[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","StonedSheamus","name","bot-detector","path","twitch.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":58,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/StonedSheamus/bot-detector/code/twitch.ts","extension","id","c92ee92a-14ce-4867-8925-5e290ffb8006","fileId","a3c58130-b09b-11f1-881e-1607ee4eb77e","parentId","branchId","eef5f215-8cd9-41ea-9861-8707575788d0","branchVersion",16,"latest",true,"createdAt",["D",1789434268736],"version",3,"fileType","script","content","// Twitch Helix API helpers for the bot-viewer detector.\n//\n// Env vars still needed (down from 6 to 4 now that broadcaster/token capture\n// happens automatically via OAuth):\n// TWITCH_CLIENT_ID - your app's Client ID — reuse GuildScribe's\n// TWITCH_CLIENT_SECRET - your app's Client Secret — reuse GuildScribe's\n// TWITCH_BOT_ID - your bot account's numeric user id — reuse GuildScribe's\n// EVENTSUB_SECRET - any random string, used to verify EventSub webhook signatures\n\nimport { getModToken, saveModToken } from \"./db.ts\";\n\nexport const env = (name: string) => {\n const value = Deno.env.get(name);\n if (!value) throw new Error(`Missing environment variable: ${name}`);\n return value;\n};\n\n// ── App access token (client_credentials) — used for Get Users lookups,\n// sending chat messages, and managing EventSub subscriptions. ──\n\nlet cachedAppToken: { token: string; expiresAt: number } | null = null;\n\nexport function invalidateAppToken() {\n cachedAppToken = null;\n}\n\nexport async function getAppToken(): Promise {\n if (cachedAppToken && Date.now() < cachedAppToken.expiresAt) {\n return cachedAppToken.token;\n }\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n grant_type: \"client_credentials\",\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`App token failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n const expiresInMs = Number(data.expires_in ?? 0) * 1000;\n cachedAppToken = {\n token: data.access_token as string,\n expiresAt: Date.now() + Math.max(0, expiresInMs - 60_000),\n };\n return cachedAppToken.token;\n}\n\n// ── Authorization-code OAuth (the broadcaster's own /connect flow) ──\n\nexport async function exchangeCode(code: string, redirectUri: string) {\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n code,\n grant_type: \"authorization_code\",\n redirect_uri: redirectUri,\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`OAuth exchange failed: ${res.status} ${await res.text()}`);\n }\n return await res.json();\n}\n\nexport async function refreshUserToken(refreshToken: string) {\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`Token refresh failed: ${res.status} ${await res.text()}`);\n }\n return await res.json();\n}\n\n/** A valid moderator:read:chatters token for this broadcaster, refreshing\n * (and persisting the refresh) if the stored one is expiring soon. Returns\n * null if this channel was never connected, or the refresh itself fails\n * (revoked) — either way the mod needs to (re)visit /connect. */\nexport async function getValidModToken(\n broadcasterId: string,\n): Promise {\n const row = await getModToken(broadcasterId);\n if (!row) return null;\n if (Date.now() < Number(row.expires_at) - 60_000) {\n return String(row.access_token);\n }\n try {\n const refreshed = await refreshUserToken(String(row.refresh_token));\n const expiresAt = Date.now() +\n Math.max(0, Number(refreshed.expires_in ?? 0) * 1000 - 60_000);\n const scope = Array.isArray(refreshed.scope)\n ? refreshed.scope.join(\" \")\n : String(row.scope ?? \"\");\n await saveModToken(\n broadcasterId,\n refreshed.access_token,\n refreshed.refresh_token ?? String(row.refresh_token),\n scope,\n expiresAt,\n );\n return String(refreshed.access_token);\n } catch (_e) {\n return null;\n }\n}\n\nexport interface TwitchUser {\n id: string;\n login: string;\n display_name: string;\n created_at: string;\n profile_image_url: string;\n}\n\n/** Get Users, batched 100 logins per request (Helix's max). */\nexport async function getUsersByLogin(logins: string[]): Promise {\n const token = await getAppToken();\n const out: TwitchUser[] = [];\n for (let i = 0; i < logins.length; i += 100) {\n const batch = logins.slice(i, i + 100);\n const params = new URLSearchParams();\n for (const l of batch) params.append(\"login\", l);\n const res = await fetch(`https://api.twitch.tv/helix/users?${params}`, {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${token}`,\n },\n });\n if (!res.ok) {\n throw new Error(`Get Users failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n out.push(...data.data);\n }\n return out;\n}\n\n/** The token owner's own Twitch identity — used right after OAuth exchange\n * to find out who just connected, and to resolve moderator_id for Get Chatters. */\nexport async function getSelf(accessToken: string): Promise {\n const res = await fetch(\"https://api.twitch.tv/helix/users\", {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${accessToken}`,\n },\n });\n if (!res.ok) {\n throw new Error(\n `Could not identify token owner: ${res.status} ${await res.text()}`,\n );\n }\n const data = await res.json();\n return data.data[0];\n}\n\nexport interface Chatter {\n user_id: string;\n user_login: string;\n user_name: string;\n}\n\n/** Get Chatters, using the broadcaster's own stored moderator:read:chatters\n * token (broadcasters are implicitly moderators of their own channel, so\n * moderator_id === broadcaster_id here). */\nexport async function getChatters(\n broadcasterId: string,\n modAccessToken: string,\n): Promise {\n const out: Chatter[] = [];\n let cursor: string | undefined;\n do {\n const params = new URLSearchParams({\n broadcaster_id: broadcasterId,\n moderator_id: broadcasterId,\n first: \"1000\",\n });\n if (cursor) params.set(\"after\", cursor);\n const res = await fetch(\n `https://api.twitch.tv/helix/chat/chatters?${params}`,\n {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${modAccessToken}`,\n },\n },\n );\n if (!res.ok) {\n throw new Error(`Get Chatters failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n out.push(...data.data);\n cursor = data.pagination?.cursor || undefined;\n } while (cursor);\n return out;\n}\n\n// ── Sending chat messages (app-token bot flow, same as GuildScribe) ──\n\nexport async function sendChatMessage(\n text: string,\n broadcasterId: string,\n): Promise {\n const message = text.slice(0, 500);\n if (!message.trim()) return true;\n try {\n const send = async (token: string) =>\n fetch(\"https://api.twitch.tv/helix/chat/messages\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n broadcaster_id: broadcasterId,\n sender_id: env(\"TWITCH_BOT_ID\"),\n message,\n }),\n });\n\n let res = await send(await getAppToken());\n if (res.status === 401) {\n invalidateAppToken();\n res = await send(await getAppToken());\n }\n if (!res.ok) {\n console.error(\n `Twitch chat send failed: ${res.status} ${await res.text()}`,\n );\n }\n return res.ok;\n } catch (err) {\n console.error(\"sendChatMessage failed\", err);\n return false;\n }\n}\n\n// ── EventSub subscription management ──\n\nasync function createEventSubSubscription(\n type: string,\n version: string,\n condition: Record,\n callbackUrl: string,\n) {\n const appToken = await getAppToken();\n const res = await fetch(\n \"https://api.twitch.tv/helix/eventsub/subscriptions\",\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${appToken}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n type,\n version,\n condition,\n transport: {\n method: \"webhook\",\n callback: callbackUrl,\n secret: env(\"EVENTSUB_SECRET\"),\n },\n }),\n },\n );\n const text = await res.text();\n if (!res.ok) {\n throw new Error(\n `EventSub subscription failed (${type}): ${res.status} ${text}`,\n );\n }\n return JSON.parse(text).data[0];\n}\n\nexport async function createChatSubscription(\n broadcasterId: string,\n callbackUrl: string,\n) {\n return createEventSubSubscription(\n \"channel.chat.message\",\n \"1\",\n { broadcaster_user_id: broadcasterId, user_id: env(\"TWITCH_BOT_ID\") },\n callbackUrl,\n );\n}\n\nexport async function deleteEventSubSubscription(subscriptionId: string) {\n if (!subscriptionId) return true;\n const appToken = await getAppToken();\n const res = await fetch(\n `https://api.twitch.tv/helix/eventsub/subscriptions?id=${\n encodeURIComponent(subscriptionId)\n }`,\n {\n method: \"DELETE\",\n headers: {\n Authorization: `Bearer ${appToken}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n },\n },\n );\n if (res.status === 404) return true;\n if (!res.ok) {\n throw new Error(\n `EventSub deletion failed: ${res.status} ${await res.text()}`,\n );\n }\n return true;\n}\n\n/** Constant-time string compare, so signature checking doesn't leak timing info. */\nexport function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return diff === 0;\n}\n\nexport async function verifyEventSub(\n req: Request,\n rawBody: string,\n): Promise {\n const id = req.headers.get(\"Twitch-Eventsub-Message-Id\") ?? \"\";\n const timestamp = req.headers.get(\"Twitch-Eventsub-Message-Timestamp\") ?? \"\";\n const received = req.headers.get(\"Twitch-Eventsub-Message-Signature\") ?? \"\";\n if (!id || !timestamp || !received) return false;\n const receivedAt = Date.parse(timestamp);\n if (\n !Number.isFinite(receivedAt) ||\n Math.abs(Date.now() - receivedAt) > 10 * 60 * 1000\n ) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(env(\"EVENTSUB_SECRET\")),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const signature = new Uint8Array(\n await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(id + timestamp + rawBody),\n ),\n );\n const hex = [...signature].map((b) => b.toString(16).padStart(2, \"0\")).join(\n \"\",\n );\n const expected = `sha256=${hex}`;\n return timingSafeEqual(expected, received);\n}","deleted",false,"label",[14],"d496d537-568b-465b-b4a8-4b4c42a8f49f",["D",1789431551373],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","cc37ba10-6e6d-4af6-a801-9955c92d23c4","pinnedFileId","13376976-b09b-11f1-9183-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04ba1-c79f-7319-b4f2-7c4f3772837b","tursoName","d496d537568b465bb4a84b4c42a8f49f","tursoHostname","d496d537568b465bb4a84b4c42a8f49f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789522252250],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":102},"org",{"_9":10,"_99":100,"_101":102,"_55":56,"_103":104,"_105":42},"branch",{"_35":89,"_11":90,"_22":28,"_91":45,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",20,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Shea Stolp","avatar","https://lh3.googleusercontent.com/a/ACg8ocIWmQgR3gyoMMicg2zCAoN1c7i36qX5mf9gRIdIXm8F2mo-ig=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_140":141,"_142":143,"_144":145,"_146":42,"_147":42,"_148":42,"_149":32,"_150":-5,"_151":-7,"_152":-7,"_153":63,"_154":42,"_155":42,"_156":-5,"_157":42,"_158":42,"_159":42,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":90,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]