n\n if (linkChanged) {\n record.updatedAt = Date.now();\n } else if (existing && existing.updatedAt) {\n record.updatedAt = existing.updatedAt;\n }\n\n await fbSet(`modules/${key}`, record);\n return res({ ok: true, module: record });\n }\n\n if (m === \"DELETE\" && segs[0] === \"modules\" && segs[1]) {\n const key = segs[1];\n const { sessionToken } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n const mod = (await fbGet(`modules/${key}`)) as\n | Record\n | null;\n if (!mod) return res({ error: \"Not found\" }, 404);\n if (mod.owner !== user.username && user.status !== \"admin\") {\n return res({ error: \"Forbidden\" }, 403);\n }\n await fbDelete(`modules/${key}`);\n await fbDelete(`comments/${key}`);\n return res({ ok: true });\n }\n\n if (\n m === \"POST\" && segs[0] === \"modules\" && segs[1] && segs[2] === \"download\"\n ) {\n const key = segs[1];\n const mod = (await fbGet(`modules/${key}`)) as\n | Record\n | null;\n if (!mod) return res({ error: \"Not found\" }, 404);\n\n const newCount = await fbIncrement(`modules/${key}/downloads`, 1);\n\n const downloadUrl = (mod.shortLink && typeof mod.shortLink === \"string\" &&\n mod.shortLink.trim() !== \"\")\n ? mod.shortLink\n : (mod.link as string);\n return res({ ok: true, downloads: newCount, url: downloadUrl });\n }\n\n if (\n m === \"POST\" && segs[0] === \"modules\" && segs[1] && segs[2] === \"review\"\n ) {\n const key = segs[1];\n const { sessionToken, rating } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n if (!rating || rating < 1 || rating > 5) {\n return res({ error: \"Invalid rating\" }, 400);\n }\n await fbSet(`modules/${key}/reviews/${user.username}`, {\n rating: Number(rating),\n updatedAt: Date.now(),\n });\n return res({ ok: true });\n }\n\n if (\n m === \"POST\" && segs[0] === \"modules\" && segs[1] && segs[2] === \"comment\"\n ) {\n const key = segs[1];\n const { sessionToken, text, replyTo, parentId } = await req.json();\n const user = await verifySession(sessionToken);\n if (!user) return res({ error: \"Unauthorized\" }, 401);\n if (!text || !text.trim()) return res({ error: \"Empty comment\" }, 400);\n\n const commentId = genToken();\n const newComment: Record = {\n id: commentId,\n moduleKey: key,\n username: user.username,\n displayName: user.displayName || user.username,\n userImage: user.image || \"\",\n text: text.trim(),\n createdAt: Date.now(),\n };\n if (replyTo && typeof replyTo === \"string\" && replyTo.trim()) {\n newComment.replyTo = replyTo.trim();\n }\n if (parentId && typeof parentId === \"string\" && parentId.trim()) {\n newComment.parentId = parentId.trim();\n }\n await fbSet(`comments/${key}/${commentId}`, newComment);\n return res({ ok: true, comment: newComment });\n }\n\n return res({ error: \"Route not found\" }, 404);\n } catch (e) {\n return res({ error: (e as Error).message }, 500);\n }\n}","createdAt",["D",1787266547801],"branchVersion","branchId","f6270933-d28e-4442-aed6-55a0986596aa","id","aad57c4b-6371-4ffe-890b-2f787b7c8e35","sunprot-modules-db",["D",1783552548469],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","35b1a91c-8fcc-4040-bc0f-e1cb277a7282","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e1d1b-adbb-76f7-a82a-b4232abb1bd1","tursoName","aad57c4b63714ffe890b2f787b7c8e35","tursoHostname","aad57c4b63714ffe890b2f787b7c8e35-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789472446807],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":54,"_102":103,"_104":25},"branch",{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"isOwned",72,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","gexcysanchez","handle","displayName","Gexcy Sanchez","avatar","https://lh3.googleusercontent.com/a/ACg8ocJD6WSSYPd2CVI2O3PHd4vtUwhkw7rC8Zf4-yjll4kHtQqmbYs=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":167,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":168,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":169,"_81":170,"_83":171,"_85":25},"tree",[162],"files",[162],"counts",{"_150":60,"_151":152,"_153":60,"_154":155,"_156":157},"contents",[142],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[129,130,131,132,133,134],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":141,"_136":-5},{"_43":140,"_136":-5},{"_43":139,"_136":-5},{"_43":138,"_136":-5},{"_43":137,"_136":-5},{"_43":135,"_136":-5},"f6198fde-1c3e-4215-8ddd-dbbf73b10801","reporterId","21fc4546-d1ae-402e-b785-a8a7259bde71","2ca95eb7-7f7a-457c-9b14-50b4bbd59445","a65081d1-7e8f-43ac-a8c4-f2f9d3cfe65b","b01b4481-5be5-411c-9f2f-996fca66a25a","66bd0826-888d-427f-9bf3-a8ef9e4dce36",{"_43":143,"_32":28,"_30":31,"_144":-5,"_41":42,"_40":14,"_145":25,"_38":146,"_13":147,"_33":34,"_35":37,"_24":25,"_148":-5,"_27":149},"6259c08e-effa-4e7b-ab89-a30ca4fc9006","parentId","latest",["D",1787266547801],31,"label",[28],"pulls","branches",1,"forks","envVars",{"_158":160,"_161":60},"connections",{"_158":60,"_159":60},"count","unfilledCount",5,"emptyCount",{"_43":143,"_32":28,"_30":31,"_144":-5,"_41":42,"_40":14,"_145":25,"_38":163,"_13":147,"_33":34,"_35":37,"_24":25,"_148":-5,"_164":165,"_27":166},["D",1787266547801],"children",[],[28],["D",1783552548469],["D",1789472446807],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":54,"_102":103,"_104":25},{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"ctx",{"_79":-5,"_126":205,"_206":207,"_208":209,"_210":25,"_211":25,"_212":25,"_213":124,"_214":-5,"_215":-7,"_216":-7,"_217":60,"_218":25,"_219":25,"_220":-5,"_221":25,"_222":25,"_223":25,"_224":-5},"ENV",{"_176":177,"_178":179,"_180":87,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v32