[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_109":110,"_111":112},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","hucccc","name","tiktok-14444-bridge","path","index.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":55,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":12,"_13":44},"permalink","https://www.val.town/x/hucccc/tiktok-14444-bridge/code/index.ts","extension","id","4e117da8-663d-4a71-8f3e-f9db9b1c80c4","fileId","01a01b9b-16b5-7082-8a0d-34b147526bab","parentId","branchId","5dc6ce84-eff1-4c60-adf9-c292cd909b24","branchVersion",40,"latest",true,"createdAt",["D",1787172910300],"version",30,"fileType","http","content","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\nconst ORIGIN = \"https://tiktok-14444-bridge.val.run\";\nconst CALLBACK = `${ORIGIN}/callback`;\nconst MCP_CALLBACK = `${ORIGIN}/mcp/callback`;\nconst MCP_RESOURCE = \"https://business-api.tiktok.com/open_mcp/tt-ads-mcp-layer\";\nconst MCP_AUTH = \"https://business-api.tiktok.com/portal/mcp-tt4b-authorize\";\nconst MCP_TOKEN = \"https://business-api.tiktok.com/open_mcp/tt-ads-mcp-layer/oauth/token\";\nconst MCP_FLAT_CALLBACK = `${ORIGIN}/mcp-flat/callback`;\nconst MCP_FLAT_RESOURCE = \"https://business-api.tiktok.com/open_mcp/tt-ads-mcp-flat\";\nconst MCP_FLAT_TOKEN = \"https://business-api.tiktok.com/open_mcp/tt-ads-mcp-flat/oauth/token\";\nconst te = new TextEncoder();\nconst td = new TextDecoder();\n\nasync function initDb() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS settings (key TEXT PRIMARY KEY, value TEXT NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS oauth_states (state_hash TEXT PRIMARY KEY, expires_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS tiktok_connections (\n open_id TEXT PRIMARY KEY,\n access_token_enc TEXT NOT NULL,\n refresh_token_enc TEXT NOT NULL,\n scope TEXT NOT NULL,\n access_expires_at INTEGER NOT NULL,\n refresh_expires_at INTEGER NOT NULL,\n display_name TEXT,\n avatar_url TEXT,\n connected_at INTEGER NOT NULL,\n updated_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS shop_creator_connections (\n open_id TEXT PRIMARY KEY,\n access_token_enc TEXT NOT NULL,\n refresh_token_enc TEXT NOT NULL,\n granted_scopes TEXT NOT NULL,\n access_expires_at INTEGER,\n refresh_expires_at INTEGER,\n connected_at INTEGER NOT NULL,\n updated_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS content_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n kind TEXT NOT NULL,\n title TEXT,\n caption TEXT,\n media_url TEXT,\n status TEXT NOT NULL DEFAULT 'draft',\n created_at INTEGER NOT NULL,\n updated_at INTEGER NOT NULL,\n last_error TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS mcp_oauth_states (\n state_hash TEXT PRIMARY KEY,\n verifier_enc TEXT NOT NULL,\n expires_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS tt4b_mcp_connections (\n id INTEGER PRIMARY KEY CHECK(id=1),\n access_token_enc TEXT NOT NULL,\n refresh_token_enc TEXT,\n scope TEXT,\n token_type TEXT,\n expires_at INTEGER,\n connected_at INTEGER NOT NULL,\n updated_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS mcp_flat_oauth_states (\n state_hash TEXT PRIMARY KEY,\n verifier_enc TEXT NOT NULL,\n expires_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS tt4b_mcp_flat_connections (\n id INTEGER PRIMARY KEY CHECK(id=1),\n access_token_enc TEXT NOT NULL,\n refresh_token_enc TEXT,\n scope TEXT,\n token_type TEXT,\n expires_at INTEGER,\n connected_at INTEGER NOT NULL,\n updated_at INTEGER NOT NULL\n )`,\n ]);\n}\n\nfunction b64(bytes: Uint8Array) {\n let s = \"\";\n for (const b of bytes) s += String.fromCharCode(b);\n return btoa(s).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\nfunction unb64(s: string) {\n s = s.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\");\n while (s.length % 4) s += \"=\";\n const raw = atob(s);\n return Uint8Array.from(raw, (c) => c.charCodeAt(0));\n}\nasync function digestHex(value: string) {\n const h = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", te.encode(value)));\n return [...h].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function pkceChallenge(verifier: string) {\n return b64(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", te.encode(verifier))));\n}\nasync function aesKey() {\n const master = Deno.env.get(\"APP_MASTER_KEY\");\n if (!master) throw new Error(\"APP_MASTER_KEY is missing\");\n const raw = await crypto.subtle.digest(\"SHA-256\", te.encode(master));\n return crypto.subtle.importKey(\"raw\", raw, \"AES-GCM\", false, [\"encrypt\", \"decrypt\"]);\n}\nasync function encrypt(value: string) {\n const iv = crypto.getRandomValues(new Uint8Array(12));\n const key = await aesKey();\n const out = new Uint8Array(await crypto.subtle.encrypt({ name: \"AES-GCM\", iv }, key, te.encode(value)));\n return `${b64(iv)}.${b64(out)}`;\n}\nasync function decrypt(value: string) {\n const [ivPart, bodyPart] = value.split(\".\");\n if (!ivPart || !bodyPart) throw new Error(\"Encrypted value is invalid\");\n const key = await aesKey();\n const out = await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: unb64(ivPart) }, key, unb64(bodyPart));\n return td.decode(out);\n}\nasync function getSetting(key: string) {\n const r = await sqlite.execute({ sql: `SELECT value FROM settings WHERE key = ? LIMIT 1`, args: [key] });\n return (r.rows[0] as any)?.value as string | undefined;\n}\nasync function setSetting(key: string, value: string) {\n await sqlite.execute({ sql: `INSERT INTO settings(key,value) VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`, args: [key, value] });\n}\nasync function getCredentials() {\n const clientKey = await getSetting(\"tiktok_client_key\");\n const encSecret = await getSetting(\"tiktok_client_secret_enc\");\n if (!clientKey || !encSecret) return null;\n return { clientKey, clientSecret: await decrypt(encSecret) };\n}\nasync function getShopCredentials() {\n const appKey = await getSetting(\"shop_app_key\");\n const encSecret = await getSetting(\"shop_app_secret_enc\");\n if (!appKey || !encSecret) return null;\n return { appKey, appSecret: await decrypt(encSecret) };\n}\nasync function isAdmin(c: any) {\n const expected = Deno.env.get(\"ADMIN_TOKEN\") || \"\";\n if (!expected) return false;\n const cookie = c.req.header(\"Cookie\") || \"\";\n const match = cookie.match(/(?:^|;\\s*)tt_admin=([^;]+)/);\n if (!match) return false;\n return match[1] === await digestHex(expected);\n}\nasync function setAdminCookie(c: any) {\n const expected = Deno.env.get(\"ADMIN_TOKEN\") || \"\";\n if (!expected) throw new Error(\"ADMIN_TOKEN is missing\");\n const value = await digestHex(expected);\n c.header(\"Set-Cookie\", `tt_admin=${value}; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Lax`);\n}\nfunction secureHeaders(c: any) {\n c.header(\"Referrer-Policy\", \"no-referrer\");\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=()\");\n c.header(\"Content-Security-Policy\", \"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'\");\n c.header(\"Cache-Control\", \"no-store\");\n}\nfunction page(title: string, body: string) {\n return `${title}

${body}

`;\n}\n\napp.use(\"*\", async (c, next) => { secureHeaders(c); await initDb(); await next(); });\napp.use(\"*\", async (c, next) => {\n const path = new URL(c.req.url).pathname;\n if ([\"/admin\", \"/access\", \"/setup\", \"/repair\", \"/callback\", \"/shop/callback\", \"/mcp/callback\", \"/mcp/start\", \"/mcp-flat/callback\", \"/mcp-flat/start\"].includes(path)) return next();\n if (!(await isAdmin(c))) return c.redirect(\"/access\");\n await next();\n});\n\napp.get(\"/access\", (c) => c.html(page(\"دخول خاص\", `

مركز خاص

الجسر محمي

استخدم رابط الإدارة الخاص الذي تم إنشاؤه للمالك. لا توجد بيانات TikTok أو مفاتيح ظاهرة في هذه الصفحة.

`)));\napp.get(\"/admin\", async (c) => {\n const provided = c.req.query(\"token\") || \"\";\n const expected = Deno.env.get(\"ADMIN_TOKEN\") || \"\";\n if (!provided || !expected || (await digestHex(provided)) !== (await digestHex(expected))) return c.html(page(\"غير مصرح\", `

رابط الإدارة غير صالح

`), 403);\n await setAdminCookie(c);\n return c.redirect(\"/\");\n});\n\napp.get(\"/\", async (c) => {\n const creds = !!(await getSetting(\"tiktok_client_key\"));\n const conn = await sqlite.execute(`SELECT open_id, display_name, avatar_url, scope, access_expires_at, updated_at FROM tiktok_connections ORDER BY updated_at DESC LIMIT 1`);\n const user = conn.rows[0] as any;\n const connected = !!user;\n return c.html(page(\"TikTok 14444 Bridge\", `\n

مركز القيادة · TikTok 14444

جسر TikTok الرسمي

اتصال OAuth مجاني ومخصص. لا تُحفظ كلمة مرور TikTok هنا، ولا تظهر مفاتيح التطبيق أو رموز الوصول في المتصفح.

مفاتيح TikTok Developer

${creds ? \"تم إعدادها بأمان\" : \"بانتظار إعداد Client Key وClient Secret\"}

${creds ? \"جاهز\" : \"مطلوب\"}

حساب TikTok

${connected ? `متصل${user.display_name ? ` باسم ${user.display_name}` : \"\"}` : \"لم يكتمل تفويض OAuth بعد\"}

${connected ? \"متصل\" : \"غير متصل\"}

${connected ? `

الصلاحيات${user.scope || \"—\"}

آخر تحديث${new Date(Number(user.updated_at)).toLocaleString(\"ar-SA\")}

` : \"\"}

Redirect URI المطلوب تسجيله في TikTok Developer

${CALLBACK}

يجب أن يطابق هذا الرابط حرفيًا داخل Login Kit في TikTok for Developers.

${creds ? `${connected ? \"إعادة تفويض TikTok\" : \"ربط حساب TikTok\"}` : `الربط ينتظر مفاتيح المطور`}حالة تقنية

\n `));\n});\n\napp.get(\"/setup\", async (c) => {\n const provided = c.req.query(\"token\") || \"\";\n const expected = Deno.env.get(\"SETUP_TOKEN\") || \"\";\n const setupDone = (await getSetting(\"setup_complete\")) === \"1\";\n if (!provided || !expected || (await digestHex(provided)) !== (await digestHex(expected))) return c.html(page(\"غير مصرح\", `

رابط الإعداد غير صالح

استخدم رابط الإعداد الآمن الذي تم إنشاؤه للمشروع.

`), 403);\n if (setupDone) return c.html(page(\"تم الإعداد\", `

آمن

تم حفظ مفاتيح TikTok بالفعل

رابط الإعداد أصبح غير قابل لإعادة كتابة المفاتيح. ارجع إلى مركز القيادة وابدأ التفويض.

مركز القيادة ربط TikTok

`));\n return c.html(page(\"إعداد TikTok Developer\", `\n

إعداد لمرة واحدة

أدخل مفاتيح TikTok Developer

هذه القيم تُرسل مباشرة إلى الخادم وتُشفّر قبل التخزين. لا ترسلها في المحادثة.

\n \n

سجّل هذا Redirect URI أولًا في Login Kit

${CALLBACK}

\n `));\n});\n\napp.post(\"/setup\", async (c) => {\n const form = await c.req.parseBody();\n const provided = String(form.token || \"\");\n const expected = Deno.env.get(\"SETUP_TOKEN\") || \"\";\n if (!provided || !expected || (await digestHex(provided)) !== (await digestHex(expected))) return c.text(\"Forbidden\", 403);\n if ((await getSetting(\"setup_complete\")) === \"1\") return c.text(\"Setup is already locked\", 409);\n const clientKey = String(form.client_key || \"\").trim();\n const clientSecret = String(form.client_secret || \"\").trim();\n if (clientKey.length < 6 || clientSecret.length < 8) return c.text(\"Invalid TikTok Developer credentials\", 400);\n await setSetting(\"tiktok_client_key\", clientKey);\n await setSetting(\"tiktok_client_secret_enc\", await encrypt(clientSecret));\n await setSetting(\"setup_complete\", \"1\");\n await setAdminCookie(c);\n return c.redirect(\"/\");\n});\n\napp.get(\"/repair\", async (c) => {\n const provided = c.req.query(\"token\") || \"\";\n const expected = Deno.env.get(\"REPAIR_TOKEN\") || \"\";\n const used = (await getSetting(\"repair_used\")) === \"1\";\n if (!provided || !expected || (await digestHex(provided)) !== (await digestHex(expected))) return c.html(page(\"غير مصرح\", `

رابط الإصلاح غير صالح

استخدم رابط الإصلاح الخاص الذي تم إنشاؤه لهذا العطل.

`), 403);\n if (used) return c.html(page(\"تم الإصلاح\", `

مغلق بأمان

استُخدم رابط الإصلاح بالفعل

تم تحديث مفاتيح TikTok Developer وإغلاق النموذج ضد إعادة الاستخدام.

`));\n return c.html(page(\"إصلاح TikTok Developer\", `\n

إصلاح لمرة واحدة

صحّح Client Key وClient Secret

خذ القيمتين فقط من TikTok for Developers → Manage apps → تطبيقك → Basic information → Credentials. لا تستخدم App ID ولا رقم الهاتف ولا اسم المستخدم.

قبل الحفظ تأكد من شيئين1) أضف منتج Login Kit إلى التطبيق. 2) سجّل Redirect URI التالي حرفيًا داخل إعدادات Login Kit.

${CALLBACK}

\n \n `));\n});\n\napp.post(\"/repair\", async (c) => {\n const form = await c.req.parseBody();\n const provided = String(form.token || \"\");\n const expected = Deno.env.get(\"REPAIR_TOKEN\") || \"\";\n if (!provided || !expected || (await digestHex(provided)) !== (await digestHex(expected))) return c.text(\"Forbidden\", 403);\n if ((await getSetting(\"repair_used\")) === \"1\") return c.text(\"Repair token already used\", 409);\n const clientKey = String(form.client_key || \"\").trim();\n const clientSecret = String(form.client_secret || \"\").trim();\n if (clientKey.length < 6 || clientSecret.length < 8) return c.text(\"Invalid TikTok Developer credentials\", 400);\n await setSetting(\"tiktok_client_key\", clientKey);\n await setSetting(\"tiktok_client_secret_enc\", await encrypt(clientSecret));\n await setSetting(\"repair_used\", \"1\");\n await sqlite.execute(`DELETE FROM oauth_states`);\n await setAdminCookie(c);\n return c.redirect(\"/connect\");\n});\n\napp.get(\"/connect\", async (c) => {\n const creds = await getCredentials();\n if (!creds) return c.html(page(\"الإعداد ناقص\", `

مفاتيح TikTok Developer غير موجودة

أكمل الإعداد الآمن أولًا.

العودة`), 412);\n const state = b64(crypto.getRandomValues(new Uint8Array(32)));\n const stateHash = await digestHex(state);\n await sqlite.execute({ sql: `DELETE FROM oauth_states WHERE expires_at < ?`, args: [Date.now()] });\n await sqlite.execute({ sql: `INSERT INTO oauth_states(state_hash,expires_at) VALUES(?,?)`, args: [stateHash, Date.now() + 10 * 60 * 1000] });\n const u = new URL(\"https://www.tiktok.com/v2/auth/authorize/\");\n u.searchParams.set(\"client_key\", creds.clientKey);\n u.searchParams.set(\"response_type\", \"code\");\n u.searchParams.set(\"scope\", \"user.info.basic\");\n u.searchParams.set(\"redirect_uri\", CALLBACK);\n u.searchParams.set(\"state\", state);\n return c.redirect(u.toString());\n});\n\napp.get(\"/callback\", async (c) => {\n const error = c.req.query(\"error\");\n if (error) return c.html(page(\"تعذر الربط\", `

TikTok

لم يكتمل التفويض

${c.req.query(\"error_description\") || error}

العودة`), 400);\n const code = c.req.query(\"code\") || \"\";\n const state = c.req.query(\"state\") || \"\";\n if (!code || !state) return c.text(\"Missing OAuth parameters\", 400);\n const stateHash = await digestHex(state);\n const sr = await sqlite.execute({ sql: `SELECT state_hash,expires_at FROM oauth_states WHERE state_hash=? LIMIT 1`, args: [stateHash] });\n const saved = sr.rows[0] as any;\n if (!saved || Number(saved.expires_at) < Date.now()) return c.text(\"OAuth state invalid or expired\", 400);\n await sqlite.execute({ sql: `DELETE FROM oauth_states WHERE state_hash=?`, args: [stateHash] });\n const creds = await getCredentials();\n if (!creds) return c.text(\"Developer credentials missing\", 500);\n const form = new URLSearchParams({ client_key: creds.clientKey, client_secret: creds.clientSecret, code, grant_type: \"authorization_code\", redirect_uri: CALLBACK });\n const tokenRes = await fetch(\"https://open.tiktokapis.com/v2/oauth/token/\", { method: \"POST\", headers: { \"Content-Type\": \"application/x-www-form-urlencoded\", \"Cache-Control\": \"no-cache\" }, body: form });\n const token = await tokenRes.json();\n if (!tokenRes.ok || !token.access_token || !token.refresh_token || !token.open_id) return c.html(page(\"فشل الرمز\", `

تعذر إكمال الربط

${token.error_description || token.error || \"TikTok token exchange failed\"}

العودة`), 502);\n let displayName: string | null = null, avatarUrl: string | null = null;\n try {\n const ur = await fetch(\"https://open.tiktokapis.com/v2/user/info/?fields=open_id,union_id,avatar_url,display_name\", { headers: { Authorization: `Bearer ${token.access_token}` } });\n const uj = await ur.json();\n displayName = uj?.data?.user?.display_name ?? null;\n avatarUrl = uj?.data?.user?.avatar_url ?? null;\n } catch (_) {}\n const now = Date.now();\n await sqlite.execute({ sql: `INSERT INTO tiktok_connections(open_id,access_token_enc,refresh_token_enc,scope,access_expires_at,refresh_expires_at,display_name,avatar_url,connected_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?) ON CONFLICT(open_id) DO UPDATE SET access_token_enc=excluded.access_token_enc,refresh_token_enc=excluded.refresh_token_enc,scope=excluded.scope,access_expires_at=excluded.access_expires_at,refresh_expires_at=excluded.refresh_expires_at,display_name=excluded.display_name,avatar_url=excluded.avatar_url,updated_at=excluded.updated_at`, args: [token.open_id, await encrypt(token.access_token), await encrypt(token.refresh_token), token.scope || c.req.query(\"scopes\") || \"\", now + Number(token.expires_in || 0) * 1000, now + Number(token.refresh_expires_in || 0) * 1000, displayName, avatarUrl, now, now] });\n return c.html(page(\"تم الربط\", `

نجاح

تم ربط TikTok فعليًا ✓

تم استلام رموز OAuth من TikTok وتشفيرها على الخادم. ${displayName ? `الحساب المتصل: ${displayName}.` : \"\"}

مركز القيادة

`));\n});\n\nfunction parseMcpBody(text:string){\n const direct=(()=>{try{return JSON.parse(text)}catch{return null}})();\n if(direct) return direct;\n const lines=text.split(/\\r?\\n/).filter(x=>x.startsWith(\"data:\"));\n for(let i=lines.length-1;i>=0;i--){try{return JSON.parse(lines[i].slice(5).trim())}catch{}}\n return {raw:text.slice(0,2000)};\n}\nasync function mcpRpc(token:string, body:any, sessionId?:string){\n const headers:any={Authorization:`Bearer ${token}`,Accept:\"application/json, text/event-stream\",\"Content-Type\":\"application/json\",\"MCP-Protocol-Version\":\"2025-06-18\"};\n if(sessionId) headers[\"Mcp-Session-Id\"]=sessionId;\n const r=await fetch(MCP_RESOURCE,{method:\"POST\",headers,body:JSON.stringify(body)});\n const text=await r.text();\n return {ok:r.ok,status:r.status,sessionId:r.headers.get(\"mcp-session-id\")||sessionId||null,data:parseMcpBody(text)};\n}\n\nasync function mcpAuthorizeUrl(){\n const clientId=await getSetting(\"tt4b_mcp_client_id\");\n if(!clientId) return null;\n const state=b64(crypto.getRandomValues(new Uint8Array(32)));\n const verifier=b64(crypto.getRandomValues(new Uint8Array(64)));\n const challenge=await pkceChallenge(verifier);\n const hash=await digestHex(state);\n await sqlite.execute({sql:`DELETE FROM mcp_oauth_states WHERE expires_at < ?`,args:[Date.now()]});\n await sqlite.execute({sql:`INSERT INTO mcp_oauth_states(state_hash,verifier_enc,expires_at) VALUES(?,?,?)`,args:[hash,await encrypt(verifier),Date.now()+10*60*1000]});\n const u=new URL(MCP_AUTH);\n u.searchParams.set(\"client_id\",clientId);\n u.searchParams.set(\"response_type\",\"code\");\n u.searchParams.set(\"redirect_uri\",MCP_CALLBACK);\n u.searchParams.set(\"scope\",\"mcp:tt4b\");\n u.searchParams.set(\"state\",state);\n u.searchParams.set(\"code_challenge\",challenge);\n u.searchParams.set(\"code_challenge_method\",\"S256\");\n u.searchParams.set(\"resource\",MCP_RESOURCE);\n return u.toString();\n}\n\napp.get(\"/mcp/start\", async (c) => {\n const provided=c.req.query(\"token\")||\"\";\n const expected=Deno.env.get(\"MCP_START_TOKEN\")||\"\";\n if((await getSetting(\"mcp_start_disabled\"))===\"1\") return c.html(page(\"TikTok MCP\", `

آمن

تم استخدام رابط الربط وإغلاقه

الاتصال الناجح يعطّل رابط البدء تلقائيًا.

`),410);\n if(!provided||!expected||(await digestHex(provided))!==(await digestHex(expected))) return c.html(page(\"غير مصرح\", `

رابط TikTok MCP غير صالح

`),403);\n const target=await mcpAuthorizeUrl();\n if(!target) return c.html(page(\"TikTok MCP\", `

تعذر بدء الاتصال

Dynamic Client Registration غير مكتمل.

`),412);\n await setAdminCookie(c);\n return c.redirect(target);\n});\n\napp.get(\"/mcp/connect\", async (c) => {\n const target=await mcpAuthorizeUrl();\n if(!target) return c.html(page(\"TikTok MCP\", `

MCP Client غير مسجل

الجسر ينتظر Dynamic Client Registration.

`),412);\n return c.redirect(target);\n});\n\napp.get(\"/mcp/callback\", async (c) => {\n const error=c.req.query(\"error\");\n if(error) return c.html(page(\"TikTok MCP\", `

TikTok for Business

لم يكتمل تفويض MCP

${c.req.query(\"error_description\")||error}

`),400);\n const code=c.req.query(\"code\")||\"\",state=c.req.query(\"state\")||\"\";\n if(!code||!state) return c.text(\"Missing MCP OAuth parameters\",400);\n const hash=await digestHex(state);\n const sr=await sqlite.execute({sql:`SELECT verifier_enc,expires_at FROM mcp_oauth_states WHERE state_hash=? LIMIT 1`,args:[hash]});\n const saved=sr.rows[0] as any;\n if(!saved||Number(saved.expires_at)({}));\n if(!tr.ok||!t.access_token) return c.html(page(\"TikTok MCP\", `

تعذر إصدار MCP Token

${t.error_description||t.error||`HTTP ${tr.status}`}

`),502);\n const now=Date.now();\n await sqlite.execute({sql:`INSERT INTO tt4b_mcp_connections(id,access_token_enc,refresh_token_enc,scope,token_type,expires_at,connected_at,updated_at) VALUES(1,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET access_token_enc=excluded.access_token_enc,refresh_token_enc=excluded.refresh_token_enc,scope=excluded.scope,token_type=excluded.token_type,expires_at=excluded.expires_at,updated_at=excluded.updated_at`,args:[await encrypt(String(t.access_token)),t.refresh_token?await encrypt(String(t.refresh_token)):null,String(t.scope||\"mcp:tt4b\"),String(t.token_type||\"Bearer\"),t.expires_in?now+Number(t.expires_in)*1000:null,now,now]});\n await setSetting(\"mcp_start_disabled\",\"1\");\n const probe=await mcpRpc(String(t.access_token),{jsonrpc:\"2.0\",id:1,method:\"initialize\",params:{protocolVersion:\"2025-06-18\",capabilities:{},clientInfo:{name:\"AI1000 TikTok Bridge\",version:\"1.0.0\"}}});\n let discovered=0;\n if(probe.ok){\n await mcpRpc(String(t.access_token),{jsonrpc:\"2.0\",method:\"notifications/initialized\",params:{}},probe.sessionId||undefined);\n const list=await mcpRpc(String(t.access_token),{jsonrpc:\"2.0\",id:2,method:\"tools/list\",params:{}},probe.sessionId||undefined);\n const tools=(list.data as any)?.result?.tools||[];\n if(Array.isArray(tools)){\n discovered=tools.length;\n const catalog=tools.map((x:any)=>({name:x.name,description:String(x.description||\"\").slice(0,500)}));\n await setSetting(\"tt4b_mcp_tool_catalog\",JSON.stringify(catalog));\n await setSetting(\"tt4b_mcp_tool_count\",String(discovered));\n }\n }\n await setAdminCookie(c);\n return c.html(page(\"TikTok MCP\", `

نجاح

تم ربط TikTok for Business MCP ✓

تم إصدار OAuth token وتخزينه مشفرًا، ثم تشغيل الاكتشاف الآلي. الأدوات المكتشفة: ${discovered}.

فحص الاتصال مركز القيادة

`));\n});\n\napp.get(\"/mcp/probe\", async (c) => {\n const r=await sqlite.execute(`SELECT access_token_enc FROM tt4b_mcp_connections WHERE id=1 LIMIT 1`);\n const row=r.rows[0] as any;\n if(!row) return c.html(page(\"TikTok MCP\", `

MCP غير مفوض بعد

تم تسجيل الجسر رسميًا لدى خادم TikTok، لكن OAuth لم يكتمل.

بدء التفويض`),412);\n const token=await decrypt(row.access_token_enc);\n const init=await mcpRpc(token,{jsonrpc:\"2.0\",id:1,method:\"initialize\",params:{protocolVersion:\"2025-06-18\",capabilities:{},clientInfo:{name:\"AI1000 TikTok Bridge\",version:\"1.0.0\"}}});\n if(!init.ok) return c.json({ok:false,stage:\"initialize\",status:init.status,response:init.data},{status:502});\n const list=await mcpRpc(token,{jsonrpc:\"2.0\",id:2,method:\"tools/list\",params:{}},init.sessionId||undefined);\n const tools=(list.data as any)?.result?.tools||[];\n return c.json({ok:list.ok,protocol:init.data,session_id_present:!!init.sessionId,tool_count:Array.isArray(tools)?tools.length:null,tool_names:Array.isArray(tools)?tools.slice(0,100).map((x:any)=>x.name):[],raw:list.ok?undefined:list.data});\n});\n\nasync function mcpFlatAuthorizeUrl(){\n const clientId=await getSetting(\"tt4b_mcp_flat_client_id\");\n if(!clientId) return null;\n const state=b64(crypto.getRandomValues(new Uint8Array(32)));\n const verifier=b64(crypto.getRandomValues(new Uint8Array(64)));\n const challenge=await pkceChallenge(verifier);\n const hash=await digestHex(state);\n await sqlite.execute({sql:`DELETE FROM mcp_flat_oauth_states WHERE expires_at < ?`,args:[Date.now()]});\n await sqlite.execute({sql:`INSERT INTO mcp_flat_oauth_states(state_hash,verifier_enc,expires_at) VALUES(?,?,?)`,args:[hash,await encrypt(verifier),Date.now()+10*60*1000]});\n const u=new URL(MCP_AUTH);\n u.searchParams.set(\"client_id\",clientId);u.searchParams.set(\"response_type\",\"code\");u.searchParams.set(\"redirect_uri\",MCP_FLAT_CALLBACK);u.searchParams.set(\"scope\",\"mcp:tt4b\");u.searchParams.set(\"state\",state);u.searchParams.set(\"code_challenge\",challenge);u.searchParams.set(\"code_challenge_method\",\"S256\");u.searchParams.set(\"resource\",MCP_FLAT_RESOURCE);\n return u.toString();\n}\napp.get(\"/mcp-flat/start\",async(c)=>{const provided=c.req.query(\"token\")||\"\",expected=Deno.env.get(\"MCP_START_TOKEN\")||\"\";if(!provided||!expected||(await digestHex(provided))!==(await digestHex(expected)))return c.text(\"Forbidden\",403);const target=await mcpFlatAuthorizeUrl();if(!target)return c.text(\"Flat MCP registration missing\",412);await setAdminCookie(c);return c.redirect(target);});\napp.get(\"/mcp-flat/callback\",async(c)=>{\n const code=c.req.query(\"code\")||\"\",state=c.req.query(\"state\")||\"\";if(!code||!state)return c.text(\"Missing flat MCP OAuth parameters\",400);\n const hash=await digestHex(state),sr=await sqlite.execute({sql:`SELECT verifier_enc,expires_at FROM mcp_flat_oauth_states WHERE state_hash=? LIMIT 1`,args:[hash]}),saved=sr.rows[0] as any;if(!saved||Number(saved.expires_at)({}));if(!tr.ok||!t.access_token)return c.html(page(\"TikTok MCP Full\",`

تعذر إصدار Full MCP Token

${t.error_description||t.error||`HTTP ${tr.status}`}

`),502);\n const now=Date.now();await sqlite.execute({sql:`INSERT INTO tt4b_mcp_flat_connections(id,access_token_enc,refresh_token_enc,scope,token_type,expires_at,connected_at,updated_at) VALUES(1,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET access_token_enc=excluded.access_token_enc,refresh_token_enc=excluded.refresh_token_enc,scope=excluded.scope,token_type=excluded.token_type,expires_at=excluded.expires_at,updated_at=excluded.updated_at`,args:[await encrypt(String(t.access_token)),t.refresh_token?await encrypt(String(t.refresh_token)):null,String(t.scope||\"mcp:tt4b\"),String(t.token_type||\"Bearer\"),t.expires_in?now+Number(t.expires_in)*1000:null,now,now]});await setAdminCookie(c);return c.html(page(\"TikTok MCP Full\",`

نجاح

تم ربط Full MCP الاحتياطي ✓

`));\n});\n\napp.get(\"/shop/connect\", async (c) => {\n const creds = await getShopCredentials();\n if (!creds) return c.html(page(\"TikTok Shop\", `

TikTok Shop Creator

الجسر جاهز وينتظر App Key

تم تجهيز مسار Creator OAuth الرسمي. تفعيل هذا المسار يتطلب تطبيقًا في TikTok Shop Partner Center مع Creator API scopes معتمدة.

Redirect URL للتطبيق

${ORIGIN}/shop/callback

لن يتم استخدام كلمة مرور TikTok أو بيانات دفع داخل الجسر.

`), 412);\n const state = b64(crypto.getRandomValues(new Uint8Array(32)));\n const stateHash = await digestHex(`shop:${state}`);\n await sqlite.execute({ sql: `DELETE FROM oauth_states WHERE expires_at < ?`, args: [Date.now()] });\n await sqlite.execute({ sql: `INSERT INTO oauth_states(state_hash,expires_at) VALUES(?,?)`, args: [stateHash, Date.now() + 10 * 60 * 1000] });\n const u = new URL(\"https://shop.tiktok.com/alliance/creator/auth\");\n u.searchParams.set(\"app_key\", creds.appKey);\n u.searchParams.set(\"state\", state);\n return c.redirect(u.toString());\n});\n\napp.get(\"/shop/callback\", async (c) => {\n const code = c.req.query(\"code\") || \"\";\n const state = c.req.query(\"state\") || \"\";\n if (!code || code === \"null\" || !state) return c.html(page(\"TikTok Shop\", `

لم يكتمل تفويض TikTok Shop

${c.req.query(\"error\") || \"لم يصل رمز تفويض صالح.\"}

`), 400);\n const stateHash = await digestHex(`shop:${state}`);\n const sr = await sqlite.execute({ sql: `SELECT state_hash,expires_at FROM oauth_states WHERE state_hash=? LIMIT 1`, args: [stateHash] });\n const saved = sr.rows[0] as any;\n if (!saved || Number(saved.expires_at) < Date.now()) return c.text(\"TikTok Shop OAuth state invalid or expired\", 400);\n await sqlite.execute({ sql: `DELETE FROM oauth_states WHERE state_hash=?`, args: [stateHash] });\n const creds = await getShopCredentials();\n if (!creds) return c.text(\"TikTok Shop developer credentials missing\", 500);\n const tokenUrl = new URL(\"https://auth.tiktok-shops.com/api/v2/token/get\");\n tokenUrl.searchParams.set(\"app_key\", creds.appKey);\n tokenUrl.searchParams.set(\"app_secret\", creds.appSecret);\n tokenUrl.searchParams.set(\"auth_code\", code);\n tokenUrl.searchParams.set(\"grant_type\", \"authorized_code\");\n const tr = await fetch(tokenUrl.toString());\n const tj:any = await tr.json();\n const data = tj?.data || tj;\n if (!tr.ok || tj?.code !== 0 || !data?.access_token || !data?.refresh_token || !data?.open_id) return c.html(page(\"TikTok Shop\", `

تعذر إصدار Creator Token

${tj?.message || tj?.msg || \"TikTok Shop token exchange failed\"}

`), 502);\n if (data.user_type !== undefined && Number(data.user_type) !== 1) return c.html(page(\"TikTok Shop\", `

نوع التفويض غير مناسب

تم إيقاف التخزين لأن الرمز المستلم ليس Creator token.

`), 409);\n const scopes = Array.isArray(data.granted_scopes) ? data.granted_scopes.join(\",\") : String(data.granted_scopes || \"\");\n const now = Date.now();\n const aexp = data.access_token_expire_in ? Number(data.access_token_expire_in) * 1000 : null;\n const rexp = data.refresh_token_expire_in ? Number(data.refresh_token_expire_in) * 1000 : null;\n await sqlite.execute({ sql: `INSERT INTO shop_creator_connections(open_id,access_token_enc,refresh_token_enc,granted_scopes,access_expires_at,refresh_expires_at,connected_at,updated_at) VALUES(?,?,?,?,?,?,?,?) ON CONFLICT(open_id) DO UPDATE SET access_token_enc=excluded.access_token_enc,refresh_token_enc=excluded.refresh_token_enc,granted_scopes=excluded.granted_scopes,access_expires_at=excluded.access_expires_at,refresh_expires_at=excluded.refresh_expires_at,updated_at=excluded.updated_at`, args: [String(data.open_id), await encrypt(String(data.access_token)), await encrypt(String(data.refresh_token)), scopes, aexp, rexp, now, now] });\n return c.html(page(\"TikTok Shop\", `

نجاح

تم ربط TikTok Shop Creator ✓

تم تخزين Creator token مشفرًا وفصله عن TikTok Login Kit token.

`));\n});\n\napp.get(\"/api/status\", async (c) => {\n const coreCreds = !!(await getSetting(\"tiktok_client_key\"));\n const shopCreds = !!(await getSetting(\"shop_app_key\"));\n const mcpClient = !!(await getSetting(\"tt4b_mcp_client_id\"));\n const mcpFlatClient = !!(await getSetting(\"tt4b_mcp_flat_client_id\"));\n const r = await sqlite.execute(`SELECT open_id,display_name,scope,access_expires_at,refresh_expires_at,updated_at FROM tiktok_connections ORDER BY updated_at DESC LIMIT 1`);\n const s = await sqlite.execute(`SELECT open_id,granted_scopes,access_expires_at,refresh_expires_at,updated_at FROM shop_creator_connections ORDER BY updated_at DESC LIMIT 1`);\n const m = await sqlite.execute(`SELECT scope,token_type,expires_at,updated_at FROM tt4b_mcp_connections WHERE id=1 LIMIT 1`);\n const mf = await sqlite.execute(`SELECT scope,token_type,expires_at,updated_at FROM tt4b_mcp_flat_connections WHERE id=1 LIMIT 1`);\n const q = await sqlite.execute(`SELECT status,COUNT(*) AS n FROM content_queue GROUP BY status`);\n const row = r.rows[0] as any;\n const shop = s.rows[0] as any;\n const mcp = m.rows[0] as any;\n const mcpFlat = mf.rows[0] as any;\n return c.json({\n ok: true,\n tt4b_mcp: { dynamically_registered: mcpClient, connected: !!mcp, resource: MCP_RESOURCE, connection: mcp ? { scopes:mcp.scope, token_type:mcp.token_type, expires_at:mcp.expires_at?new Date(Number(mcp.expires_at)).toISOString():null, updated_at:new Date(Number(mcp.updated_at)).toISOString() } : null },\n tt4b_mcp_full: { dynamically_registered: mcpFlatClient, connected: !!mcpFlat, resource: MCP_FLAT_RESOURCE, connection: mcpFlat ? { scopes:mcpFlat.scope, token_type:mcpFlat.token_type, expires_at:mcpFlat.expires_at?new Date(Number(mcpFlat.expires_at)).toISOString():null, updated_at:new Date(Number(mcpFlat.updated_at)).toISOString() } : null },\n core: { credentials_configured: coreCreds, connected: !!row, redirect_uri: CALLBACK, connection: row ? { open_id: row.open_id, display_name: row.display_name, scopes: row.scope, access_expires_at: new Date(Number(row.access_expires_at)).toISOString(), refresh_expires_at: new Date(Number(row.refresh_expires_at)).toISOString(), updated_at: new Date(Number(row.updated_at)).toISOString() } : null },\n shop_creator: { credentials_configured: shopCreds, connected: !!shop, connection: shop ? { open_id: shop.open_id, granted_scopes: shop.granted_scopes, updated_at: new Date(Number(shop.updated_at)).toISOString() } : null },\n queue: Object.fromEntries((q.rows as any[]).map((x:any)=>[x.status,Number(x.n)])),\n capabilities: { tt4b_mcp:!!mcp, tt4b_mcp_full:!!mcpFlat, profile_read: !!row, video_list: !!row && String(row.scope||'').includes('video.list'), direct_post: !!row && String(row.scope||'').includes('video.publish'), shop_creator_api: !!shop }\n });\n});\n\napp.onError((err, c) => { console.error(err); secureHeaders(c); return c.html(page(\"خطأ\", `

عطل تقني

تعذر تنفيذ الطلب

تم إيقاف العملية بأمان. لا توجد كلمة مرور TikTok مخزنة في الجسر.

العودة`), 500); });\n\nexport default app.fetch;\n","deleted",false,"label",[14],"7ee5a4e8-0b49-4346-96aa-9beb987e0417",["D",1787169543745],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","جسر OAuth مجاني وآمن لربط TikTok 14444","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/64dc00cc-94d9-47dd-81b1-dde02610d900/square512?exp=1789545599&sig=91cfcc631bd9f3dd8274549c04838d172adf2572755982193460d49bfd04bd62","userId","d01b5ba9-4190-4170-b205-935688c090c0","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019fff33-2891-750b-b930-6536da9aa970","tursoName","7ee5a4e80b49434696aa9beb987e0417","tursoHostname","7ee5a4e80b49434696aa9beb987e0417-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789517443998],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_108":104},"org",{"_9":10,"_102":10,"_103":104,"_56":57,"_105":106,"_107":42},"branch",{"_35":30,"_11":89,"_22":28,"_90":45,"_91":92,"_93":94,"_95":50,"_96":97,"_98":99,"_100":12,"_101":10},"isOwned","main","projectId","forkedBranchId","961078ea-f528-11ef-aa68-569c3dd06744","forkedBranchVersion",91,"forkedProjectPrivacy","forkedProjectId","96102714-f528-11ef-aa68-569c3dd06744","forkedProjectOrgId","019aa807-52c2-709c-928b-2029bae9a558","projectName","userHandle","displayName","avatar","https://avatars.githubusercontent.com/u/290340746?v=4","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_142":143,"_144":145,"_146":147,"_148":42,"_149":42,"_150":42,"_151":32,"_152":-5,"_153":-7,"_154":-7,"_155":63,"_156":42,"_157":42,"_158":-5,"_159":42,"_160":42,"_161":42,"_162":-5},"ENV",{"_113":114,"_115":116,"_117":89,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139,"_140":141},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]