[{"_1":2,"_188":-5,"_189":-5},"loaderData",{"_3":4,"_95":96},"root",{"_5":6,"_36":37,"_68":69},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isBusinessOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","e0a5dccc140d9e386346cd4232e1ac283f40c293","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","API_URL","https://api.val.town","clerkState",{"_70":71},"__internal_clerk_state",{"_72":73,"_74":47,"_75":76,"_77":76,"_78":20,"_79":76,"_80":76,"_81":76,"_82":76,"_83":84,"_93":20,"_94":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_85":20,"_19":20,"_86":76,"_87":88,"_89":76,"_90":47,"_91":20,"_92":76},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_97":98,"_99":100,"_101":102,"_103":104,"_165":166,"_185":186,"_187":-5},"handle","Mj67","name","Huddle","path","index.ts","project",{"_105":106,"_99":100,"_107":108,"_109":-5,"_110":20,"_111":112,"_113":114,"_115":-5,"_12":116,"_117":-5,"_118":20,"_119":-5,"_120":-5,"_121":33,"_14":122,"_123":124,"_125":126,"_127":128,"_129":-5,"_130":131,"_132":131,"_133":134,"_135":134,"_136":134,"_137":131,"_138":131,"_23":139,"_142":143,"_147":148,"_164":20},"id","9b2be866-30ad-11f1-91e2-42dde27851f2","createdAt",["D",1775365761543],"deletedAt","legacyEnvVars","privacy","public","description","Huddle - real time messaging app","imageUrl","019d5c0b-8b96-7535-8704-ff0267c1a546","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019d5c0b-8b96-7535-8705-029f61e9534e","tursoName","9b2be86630ad11f191e242dde27851f2","tursoHostname","9b2be86630ad11f191e242dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1775365857874],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_97":98,"_140":141},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNCdk5tUFV3TTgxbk1nVnExYTJ0TENBM3hYZyJ9","org",{"_97":98,"_144":141,"_12":116,"_145":146},"avatar","tier","free","branch",{"_149":150,"_99":45,"_105":151,"_152":106,"_153":154,"_155":156,"_157":112,"_158":159,"_160":161,"_162":100,"_163":98},"version",8,"9b32896e-30ad-11f1-91e2-42dde27851f2","projectId","forkedBranchId","db6cfe04-3078-11f1-85fe-42dde27851f2","forkedBranchVersion",9,"forkedProjectPrivacy","forkedProjectId","db67f8fa-3078-11f1-85fe-42dde27851f2","forkedProjectOrgId","019d5ab1-d927-744f-b2d0-ae1cced4ff1f","projectName","userHandle","isOwned","file",{"_105":167,"_99":102,"_168":169,"_170":-5,"_171":151,"_172":173,"_174":175,"_107":176,"_149":177,"_178":179,"_180":181,"_182":20,"_183":-5,"_101":184},"d2227544-30b0-11f1-afa4-42dde27851f2","fileId","019d5c0b-aa93-72e9-92b5-448900047e30","parentId","branchId","branchVersion",6,"latest",true,["D",1775367142292],3,"fileType","http","content","import { Hono } from \"npm:hono@4\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { serveFile, parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { runMigrations } from \"./database/migrations.ts\";\nimport {\n createUser, getUserByUsername, getUserByEmail, getUserById,\n createSession, getSession, deleteSession,\n createApiToken, getApiToken, deleteApiToken,\n createRoom, getRoomById, getRoomsForUser, getAllRooms, getRoomMembers,\n addRoomMember, removeRoomMember, isRoomMember, inviteToRoom,\n deleteRoom,\n createMessage, getMessages, editMessage, searchMessages, getMessageById, deleteMessage, clearRoom,\n addReaction, removeReaction, getReactionsForRoom,\n setTyping, clearTyping, getTyping,\n blockUser, unblockUser, getBlockedUsers,\n queueMention, getPublicUsers, getAllUsers,\n setGhostMode, banUser, unbanUser, muteUser, unmuteUser,\n updateUserAvatar, updateUserPassword, deleteUser,\n} from \"./database/queries.ts\";\nimport { hashPassword, verifyPassword, generateToken } from \"./shared/auth.ts\";\nimport { sendEmail, mentionEmailHtml, recoveryEmailHtml } from \"./shared/email.ts\";\nimport { ADMIN_USERNAME, ADMIN_PASSWORD, MAX_FILE_SIZE, MAX_AVATAR_SIZE, MISTRAL_API_KEY, CODESTRAL_API_KEY, GROQ_API_KEY, GROQ_ADMIN_MODEL } from \"./shared/types.ts\";\n\nawait runMigrations();\n\nconst adminExists = await getUserByUsername(ADMIN_USERNAME);\nif (!adminExists) {\n const hash = await hashPassword(ADMIN_PASSWORD);\n await createUser(ADMIN_USERNAME, \"admin@huddle.local\", hash, ADMIN_PASSWORD);\n}\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\nasync function getSessionUser(c: any) {\n const sid = getCookie(c, \"hid\");\n if (sid) {\n const session = await getSession(sid);\n if (session) {\n const user = await getUserById(Number(session.user_id));\n if (user) return await checkExpiry(user);\n }\n }\n const auth = c.req.header(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) {\n const token = auth.slice(7);\n const rec = await getApiToken(token);\n if (rec) {\n const user = await getUserById(Number(rec.user_id));\n if (user) return await checkExpiry(user);\n }\n }\n return null;\n}\n\nasync function checkExpiry(user: any) {\n if (user.is_banned && user.ban_expires_at && new Date(user.ban_expires_at as string) < new Date()) {\n await unbanUser(Number(user.id));\n user.is_banned = 0;\n }\n if (user.is_muted && user.mute_expires_at && new Date(user.mute_expires_at as string) < new Date()) {\n await unmuteUser(Number(user.id));\n user.is_muted = 0;\n }\n if (user.is_banned) {\n const isPerm = !user.ban_expires_at;\n const isActive = isPerm || new Date(user.ban_expires_at as string) > new Date();\n if (isActive) return null;\n }\n return user;\n}\n\nfunction isAdmin(user: any) {\n return user && user.username.toLowerCase() === ADMIN_USERNAME.toLowerCase();\n}\n\nfunction userPayload(user: any) {\n return {\n id: Number(user.id),\n username: user.username,\n email: user.email,\n isAdmin: isAdmin(user),\n ghost_mode: user.ghost_mode,\n avatar_blob_key: user.avatar_blob_key,\n };\n}\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,Authorization\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\napp.options(\"*\", (c) => new Response(null, { status: 204, headers: CORS_HEADERS }));\n\napp.use(\"*\", async (c, next) => {\n await next();\n for (const [k, v] of Object.entries(CORS_HEADERS)) {\n c.res.headers.set(k, v);\n }\n});\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\"/bookmarklet\", (c) => serveFile(\"/frontend/bookmarklet.html\", import.meta.url));\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.post(\"/api/signup\", async (c) => {\n const { username, email, password } = await c.req.json();\n if (!username || !email || !password) return c.json({ error: \"All fields required\" }, 400);\n if (password.length < 6) return c.json({ error: \"Password must be at least 6 characters\" }, 400);\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) return c.json({ error: \"Invalid email address\" }, 400);\n if (!/^[a-zA-Z0-9_]{3,20}$/.test(username)) return c.json({ error: \"Username: 3–20 chars, letters/numbers/_ only\" }, 400);\n const existingUser = await getUserByUsername(username);\n if (existingUser) return c.json({ error: \"Username already taken\" }, 409);\n const existingEmail = await getUserByEmail(email);\n if (existingEmail) return c.json({ error: \"Email already registered\" }, 409);\n const hash = await hashPassword(password);\n const userId = await createUser(username, email, hash, password);\n const sid = generateToken();\n await createSession(sid, Number(userId));\n const apiToken = generateToken();\n await createApiToken(apiToken, Number(userId));\n setCookie(c, \"hid\", sid, { httpOnly: true, sameSite: \"Lax\", maxAge: 60 * 60 * 24 * 30 });\n return c.json({ ok: true, apiToken, user: { id: Number(userId), username, email, isAdmin: isAdmin({ username }) } });\n});\n\napp.post(\"/api/login\", async (c) => {\n const { username, password } = await c.req.json();\n if (!username || !password) return c.json({ error: \"Username and password required\" }, 400);\n const user = await getUserByUsername(username);\n if (!user) return c.json({ error: \"Invalid credentials\" }, 401);\n if (user.is_banned) {\n const isPerm = !user.ban_expires_at;\n const isActive = isPerm || new Date(user.ban_expires_at as string) > new Date();\n if (isActive) {\n const msg = user.ban_message ? `\\n\\n${user.ban_message}` : \"\";\n const exp = isPerm ? \" permanently\" : ` until ${new Date(user.ban_expires_at as string).toLocaleString()}`;\n return c.json({ error: `Your account has been banned${exp}.${msg}` }, 403);\n }\n }\n const ok = await verifyPassword(password as string, user.password_hash as string);\n if (!ok) return c.json({ error: \"Invalid credentials\" }, 401);\n const sid = generateToken();\n await createSession(sid, Number(user.id));\n const apiToken = generateToken();\n await createApiToken(apiToken, Number(user.id));\n setCookie(c, \"hid\", sid, { httpOnly: true, sameSite: \"Lax\", maxAge: 60 * 60 * 24 * 30 });\n return c.json({ ok: true, apiToken, user: userPayload(user) });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const sid = getCookie(c, \"hid\");\n if (sid) await deleteSession(sid);\n const auth = c.req.header(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) await deleteApiToken(auth.slice(7));\n deleteCookie(c, \"hid\");\n return c.json({ ok: true });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n return c.json({ user: userPayload(user) });\n});\n\napp.post(\"/api/recover\", async (c) => {\n const { identifier } = await c.req.json();\n if (!identifier) return c.json({ error: \"Email or username required\" }, 400);\n const user = identifier.includes(\"@\") ? await getUserByEmail(identifier) : await getUserByUsername(identifier);\n if (!user) return c.json({ ok: true });\n const plain = user.password_plain as string | null;\n if (!plain) {\n await sendEmail(user.email as string, \"Huddle – Password Recovery\", recoveryEmailHtml(\"[Password recovery not available — please contact admin]\"));\n } else {\n await sendEmail(user.email as string, \"Huddle – Password Recovery\", recoveryEmailHtml(plain));\n }\n return c.json({ ok: true });\n});\n\napp.get(\"/api/users\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (isAdmin(user)) {\n const users = await getAllUsers();\n return c.json({ users });\n }\n const users = await getPublicUsers();\n return c.json({ users });\n});\n\napp.delete(\"/api/users/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const targetId = Number(c.req.param(\"id\"));\n if (Number(user.id) !== targetId && !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const target = await getUserById(targetId);\n if (!target) return c.json({ error: \"User not found\" }, 404);\n if (isAdmin({ username: target.username })) return c.json({ error: \"Cannot delete admin account\" }, 403);\n try {\n await deleteUser(targetId);\n } catch (e: any) {\n console.error(\"deleteUser failed:\", e);\n return c.json({ error: e?.message ?? \"Failed to delete user\" }, 500);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/ghost\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { ghost } = await c.req.json();\n await setGhostMode(Number(user.id), ghost);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/ban\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const targetId = Number(c.req.param(\"id\"));\n const target = await getUserById(targetId);\n if (target && isAdmin({ username: target.username })) return c.json({ error: \"Cannot ban admin account\" }, 403);\n const { duration, message } = await c.req.json();\n const expiresAt = duration ? new Date(Date.now() + duration * 3600000).toISOString() : null;\n await banUser(targetId, expiresAt, message ?? null);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unban\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await unbanUser(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/mute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const targetId = Number(c.req.param(\"id\"));\n const target = await getUserById(targetId);\n if (target && isAdmin({ username: target.username })) return c.json({ error: \"Cannot mute admin account\" }, 403);\n const { duration } = await c.req.json();\n const expiresAt = new Date(Date.now() + (duration || 30) * 60000).toISOString();\n await muteUser(targetId, expiresAt);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unmute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await unmuteUser(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/users/blocked\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const blocked = await getBlockedUsers(Number(user.id));\n return c.json({ blocked });\n});\n\napp.post(\"/api/users/:id/block\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const blockTargetId = Number(c.req.param(\"id\"));\n const blockTarget = await getUserById(blockTargetId);\n if (blockTarget && isAdmin({ username: blockTarget.username })) return c.json({ error: \"Cannot block admin\" }, 403);\n await blockUser(Number(user.id), blockTargetId);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unblock\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n await unblockUser(Number(user.id), Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/avatar\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const formData = await c.req.formData();\n const file = formData.get(\"avatar\") as File | null;\n if (!file) return c.json({ error: \"No file\" }, 400);\n if (file.size > MAX_AVATAR_SIZE) return c.json({ error: \"Avatar max size is 100 KB\" }, 400);\n const key = `huddle_avatar_${user.id}_${Date.now()}`;\n const buf = await file.arrayBuffer();\n await blob.set(key, buf);\n await updateUserAvatar(Number(user.id), key);\n return c.json({ ok: true, key });\n});\n\napp.get(\"/api/blob/:key\", async (c) => {\n const key = c.req.param(\"key\");\n const isAvatar = key.startsWith(\"huddle_avatar_\");\n if (!isAvatar) {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n }\n let buf: ArrayBuffer;\n try {\n const resp = await blob.get(key);\n buf = await resp.arrayBuffer();\n } catch {\n return c.json({ error: \"File not found or has expired\" }, 404);\n }\n const lk = key.toLowerCase();\n const mimeMap: Record = {\n \".jpg\": \"image/jpeg\", \".jpeg\": \"image/jpeg\", \".png\": \"image/png\",\n \".gif\": \"image/gif\", \".webp\": \"image/webp\", \".svg\": \"image/svg+xml\",\n \".pdf\": \"application/pdf\", \".txt\": \"text/plain; charset=utf-8\",\n \".md\": \"text/plain; charset=utf-8\", \".csv\": \"text/csv; charset=utf-8\",\n \".mp4\": \"video/mp4\", \".mp3\": \"audio/mpeg\", \".wav\": \"audio/wav\",\n \".zip\": \"application/zip\", \".json\": \"application/json\",\n \".html\": \"text/html; charset=utf-8\", \".htm\": \"text/html; charset=utf-8\",\n \".js\": \"text/javascript\", \".ts\": \"text/plain; charset=utf-8\", \".css\": \"text/css\",\n \".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n \".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n };\n let ct = \"application/octet-stream\";\n for (const [ext, mime] of Object.entries(mimeMap)) {\n if (lk.endsWith(ext)) { ct = mime; break; }\n }\n if (ct === \"application/octet-stream\") {\n const bytes = new Uint8Array(buf).subarray(0, 4);\n if (bytes[0] === 0xFF && bytes[1] === 0xD8) ct = \"image/jpeg\";\n else if (bytes[0] === 0x89 && bytes[1] === 0x50) ct = \"image/png\";\n else if (bytes[0] === 0x47 && bytes[1] === 0x49) ct = \"image/gif\";\n else if (bytes[0] === 0x52 && bytes[1] === 0x49) ct = \"image/webp\";\n }\n return new Response(buf, {\n headers: {\n \"Content-Type\": ct,\n \"Cache-Control\": isAvatar ? \"public, max-age=86400\" : \"private, max-age=3600\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n});\n\napp.get(\"/api/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const rooms = isAdmin(user) ? await getAllRooms() : await getRoomsForUser(Number(user.id));\n return c.json({ rooms });\n});\n\napp.post(\"/api/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { name } = await c.req.json();\n if (!name?.trim()) return c.json({ error: \"Room name required\" }, 400);\n const roomId = await createRoom(name.trim(), Number(user.id));\n return c.json({ ok: true, roomId });\n});\n\napp.delete(\"/api/rooms/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type === \"world\") return c.json({ error: \"Cannot delete World Chat\" }, 403);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) return c.json({ error: \"Only the creator can delete this room\" }, 403);\n await deleteRoom(roomId);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/members\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const members = await getRoomMembers(roomId);\n return c.json({ members });\n});\n\napp.post(\"/api/rooms/:id/invite\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { username } = await c.req.json();\n if (!username) return c.json({ error: \"Username required\" }, 400);\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n const members = await getRoomMembers(roomId);\n const caller = members.find((m: any) => Number(m.id) === Number(user.id));\n if (!caller || caller.role !== \"owner\") return c.json({ error: \"Only the room owner can invite\" }, 403);\n }\n const target = await getUserByUsername(username);\n if (!target) return c.json({ error: \"User not found\" }, 404);\n await inviteToRoom(roomId, Number(target.id), Number(user.id));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/kick\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { userId } = await c.req.json();\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n const members = await getRoomMembers(roomId);\n const caller = members.find((m: any) => Number(m.id) === Number(user.id));\n if (!caller || caller.role !== \"owner\") return c.json({ error: \"Forbidden\" }, 403);\n }\n const kickTarget = await getUserById(Number(userId));\n if (kickTarget && isAdmin({ username: kickTarget.username })) return c.json({ error: \"Cannot kick admin\" }, 403);\n await removeRoomMember(roomId, Number(userId));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/leave\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n await removeRoomMember(roomId, Number(user.id));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const since = c.req.query(\"since\") ? Number(c.req.query(\"since\")) : undefined;\n const msgs = await getMessages(roomId, since);\n const blocked = await getBlockedUsers(Number(user.id));\n const filtered = isAdmin(user) ? msgs : msgs.filter((m: any) => !blocked.includes(Number(m.user_id)));\n let reactions: any[] = [];\n if (!since) reactions = await getReactionsForRoom(roomId);\n return c.json({ messages: filtered, reactions });\n});\n\napp.get(\"/api/rooms/:id/poll\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const since = Number(c.req.query(\"since\") ?? 0);\n const blocked = await getBlockedUsers(Number(user.id));\n const deadline = Date.now() + 25000;\n while (Date.now() < deadline) {\n const msgs = await getMessages(roomId, since);\n const typing = await getTyping(roomId);\n const typingOthers = typing.filter((u: string) => u !== (user.username as string));\n if (msgs.length > 0) {\n const filtered = isAdmin(user) ? msgs : msgs.filter((m: any) => !blocked.includes(Number(m.user_id)));\n return c.json({ messages: filtered, typing: typingOthers });\n }\n if (typingOthers.length > 0) {\n return c.json({ messages: [], typing: typingOthers });\n }\n await new Promise((r) => setTimeout(r, 1000));\n }\n return c.json({ messages: [], typing: [] });\n});\n\napp.post(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (user.is_muted && user.mute_expires_at && new Date(user.mute_expires_at as string) > new Date()) {\n return c.json({ error: \"You are currently muted\" }, 403);\n }\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const { content, reply_to_id } = await c.req.json();\n if (!content?.trim()) return c.json({ error: \"Message cannot be empty\" }, 400);\n if (content.length > 2000) return c.json({ error: \"Message too long (max 2000 chars)\" }, 400);\n const msgId = await createMessage(roomId, Number(user.id), content.trim(), undefined, undefined, undefined, reply_to_id ? Number(reply_to_id) : undefined);\n const mentionRegex = /@([a-zA-Z0-9_]+)/g;\n let match;\n while ((match = mentionRegex.exec(content)) !== null) {\n const mentioned = await getUserByUsername(match[1]);\n if (mentioned && Number(mentioned.id) !== Number(user.id)) {\n await queueMention(Number(mentioned.id), user.username as string, room.name as string);\n }\n }\n const createdMsg = await getMessageById(Number(msgId));\n return c.json({ ok: true, message: createdMsg ? { ...createdMsg, id: Number((createdMsg as any).id) } : null });\n});\n\napp.post(\"/api/rooms/:id/upload\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (user.is_muted && user.mute_expires_at && new Date(user.mute_expires_at as string) > new Date()) {\n return c.json({ error: \"You are currently muted\" }, 403);\n }\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const formData = await c.req.formData();\n const file = formData.get(\"file\") as File | null;\n if (!file) return c.json({ error: \"No file\" }, 400);\n if (file.size > MAX_FILE_SIZE) return c.json({ error: \"File max size is 200 KB\" }, 400);\n const key = `huddle_file_${roomId}_${user.id}_${Date.now()}_${file.name}`;\n const buf = await file.arrayBuffer();\n await blob.set(key, buf);\n await createMessage(roomId, Number(user.id), null, key, file.name, file.size);\n return c.json({ ok: true });\n});\n\napp.patch(\"/api/messages/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { content } = await c.req.json();\n if (!content?.trim()) return c.json({ error: \"Content required\" }, 400);\n if (content.length > 2000) return c.json({ error: \"Message too long\" }, 400);\n const msg = await getMessageById(msgId);\n if (!msg) return c.json({ error: \"Not found\" }, 404);\n if (Number(msg.user_id) !== Number(user.id) && !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n if (!isAdmin(user)) {\n const createdAt = new Date(msg.created_at as string).getTime();\n if (Date.now() - createdAt > 5 * 60 * 1000) return c.json({ error: \"Edit window expired (5 min)\" }, 403);\n }\n await editMessage(msgId, Number(user.id), content.trim());\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/messages/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const msg = await getMessageById(msgId);\n if (!msg) return c.json({ error: \"Not found\" }, 404);\n if (Number(msg.user_id) !== Number(user.id) && !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await deleteMessage(msgId);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n await clearRoom(roomId);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/search\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const q = c.req.query(\"q\") ?? \"\";\n if (q.trim().length < 2) return c.json({ messages: [] });\n const msgs = await searchMessages(roomId, q.trim());\n return c.json({ messages: msgs });\n});\n\napp.post(\"/api/messages/:id/react\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { emoji } = await c.req.json();\n if (!emoji) return c.json({ error: \"Emoji required\" }, 400);\n const ALLOWED = [\"👍\",\"❤️\",\"😂\",\"😮\",\"😢\",\"🔥\",\"👀\",\"🎉\",\"💯\",\"🤔\"];\n if (!ALLOWED.includes(emoji)) return c.json({ error: \"Emoji not allowed\" }, 400);\n await addReaction(msgId, Number(user.id), emoji);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/messages/:id/react\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { emoji } = await c.req.json();\n await removeReaction(msgId, Number(user.id), emoji);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/typing\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { typing } = await c.req.json();\n if (typing) {\n await setTyping(roomId, Number(user.id), user.username as string);\n } else {\n await clearTyping(roomId, Number(user.id));\n }\n return c.json({ ok: true });\n});\n\napp.get(\"/api/link-preview\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const url = c.req.query(\"url\");\n if (!url) return c.json({ error: \"URL required\" }, 400);\n try {\n const resp = await fetch(url, {\n headers: { \"User-Agent\": \"Mozilla/5.0 (compatible; Huddle/1.0)\" },\n signal: AbortSignal.timeout(5000),\n });\n if (!resp.ok) return c.json({ error: \"Failed to fetch\" }, 502);\n const html = await resp.text();\n const getTag = (prop: string) => {\n const m = html.match(new RegExp(`]+(?:property|name)=[\"']${prop}[\"'][^>]+content=[\"']([^\"']+)[\"']`, \"i\"))\n || html.match(new RegExp(`]+content=[\"']([^\"']+)[\"'][^>]+(?:property|name)=[\"']${prop}[\"']`, \"i\"));\n return m?.[1] ?? null;\n };\n const titleMatch = html.match(/]*>([^<]+)<\\/title>/i);\n const title = getTag(\"og:title\") || getTag(\"twitter:title\") || titleMatch?.[1]?.trim() || null;\n const description = getTag(\"og:description\") || getTag(\"twitter:description\") || getTag(\"description\") || null;\n const image = getTag(\"og:image\") || getTag(\"twitter:image\") || null;\n const siteName = getTag(\"og:site_name\") || null;\n return c.json({ title, description, image, siteName, url });\n } catch {\n return c.json({ error: \"Could not fetch URL\" }, 502);\n }\n});\n\n// ─── AI Admin — shared helpers ────────────────────────────────────────────────\n\nasync function buildAdminContext(): Promise<{ context: string; userMap: Record }> {\n const allUsers = await getAllUsers();\n const allRooms = await getAllRooms();\n const userMap: Record = {};\n const nonModUsers = (allUsers as any[]).filter((u: any) => u.username.toLowerCase() !== ADMIN_USERNAME.toLowerCase());\n for (const u of nonModUsers) userMap[u.username.toLowerCase()] = Number(u.id);\n const lines: string[] = [];\n lines.push(`=== USERS (${nonModUsers.length}) ===`);\n for (const u of nonModUsers) {\n const banned = u.is_banned ? ` [BANNED${u.ban_expires_at ? \" until \" + u.ban_expires_at : \" PERM\"}]` : \"\";\n const muted = u.is_muted ? ` [MUTED until ${u.mute_expires_at}]` : \"\";\n lines.push(`@${u.username} (id:${u.id})${banned}${muted}`);\n }\n lines.push(`\\n=== ROOMS (${allRooms.length}) ===`);\n for (const room of allRooms as any[]) {\n lines.push(`[room:${room.id}] ${room.name} (${room.type})`);\n try {\n const msgs = await getMessages(Number(room.id), undefined);\n const all = (msgs as any[]).filter(\n (m: any) => !m.is_deleted && m.username?.toLowerCase() !== ADMIN_USERNAME.toLowerCase()\n );\n let charBudget = 5000;\n const recent: any[] = [];\n for (let i = all.length - 1; i >= 0 && charBudget > 0; i--) {\n const text = all[i].content || \"[file]\";\n charBudget -= text.length;\n recent.unshift(all[i]);\n }\n for (const m of recent) {\n lines.push(` [msg:${m.id}] @${m.username}: ${m.content || \"[file]\"}`);\n }\n } catch {}\n }\n return { context: lines.join(\"\\n\").slice(0, 80000), userMap };\n}\n\nasync function execAdminCommand(lastMsg: string): Promise {\n const deleteMsgMatch = lastMsg.match(/^delete\\s+msg(?:s?|essages?)?\\s+([\\d,\\s]+)/i);\n if (deleteMsgMatch) {\n const ids = deleteMsgMatch[1].split(\",\").map((s: string) => Number(s.trim())).filter((n: number) => n > 0);\n const results: string[] = [];\n for (const msgId of ids) {\n const msg = await getMessageById(msgId);\n if (!msg) { results.push(`Failed: message not found.`); continue; }\n await deleteMessage(msgId);\n results.push(`Done: message removed.`);\n }\n return results.join(\"\\n\");\n }\n const clearRoomMatch = lastMsg.match(/^clear\\s+room\\s+([\\d,\\s]+)/i);\n if (clearRoomMatch) {\n const ids = clearRoomMatch[1].split(\",\").map((s: string) => Number(s.trim())).filter((n: number) => n > 0);\n const results: string[] = [];\n for (const roomId of ids) {\n const room = await getRoomById(roomId);\n if (!room) { results.push(`Failed: room not found.`); continue; }\n await clearRoom(roomId);\n results.push(`Done: cleared all messages in ${(room as any).name}.`);\n }\n return results.join(\"\\n\");\n }\n const actionMatch = lastMsg.match(/^(ban|mute|unban|unmute)\\s+([@\\w,\\s]+?)(?:\\s+(\\d+))?$/i);\n if (actionMatch) {\n const cmd = actionMatch[1].toLowerCase();\n const duration = actionMatch[3] ? Number(actionMatch[3]) : null;\n const usernames = actionMatch[2].split(\",\").map((s: string) => s.trim().replace(/^@/, \"\")).filter(Boolean);\n const results: string[] = [];\n for (const targetUsername of usernames) {\n const target = await getUserByUsername(targetUsername);\n if (!target) { results.push(`Failed: @${targetUsername} not found.`); continue; }\n if (isAdmin({ username: target.username })) { results.push(`Failed: cannot moderate admin.`); continue; }\n if (cmd === \"ban\") {\n const expiresAt = duration ? new Date(Date.now() + duration * 3600000).toISOString() : null;\n await banUser(Number(target.id), expiresAt, null);\n results.push(duration ? `Done: banned @${targetUsername} for ${duration}h.` : `Done: permanently banned @${targetUsername}.`);\n } else if (cmd === \"unban\") {\n await unbanUser(Number(target.id));\n results.push(`Done: unbanned @${targetUsername}.`);\n } else if (cmd === \"mute\") {\n const mins = duration ?? 30;\n await muteUser(Number(target.id), new Date(Date.now() + mins * 60000).toISOString());\n results.push(`Done: muted @${targetUsername} for ${mins}m.`);\n } else if (cmd === \"unmute\") {\n await unmuteUser(Number(target.id));\n results.push(`Done: unmuted @${targetUsername}.`);\n }\n }\n return results.join(\"\\n\");\n }\n return null;\n}\n\n// Shared SSE stream helper\nfunction makeSSEStream(text: string, corsHeaders: Record) {\n const enc = new TextEncoder();\n const readable = new ReadableStream({\n start(controller) {\n controller.enqueue(enc.encode(`data: ${JSON.stringify({ t: text })}\\n\\n`));\n controller.enqueue(enc.encode(\"data: [DONE]\\n\\n\"));\n controller.close();\n },\n });\n return new Response(readable, {\n headers: { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", ...corsHeaders },\n });\n}\n\n// ─── TRIAGE endpoint ──────────────────────────────────────────────────────────\napp.post(\"/api/ai/triage\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n\n const { context } = await buildAdminContext();\n\n const TRIAGE_PROMPT = `You are a moderation triage engine. Scan the messages below and output ONLY flagged items.\n\nCATEGORIES:\n- CRITICAL: threats, doxxing, malware links, account attacks, coordinated abuse, illegal content\n- VIOLATION: harassment, hate speech, repeated offensive content, spam, safety issues\n- Normal chat: output NOTHING — do not list, reference, or mention it in any form\n\nABSOLUTE RULES (breaking any rule = wrong output):\n1. Silent on normal messages. Zero mention of them.\n2. No emojis anywhere.\n3. No message IDs or numbers in output (no \"msg 3\", no \"#42\", nothing).\n4. No restating your output. Write it once.\n5. No preamble, no \"however\", no \"note\", no conclusions, no meta-commentary.\n6. Quotes max 10 words.\n7. Reason: 2-4 words.\n8. Action line: one executable command only.\n\nOUTPUT FORMAT (flagged items only):\n\n--- CRITICAL ---\n@username | \"quote\" | reason\nAction: ban @username\n\n--- VIOLATION ---\n@username | \"quote\" | reason\nAction: mute @username 60\n\nIf nothing is flagged: All clear.\n\n=== DATA ===\n${context}\n=== END ===`;\n\n const resp = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Authorization\": `Bearer ${GROQ_API_KEY}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n model: GROQ_ADMIN_MODEL,\n messages: [{ role: \"system\", content: TRIAGE_PROMPT }, { role: \"user\", content: \"Run triage.\" }],\n max_tokens: 800,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"Triage AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const enc = new TextEncoder();\n const readable = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") { controller.enqueue(enc.encode(\"data: [DONE]\\n\\n\")); continue; }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) controller.enqueue(enc.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`));\n } catch {}\n }\n }\n } catch (e) { console.error(\"Triage stream error:\", e); }\n finally { controller.close(); }\n },\n });\n\n return new Response(readable, {\n headers: { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", \"Connection\": \"keep-alive\", ...CORS_HEADERS },\n });\n});\n\n// ─── Admin execute ────────────────────────────────────────────────────────────\napp.post(\"/api/ai/execute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const { command } = await c.req.json();\n if (!command?.trim()) return c.json({ error: \"Command required\" }, 400);\n const result = await execAdminCommand(command.trim());\n if (result === null) return c.json({ error: \"Unrecognised command\" }, 400);\n return c.json({ ok: true, result });\n});\n\n// ─── Admin chat ───────────────────────────────────────────────────────────────\napp.post(\"/api/ai/admin-chat\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n\n const { messages } = await c.req.json();\n if (!messages?.length) return c.json({ error: \"Messages required\" }, 400);\n\n const lastMsg: string = messages[messages.length - 1]?.content ?? \"\";\n\n // Direct command execution\n const directResult = await execAdminCommand(lastMsg);\n if (directResult !== null) return makeSSEStream(directResult, CORS_HEADERS);\n\n // \"yes\" / \"confirm\" → execute last suggested Action\n const confirmPhrases = /^(yes|confirm|do it|execute|apply|go ahead|yep|ok|okay)[\\s!.]*$/i;\n if (confirmPhrases.test(lastMsg.trim())) {\n for (let i = messages.length - 2; i >= 0; i--) {\n const msg = messages[i];\n if (msg.role !== \"assistant\") continue;\n const actionLines = [...(msg.content?.matchAll(/Action:\\s*(.+)/gi) ?? [])];\n if (actionLines.length > 0) {\n const results: string[] = [];\n for (const al of actionLines) {\n const cmds = al[1].split(\"|\").map((s: string) => s.trim());\n for (const cmd of cmds) {\n const r = await execAdminCommand(cmd);\n if (r) results.push(r);\n }\n }\n if (results.length > 0) return makeSSEStream(results.join(\"\\n\"), CORS_HEADERS);\n }\n }\n return makeSSEStream(\"No pending action found. Provide a specific command.\", CORS_HEADERS);\n }\n\n const { context } = await buildAdminContext();\n\n const CHAT_PROMPT = `You are the Huddle Admin AI — moderation assistant for @${ADMIN_USERNAME}.\n\nRULES:\n1. No storytelling. No summaries of normal chat. Output only what matters.\n2. No emojis anywhere.\n3. No message IDs in output.\n4. No restating. Never write the same content twice.\n5. When scanning: show CRITICAL and VIOLATION only. Silent on normal messages.\n6. Format for flagged items:\n\n--- CRITICAL ---\n@username | \"quote\" | reason\nAction: ban @username\n\n--- VIOLATION ---\n@username | \"quote\" | reason\nAction: mute @username 60\n\n7. If nothing flagged: reply exactly \"All clear.\"\n8. Admin can say \"yes\" or \"confirm\" to execute the last Action you suggested — always include Action lines for any recommendation.\n9. Supported commands: ban @user [hours] | unban @user | mute @user [mins] | unmute @user | delete msg | clear room \n10. @${ADMIN_USERNAME} is the admin — never flag them.\n11. Max 250 words per response unless asked for more detail.\n\n=== LIVE DATA ===\n${context}\n=== END ===`;\n\n const resp = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Authorization\": `Bearer ${GROQ_API_KEY}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n model: GROQ_ADMIN_MODEL,\n messages: [{ role: \"system\", content: CHAT_PROMPT }, ...messages],\n max_tokens: 900,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"Admin AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const enc2 = new TextEncoder();\n const readable2 = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") { controller.enqueue(enc2.encode(\"data: [DONE]\\n\\n\")); continue; }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) controller.enqueue(enc2.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`));\n } catch {}\n }\n }\n } catch (e) { console.error(\"Admin AI stream error:\", e); }\n finally { controller.close(); }\n },\n });\n\n return new Response(readable2, {\n headers: { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", \"Connection\": \"keep-alive\", ...CORS_HEADERS },\n });\n});\n\n// ─── AI Chat (Mistral / Codestral) ───────────────────────────────────────────\napp.post(\"/api/ai/chat\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { messages, model } = await c.req.json();\n if (!messages?.length) return c.json({ error: \"Messages required\" }, 400);\n\n const isCodestral = model === \"codestral-latest\";\n const apiKey = isCodestral ? CODESTRAL_API_KEY : MISTRAL_API_KEY;\n const apiUrl = isCodestral\n ? \"https://codestral.mistral.ai/v1/chat/completions\"\n : \"https://api.mistral.ai/v1/chat/completions\";\n const selectedModel = isCodestral ? \"codestral-latest\" : \"mistral-large-latest\";\n const systemPrompt = isCodestral\n ? `You are Codestral, an AI coding assistant built into Huddle. Help with debugging, code generation, code review, and technical questions. Be precise and include code examples.`\n : `You are Mist, a helpful AI assistant built into Huddle — a real-time messaging app. Be concise, friendly, and helpful. Help users with Huddle features and general questions.`;\n\n const resp = await fetch(apiUrl, {\n method: \"POST\",\n headers: { \"Authorization\": `Bearer ${apiKey}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n model: selectedModel,\n messages: [{ role: \"system\", content: systemPrompt }, ...messages],\n max_tokens: 1024,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const encoder = new TextEncoder();\n const readable = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") { controller.enqueue(encoder.encode(\"data: [DONE]\\n\\n\")); continue; }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) controller.enqueue(encoder.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`));\n } catch {}\n }\n }\n } catch (e) { console.error(\"Stream error:\", e); }\n finally { controller.close(); }\n },\n });\n\n return new Response(readable, {\n headers: { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", \"Connection\": \"keep-alive\", ...CORS_HEADERS },\n });\n});\n\nexport default app.fetch;\n","deleted","label",[102],"permalink","https://www.val.town/x/Mj67/Huddle/code/index.ts","extension","actionData","errors"]