anhedral 0.1.6 → 0.1.8

package/dist/templates/backend.js

@@ -54,6 +54,7 @@ function writePackageJson(dir, projectName) {
             'db:generate': 'drizzle-kit generate',
             'db:migrate': 'pnpm --filter @anhedral/db db:migrate',
             'db:studio': 'drizzle-kit studio',
+            'db:check': 'drizzle-kit check',
             'db:push': 'drizzle-kit push',
             lint: 'eslint . --ext .js,.ts',
             test: 'vitest run',
@@ -659,11 +660,6 @@ export interface RevenueCatEntitlement {
   cancelAtPeriodEnd?: boolean;
 }
 
-export interface GrantPromoResult {
-  success: boolean;
-  expiresAt: Date;
-}
-
 const RC_CACHE_TTL_MS = process.env.NODE_ENV === 'production' ? 60_000 : 10_000;
 const rcEntitlementCache = new LRUCache<RevenueCatEntitlement>({ maxSize: 100_000, ttlMs: RC_CACHE_TTL_MS });
 const inflightCached = new Map<string, Promise<RevenueCatEntitlement>>();
@@ -673,17 +669,6 @@ export function invalidateRcEntitlementCache(appUserId: string, entitlementId: s
   rcEntitlementCache.invalidate(\`\${entitlementId}:\${appUserId}\`);
 }
 
-function addMonthsClamped(date: Date, months: number): Date {
-  const m = Number.isFinite(months) ? months : 0;
-  if (m === 0) return new Date(date.getTime());
-  const yr = date.getFullYear(), mo = date.getMonth(), day = date.getDate();
-  const targetMo = mo + m;
-  const targetYr = yr + Math.floor(targetMo / 12);
-  const finalMo  = ((targetMo % 12) + 12) % 12;
-  const lastDay  = new Date(targetYr, finalMo + 1, 0).getDate();
-  return new Date(targetYr, finalMo, Math.min(day, lastDay), date.getHours(), date.getMinutes(), date.getSeconds(), date.getMilliseconds());
-}
-
 interface RcSubscriberResponse {
   subscriber?: {
     entitlements?: Record<string, { expires_date?: string; purchase_date?: string; product_identifier?: string; will_renew?: boolean | null; unsubscribe_detected_at?: string | null }>;
@@ -778,30 +763,12 @@ export function verifyRevenueCatWebhookAuthorization(authHeader: string | undefi
   const normalize = (v: string) => v.trim().replace(/^bearer\\s+/i, '');
   return normalize(authHeader) === normalize(secret);
 }
-
-export async function grantPromotionalEntitlement(
-  appUserId: string, entitlementId: string, months: number, apiKey: string
-): Promise<GrantPromoResult> {
-  const safeMonths = Number.isFinite(months) && months > 0 ? months : 1;
-  const startsAt  = new Date();
-  const expiresAt = addMonthsClamped(startsAt, safeMonths);
-  const url = \`https://api.revenuecat.com/v1/subscribers/\${encodeURIComponent(appUserId)}/entitlements/\${encodeURIComponent(entitlementId)}/promotional\`;
-  const res = await fetchWithTimeout(url, {
-    method: 'POST',
-    headers: { Accept: 'application/json', 'Content-Type': 'application/json', Authorization: \`Bearer \${apiKey}\` },
-    body: JSON.stringify({ duration: \`\${safeMonths}m\`, end_time_ms: expiresAt.getTime() }),
-    timeout: 60_000,
-  });
-  if (!res.ok) throw new Error(\`RevenueCat promo grant failed: \${res.status} \${await res.text()}\`);
-  return { success: true, expiresAt };
-}
 `);
-    writeFile(path.join(dir, 'src/lib/r2.ts'), `import { GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+    writeFile(path.join(dir, 'src/lib/r2.ts'), `import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 
-type UploadAvatarInput = {
+type UploadObjectInput = {
   objectKey: string;
-  body: Buffer;
   contentType: string;
 };
 
@@ -841,29 +808,40 @@ export function isR2Configured() {
   return hasR2Config();
 }
 
-export async function uploadAvatarToR2(input: UploadAvatarInput) {
+export async function createSignedUploadUrl(input: UploadObjectInput, expiresIn = 60 * 10) {
   const client = getR2Client();
   const bucket = getBucket();
 
-  await client.send(new PutObjectCommand({
+  const uploadUrl = await getSignedUrl(client, new PutObjectCommand({
     Bucket: bucket,
     Key: input.objectKey,
-    Body: input.body,
     ContentType: input.contentType,
-  }));
+  }), { expiresIn });
 
   return {
     bucket,
     objectKey: input.objectKey,
+    uploadUrl,
+    expiresIn,
   };
 }
 
-export async function createSignedAvatarUrl(objectKey: string) {
+export async function createSignedDownloadUrl(objectKey: string, expiresIn = 60 * 10) {
   const client = getR2Client();
-  return getSignedUrl(client, new GetObjectCommand({
+  const downloadUrl = await getSignedUrl(client, new GetObjectCommand({
     Bucket: getBucket(),
     Key: objectKey,
-  }), { expiresIn: 60 * 10 });
+  }), { expiresIn });
+
+  return { objectKey, downloadUrl, expiresIn };
+}
+
+export async function deleteObjectFromR2(objectKey: string) {
+  const client = getR2Client();
+  await client.send(new DeleteObjectCommand({
+    Bucket: getBucket(),
+    Key: objectKey,
+  }));
 }
 `);
     writeFile(path.join(dir, 'src/services/SubscriptionService.ts'), `import type { FastifyInstance, FastifyRequest } from 'fastify';
@@ -1382,12 +1360,13 @@ export class CorsConfig {
 // Repositories
 // ═══════════════════════════════════════════════════════════════════════════
 function writeRepositories(dir) {
-    writeFile(path.join(dir, 'src/repositories/UserRepository.ts'), `import { eq } from 'drizzle-orm';
+    writeFile(path.join(dir, 'src/repositories/UserRepository.ts'), `import crypto from 'node:crypto';
+import { eq } from 'drizzle-orm';
 import type { Database } from '../db/index.js';
 import { users } from '../db/schema.js';
 import type { NewUsers, SubscriptionStatus, SubscriptionTier } from '../db/schema.js';
 import { LRUCache } from '../lib/lruCache.js';
-import { subscriptions } from '../db/schema.js';
+import { subscriptions, uploads } from '../db/schema.js';
 
 export type UserAuthData = {
   id: string;
@@ -1446,27 +1425,13 @@ export class UserRepository {
     return { created: true };
   }
 
-  async updateAvatar(userId: string, input: {
-    avatarObjectKey: string;
-    avatarMimeType: string;
-  }): Promise<void> {
-    await this.db.update(users).set({
-      avatarObjectKey: input.avatarObjectKey,
-      avatarMimeType: input.avatarMimeType,
-    }).where(eq(users.id, userId));
-    authPluginCache.invalidate(\`auth:\${userId}\`);
-  }
-
-  async getDashboardProfile(userId: string) {
+  async getProfile(userId: string) {
     const rows = await this.db
       .select({
         id: users.id,
         email: users.email,
         displayName: users.displayName,
         profileImageUrl: users.profileImageUrl,
-        avatarObjectKey: users.avatarObjectKey,
-        avatarMimeType: users.avatarMimeType,
-        creditsBalance: users.creditsBalance,
         subscriptionTier: subscriptions.tier,
         subscriptionStatus: subscriptions.status,
       })
@@ -1483,6 +1448,19 @@ export class UserRepository {
     authPluginCache.invalidate(\`auth:\${userId}\`);
   }
 
+  async createUploadRecord(
+    userId: string,
+    input: { objectKey: string; bucket: string; contentType: string | null },
+  ): Promise<void> {
+    await this.db.insert(uploads).values({
+      id: crypto.randomUUID(),
+      userId,
+      objectKey: input.objectKey,
+      bucket: input.bucket,
+      contentType: input.contentType,
+    });
+  }
+
   async deleteById(userId: string): Promise<void> {
     await this.db.delete(users).where(eq(users.id, userId));
     authPluginCache.invalidate(\`auth:\${userId}\`);
@@ -1646,77 +1624,27 @@ export class SubscriptionEventRepository {
     return results.reduce((acc, r) => { acc[r.eventType] = r.count; return acc; }, {} as Record<string, number>);
   }
 }
-`);
-    writeFile(path.join(dir, 'src/repositories/PromoCodeRepository.ts'), `import { eq, and, lt, sql } from 'drizzle-orm';
-import crypto from 'node:crypto';
-import type { Database } from '../db/index.js';
-import { promoCodes, promoRedemptions } from '../db/schema.js';
-import type { PromoCodes } from '../db/schema.js';
-
-export interface ValidateCodeResult {
-  valid: boolean;
-  error?: string;
-  promoCode?: PromoCodes;
-}
-
-export class PromoCodeRepository {
-  constructor(private db: Database) {}
-
-  async validateCode(code: string, userId: string): Promise<ValidateCodeResult> {
-    const [promoCode] = await this.db.select().from(promoCodes)
-      .where(eq(promoCodes.code, code.toUpperCase())).limit(1);
-    if (!promoCode) return { valid: false, error: 'invalid_code' };
-
-    const now = new Date();
-    if (promoCode.expiresAt && promoCode.expiresAt < now) return { valid: false, error: 'code_expired' };
-    if (promoCode.redeemedCount >= promoCode.maxRedemptions) return { valid: false, error: 'code_fully_used' };
-
-    const [existing] = await this.db.select().from(promoRedemptions)
-      .where(and(eq(promoRedemptions.promoCodeId, promoCode.id), eq(promoRedemptions.userId, userId))).limit(1);
-    if (existing) return { valid: false, error: 'already_redeemed' };
-
-    return { valid: true, promoCode };
-  }
-
-  async recordRedemption(promoCodeId: string, userId: string, entitlementExpiresAt: Date): Promise<void> {
-    await this.db.insert(promoRedemptions).values({
-      id: crypto.randomUUID(), promoCodeId, userId, entitlementExpiresAt,
-    });
-    await this.db.update(promoCodes)
-      .set({ redeemedCount: sql\`\${promoCodes.redeemedCount} + 1\` })
-      .where(eq(promoCodes.id, promoCodeId));
-  }
-
-  async findExpiredRedemptions(userId: string): Promise<typeof promoRedemptions.$inferSelect[]> {
-    return this.db.select().from(promoRedemptions)
-      .where(and(eq(promoRedemptions.userId, userId), lt(promoRedemptions.entitlementExpiresAt, new Date())));
-  }
-}
 `);
     writeFile(path.join(dir, 'src/repositories/index.ts'), `import type { Database } from '../db/index.js';
 import { UserRepository } from './UserRepository.js';
 import { SubscriptionRepository } from './SubscriptionRepository.js';
 import { SubscriptionEventRepository } from './SubscriptionEventRepository.js';
-import { PromoCodeRepository } from './PromoCodeRepository.js';
 
 export class Repositories {
   public readonly users: UserRepository;
   public readonly subscriptions: SubscriptionRepository;
   public readonly subscriptionEvents: SubscriptionEventRepository;
-  public readonly promoCodes: PromoCodeRepository;
 
   constructor(db: Database) {
     this.users = new UserRepository(db);
     this.subscriptions = new SubscriptionRepository(db);
     this.subscriptionEvents = new SubscriptionEventRepository(db);
-    this.promoCodes = new PromoCodeRepository(db);
   }
 }
 
 export { UserRepository } from './UserRepository.js';
 export { SubscriptionRepository } from './SubscriptionRepository.js';
 export { SubscriptionEventRepository } from './SubscriptionEventRepository.js';
-export { PromoCodeRepository } from './PromoCodeRepository.js';
 export type { UserAuthData } from './UserRepository.js';
 export type { RecordEventParams } from './SubscriptionEventRepository.js';
 `);
@@ -1752,7 +1680,6 @@ export default healthRoutes;
 import { clerkClient } from '@clerk/fastify';
 import { AuthError } from '../errors/index.js';
 import { createAuthHook } from '../lib/routeHelpers.js';
-import { createSignedAvatarUrl, isR2Configured, uploadAvatarToR2 } from '../lib/r2.js';
 
 function getDisplayName(input: {
   firstName?: string | null;
@@ -1765,28 +1692,6 @@ function getDisplayName(input: {
     || (input.email ? input.email.split('@')[0] : 'Builder');
 }
 
-async function resolveAvatarUrl(input: {
-  avatarObjectKey?: string | null;
-  fallbackUrl?: string | null;
-}) {
-  if (input.avatarObjectKey && isR2Configured()) {
-    try {
-      return await createSignedAvatarUrl(input.avatarObjectKey);
-    } catch {
-      return input.fallbackUrl ?? null;
-    }
-  }
-
-  return input.fallbackUrl ?? null;
-}
-
-function sanitizeFileName(fileName: string) {
-  return fileName
-    .toLowerCase()
-    .replace(/[^a-z0-9.-]+/g, '-')
-    .replace(/^-+|-+$/g, '');
-}
-
 const authRoutes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
   fastify.get('/me', {
     preHandler: createAuthHook(fastify),
@@ -1802,16 +1707,12 @@ const authRoutes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
           lastName: 'Builder',
           displayName: '${displayName} Demo',
           imageUrl: null,
-          avatarUrl: null,
-          creditsBalance: 250,
-          subscriptionTier: 'pro',
-          subscriptionStatus: 'active',
         },
       });
     }
 
     const clerkUser = await clerkClient.users.getUser(req.user.id);
-    const userData = await fastify.repos.users.getDashboardProfile(req.user.id);
+    const userData = await fastify.repos.users.getProfile(req.user.id);
     const primaryEmail = clerkUser.emailAddresses.find(
       (e: { id: string }) => e.id === clerkUser.primaryEmailAddressId
     );
@@ -1822,10 +1723,6 @@ const authRoutes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
       email,
       fallback: userData?.displayName ?? null,
     });
-    const avatarUrl = await resolveAvatarUrl({
-      avatarObjectKey: userData?.avatarObjectKey ?? null,
-      fallbackUrl: userData?.profileImageUrl ?? clerkUser.imageUrl ?? null,
-    });
 
     return reply.send({
       user: {
@@ -1835,10 +1732,6 @@ const authRoutes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
         lastName: clerkUser.lastName,
         displayName,
         imageUrl: userData?.profileImageUrl ?? clerkUser.imageUrl,
-        avatarUrl,
-        creditsBalance: userData?.creditsBalance ?? 250,
-        subscriptionTier: userData?.subscriptionTier || 'free',
-        subscriptionStatus: userData?.subscriptionStatus || 'active',
       },
     });
   });
@@ -1850,48 +1743,6 @@ const authRoutes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
     return reply.send({ success: true });
   });
 
-  fastify.post<{ Body: { base64: string; mimeType: string; fileName?: string } }>('/avatar', {
-    preHandler: createAuthHook(fastify),
-  }, async (req, reply) => {
-    if (!req.user?.id) throw AuthError.unauthorized();
-    if (!isR2Configured()) {
-      return reply.code(500).send({ error: 'r2_not_configured', message: 'Configure Cloudflare R2 before uploading avatars.' });
-    }
-
-    const { base64, mimeType, fileName } = req.body;
-    if (!base64 || !mimeType) {
-      return reply.code(400).send({ error: 'invalid_payload', message: 'Avatar payload is incomplete.' });
-    }
-    if (!mimeType.startsWith('image/')) {
-      return reply.code(400).send({ error: 'invalid_mime_type', message: 'Only image uploads are supported.' });
-    }
-
-    const normalizedBase64 = base64.includes(',') ? (base64.split(',')[1] ?? '') : base64;
-    const buffer = Buffer.from(normalizedBase64, 'base64');
-    if (buffer.length === 0) {
-      return reply.code(400).send({ error: 'invalid_payload', message: 'Avatar payload is empty.' });
-    }
-    if (buffer.length > 5 * 1024 * 1024) {
-      return reply.code(400).send({ error: 'file_too_large', message: 'Avatar uploads are capped at 5MB.' });
-    }
-
-    const safeName = sanitizeFileName(fileName || 'avatar');
-    const objectKey = \`avatars/\${req.user.id}/\${Date.now()}-\${safeName || 'avatar'}\`;
-    await uploadAvatarToR2({
-      objectKey,
-      body: buffer,
-      contentType: mimeType,
-    });
-
-    await fastify.repos.users.updateAvatar(req.user.id, {
-      avatarObjectKey: objectKey,
-      avatarMimeType: mimeType,
-    });
-
-    const avatarUrl = await createSignedAvatarUrl(objectKey);
-    return reply.send({ ok: true, avatarUrl });
-  });
-
   fastify.delete('/account', {
     preHandler: createAuthHook(fastify),
   }, async (req: FastifyRequest, reply: FastifyReply) => {
@@ -1908,8 +1759,8 @@ export default authRoutes;
 import clerkAuthPlugin from '../plugins/clerkAuth.js';
 import { SubscriptionService } from '../services/SubscriptionService.js';
 import { AuthError } from '../errors/index.js';
-import { verifyRevenueCatWebhook, verifyRevenueCatWebhookAuthorization, grantPromotionalEntitlement } from '../lib/revenuecat.js';
-import { createAuthHook, runBackgroundTask } from '../lib/routeHelpers.js';
+import { verifyRevenueCatWebhook, verifyRevenueCatWebhookAuthorization } from '../lib/revenuecat.js';
+import { createAuthHook } from '../lib/routeHelpers.js';
 import { CACHE_SECONDS } from '../lib/constants.js';
 
 const subscriptionRoutes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
@@ -1949,50 +1800,6 @@ const subscriptionRoutes: FastifyPluginAsync = async (fastify: FastifyInstance)
       reply.header('Cache-Control', 'private, no-store');
       return reply.send(data);
     });
-
-    app.post<{ Body: { code: string } }>('/redeem', {
-      preHandler: createAuthHook(app),
-    }, async (req, reply) => {
-      const userId = req.user?.id;
-      if (!userId) throw AuthError.unauthorized();
-      if (app.env.ANHEDRAL_DEMO === 'true') {
-        return { ok: true, expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString() };
-      }
-      const { code } = req.body;
-      const validation = await app.repos.promoCodes.validateCode(code, userId);
-      if (!validation.valid || !validation.promoCode) {
-        const msgs: Record<string, string> = { invalid_code: 'This code is not valid.', code_expired: 'This code has expired.', code_fully_used: 'This code has already been used.', already_redeemed: 'You have already redeemed this code.' };
-        return reply.code(400).send({ error: validation.error, message: msgs[validation.error!] || 'Invalid code.' });
-      }
-      const rcKey = app.env.RC_SECRET_API_KEY;
-      if (!rcKey) return reply.code(500).send({ error: 'configuration_error', message: 'Subscription service not configured.' });
-
-      const { promoCode } = validation;
-      const entitlementId = app.env.RC_ENTITLEMENT_ID || 'pro';
-      try {
-        const currentSub = await app.repos.subscriptions.findByUserId(userId);
-        const result = await grantPromotionalEntitlement(userId, entitlementId, promoCode.months, rcKey);
-        await app.repos.promoCodes.recordRedemption(promoCode.id, userId, result.expiresAt);
-        const now = new Date();
-        await app.repos.subscriptions.upsert(userId, {
-          tier: 'pro', status: 'active', method: 'redeemed',
-          currentPeriodStart: now, currentPeriodEnd: result.expiresAt,
-          trialStart: null, trialEnd: null,
-          metadata: { redeemCode: promoCode.code, redeemCodeRedeemedAt: now.toISOString() },
-        });
-        runBackgroundTask(req, app.repos.subscriptionEvents.recordEvent({
-          userId, subscriptionId: currentSub?.id, eventType: 'promo_redeemed',
-          previousState: { tier: currentSub?.tier, status: currentSub?.status, method: currentSub?.method },
-          newState: { tier: 'pro', status: 'active', method: 'redeemed' },
-          periodStart: now, periodEnd: result.expiresAt,
-          metadata: { promoCode: promoCode.code },
-        }), 'promo_redeemed_event');
-        return { ok: true, expiresAt: result.expiresAt.toISOString() };
-      } catch (err) {
-        app.log.error({ msg: '[redeem:failed]', userId, error: (err as Error).message });
-        return reply.code(500).send({ error: 'redemption_failed', message: 'Failed to redeem code. Please try again.' });
-      }
-    });
   });
 
   await fastify.register(async (app) => {
@@ -2033,12 +1840,100 @@ const subscriptionRoutes: FastifyPluginAsync = async (fastify: FastifyInstance)
 };
 
 export default subscriptionRoutes;
+`);
+    writeFile(path.join(dir, 'src/routes/storage.ts'), `import crypto from 'node:crypto';
+import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
+import { CreateUploadRequestSchema } from '@anhedral/contracts';
+import { AuthError, ServerError, ValidationError } from '../errors/index.js';
+import { createAuthHook } from '../lib/routeHelpers.js';
+import { createSignedDownloadUrl, createSignedUploadUrl, deleteObjectFromR2, isR2Configured } from '../lib/r2.js';
+
+const SIGNED_URL_EXPIRES_IN = 60 * 10;
+
+function sanitizeFileName(fileName: string | undefined) {
+  const fallback = 'upload';
+  const cleaned = (fileName ?? fallback)
+    .normalize('NFKD')
+    .replace(/[^a-zA-Z0-9._-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 120);
+  return cleaned || fallback;
+}
+
+function objectKeyForUser(userId: string, fileName: string | undefined) {
+  const safeUserId = userId.replace(/[^a-zA-Z0-9_-]+/g, '_');
+  return \`\${safeUserId}--\${crypto.randomUUID()}--\${sanitizeFileName(fileName)}\`;
+}
+
+function assertUserOwnsObject(userId: string, objectKey: string) {
+  const safeUserId = userId.replace(/[^a-zA-Z0-9_-]+/g, '_');
+  if (!objectKey.startsWith(\`\${safeUserId}--\`)) {
+    throw AuthError.forbidden();
+  }
+}
+
+const storageRoutes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
+  fastify.post('/uploads', {
+    preHandler: createAuthHook(fastify),
+  }, async (req, reply) => {
+    if (!req.user?.id) throw AuthError.unauthorized();
+    if (!isR2Configured()) throw ServerError.missingConfiguration('R2');
+
+    const parsed = CreateUploadRequestSchema.safeParse(req.body);
+    if (!parsed.success) throw ValidationError.invalidFormat('body', 'CreateUploadRequest');
+    const input = parsed.data;
+    const objectKey = objectKeyForUser(req.user.id, input.fileName);
+    const signed = await createSignedUploadUrl({
+      objectKey,
+      contentType: input.contentType,
+    }, SIGNED_URL_EXPIRES_IN);
+
+    await fastify.repos.users.createUploadRecord(req.user.id, {
+      objectKey,
+      bucket: signed.bucket,
+      contentType: input.contentType,
+    });
+
+    return reply.send({
+      objectKey,
+      uploadUrl: signed.uploadUrl,
+      expiresIn: signed.expiresIn,
+      headers: { 'Content-Type': input.contentType },
+    });
+  });
+
+  fastify.get<{ Params: { key: string } }>('/files/:key', {
+    preHandler: createAuthHook(fastify),
+  }, async (req, reply) => {
+    if (!req.user?.id) throw AuthError.unauthorized();
+    if (!isR2Configured()) throw ServerError.missingConfiguration('R2');
+
+    const objectKey = decodeURIComponent(req.params.key);
+    assertUserOwnsObject(req.user.id, objectKey);
+    return reply.send(await createSignedDownloadUrl(objectKey, SIGNED_URL_EXPIRES_IN));
+  });
+
+  fastify.delete<{ Params: { key: string } }>('/files/:key', {
+    preHandler: createAuthHook(fastify),
+  }, async (req, reply) => {
+    if (!req.user?.id) throw AuthError.unauthorized();
+    if (!isR2Configured()) throw ServerError.missingConfiguration('R2');
+
+    const objectKey = decodeURIComponent(req.params.key);
+    assertUserOwnsObject(req.user.id, objectKey);
+    await deleteObjectFromR2(objectKey);
+    return reply.code(204).send();
+  });
+};
+
+export default storageRoutes;
 `);
     writeFile(path.join(dir, 'src/routes/index.ts'), `import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
 import clerkAuthPlugin from '../plugins/clerkAuth.js';
 import health from './health.js';
 import auth from './auth.js';
 import subscriptions from './subscriptions.js';
+import storage from './storage.js';
 import cors from '@fastify/cors';
 
 const routes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
@@ -2066,6 +1961,12 @@ const routes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
     await app.register(cors, { origin: restrictedCorsOrigin, maxAge: 86_400, methods: ['GET', 'POST', 'OPTIONS'], allowedHeaders: ['Authorization', 'Content-Type', 'X-Platform', 'X-RevenueCat-Signature'] });
     await app.register(subscriptions);
   }, { prefix: '/subscriptions' });
+
+  await fastify.register(async (app) => {
+    await app.register(cors, { origin: restrictedCorsOrigin, maxAge: 86_400, methods: ['GET', 'POST', 'DELETE', 'OPTIONS'], allowedHeaders: ['Authorization', 'Content-Type', 'X-Platform'] });
+    await app.register(clerkAuthPlugin);
+    await app.register(storage);
+  }, { prefix: '/storage' });
 };
 
 export default routes;