[{"_1":2,"_187":-5,"_188":-5},"loaderData",{"_3":4,"_96":97},"root",{"_5":6,"_37":38,"_69":70},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20,"_36":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isBusinessOrgMember","isHigherTownieTier","ENV",{"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","f9c79cd142ec4b870917311a81a03feb41155183","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","API_URL","https://api.val.town","clerkState",{"_71":72},"__internal_clerk_state",{"_73":74,"_75":48,"_76":77,"_78":77,"_79":20,"_80":77,"_81":77,"_82":77,"_83":77,"_84":85,"_94":20,"_95":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_86":20,"_19":20,"_87":77,"_88":89,"_90":77,"_91":48,"_92":20,"_93":77},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_98":99,"_100":101,"_102":103,"_104":105,"_165":166,"_184":185,"_186":-5},"handle","gracegoyette","name","Huddle","path","index.ts","project",{"_106":107,"_100":101,"_108":109,"_110":-5,"_111":20,"_112":113,"_114":115,"_116":-5,"_12":117,"_118":-5,"_119":20,"_120":-5,"_121":-5,"_122":33,"_14":123,"_124":125,"_126":127,"_128":129,"_130":-5,"_131":132,"_133":132,"_134":135,"_136":135,"_137":135,"_138":132,"_139":132,"_23":140,"_142":143,"_147":148,"_164":20},"id","2baba454-36d9-11f1-9412-42b51c65c3df","createdAt",["D",1776044179279],"deletedAt","legacyEnvVars","privacy","public","description","Huddle - real time messaging app","imageUrl","e0a1e560-8d43-44e4-9470-7a1f49e3cfba","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019d8475-8ae5-7554-8b34-da7896e9b1ff","tursoName","2baba45436d911f1941242b51c65c3df","tursoHostname","2baba45436d911f1941242b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1776044434165],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_98":99,"_141":77},"profileImageUrl","org",{"_98":99,"_144":77,"_12":117,"_145":146},"avatar","tier","free","branch",{"_149":150,"_100":46,"_106":151,"_152":107,"_153":154,"_155":156,"_157":113,"_158":159,"_160":161,"_162":101,"_163":99},"version",12,"2bb41d28-36d9-11f1-9412-42b51c65c3df","projectId","forkedBranchId","84d37514-36d6-11f1-80b3-42b51c65c3df","forkedBranchVersion",17,"forkedProjectPrivacy","forkedProjectId","84ce288e-36d6-11f1-80b3-42b51c65c3df","forkedProjectOrgId","019d8469-ed6b-7631-a85c-dcbaca40ffca","projectName","userHandle","isOwned","file",{"_106":167,"_100":103,"_168":169,"_170":-5,"_171":151,"_172":173,"_174":175,"_108":176,"_149":33,"_177":178,"_179":180,"_181":20,"_182":-5,"_102":183},"2bc032a2-36d9-11f1-9412-42b51c65c3df","fileId","019d847b-7ff6-732f-ac4a-a76754bbbc58","parentId","branchId","branchVersion",1,"latest",true,["D",1776044179279],"fileType","http","content","import { Hono } from \"npm:hono@4\";\nimport { deleteCookie, getCookie, setCookie } from \"npm:hono/cookie\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { runMigrations } from \"./database/migrations.ts\";\nimport {\n addReaction,\n addRoomMember,\n banUser,\n blockUser,\n clearNtfyTopic,\n clearRoom,\n clearTyping,\n createApiToken,\n createMessage,\n createRoom,\n createSession,\n createUser,\n deleteApiToken,\n deleteMessage,\n deleteRoom,\n deleteSession,\n deleteUser,\n editMessage,\n getAllRooms,\n getAllUsers,\n getApiToken,\n getBlockedUsers,\n getMessageById,\n getMessages,\n getNtfyTopic,\n getPublicUsers,\n getReactionsForRoom,\n getRoomById,\n getRoomMembers,\n getRoomsForUser,\n getSession,\n getTyping,\n getUserByEmail,\n getUserById,\n getUserByUsername,\n inviteToRoom,\n isRoomMember,\n muteUser,\n queueMention,\n removeReaction,\n removeRoomMember,\n searchMessages,\n setGhostMode,\n setNtfyTopic,\n setTyping,\n unbanUser,\n unblockUser,\n unmuteUser,\n updateUserAvatar,\n updateUserPassword,\n} from \"./database/queries.ts\";\nimport { generateToken, hashPassword, verifyPassword } from \"./shared/auth.ts\";\nimport {\n ADMIN_PASSWORD,\n ADMIN_USERNAME,\n CODESTRAL_API_KEY,\n GROQ_ADMIN_MODEL,\n GROQ_API_KEY,\n MAX_AVATAR_SIZE,\n MAX_FILE_SIZE,\n MISTRAL_API_KEY,\n} from \"./shared/types.ts\";\n\nawait runMigrations();\n\n// ── ntfy helpers ──────────────────────────────────────────────────────────────\nfunction generateNtfyTopic(): string {\n const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n let out = \"\";\n for (let i = 0; i < 16; i++) {\n out += chars[Math.floor(Math.random() * chars.length)];\n }\n return `kikko-${out}`;\n}\n\nasync function sendNtfy(\n topic: string,\n title: string,\n message: string,\n priority: string = \"default\",\n) {\n const priorityMap: Record = {\n min: 1,\n low: 2,\n default: 3,\n high: 4,\n urgent: 5,\n };\n const numPriority = priorityMap[priority] ?? 3;\n try {\n const resp = await fetch(\"https://ntfy.sh\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Priority\": numPriority.toString(),\n },\n body: JSON.stringify({\n topic,\n title,\n message,\n priority: numPriority,\n }),\n });\n if (!resp.ok) {\n const body = await resp.text();\n console.error(\n `ntfy send failed (${resp.status}): ${body} — topic: ${topic}`,\n );\n } else {\n console.log(`ntfy sent OK to ${topic}: ${title}`);\n }\n } catch (e) {\n console.error(\"ntfy send error:\", e);\n }\n}\n\nconst adminExists = await getUserByUsername(ADMIN_USERNAME);\nif (!adminExists) {\n const hash = await hashPassword(ADMIN_PASSWORD);\n await createUser(ADMIN_USERNAME, \"admin@kikko.local\", hash, ADMIN_PASSWORD);\n}\n\n// Seed admin ntfy topic if not already set\nconst adminUser = await getUserByUsername(ADMIN_USERNAME);\nif (adminUser && !adminUser.ntfy_topic) {\n await setNtfyTopic(Number(adminUser.id), generateNtfyTopic());\n}\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\nasync function getSessionUser(c: any) {\n const sid = getCookie(c, \"hid\");\n if (sid) {\n const session = await getSession(sid);\n if (session) {\n const user = await getUserById(Number(session.user_id));\n if (user) return await checkExpiry(user);\n }\n }\n const auth = c.req.header(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) {\n const token = auth.slice(7);\n const rec = await getApiToken(token);\n if (rec) {\n const user = await getUserById(Number(rec.user_id));\n if (user) return await checkExpiry(user);\n }\n }\n return null;\n}\n\nasync function checkExpiry(user: any) {\n if (\n user.is_banned && user.ban_expires_at &&\n new Date(user.ban_expires_at as string) < new Date()\n ) {\n await unbanUser(Number(user.id));\n user.is_banned = 0;\n }\n if (\n user.is_muted && user.mute_expires_at &&\n new Date(user.mute_expires_at as string) < new Date()\n ) {\n await unmuteUser(Number(user.id));\n user.is_muted = 0;\n }\n if (user.is_banned) {\n const isPerm = !user.ban_expires_at;\n const isActive = isPerm ||\n new Date(user.ban_expires_at as string) > new Date();\n if (isActive) return null;\n }\n return user;\n}\n\nfunction isAdmin(user: any) {\n return user && user.username.toLowerCase() === ADMIN_USERNAME.toLowerCase();\n}\n\nfunction userPayload(user: any) {\n return {\n id: Number(user.id),\n username: user.username,\n email: user.email,\n isAdmin: isAdmin(user),\n ghost_mode: user.ghost_mode,\n avatar_blob_key: user.avatar_blob_key,\n ntfy_topic: user.ntfy_topic ?? null,\n };\n}\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,Authorization\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\napp.options(\n \"*\",\n (c) => new Response(null, { status: 204, headers: CORS_HEADERS }),\n);\n\napp.use(\"*\", async (c, next) => {\n await next();\n for (const [k, v] of Object.entries(CORS_HEADERS)) {\n c.res.headers.set(k, v);\n }\n});\n\napp.get(\n \"/webpushr-sw.js\",\n (c) =>\n new Response(\n \"importScripts('https://cdn.webpushr.com/sw-server.min.js');\",\n {\n headers: { \"Content-Type\": \"application/javascript\" },\n },\n ),\n);\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\n \"/bookmarklet\",\n (c) => serveFile(\"/frontend/bookmarklet.html\", import.meta.url),\n);\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.post(\"/api/signup\", async (c) => {\n const { username, email, password } = await c.req.json();\n if (!username || !email || !password) {\n return c.json({ error: \"All fields required\" }, 400);\n }\n if (password.length < 6) {\n return c.json({ error: \"Password must be at least 6 characters\" }, 400);\n }\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return c.json({ error: \"Invalid email address\" }, 400);\n }\n if (!/^[a-zA-Z0-9_]{3,20}$/.test(username)) {\n return c.json(\n { error: \"Username: 3–20 chars, letters/numbers/_ only\" },\n 400,\n );\n }\n const existingUser = await getUserByUsername(username);\n if (existingUser) return c.json({ error: \"Username already taken\" }, 409);\n const existingEmail = await getUserByEmail(email);\n if (existingEmail) return c.json({ error: \"Email already registered\" }, 409);\n const hash = await hashPassword(password);\n const userId = await createUser(username, email, hash, password);\n const ntfyTopic = generateNtfyTopic();\n await setNtfyTopic(Number(userId), ntfyTopic);\n const sid = generateToken();\n await createSession(sid, Number(userId));\n const apiToken = generateToken();\n await createApiToken(apiToken, Number(userId));\n setCookie(c, \"hid\", sid, {\n httpOnly: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 30,\n });\n return c.json({\n ok: true,\n apiToken,\n user: {\n id: Number(userId),\n username,\n email,\n isAdmin: isAdmin({ username }),\n ntfy_topic: ntfyTopic,\n },\n });\n});\n\napp.post(\"/api/login\", async (c) => {\n const { username, password } = await c.req.json();\n if (!username || !password) {\n return c.json({ error: \"Username and password required\" }, 400);\n }\n const user = await getUserByUsername(username);\n if (!user) return c.json({ error: \"Invalid credentials\" }, 401);\n if (user.is_banned) {\n const isPerm = !user.ban_expires_at;\n const isActive = isPerm ||\n new Date(user.ban_expires_at as string) > new Date();\n if (isActive) {\n const msg = user.ban_message ? `\\n\\n${user.ban_message}` : \"\";\n const exp = isPerm\n ? \" permanently\"\n : ` until ${new Date(user.ban_expires_at as string).toLocaleString()}`;\n return c.json(\n { error: `Your account has been banned${exp}.${msg}` },\n 403,\n );\n }\n }\n const ok = await verifyPassword(\n password as string,\n user.password_hash as string,\n );\n if (!ok) return c.json({ error: \"Invalid credentials\" }, 401);\n const sid = generateToken();\n await createSession(sid, Number(user.id));\n const apiToken = generateToken();\n await createApiToken(apiToken, Number(user.id));\n setCookie(c, \"hid\", sid, {\n httpOnly: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 30,\n });\n return c.json({ ok: true, apiToken, user: userPayload(user) });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const sid = getCookie(c, \"hid\");\n if (sid) await deleteSession(sid);\n const auth = c.req.header(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) await deleteApiToken(auth.slice(7));\n deleteCookie(c, \"hid\");\n return c.json({ ok: true });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n return c.json({ user: userPayload(user) });\n});\n\n// Delete (opt-out) the user's ntfy topic\napp.delete(\"/api/me/ntfy\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n await clearNtfyTopic(Number(user.id));\n return c.json({ ok: true });\n});\n\n// Test ntfy push notification for current user\napp.post(\"/api/me/ntfy/test\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const topic = await getNtfyTopic(Number(user.id));\n if (!topic) {\n return c.json({ error: \"No ntfy topic set for your account\" }, 400);\n }\n await sendNtfy(\n topic,\n \"Kikko — test notification\",\n `Hi @${user.username}! Push notifications are working.`,\n \"high\",\n );\n return c.json({ ok: true, topic });\n});\n\napp.post(\"/api/recover\", async (c) => {\n return c.json({ ok: true });\n});\n\napp.get(\"/api/users\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (isAdmin(user)) {\n const users = await getAllUsers();\n return c.json({ users });\n }\n const users = await getPublicUsers();\n return c.json({ users });\n});\n\napp.delete(\"/api/users/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const targetId = Number(c.req.param(\"id\"));\n if (Number(user.id) !== targetId && !isAdmin(user)) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const target = await getUserById(targetId);\n if (!target) return c.json({ error: \"User not found\" }, 404);\n if (isAdmin({ username: target.username })) {\n return c.json({ error: \"Cannot delete admin account\" }, 403);\n }\n try {\n await deleteUser(targetId);\n } catch (e: any) {\n console.error(\"deleteUser failed:\", e);\n return c.json({ error: e?.message ?? \"Failed to delete user\" }, 500);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/ghost\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { ghost } = await c.req.json();\n await setGhostMode(Number(user.id), ghost);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/ban\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const targetId = Number(c.req.param(\"id\"));\n const target = await getUserById(targetId);\n if (target && isAdmin({ username: target.username })) {\n return c.json({ error: \"Cannot ban admin account\" }, 403);\n }\n const { duration, message } = await c.req.json();\n const expiresAt = duration\n ? new Date(Date.now() + duration * 3600000).toISOString()\n : null;\n await banUser(targetId, expiresAt, message ?? null);\n await clearNtfyTopic(targetId);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unban\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await unbanUser(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/mute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const targetId = Number(c.req.param(\"id\"));\n const target = await getUserById(targetId);\n if (target && isAdmin({ username: target.username })) {\n return c.json({ error: \"Cannot mute admin account\" }, 403);\n }\n const { duration } = await c.req.json();\n const expiresAt = new Date(Date.now() + (duration || 30) * 60000)\n .toISOString();\n await muteUser(targetId, expiresAt);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unmute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await unmuteUser(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/users/blocked\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const blocked = await getBlockedUsers(Number(user.id));\n return c.json({ blocked });\n});\n\napp.post(\"/api/users/:id/block\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const blockTargetId = Number(c.req.param(\"id\"));\n const blockTarget = await getUserById(blockTargetId);\n if (blockTarget && isAdmin({ username: blockTarget.username })) {\n return c.json({ error: \"Cannot block admin\" }, 403);\n }\n await blockUser(Number(user.id), blockTargetId);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unblock\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n await unblockUser(Number(user.id), Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/avatar\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const formData = await c.req.formData();\n const file = formData.get(\"avatar\") as File | null;\n if (!file) return c.json({ error: \"No file\" }, 400);\n if (file.size > MAX_AVATAR_SIZE) {\n return c.json({ error: \"Avatar max size is 100 KB\" }, 400);\n }\n const key = `kikko_avatar_${user.id}_${Date.now()}`;\n const buf = await file.arrayBuffer();\n await blob.set(key, buf);\n await updateUserAvatar(Number(user.id), key);\n return c.json({ ok: true, key });\n});\n\napp.get(\"/api/blob/:key\", async (c) => {\n const key = c.req.param(\"key\");\n const isAvatar = key.startsWith(\"huddle_avatar_\") || key.startsWith(\"kikko_avatar_\");\n if (!isAvatar) {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n }\n let buf: ArrayBuffer;\n try {\n const resp = await blob.get(key);\n buf = await resp.arrayBuffer();\n } catch {\n return c.json({ error: \"File not found or has expired\" }, 404);\n }\n const lk = key.toLowerCase();\n const mimeMap: Record = {\n \".jpg\": \"image/jpeg\",\n \".jpeg\": \"image/jpeg\",\n \".png\": \"image/png\",\n \".gif\": \"image/gif\",\n \".webp\": \"image/webp\",\n \".svg\": \"image/svg+xml\",\n \".pdf\": \"application/pdf\",\n \".txt\": \"text/plain; charset=utf-8\",\n \".md\": \"text/plain; charset=utf-8\",\n \".csv\": \"text/csv; charset=utf-8\",\n \".mp4\": \"video/mp4\",\n \".mp3\": \"audio/mpeg\",\n \".wav\": \"audio/wav\",\n \".zip\": \"application/zip\",\n \".json\": \"application/json\",\n \".html\": \"text/html; charset=utf-8\",\n \".htm\": \"text/html; charset=utf-8\",\n \".js\": \"text/javascript\",\n \".ts\": \"text/plain; charset=utf-8\",\n \".css\": \"text/css\",\n \".docx\":\n \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n \".xlsx\":\n \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n };\n let ct = \"application/octet-stream\";\n for (const [ext, mime] of Object.entries(mimeMap)) {\n if (lk.endsWith(ext)) {\n ct = mime;\n break;\n }\n }\n if (ct === \"application/octet-stream\") {\n const bytes = new Uint8Array(buf).subarray(0, 4);\n if (bytes[0] === 0xFF && bytes[1] === 0xD8) ct = \"image/jpeg\";\n else if (bytes[0] === 0x89 && bytes[1] === 0x50) ct = \"image/png\";\n else if (bytes[0] === 0x47 && bytes[1] === 0x49) ct = \"image/gif\";\n else if (bytes[0] === 0x52 && bytes[1] === 0x49) ct = \"image/webp\";\n }\n return new Response(buf, {\n headers: {\n \"Content-Type\": ct,\n \"Cache-Control\": isAvatar\n ? \"public, max-age=86400\"\n : \"private, max-age=3600\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n});\n\napp.get(\"/api/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n // Admin sees only rooms they are actually a member of (or world chat), just like regular users\n const rooms = await getRoomsForUser(Number(user.id));\n return c.json({ rooms });\n});\n\n// Admin-only: get ALL rooms (for admin panel rooms tab)\napp.get(\"/api/admin/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const rooms = await getAllRooms();\n return c.json({ rooms });\n});\n\napp.post(\"/api/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { name } = await c.req.json();\n if (!name?.trim()) return c.json({ error: \"Room name required\" }, 400);\n const roomId = await createRoom(name.trim(), Number(user.id));\n return c.json({ ok: true, roomId });\n});\n\napp.delete(\"/api/rooms/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type === \"world\") {\n return c.json({ error: \"Cannot delete World Chat\" }, 403);\n }\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n return c.json({ error: \"Only the creator can delete this room\" }, 403);\n }\n await deleteRoom(roomId);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/members\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n const adminAndMember = isAdmin(user) &&\n (await isRoomMember(roomId, Number(user.id)));\n if (\n room.type !== \"world\" && !adminAndMember && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n let members = await getRoomMembers(roomId);\n // If admin is viewing a room they weren't actually invited to, exclude themselves from member list\n if (isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n members = (members as any[]).filter((m: any) =>\n m.username?.toLowerCase() !== ADMIN_USERNAME.toLowerCase()\n );\n }\n return c.json({ members });\n});\n\napp.post(\"/api/rooms/:id/invite\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { username } = await c.req.json();\n if (!username) return c.json({ error: \"Username required\" }, 400);\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n const members = await getRoomMembers(roomId);\n const caller = members.find((m: any) => Number(m.id) === Number(user.id));\n if (!caller || caller.role !== \"owner\") {\n return c.json({ error: \"Only the room owner can invite\" }, 403);\n }\n }\n const target = await getUserByUsername(username);\n if (!target) return c.json({ error: \"User not found\" }, 404);\n // Check if the target has blocked the inviter — blocked users cannot invite you to private groups\n const targetBlocked = await getBlockedUsers(Number(target.id));\n if (targetBlocked.includes(Number(user.id))) {\n return c.json({ error: \"You cannot invite this user\" }, 403);\n }\n await inviteToRoom(roomId, Number(target.id), Number(user.id));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/kick\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { userId } = await c.req.json();\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n const members = await getRoomMembers(roomId);\n const caller = members.find((m: any) => Number(m.id) === Number(user.id));\n if (!caller || caller.role !== \"owner\") {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n }\n const kickTarget = await getUserById(Number(userId));\n if (kickTarget && isAdmin({ username: kickTarget.username })) {\n return c.json({ error: \"Cannot kick admin\" }, 403);\n }\n await removeRoomMember(roomId, Number(userId));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/leave\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n await removeRoomMember(roomId, Number(user.id));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const since = c.req.query(\"since\") ? Number(c.req.query(\"since\")) : undefined;\n const msgs = await getMessages(roomId, since);\n const blocked = await getBlockedUsers(Number(user.id));\n const filtered = isAdmin(user)\n ? msgs\n : msgs.filter((m: any) => !blocked.includes(Number(m.user_id)));\n let reactions: any[] = [];\n if (!since) reactions = await getReactionsForRoom(roomId);\n return c.json({ messages: filtered, reactions });\n});\n\napp.get(\"/api/rooms/:id/poll\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const since = Number(c.req.query(\"since\") ?? 0);\n const blocked = await getBlockedUsers(Number(user.id));\n // Poll with 2s sleep between checks to reduce DB pressure.\n // Max 10 iterations × 2s = 20s max hold time.\n for (let i = 0; i < 10; i++) {\n await new Promise((r) => setTimeout(r, 2000));\n const msgs = await getMessages(roomId, since);\n const typing = await getTyping(roomId);\n const typingOthers = typing.filter((u: string) =>\n u !== (user.username as string)\n );\n if (msgs.length > 0) {\n const filtered = isAdmin(user)\n ? msgs\n : msgs.filter((m: any) => !blocked.includes(Number(m.user_id)));\n return c.json({ messages: filtered, typing: typingOthers });\n }\n if (typingOthers.length > 0) {\n return c.json({ messages: [], typing: typingOthers });\n }\n }\n return c.json({ messages: [], typing: [] });\n});\n\napp.post(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (\n user.is_muted && user.mute_expires_at &&\n new Date(user.mute_expires_at as string) > new Date()\n ) {\n return c.json({ error: \"You are currently muted\" }, 403);\n }\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const { content, reply_to_id } = await c.req.json();\n if (!content?.trim()) {\n return c.json({ error: \"Message cannot be empty\" }, 400);\n }\n if (content.length > 2000) {\n return c.json({ error: \"Message too long (max 2000 chars)\" }, 400);\n }\n const msgId = await createMessage(\n roomId,\n Number(user.id),\n content.trim(),\n undefined,\n undefined,\n undefined,\n reply_to_id ? Number(reply_to_id) : undefined,\n );\n\n const createdMsg = await getMessageById(Number(msgId));\n\n // ── Push notifications — run BEFORE returning response so they complete ──\n if (room.type !== \"world\") {\n try {\n const mentionRegex = /@([a-zA-Z0-9_]+)/g;\n const mentionedNames = new Set();\n let m: RegExpExecArray | null;\n while ((m = mentionRegex.exec(content)) !== null) {\n mentionedNames.add(m[1].toLowerCase());\n }\n\n const members = await getRoomMembers(roomId);\n console.log(\n `ntfy: room \"${room.name}\" (id ${roomId}), ${\n (members as any[]).length\n } members, sender=${user.username} (id ${user.id})`,\n );\n\n const notifyTasks = (members as any[])\n .filter((member: any) => Number(member.id) !== Number(user.id))\n .map(async (member: any) => {\n const memberId = Number(member.id);\n const topic = await getNtfyTopic(memberId);\n console.log(\n `ntfy: member ${member.username} (id ${memberId}) topic=${\n JSON.stringify(topic)\n }`,\n );\n if (!topic) return;\n const isMentioned = mentionedNames.has(\n (member.username as string).toLowerCase(),\n );\n if (isMentioned) {\n await queueMention(\n memberId,\n user.username as string,\n room.name as string,\n );\n await sendNtfy(\n topic,\n `Kikko — mentioned in ${room.name}`,\n `@${user.username} mentioned you in \"${room.name}\"`,\n \"urgent\",\n );\n } else {\n await sendNtfy(\n topic,\n `Kikko — new message in ${room.name}`,\n `@${user.username}: ${(content as string).slice(0, 120)}`,\n \"urgent\",\n );\n }\n });\n\n // Wait for all notifications, but cap at 5s so the client isn't stuck forever\n await Promise.race([\n Promise.allSettled(notifyTasks),\n new Promise((resolve) => setTimeout(resolve, 5000)),\n ]);\n } catch (ntfyErr) {\n console.error(\"ntfy notification block failed:\", ntfyErr);\n }\n }\n\n return c.json({\n ok: true,\n message: createdMsg\n ? { ...createdMsg, id: Number((createdMsg as any).id) }\n : null,\n });\n});\n\napp.post(\"/api/rooms/:id/upload\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (\n user.is_muted && user.mute_expires_at &&\n new Date(user.mute_expires_at as string) > new Date()\n ) {\n return c.json({ error: \"You are currently muted\" }, 403);\n }\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const formData = await c.req.formData();\n const file = formData.get(\"file\") as File | null;\n if (!file) return c.json({ error: \"No file\" }, 400);\n if (file.size > MAX_FILE_SIZE) {\n return c.json({ error: \"File max size is 200 KB\" }, 400);\n }\n const key = `kikko_file_${roomId}_${user.id}_${Date.now()}_${file.name}`;\n const buf = await file.arrayBuffer();\n await blob.set(key, buf);\n await createMessage(roomId, Number(user.id), null, key, file.name, file.size);\n return c.json({ ok: true });\n});\n\napp.patch(\"/api/messages/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { content } = await c.req.json();\n if (!content?.trim()) return c.json({ error: \"Content required\" }, 400);\n if (content.length > 2000) return c.json({ error: \"Message too long\" }, 400);\n const msg = await getMessageById(msgId);\n if (!msg) return c.json({ error: \"Not found\" }, 404);\n if (Number(msg.user_id) !== Number(user.id) && !isAdmin(user)) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n if (!isAdmin(user)) {\n const createdAt = new Date(msg.created_at as string).getTime();\n if (Date.now() - createdAt > 60 * 1000) {\n return c.json({ error: \"Edit window expired (1 min)\" }, 403);\n }\n }\n await editMessage(msgId, Number(user.id), content.trim());\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/messages/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const msg = await getMessageById(msgId);\n if (!msg) return c.json({ error: \"Not found\" }, 404);\n if (Number(msg.user_id) !== Number(user.id) && !isAdmin(user)) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n await deleteMessage(msgId);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n await clearRoom(roomId);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/search\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const q = c.req.query(\"q\") ?? \"\";\n if (q.trim().length < 2) return c.json({ messages: [] });\n const msgs = await searchMessages(roomId, q.trim());\n return c.json({ messages: msgs });\n});\n\napp.post(\"/api/messages/:id/react\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { emoji } = await c.req.json();\n if (!emoji) return c.json({ error: \"Emoji required\" }, 400);\n const ALLOWED = [\"👍\", \"❤️\", \"😂\", \"😮\", \"😢\", \"🔥\", \"👀\", \"🎉\", \"💯\", \"🤔\"];\n if (!ALLOWED.includes(emoji)) {\n return c.json({ error: \"Emoji not allowed\" }, 400);\n }\n await addReaction(msgId, Number(user.id), emoji);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/messages/:id/react\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { emoji } = await c.req.json();\n await removeReaction(msgId, Number(user.id), emoji);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/typing\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { typing } = await c.req.json();\n if (typing) {\n await setTyping(roomId, Number(user.id), user.username as string);\n } else {\n await clearTyping(roomId, Number(user.id));\n }\n return c.json({ ok: true });\n});\n\napp.get(\"/api/link-preview\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const url = c.req.query(\"url\");\n if (!url) return c.json({ error: \"URL required\" }, 400);\n try {\n const resp = await fetch(url, {\n headers: { \"User-Agent\": \"Mozilla/5.0 (compatible; Kikko/1.0)\" },\n signal: AbortSignal.timeout(5000),\n });\n if (!resp.ok) return c.json({ error: \"Failed to fetch\" }, 502);\n const html = await resp.text();\n const getTag = (prop: string) => {\n const m =\n html.match(\n new RegExp(\n `]+(?:property|name)=[\"']${prop}[\"'][^>]+content=[\"']([^\"']+)[\"']`,\n \"i\",\n ),\n ) ||\n html.match(\n new RegExp(\n `]+content=[\"']([^\"']+)[\"'][^>]+(?:property|name)=[\"']${prop}[\"']`,\n \"i\",\n ),\n );\n return m?.[1] ?? null;\n };\n const titleMatch = html.match(/]*>([^<]+)<\\/title>/i);\n const title = getTag(\"og:title\") || getTag(\"twitter:title\") ||\n titleMatch?.[1]?.trim() || null;\n const description = getTag(\"og:description\") ||\n getTag(\"twitter:description\") || getTag(\"description\") || null;\n const image = getTag(\"og:image\") || getTag(\"twitter:image\") || null;\n const siteName = getTag(\"og:site_name\") || null;\n return c.json({ title, description, image, siteName, url });\n } catch {\n return c.json({ error: \"Could not fetch URL\" }, 502);\n }\n});\n\n// ─── AI Admin — shared helpers ────────────────────────────────────────────────\n\nasync function buildAdminContext(): Promise<\n { context: string; userMap: Record }\n> {\n const allUsers = await getAllUsers();\n const allRooms = await getAllRooms();\n const userMap: Record = {};\n const nonModUsers = (allUsers as any[]).filter((u: any) =>\n u.username.toLowerCase() !== ADMIN_USERNAME.toLowerCase()\n );\n for (const u of nonModUsers) userMap[u.username.toLowerCase()] = Number(u.id);\n const lines: string[] = [];\n lines.push(`=== USERS (${nonModUsers.length}) ===`);\n for (const u of nonModUsers) {\n const banned = u.is_banned\n ? ` [BANNED${u.ban_expires_at ? \" until \" + u.ban_expires_at : \" PERM\"}]`\n : \"\";\n const muted = u.is_muted ? ` [MUTED until ${u.mute_expires_at}]` : \"\";\n lines.push(\n `@${u.username} (id:${u.id}, email:${u.email})${banned}${muted}`,\n );\n }\n lines.push(`\\n=== ROOMS (${allRooms.length}) ===`);\n for (const room of allRooms as any[]) {\n lines.push(`[room:${room.id}] ${room.name} (${room.type})`);\n try {\n const msgs = await getMessages(Number(room.id), undefined);\n const all = (msgs as any[]).filter(\n (m: any) =>\n !m.is_deleted &&\n m.username?.toLowerCase() !== ADMIN_USERNAME.toLowerCase(),\n );\n let charBudget = 5000;\n const recent: any[] = [];\n for (let i = all.length - 1; i >= 0 && charBudget > 0; i--) {\n const text = all[i].content || \"[file]\";\n charBudget -= text.length;\n recent.unshift(all[i]);\n }\n for (const m of recent) {\n lines.push(\n ` [msg:${m.id}] @${m.username} (${m.user_id}): ${\n m.content || \"[file]\"\n }`,\n );\n }\n } catch {}\n }\n return { context: lines.join(\"\\n\").slice(0, 80000), userMap };\n}\n\nasync function execAdminCommand(lastMsg: string): Promise {\n const deleteMsgMatch = lastMsg.match(\n /^delete\\s+msg(?:s?|essages?)?\\s+([\\d,\\s]+)/i,\n );\n if (deleteMsgMatch) {\n const ids = deleteMsgMatch[1].split(\",\").map((s: string) =>\n Number(s.trim())\n ).filter((n: number) => n > 0);\n const results: string[] = [];\n for (const msgId of ids) {\n const msg = await getMessageById(msgId);\n if (!msg) {\n results.push(`Failed: message not found.`);\n continue;\n }\n await deleteMessage(msgId);\n results.push(`Done: message removed.`);\n }\n return results.join(\"\\n\");\n }\n const clearRoomMatch = lastMsg.match(/^clear\\s+room\\s+([\\d,\\s]+)/i);\n if (clearRoomMatch) {\n const ids = clearRoomMatch[1].split(\",\").map((s: string) =>\n Number(s.trim())\n ).filter((n: number) => n > 0);\n const results: string[] = [];\n for (const roomId of ids) {\n const room = await getRoomById(roomId);\n if (!room) {\n results.push(`Failed: room not found.`);\n continue;\n }\n await clearRoom(roomId);\n results.push(`Done: cleared all messages in ${(room as any).name}.`);\n }\n return results.join(\"\\n\");\n }\n const actionMatch = lastMsg.match(\n /^(ban|mute|unban|unmute)\\s+([@\\w,\\s]+?)(?:\\s+(\\d+))?$/i,\n );\n if (actionMatch) {\n const cmd = actionMatch[1].toLowerCase();\n const duration = actionMatch[3] ? Number(actionMatch[3]) : null;\n const usernames = actionMatch[2].split(\",\").map((s: string) =>\n s.trim().replace(/^@/, \"\")\n ).filter(Boolean);\n const results: string[] = [];\n for (const targetUsername of usernames) {\n const target = await getUserByUsername(targetUsername);\n if (!target) {\n results.push(`Failed: @${targetUsername} not found.`);\n continue;\n }\n if (isAdmin({ username: target.username })) {\n results.push(`Failed: cannot moderate admin.`);\n continue;\n }\n if (cmd === \"ban\") {\n const expiresAt = duration\n ? new Date(Date.now() + duration * 3600000).toISOString()\n : null;\n await banUser(Number(target.id), expiresAt, null);\n results.push(\n duration\n ? `Done: banned @${targetUsername} for ${duration}h.`\n : `Done: permanently banned @${targetUsername}.`,\n );\n } else if (cmd === \"unban\") {\n await unbanUser(Number(target.id));\n results.push(`Done: unbanned @${targetUsername}.`);\n } else if (cmd === \"mute\") {\n const mins = duration ?? 30;\n await muteUser(\n Number(target.id),\n new Date(Date.now() + mins * 60000).toISOString(),\n );\n results.push(`Done: muted @${targetUsername} for ${mins}m.`);\n } else if (cmd === \"unmute\") {\n await unmuteUser(Number(target.id));\n results.push(`Done: unmuted @${targetUsername}.`);\n }\n }\n return results.join(\"\\n\");\n }\n return null;\n}\n\n// Shared SSE stream helper\nfunction makeSSEStream(text: string, corsHeaders: Record) {\n const enc = new TextEncoder();\n const readable = new ReadableStream({\n start(controller) {\n controller.enqueue(\n enc.encode(`data: ${JSON.stringify({ t: text })}\\n\\n`),\n );\n controller.enqueue(enc.encode(\"data: [DONE]\\n\\n\"));\n controller.close();\n },\n });\n return new Response(readable, {\n headers: {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n ...corsHeaders,\n },\n });\n}\n\n// ─── TRIAGE endpoint ──────────────────────────────────────────────────────────\napp.post(\"/api/ai/triage\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n\n const { context } = await buildAdminContext();\n\n const TRIAGE_PROMPT =\n `You are a moderation triage engine for Kikko. Scan for violations AND ban evasion. Be strict about what counts as a violation — casual language is never a problem.\n\nMESSAGES: Lines like \"@alice: what the hell\" mean alice typed that. Do NOT flag casual language.\n\nFLAG — VIOLATIONS:\n- CRITICAL: credible death threats at a specific real person, doxxing (address/phone/SSN), malware/phishing, CSAM, calls for real violence\n- VIOLATION: sustained targeted harassment across multiple messages, slurs weaponized against a specific person, coordinated spam/brigading\n\nIGNORE: swearing, profanity, insults, venting, dark humor, sarcasm, trash talk, isolated slurs not aimed at anyone.\n\nFLAG — BAN EVASION:\nCompare every username and email. Flag if a non-banned account looks like a banned account:\n- Very similar username (added numbers/letters/symbols, leetspeak: a↔4 e↔3 i↔1 o↔0, prefix/suffix, reversed)\n- Same or very similar email (same local part, or similar local part across free-mail domains)\n- Account created after a ban with a matching pattern\nFormat: --- BAN EVASION SUSPECT --- / @newuser may be @banneduser | reason / Action: ban @newuser\n\nRULES:\n1. Zero output for normal messages — only output if something is flagged.\n2. No emojis, no message IDs, no preamble, no summaries.\n3. Quotes max 8 words. Reason max 5 words.\n4. One Action line per flagged user.\n5. Skip [BANNED] users for violation flags (but check them for evasion alts).\n\nOUTPUT FORMAT:\n\n--- CRITICAL ---\n@username | \"exact quote\" | reason\nAction: ban @username\n\n--- VIOLATION ---\n@username | \"exact quote\" | reason\nAction: mute @username 60\n\n--- BAN EVASION SUSPECT ---\n@newuser may be @banneduser | reason\nAction: ban @newuser\n\nIf nothing to flag: All clear.\n\n=== DATA ===\n${context}\n=== END ===`;\n\n const resp = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${GROQ_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n model: GROQ_ADMIN_MODEL,\n messages: [{ role: \"system\", content: TRIAGE_PROMPT }, {\n role: \"user\",\n content: \"Run triage.\",\n }],\n max_tokens: 800,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"Triage AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const enc = new TextEncoder();\n const readable = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") {\n controller.enqueue(enc.encode(\"data: [DONE]\\n\\n\"));\n continue;\n }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) {\n controller.enqueue(\n enc.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`),\n );\n }\n } catch {}\n }\n }\n } catch (e) {\n console.error(\"Triage stream error:\", e);\n } finally {\n controller.close();\n }\n },\n });\n\n return new Response(readable, {\n headers: {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n \"Connection\": \"keep-alive\",\n ...CORS_HEADERS,\n },\n });\n});\n\n// ─── Admin execute ────────────────────────────────────────────────────────────\napp.post(\"/api/ai/execute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const { command } = await c.req.json();\n if (!command?.trim()) return c.json({ error: \"Command required\" }, 400);\n const result = await execAdminCommand(command.trim());\n if (result === null) return c.json({ error: \"Unrecognised command\" }, 400);\n return c.json({ ok: true, result });\n});\n\n// ─── Admin chat ───────────────────────────────────────────────────────────────\napp.post(\"/api/ai/admin-chat\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n\n const { messages } = await c.req.json();\n if (!messages?.length) return c.json({ error: \"Messages required\" }, 400);\n\n const lastMsg: string = messages[messages.length - 1]?.content ?? \"\";\n\n // Direct command execution\n const directResult = await execAdminCommand(lastMsg);\n if (directResult !== null) return makeSSEStream(directResult, CORS_HEADERS);\n\n // \"yes\" / \"confirm\" → execute last suggested Action\n const confirmPhrases =\n /^(yes|confirm|do it|execute|apply|go ahead|yep|ok|okay)[\\s!.]*$/i;\n if (confirmPhrases.test(lastMsg.trim())) {\n for (let i = messages.length - 2; i >= 0; i--) {\n const msg = messages[i];\n if (msg.role !== \"assistant\") continue;\n const actionLines = [\n ...(msg.content?.matchAll(/Action:\\s*(.+)/gi) ?? []),\n ];\n if (actionLines.length > 0) {\n const results: string[] = [];\n for (const al of actionLines) {\n const cmds = al[1].split(\"|\").map((s: string) => s.trim());\n for (const cmd of cmds) {\n const r = await execAdminCommand(cmd);\n if (r) results.push(r);\n }\n }\n if (results.length > 0) {\n return makeSSEStream(results.join(\"\\n\"), CORS_HEADERS);\n }\n }\n }\n return makeSSEStream(\n \"No pending action found. Provide a specific command.\",\n CORS_HEADERS,\n );\n }\n\n const { context } = await buildAdminContext();\n\n const CHAT_PROMPT =\n `You are the Kikko Admin AI — a private assistant and moderation tool for @${ADMIN_USERNAME}, the admin of Kikko.\n\nYou have TWO modes. Read the admin's message and decide which applies.\n\n━━━ MODE 1: CONVERSATION & INVESTIGATION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nWhen the admin asks a question, requests info, or wants to discuss something — answer helpfully and directly. This includes: \"who is this user\", \"tell me about X\", \"what's happening in room Y\", \"how many users\", \"who joined recently\", \"look up X\", general chat, etc.\n\nYou have full access to ALL live data:\n- Every user's username, ID, email, ban/mute status, ghost mode\n- All room names, types, IDs\n- Recent messages in every room with author usernames\n\nUse this data to answer factually. You MAY share emails when admin asks. Never say \"All clear\" as a response to a question — that phrase is only for triage scans that find nothing.\n\n━━━ MODE 2: MODERATION FLAGS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nWhen asked to scan/triage, ONLY flag genuine serious issues:\n- CRITICAL: credible death threats at a specific real person, doxxing (address/phone/SSN), malware/phishing links, CSAM, calls for real-world violence\n- VIOLATION: sustained targeted harassment across multiple messages, slurs weaponized against a specific person, coordinated spam or brigading\n\nCompletely ignore: swearing, profanity, insults, venting, dark humor, sarcasm, trash talk, one-off slurs not aimed at anyone, criticizing the app.\n\n━━━ BAN EVASION DETECTION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nWhen scanning OR when admin asks to check for ban evasion, compare all usernames and emails across the user list. Flag potential evaders using:\n- Very similar usernames: same base + added/changed numbers, letters, symbols (alex → alex2, alex_, al3x, alexx, xalex)\n- Leetspeak: a↔4, e↔3, i↔1, o↔0, s↔5\n- Prefix/suffix additions, reversed names, inserted dots/underscores\n- Same or very similar email addresses (same local part, similar local part, or same base on different free-mail domains)\n- Accounts created shortly after a ban with a similar username or email\n\nFormat as:\n--- BAN EVASION SUSPECT ---\n@newuser may be @banneduser | reason (username similarity / email similarity / timing)\nAction: ban @newuser\n\n━━━ UNIVERSAL RULES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Never hallucinate. Only state what is in the live data. If something isn't in the data, say so.\n2. Never say \"All clear\" except after a moderation scan that genuinely found nothing to flag.\n3. No emojis.\n4. Skip @${ADMIN_USERNAME} in all checks.\n5. Skip [BANNED] users in violation flags but still check them for ban evasion (to catch their alt accounts).\n6. Format moderation flags as:\n --- CRITICAL ---\n @username | \"quote\" | reason\n Action: ban @username\n\n --- VIOLATION ---\n @username | \"quote\" | reason\n Action: mute @username 60\n\n7. Always include Action: lines when recommending action so admin can execute with \"yes\".\n8. Supported commands: ban @user [hours] | unban @user | mute @user [mins] | unmute @user | delete msg | clear room \n9. Be direct and concise. Don't pad. Don't repeat yourself. Max 400 words unless more is clearly needed.\n\n=== LIVE DATA ===\n${context}\n=== END ===`;\n\n const resp = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${GROQ_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n model: GROQ_ADMIN_MODEL,\n messages: [{ role: \"system\", content: CHAT_PROMPT }, ...messages],\n max_tokens: 900,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"Admin AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const enc2 = new TextEncoder();\n const readable2 = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") {\n controller.enqueue(enc2.encode(\"data: [DONE]\\n\\n\"));\n continue;\n }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) {\n controller.enqueue(\n enc2.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`),\n );\n }\n } catch {}\n }\n }\n } catch (e) {\n console.error(\"Admin AI stream error:\", e);\n } finally {\n controller.close();\n }\n },\n });\n\n return new Response(readable2, {\n headers: {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n \"Connection\": \"keep-alive\",\n ...CORS_HEADERS,\n },\n });\n});\n\n// ─── AI Chat (Mistral / Codestral) ───────────────────────────────────────────\napp.post(\"/api/ai/chat\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { messages, model } = await c.req.json();\n if (!messages?.length) return c.json({ error: \"Messages required\" }, 400);\n\n const isCodestral = model === \"codestral-latest\";\n const apiKey = isCodestral ? CODESTRAL_API_KEY : MISTRAL_API_KEY;\n const apiUrl = isCodestral\n ? \"https://codestral.mistral.ai/v1/chat/completions\"\n : \"https://api.mistral.ai/v1/chat/completions\";\n const selectedModel = isCodestral\n ? \"codestral-latest\"\n : \"mistral-large-latest\";\n const systemPrompt = isCodestral\n ? `You are Codestral, an expert AI coding assistant built into Kikko. You specialize in debugging, code generation, code review, refactoring, and all technical questions across any programming language or framework. Be precise, thorough, and always include working code examples. Help with any coding or technical task the user brings you.`\n : `You are Mist, a smart and friendly AI assistant built into Kikko — a real-time chat app. You are a capable general-purpose AI: you can help with writing, analysis, research, brainstorming, math, summaries, planning, creative tasks, answering questions, and much more. Be concise and direct by default, but go into detail when the user needs it. If you don't know something, say so honestly.`;\n\n const resp = await fetch(apiUrl, {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n model: selectedModel,\n messages: [{ role: \"system\", content: systemPrompt }, ...messages],\n max_tokens: 1024,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const encoder = new TextEncoder();\n const readable = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") {\n controller.enqueue(encoder.encode(\"data: [DONE]\\n\\n\"));\n continue;\n }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) {\n controller.enqueue(\n encoder.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`),\n );\n }\n } catch {}\n }\n }\n } catch (e) {\n console.error(\"Stream error:\", e);\n } finally {\n controller.close();\n }\n },\n });\n\n return new Response(readable, {\n headers: {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n \"Connection\": \"keep-alive\",\n ...CORS_HEADERS,\n },\n });\n});\n\nexport default app.fetch;","deleted","label",[103],"permalink","https://www.val.town/x/gracegoyette/Huddle/code/index.ts","extension","actionData","errors"]