{title}

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_262":263,"_264":265},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_103":85,"_27":104,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":121,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",39,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","mod_test.ts","latestPath","fileId","8b7d15d2-7d49-11f1-80ff-1607ee4eb77e","name","fileType","script","content","import { createRouteHandler } from \"https://esm.town/v/nbbaier/integrations/mod.ts\";\nimport { assert, assertEquals } from \"jsr:@std/assert@1.0.19\";\nimport { type BlobStore, createBlobAdmin } from \"./mod.ts\";\n\n// In-memory stand-in for std/blob so the routes never touch real storage.\nfunction fakeStore(seed: Record = {}): BlobStore {\n\tconst map = new Map();\n\tconst enc = new TextEncoder();\n\tfor (const [k, v] of Object.entries(seed)) map.set(k, enc.encode(v));\n\tconst stamp = new Date(0).toISOString();\n\treturn {\n\t\tlist: (prefix = \"\") =>\n\t\t\tPromise.resolve(\n\t\t\t\t[...map.entries()]\n\t\t\t\t\t.filter(([k]) => k.startsWith(prefix))\n\t\t\t\t\t.map(([key, bytes]) => ({\n\t\t\t\t\t\tkey,\n\t\t\t\t\t\tsize: bytes.length,\n\t\t\t\t\t\tlastModified: stamp,\n\t\t\t\t\t})),\n\t\t\t),\n\t\tget: (key) => {\n\t\t\tconst bytes = map.get(key);\n\t\t\tif (!bytes) throw new Error(`not found: ${key}`);\n\t\t\treturn Promise.resolve(new Response(bytes as BodyInit));\n\t\t},\n\t\tset: (key, value) => {\n\t\t\tmap.set(key, typeof value === \"string\" ? enc.encode(value) : value);\n\t\t\treturn Promise.resolve();\n\t\t},\n\t\tdelete: (key) => {\n\t\t\tmap.delete(key);\n\t\t\treturn Promise.resolve();\n\t\t},\n\t\tmove: (from, to) => {\n\t\t\tconst b = map.get(from);\n\t\t\tif (b) {\n\t\t\t\tmap.set(to, b);\n\t\t\t\tmap.delete(from);\n\t\t\t}\n\t\t\treturn Promise.resolve();\n\t\t},\n\t\tcopy: (from, to) => {\n\t\t\tconst b = map.get(from);\n\t\t\tif (b) map.set(to, b);\n\t\t\treturn Promise.resolve();\n\t\t},\n\t};\n}\n\nDeno.test(\"conforms to the integrations contract\", () => {\n\tconst admin = createBlobAdmin({ owner: \"nbbaier\" }, fakeStore());\n\tassertEquals(admin.slug, \"blobs\");\n\tassertEquals(admin.name, \"Scoped Blob Admin\");\n\tassertEquals(admin.requiredEnv, [\"OAUTH_STATE_ENCRYPTION_KEY\"]);\n\t// auth:false has no OAuth gate, so nothing to badge.\n\tassertEquals(\n\t\tcreateBlobAdmin({ auth: false }, fakeStore()).requiredEnv,\n\t\tundefined,\n\t);\n});\n\nDeno.test(\"routed mode: owner gate + every internal link carries the mount prefix\", async () => {\n\tconst admin = createBlobAdmin(\n\t\t{ owner: \"nbbaier\" },\n\t\tfakeStore({ \"config.json\": '{\"a\":1}' }),\n\t);\n\tconst routed = (req: Request, user: string | null) =>\n\t\tadmin.handler(req, { user, prefix: \"/blobs\" });\n\n\tconst res = await routed(new Request(\"http://local/\"), \"nbbaier\");\n\tassertEquals(res.status, 200);\n\tconst html = await res.text();\n\tassert(html.includes(`href=\"/blobs/\"`), \"home link must carry the prefix\");\n\tassert(\n\t\thtml.includes(`action=\"/blobs/create\"`),\n\t\t\"create form must carry the prefix\",\n\t);\n\tassert(\n\t\thtml.includes(`href=\"/blobs/view?key=config.json\"`),\n\t\t\"view link must carry the prefix\",\n\t);\n\tassert(\n\t\thtml.includes(`action=\"/auth/logout\"`),\n\t\t\"/auth/* links stay origin-level in both modes\",\n\t);\n\tassert(\n\t\t!html.includes(`action=\"/create\"`),\n\t\t\"no unprefixed form action may leak through\",\n\t);\n\n\t// A logged-in non-owner is refused; so is an ungated router (null user)\n\t// that can't satisfy the allowlist.\n\tassertEquals(\n\t\t(await routed(new Request(\"http://local/\"), \"intruder\")).status,\n\t\t403,\n\t);\n\tassertEquals((await routed(new Request(\"http://local/\"), null)).status, 403);\n});\n\nDeno.test(\"routed mode: mutations round-trip and redirects stay integration-local\", async () => {\n\tconst store = fakeStore();\n\tconst admin = createBlobAdmin({ owner: \"nbbaier\" }, store);\n\tconst created = await admin.handler(\n\t\tnew Request(\"http://local/create\", {\n\t\t\tmethod: \"POST\",\n\t\t\tbody: new URLSearchParams({ key: \"greeting\", content: \"hello\" }),\n\t\t}),\n\t\t{ user: \"nbbaier\", prefix: \"/blobs\" },\n\t);\n\tassertEquals(created.status, 302);\n\t// Root-absolute Location; the router rewrites it, not the integration (ADR 0002).\n\tassert(\n\t\tcreated.headers.get(\"location\")?.startsWith(\"/?ok=\"),\n\t\t`redirect stays local, got ${created.headers.get(\"location\")}`,\n\t);\n\tassertEquals(\n\t\t(await store.list()).map((e) => e.key),\n\t\t[\"greeting\"],\n\t);\n});\n\nDeno.test(\"mounted under the real router: dispatch, gate, and Location rewriting compose\", async () => {\n\tconst store = fakeStore();\n\tconst admin = createBlobAdmin({ owner: \"boss\" }, store);\n\tconst handle = createRouteHandler({ integrations: [admin], auth: {} }, () =>\n\t\tPromise.resolve(\"boss\"),\n\t);\n\n\t// /blobs canonicalizes to /blobs/ so relative resolution has a trailing slash.\n\tconst canon = await handle(new Request(\"https://host.test/blobs\"));\n\tassertEquals(canon.status, 302);\n\tassertEquals(canon.headers.get(\"location\"), \"/blobs/\");\n\n\t// POST create: integration redirects to /?ok=, router prefixes it to /blobs/?ok=.\n\tconst created = await handle(\n\t\tnew Request(\"https://host.test/blobs/create\", {\n\t\t\tmethod: \"POST\",\n\t\t\tbody: new URLSearchParams({ key: \"k\", content: \"v\" }),\n\t\t}),\n\t);\n\tassertEquals(created.status, 302);\n\tassert(\n\t\tcreated.headers.get(\"location\")?.startsWith(\"/blobs/?ok=\"),\n\t\t`Location must be prefix-rewritten, got ${created.headers.get(\"location\")}`,\n\t);\n\tassertEquals(\n\t\t(await store.list()).map((e) => e.key),\n\t\t[\"k\"],\n\t);\n});\n\nDeno.test(\"standalone auth:false is open, and the value is itself an HTTP handler\", async () => {\n\tconst admin = createBlobAdmin({ auth: false }, fakeStore({ a: \"1\" }));\n\t// Called with no ctx → standalone mode; no gate, base is \"\".\n\tconst res = await admin(new Request(\"http://local/\"));\n\tassertEquals(res.status, 200);\n\tconst html = await res.text();\n\tassert(html.includes(`action=\"/create\"`), \"standalone links are unprefixed\");\n});\n","import { createRouteHandler } from \"https://esm.town/v/nbbaier/integrations/mod.ts\";\nimport { assert, assertEquals } from \"jsr:@std/assert@1.0.19\";\nimport { type BlobStore, blobAdmin } from \"./mod.ts\";\n\n// In-memory stand-in for std/blob so the routes never touch real storage.\nfunction fakeStore(seed: Record = {}): BlobStore {\n\tconst map = new Map();\n\tconst enc = new TextEncoder();\n\tfor (const [k, v] of Object.entries(seed)) map.set(k, enc.encode(v));\n\tconst stamp = new Date(0).toISOString();\n\treturn {\n\t\tlist: (prefix = \"\") =>\n\t\t\tPromise.resolve(\n\t\t\t\t[...map.entries()]\n\t\t\t\t\t.filter(([k]) => k.startsWith(prefix))\n\t\t\t\t\t.map(([key, bytes]) => ({\n\t\t\t\t\t\tkey,\n\t\t\t\t\t\tsize: bytes.length,\n\t\t\t\t\t\tlastModified: stamp,\n\t\t\t\t\t})),\n\t\t\t),\n\t\tget: (key) => {\n\t\t\tconst bytes = map.get(key);\n\t\t\tif (!bytes) throw new Error(`not found: ${key}`);\n\t\t\treturn Promise.resolve(new Response(bytes as BodyInit));\n\t\t},\n\t\tset: (key, value) => {\n\t\t\tmap.set(key, typeof value === \"string\" ? enc.encode(value) : value);\n\t\t\treturn Promise.resolve();\n\t\t},\n\t\tdelete: (key) => {\n\t\t\tmap.delete(key);\n\t\t\treturn Promise.resolve();\n\t\t},\n\t\tmove: (from, to) => {\n\t\t\tconst b = map.get(from);\n\t\t\tif (b) {\n\t\t\t\tmap.set(to, b);\n\t\t\t\tmap.delete(from);\n\t\t\t}\n\t\t\treturn Promise.resolve();\n\t\t},\n\t\tcopy: (from, to) => {\n\t\t\tconst b = map.get(from);\n\t\t\tif (b) map.set(to, b);\n\t\t\treturn Promise.resolve();\n\t\t},\n\t};\n}\n\nDeno.test(\"conforms to the integrations contract\", () => {\n\tconst admin = blobAdmin({ owner: \"nbbaier\" }, fakeStore());\n\tassertEquals(admin.slug, \"blobs\");\n\tassertEquals(admin.name, \"Scoped Blob Admin\");\n\tassertEquals(admin.requiredEnv, [\"OAUTH_STATE_ENCRYPTION_KEY\"]);\n\t// auth:false has no OAuth gate, so nothing to badge.\n\tassertEquals(blobAdmin({ auth: false }, fakeStore()).requiredEnv, undefined);\n});\n\nDeno.test(\"routed mode: owner gate + every internal link carries the mount prefix\", async () => {\n\tconst admin = blobAdmin(\n\t\t{ owner: \"nbbaier\" },\n\t\tfakeStore({ \"config.json\": '{\"a\":1}' }),\n\t);\n\tconst routed = (req: Request, user: string | null) =>\n\t\tadmin.handler(req, { user, prefix: \"/blobs\" });\n\n\tconst res = await routed(new Request(\"http://local/\"), \"nbbaier\");\n\tassertEquals(res.status, 200);\n\tconst html = await res.text();\n\tassert(html.includes(`href=\"/blobs/\"`), \"home link must carry the prefix\");\n\tassert(\n\t\thtml.includes(`action=\"/blobs/create\"`),\n\t\t\"create form must carry the prefix\",\n\t);\n\tassert(\n\t\thtml.includes(`href=\"/blobs/view?key=config.json\"`),\n\t\t\"view link must carry the prefix\",\n\t);\n\tassert(\n\t\thtml.includes(`action=\"/auth/logout\"`),\n\t\t\"/auth/* links stay origin-level in both modes\",\n\t);\n\tassert(\n\t\t!html.includes(`action=\"/create\"`),\n\t\t\"no unprefixed form action may leak through\",\n\t);\n\n\t// A logged-in non-owner is refused; so is an ungated router (null user)\n\t// that can't satisfy the allowlist.\n\tassertEquals(\n\t\t(await routed(new Request(\"http://local/\"), \"intruder\")).status,\n\t\t403,\n\t);\n\tassertEquals((await routed(new Request(\"http://local/\"), null)).status, 403);\n});\n\nDeno.test(\"routed mode: mutations round-trip and redirects stay integration-local\", async () => {\n\tconst store = fakeStore();\n\tconst admin = blobAdmin({ owner: \"nbbaier\" }, store);\n\tconst created = await admin.handler(\n\t\tnew Request(\"http://local/create\", {\n\t\t\tmethod: \"POST\",\n\t\t\tbody: new URLSearchParams({ key: \"greeting\", content: \"hello\" }),\n\t\t}),\n\t\t{ user: \"nbbaier\", prefix: \"/blobs\" },\n\t);\n\tassertEquals(created.status, 302);\n\t// Root-absolute Location; the router rewrites it, not the integration (ADR 0002).\n\tassert(\n\t\tcreated.headers.get(\"location\")?.startsWith(\"/?ok=\"),\n\t\t`redirect stays local, got ${created.headers.get(\"location\")}`,\n\t);\n\tassertEquals(\n\t\t(await store.list()).map((e) => e.key),\n\t\t[\"greeting\"],\n\t);\n});\n\nDeno.test(\"mounted under the real router: dispatch, gate, and Location rewriting compose\", async () => {\n\tconst store = fakeStore();\n\tconst admin = blobAdmin({ owner: \"boss\" }, store);\n\tconst handle = createRouteHandler({ integrations: [admin], auth: {} }, () =>\n\t\tPromise.resolve(\"boss\"),\n\t);\n\n\t// /blobs canonicalizes to /blobs/ so relative resolution has a trailing slash.\n\tconst canon = await handle(new Request(\"https://host.test/blobs\"));\n\tassertEquals(canon.status, 302);\n\tassertEquals(canon.headers.get(\"location\"), \"/blobs/\");\n\n\t// POST create: integration redirects to /?ok=, router prefixes it to /blobs/?ok=.\n\tconst created = await handle(\n\t\tnew Request(\"https://host.test/blobs/create\", {\n\t\t\tmethod: \"POST\",\n\t\t\tbody: new URLSearchParams({ key: \"k\", content: \"v\" }),\n\t\t}),\n\t);\n\tassertEquals(created.status, 302);\n\tassert(\n\t\tcreated.headers.get(\"location\")?.startsWith(\"/blobs/?ok=\"),\n\t\t`Location must be prefix-rewritten, got ${created.headers.get(\"location\")}`,\n\t);\n\tassertEquals(\n\t\t(await store.list()).map((e) => e.key),\n\t\t[\"k\"],\n\t);\n});\n\nDeno.test(\"standalone auth:false is open, and the value is itself an HTTP handler\", async () => {\n\tconst admin = blobAdmin({ auth: false }, fakeStore({ a: \"1\" }));\n\t// Called with no ctx → standalone mode; no gate, base is \"\".\n\tconst res = await admin(new Request(\"http://local/\"));\n\tassertEquals(res.status, 200);\n\tconst html = await res.text();\n\tassert(html.includes(`action=\"/create\"`), \"standalone links are unprefixed\");\n});\n","createdAt",["D",1783790104562],"branchVersion","branchId","312b9f03-2082-4458-8650-b643ff4498f4","id","eea1c52b-5aa1-4a5f-81a3-5488cf5018ec","scoped-blob-viewer",["D",1781542084872],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","An admin panel for val-scoped blob storage","imageUrl","5d1042a9-7b0b-499d-8a72-3a8ac7a4e185","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","5f80108f-7ca4-4327-b77b-089dbe4b5a82","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_102":98},"org",{"_95":94,"_96":-5,"_97":98,"_18":55,"_99":100,"_101":25},"branch",{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned",51,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","nbbaier","handle","displayName","avatar","https://secure.gravatar.com/avatar/0129a541b7b3574e92c4afd06c5e32da&d=identicon","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":258,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":259,"_79":260,"_81":261,"_83":25},"tree",[212,214,215,216,217,218,219,220,221],"files",[212,213,214,215,216,217,218,219,220,221],"counts",{"_202":61,"_203":139,"_204":61,"_205":206,"_207":208},"contents",[126,127,128,129,130,131,132,133,134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":195,"_32":196,"_30":197,"_136":-5,"_41":42,"_40":198,"_137":121,"_38":199,"_13":61,"_33":200,"_35":-5,"_24":25,"_140":-5,"_27":201},{"_43":188,"_32":189,"_30":190,"_136":-5,"_41":42,"_40":191,"_137":25,"_38":192,"_13":61,"_33":20,"_35":193,"_24":25,"_140":-5,"_27":194},{"_43":180,"_32":181,"_30":182,"_136":-5,"_41":42,"_40":183,"_137":25,"_38":184,"_13":185,"_33":20,"_35":186,"_24":25,"_140":-5,"_27":187},{"_43":173,"_32":174,"_30":175,"_136":-5,"_41":42,"_40":176,"_137":25,"_38":177,"_13":61,"_33":34,"_35":178,"_24":25,"_140":-5,"_27":179},{"_43":166,"_32":167,"_30":168,"_136":-5,"_41":42,"_40":169,"_137":25,"_38":170,"_13":139,"_33":20,"_35":171,"_24":25,"_140":-5,"_27":172},{"_43":159,"_32":160,"_30":161,"_136":-5,"_41":42,"_40":162,"_137":25,"_38":163,"_13":139,"_33":20,"_35":164,"_24":25,"_140":-5,"_27":165},{"_43":150,"_32":151,"_30":152,"_136":-5,"_41":42,"_40":153,"_137":121,"_38":154,"_13":155,"_33":156,"_35":157,"_24":25,"_140":-5,"_27":158},{"_43":142,"_32":143,"_30":144,"_136":-5,"_41":42,"_40":145,"_137":25,"_38":146,"_13":147,"_33":34,"_35":148,"_24":25,"_140":-5,"_27":149},{"_43":135,"_32":28,"_30":31,"_136":-5,"_41":42,"_40":14,"_137":25,"_38":138,"_13":139,"_33":34,"_35":37,"_24":25,"_140":-5,"_27":141},"bffccfd6-5ece-459c-99f4-990230e8a47b","parentId","latest",["D",1783790104562],1,"label",[28],"a8afafa3-2b56-4e95-b1b9-f4bb2cb92c31","mod.ts","4fd8b2e4-68df-11f1-8b5c-1607ee4eb77e",37,["D",1783790104538],4,"// Public entry point. The implementation (JSX) lives in app.tsx; this barrel\n// keeps the stable `.../scoped-blob-viewer/mod.ts` import path and stays\n// JSX-free so it type-checks with plain `deno check`.\nexport {\n\ttype BlobAdminOptions,\n\ttype BlobStore,\n\tblobAdmin,\n\tdefault,\n} from \"./app.tsx\";\n",[143],"482be904-d637-4933-bf8b-328be2385c7d","main.ts","fabb0370-68d9-11f1-8438-1607ee4eb77e",38,["D",1783790104545],6,"http","import { blobAdmin } from \"./mod.ts\";\n\n/**\n * This val's own panel — manages THIS val's scoped blob storage.\n *\n * To inspect a DIFFERENT val's scoped storage, import the panel into that val:\n *\n * import { blobAdmin } from \"https://esm.town/v/nbbaier/scoped-blob-viewer/mod.ts\";\n * export default blobAdmin({ owner: \"nbbaier\" });\n *\n * Because scoped blobs are bound to the running val, the imported panel reads\n * the host val's storage automatically — no per-val tokens needed.\n */\nexport default blobAdmin({ owner: \"nbbaier\" });\n",[151],"121f1c7b-eb75-4cd8-8439-06bb71fa9bd4","deno.json","1af2bbd8-68da-11f1-b600-1607ee4eb77e",30,["D",1783789024241],"{\n\t\"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n\t\"compilerOptions\": {\n\t\t\"lib\": [\n\t\t\t\"dom\",\n\t\t\t\"dom.iterable\",\n\t\t\t\"dom.asynciterable\",\n\t\t\t\"deno.ns\",\n\t\t\t\"deno.unstable\"\n\t\t],\n\t\t\"noImplicitAny\": false,\n\t\t\"strict\": false,\n\t\t\"types\": [\"https://www.val.town/types/valtown.d.ts\"]\n\t},\n\t\"experimental\": {\n\t\t\"unstable-node-globals\": true,\n\t\t\"unstable-sloppy-imports\": true,\n\t\t\"unstable-temporal\": true,\n\t\t\"unstable-worker-options\": true\n\t},\n\t\"imports\": {\n\t\t\"@biomejs/biome\": \"npm:@biomejs/biome@^2.4.16\",\n\t\t\"@std/assert\": \"jsr:@std/assert@^1.0.19\"\n\t},\n\t\"lint\": {\n\t\t\"include\": [\"*.ts\", \"*.tsx\"],\n\t\t\"rules\": {\n\t\t\t\"exclude\": [\"no-explicit-any\", \"no-import-prefix\"]\n\t\t}\n\t},\n\t\"lock\": false,\n\t\"nodeModulesDir\": \"auto\",\n\t\"tasks\": {\n\t\t\"fmt\": \"biome check . --write\",\n\t\t\"lint\": \"deno lint\",\n\t\t\"typecheck\": \"VAL_TOWN_API_KEY=test deno check --allow-import=esm.town,www.val.town,esm.sh,jsr.io main.ts mod.ts app.tsx mod_test.ts\",\n\t\t\"test\": \"VAL_TOWN_API_KEY=test deno test --allow-env --allow-import=esm.town,www.val.town,esm.sh,jsr.io\",\n\t\t\"check\": \"deno task fmt && deno task lint && deno task typecheck && deno task test\"\n\t}\n}\n",[160],"6f3f55ed-628f-42a4-a125-056f95331de4","biome.json","1b2ae33c-68da-11f1-a06e-1607ee4eb77e",36,["D",1783789024506],"{\n\t\"$schema\": \"https://biomejs.dev/schemas/2.4.16/schema.json\",\n\t\"vcs\": { \"enabled\": false, \"clientKind\": \"git\", \"useIgnoreFile\": false },\n\t\"files\": { \"ignoreUnknown\": false },\n\t\"formatter\": { \"enabled\": true, \"indentStyle\": \"tab\" },\n\t\"linter\": { \"enabled\": true, \"rules\": { \"recommended\": true } },\n\t\"javascript\": { \"formatter\": { \"quoteStyle\": \"double\" } },\n\t\"assist\": {\n\t\t\"enabled\": true,\n\t\t\"actions\": { \"source\": { \"organizeImports\": \"on\" } }\n\t}\n}\n",[167],"e0117b19-ccad-4e64-bd2a-30a34c248488","app.tsx","8b0a8d64-7d49-11f1-8e3c-1607ee4eb77e",33,["D",1783789024327],"/** @jsxImportSource npm:hono@4.6.14/jsx */\nimport {\n\ttype CallableIntegration,\n\tdefineIntegration,\n\ttype IntegrationContext,\n} from \"https://esm.town/v/nbbaier/integrations/mod.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport {\n\tgetOAuthUserData,\n\toauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { type Context, Hono } from \"npm:hono@4.6.14\";\nimport type { FC, PropsWithChildren } from \"npm:hono@4.6.14/jsx\";\n\n/**\n * Reusable admin panel for **val-scoped** blob storage (`std/blob/main.ts`).\n *\n * Drop it into ANY val to browse that val's own scoped blobs — because scoped\n * storage is bound to the *running* val's runtime token, the imported panel\n * automatically reads the host val's storage. No per-val tokens required.\n *\n * The factory returns a callable Integration (the `integrations` contract), so\n * the same value serves both mounting styles:\n *\n * // Standalone: the panel IS the val's HTTP export; runs its own OAuth.\n * export default createBlobAdmin({ owner: \"nbbaier\" });\n *\n * // Routed: mounted alongside other integrations under one OAuth gate.\n * createRouter({ integrations: [createBlobAdmin({})] });\n *\n * When `auth` is enabled (default), the OAuth gate — this val's own when\n * standalone, the router's when routed — needs an `OAUTH_STATE_ENCRYPTION_KEY`\n * env var (any random 32-byte hex string) to encrypt session cookies.\n */\n\nexport interface BlobAdminOptions {\n\t/**\n\t * Val Town username(s) allowed in. Others get 403. Omit to allow ANY\n\t * logged-in Val Town user (not recommended). Ignored when `auth` is false.\n\t */\n\towner?: string | string[];\n\t/** Gate behind \"Log in with Val Town\". Default true. Set false for no auth. */\n\tauth?: boolean;\n\t/** Title shown in the header / tab. Default \"Scoped Blob Admin\". */\n\ttitle?: string;\n}\n\nconst PAGE_SIZE = 50;\n// Largest blob we'll attempt to render/edit inline; bigger ones get download-only.\nconst INLINE_MAX = 1024 * 1024; // 1 MB\n\ntype BlobEntry = { key: string; size: number; lastModified: string };\n\n/**\n * The slice of `std/blob` this panel uses. `blob` satisfies it structurally;\n * injecting a fake is the test seam (mutations never touch real storage).\n */\nexport interface BlobStore {\n\tlist(prefix?: string): Promise;\n\tget(key: string): Promise;\n\tset(key: string, value: string | Uint8Array): Promise;\n\tdelete(key: string): Promise;\n\tmove(from: string, to: string): Promise;\n\tcopy(from: string, to: string): Promise;\n}\n\ntype Env = {\n\tVariables: {\n\t\t/** Val Town username; \"\" when unauthenticated or auth is off. */\n\t\tuser: string;\n\t\t/** Mount prefix for internal links: \"\" standalone, ctx.prefix routed. */\n\t\tbase: string;\n\t};\n\tBindings: IntegrationContext;\n};\n\n/** Routed mode iff the router passed an IntegrationContext as Hono env. */\nfunction routedCtx(c: Context): IntegrationContext | undefined {\n\treturn typeof c.env?.prefix === \"string\" ? c.env : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction formatBytes(n: number): string {\n\tif (n < 1024) return `${n} B`;\n\tif (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;\n\treturn `${(n / (1024 * 1024)).toFixed(2)} MB`;\n}\n\nfunction formatDate(iso: string): string {\n\ttry {\n\t\treturn new Date(iso).toLocaleString(\"en-US\", {\n\t\t\tdateStyle: \"medium\",\n\t\t\ttimeStyle: \"short\",\n\t\t});\n\t} catch {\n\t\treturn iso;\n\t}\n}\n\nconst IMAGE_EXT = [\n\t\"png\",\n\t\"jpg\",\n\t\"jpeg\",\n\t\"gif\",\n\t\"webp\",\n\t\"svg\",\n\t\"ico\",\n\t\"bmp\",\n\t\"avif\",\n];\nconst CONTENT_TYPES: Record = {\n\tpng: \"image/png\",\n\tjpg: \"image/jpeg\",\n\tjpeg: \"image/jpeg\",\n\tgif: \"image/gif\",\n\twebp: \"image/webp\",\n\tsvg: \"image/svg+xml\",\n\tico: \"image/x-icon\",\n\tbmp: \"image/bmp\",\n\tavif: \"image/avif\",\n\tjson: \"application/json\",\n\ttxt: \"text/plain\",\n\tmd: \"text/markdown\",\n\tcsv: \"text/csv\",\n\thtml: \"text/html\",\n\tcss: \"text/css\",\n\tjs: \"text/javascript\",\n\tts: \"text/typescript\",\n\txml: \"application/xml\",\n\tpdf: \"application/pdf\",\n};\n\nfunction extOf(key: string): string {\n\tconst base = key.split(\"/\").pop() ?? key;\n\tconst dot = base.lastIndexOf(\".\");\n\treturn dot >= 0 ? base.slice(dot + 1).toLowerCase() : \"\";\n}\n\nfunction contentTypeFor(key: string): string {\n\treturn CONTENT_TYPES[extOf(key)] ?? \"application/octet-stream\";\n}\n\nfunction isImage(key: string): boolean {\n\treturn IMAGE_EXT.includes(extOf(key));\n}\n\n// Decide if bytes look like UTF-8 text (no NUL, few replacement chars).\nfunction looksLikeText(bytes: Uint8Array): boolean {\n\tconst sample = bytes.subarray(0, Math.min(bytes.length, 4096));\n\tfor (const b of sample) {\n\t\tif (b === 0) return false; // NUL → binary\n\t}\n\tconst text = new TextDecoder(\"utf-8\", { fatal: false }).decode(sample);\n\tlet bad = 0;\n\tfor (const ch of text) if (ch === \"�\") bad++;\n\treturn bad / Math.max(text.length, 1) < 0.05;\n}\n\n// ---------------------------------------------------------------------------\n// Styles\n// ---------------------------------------------------------------------------\n\nconst STYLE = `\n:root{--bg:#0f1115;--panel:#181b22;--panel2:#1f232c;--border:#2a2f3a;--text:#e6e9ef;--muted:#8b93a3;--accent:#6ea8fe;--accent2:#3d7bf0;--danger:#f06e7b;--ok:#5fd08a}\n*{box-sizing:border-box}\nbody{margin:0;background:var(--bg);color:var(--text);font:14px/1.5 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\na{color:var(--accent);text-decoration:none}\na:hover{text-decoration:underline}\nheader{display:flex;align-items:center;gap:12px;padding:14px 20px;border-bottom:1px solid var(--border);background:var(--panel)}\nheader h1{font-size:16px;margin:0;font-weight:600}\nheader h1 a{color:var(--text)}\nheader .spacer{flex:1}\nheader .who{color:var(--muted);font-size:13px}\n.container{max-width:1040px;margin:0 auto;padding:20px}\n.card{background:var(--panel);border:1px solid var(--border);border-radius:10px;padding:16px;margin-bottom:18px}\n.card h2{margin:0 0 12px;font-size:14px;font-weight:600;color:var(--muted);text-transform:uppercase;letter-spacing:.04em}\ninput,textarea,button,select{font:inherit;color:inherit}\ninput[type=text],input[type=search],textarea{background:var(--panel2);border:1px solid var(--border);border-radius:7px;padding:8px 10px;color:var(--text);width:100%}\ntextarea{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:13px;resize:vertical;min-height:280px;white-space:pre;tab-size:2}\ninput:focus,textarea:focus{outline:none;border-color:var(--accent)}\nbutton,.btn{display:inline-flex;align-items:center;gap:6px;background:var(--accent2);border:1px solid var(--accent2);color:#fff;border-radius:7px;padding:8px 14px;cursor:pointer;font-weight:500}\nbutton:hover,.btn:hover{filter:brightness(1.08);text-decoration:none}\n.btn.ghost,button.ghost{background:transparent;border-color:var(--border);color:var(--text)}\n.btn.danger,button.danger{background:transparent;border-color:var(--danger);color:var(--danger)}\n.btn.danger:hover,button.danger:hover{background:var(--danger);color:#fff}\n.row{display:flex;gap:10px;align-items:center;flex-wrap:wrap}\ntable{width:100%;border-collapse:collapse}\nth,td{text-align:left;padding:9px 10px;border-bottom:1px solid var(--border)}\nth{color:var(--muted);font-weight:500;font-size:12px;text-transform:uppercase;letter-spacing:.03em}\ntd.num,th.num{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}\ntr:hover td{background:var(--panel2)}\n.key{font-family:ui-monospace,Menlo,monospace;word-break:break-all}\n.muted{color:var(--muted)}\n.empty{text-align:center;color:var(--muted);padding:40px 0}\n.pager{display:flex;justify-content:space-between;align-items:center;margin-top:12px;color:var(--muted)}\n.pill{display:inline-block;background:var(--panel2);border:1px solid var(--border);border-radius:20px;padding:2px 10px;font-size:12px;color:var(--muted)}\nimg.preview{max-width:100%;border:1px solid var(--border);border-radius:8px;background:#fff}\n.actions{display:flex;gap:8px;flex-wrap:wrap;margin-top:14px}\n.grid2{display:grid;grid-template-columns:1fr 1fr;gap:10px}\n@media(max-width:640px){.grid2{grid-template-columns:1fr}}\n.banner{padding:10px 14px;border-radius:8px;margin-bottom:16px;border:1px solid}\n.banner.err{background:#2a1a1e;border-color:var(--danger);color:#f7b3bb}\n.banner.ok{background:#15261c;border-color:var(--ok);color:#a8e6c1}\ncode{font-family:ui-monospace,Menlo,monospace;background:var(--panel2);padding:1px 5px;border-radius:4px}\n`;\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\nexport function createBlobAdmin(\n\toptions: BlobAdminOptions = {},\n\tstore: BlobStore = blob as unknown as BlobStore,\n): CallableIntegration {\n\tconst auth = options.auth !== false;\n\tconst title = options.title ?? \"Scoped Blob Admin\";\n\tconst owners =\n\t\toptions.owner == null\n\t\t\t? null\n\t\t\t: Array.isArray(options.owner)\n\t\t\t\t? options.owner\n\t\t\t\t: [options.owner];\n\n\tconst Layout: FC<\n\t\tPropsWithChildren<{ title: string; user?: string | null; base?: string }>\n\t> = ({ title, user, base = \"\", children }) => (\n\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t{title}\n\t\t\t\t

Diff · v39