[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","StonedSheamus","name","dnd-twitch-bot","path","twitch.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":-5,"_58":42,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/StonedSheamus/dnd-twitch-bot/code/twitch.ts","extension","id","04804c7c-774d-4551-b214-489082ab7791","fileId","9c5a8652-a4d9-11f1-b87e-1607ee4eb77e","parentId","branchId","05246ac8-a272-4b74-b48a-34d91555f75d","branchVersion",512,"latest",true,"createdAt",["D",1789339214432],"version",30,"fileType","script","content","// Twitch API helpers (tokens, chat, EventSub)\n\nimport { MAX_LOOKUP_MESSAGE_LENGTH } from \"./data.ts\";\nimport { splitChatMessage } from \"./utils.ts\";\n\nexport const env = (name: string) => {\n const value = Deno.env.get(name);\n if (!value) throw new Error(`Missing environment variable: ${name}`);\n return value;\n};\n\nconst CHAT_MAX = Math.min(MAX_LOOKUP_MESSAGE_LENGTH, 480);\n// Rules need more parts than other lookups; spells use sendSpellSections separately.\nconst MAX_PARTS = 5;\nconst PART_DELAY_MS = 450;\n// Twitch chat-send limits apply per channel, not bot-account-wide. With the\n// bot modded in its channels, the applicable limit is 100 messages/30s\n// (~300ms/message); default sits a little above that floor for safety.\n// Each channel gets its own queue slot so a busy channel's duels/lookups\n// never throttle chat sends in a different channel.\nconst GLOBAL_CHAT_MIN_INTERVAL_MS = Math.max(50, Number(Deno.env.get(\"CHAT_GLOBAL_MIN_INTERVAL_MS\") ?? \"320\"));\nconst nextChatSendAtByChannel = new Map();\n\nasync function waitForChatSlot(broadcasterId: string) {\n const now = Date.now();\n const nextAt = nextChatSendAtByChannel.get(broadcasterId) ?? 0;\n const wait = Math.max(0, nextAt - now);\n nextChatSendAtByChannel.set(broadcasterId, Math.max(now, nextAt) + GLOBAL_CHAT_MIN_INTERVAL_MS);\n if (wait) await sleep(wait);\n}\n\nfunction sleep(ms: number) {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/** Cap + truncate parts so multi-message lookups always finish. */\nfunction prepareParts(text: string, maxLen = CHAT_MAX, maxParts = MAX_PARTS): string[] {\n let parts = splitChatMessage(text, maxLen).map((p) => p.slice(0, maxLen));\n if (parts.length > maxParts) {\n parts = parts.slice(0, maxParts);\n const last = parts[parts.length - 1];\n parts[parts.length - 1] = last.slice(0, Math.max(0, maxLen - 12)).trimEnd() + \" …(cut)\";\n }\n return parts.filter((p) => p.length > 0);\n}\n\n/** Keep URL on the first chat part so it is never dropped. */\nfunction preferLinkInFirstPart(parts: string[]): string[] {\n if (parts.length <= 1) return parts;\n const linkMatch = parts.join(\" \").match(/https?:\\/\\/[^\\s|]+/);\n if (!linkMatch) return parts;\n const link = linkMatch[0];\n if (parts[0].includes(link)) return parts;\n const prefix = `🔗 ${link} | `;\n let first = prefix + parts[0].replace(/🔗\\s*https?:\\/\\/[^\\s|]+\\s*\\|\\s*/g, \"\");\n if (first.length > CHAT_MAX) first = first.slice(0, CHAT_MAX - 1) + \"…\";\n const rest = parts\n .slice(1)\n .map((p) => p.replace(link, \"\").replace(/\\s*\\|\\s*$/g, \"\").trim())\n .filter(Boolean);\n return [first, ...rest];\n}\n\nexport async function sendChatMessage(text: string, broadcasterId: string) {\n const message = text.slice(0, 500);\n if (!message.trim()) return true;\n try {\n await waitForChatSlot(broadcasterId);\n const send = async (token: string) =>\n fetch(\"https://api.twitch.tv/helix/chat/messages\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n broadcaster_id: broadcasterId,\n sender_id: env(\"TWITCH_BOT_ID\"),\n message,\n }),\n });\n\n let res = await send(await getAppToken());\n if (res.status === 401) {\n // Cached token was rejected (expired/revoked) — drop it and get a fresh one, once.\n invalidateAppToken();\n await waitForChatSlot(broadcasterId);\n res = await send(await getAppToken());\n }\n if (!res.ok && res.status !== 429) {\n console.error(`Twitch chat send failed: ${res.status}`);\n }\n // Brief backoff on rate limit so following parts can still send\n if (res.status === 429) {\n await sleep(1100);\n return false;\n }\n return res.ok;\n } catch (err) {\n console.error(\"sendChatMessage failed\", err);\n return false;\n }\n}\n\nexport async function sendChatMessages(\n text: string,\n broadcasterId: string,\n opts?: { maxParts?: number },\n) {\n const maxParts = opts?.maxParts ?? MAX_PARTS;\n let parts = prepareParts(text, CHAT_MAX, maxParts);\n parts = preferLinkInFirstPart(parts);\n for (let i = 0; i < parts.length; i++) {\n const ok = await sendChatMessage(parts[i], broadcasterId);\n if (!ok && i < parts.length - 1) {\n await sleep(700);\n await sendChatMessage(parts[i], broadcasterId);\n }\n if (i < parts.length - 1) await sleep(PART_DELAY_MS);\n }\n}\n\nexport async function sendSpellSections(sections: string[], display: string, broadcasterId: string) {\n // Flatten sections into a limited stream of chat parts (avoid dropping mid-spell)\n const combined: string[] = [];\n for (const section of sections) {\n combined.push(...prepareParts(`@${display} ${section}`, CHAT_MAX, 3));\n }\n const parts = combined.slice(0, MAX_PARTS);\n if (combined.length > MAX_PARTS && parts.length) {\n parts[parts.length - 1] =\n parts[parts.length - 1].slice(0, Math.max(0, CHAT_MAX - 12)).trimEnd() + \" …(cut)\";\n }\n for (let i = 0; i < parts.length; i++) {\n await sendChatMessage(parts[i], broadcasterId);\n if (i < parts.length - 1) await sleep(PART_DELAY_MS);\n }\n}\n\n// App access tokens (client_credentials) are valid for ~hours, not one request —\n// cache and reuse instead of re-fetching one from Twitch on every chat send.\nlet cachedAppToken: { token: string; expiresAt: number } | null = null;\n\nexport function invalidateAppToken() {\n cachedAppToken = null;\n}\n\nexport async function getAppToken() {\n if (cachedAppToken && Date.now() < cachedAppToken.expiresAt) {\n return cachedAppToken.token;\n }\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n grant_type: \"client_credentials\",\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) throw new Error(`App token failed: ${res.status} ${await res.text()}`);\n const data = await res.json();\n const expiresInMs = Number(data.expires_in ?? 0) * 1000;\n // Refresh a minute early so we never send a request with a token that\n // expires mid-flight.\n cachedAppToken = {\n token: data.access_token as string,\n expiresAt: Date.now() + Math.max(0, expiresInMs - 60_000),\n };\n return cachedAppToken.token;\n}\n\n// Live channel info for custom command/trigger placeholders ({game},\n// {title}, {status}, {uptime}). Uses the existing cached app token — no new\n// OAuth scope needed since these are public Helix endpoints.\nexport async function getChannelInfo(broadcasterId: string): Promise<{ gameName: string; title: string } | null> {\n try {\n const token = await getAppToken();\n const res = await fetch(`https://api.twitch.tv/helix/channels?broadcaster_id=${broadcasterId}`, {\n headers: { Authorization: `Bearer ${token}`, \"Client-Id\": env(\"TWITCH_CLIENT_ID\") },\n });\n if (!res.ok) return null;\n const data = await res.json();\n const row = data?.data?.[0];\n if (!row) return null;\n return { gameName: String(row.game_name ?? \"\"), title: String(row.title ?? \"\") };\n } catch (err) {\n console.error(\"getChannelInfo failed\", err);\n return null;\n }\n}\n\n/** Returns a formatted uptime string (\"1h 12m\"/\"12m\"), or null if offline. */\nexport async function getStreamUptime(broadcasterId: string): Promise {\n try {\n const token = await getAppToken();\n const res = await fetch(`https://api.twitch.tv/helix/streams?user_id=${broadcasterId}`, {\n headers: { Authorization: `Bearer ${token}`, \"Client-Id\": env(\"TWITCH_CLIENT_ID\") },\n });\n if (!res.ok) return null;\n const data = await res.json();\n const startedAt = data?.data?.[0]?.started_at;\n if (!startedAt) return null; // offline\n const totalMinutes = Math.max(0, Math.floor((Date.now() - new Date(startedAt).getTime()) / 60_000));\n const hours = Math.floor(totalMinutes / 60);\n const minutes = totalMinutes % 60;\n return hours > 0 ? `${hours}h ${minutes}m` : `${minutes}m`;\n } catch (err) {\n console.error(\"getStreamUptime failed\", err);\n return null;\n }\n}\n\nexport async function exchangeCode(code: string, redirectUri: string) {\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n code,\n grant_type: \"authorization_code\",\n redirect_uri: redirectUri,\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) throw new Error(`OAuth exchange failed: ${res.status} ${await res.text()}`);\n return await res.json();\n}\n\nexport async function refreshUserToken(refreshToken: string) {\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) throw new Error(`Token refresh failed: ${res.status} ${await res.text()}`);\n return await res.json();\n}\n\nexport interface AdSchedule {\n snoozeCount: number;\n snoozeRefreshAt: string;\n nextAdAt: string;\n lastAdAt: string;\n durationSeconds: number;\n prerollFreeTime: number;\n}\n\n/** Twitch's real ad schedule for a channel (Get Ad Schedule) — requires the\n * broadcaster's own user access token with the channel:read:ads scope\n * (requested during /connect, stored in broadcaster_ad_tokens). Returns\n * null if Twitch has nothing to report (e.g. stream offline / not yet\n * monetized) or the token was rejected (expired/revoked) — callers should\n * treat a rejected token as \"needs reconnect\", not a hard failure. */\nexport async function fetchAdSchedule(userAccessToken: string, broadcasterId: string): Promise {\n const res = await fetch(\n `https://api.twitch.tv/helix/channels/ads?broadcaster_id=${encodeURIComponent(broadcasterId)}`,\n {\n headers: {\n Authorization: `Bearer ${userAccessToken}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n },\n },\n );\n if (res.status === 401 || res.status === 403) return null;\n if (!res.ok) throw new Error(`Ad schedule fetch failed: ${res.status} ${await res.text()}`);\n const row = (await res.json()).data?.[0];\n if (!row) return null;\n return {\n snoozeCount: Number(row.snooze_count ?? 0),\n snoozeRefreshAt: String(row.snooze_refresh_at ?? \"\"),\n nextAdAt: String(row.next_ad_at ?? \"\"),\n lastAdAt: String(row.last_ad_at ?? \"\"),\n durationSeconds: Number(row.duration ?? 0),\n prerollFreeTime: Number(row.preroll_free_time ?? 0),\n };\n}\n\nasync function createEventSubSubscription(\n type: string,\n version: string,\n condition: Record,\n callbackUrl: string,\n) {\n const appToken = await getAppToken();\n const res = await fetch(\"https://api.twitch.tv/helix/eventsub/subscriptions\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${appToken}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n type,\n version,\n condition,\n transport: {\n method: \"webhook\",\n callback: callbackUrl,\n secret: env(\"EVENTSUB_SECRET\"),\n },\n }),\n });\n const text = await res.text();\n if (!res.ok) throw new Error(`EventSub subscription failed (${type}): ${res.status} ${text}`);\n return JSON.parse(text).data[0];\n}\n\nexport async function createChatSubscription(broadcasterId: string, callbackUrl: string) {\n return createEventSubSubscription(\n \"channel.chat.message\",\n \"1\",\n { broadcaster_user_id: broadcasterId, user_id: env(\"TWITCH_BOT_ID\") },\n callbackUrl,\n );\n}\n\n// New subscriptions (channel.subscribe) and renewals shared with a message\n// in chat (channel.subscription.message) — used to power the D&D-themed\n// !hug-style auto thank-you. Both require the broadcaster to have granted\n// the \"channel:read:subscriptions\" scope during OAuth; older connections\n// made before that scope was requested will need to reconnect for these to\n// take effect. Best-effort: callers should not fail the whole connect flow\n// if these throw (e.g. scope not yet granted).\nexport async function createSubEventSubscriptions(broadcasterId: string, callbackUrl: string) {\n const [newSub, resub, gift] = await Promise.all([\n createEventSubSubscription(\"channel.subscribe\", \"1\", { broadcaster_user_id: broadcasterId }, callbackUrl),\n createEventSubSubscription(\"channel.subscription.message\", \"1\", { broadcaster_user_id: broadcasterId }, callbackUrl),\n createEventSubSubscription(\"channel.subscription.gift\", \"1\", { broadcaster_user_id: broadcasterId }, callbackUrl),\n ]);\n return { newSub, resub, gift };\n}\n\n// Incoming raids — powers the automatic D&D-themed raid thank-you. Unlike\n// the subscribe/resub/gift events above, channel.raid with a\n// to_broadcaster_user_id condition needs no extra OAuth scope (it's public\n// EventSub data), so this should reliably succeed for every connected\n// channel. Still created as its own best-effort call in main.ts so a hiccup\n// here never blocks the core chat connection.\nexport async function createRaidEventSubscription(broadcasterId: string, callbackUrl: string) {\n return createEventSubSubscription(\n \"channel.raid\",\n \"1\",\n { to_broadcaster_user_id: broadcasterId },\n callbackUrl,\n );\n}\n\nexport async function deleteEventSubSubscription(subscriptionId: string) {\n if (!subscriptionId) return true;\n const appToken = await getAppToken();\n const res = await fetch(`https://api.twitch.tv/helix/eventsub/subscriptions?id=${encodeURIComponent(subscriptionId)}`, {\n method: \"DELETE\",\n headers: { Authorization: `Bearer ${appToken}`, \"Client-Id\": env(\"TWITCH_CLIENT_ID\") },\n });\n if (res.status === 404) return true;\n if (!res.ok) throw new Error(`EventSub deletion failed: ${res.status} ${await res.text()}`);\n return true;\n}\n\n/** Constant-time string compare — doesn't branch/short-circuit on content,\n * only on length (which isn't secret), so it doesn't leak how many leading\n * characters of the signature matched via response timing. Exported for\n * reuse by dashboard.ts's session cookie verification. */\nexport function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return diff === 0;\n}\n\nexport async function verifyEventSub(req: Request, rawBody: string) {\n const id = req.headers.get(\"Twitch-Eventsub-Message-Id\") ?? \"\";\n const timestamp = req.headers.get(\"Twitch-Eventsub-Message-Timestamp\") ?? \"\";\n const received = req.headers.get(\"Twitch-Eventsub-Message-Signature\") ?? \"\";\n if (!id || !timestamp || !received) return false;\n const receivedAt = Date.parse(timestamp);\n if (!Number.isFinite(receivedAt) || Math.abs(Date.now() - receivedAt) > 10 * 60 * 1000) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(env(\"EVENTSUB_SECRET\")),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const signature = new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(id + timestamp + rawBody)),\n );\n const hex = [...signature].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n const expected = `sha256=${hex}`;\n return timingSafeEqual(expected, received);\n}\n\n// ── Dashboard login (viewer-side OAuth, separate from the broadcaster\n// connect flow above) — used by dashboard.ts to verify that whoever is\n// sitting at the web dashboard is actually a moderator/broadcaster of the\n// channel, not just someone who found the link. ──\n\n/** The logged-in viewer's own Twitch identity, from their own access token\n * (no user_id param needed — Helix defaults to the token's owner). */\nexport async function getViewerIdentity(accessToken: string): Promise<{ id: string; login: string; display_name: string } | null> {\n const res = await fetch(\"https://api.twitch.tv/helix/users\", {\n headers: { Authorization: `Bearer ${accessToken}`, \"Client-Id\": env(\"TWITCH_CLIENT_ID\") },\n });\n if (!res.ok) return null;\n const data = await res.json();\n const user = data.data?.[0];\n if (!user) return null;\n return { id: String(user.id), login: String(user.login), display_name: String(user.display_name ?? user.login) };\n}\n\n// Get Moderated Channels only returns channels the viewer moderates for\n// *someone else* — the broadcaster of their own channel is never in this\n// list, so callers must check viewerId === broadcasterId separately.\n// Requires the viewer's own token with scope user:read:moderated_channels.\nconst MAX_MODERATED_CHANNELS_PAGES = 10;\n\nexport async function isUserModeratorOfChannel(accessToken: string, viewerId: string, broadcasterId: string): Promise {\n let cursor: string | undefined;\n for (let page = 0; page < MAX_MODERATED_CHANNELS_PAGES; page++) {\n const params = new URLSearchParams({ user_id: viewerId, first: \"100\" });\n if (cursor) params.set(\"after\", cursor);\n const res = await fetch(`https://api.twitch.tv/helix/moderation/channels?${params.toString()}`, {\n headers: { Authorization: `Bearer ${accessToken}`, \"Client-Id\": env(\"TWITCH_CLIENT_ID\") },\n });\n if (!res.ok) return false;\n const data = await res.json();\n const rows: any[] = data.data ?? [];\n if (rows.some((r) => String(r.broadcaster_id) === broadcasterId)) return true;\n cursor = data.pagination?.cursor;\n if (!cursor) break;\n }\n return false;\n}\n","deleted",false,"label",[14],"20e82baa-ad9c-41ac-a8e5-4d2d285f6a79",["D",1787995257440],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","cc37ba10-6e6d-4af6-a801-9955c92d23c4","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04ba1-c79f-7319-b4f2-7c4f3772837b","tursoName","20e82baaad9c41aca8e54d2d285f6a79","tursoHostname","20e82baaad9c41aca8e54d2d285f6a79-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789500119686],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":100},"org",{"_9":10,"_97":98,"_99":100,"_55":56,"_101":102,"_103":42},"branch",{"_35":30,"_11":88,"_22":28,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":12,"_96":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Shea Stolp","avatar","https://lh3.googleusercontent.com/a/ACg8ocIWmQgR3gyoMMicg2zCAoN1c7i36qX5mf9gRIdIXm8F2mo-ig=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":88,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]