[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_161":162,"_163":164},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",25,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","3b41e0c6-5c1e-11f1-924f-ee650bb23af1","name","fileType","http","content","// Video mirror: requests to /v3/ are proxied from an upstream host and\n// streamed back jto the client. The upstream domain is NEVER exposed to the\n// client — not in URLs, headers, redirects, or error messages.\n\nconst UPSTREAM_HOST = Deno.env.get(\"UPSTREAM_HOST\") ?? \"\";\nconst UPSTREAM_PREFIX = Deno.env.get(\"UPSTREAM_PREFIX\") ?? \"/\";\nconst MIRROR_PREFIX = \"/v3/\";\n\n// Second mirror: /v4/ proxies from the Vercel blob store.\nconst VERCEL_PREFIX = \"/v4/\";\nconst VERCEL_HOST = Deno.env.get(\"VERCELURL\") ?? \"\";\nconst VERCEL_UPSTREAM_PREFIX = Deno.env.get(\"VERCEL_UPSTREAM_PREFIX\") ?? \"/\";\n\nconst FORWARD_REQUEST_HEADERS = [\n \"range\",\n \"if-range\",\n \"accept\",\n];\n\nconst SAFE_RESPONSE_HEADERS = [\n \"content-type\",\n \"content-length\",\n \"content-range\",\n \"accept-ranges\",\n \"cache-control\",\n \"expires\",\n];\n\n// Extensions the upstream stores with their REAL name (no .png disguise).\n// Matches the uploader's KEEP_ORIGINAL_EXTENSIONS. Anything else was uploaded\n// as \".png\" and the \".png\" was hidden from the public link.\nconst KEEP_ORIGINAL_EXTS = new Set([\n \"png\",\n \"jpg\",\n \"jpeg\",\n \"gif\",\n \"mp4\",\n \"mp3\",\n \"pdf\",\n \"txt\",\n]);\n\n// Extensions that should play/show INLINE in the browser.\nconst INLINE_EXTS = new Set([\n // images\n \"png\",\n \"jpg\",\n \"jpeg\",\n \"gif\",\n \"webp\",\n \"avif\",\n \"bmp\",\n \"svg\",\n \"ico\",\n // streamable video\n \"mp4\",\n \"webm\",\n]);\n\nfunction jsonError(status: number): Response {\n return Response.json({ message: \"dont work\" }, { status });\n}\n\n// Get the real filename + ext from the path, stripping a decoy \".png\".\n// \"foo.glb.png\" -> { name: \"foo.glb\", ext: \"glb\" }\n// \"foo.glb\" -> { name: \"foo.glb\", ext: \"glb\" }\n// \"foo.mp4\" -> { name: \"foo.mp4\", ext: \"mp4\" }\n// \"foo.png\" -> { name: \"foo.png\", ext: \"png\" } (real png, kept inline)\nfunction realFile(rest: string): { name: string; ext: string } {\n const seg = rest.split(\"/\").pop() || rest;\n let name = seg;\n if (name.toLowerCase().endsWith(\".png\")) {\n const stripped = name.slice(0, -4);\n if (stripped.includes(\".\")) name = stripped; // .glb.png -> .glb\n // else: it's a real \".png\" image, leave it\n }\n const dot = name.lastIndexOf(\".\");\n const ext = dot >= 0 ? name.slice(dot + 1).toLowerCase() : \"\";\n return { name, ext };\n}\n\nconst STALL_MS = 8000; // Replicate's CDN drops fast -> shorter stall window\nconst MAX_RESUMES = 20; // signed urls are cheap to re-hit; allow more resumes\n\n// Stream upstream to the client, transparently resuming via Range requests if\n// the upstream connection stalls or drops mid-transfer. The client sees one\n// smooth, continuous download.\nfunction resilientBody(\n upstreamURL: string,\n baseHeaders: Headers,\n startResp: Response,\n startOffset: number,\n): ReadableStream {\n let resp: Response | null = startResp;\n let offset = startOffset;\n let resumes = 0;\n\n return new ReadableStream({\n async pull(controller) {\n while (true) {\n if (!resp) {\n if (resumes >= MAX_RESUMES) {\n controller.error(new Error(\"too many upstream resumes\"));\n return;\n }\n resumes++;\n const h = new Headers(baseHeaders);\n h.set(\"range\", `bytes=${offset}-`);\n console.log(\n `[resume] requesting bytes=${offset}- (attempt ${resumes})`,\n );\n try {\n resp = await fetch(upstreamURL, {\n method: \"GET\",\n headers: h,\n redirect: \"manual\", // signed url is final; don't re-bounce to byte 0\n });\n } catch {\n resp = null;\n await new Promise((r) => setTimeout(r, 500));\n continue;\n }\n console.log(\n `[resume] upstream replied ${resp.status}, content-range=${\n resp.headers.get(\"content-range\")\n }`,\n );\n if (resp.status >= 300 || !resp.body) {\n console.log(`[resume] unusable status ${resp.status}, retrying`);\n try {\n await resp.body?.cancel();\n } catch { /* ignore */ }\n resp = null;\n await new Promise((r) => setTimeout(r, 500));\n continue;\n }\n }\n\n // If a resumed upstream ignored our Range and sent a full 200, it\n // restarts at byte 0 — so we must skip the bytes we already delivered.\n let skip = 0;\n if (resp.status === 200 && offset > startOffset) {\n skip = offset - startOffset;\n }\n\n const reader = resp.body!.getReader();\n try {\n while (true) {\n let timer: number | undefined;\n const timeout = new Promise<\"timeout\">((r) => {\n timer = setTimeout(() => r(\"timeout\"), STALL_MS);\n });\n const result = await Promise.race([reader.read(), timeout]);\n clearTimeout(timer);\n\n if (result === \"timeout\") {\n // Upstream went quiet -> drop it and resume from `offset`.\n console.log(`[stall] at offset=${offset}, resumes=${resumes}`);\n try {\n await reader.cancel();\n } catch { /* ignore */ }\n resp = null;\n break;\n }\n const { done, value } = result;\n if (done) {\n controller.close();\n return;\n }\n if (value && value.length) {\n let chunk = value;\n if (skip > 0) {\n if (skip >= chunk.length) {\n skip -= chunk.length;\n continue; // whole chunk already delivered, drop it\n }\n chunk = chunk.subarray(skip);\n skip = 0;\n }\n offset += chunk.length;\n controller.enqueue(chunk);\n }\n }\n } catch {\n // Connection error mid-stream -> resume.\n try {\n reader.releaseLock();\n } catch { /* ignore */ }\n resp = null;\n }\n // loop continues -> will re-fetch from `offset`\n }\n },\n cancel() {\n try {\n resp?.body?.cancel();\n } catch { /* ignore */ }\n },\n });\n}\n\nasync function tryFetch(\n upstreamURL: string,\n method: string,\n headers: Headers,\n): Promise {\n let resp: Response;\n try {\n resp = await fetch(upstreamURL, {\n method: method === \"HEAD\" ? \"HEAD\" : \"GET\",\n headers,\n redirect: \"follow\",\n });\n } catch {\n return null;\n }\n // Redirects or errors -> not usable, drain and bail.\n // 206 (Partial Content) is a SUCCESS for range requests — keep it.\n if (resp.status >= 300 && resp.status !== 304) {\n try {\n await resp.body?.cancel();\n } catch { /* ignore */ }\n return null;\n }\n return resp;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-methods\": \"GET, HEAD, OPTIONS\",\n \"access-control-allow-headers\": \"range, if-range, accept, content-type\",\n \"access-control-max-age\": \"86400\",\n },\n });\n }\n\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n return jsonError(405);\n }\n\n // Pick which upstream to mirror from based on the path prefix.\n let upstreamHostBase: string;\n let rest: string;\n if (url.pathname.startsWith(VERCEL_PREFIX)) {\n upstreamHostBase = VERCEL_HOST + VERCEL_UPSTREAM_PREFIX;\n rest = url.pathname.slice(VERCEL_PREFIX.length);\n } else if (url.pathname.startsWith(MIRROR_PREFIX)) {\n upstreamHostBase = UPSTREAM_HOST + UPSTREAM_PREFIX;\n rest = url.pathname.slice(MIRROR_PREFIX.length);\n } else {\n return jsonError(404);\n }\n\n const { name, ext } = realFile(rest);\n\n // Build candidate upstream paths.\n // - If the path already ends in \".png\", or the real ext is one the upstream\n // stores natively, fetch it as-is.\n // - Otherwise the file was disguised as \".png\", so try that FIRST.\n const base = upstreamHostBase + rest;\n const alreadyPng = rest.toLowerCase().endsWith(\".png\");\n const candidates: string[] = (alreadyPng || KEEP_ORIGINAL_EXTS.has(ext))\n ? [base + url.search]\n : [base + \".png\" + url.search, base + url.search];\n\n const upstreamHeaders = new Headers();\n for (const h of FORWARD_REQUEST_HEADERS) {\n const v = req.headers.get(h);\n if (v) upstreamHeaders.set(h, v);\n }\n\n let upstreamResp: Response | null = null;\n let winningURL = \"\";\n for (const candidate of candidates) {\n upstreamResp = await tryFetch(candidate, req.method, upstreamHeaders);\n if (upstreamResp) {\n // Use the FINAL url after redirects (e.g. the signed GCS/S3 url that\n // replicate.delivery 302s to). That target honors Range requests;\n // the replicate.delivery front door re-mints a fresh byte-0 url on\n // every hit, which breaks resume. Resume against the resolved url.\n winningURL = upstreamResp.url || candidate;\n break;\n }\n }\n\n if (!upstreamResp) {\n return jsonError(404);\n }\n\n const respHeaders = new Headers();\n for (const h of SAFE_RESPONSE_HEADERS) {\n const v = upstreamResp.headers.get(h);\n if (v) respHeaders.set(h, v);\n }\n\n // When we resilient-stream a full (non-range) GET, we may stitch the body\n // from multiple upstream connections. Forwarding the upstream content-length\n // is dangerous: if any single signed-url hop reports a different/short\n // length, the browser counts bytes against the wrong total and stalls at the\n // boundary (\"resuming\" forever). Drop it for full GETs and let the response\n // stream to natural EOF instead.\n if (\n req.method === \"GET\" && !req.headers.has(\"range\") &&\n upstreamResp.status === 200\n ) {\n respHeaders.delete(\"content-length\");\n }\n\n // If the client asked for a range but upstream answered with a full 200,\n // strip range-y headers so the browser treats it as a complete download\n // instead of waiting forever to \"resume\" bytes it will never get.\n const clientWantedRange = req.headers.has(\"range\");\n if (clientWantedRange && upstreamResp.status === 200) {\n respHeaders.delete(\"content-range\");\n }\n // For a real 206, content-range MUST be present or the browser stalls.\n if (upstreamResp.status === 206 && !respHeaders.has(\"content-range\")) {\n // Upstream gave 206 but no content-range — unusable as partial.\n // Treat the whole body as a full response.\n respHeaders.delete(\"content-range\");\n }\n respHeaders.set(\"access-control-allow-origin\", \"*\");\n respHeaders.set(\"referrer-policy\", \"no-referrer\");\n\n // Only advertise range support if upstream actually honored/announced it.\n // Faking \"accept-ranges: bytes\" makes browsers/download managers try to\n // \"resume\" with a Range request the upstream can't satisfy -> stalls forever.\n const upstreamAcceptRanges = upstreamResp.headers.get(\"accept-ranges\");\n const isPartial = upstreamResp.status === 206;\n if (isPartial || upstreamAcceptRanges === \"bytes\") {\n respHeaders.set(\"accept-ranges\", \"bytes\");\n } else {\n respHeaders.delete(\"accept-ranges\");\n respHeaders.delete(\"content-range\");\n }\n\n // If the client asked for a range but upstream gave us a full 200 body,\n // strip any stale content-range so the browser treats it as a clean full\n // download instead of a broken partial resume.\n if (req.headers.get(\"range\") && upstreamResp.status === 200) {\n respHeaders.delete(\"content-range\");\n }\n\n // Decide inline vs download by the REAL extension.\n if (!INLINE_EXTS.has(ext)) {\n // Not an inline type (.glb, .mov, etc.) -> force download w/ real name.\n respHeaders.set(\"content-type\", \"application/octet-stream\");\n const safeName = (name || \"download\").replace(/\"/g, \"\");\n respHeaders.set(\n \"content-disposition\",\n `attachment; filename=\"${safeName}\"`,\n );\n }\n // else: leave upstream content-type so images/mp4/webm render inline.\n\n // Figure out the byte offset this response starts at, so resumes can ask\n // the upstream for exactly the bytes after the last one we delivered.\n let startOffset = 0;\n const cr = upstreamResp.headers.get(\"content-range\"); // e.g. \"bytes 500-999/1234\"\n if (cr) {\n const m = cr.match(/bytes\\s+(\\d+)-/i);\n if (m) startOffset = parseInt(m[1], 10);\n } else {\n const rangeReq = req.headers.get(\"range\"); // e.g. \"bytes=500-\"\n if (rangeReq) {\n const m = rangeReq.match(/bytes=(\\d+)-/i);\n if (m) startOffset = parseInt(m[1], 10);\n }\n }\n\n // For HEAD, no body. For GET, wrap so we transparently resume from the\n // resolved signed url if the CDN cuts the connection halfway.\n const body = req.method === \"HEAD\"\n ? null\n : resilientBody(winningURL, upstreamHeaders, upstreamResp, startOffset);\n\n return new Response(body, {\n status: upstreamResp.status,\n headers: respHeaders,\n });\n}","// Video mirror: requests to /v3/ are proxied from an upstream host and\n// streamed back jto the client. The upstream domain is NEVER exposed to the\n// client — not in URLs, headers, redirects, or error messages.\n\nconst UPSTREAM_HOST = Deno.env.get(\"UPSTREAM_HOST\") ?? \"\";\nconst UPSTREAM_PREFIX = Deno.env.get(\"UPSTREAM_PREFIX\") ?? \"/\";\nconst MIRROR_PREFIX = \"/v3/\";\n\n// Second mirror: /v4/ proxies from the Vercel blob store.\nconst VERCEL_PREFIX = \"/v4/\";\nconst VERCEL_HOST = Deno.env.get(\"VERCELURL\") ?? \"\";\nconst VERCEL_UPSTREAM_PREFIX = Deno.env.get(\"VERCEL_UPSTREAM_PREFIX\") ?? \"/\";\n\nconst FORWARD_REQUEST_HEADERS = [\n \"range\",\n \"if-range\",\n \"accept\",\n];\n\nconst SAFE_RESPONSE_HEADERS = [\n \"content-type\",\n \"content-length\",\n \"content-range\",\n \"accept-ranges\",\n \"cache-control\",\n \"expires\",\n];\n\n// Extensions the upstream stores with their REAL name (no .png disguise).\n// Matches the uploader's KEEP_ORIGINAL_EXTENSIONS. Anything else was uploaded\n// as \".png\" and the \".png\" was hidden from the public link.\nconst KEEP_ORIGINAL_EXTS = new Set([\n \"png\",\n \"jpg\",\n \"jpeg\",\n \"gif\",\n \"mp4\",\n \"mp3\",\n \"pdf\",\n \"txt\",\n]);\n\n// Extensions that should play/show INLINE in the browser.\nconst INLINE_EXTS = new Set([\n // images\n \"png\",\n \"jpg\",\n \"jpeg\",\n \"gif\",\n \"webp\",\n \"avif\",\n \"bmp\",\n \"svg\",\n \"ico\",\n // streamable video\n \"mp4\",\n \"webm\",\n]);\n\nfunction jsonError(status: number): Response {\n return Response.json({ message: \"dont work\" }, { status });\n}\n\n// Get the real filename + ext from the path, stripping a decoy \".png\".\n// \"foo.glb.png\" -> { name: \"foo.glb\", ext: \"glb\" }\n// \"foo.glb\" -> { name: \"foo.glb\", ext: \"glb\" }\n// \"foo.mp4\" -> { name: \"foo.mp4\", ext: \"mp4\" }\n// \"foo.png\" -> { name: \"foo.png\", ext: \"png\" } (real png, kept inline)\nfunction realFile(rest: string): { name: string; ext: string } {\n const seg = rest.split(\"/\").pop() || rest;\n let name = seg;\n if (name.toLowerCase().endsWith(\".png\")) {\n const stripped = name.slice(0, -4);\n if (stripped.includes(\".\")) name = stripped; // .glb.png -> .glb\n // else: it's a real \".png\" image, leave it\n }\n const dot = name.lastIndexOf(\".\");\n const ext = dot >= 0 ? name.slice(dot + 1).toLowerCase() : \"\";\n return { name, ext };\n}\n\nconst STALL_MS = 8000; // Replicate's CDN drops fast -> shorter stall window\nconst MAX_RESUMES = 20; // signed urls are cheap to re-hit; allow more resumes\n\n// Stream upstream to the client, transparently resuming via Range requests if\n// the upstream connection stalls or drops mid-transfer. The client sees one\n// smooth, continuous download.\nfunction resilientBody(\n upstreamURL: string,\n baseHeaders: Headers,\n startResp: Response,\n startOffset: number,\n totalSize: number, // expected final byte offset (-1 if unknown)\n): ReadableStream {\n let resp: Response | null = startResp;\n let offset = startOffset;\n let resumes = 0;\n\n return new ReadableStream({\n async pull(controller) {\n while (true) {\n if (!resp) {\n if (resumes >= MAX_RESUMES) {\n controller.error(new Error(\"too many upstream resumes\"));\n return;\n }\n resumes++;\n const h = new Headers(baseHeaders);\n h.set(\"range\", `bytes=${offset}-`);\n console.log(\n `[resume] requesting bytes=${offset}- (attempt ${resumes})`,\n );\n try {\n resp = await fetch(upstreamURL, {\n method: \"GET\",\n headers: h,\n redirect: \"manual\", // signed url is final; don't re-bounce to byte 0\n });\n } catch {\n resp = null;\n await new Promise((r) => setTimeout(r, 500));\n continue;\n }\n console.log(\n `[resume] upstream replied ${resp.status}, content-range=${\n resp.headers.get(\"content-range\")\n }`,\n );\n if (resp.status >= 300 || !resp.body) {\n console.log(`[resume] unusable status ${resp.status}, retrying`);\n try {\n await resp.body?.cancel();\n } catch { /* ignore */ }\n resp = null;\n await new Promise((r) => setTimeout(r, 500));\n continue;\n }\n }\n\n // If a resumed upstream ignored our Range and sent a full 200, it\n // restarts at byte 0 — so we must skip the bytes we already delivered.\n let skip = 0;\n if (resp.status === 200 && offset > startOffset) {\n skip = offset - startOffset;\n }\n\n const reader = resp.body!.getReader();\n try {\n while (true) {\n let timer: number | undefined;\n const timeout = new Promise<\"timeout\">((r) => {\n timer = setTimeout(() => r(\"timeout\"), STALL_MS);\n });\n const result = await Promise.race([reader.read(), timeout]);\n clearTimeout(timer);\n\n if (result === \"timeout\") {\n // Upstream went quiet -> drop it and resume from `offset`.\n console.log(`[stall] at offset=${offset}, resumes=${resumes}`);\n try {\n await reader.cancel();\n } catch { /* ignore */ }\n resp = null;\n break;\n }\n const { done, value } = result;\n if (done) {\n // Upstream ended the stream. If we KNOW the total and haven't\n // reached it, the CDN cut us off early -> resume from `offset`\n // instead of closing (which would truncate the download).\n if (totalSize >= 0 && offset < totalSize) {\n console.log(`[short-eof] got ${offset}/${totalSize}, resuming`);\n try {\n reader.releaseLock();\n } catch { /* ignore */ }\n resp = null;\n break;\n }\n console.log(`[done] delivered ${offset} bytes total`);\n controller.close();\n return;\n }\n if (value && value.length) {\n let chunk = value;\n if (skip > 0) {\n if (skip >= chunk.length) {\n skip -= chunk.length;\n continue; // whole chunk already delivered, drop it\n }\n chunk = chunk.subarray(skip);\n skip = 0;\n }\n offset += chunk.length;\n controller.enqueue(chunk);\n }\n }\n } catch {\n // Connection error mid-stream -> resume.\n try {\n reader.releaseLock();\n } catch { /* ignore */ }\n resp = null;\n }\n // loop continues -> will re-fetch from `offset`\n }\n },\n cancel() {\n try {\n resp?.body?.cancel();\n } catch { /* ignore */ }\n },\n });\n}\n\nasync function tryFetch(\n upstreamURL: string,\n method: string,\n headers: Headers,\n): Promise {\n let resp: Response;\n try {\n resp = await fetch(upstreamURL, {\n method: method === \"HEAD\" ? \"HEAD\" : \"GET\",\n headers,\n redirect: \"follow\",\n });\n } catch {\n return null;\n }\n // Redirects or errors -> not usable, drain and bail.\n // 206 (Partial Content) is a SUCCESS for range requests — keep it.\n if (resp.status >= 300 && resp.status !== 304) {\n try {\n await resp.body?.cancel();\n } catch { /* ignore */ }\n return null;\n }\n return resp;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-methods\": \"GET, HEAD, OPTIONS\",\n \"access-control-allow-headers\": \"range, if-range, accept, content-type\",\n \"access-control-max-age\": \"86400\",\n },\n });\n }\n\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n return jsonError(405);\n }\n\n // Pick which upstream to mirror from based on the path prefix.\n let upstreamHostBase: string;\n let rest: string;\n if (url.pathname.startsWith(VERCEL_PREFIX)) {\n upstreamHostBase = VERCEL_HOST + VERCEL_UPSTREAM_PREFIX;\n rest = url.pathname.slice(VERCEL_PREFIX.length);\n } else if (url.pathname.startsWith(MIRROR_PREFIX)) {\n upstreamHostBase = UPSTREAM_HOST + UPSTREAM_PREFIX;\n rest = url.pathname.slice(MIRROR_PREFIX.length);\n } else {\n return jsonError(404);\n }\n\n const { name, ext } = realFile(rest);\n\n // Build candidate upstream paths.\n // - If the path already ends in \".png\", or the real ext is one the upstream\n // stores natively, fetch it as-is.\n // - Otherwise the file was disguised as \".png\", so try that FIRST.\n const base = upstreamHostBase + rest;\n const alreadyPng = rest.toLowerCase().endsWith(\".png\");\n const candidates: string[] = (alreadyPng || KEEP_ORIGINAL_EXTS.has(ext))\n ? [base + url.search]\n : [base + \".png\" + url.search, base + url.search];\n\n const upstreamHeaders = new Headers();\n for (const h of FORWARD_REQUEST_HEADERS) {\n const v = req.headers.get(h);\n if (v) upstreamHeaders.set(h, v);\n }\n\n let upstreamResp: Response | null = null;\n let winningURL = \"\";\n for (const candidate of candidates) {\n upstreamResp = await tryFetch(candidate, req.method, upstreamHeaders);\n if (upstreamResp) {\n // Use the FINAL url after redirects (e.g. the signed GCS/S3 url that\n // replicate.delivery 302s to). That target honors Range requests;\n // the replicate.delivery front door re-mints a fresh byte-0 url on\n // every hit, which breaks resume. Resume against the resolved url.\n winningURL = upstreamResp.url || candidate;\n break;\n }\n }\n\n if (!upstreamResp) {\n return jsonError(404);\n }\n\n const respHeaders = new Headers();\n for (const h of SAFE_RESPONSE_HEADERS) {\n const v = upstreamResp.headers.get(h);\n if (v) respHeaders.set(h, v);\n }\n\n // When we resilient-stream a full (non-range) GET, we may stitch the body\n // from multiple upstream connections. Forwarding the upstream content-length\n // is dangerous: if any single signed-url hop reports a different/short\n // length, the browser counts bytes against the wrong total and stalls at the\n // boundary (\"resuming\" forever). Drop it for full GETs and let the response\n // stream to natural EOF instead.\n if (\n req.method === \"GET\" && !req.headers.has(\"range\") &&\n upstreamResp.status === 200\n ) {\n respHeaders.delete(\"content-length\");\n }\n\n // If the client asked for a range but upstream answered with a full 200,\n // strip range-y headers so the browser treats it as a complete download\n // instead of waiting forever to \"resume\" bytes it will never get.\n const clientWantedRange = req.headers.has(\"range\");\n if (clientWantedRange && upstreamResp.status === 200) {\n respHeaders.delete(\"content-range\");\n }\n // For a real 206, content-range MUST be present or the browser stalls.\n if (upstreamResp.status === 206 && !respHeaders.has(\"content-range\")) {\n // Upstream gave 206 but no content-range — unusable as partial.\n // Treat the whole body as a full response.\n respHeaders.delete(\"content-range\");\n }\n respHeaders.set(\"access-control-allow-origin\", \"*\");\n respHeaders.set(\"referrer-policy\", \"no-referrer\");\n\n // Only advertise range support if upstream actually honored/announced it.\n // Faking \"accept-ranges: bytes\" makes browsers/download managers try to\n // \"resume\" with a Range request the upstream can't satisfy -> stalls forever.\n const upstreamAcceptRanges = upstreamResp.headers.get(\"accept-ranges\");\n const isPartial = upstreamResp.status === 206;\n if (isPartial || upstreamAcceptRanges === \"bytes\") {\n respHeaders.set(\"accept-ranges\", \"bytes\");\n } else {\n respHeaders.delete(\"accept-ranges\");\n respHeaders.delete(\"content-range\");\n }\n\n // If the client asked for a range but upstream gave us a full 200 body,\n // strip any stale content-range so the browser treats it as a clean full\n // download instead of a broken partial resume.\n if (req.headers.get(\"range\") && upstreamResp.status === 200) {\n respHeaders.delete(\"content-range\");\n }\n\n // Decide inline vs download by the REAL extension.\n if (!INLINE_EXTS.has(ext)) {\n // Not an inline type (.glb, .mov, etc.) -> force download w/ real name.\n respHeaders.set(\"content-type\", \"application/octet-stream\");\n const safeName = (name || \"download\").replace(/\"/g, \"\");\n respHeaders.set(\n \"content-disposition\",\n `attachment; filename=\"${safeName}\"`,\n );\n }\n // else: leave upstream content-type so images/mp4/webm render inline.\n\n // Figure out the byte offset this response starts at, so resumes can ask\n // the upstream for exactly the bytes after the last one we delivered.\n let startOffset = 0;\n const cr = upstreamResp.headers.get(\"content-range\"); // e.g. \"bytes 500-999/1234\"\n if (cr) {\n const m = cr.match(/bytes\\s+(\\d+)-/i);\n if (m) startOffset = parseInt(m[1], 10);\n } else {\n const rangeReq = req.headers.get(\"range\"); // e.g. \"bytes=500-\"\n if (rangeReq) {\n const m = rangeReq.match(/bytes=(\\d+)-/i);\n if (m) startOffset = parseInt(m[1], 10);\n }\n }\n\n // Determine the TOTAL expected size so we can detect a premature EOF\n // (Replicate's CDN closing the connection early) and resume instead of\n // truncating the download.\n let totalSize = -1;\n const crTotal = upstreamResp.headers.get(\"content-range\"); // \"bytes 0-/12345\"\n if (crTotal) {\n const m = crTotal.match(/\\/(\\d+)\\s*$/);\n if (m) totalSize = parseInt(m[1], 10);\n }\n if (totalSize < 0) {\n const cl = upstreamResp.headers.get(\"content-length\");\n if (cl) {\n const n = parseInt(cl, 10);\n // content-length on a 206 is the chunk size; on a 200 it's the whole file.\n if (!Number.isNaN(n)) {\n totalSize = upstreamResp.status === 206 ? startOffset + n : n;\n }\n }\n }\n console.log(\n `[start] offset=${startOffset} totalSize=${totalSize} status=${upstreamResp.status}`,\n );\n\n // For HEAD, no body. For GET, wrap so we transparently resume from the\n // resolved signed url if the CDN cuts the connection halfway.\n const body = req.method === \"HEAD\"\n ? null\n : resilientBody(\n winningURL,\n upstreamHeaders,\n upstreamResp,\n startOffset,\n totalSize,\n );\n\n return new Response(body, {\n status: upstreamResp.status,\n headers: respHeaders,\n });\n}","createdAt",["D",1780598222004],"branchVersion","branchId","2e9d81ea-5c1e-11f1-924f-ee650bb23af1","id","2e9ca14e-5c1e-11f1-924f-ee650bb23af1","video",["D",1780142012597],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Host","imageUrl","e1d9874c-49a0-4fd0-a196-e29af0fc3985","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019e78ba-264d-73c7-b4fa-c98be63ae754","tursoName","2e9ca14e5c1e11f1924fee650bb23af1","tursoHostname","2e9ca14e5c1e11f1924fee650bb23af1-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789471840176],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",26,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","raddman","handle","displayName","Rain","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/9e1a4958-e7ce-4b51-c18a-bd85c98bf600/square512?exp=1789527599&sig=4fc3a62a20555216db2a6e42a409235d3f742de4c96a97a16d42ca053fd1b151","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":156,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":157,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":158,"_83":159,"_85":160,"_87":25},"tree",[151],"files",[151],"counts",{"_139":62,"_140":141,"_142":62,"_143":144,"_145":146},"contents",[130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":134,"_13":135,"_33":34,"_35":37,"_24":25,"_136":137,"_27":138},"268ad042-2493-4fcd-af3d-11df975e952b","parentId","latest",["D",1780598222004],24,"label","videos",[28],"pulls","branches",1,"forks","envVars",{"_147":149,"_150":62},"connections",{"_147":62,"_148":62},"count","unfilledCount",3,"emptyCount",{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":152,"_13":135,"_33":34,"_35":37,"_24":25,"_136":137,"_153":154,"_27":155},["D",1780598222004],"children",[],[28],["D",1780142012597],["D",1789471840176],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_127":194,"_195":196,"_197":198,"_199":25,"_200":25,"_201":25,"_202":58,"_203":-5,"_204":-7,"_205":-7,"_206":62,"_207":25,"_208":25,"_209":-5,"_210":25,"_211":25,"_212":25,"_213":-5},"ENV",{"_165":166,"_167":168,"_169":89,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v25