[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_255":256,"_257":258},"routes/_app.x.$handle.$name",{"_98":97,"_31":44,"_106":88,"_26":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":24,"_121":122,"_123":57,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":30,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",11,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","lib/http.ts","latestPath","fileId","08a8e9dc-ab26-11f1-b9b1-1607ee4eb77e","name","http.ts","fileType","http","content","/**\n * HTTP 유틸 — 응답 헬퍼, CORS, 아주 작은 라우터.\n * 프레임워크를 넣지 않는 이유: Val Town 은 단일 fetch 핸들러라 이 정도면 충분하고,\n * 의존성이 적을수록 배포가 단순하다.\n */\nimport { CONFIG } from \"../config.ts\";\n\nexport class HttpError extends Error {\n constructor(\n public status: number,\n public code: string,\n message: string,\n public detail?: unknown,\n ) {\n super(message);\n this.name = \"HttpError\";\n }\n}\n\nexport const badRequest = (msg: string, detail?: unknown) =>\n new HttpError(400, \"bad_request\", msg, detail);\nexport const unauthorized = (msg = \"로그인이 필요합니다.\") =>\n new HttpError(401, \"unauthorized\", msg);\nexport const forbidden = (msg = \"권한이 없습니다.\") => new HttpError(403, \"forbidden\", msg);\nexport const notFound = (msg = \"대상을 찾을 수 없습니다.\") => new HttpError(404, \"not_found\", msg);\nexport const tooMany = (msg: string) => new HttpError(429, \"rate_limited\", msg);\n\n/**\n * 허용 오리진이면 그 오리진을 그대로 돌려준다.\n * ALLOWED_ORIGINS 가 비어 있으면 개발 편의를 위해 * 를 준다(운영에서는 반드시 채울 것).\n */\nexport function corsHeaders(req: Request): Record {\n const origin = req.headers.get(\"origin\") ?? \"\";\n const list = CONFIG.allowedOrigins;\n let allow = \"*\";\n if (list.length) allow = list.includes(origin) ? origin : list[0];\n\n return {\n \"access-control-allow-origin\": allow,\n \"access-control-allow-methods\": \"GET,POST,PATCH,PUT,DELETE,OPTIONS\",\n \"access-control-allow-headers\": \"authorization,content-type\",\n \"access-control-max-age\": \"86400\",\n \"vary\": \"origin\",\n };\n}\n\nexport function json(data: unknown, status = 200, headers: Record = {}): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...headers },\n });\n}\n\nexport function errorResponse(e: unknown, req: Request): Response {\n const cors = corsHeaders(req);\n if (e instanceof HttpError) {\n return json({ error: e.code, message: e.message, detail: e.detail }, e.status, cors);\n }\n console.error(\"[unhandled]\", e);\n const message = e instanceof Error ? e.message : String(e);\n return json({ error: \"internal\", message }, 500, cors);\n}\n\n/* ── 라우터 ───────────────────────────────────────────────── */\n\nexport type AuthLevel = \"public\" | \"user\" | \"staff\" | \"admin\";\n\nexport interface AuthUser {\n id: string;\n email: string | null;\n name: string;\n role: \"student\" | \"coach\" | \"admin\";\n}\n\nexport interface Ctx {\n req: Request;\n url: URL;\n params: Record;\n query: URLSearchParams;\n /** auth 레벨이 public 이 아니면 항상 채워진다. */\n user: AuthUser;\n body: >() => Promise;\n}\n\nexport type Handler = (ctx: Ctx) => Promise | Response;\n\ninterface Route {\n method: string;\n segments: string[];\n handler: Handler;\n auth: AuthLevel;\n}\n\nexport class Router {\n private routes: Route[] = [];\n\n add(method: string, pattern: string, auth: AuthLevel, handler: Handler): this {\n this.routes.push({\n method: method.toUpperCase(),\n segments: pattern.split(\"/\").filter(Boolean),\n handler,\n auth,\n });\n return this;\n }\n\n get = (p: string, a: AuthLevel, h: Handler) => this.add(\"GET\", p, a, h);\n post = (p: string, a: AuthLevel, h: Handler) => this.add(\"POST\", p, a, h);\n patch = (p: string, a: AuthLevel, h: Handler) => this.add(\"PATCH\", p, a, h);\n del = (p: string, a: AuthLevel, h: Handler) => this.add(\"DELETE\", p, a, h);\n\n match(method: string, path: string): { route: Route; params: Record } | null {\n const parts = path.split(\"/\").filter(Boolean);\n let pathMatched = false;\n\n for (const route of this.routes) {\n if (route.segments.length !== parts.length) continue;\n const params: Record = {};\n let ok = true;\n for (let i = 0; i < parts.length; i++) {\n const seg = route.segments[i];\n if (seg.startsWith(\":\")) params[seg.slice(1)] = decodeURIComponent(parts[i]);\n else if (seg !== parts[i]) {\n ok = false;\n break;\n }\n }\n if (!ok) continue;\n pathMatched = true;\n if (route.method === method.toUpperCase()) return { route, params };\n }\n\n if (pathMatched) throw new HttpError(405, \"method_not_allowed\", \"허용되지 않은 메서드입니다.\");\n return null;\n }\n\n levelOf(route: Route): AuthLevel {\n return route.auth;\n }\n\n run(route: Route, ctx: Ctx): Promise | Response {\n return route.handler(ctx);\n }\n}\n\n/** 요청 본문 파서 — 빈 본문은 {} 로 준다. */\nexport function bodyReader(req: Request) {\n let cached: unknown;\n let read = false;\n return async >(): Promise => {\n if (read) return cached as T;\n read = true;\n const text = await req.text();\n if (!text.trim()) {\n cached = {};\n return cached as T;\n }\n try {\n cached = JSON.parse(text);\n } catch {\n throw badRequest(\"JSON 본문을 해석할 수 없습니다.\");\n }\n return cached as T;\n };\n}\n","createdAt",["D",1788831526498],"branchVersion","branchId","964f7637-562b-4945-9c69-b20a92bec2d0","id","19e69952-e1a2-467a-8d0c-9197e6be008a","roadmap-api",["D",1788831523479],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","관리형 독서실 학습 관리 API","imageUrl","62e039ee-902a-49bb-8a64-406c241f4c74","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07e6b-1ded-75cb-baf4-27bab987c121","tursoName","19e69952e1a2467a8d0c9197e6be008a","tursoHostname","19e69952e1a2467a8d0c9197e6be008a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789529498250],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_105":101},"org",{"_98":97,"_99":97,"_100":101,"_18":54,"_102":103,"_104":24},"branch",{"_13":87,"_31":88,"_42":41,"_89":43,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":44,"_96":97},"isOwned",33,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","marketadapter","handle","displayName","avatar","https://lh3.googleusercontent.com/a/ACg8ocIP-2ZbzXrHkL2_NvgLmOKbrq2boZbhR3VJZY8_uH0a2c56-zs=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":250,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":30,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":251,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":252,"_82":253,"_84":254,"_86":24},"tree",[180,181,182,189,190],"files",[180,181,182,183,184,185,186,187,188,189,190],"counts",{"_169":61,"_170":154,"_171":61,"_172":173,"_174":175},"contents",[128,129,130,131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":163,"_31":164,"_29":165,"_136":-5,"_40":41,"_39":166,"_138":57,"_37":167,"_13":61,"_33":149,"_35":-5,"_23":24,"_142":-5,"_26":168},{"_42":157,"_31":158,"_29":159,"_136":-5,"_40":41,"_39":160,"_138":57,"_37":161,"_13":61,"_33":149,"_35":-5,"_23":24,"_142":-5,"_26":162},{"_42":151,"_31":152,"_29":153,"_136":-5,"_40":41,"_39":154,"_138":57,"_37":155,"_13":61,"_33":149,"_35":-5,"_23":24,"_142":-5,"_26":156},{"_42":144,"_31":145,"_29":146,"_136":-5,"_40":41,"_39":147,"_138":57,"_37":148,"_13":61,"_33":149,"_35":-5,"_23":24,"_142":-5,"_26":150},{"_42":133,"_31":134,"_29":135,"_136":-5,"_40":41,"_39":137,"_138":24,"_37":139,"_13":61,"_33":140,"_35":141,"_23":24,"_142":-5,"_26":143},"ba484cca-ae53-4e38-b4f4-903f7b8b9127","main.ts","088e9dd4-ab26-11f1-bd9b-1607ee4eb77e","parentId",10,"latest",["D",1788831526527],"script","/**\n * Val Town HTTP 진입점.\n *\n * Val Town 은 이 파일의 default export 를 fetch 핸들러로 실행한다.\n * 로컬 개발은 backend/local.ts 가 같은 핸들러를 Deno.serve 로 감싼다.\n */\nimport { requireAdmin, requireStaff, resolveUser } from \"./lib/auth.ts\";\nimport {\n AuthUser,\n bodyReader,\n corsHeaders,\n Ctx,\n errorResponse,\n json,\n unauthorized,\n} from \"./lib/http.ts\";\nimport { buildRouter } from \"./routes/index.ts\";\nimport { toLocalDate } from \"./lib/time.ts\";\n\nconst router = buildRouter();\n\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n const cors = corsHeaders(req);\n\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204, headers: cors });\n\n try {\n if (url.pathname === \"/\" || url.pathname === \"/api\" || url.pathname === \"/api/health\") {\n return json(\n { ok: true, service: \"roadmap-study-api\", today: toLocalDate() },\n 200,\n cors,\n );\n }\n\n const matched = router.match(req.method, url.pathname);\n if (!matched) {\n return json({ error: \"not_found\", message: \"없는 경로입니다.\" }, 404, cors);\n }\n\n const level = router.levelOf(matched.route);\n let user: AuthUser | null = null;\n\n if (level !== \"public\") {\n user = await resolveUser(req);\n if (!user) throw unauthorized();\n if (level === \"staff\") requireStaff(user);\n if (level === \"admin\") requireAdmin(user);\n }\n\n const ctx: Ctx = {\n req,\n url,\n params: matched.params,\n query: url.searchParams,\n user: user ?? { id: \"\", email: null, name: \"\", role: \"student\" },\n body: bodyReader(req),\n };\n\n const res = await router.run(matched.route, ctx);\n\n // SSE 응답은 헤더를 다시 만들면 스트림이 깨진다 — 헤더만 덧댄다.\n const headers = new Headers(res.headers);\n for (const [k, v] of Object.entries(cors)) headers.set(k, v);\n return new Response(res.body, { status: res.status, headers });\n } catch (e) {\n return errorResponse(e, req);\n }\n}\n","label",[134],"3fb43c0f-8230-4f8c-9ddf-d22e141f8fcb","routes","0819cf40-ab26-11f1-87f9-1607ee4eb77e",4,["D",1788831525811],"directory",[145],"f1a202e2-b1b4-42ba-aec0-af1add9fd545","lib","0791e4a4-ab26-11f1-a503-1607ee4eb77e",1,["D",1788831524911],[152],"1ab759e0-0152-48e1-8407-330dbb0c8088","db","07c0dc82-ab26-11f1-8306-1607ee4eb77e",2,["D",1788831525229],[158],"130359c1-3f85-42d1-853e-43f5d0e94aab","crons","07f16262-ab26-11f1-87f9-1607ee4eb77e",3,["D",1788831525524],[164],"pulls","branches","forks","envVars",{"_176":178,"_179":61},"connections",{"_176":61,"_177":61},"count","unfilledCount",5,"emptyCount",{"_42":163,"_31":164,"_29":165,"_136":-5,"_40":41,"_39":166,"_138":57,"_37":247,"_13":61,"_33":149,"_35":-5,"_23":24,"_142":-5,"_192":248,"_26":249},{"_42":157,"_31":158,"_29":159,"_136":-5,"_40":41,"_39":160,"_138":57,"_37":244,"_13":61,"_33":149,"_35":-5,"_23":24,"_142":-5,"_192":245,"_26":246},{"_42":151,"_31":152,"_29":153,"_136":-5,"_40":41,"_39":154,"_138":57,"_37":241,"_13":61,"_33":149,"_35":-5,"_23":24,"_142":-5,"_192":242,"_26":243},{"_42":233,"_31":234,"_29":235,"_136":153,"_40":41,"_39":236,"_138":24,"_37":237,"_13":61,"_33":140,"_35":238,"_23":24,"_142":-5,"_192":239,"_26":240},{"_42":225,"_31":226,"_29":227,"_136":153,"_40":41,"_39":228,"_138":57,"_37":229,"_13":61,"_33":140,"_35":230,"_23":24,"_142":-5,"_192":231,"_26":232},{"_42":217,"_31":218,"_29":219,"_136":153,"_40":41,"_39":220,"_138":57,"_37":221,"_13":61,"_33":140,"_35":222,"_23":24,"_142":-5,"_192":223,"_26":224},{"_42":213,"_31":32,"_29":30,"_136":153,"_40":41,"_39":14,"_138":24,"_37":214,"_13":61,"_33":34,"_35":36,"_23":24,"_142":-5,"_192":215,"_26":216},{"_42":205,"_31":206,"_29":207,"_136":153,"_40":41,"_39":208,"_138":57,"_37":209,"_13":61,"_33":140,"_35":210,"_23":24,"_142":-5,"_192":211,"_26":212},{"_42":198,"_31":199,"_29":200,"_136":153,"_40":41,"_39":178,"_138":57,"_37":201,"_13":61,"_33":140,"_35":202,"_23":24,"_142":-5,"_192":203,"_26":204},{"_42":144,"_31":145,"_29":146,"_136":-5,"_40":41,"_39":147,"_138":57,"_37":195,"_13":61,"_33":149,"_35":-5,"_23":24,"_142":-5,"_192":196,"_26":197},{"_42":133,"_31":134,"_29":135,"_136":-5,"_40":41,"_39":137,"_138":24,"_37":191,"_13":61,"_33":140,"_35":141,"_23":24,"_142":-5,"_192":193,"_26":194},["D",1788831526527],"children",[],[134],["D",1788831525811],[],[145],"df23e099-bed8-4548-83a7-37c579690a42","validate.ts","084b9f48-ab26-11f1-97be-1607ee4eb77e",["D",1788831526112],"/**\n * 입력 검증 — 얇은 헬퍼. 스키마 라이브러리를 넣지 않고 필요한 것만 둔다.\n * 모든 문자열은 trim 하고 길이 상한을 강제한다(DB 오염 방지).\n */\nimport { badRequest } from \"./http.ts\";\nimport { isDate } from \"./time.ts\";\n\ntype Obj = Record;\n\nexport function str(\n body: Obj,\n key: string,\n opts: { required?: boolean; max?: number; min?: number; default?: string } = {},\n): string {\n const raw = body[key];\n if (raw === undefined || raw === null || raw === \"\") {\n if (opts.required) throw badRequest(`'${key}' 값이 필요합니다.`);\n return opts.default ?? \"\";\n }\n if (typeof raw !== \"string\") throw badRequest(`'${key}' 는 문자열이어야 합니다.`);\n const v = raw.trim();\n const max = opts.max ?? 2000;\n if (v.length > max) throw badRequest(`'${key}' 는 ${max}자를 넘을 수 없습니다.`);\n if (opts.min && v.length < opts.min) {\n throw badRequest(`'${key}' 는 ${opts.min}자 이상이어야 합니다.`);\n }\n return v;\n}\n\nexport function optStr(body: Obj, key: string, max = 2000): string | null {\n const v = str(body, key, { max });\n return v === \"\" ? null : v;\n}\n\nexport function int(\n body: Obj,\n key: string,\n opts: { required?: boolean; min?: number; max?: number; default?: number } = {},\n): number {\n const raw = body[key];\n if (raw === undefined || raw === null || raw === \"\") {\n if (opts.required) throw badRequest(`'${key}' 값이 필요합니다.`);\n return opts.default ?? 0;\n }\n const n = Number(raw);\n if (!Number.isFinite(n)) throw badRequest(`'${key}' 는 숫자여야 합니다.`);\n const v = Math.trunc(n);\n if (opts.min !== undefined && v < opts.min) {\n throw badRequest(`'${key}' 는 ${opts.min} 이상이어야 합니다.`);\n }\n if (opts.max !== undefined && v > opts.max) {\n throw badRequest(`'${key}' 는 ${opts.max} 이하여야 합니다.`);\n }\n return v;\n}\n\nexport function optInt(body: Obj, key: string, min: number, max: number): number | null {\n const raw = body[key];\n if (raw === undefined || raw === null || raw === \"\") return null;\n return int(body, key, { min, max });\n}\n\nexport function enumOf(\n body: Obj,\n key: string,\n allowed: readonly T[],\n fallback: T,\n): T {\n const raw = body[key];\n if (raw === undefined || raw === null || raw === \"\") return fallback;\n if (typeof raw !== \"string\" || !allowed.includes(raw as T)) {\n throw badRequest(`'${key}' 는 ${allowed.join(\", \")} 중 하나여야 합니다.`);\n }\n return raw as T;\n}\n\nexport function dateOf(body: Obj, key: string, fallback?: string): string {\n const raw = body[key];\n if (raw === undefined || raw === null || raw === \"\") {\n if (fallback) return fallback;\n throw badRequest(`'${key}' 날짜가 필요합니다.`);\n }\n if (!isDate(raw)) throw badRequest(`'${key}' 는 YYYY-MM-DD 형식이어야 합니다.`);\n return raw;\n}\n\n/** ISO8601 시각 문자열 검증 */\nexport function isoOf(body: Obj, key: string, required = false): string | null {\n const raw = body[key];\n if (raw === undefined || raw === null || raw === \"\") {\n if (required) throw badRequest(`'${key}' 시각이 필요합니다.`);\n return null;\n }\n if (typeof raw !== \"string\" || Number.isNaN(Date.parse(raw))) {\n throw badRequest(`'${key}' 는 올바른 날짜/시각이어야 합니다.`);\n }\n return new Date(raw).toISOString();\n}\n\n/** 쿼리스트링에서 날짜 범위를 뽑는다. 없으면 기본 구간을 준다. */\nexport function rangeFromQuery(\n q: URLSearchParams,\n defaultFrom: string,\n defaultTo: string,\n): { from: string; to: string } {\n const from = q.get(\"from\");\n const to = q.get(\"to\");\n if (from && !isDate(from)) throw badRequest(\"'from' 은 YYYY-MM-DD 형식이어야 합니다.\");\n if (to && !isDate(to)) throw badRequest(\"'to' 는 YYYY-MM-DD 형식이어야 합니다.\");\n const f = from ?? defaultFrom;\n const t = to ?? defaultTo;\n if (f > t) throw badRequest(\"'from' 이 'to' 보다 늦습니다.\");\n return { from: f, to: t };\n}\n",[],[152,199],"f3e0733b-4e89-4b1f-ae5f-40e750c11ca0","sqlite.ts","08548de2-ab26-11f1-aeaa-1607ee4eb77e",6,["D",1788831526144],"/**\n * SQLite 어댑터.\n *\n * 백엔드는 두 가지다.\n * - valtown : Val Town 내장 SQLite (https://esm.town/v/std/sqlite)\n * - local : jsr:@db/sqlite 파일 DB (로컬 개발/테스트)\n *\n * 두 백엔드의 반환 형태가 달라서(배열 행 vs 객체 행) 여기서 객체 행으로 통일한다.\n * 호출부는 어느 백엔드인지 알 필요가 없다.\n *\n * 모듈 경로를 변수로 조립하는 이유: `deno check` 가 정적 분석으로 원격 모듈을\n * 받아오려 하는 것을 막기 위해서다(로컬에서는 Val Town 모듈을 받을 수 없다).\n */\nimport { CONFIG, isLocal } from \"../config.ts\";\n\nexport type Row = Record;\nexport type Arg = string | number | boolean | null;\n\n// deno-lint-ignore no-explicit-any\ntype AnyDb = any;\n\nlet valtownSqlite: AnyDb | null = null;\nlet localDb: AnyDb | null = null;\n\n/**\n * Val Town 내장 SQLite.\n *\n * ★ 경로 끝의 `/main.ts` 를 반드시 붙인다.\n * 생략하면(`.../std/sqlite`) legacy account-scoped(global) DB 에 연결되고,\n * 그쪽은 rows 를 \"배열의 배열\"로 돌려줘 반환 형태까지 달라진다.\n * 현행 권장은 val-scoped(`/main.ts`)이며 rows 가 객체 배열이다.\n * https://docs.val.town/reference/std/sqlite/usage\n */\nasync function getValtown(): Promise {\n if (!valtownSqlite) {\n const spec = [\"https:/\", \"esm.town\", \"v\", \"std\", \"sqlite\", \"main.ts\"].join(\"/\");\n const mod = await import(spec);\n valtownSqlite = mod.sqlite;\n }\n return valtownSqlite;\n}\n\n/**\n * 로컬 백엔드는 Deno 내장 node:sqlite 를 쓴다.\n * (jsr:@db/sqlite 는 SQL 문에 한글이 섞이면 바이트 길이를 잘못 계산해\n * \"incomplete input\" 으로 실패한다 — DDL 주석이 한글이라 바로 걸린다.)\n */\nasync function getLocal(): Promise {\n if (!localDb) {\n const spec = [\"node:\", \"sqlite\"].join(\"\");\n const { DatabaseSync } = await import(spec);\n const path = CONFIG.localDbPath;\n const dir = path.slice(0, path.lastIndexOf(\"/\"));\n if (dir) await Deno.mkdir(dir, { recursive: true }).catch(() => {});\n localDb = new DatabaseSync(path);\n localDb.exec(\"PRAGMA journal_mode = WAL;\");\n localDb.exec(\"PRAGMA foreign_keys = ON;\");\n }\n return localDb;\n}\n\n/** SELECT — 객체 행 배열을 돌려준다. */\nexport async function query(sql: string, args: Arg[] = []): Promise {\n if (isLocal()) {\n const db = await getLocal();\n return db.prepare(sql).all(...args) as T[];\n }\n const sqlite = await getValtown();\n const res = await sqlite.execute({ sql, args });\n const rows: unknown[] = res.rows ?? [];\n if (!rows.length) return [];\n\n // val-scoped 는 객체 배열, legacy global 은 배열의 배열을 준다.\n // 어느 쪽에 붙어도 깨지지 않게 형태를 보고 분기한다.\n if (!Array.isArray(rows[0])) return rows as T[];\n\n const cols: string[] = res.columns ?? [];\n return (rows as unknown[][]).map((row) => {\n const obj: Row = {};\n cols.forEach((c, i) => (obj[c] = row[i]));\n return obj as T;\n });\n}\n\n/** SELECT 단건 */\nexport async function one(sql: string, args: Arg[] = []): Promise {\n const rows = await query(sql, args);\n return rows.length ? rows[0] : null;\n}\n\n/** INSERT / UPDATE / DELETE */\nexport async function exec(sql: string, args: Arg[] = []): Promise {\n if (isLocal()) {\n const db = await getLocal();\n db.prepare(sql).run(...args);\n return;\n }\n const sqlite = await getValtown();\n await sqlite.execute({ sql, args });\n}\n\n/** DDL 등 파라미터 없는 스크립트를 순서대로 실행 */\nexport async function execScript(statements: string[]): Promise {\n for (const sql of statements) {\n const trimmed = sql.trim();\n if (trimmed) await exec(trimmed);\n }\n}\n\n/** COUNT(*) 같은 단일 스칼라 */\nexport async function scalar(sql: string, args: Arg[] = []): Promise {\n const row = await one(sql, args);\n if (!row) return null;\n const first = Object.values(row)[0];\n return (first as T) ?? null;\n}\n\nexport function uuid(): string {\n return crypto.randomUUID();\n}\n",[],[152,206],"93f01b35-e597-47ba-b87c-d47c24cc5c0f",["D",1788831526498],[],[152,32],"a856c541-89d5-4b15-a59e-2ae5b080db9c","env.ts","0879b608-ab26-11f1-aeaa-1607ee4eb77e",8,["D",1788831526436],"/**\n * 로컬 개발용 .env 로더.\n * Val Town 에서는 대시보드 환경변수가 이 역할을 하므로 파일이 없으면 조용히 넘어간다.\n *\n * 이 모듈은 부수효과가 목적이다 — 진입점에서 `import \"./lib/env.ts\";` 로 가장 먼저 부른다.\n */\nexport async function loadEnvFile(url = new URL(\"../../.env\", import.meta.url)): Promise {\n let text: string;\n try {\n text = await Deno.readTextFile(url);\n } catch {\n return false;\n }\n\n for (const line of text.split(\"\\n\")) {\n const trimmed = line.trim();\n if (!trimmed || trimmed.startsWith(\"#\")) continue;\n const eq = trimmed.indexOf(\"=\");\n if (eq < 0) continue;\n const key = trimmed.slice(0, eq).trim();\n const value = trimmed.slice(eq + 1).trim().replace(/^[\"']|[\"']$/g, \"\");\n // 이미 설정된 시스템 환경변수가 우선한다.\n if (!Deno.env.get(key)) Deno.env.set(key, value);\n }\n return true;\n}\n\nawait loadEnvFile();\n",[],[152,218],"6b99b14f-dcd2-4a00-ada4-784904e0e85a","claude.ts","085c59c8-ab26-11f1-9b77-1607ee4eb77e",7,["D",1788831526216],"/**\n * Claude API 클라이언트 (Messages API).\n * SDK 를 넣지 않는다 — 필요한 건 fetch 두 줄이고, Val Town 은 의존성이 적을수록 안전하다.\n */\nimport { CONFIG } from \"../config.ts\";\nimport { HttpError } from \"./http.ts\";\n\nconst API_URL = \"https://api.anthropic.com/v1/messages\";\nconst API_VERSION = \"2023-06-01\";\n\nexport interface ClaudeMessage {\n role: \"user\" | \"assistant\";\n content: string;\n}\n\ninterface RequestOptions {\n system: string;\n messages: ClaudeMessage[];\n maxTokens?: number;\n stream?: boolean;\n}\n\nfunction headers(): HeadersInit {\n if (!CONFIG.anthropicApiKey) {\n throw new HttpError(503, \"chat_unavailable\", \"챗봇이 아직 설정되지 않았습니다.\");\n }\n return {\n \"content-type\": \"application/json\",\n \"x-api-key\": CONFIG.anthropicApiKey,\n \"anthropic-version\": API_VERSION,\n };\n}\n\n/**\n * Anthropic 오류를 사용자·운영자가 구분할 수 있는 문장으로 바꾼다.\n * 전부 \"실패했습니다\" 로 뭉치면 키가 틀린 건지 일시 장애인지 알 수 없다.\n */\nfunction messageFor(status: number): string {\n if (status === 401 || status === 403) {\n return \"챗봇 인증에 실패했습니다. 관리자에게 API 키 확인을 요청해 주세요.\";\n }\n if (status === 429) return \"지금 이용자가 많습니다. 잠시 후 다시 시도해 주세요.\";\n if (status >= 500) return \"챗봇 서버가 응답하지 않습니다. 잠시 후 다시 시도해 주세요.\";\n return \"챗봇 응답에 실패했습니다. 잠시 후 다시 시도해 주세요.\";\n}\n\nfunction payload(opts: RequestOptions) {\n return JSON.stringify({\n model: CONFIG.claudeModel,\n max_tokens: opts.maxTokens ?? 1500,\n system: opts.system,\n messages: opts.messages,\n stream: opts.stream ?? false,\n });\n}\n\nexport interface ClaudeResult {\n text: string;\n tokensIn: number;\n tokensOut: number;\n}\n\n/** 단발 호출 — 응답 전체를 받아서 돌려준다. */\nexport async function complete(opts: RequestOptions): Promise {\n const res = await fetch(API_URL, {\n method: \"POST\",\n headers: headers(),\n body: payload({ ...opts, stream: false }),\n });\n\n if (!res.ok) {\n const detail = await res.text();\n console.error(\"[claude]\", res.status, detail);\n throw new HttpError(502, \"chat_failed\", messageFor(res.status));\n }\n\n const data = await res.json() as {\n content: Array<{ type: string; text?: string }>;\n usage?: { input_tokens: number; output_tokens: number };\n };\n\n return {\n text: data.content.filter((c) => c.type === \"text\").map((c) => c.text ?? \"\").join(\"\"),\n tokensIn: data.usage?.input_tokens ?? 0,\n tokensOut: data.usage?.output_tokens ?? 0,\n };\n}\n\n/**\n * 스트리밍 호출.\n * Anthropic SSE 를 그대로 흘려보내지 않고 { delta } / { done } 형태로 단순화해 내보낸다.\n * 프론트가 Anthropic 이벤트 스펙에 묶이지 않게 하려는 것.\n * 전체 텍스트가 모이면 onDone 으로 넘겨 저장한다.\n */\nexport function stream(\n opts: RequestOptions,\n onDone: (result: ClaudeResult) => Promise,\n): Response {\n const encoder = new TextEncoder();\n\n const body = new ReadableStream({\n async start(controller) {\n const send = (obj: unknown) =>\n controller.enqueue(encoder.encode(`data: ${JSON.stringify(obj)}\\n\\n`));\n\n let full = \"\";\n let tokensIn = 0;\n let tokensOut = 0;\n\n try {\n const res = await fetch(API_URL, {\n method: \"POST\",\n headers: headers(),\n body: payload({ ...opts, stream: true }),\n });\n\n if (!res.ok || !res.body) {\n const detail = await res.text().catch(() => \"\");\n console.error(\"[claude:stream]\", res.status, detail);\n send({ error: messageFor(res.status) });\n controller.close();\n return;\n }\n\n const reader = res.body.pipeThrough(new TextDecoderStream()).getReader();\n let buffer = \"\";\n\n while (true) {\n const { value, done } = await reader.read();\n if (done) break;\n buffer += value;\n\n // SSE 는 빈 줄로 이벤트가 끝난다. 마지막 조각은 다음 청크와 이어 붙인다.\n const chunks = buffer.split(\"\\n\\n\");\n buffer = chunks.pop() ?? \"\";\n\n for (const chunk of chunks) {\n const line = chunk.split(\"\\n\").find((l) => l.startsWith(\"data:\"));\n if (!line) continue;\n const raw = line.slice(5).trim();\n if (!raw || raw === \"[DONE]\") continue;\n\n try {\n const evt = JSON.parse(raw);\n if (evt.type === \"content_block_delta\" && evt.delta?.type === \"text_delta\") {\n full += evt.delta.text;\n send({ delta: evt.delta.text });\n } else if (evt.type === \"message_start\") {\n tokensIn = evt.message?.usage?.input_tokens ?? 0;\n } else if (evt.type === \"message_delta\") {\n tokensOut = evt.usage?.output_tokens ?? tokensOut;\n } else if (evt.type === \"error\") {\n send({ error: evt.error?.message ?? \"오류가 발생했습니다.\" });\n }\n } catch {\n // 파싱 실패한 이벤트는 건너뛴다(핑 등).\n }\n }\n }\n\n await onDone({ text: full, tokensIn, tokensOut });\n send({ done: true });\n } catch (e) {\n console.error(\"[claude:stream]\", e);\n // 여기까지 받은 응답이라도 저장해 대화가 끊기지 않게 한다.\n if (full) await onDone({ text: full, tokensIn, tokensOut }).catch(() => {});\n send({ error: \"연결이 끊겼습니다.\" });\n } finally {\n controller.close();\n }\n },\n });\n\n return new Response(body, {\n headers: {\n \"content-type\": \"text/event-stream; charset=utf-8\",\n \"cache-control\": \"no-cache\",\n \"connection\": \"keep-alive\",\n },\n });\n}\n",[],[152,226],"1c512b15-d69b-4584-8f43-69cbcd1f2c6f","auth.ts","0882c860-ab26-11f1-aeaa-1607ee4eb77e",9,["D",1788831526489],"/**\n * Firebase ID 토큰 검증 + 사용자 upsert.\n *\n * Admin SDK 를 쓰지 않는다 — Deno/Val Town 에서 무겁고 서비스 계정 키까지 필요하다.\n * 대신 구글이 공개하는 JWK 로 RS256 서명을 WebCrypto 로 직접 검증한다.\n * (x509 PEM 엔드포인트가 아니라 JWK 엔드포인트를 쓰는 이유: importKey('jwk') 로 바로 들어간다.)\n */\nimport { CONFIG } from \"../config.ts\";\nimport { AuthUser, forbidden, unauthorized } from \"./http.ts\";\nimport { exec, one } from \"./sqlite.ts\";\nimport { nowIso } from \"./time.ts\";\n\nconst JWK_URL =\n \"https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com\";\n\ninterface Jwk {\n kid: string;\n kty: string;\n n: string;\n e: string;\n alg: string;\n}\n\nlet keyCache: { keys: Map; expiresAt: number } | null = null;\n\nasync function getKeys(): Promise> {\n if (keyCache && keyCache.expiresAt > Date.now()) return keyCache.keys;\n\n const res = await fetch(JWK_URL);\n if (!res.ok) throw unauthorized(\"인증 키를 가져오지 못했습니다.\");\n\n const maxAge = Number(\n (res.headers.get(\"cache-control\") ?? \"\").match(/max-age=(\\d+)/)?.[1] ?? \"3600\",\n );\n const data = (await res.json()) as { keys: Jwk[] };\n\n const keys = new Map();\n for (const jwk of data.keys) {\n const key = await crypto.subtle.importKey(\n \"jwk\",\n { kty: jwk.kty, n: jwk.n, e: jwk.e, alg: \"RS256\", ext: true },\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"verify\"],\n );\n keys.set(jwk.kid, key);\n }\n\n keyCache = { keys, expiresAt: Date.now() + maxAge * 1000 };\n return keys;\n}\n\nfunction b64urlToBytes(s: string): Uint8Array {\n const b64 = s.replace(/-/g, \"+\").replace(/_/g, \"/\").padEnd(\n s.length + ((4 - (s.length % 4)) % 4),\n \"=\",\n );\n const bin = atob(b64);\n // WebCrypto 는 ArrayBuffer 기반 뷰만 받는다(SharedArrayBuffer 불가) — 버퍼를 직접 만들어 맞춘다.\n const out = new Uint8Array(new ArrayBuffer(bin.length));\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction b64urlToJson(s: string): T {\n return JSON.parse(new TextDecoder().decode(b64urlToBytes(s))) as T;\n}\n\nexport interface FirebaseClaims {\n sub: string;\n email?: string;\n email_verified?: boolean;\n name?: string;\n picture?: string;\n aud: string;\n iss: string;\n exp: number;\n iat: number;\n}\n\n/** Firebase ID 토큰을 검증하고 클레임을 돌려준다. */\nexport async function verifyIdToken(token: string): Promise {\n const parts = token.split(\".\");\n if (parts.length !== 3) throw unauthorized(\"토큰 형식이 올바르지 않습니다.\");\n\n const [headerB64, payloadB64, sigB64] = parts;\n const header = b64urlToJson<{ alg: string; kid: string }>(headerB64);\n if (header.alg !== \"RS256\") throw unauthorized(\"지원하지 않는 서명 알고리즘입니다.\");\n\n const keys = await getKeys();\n const key = keys.get(header.kid);\n if (!key) throw unauthorized(\"토큰 서명 키를 찾을 수 없습니다.\");\n\n const valid = await crypto.subtle.verify(\n \"RSASSA-PKCS1-v1_5\",\n key,\n b64urlToBytes(sigB64),\n new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n );\n if (!valid) throw unauthorized(\"토큰 서명이 올바르지 않습니다.\");\n\n const claims = b64urlToJson(payloadB64);\n const projectId = CONFIG.firebaseProjectId;\n const now = Math.floor(Date.now() / 1000);\n\n if (!projectId) throw unauthorized(\"서버에 FIREBASE_PROJECT_ID 가 설정되지 않았습니다.\");\n if (claims.aud !== projectId) throw unauthorized(\"토큰 대상(aud)이 일치하지 않습니다.\");\n if (claims.iss !== `https://securetoken.google.com/${projectId}`) {\n throw unauthorized(\"토큰 발급자(iss)가 일치하지 않습니다.\");\n }\n if (claims.exp <= now) throw unauthorized(\"토큰이 만료되었습니다. 다시 로그인해 주세요.\");\n if (claims.iat > now + 300) throw unauthorized(\"토큰 발급 시각이 올바르지 않습니다.\");\n if (!claims.sub) throw unauthorized(\"토큰에 사용자 식별자가 없습니다.\");\n\n return claims;\n}\n\ninterface UserRow {\n id: string;\n email: string | null;\n name: string;\n role: \"student\" | \"coach\" | \"admin\";\n status: string;\n}\n\n/** 첫 로그인이면 만들고, 있으면 마지막 로그인 시각만 갱신한다. */\nasync function upsertUser(claims: {\n sub: string;\n email?: string;\n name?: string;\n picture?: string;\n}): Promise {\n const now = nowIso();\n const email = claims.email?.toLowerCase() ?? null;\n const existing = await one(\n \"SELECT id, email, name, role, status FROM users WHERE id = ?\",\n [claims.sub],\n );\n\n if (existing) {\n await exec(\"UPDATE users SET last_login_at = ?, updated_at = ? WHERE id = ?\", [\n now,\n now,\n claims.sub,\n ]);\n // 운영자 이메일이 나중에 추가된 경우를 위해 매 로그인마다 승격 여부를 본다.\n if (email && CONFIG.adminEmails.includes(email) && existing.role !== \"admin\") {\n await exec(\"UPDATE users SET role = 'admin' WHERE id = ?\", [claims.sub]);\n existing.role = \"admin\";\n }\n return existing;\n }\n\n const role = email && CONFIG.adminEmails.includes(email) ? \"admin\" : \"student\";\n await exec(\n `INSERT INTO users (id, email, name, role, status, photo_url, created_at, updated_at, last_login_at)\n VALUES (?, ?, ?, ?, 'active', ?, ?, ?, ?)`,\n [claims.sub, email, claims.name ?? \"\", role, claims.picture ?? null, now, now, now],\n );\n\n return { id: claims.sub, email, name: claims.name ?? \"\", role, status: \"active\" };\n}\n\n/**\n * 요청에서 사용자를 뽑는다. 토큰이 없으면 null.\n * AUTH_MODE=dev 이면 \"dev::\" 형태를 허용한다(로컬 전용).\n */\nexport async function resolveUser(req: Request): Promise {\n const header = req.headers.get(\"authorization\") ?? \"\";\n if (!header.toLowerCase().startsWith(\"bearer \")) return null;\n const token = header.slice(7).trim();\n if (!token) return null;\n\n if (CONFIG.authMode === \"dev\" && token.startsWith(\"dev:\")) {\n const [, uid, role = \"student\"] = token.split(\":\");\n const row = await upsertUser({ sub: uid, email: `${uid}@dev.local`, name: `dev-${uid}` });\n if (role === \"admin\" || role === \"coach\") {\n await exec(\"UPDATE users SET role = ? WHERE id = ?\", [role, uid]);\n row.role = role as UserRow[\"role\"];\n }\n return { id: row.id, email: row.email, name: row.name, role: row.role };\n }\n\n const claims = await verifyIdToken(token);\n const row = await upsertUser(claims);\n if (row.status === \"left\") throw forbidden(\"이용이 종료된 계정입니다. 관리자에게 문의하세요.\");\n return { id: row.id, email: row.email, name: row.name, role: row.role };\n}\n\nexport function requireStaff(user: AuthUser): void {\n if (user.role !== \"admin\" && user.role !== \"coach\") {\n throw forbidden(\"관리자 또는 관리쌤만 사용할 수 있습니다.\");\n }\n}\n\nexport function requireAdmin(user: AuthUser): void {\n if (user.role !== \"admin\") throw forbidden(\"관리자만 사용할 수 있습니다.\");\n}\n\nexport const isStaff = (user: AuthUser) => user.role === \"admin\" || user.role === \"coach\";\n",[],[152,234],["D",1788831524911],[183,184,185,186,187,188],[152],["D",1788831525229],[],[158],["D",1788831525524],[],[164],["D",1788831523479],["D",1789529498250],{"_98":97,"_105":101},{"_98":97,"_99":97,"_100":101,"_18":54,"_102":103,"_104":24},{"_13":87,"_31":88,"_42":41,"_89":43,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":44,"_96":97},"ctx",{"_80":-5,"_125":288,"_289":290,"_291":292,"_293":24,"_294":24,"_295":24,"_296":57,"_297":-5,"_298":-7,"_299":-7,"_300":61,"_301":24,"_302":24,"_303":-5,"_304":24,"_305":24,"_306":24,"_307":-5},"ENV",{"_259":260,"_261":262,"_263":88,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v11