[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_267":268,"_269":270},"routes/_app.x.$handle.$name",{"_108":107,"_39":53,"_116":98,"_34":117,"_13":14,"_118":-5,"_11":119,"_120":121,"_122":123,"_124":125,"_126":127,"_26":-5,"_128":-5,"_129":-5,"_130":33,"_131":132,"_133":31,"_134":-5,"_135":-5,"_136":137},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_51":52,"_39":53,"_46":54,"_55":-5,"_56":33,"_57":58,"_59":58,"_60":61,"_62":-5,"_19":63,"_64":65,"_66":31,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":76,"_77":78,"_79":80,"_81":82,"_83":82,"_84":85,"_86":85,"_87":85,"_88":82,"_89":82,"_90":91,"_92":93,"_94":95,"_96":33},"version",21,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","ab1fc4ea-ce0d-4697-a92e-8831e78d93e0","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":33,"_34":35,"_36":35},"file",{"_37":38,"_39":40,"_41":42,"_43":45,"_46":47,"_48":14,"_49":50,"_30":33},"previous",{"_37":38,"_39":40,"_41":42,"_43":44},"deleted",true,"deletedHere",false,"path","server/render.tsx","latestPath","fileId","a796f99a-198f-11f1-8039-42dde27851f2","name","render.tsx","fileType","script","content","/** @jsxImportSource https://esm.sh/react@18 */\nimport React from \"https://esm.sh/react@18\";\nimport { renderToString } from \"https://esm.sh/react-dom@18/server\";\nimport { App } from \"../client/app.tsx\";\n\nexport function renderPage(secretId?: string): string {\n const appHtml = renderToString();\n\n return `\n\n\n \n \n 🔐 Secret Share – E2E Encrypted\n \n\n\n

${appHtml}

\n \n \n\n`;\n}\n","/** @jsxImportSource https://esm.sh/react@18 */\nimport React from \"https://esm.sh/react@18\";\nimport { renderToString } from \"https://esm.sh/react-dom@18/server\";\nimport { App } from \"../client/app.tsx\";\n\nexport function renderPage(secretId?: string): string {\n const appHtml = renderToString();\n\n return `\n\n\n \n \n 🔐 Secret Share – E2E Encrypted\n \n\n\n

${appHtml}

\n \n \n\n`;\n}\n","createdAt",["D",1772824703361],"branchVersion","branchId","61afdd2a-198f-11f1-93ed-42dde27851f2","id","61af4568-198f-11f1-93ed-42dde27851f2","secret-share",["D",1772823903506],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","E2E encrypted secret sharing with expiring links","imageUrl","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","b4478132-198f-11f1-9869-42dde27851f2","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"orgId","e81e7335-6d4c-4764-a902-d0962bbfa9f7","tursoName","61af4568198f11f193ed42dde27851f2","tursoHostname","61af4568198f11f193ed42dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789515657103],"pinned",3,"userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_108":107,"_115":111},"org",{"_108":107,"_109":-5,"_110":111,"_19":63,"_112":113,"_114":33},"branch",{"_13":97,"_39":98,"_51":50,"_99":52,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":53,"_106":107},"isOwned",159,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","stevekrouse","handle","displayName","avatar","https://images.clerk.dev/uploaded/img_2PqHa2Gsy93xQrjh2w78Xu0cChW.jpeg","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_51":52,"_39":53,"_46":262,"_55":-5,"_56":33,"_57":58,"_59":58,"_60":61,"_62":-5,"_19":63,"_64":65,"_66":31,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":76,"_77":263,"_79":80,"_81":82,"_83":82,"_84":85,"_86":85,"_87":85,"_88":82,"_89":82,"_90":264,"_92":265,"_94":266,"_96":33},"tree",[191,194,197,200,201],"files",[191,192,193,194,195,196,197,198,199,200,201],"counts",{"_181":160,"_182":70,"_183":70,"_184":185,"_186":187},"contents",[138,139,140,141,142],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_51":175,"_39":176,"_37":177,"_145":-5,"_49":50,"_48":178,"_147":33,"_46":179,"_13":160,"_41":167,"_43":-5,"_30":33,"_152":-5,"_34":180},{"_51":169,"_39":170,"_37":171,"_145":-5,"_49":50,"_48":172,"_147":31,"_46":173,"_13":160,"_41":167,"_43":-5,"_30":33,"_152":-5,"_34":174},{"_51":163,"_39":164,"_37":165,"_145":-5,"_49":50,"_48":70,"_147":31,"_46":166,"_13":160,"_41":167,"_43":-5,"_30":33,"_152":-5,"_34":168},{"_51":155,"_39":156,"_37":157,"_145":-5,"_49":50,"_48":158,"_147":33,"_46":159,"_13":160,"_41":26,"_43":161,"_30":33,"_152":-5,"_34":162},{"_51":143,"_39":144,"_37":65,"_145":-5,"_49":50,"_48":146,"_147":33,"_46":148,"_13":149,"_41":150,"_43":151,"_30":33,"_152":153,"_34":154},"db37a794-1990-11f1-89ab-42dde27851f2","main.ts","parentId",15,"latest",["D",1772824536883],2,"http","import { Hono } from \"npm:hono@4\";\nimport { ensureTable, insertSecret, getSecret, deleteSecret, cleanupExpired } from \"./server/db.ts\";\nimport { renderPage } from \"./server/render.tsx\";\nimport type { CreateSecretRequest, CreateSecretResponse, FetchSecretResponse } from \"./shared/types.ts\";\n\nconst app = new Hono();\n\n// ─── Rate Limiter ──────────────────────────────────────────────────\n\ninterface RateBucket {\n count: number;\n resetAt: number;\n}\n\nconst rateBuckets = new Map();\n\n// Clean stale buckets every 5 minutes to prevent memory leaks\nsetInterval(() => {\n const now = Date.now();\n for (const [key, bucket] of rateBuckets) {\n if (bucket.resetAt <= now) rateBuckets.delete(key);\n }\n}, 5 * 60 * 1000);\n\nfunction rateLimit(\n windowMs: number,\n maxRequests: number,\n) {\n return async (c: any, next: () => Promise) => {\n const ip = c.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim()\n || c.req.header(\"cf-connecting-ip\")\n || \"unknown\";\n const key = `${ip}:${c.req.path}:${c.req.method}`;\n const now = Date.now();\n\n let bucket = rateBuckets.get(key);\n if (!bucket || bucket.resetAt <= now) {\n bucket = { count: 0, resetAt: now + windowMs };\n rateBuckets.set(key, bucket);\n }\n\n bucket.count++;\n\n if (bucket.count > maxRequests) {\n const retryAfter = Math.ceil((bucket.resetAt - now) / 1000);\n return c.json(\n { error: \"Too many requests. Please try again later.\" },\n 429,\n { \"Retry-After\": String(retryAfter) },\n );\n }\n\n await next();\n };\n}\n\n// ─── Validation Helpers ────────────────────────────────────────────\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst BASE64_RE = /^[A-Za-z0-9+/]+=*$/;\n\nfunction isValidBase64(s: string, maxLen: number): boolean {\n return typeof s === \"string\" && s.length > 0 && s.length <= maxLen && BASE64_RE.test(s);\n}\n\n// Ensure the DB table exists on cold start\nlet tableReady: Promise | null = null;\nfunction initDb() {\n if (!tableReady) tableReady = ensureTable();\n return tableReady;\n}\n\n// ─── API Routes ────────────────────────────────────────────────────\n\n// POST: 10 requests per minute per IP (creating secrets)\napp.post(\"/api/secrets\", rateLimit(60_000, 10), async (c) => {\n await initDb();\n const body = await c.req.json();\n\n // Validate required fields exist\n if (!body.encrypted_data || !body.iv || !body.salt) {\n return c.json({ error: \"Missing required fields\" }, 400);\n }\n\n // Validate sizes and format\n // encrypted_data: max ~100KB base64\n if (!isValidBase64(body.encrypted_data, 131_072)) {\n return c.json({ error: \"encrypted_data must be valid base64, max 100KB\" }, 400);\n }\n // iv: 12 bytes = 16 chars base64\n if (!isValidBase64(body.iv, 24) || body.iv.length < 16) {\n return c.json({ error: \"iv must be valid base64 of 12 bytes\" }, 400);\n }\n // salt: 16 bytes = 24 chars base64\n if (!isValidBase64(body.salt, 32) || body.salt.length < 20) {\n return c.json({ error: \"salt must be valid base64 of 16 bytes\" }, 400);\n }\n\n const maxHours = 720;\n const hours = Math.min(Math.max(body.expires_in_hours || 168, 1), maxHours);\n const expiresAt = Math.floor(Date.now() / 1000) + hours * 3600;\n const id = crypto.randomUUID();\n const deleteToken = crypto.randomUUID();\n\n await insertSecret(id, body.encrypted_data, body.iv, body.salt, expiresAt, deleteToken);\n\n // Opportunistic cleanup of expired secrets\n cleanupExpired().catch(() => {});\n\n const response: CreateSecretResponse = { id, expires_at: expiresAt, delete_token: deleteToken };\n return c.json(response, 201);\n});\n\n// GET: 30 requests per minute per IP (fetching secrets)\napp.get(\"/api/secrets/:id\", rateLimit(60_000, 30), async (c) => {\n await initDb();\n const id = c.req.param(\"id\");\n\n if (!UUID_RE.test(id)) {\n return c.json({ error: \"Invalid secret ID\" }, 400);\n }\n\n const secret = await getSecret(id);\n if (!secret) {\n return c.json({ error: \"Secret not found or expired\" }, 404);\n }\n const response: FetchSecretResponse = {\n encrypted_data: secret.encrypted_data,\n iv: secret.iv,\n salt: secret.salt,\n expires_at: secret.expires_at,\n };\n return c.json(response);\n});\n\n// DELETE: 10 requests per minute, requires delete_token\napp.delete(\"/api/secrets/:id\", rateLimit(60_000, 10), async (c) => {\n await initDb();\n const id = c.req.param(\"id\");\n\n if (!UUID_RE.test(id)) {\n return c.json({ error: \"Invalid secret ID\" }, 400);\n }\n\n const token = c.req.header(\"X-Delete-Token\");\n if (!token || !UUID_RE.test(token)) {\n return c.json({ error: \"Missing or invalid X-Delete-Token header\" }, 401);\n }\n\n const deleted = await deleteSecret(id, token);\n if (!deleted) {\n return c.json({ error: \"Secret not found or invalid delete token\" }, 404);\n }\n return c.json({ success: true });\n});\n\n// ─── Pages ─────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) => {\n const html = renderPage();\n return c.html(html);\n});\n\napp.get(\"/s/:id\", (c) => {\n const id = c.req.param(\"id\");\n\n // Strict UUID validation before passing to renderer\n if (!UUID_RE.test(id)) {\n return c.text(\"Invalid secret ID\", 400);\n }\n\n const html = renderPage(id);\n return c.html(html);\n});\n\nexport default app.fetch;\n","label","e2e",[144],"06dd1e16-1990-11f1-aeb1-42dde27851f2","README.md","06dd1eca-1990-11f1-aeb1-42dde27851f2",14,["D",1772824180626],0,"# 🔐 Secret Share\n\n**End-to-end encrypted secret sharing. Zero trust required.**\n\nSend passwords, API keys, and sensitive text to anyone — encrypted in your browser before it ever touches a server. The passphrase never leaves your device.\n\n🔗 **[Try it live](https://stevekrouse--b4478132198f11f1986942dde27851f2.web.val.run)**\n\n## Why This Is Trustworthy\n\nMost secret-sharing tools ask you to trust that the server isn't logging your data. **This one doesn't.** Here's why:\n\n**Every line of source code is public.** This app is built on [Val Town](https://val.town), where the code that runs the server is the code you can read — no hidden build steps, no compiled bundles, no deploy pipeline that could inject anything. What you see at [stevekrouse/secret-share](https://www.val.town/x/stevekrouse/secret-share/code/) is exactly what runs when you use the app.\n\nThat means you can verify:\n\n- ✅ The **passphrase is never sent to the server** — check [`client/app.tsx`](https://www.val.town/x/stevekrouse/secret-share/code/client/app.tsx) and [`shared/crypto.ts`](https://www.val.town/x/stevekrouse/secret-share/code/shared/crypto.ts)\n- ✅ The **server only stores ciphertext**, IV, and salt — check [`server/db.ts`](https://www.val.town/x/stevekrouse/secret-share/code/server/db.ts)\n- ✅ The **API never receives or returns plaintext** — check [`main.ts`](https://www.val.town/x/stevekrouse/secret-share/code/main.ts)\n- ✅ **Encryption uses AES-256-GCM** with PBKDF2 key derivation (600K iterations, SHA-256) via the Web Crypto API — no homebrew crypto\n- ✅ The **client-side code served to your browser** is the same source file from this repo, transpiled by `esm.town` with no bundler in between\n\nEven the app's author cannot read your secrets. The database contains only encrypted noise without the passphrase.\n\n## How It Works\n\n```mermaid\nsequenceDiagram\n participant Sender as 🧑 Sender's Browser\n participant Server as 🖥️ Val Town Server\n participant DB as 🗄️ SQLite\n participant Receiver as 🧑 Receiver's Browser\n\n Note over Sender: Enters secret + passphrase\n Sender->>Sender: Encrypt with AES-256-GCM (PBKDF2)\n Sender->>Server: POST /api/secrets {ciphertext, iv, salt}\n Note over Sender: ⚠️ Passphrase NEVER sent\n Server->>DB: Store encrypted blob + expiry\n Server-->>Sender: {id, expires_at}\n\n Note over Sender: Shares link via one channel\n Note over Sender: Shares passphrase via another channel\n\n Receiver->>Server: GET /api/secrets/:id\n Server->>DB: Lookup (reject if expired)\n DB-->>Server: {ciphertext, iv, salt}\n Server-->>Receiver: {ciphertext, iv, salt}\n Note over Receiver: Enters passphrase\n Receiver->>Receiver: Decrypt with AES-256-GCM (PBKDF2)\n Note over Receiver: ✅ Reads secret\n\n opt Early deletion\n Receiver->>Server: DELETE /api/secrets/:id\n Server->>DB: Permanently remove\n end\n```\n\n## Security Model\n\n| Layer | Detail |\n|---|---|\n| **Encryption** | AES-256-GCM (authenticated encryption) |\n| **Key Derivation** | PBKDF2 with SHA-256, 600,000 iterations |\n| **Salt** | 128-bit random per secret |\n| **IV** | 96-bit random per secret |\n| **Passphrase** | User-supplied or auto-generated, never transmitted |\n| **Server storage** | Ciphertext + IV + salt only — no plaintext, no passphrase, no key material |\n| **Expiry** | Configurable: 1 hour → 30 days (default 1 week) |\n| **Deletion** | Receiver can destroy immediately after reading |\n\n## Project Structure\n\n```\nsecret-share/\n├── main.ts # Hono HTTP routes + API endpoints\n├── server/\n│ ├── db.ts # SQLite CRUD (stores only ciphertext)\n│ └── render.tsx # Server-side React rendering\n├── client/\n│ ├── app.tsx # React UI (create + reveal views)\n│ └── hydrate.tsx # Client-side hydration\n└── shared/\n ├── types.ts # Shared TypeScript interfaces\n └── crypto.ts # AES-256-GCM encrypt/decrypt (Web Crypto API)\n```\n\n## Tech Stack\n\n- **Runtime:** [Val Town](https://val.town) (Deno)\n- **Server:** [Hono](https://hono.dev)\n- **UI:** React 18 (SSR + hydration, JSX only — no HTML/CSS/JS strings)\n- **Styling:** [Twind](https://twind.style) (Tailwind-in-JS)\n- **Database:** Val Town SQLite\n- **Crypto:** Web Crypto API (built into every modern browser and Deno)\n\n## Usage\n\n1. **Create:** Enter your secret → passphrase is auto-generated (or type your own) → click \"Encrypt & Create Link\"\n2. **Share:** Copy the link and passphrase — send them via **different channels** (e.g. link in Slack, passphrase in a text message)\n3. **Receive:** Open the link → enter the passphrase → read the secret\n4. **Destroy:** Click \"Delete This Secret Now\" to remove it before expiry\n\n---\n\n📖 **[View the full source code on Val Town →](https://www.val.town/x/stevekrouse/secret-share/code/)**\n",[156],"64463480-198f-11f1-b146-42dde27851f2","shared","6446358e-198f-11f1-b146-42dde27851f2",["D",1772823907845],"directory",[164],"a39c5556-198f-11f1-8039-42dde27851f2","server","a39c5632-198f-11f1-8039-42dde27851f2",7,["D",1772824014091],[170],"8b79bd6a-198f-11f1-8039-42dde27851f2","client","8b79be28-198f-11f1-8039-42dde27851f2",4,["D",1772823973606],[176],"pulls","branches","forks","envVars",{"_188":160,"_190":160},"connections",{"_188":160,"_189":160},"count","unfilledCount","emptyCount",{"_51":175,"_39":176,"_37":177,"_145":-5,"_49":50,"_48":178,"_147":33,"_46":259,"_13":160,"_41":167,"_43":-5,"_30":33,"_152":-5,"_203":260,"_34":261},{"_51":251,"_39":252,"_37":253,"_145":177,"_49":50,"_48":254,"_147":33,"_46":255,"_13":70,"_41":42,"_43":256,"_30":33,"_152":-5,"_203":257,"_34":258},{"_51":243,"_39":244,"_37":245,"_145":177,"_49":50,"_48":246,"_147":33,"_46":247,"_13":70,"_41":42,"_43":248,"_30":33,"_152":-5,"_203":249,"_34":250},{"_51":169,"_39":170,"_37":171,"_145":-5,"_49":50,"_48":172,"_147":31,"_46":240,"_13":160,"_41":167,"_43":-5,"_30":33,"_152":-5,"_203":241,"_34":242},{"_51":232,"_39":233,"_37":234,"_145":171,"_49":50,"_48":235,"_147":33,"_46":236,"_13":70,"_41":42,"_43":237,"_30":33,"_152":-5,"_203":238,"_34":239},{"_51":228,"_39":40,"_37":38,"_145":171,"_49":50,"_48":14,"_147":33,"_46":229,"_13":80,"_41":42,"_43":45,"_30":33,"_152":-5,"_203":230,"_34":231},{"_51":163,"_39":164,"_37":165,"_145":-5,"_49":50,"_48":70,"_147":31,"_46":225,"_13":160,"_41":167,"_43":-5,"_30":33,"_152":-5,"_203":226,"_34":227},{"_51":217,"_39":218,"_37":219,"_145":165,"_49":50,"_48":220,"_147":33,"_46":221,"_13":70,"_41":42,"_43":222,"_30":33,"_152":-5,"_203":223,"_34":224},{"_51":209,"_39":210,"_37":211,"_145":165,"_49":50,"_48":212,"_147":33,"_46":213,"_13":70,"_41":42,"_43":214,"_30":33,"_152":-5,"_203":215,"_34":216},{"_51":155,"_39":156,"_37":157,"_145":-5,"_49":50,"_48":158,"_147":33,"_46":206,"_13":160,"_41":26,"_43":161,"_30":33,"_152":-5,"_203":207,"_34":208},{"_51":143,"_39":144,"_37":65,"_145":-5,"_49":50,"_48":146,"_147":33,"_46":202,"_13":149,"_41":150,"_43":151,"_30":33,"_152":153,"_203":204,"_34":205},["D",1772824536883],"children",[],[144],["D",1772824180626],[],[156],"e3c9f434-1990-11f1-a6d7-42dde27851f2","types.ts","67a24fce-198f-11f1-a172-42dde27851f2",17,["D",1772824551225],"export interface SecretRecord {\n id: string;\n encrypted_data: string;\n iv: string;\n salt: string;\n expires_at: number;\n created_at: number;\n}\n\nexport interface CreateSecretRequest {\n encrypted_data: string;\n iv: string;\n salt: string;\n expires_in_hours: number;\n}\n\nexport interface CreateSecretResponse {\n id: string;\n expires_at: number;\n delete_token: string;\n}\n\nexport interface FetchSecretResponse {\n encrypted_data: string;\n iv: string;\n salt: string;\n expires_at: number;\n}\n",[],[164,210],"e829608c-1990-11f1-b5db-42dde27851f2","crypto.ts","6ddb21b8-198f-11f1-8039-42dde27851f2",18,["D",1772824558601],"export function arrayBufferToBase64(buffer: ArrayBuffer): string {\n const bytes = new Uint8Array(buffer);\n let binary = \"\";\n for (let i = 0; i < bytes.byteLength; i++) {\n binary += String.fromCharCode(bytes[i]);\n }\n return btoa(binary);\n}\n\nexport function base64ToArrayBuffer(base64: string): ArrayBuffer {\n const binary = atob(base64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes.buffer;\n}\n\nexport async function deriveKey(password: string, salt: Uint8Array): Promise {\n const encoder = new TextEncoder();\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveKey\"],\n );\n return crypto.subtle.deriveKey(\n { name: \"PBKDF2\", salt, iterations: 600000, hash: \"SHA-256\" },\n keyMaterial,\n { name: \"AES-GCM\", length: 256 },\n false,\n [\"encrypt\", \"decrypt\"],\n );\n}\n\nexport async function encryptData(\n plaintext: string,\n password: string,\n): Promise<{ encrypted: string; iv: string; salt: string }> {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const iv = crypto.getRandomValues(new Uint8Array(12));\n const key = await deriveKey(password, salt);\n const encoder = new TextEncoder();\n const encrypted = await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv },\n key,\n encoder.encode(plaintext),\n );\n return {\n encrypted: arrayBufferToBase64(encrypted),\n iv: arrayBufferToBase64(iv),\n salt: arrayBufferToBase64(salt),\n };\n}\n\nexport async function decryptData(\n encryptedBase64: string,\n ivBase64: string,\n saltBase64: string,\n password: string,\n): Promise {\n const salt = new Uint8Array(base64ToArrayBuffer(saltBase64));\n const iv = new Uint8Array(base64ToArrayBuffer(ivBase64));\n const key = await deriveKey(password, salt);\n const decrypted = await crypto.subtle.decrypt(\n { name: \"AES-GCM\", iv },\n key,\n base64ToArrayBuffer(encryptedBase64),\n );\n return new TextDecoder().decode(decrypted);\n}\n\nexport function generatePassphrase(length = 20): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789!@#$%\";\n const maxUnbiased = 256 - (256 % chars.length); // = 236 for 59 chars\n const result: string[] = [];\n\n while (result.length < length) {\n const values = crypto.getRandomValues(new Uint8Array(length - result.length));\n for (const v of values) {\n if (v < maxUnbiased) {\n result.push(chars[v % chars.length]);\n if (result.length === length) break;\n }\n // Reject biased values and retry\n }\n }\n\n return result.join(\"\");\n}\n",[],[164,218],["D",1772823907845],[198,199],[164],"3e70f2ca-1991-11f1-b5b5-42dde27851f2",["D",1772824703361],[],[170,40],"e11aa648-1990-11f1-b856-42dde27851f2","db.ts","ab280630-198f-11f1-8038-42dde27851f2",16,["D",1772824546752],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport type { SecretRecord } from \"../shared/types.ts\";\n\nexport async function ensureTable() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS secrets (\n id TEXT PRIMARY KEY,\n encrypted_data TEXT NOT NULL,\n iv TEXT NOT NULL,\n salt TEXT NOT NULL,\n expires_at INTEGER NOT NULL,\n created_at INTEGER NOT NULL DEFAULT (unixepoch()),\n delete_token TEXT NOT NULL DEFAULT ''\n )\n `);\n\n // Add delete_token column if upgrading from older schema\n try {\n await sqlite.execute(`ALTER TABLE secrets ADD COLUMN delete_token TEXT NOT NULL DEFAULT ''`);\n } catch {\n // Column already exists — ignore\n }\n}\n\nexport async function insertSecret(\n id: string,\n encryptedData: string,\n iv: string,\n salt: string,\n expiresAt: number,\n deleteToken: string,\n): Promise {\n await sqlite.execute({\n sql: `INSERT INTO secrets (id, encrypted_data, iv, salt, expires_at, created_at, delete_token)\n VALUES (?, ?, ?, ?, ?, ?, ?)`,\n args: [id, encryptedData, iv, salt, expiresAt, Math.floor(Date.now() / 1000), deleteToken],\n });\n}\n\nexport async function getSecret(id: string): Promise {\n const now = Math.floor(Date.now() / 1000);\n const result = await sqlite.execute({\n sql: `SELECT id, encrypted_data, iv, salt, expires_at, created_at\n FROM secrets WHERE id = ? AND expires_at > ?`,\n args: [id, now],\n });\n if (result.rows.length === 0) return null;\n return result.rows[0] as unknown as SecretRecord;\n}\n\nexport async function deleteSecret(id: string, deleteToken: string): Promise {\n const result = await sqlite.execute({\n sql: `DELETE FROM secrets WHERE id = ? AND delete_token = ?`,\n args: [id, deleteToken],\n });\n return result.rowsAffected > 0;\n}\n\nexport async function cleanupExpired(): Promise {\n const now = Math.floor(Date.now() / 1000);\n const result = await sqlite.execute({\n sql: `DELETE FROM secrets WHERE expires_at <= ?`,\n args: [now],\n });\n return result.rowsAffected;\n}\n",[],[170,233],["D",1772824014091],[195,196],[170],"c03ff4c4-198f-11f1-9869-42dde27851f2","hydrate.tsx","a1d88172-198f-11f1-8038-42dde27851f2",11,["D",1772824062153],"/** @jsxImportSource https://esm.sh/react@18 */\nimport React from \"https://esm.sh/react@18\";\nimport { hydrateRoot } from \"https://esm.sh/react-dom@18/client\";\nimport { App } from \"./app.tsx\";\n\nhydrateRoot(\n document.getElementById(\"root\")!,\n ,\n);\n",[],[176,244],"0445181a-1991-11f1-82e8-42dde27851f2","app.tsx","a079f8e2-198f-11f1-8038-42dde27851f2",19,["D",1772824605761],"/** @jsxImportSource https://esm.sh/react@18 */\nimport React, { useState, useCallback } from \"https://esm.sh/react@18\";\nimport type {\n CreateSecretRequest,\n CreateSecretResponse,\n FetchSecretResponse,\n} from \"../shared/types.ts\";\nimport { encryptData, decryptData, generatePassphrase } from \"../shared/crypto.ts\";\n\nfunction Spinner() {\n return (\n \n \n \n \n );\n}\n\nfunction CopyButton({ text }: { text: string }) {\n const [copied, setCopied] = useState(false);\n const handleCopy = useCallback(async () => {\n await navigator.clipboard.writeText(text);\n setCopied(true);\n setTimeout(() => setCopied(false), 2000);\n }, [text]);\n return (\n \n {copied ? \"✓ Copied\" : \"📋 Copy\"}\n \n );\n}\n\nfunction CreateView() {\n const [secret, setSecret] = useState(\"\");\n const [passphrase, setPassphrase] = useState(() => generatePassphrase());\n const [expiresInHours, setExpiresInHours] = useState(168);\n const [loading, setLoading] = useState(false);\n const [result, setResult] = useState<{ url: string; passphrase: string; secretId: string; deleteToken: string } | null>(null);\n const [deleting, setDeleting] = useState(false);\n const [deleted, setDeleted] = useState(false);\n const [error, setError] = useState(null);\n\n const handleGenerate = useCallback(() => {\n setPassphrase(generatePassphrase());\n }, []);\n\n const handleSubmit = useCallback(async () => {\n if (!secret.trim()) {\n setError(\"Please enter a secret to share.\");\n return;\n }\n if (!passphrase.trim()) {\n setError(\"Please enter or generate a passphrase.\");\n return;\n }\n setLoading(true);\n setError(null);\n try {\n const { encrypted, iv, salt } = await encryptData(secret, passphrase);\n const body: CreateSecretRequest = {\n encrypted_data: encrypted,\n iv,\n salt,\n expires_in_hours: expiresInHours,\n };\n const res = await fetch(\"/api/secrets\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n });\n if (!res.ok) throw new Error(await res.text());\n const data: CreateSecretResponse = await res.json();\n const url = `${window.location.origin}/s/${data.id}`;\n setResult({ url, passphrase, secretId: data.id, deleteToken: data.delete_token });\n } catch (e: any) {\n setError(e.message || \"Something went wrong\");\n } finally {\n setLoading(false);\n }\n }, [secret, passphrase, expiresInHours]);\n\n const handleDelete = useCallback(async () => {\n if (!result) return;\n if (!confirm(\"Are you sure? This secret will be permanently deleted.\")) return;\n setDeleting(true);\n setError(null);\n try {\n const res = await fetch(`/api/secrets/${result.secretId}`, {\n method: \"DELETE\",\n headers: { \"X-Delete-Token\": result.deleteToken },\n });\n if (!res.ok) throw new Error(await res.text());\n setDeleted(true);\n } catch (e: any) {\n setError(e.message || \"Failed to delete\");\n } finally {\n setDeleting(false);\n }\n }, [result]);\n\n if (deleted) {\n return (\n

🗑️ Secret Deleted

The secret has been permanently destroyed.

\n {\n setResult(null);\n setDeleted(false);\n setSecret(\"\");\n setPassphrase(generatePassphrase());\n }}\n className=\"w-full py-3 bg-purple-600 hover:bg-purple-500 text-white font-bold rounded-lg transition-colors\"\n >\n Create a New Secret\n \n

\n );\n }\n\n if (result) {\n return (\n

🔒 Secret Created!

\n Share this link:\n

\n {result.url}\n \n

\n \n Passphrase (send separately!):\n \n

\n {result.passphrase}\n \n

\n ⚠️ Send the link and passphrase via different channels for maximum security.\n

\n {error && (\n

\n {error}\n

\n )}\n \n {deleting && }\n {deleting ? \"Deleting...\" : \"🗑️ Delete This Secret\"}\n \n {\n setResult(null);\n setSecret(\"\");\n setPassphrase(generatePassphrase());\n }}\n className=\"w-full py-3 bg-gray-700 hover:bg-gray-600 text-white font-medium rounded-lg transition-colors\"\n >\n Create Another Secret\n \n

\n );\n }\n\n return (\n

\n Your Secret\n setSecret(e.target.value)}\n placeholder=\"Enter password, API key, or any secret text...\"\n rows={4}\n className=\"w-full bg-gray-800 border border-gray-700 rounded-lg p-3 text-white placeholder-gray-500 focus:outline-none focus:ring-2 focus:ring-purple-500 focus:border-transparent resize-none\"\n />\n

\n Encryption Passphrase\n

\n setPassphrase(e.target.value)}\n className=\"flex-1 bg-gray-800 border border-gray-700 rounded-lg p-3 text-white font-mono focus:outline-none focus:ring-2 focus:ring-purple-500 focus:border-transparent\"\n />\n \n 🎲 Generate\n \n

\n Expires In\n setExpiresInHours(Number(e.target.value))}\n className=\"w-full bg-gray-800 border border-gray-700 rounded-lg p-3 text-white focus:outline-none focus:ring-2 focus:ring-purple-500 focus:border-transparent\"\n >\n \n \n \n \n \n \n

\n {error && (\n

\n {error}\n

\n )}\n \n {loading && }\n {loading ? \"Encrypting & Saving...\" : \"🔐 Encrypt & Create Link\"}\n \n

\n );\n}\n\nfunction RevealView({ secretId }: { secretId: string }) {\n const [passphrase, setPassphrase] = useState(\"\");\n const [decryptedSecret, setDecryptedSecret] = useState(null);\n const [loading, setLoading] = useState(false);\n const [error, setError] = useState(null);\n const [notFound, setNotFound] = useState(false);\n\n const handleDecrypt = useCallback(async () => {\n if (!passphrase.trim()) {\n setError(\"Please enter the passphrase.\");\n return;\n }\n setLoading(true);\n setError(null);\n try {\n const res = await fetch(`/api/secrets/${secretId}`);\n if (res.status === 404) {\n setNotFound(true);\n return;\n }\n if (!res.ok) throw new Error(await res.text());\n const data: FetchSecretResponse = await res.json();\n const plaintext = await decryptData(data.encrypted_data, data.iv, data.salt, passphrase);\n setDecryptedSecret(plaintext);\n } catch (e: any) {\n if (e.name === \"OperationError\") {\n setError(\"Wrong passphrase. Please try again.\");\n } else {\n setError(e.message || \"Something went wrong\");\n }\n } finally {\n setLoading(false);\n }\n }, [secretId, passphrase]);\n\n if (notFound) {\n return (\n

🚫 Secret Not Found

This secret has expired or been deleted.

\n \n Create a New Secret\n \n

\n );\n }\n\n if (decryptedSecret !== null) {\n return (\n

🔓 Decrypted Secret

\n \n

\n            {decryptedSecret}\n

\n 💡 Only the secret's creator can delete it.\n

\n \n Create a New Secret\n \n

\n );\n }\n\n return (\n

🔒 Someone sent you a secret

Enter the passphrase to decrypt it.

\n Passphrase\n setPassphrase(e.target.value)}\n onKeyDown={(e) => e.key === \"Enter\" && handleDecrypt()}\n placeholder=\"Enter the passphrase you were given...\"\n className=\"w-full bg-gray-800 border border-gray-700 rounded-lg p-3 text-white font-mono placeholder-gray-500 focus:outline-none focus:ring-2 focus:ring-purple-500 focus:border-transparent\"\n autoFocus\n />\n

\n {error && (\n

\n {error}\n

\n )}\n \n {loading && }\n {loading ? \"Decrypting...\" : \"🔓 Decrypt Secret\"}\n \n

\n );\n}\n\nexport function App({ secretId }: { secretId?: string }) {\n return (\n

\n 🔐 Secret Share\n

End-to-end encrypted secret sharing

\n {secretId ? : }\n

\n Secrets are encrypted in your browser. The server never sees your passphrase or plaintext.\n

\n );\n}\n",[],[176,252],["D",1772823973606],[192,193],[176],["D",1772823903506],["D",1789515657103],{"_108":107,"_115":111},{"_108":107,"_109":-5,"_110":111,"_19":63,"_112":113,"_114":33},{"_13":97,"_39":98,"_51":50,"_99":52,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":53,"_106":107},"ctx",{"_90":-5,"_135":300,"_301":302,"_303":304,"_305":33,"_306":33,"_307":33,"_308":31,"_309":-5,"_310":-7,"_311":-7,"_312":160,"_313":33,"_314":33,"_315":-5,"_316":33,"_317":33,"_318":33,"_319":-5},"ENV",{"_271":272,"_273":274,"_275":98,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291,"_292":293,"_294":295,"_296":297,"_298":299},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v21