updates to uuids to be consistent

apps/api/src/routes/images.ts

@@ -64,7 +64,7 @@ export const imageRoutes = new Hono<App>({ strict: false })
 		// The `img` worker serves it back by that key (slashes and all), which is the
 		// returned ImageName.
 		const datePrefix = new Date().toISOString().slice(0, 10) + '/'
-		const name = datePrefix + crypto.randomUUID().replace(/-/g, '') + extension
+		const name = datePrefix + crypto.randomUUID() + extension
 		await c.env.IMAGES.put(name, await file.arrayBuffer(), {
 			httpMetadata: { contentType: file.type || 'image/jpeg' },
 		})

apps/api/src/test/integration/api.test.ts

@@ -325,7 +325,9 @@ describe('images', () => {
 		})
 		expect(res.status).toBe(200)
 		const { ImageName } = (await res.json()) as { ImageName: string }
-		expect(ImageName).toMatch(/^\d{4}-\d{2}-\d{2}\/[0-9a-f]+\.png$/)
+		expect(ImageName).toMatch(
+			/^\d{4}-\d{2}-\d{2}\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.png$/
+		)
 
 		// The object is in the shared bucket under that key.
 		const stored = await env.IMAGES.get(ImageName)
@@ -470,7 +472,9 @@ describe('images', () => {
 		})
 		expect(res.status).toBe(200)
 		const { ImageName } = (await res.json()) as { ImageName: string }
-		expect(ImageName).toMatch(/^\d{4}-\d{2}-\d{2}\/[0-9a-f]+\.jpg$/)
+		expect(ImageName).toMatch(
+			/^\d{4}-\d{2}-\d{2}\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jpg$/
+		)
 
 		// The account row now points its profileImage at the uploaded key.
 		const row = await env.DB.prepare('SELECT data FROM accounts WHERE account_id = 42').first<{

apps/auth/src/refresh-db.ts

@@ -38,11 +38,10 @@ async function hashToken(token: string): Promise<string> {
 
 /**
  * Mint and persist a new refresh token for the given login, returning the raw
- * token — the only moment it exists in plaintext (only its hash is stored). The
+ * token — the only moment it exists in plaintext (only its hash is stored).
- * `-1` suffix mirrors the shape the client expects.
  */
 export async function issueRefreshToken(db: D1Database, ctx: RefreshContext): Promise<string> {
-	const token = `${crypto.randomUUID().replace(/-/g, '').toUpperCase()}-1`
+	const token = `${crypto.randomUUID()}`
 	const now = Math.floor(Date.now() / 1000)
 	await db
 		.prepare(

apps/cdn/src/cdn.app.ts

@@ -102,7 +102,9 @@ const app = new Hono<App>()
 	.get('/sigs/:sigName', (c) => serveAsset(c, `sigs/${c.req.param('sigName')}`))
 
 	// Room build data by name. The client fetches this for a SubRoom's DataBlob to
-	// load the room. Streamed from R2 under `room/`.
+	// load the room. Streamed from R2 under `room/`. The name may contain slashes
-	.get('/room/:dataBlob', (c) => serveAsset(c, `room/${c.req.param('dataBlob')}`))
+	// (uploads are foldered by date, e.g. `2026-02-03/<uuid>`), so match the rest of
+	// the path.
+	.get('/room/:dataBlob{.+}', (c) => serveAsset(c, `room/${c.req.param('dataBlob')}`))
 
 export default app

apps/storage/src/storage.app.ts

@@ -14,7 +14,7 @@ import type { App } from './context'
 
 /**
  * The client's `UploadFileType` enum → the R2 subfolder uploads of that type are
- * stored under. `Unknown` (0) is intentionally absent: like the reference
+ * stored under. `Unknown` (0) is intentionally absent: like the referencecdn
  * server's `makeUploadName`, an unrecognized type has no destination and is
  * rejected rather than stored.
  *
@@ -65,7 +65,8 @@ const app = new Hono<App>()
 	// File upload. Auth-gated — any valid account token is allowed (no role check).
 	// Multipart form with `FileType` (the client's UploadFileType enum) and a binary
 	// part. Stores the file in the shared CDN R2 bucket under
-	// `<type-subfolder>/<random-name>` and returns the generated filename the client
+	// `<type-subfolder>/<upload-date>/<random-name>` and returns the generated name
+	// (the `<upload-date>/<random-name>` part the `cdn` worker serves back) the client
 	// references it by. Also accepts a name-only post (no binary) that just echoes
 	// back an explicit `name`/`filename`/`imagename`. Mirrors the reference `Upload`.
 	.post('/upload', async (c) => {
@@ -84,7 +85,11 @@ const app = new Hono<App>()
 				// makeUploadName == "" → no destination for an unknown/missing type.
 				return c.json({ error: 'missing or unknown FileType' }, 400)
 			}
-			const filename = crypto.randomUUID().replace(/-/g, '')
+			// Folder each upload under its date (e.g. `room/2026-02-03/<uuid>`) so the
+			// bucket stays browsable. The date is part of the returned name, so the key
+			// the `cdn` worker reads back (`<subfolder>/<name>`) still round-trips.
+			const datePrefix = new Date().toISOString().slice(0, 10)
+			const filename = `${datePrefix}/${crypto.randomUUID()}`
 			await c.env.CDN_ASSETS.put(`${subfolder}/${filename}`, await file.arrayBuffer(), {
 				httpMetadata: { contentType: file.type || 'application/octet-stream' },
 			})

apps/storage/src/test/integration/api.test.ts

@@ -73,7 +73,9 @@ it('POST /upload stores a RoomMetadata (FileType 6) file under roommetadata/ and
 	})
 	expect(res.status).toBe(200)
 	const { filename } = (await res.json()) as { filename: string }
-	expect(filename).toMatch(/^[0-9a-f]{32}$/)
+	expect(filename).toMatch(
+		/^\d{4}-\d{2}-\d{2}\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+	)
 
 	// The bytes are persisted in the shared CDN bucket under the type subfolder.
 	const stored = await env.CDN_ASSETS.get(`roommetadata/${filename}`)

packages/jwt/src/jwt.ts

@@ -95,11 +95,11 @@ export async function generateToken(
 			idp: 'local',
 			platform,
 			platform_id: platformId,
-			'rn.ver': '20210129',
+			'rn.ver': '20230302',
 			'rn.plat': '0',
 			role: TOKEN_ROLES,
 			scope: TOKEN_SCOPES,
-			jti: crypto.randomUUID().replace(/-/g, '').toUpperCase(),
+			jti: crypto.randomUUID(),
 		},
 		secret
 	)