[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","StonedSheamus","name","dnd-twitch-bot","path","dashboard.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":-5,"_58":42,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/StonedSheamus/dnd-twitch-bot/code/dashboard.ts","extension","id","c6800307-f06e-41f0-846e-ebecf7e373d9","fileId","0a7ee40a-af04-11f1-8d42-1607ee4eb77e","parentId","branchId","05246ac8-a272-4b74-b48a-34d91555f75d","branchVersion",510,"latest",true,"createdAt",["D",1789335872718],"version",1,"fileType","script","content","// !dashboard — gives a mod/broadcaster the link to this channel's web\n// dashboard (GET /dashboard, rendered by renderDashboardPage in pages.ts,\n// routed in main.ts), where they can manage custom commands, chat triggers,\n// and timed messages with plain HTML forms instead of chat syntax.\n//\n// Two layers of access control, not just one:\n// 1. dashboard_key (see db.ts) — a per-channel capability token embedded\n// in the link, only ever handed out via this mod-gated chat command.\n// 2. A live Twitch login (GET /dashboard/login → /dashboard/callback)\n// that checks — at the moment the page is opened — whether the logged\n// -in Twitch account is actually a moderator/broadcaster of *this*\n// channel, via Get Moderated Channels (scope user:read:moderated_channels).\n// A signed, channel-scoped, short-lived session cookie remembers that\n// check so it isn't repeated on every click.\n// The key alone stops a random stranger from finding the page; the login\n// on top of it means even a screenshotted/leaked link is useless to anyone\n// who isn't currently a mod of that channel on Twitch.\n//\n// !dashboard (mod) get this channel's dashboard link\n// !dashboard reset (mod) invalidate the old link and issue a new one\n\nimport { sendChatMessage, exchangeCode, getViewerIdentity, isUserModeratorOfChannel, timingSafeEqual, env } from \"./twitch.ts\";\nimport {\n getOrCreateDashboardKey,\n regenerateDashboardKey,\n verifyDashboardKey,\n getBroadcaster,\n listCustomCommandsFull,\n listCustomTriggers,\n listTimedMessages,\n addCustomCommand,\n editCustomCommand,\n deleteCustomCommand,\n setCustomCommandCooldown,\n addCustomTrigger,\n editCustomTrigger,\n deleteCustomTrigger,\n setCustomTriggerCooldown,\n addTimedMessage,\n editTimedMessage,\n setTimedMessageInterval,\n setTimedMessageEnabled,\n deleteTimedMessage,\n saveDashboardOAuthState,\n consumeDashboardOAuthState,\n isChannelEnabled,\n setChannelEnabled,\n isMerchantEnabled,\n setMerchantEnabled,\n getCommandGroupToggles,\n setCommandGroupEnabled,\n} from \"./db.ts\";\nimport { isChronicleEnabled, setChronicleEnabled, isNpcEnabled, setNpcEnabled, isNpcChatterEnabled, setNpcChatterEnabled } from \"./social_db.ts\";\nimport { randomMerchantIntervalMs } from \"./merchant.ts\";\nimport { COMMAND_GROUPS } from \"./utils.ts\";\nimport {\n sanitizeCommandName,\n sanitizeTriggerKeyword,\n RESERVED_NAMES,\n MAX_CUSTOM_RESPONSE_LEN,\n MAX_COOLDOWN_SECONDS,\n parseCooldownSeconds,\n} from \"./customcommands.ts\";\nimport { parseIntervalMinutes, sanitizeTimedMessageText, MIN_INTERVAL_MINUTES, MAX_INTERVAL_MINUTES } from \"./timedmessages.ts\";\nimport { renderDashboardPage, renderDashboardLoginGate, type DashboardData } from \"./pages.ts\";\n\nexport async function handleDashboardCommand(\n chatMessage: string,\n display: string,\n broadcasterId: string,\n isModerator: boolean,\n baseUrl: string,\n): Promise {\n const match = chatMessage.trim().match(/^!dashboard(?:\\s+(reset))?$/i);\n if (!match) return false;\n\n if (!isModerator) {\n await sendChatMessage(`@${display} only the broadcaster or a moderator can access the dashboard.`, broadcasterId);\n return true;\n }\n\n const reset = !!match[1];\n const key = reset ? await regenerateDashboardKey(broadcasterId) : await getOrCreateDashboardKey(broadcasterId);\n const link = `${baseUrl}/dashboard?channel=${broadcasterId}&key=${key}`;\n await sendChatMessage(\n `@${display} ${reset ? \"New dashboard link (the old one no longer works): \" : \"Dashboard: \"}${link} — you'll be asked to log in with Twitch to confirm you're a mod. Keep this link private regardless.`,\n broadcasterId,\n );\n return true;\n}\n\n// ── Session cookie (proves \"logged in and verified as a mod of this\n// channel\", separate from and in addition to the dashboard_key) ──\n\nconst SESSION_TTL_MS = 12 * 60 * 60 * 1000; // 12 hours\nconst OAUTH_STATE_TTL_MS = 10 * 60 * 1000;\n\nfunction sessionCookieName(channelId: string): string {\n return `gs_dash_${channelId}`;\n}\n\nfunction base64urlEncode(input: string): string {\n return btoa(input).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction base64urlDecode(input: string): string {\n const padded = input.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"===\".slice((input.length + 3) % 4);\n return atob(padded);\n}\n\n// Derived (not the raw secret) so this cookie's signing key is distinct\n// from whatever else EVENTSUB_SECRET is used for, in case they're ever\n// reused across a future feature.\nasync function getSessionHmacKey(): Promise {\n const material = new TextEncoder().encode(`${env(\"EVENTSUB_SECRET\")}:dashboard-session-v1`);\n const digest = await crypto.subtle.digest(\"SHA-256\", material);\n return crypto.subtle.importKey(\"raw\", digest, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n}\n\nasync function hmacHex(payload: string): Promise {\n const key = await getSessionHmacKey();\n const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(payload)));\n return [...signature].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function signDashboardSession(channelId: string, viewerId: string, expiresAt: number): Promise {\n const payload = `${channelId}:${viewerId}:${expiresAt}`;\n const sig = await hmacHex(payload);\n return `${base64urlEncode(payload)}.${sig}`;\n}\n\n/** Returns the verified viewer id if the cookie is a validly-signed,\n * unexpired session for this exact channel — null otherwise. */\nasync function verifyDashboardSession(token: string, channelId: string): Promise {\n const dot = token.lastIndexOf(\".\");\n if (dot < 0) return null;\n const payloadB64 = token.slice(0, dot);\n const sig = token.slice(dot + 1);\n let payload: string;\n try {\n payload = base64urlDecode(payloadB64);\n } catch {\n return null;\n }\n const expectedSig = await hmacHex(payload);\n if (!timingSafeEqual(sig, expectedSig)) return null;\n const parts = payload.split(\":\");\n if (parts.length !== 3) return null;\n const [chId, viewerId, expiresAtStr] = parts;\n if (chId !== channelId) return null;\n const expiresAt = Number(expiresAtStr);\n if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) return null;\n return viewerId;\n}\n\nfunction getCookie(cookieHeader: string | null, name: string): string | null {\n if (!cookieHeader) return null;\n for (const part of cookieHeader.split(\";\")) {\n const eq = part.indexOf(\"=\");\n if (eq < 0) continue;\n if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();\n }\n return null;\n}\n\nfunction sessionSetCookieHeader(channelId: string, token: string): string {\n const maxAgeSeconds = Math.floor(SESSION_TTL_MS / 1000);\n return `${sessionCookieName(channelId)}=${token}; Path=/dashboard; Max-Age=${maxAgeSeconds}; HttpOnly; Secure; SameSite=Lax`;\n}\n\n// ── GET /dashboard ──\n\nfunction redirectTo(location: string, extraHeaders?: Record): Response {\n return new Response(null, { status: 302, headers: { Location: location, \"Cache-Control\": \"no-store\", ...extraHeaders } });\n}\n\nfunction dashboardUrl(baseUrl: string, channelId: string, key: string, extra?: Record): string {\n const params = new URLSearchParams({ channel: channelId, key, ...extra });\n return `${baseUrl}/dashboard?${params.toString()}`;\n}\n\nfunction loginUrl(baseUrl: string, channelId: string, key: string): string {\n const params = new URLSearchParams({ channel: channelId, key });\n return `${baseUrl}/dashboard/login?${params.toString()}`;\n}\n\n/**\n * Renders the dashboard for GET /dashboard?channel=&key=. Checks the\n * dashboard_key first (400/401 on failure, same as before), then checks for\n * a valid mod session cookie — if that's missing or expired, shows a\n * \"log in with Twitch\" gate instead of the management UI.\n */\nexport async function renderDashboard(\n channelId: string | null,\n key: string | null,\n cookieHeader: string | null,\n baseUrl: string,\n opts?: { notice?: string; error?: string },\n): Promise {\n if (!channelId || !/^\\d+$/.test(channelId) || !key) {\n return new Response(\"Missing channel or key. Get your link in chat with !dashboard.\", { status: 400 });\n }\n if (!(await verifyDashboardKey(channelId, key))) {\n return new Response(\"Unauthorized. Get a valid link in chat with !dashboard.\", { status: 401, headers: { \"Cache-Control\": \"no-store\" } });\n }\n\n const cookie = getCookie(cookieHeader, sessionCookieName(channelId));\n const viewerId = cookie ? await verifyDashboardSession(cookie, channelId) : null;\n const broadcaster = await getBroadcaster(channelId);\n const broadcasterName = String(broadcaster?.display_name || broadcaster?.login || channelId);\n\n if (!viewerId) {\n return new Response(\n renderDashboardLoginGate({ broadcasterName, loginUrl: loginUrl(baseUrl, channelId, key), error: opts?.error }),\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\", \"Cache-Control\": \"no-store\" } },\n );\n }\n\n const [commands, triggers, timedMessages, botEnabled, marketEnabled, chronicleEnabled, npcEnabled, npcChatterEnabled, groupToggles] = await Promise.all([\n listCustomCommandsFull(channelId),\n listCustomTriggers(channelId),\n listTimedMessages(channelId),\n isChannelEnabled(channelId),\n isMerchantEnabled(channelId),\n isChronicleEnabled(channelId),\n isNpcEnabled(channelId),\n isNpcChatterEnabled(channelId),\n getCommandGroupToggles(channelId),\n ]);\n const data: DashboardData = {\n broadcasterId: channelId,\n broadcasterName,\n channelKey: key,\n commands,\n triggers,\n timedMessages,\n minIntervalMinutes: MIN_INTERVAL_MINUTES,\n maxIntervalMinutes: MAX_INTERVAL_MINUTES,\n maxCooldownSeconds: MAX_COOLDOWN_SECONDS,\n notice: opts?.notice,\n error: opts?.error,\n botEnabled,\n marketEnabled,\n chronicleEnabled,\n npcEnabled,\n npcChatterEnabled,\n groupToggles,\n };\n return new Response(renderDashboardPage(data), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\", \"Cache-Control\": \"no-store\" },\n });\n}\n\n// ── GET /dashboard/login, GET /dashboard/callback ──\n\nexport async function handleDashboardLogin(channelId: string | null, key: string | null, baseUrl: string): Promise {\n if (!channelId || !/^\\d+$/.test(channelId) || !key) {\n return new Response(\"Missing channel or key. Get your link in chat with !dashboard.\", { status: 400 });\n }\n if (!(await verifyDashboardKey(channelId, key))) {\n return new Response(\"Unauthorized. Get a valid link in chat with !dashboard.\", { status: 401, headers: { \"Cache-Control\": \"no-store\" } });\n }\n const state = crypto.randomUUID();\n await saveDashboardOAuthState(state, channelId, key, Date.now() + OAUTH_STATE_TTL_MS);\n const auth = new URL(\"https://id.twitch.tv/oauth2/authorize\");\n auth.search = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n redirect_uri: `${baseUrl}/dashboard/callback`,\n response_type: \"code\",\n scope: \"user:read:moderated_channels\",\n state,\n }).toString();\n return redirectTo(auth.toString());\n}\n\nexport async function handleDashboardCallback(\n code: string | null,\n state: string | null,\n oauthError: string | null,\n baseUrl: string,\n): Promise {\n if (!state) return new Response(\"Missing OAuth state.\", { status: 400 });\n const stateRow = await consumeDashboardOAuthState(state);\n if (!stateRow) return new Response(\"Invalid or expired login attempt. Get a fresh link in chat with !dashboard.\", { status: 400 });\n const channelId = String(stateRow.channel_id);\n const key = String(stateRow.dashboard_key);\n\n // The key may have been reset (e.g. !dashboard reset) while this login\n // was in flight — re-check rather than trusting the state row blindly.\n if (!(await verifyDashboardKey(channelId, key))) {\n return new Response(\"This dashboard link is no longer valid. Get a fresh one in chat with !dashboard.\", { status: 401 });\n }\n\n if (oauthError) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Twitch login was cancelled.\" }));\n }\n if (!code) return new Response(\"Missing OAuth code.\", { status: 400 });\n\n try {\n const token = await exchangeCode(code, `${baseUrl}/dashboard/callback`);\n const viewer = await getViewerIdentity(token.access_token);\n if (!viewer) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Couldn't verify your Twitch account — try logging in again.\" }));\n }\n const isBroadcaster = viewer.id === channelId;\n const isMod = isBroadcaster || (await isUserModeratorOfChannel(token.access_token, viewer.id, channelId));\n if (!isMod) {\n return redirectTo(\n dashboardUrl(baseUrl, channelId, key, { error: `${viewer.display_name} isn't a moderator of this channel on Twitch.` }),\n );\n }\n const sessionToken = await signDashboardSession(channelId, viewer.id, Date.now() + SESSION_TTL_MS);\n return redirectTo(dashboardUrl(baseUrl, channelId, key), { \"Set-Cookie\": sessionSetCookieHeader(channelId, sessionToken) });\n } catch (e) {\n console.error(\"dashboard oauth callback failed\", e);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Twitch login failed — try again.\" }));\n }\n}\n\n// ── POST /dashboard/commands, /dashboard/triggers, /dashboard/timedmessages ──\n//\n// Each takes the already-parsed form body, the request's own origin (for\n// building redirects), and the raw Cookie header, verifies the embedded\n// channel+key *and* the mod session cookie exactly like the GET route,\n// applies one mutation, then redirects back to the dashboard with a flash\n// notice/error — a plain POST/redirect/GET flow that needs no client-side JS.\n\nasync function authFromForm(form: FormData, baseUrl: string, cookieHeader: string | null): Promise<{ channelId: string; key: string } | Response> {\n const channelId = String(form.get(\"channel\") ?? \"\");\n const key = String(form.get(\"key\") ?? \"\");\n if (!channelId || !/^\\d+$/.test(channelId) || !key) {\n return new Response(\"Missing channel or key.\", { status: 400 });\n }\n if (!(await verifyDashboardKey(channelId, key))) {\n return new Response(\"Unauthorized.\", { status: 401, headers: { \"Cache-Control\": \"no-store\" } });\n }\n const cookie = getCookie(cookieHeader, sessionCookieName(channelId));\n const viewerId = cookie ? await verifyDashboardSession(cookie, channelId) : null;\n if (!viewerId) {\n // Session missing/expired — bounce back through Twitch login rather\n // than just failing, since the form's key is otherwise still valid.\n return redirectTo(loginUrl(baseUrl, channelId, key));\n }\n return { channelId, key };\n}\n\nexport async function handleDashboardCommandsForm(form: FormData, baseUrl: string, cookieHeader: string | null): Promise {\n const auth = await authFromForm(form, baseUrl, cookieHeader);\n if (auth instanceof Response) return auth;\n const { channelId, key } = auth;\n const intent = String(form.get(\"intent\") ?? \"\");\n const name = sanitizeCommandName(String(form.get(\"name\") ?? \"\"));\n const cooldownSeconds = parseCooldownSeconds(String(form.get(\"cooldown_seconds\") ?? \"\"));\n\n if (!name) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Command names must be 2-25 characters: letters, numbers, - or _.\" }));\n }\n\n if (intent === \"add\") {\n if (RESERVED_NAMES.has(name)) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: `!${name} is a built-in command and can't be added.` }));\n }\n const response = String(form.get(\"response\") ?? \"\").slice(0, MAX_CUSTOM_RESPONSE_LEN).trim();\n if (!response) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Give the command a response.\" }));\n const result = await addCustomCommand(channelId, name, response, \"dashboard\");\n if (!result.ok) {\n const msg = result.error === \"exists\"\n ? `!${name} already exists.`\n : `This channel's custom command limit (${result.max}) is reached.`;\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: msg }));\n }\n if (cooldownSeconds !== null) await setCustomCommandCooldown(channelId, name, cooldownSeconds * 1000);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Added !${name}.` }));\n }\n\n if (intent === \"save\") {\n const response = String(form.get(\"response\") ?? \"\").slice(0, MAX_CUSTOM_RESPONSE_LEN).trim();\n if (!response) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Give the command a response.\" }));\n const updated = await editCustomCommand(channelId, name, response);\n if (!updated) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: `!${name} doesn't exist.` }));\n if (cooldownSeconds !== null) await setCustomCommandCooldown(channelId, name, cooldownSeconds * 1000);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Updated !${name}.` }));\n }\n\n if (intent === \"delete\") {\n const removed = await deleteCustomCommand(channelId, name);\n return redirectTo(\n dashboardUrl(baseUrl, channelId, key, removed ? { notice: `Removed !${name}.` } : { error: `!${name} doesn't exist.` }),\n );\n }\n\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Unknown action.\" }));\n}\n\nexport async function handleDashboardTriggersForm(form: FormData, baseUrl: string, cookieHeader: string | null): Promise {\n const auth = await authFromForm(form, baseUrl, cookieHeader);\n if (auth instanceof Response) return auth;\n const { channelId, key } = auth;\n const intent = String(form.get(\"intent\") ?? \"\");\n const keyword = sanitizeTriggerKeyword(String(form.get(\"keyword\") ?? \"\"));\n const cooldownSeconds = parseCooldownSeconds(String(form.get(\"cooldown_seconds\") ?? \"\"));\n\n if (!keyword) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Keywords must be 2-40 characters, up to 5 words.\" }));\n }\n\n if (intent === \"add\") {\n const response = String(form.get(\"response\") ?? \"\").slice(0, MAX_CUSTOM_RESPONSE_LEN).trim();\n if (!response) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Give the trigger a response.\" }));\n const result = await addCustomTrigger(channelId, keyword, response, \"dashboard\");\n if (!result.ok) {\n const msg = result.error === \"exists\"\n ? `A trigger for \"${keyword}\" already exists.`\n : `This channel's trigger limit (${result.max}) is reached.`;\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: msg }));\n }\n if (cooldownSeconds !== null) await setCustomTriggerCooldown(channelId, keyword, cooldownSeconds * 1000);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Added trigger \"${keyword}\".` }));\n }\n\n if (intent === \"save\") {\n const response = String(form.get(\"response\") ?? \"\").slice(0, MAX_CUSTOM_RESPONSE_LEN).trim();\n if (!response) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Give the trigger a response.\" }));\n const updated = await editCustomTrigger(channelId, keyword, response);\n if (!updated) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: `No trigger found for \"${keyword}\".` }));\n if (cooldownSeconds !== null) await setCustomTriggerCooldown(channelId, keyword, cooldownSeconds * 1000);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Updated trigger \"${keyword}\".` }));\n }\n\n if (intent === \"delete\") {\n const removed = await deleteCustomTrigger(channelId, keyword);\n return redirectTo(\n dashboardUrl(baseUrl, channelId, key, removed ? { notice: `Removed trigger \"${keyword}\".` } : { error: `No trigger found for \"${keyword}\".` }),\n );\n }\n\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Unknown action.\" }));\n}\n\nexport async function handleDashboardTimedMessagesForm(form: FormData, baseUrl: string, cookieHeader: string | null): Promise {\n const auth = await authFromForm(form, baseUrl, cookieHeader);\n if (auth instanceof Response) return auth;\n const { channelId, key } = auth;\n const intent = String(form.get(\"intent\") ?? \"\");\n\n if (intent === \"add\") {\n const minutes = parseIntervalMinutes(String(form.get(\"interval_minutes\") ?? \"\"));\n const message = sanitizeTimedMessageText(form.get(\"message\"));\n if (minutes === null) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: `Interval must be ${MIN_INTERVAL_MINUTES}-${MAX_INTERVAL_MINUTES} minutes.` }));\n }\n if (!message) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Give the timed message some text.\" }));\n const result = await addTimedMessage(channelId, message, minutes, \"dashboard\");\n if (!result.ok) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: `This channel's timed message limit (${result.max}) is reached.` }));\n }\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Added timed message #${result.id}.` }));\n }\n\n const id = Number.parseInt(String(form.get(\"id\") ?? \"\"), 10);\n if (!Number.isFinite(id)) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Missing timed message id.\" }));\n\n if (intent === \"save\") {\n const minutes = parseIntervalMinutes(String(form.get(\"interval_minutes\") ?? \"\"));\n const message = sanitizeTimedMessageText(form.get(\"message\"));\n const enabled = String(form.get(\"enabled\") ?? \"\") === \"on\";\n if (minutes === null) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: `Interval must be ${MIN_INTERVAL_MINUTES}-${MAX_INTERVAL_MINUTES} minutes.` }));\n }\n if (!message) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Give the timed message some text.\" }));\n const updated = await editTimedMessage(channelId, id, message);\n if (!updated) return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: `No timed message #${id} in this channel.` }));\n await setTimedMessageInterval(channelId, id, minutes);\n await setTimedMessageEnabled(channelId, id, enabled);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Updated timed message #${id}.` }));\n }\n\n if (intent === \"delete\") {\n const removed = await deleteTimedMessage(channelId, id);\n return redirectTo(\n dashboardUrl(baseUrl, channelId, key, removed ? { notice: `Removed timed message #${id}.` } : { error: `No timed message #${id} in this channel.` }),\n );\n }\n\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Unknown action.\" }));\n}\n\nexport async function handleDashboardFeaturesForm(form: FormData, baseUrl: string, cookieHeader: string | null): Promise {\n const auth = await authFromForm(form, baseUrl, cookieHeader);\n if (auth instanceof Response) return auth;\n const { channelId, key } = auth;\n const intent = String(form.get(\"intent\") ?? \"\");\n\n switch (intent) {\n case \"bot_on\":\n case \"bot_off\": {\n const enabled = intent === \"bot_on\";\n await setChannelEnabled(channelId, enabled);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Bot turned ${enabled ? \"on\" : \"off\"}.` }));\n }\n case \"market_on\":\n case \"market_off\": {\n const enabled = intent === \"market_on\";\n await setMerchantEnabled(channelId, enabled, enabled ? Date.now() + randomMerchantIntervalMs() : null);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Merchant turned ${enabled ? \"on\" : \"off\"}.` }));\n }\n case \"chronicle_on\":\n case \"chronicle_off\": {\n const enabled = intent === \"chronicle_on\";\n await setChronicleEnabled(channelId, enabled);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `Chronicle turned ${enabled ? \"on\" : \"off\"}.` }));\n }\n case \"npc_on\":\n case \"npc_off\": {\n const enabled = intent === \"npc_on\";\n await setNpcEnabled(channelId, enabled);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `AI NPCs turned ${enabled ? \"on\" : \"off\"}.` }));\n }\n case \"npcchatter_on\":\n case \"npcchatter_off\": {\n const enabled = intent === \"npcchatter_on\";\n await setNpcChatterEnabled(channelId, enabled);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `AI NPC chatter turned ${enabled ? \"on\" : \"off\"}.` }));\n }\n case \"group_on\":\n case \"group_off\": {\n const group = String(form.get(\"group\") ?? \"\");\n if (!(group in COMMAND_GROUPS)) {\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Unknown feature group.\" }));\n }\n const enabled = intent === \"group_on\";\n await setCommandGroupEnabled(channelId, group, enabled);\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { notice: `${COMMAND_GROUPS[group].label.split(\" (\")[0]} turned ${enabled ? \"on\" : \"off\"}.` }));\n }\n default:\n return redirectTo(dashboardUrl(baseUrl, channelId, key, { error: \"Unknown action.\" }));\n }\n}\n","deleted",false,"label",[14],"20e82baa-ad9c-41ac-a8e5-4d2d285f6a79",["D",1787995257440],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","cc37ba10-6e6d-4af6-a801-9955c92d23c4","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04ba1-c79f-7319-b4f2-7c4f3772837b","tursoName","20e82baaad9c41aca8e54d2d285f6a79","tursoHostname","20e82baaad9c41aca8e54d2d285f6a79-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789500119686],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",523,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Shea Stolp","avatar","https://lh3.googleusercontent.com/a/ACg8ocIWmQgR3gyoMMicg2zCAoN1c7i36qX5mf9gRIdIXm8F2mo-ig=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":62,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]