[{"_1":2,"_188":-5,"_189":-5},"loaderData",{"_3":4,"_96":97},"root",{"_5":6,"_37":38,"_69":70},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20,"_36":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isBusinessOrgMember","isHigherTownieTier","ENV",{"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","885fdc4f1b65fabe6ae3846465b9d223c7aad292","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","API_URL","https://api.val.town","clerkState",{"_71":72},"__internal_clerk_state",{"_73":74,"_75":48,"_76":77,"_78":77,"_79":20,"_80":77,"_81":77,"_82":77,"_83":77,"_84":85,"_94":20,"_95":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_86":20,"_19":20,"_87":77,"_88":89,"_90":77,"_91":48,"_92":20,"_93":77},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_98":99,"_100":101,"_102":103,"_104":105,"_166":167,"_185":186,"_187":-5},"handle","ray1","name","Huddle","path","index.ts","project",{"_106":107,"_100":101,"_108":109,"_110":-5,"_111":20,"_112":113,"_114":115,"_116":-5,"_12":117,"_118":-5,"_119":20,"_120":-5,"_121":-5,"_122":33,"_14":123,"_124":125,"_126":127,"_128":129,"_130":-5,"_131":132,"_133":132,"_134":135,"_136":135,"_137":135,"_138":132,"_139":132,"_23":140,"_143":144,"_148":149,"_165":20},"id","cb820ada-31cb-11f1-9328-42dde27851f2","createdAt",["D",1775488678722],"deletedAt","legacyEnvVars","privacy","public","description","Huddle - real time messaging app","imageUrl","019d635e-ff25-7250-8356-0c9131dc4373","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019d635e-ff25-7250-8356-13dbc9ef16c1","tursoName","cb820ada31cb11f1932842dde27851f2","tursoHostname","cb820ada31cb11f1932842dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1775575875861],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_98":99,"_141":142},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNCek91VEcwTlB5c3NzSkdUOExjYTBDcGtOaCJ9","org",{"_98":99,"_145":142,"_12":117,"_146":147},"avatar","tier","free","branch",{"_150":151,"_100":46,"_106":152,"_153":107,"_154":155,"_156":157,"_158":113,"_159":160,"_161":162,"_163":101,"_164":99},"version",26,"cb85e358-31cb-11f1-9328-42dde27851f2","projectId","forkedBranchId","9b32896e-30ad-11f1-91e2-42dde27851f2","forkedBranchVersion",8,"forkedProjectPrivacy","forkedProjectId","9b2be866-30ad-11f1-91e2-42dde27851f2","forkedProjectOrgId","019d5c0b-8b96-7535-8705-029f61e9534e","projectName","userHandle","isOwned","file",{"_106":168,"_100":103,"_169":170,"_171":-5,"_172":152,"_173":157,"_174":175,"_108":176,"_150":177,"_178":179,"_180":181,"_182":20,"_183":-5,"_102":184},"a7470fd0-31d0-11f1-967c-42dde27851f2","fileId","019d635f-3b8c-71ce-b261-f4dc334530c1","parentId","branchId","branchVersion","latest",true,["D",1775490765451],5,"fileType","http","content","import { Hono } from \"npm:hono@4\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { serveFile, parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { runMigrations } from \"./database/migrations.ts\";\nimport {\n createUser, getUserByUsername, getUserByEmail, getUserById,\n createSession, getSession, deleteSession,\n createApiToken, getApiToken, deleteApiToken,\n createRoom, getRoomById, getRoomsForUser, getAllRooms, getRoomMembers,\n addRoomMember, removeRoomMember, isRoomMember, inviteToRoom,\n deleteRoom,\n createMessage, getMessages, editMessage, searchMessages, getMessageById, deleteMessage, clearRoom,\n addReaction, removeReaction, getReactionsForRoom,\n setTyping, clearTyping, getTyping,\n blockUser, unblockUser, getBlockedUsers,\n queueMention, getPublicUsers, getAllUsers,\n setGhostMode, banUser, unbanUser, muteUser, unmuteUser,\n updateUserAvatar, updateUserPassword, deleteUser,\n} from \"./database/queries.ts\";\nimport { hashPassword, verifyPassword, generateToken } from \"./shared/auth.ts\";\nimport { sendEmail, mentionEmailHtml, recoveryEmailHtml } from \"./shared/email.ts\";\nimport { ADMIN_USERNAME, ADMIN_PASSWORD, MAX_FILE_SIZE, MAX_AVATAR_SIZE, MISTRAL_API_KEY, CODESTRAL_API_KEY, GROQ_API_KEY, GROQ_ADMIN_MODEL } from \"./shared/types.ts\";\n\nawait runMigrations();\n\nconst adminExists = await getUserByUsername(ADMIN_USERNAME);\nif (!adminExists) {\n const hash = await hashPassword(ADMIN_PASSWORD);\n await createUser(ADMIN_USERNAME, \"admin@huddle.local\", hash, ADMIN_PASSWORD);\n}\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\nasync function getSessionUser(c: any) {\n const sid = getCookie(c, \"hid\");\n if (sid) {\n const session = await getSession(sid);\n if (session) {\n const user = await getUserById(Number(session.user_id));\n if (user) return await checkExpiry(user);\n }\n }\n const auth = c.req.header(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) {\n const token = auth.slice(7);\n const rec = await getApiToken(token);\n if (rec) {\n const user = await getUserById(Number(rec.user_id));\n if (user) return await checkExpiry(user);\n }\n }\n return null;\n}\n\nasync function checkExpiry(user: any) {\n if (user.is_banned && user.ban_expires_at && new Date(user.ban_expires_at as string) < new Date()) {\n await unbanUser(Number(user.id));\n user.is_banned = 0;\n }\n if (user.is_muted && user.mute_expires_at && new Date(user.mute_expires_at as string) < new Date()) {\n await unmuteUser(Number(user.id));\n user.is_muted = 0;\n }\n if (user.is_banned) {\n const isPerm = !user.ban_expires_at;\n const isActive = isPerm || new Date(user.ban_expires_at as string) > new Date();\n if (isActive) return null;\n }\n return user;\n}\n\nfunction isAdmin(user: any) {\n return user && user.username.toLowerCase() === ADMIN_USERNAME.toLowerCase();\n}\n\nfunction userPayload(user: any) {\n return {\n id: Number(user.id),\n username: user.username,\n email: user.email,\n isAdmin: isAdmin(user),\n ghost_mode: user.ghost_mode,\n avatar_blob_key: user.avatar_blob_key,\n };\n}\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,Authorization\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\napp.options(\"*\", (c) => new Response(null, { status: 204, headers: CORS_HEADERS }));\n\napp.use(\"*\", async (c, next) => {\n await next();\n for (const [k, v] of Object.entries(CORS_HEADERS)) {\n c.res.headers.set(k, v);\n }\n});\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\"/bookmarklet\", (c) => serveFile(\"/frontend/bookmarklet.html\", import.meta.url));\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.post(\"/api/signup\", async (c) => {\n const { username, email, password } = await c.req.json();\n if (!username || !email || !password) return c.json({ error: \"All fields required\" }, 400);\n if (password.length < 6) return c.json({ error: \"Password must be at least 6 characters\" }, 400);\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) return c.json({ error: \"Invalid email address\" }, 400);\n if (!/^[a-zA-Z0-9_]{3,20}$/.test(username)) return c.json({ error: \"Username: 3–20 chars, letters/numbers/_ only\" }, 400);\n const existingUser = await getUserByUsername(username);\n if (existingUser) return c.json({ error: \"Username already taken\" }, 409);\n const existingEmail = await getUserByEmail(email);\n if (existingEmail) return c.json({ error: \"Email already registered\" }, 409);\n const hash = await hashPassword(password);\n const userId = await createUser(username, email, hash, password);\n const sid = generateToken();\n await createSession(sid, Number(userId));\n const apiToken = generateToken();\n await createApiToken(apiToken, Number(userId));\n setCookie(c, \"hid\", sid, { httpOnly: true, sameSite: \"Lax\", maxAge: 60 * 60 * 24 * 30 });\n return c.json({ ok: true, apiToken, user: { id: Number(userId), username, email, isAdmin: isAdmin({ username }) } });\n});\n\napp.post(\"/api/login\", async (c) => {\n const { username, password } = await c.req.json();\n if (!username || !password) return c.json({ error: \"Username and password required\" }, 400);\n const user = await getUserByUsername(username);\n if (!user) return c.json({ error: \"Invalid credentials\" }, 401);\n if (user.is_banned) {\n const isPerm = !user.ban_expires_at;\n const isActive = isPerm || new Date(user.ban_expires_at as string) > new Date();\n if (isActive) {\n const msg = user.ban_message ? `\\n\\n${user.ban_message}` : \"\";\n const exp = isPerm ? \" permanently\" : ` until ${new Date(user.ban_expires_at as string).toLocaleString()}`;\n return c.json({ error: `Your account has been banned${exp}.${msg}` }, 403);\n }\n }\n const ok = await verifyPassword(password as string, user.password_hash as string);\n if (!ok) return c.json({ error: \"Invalid credentials\" }, 401);\n const sid = generateToken();\n await createSession(sid, Number(user.id));\n const apiToken = generateToken();\n await createApiToken(apiToken, Number(user.id));\n setCookie(c, \"hid\", sid, { httpOnly: true, sameSite: \"Lax\", maxAge: 60 * 60 * 24 * 30 });\n return c.json({ ok: true, apiToken, user: userPayload(user) });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const sid = getCookie(c, \"hid\");\n if (sid) await deleteSession(sid);\n const auth = c.req.header(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) await deleteApiToken(auth.slice(7));\n deleteCookie(c, \"hid\");\n return c.json({ ok: true });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n return c.json({ user: userPayload(user) });\n});\n\napp.post(\"/api/recover\", async (c) => {\n const { identifier } = await c.req.json();\n if (!identifier) return c.json({ error: \"Email or username required\" }, 400);\n const user = identifier.includes(\"@\") ? await getUserByEmail(identifier) : await getUserByUsername(identifier);\n if (!user) return c.json({ ok: true });\n const plain = user.password_plain as string | null;\n if (!plain) {\n await sendEmail(user.email as string, \"Huddle – Password Recovery\", recoveryEmailHtml(\"[Password recovery not available — please contact admin]\"));\n } else {\n await sendEmail(user.email as string, \"Huddle – Password Recovery\", recoveryEmailHtml(plain));\n }\n return c.json({ ok: true });\n});\n\napp.get(\"/api/users\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (isAdmin(user)) {\n const users = await getAllUsers();\n return c.json({ users });\n }\n const users = await getPublicUsers();\n return c.json({ users });\n});\n\napp.delete(\"/api/users/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const targetId = Number(c.req.param(\"id\"));\n if (Number(user.id) !== targetId && !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const target = await getUserById(targetId);\n if (!target) return c.json({ error: \"User not found\" }, 404);\n if (isAdmin({ username: target.username })) return c.json({ error: \"Cannot delete admin account\" }, 403);\n try {\n await deleteUser(targetId);\n } catch (e: any) {\n console.error(\"deleteUser failed:\", e);\n return c.json({ error: e?.message ?? \"Failed to delete user\" }, 500);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/ghost\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { ghost } = await c.req.json();\n await setGhostMode(Number(user.id), ghost);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/ban\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const targetId = Number(c.req.param(\"id\"));\n const target = await getUserById(targetId);\n if (target && isAdmin({ username: target.username })) return c.json({ error: \"Cannot ban admin account\" }, 403);\n const { duration, message } = await c.req.json();\n const expiresAt = duration ? new Date(Date.now() + duration * 3600000).toISOString() : null;\n await banUser(targetId, expiresAt, message ?? null);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unban\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await unbanUser(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/mute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const targetId = Number(c.req.param(\"id\"));\n const target = await getUserById(targetId);\n if (target && isAdmin({ username: target.username })) return c.json({ error: \"Cannot mute admin account\" }, 403);\n const { duration } = await c.req.json();\n const expiresAt = new Date(Date.now() + (duration || 30) * 60000).toISOString();\n await muteUser(targetId, expiresAt);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unmute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await unmuteUser(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/users/blocked\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const blocked = await getBlockedUsers(Number(user.id));\n return c.json({ blocked });\n});\n\napp.post(\"/api/users/:id/block\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const blockTargetId = Number(c.req.param(\"id\"));\n const blockTarget = await getUserById(blockTargetId);\n if (blockTarget && isAdmin({ username: blockTarget.username })) return c.json({ error: \"Cannot block admin\" }, 403);\n await blockUser(Number(user.id), blockTargetId);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unblock\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n await unblockUser(Number(user.id), Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/avatar\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const formData = await c.req.formData();\n const file = formData.get(\"avatar\") as File | null;\n if (!file) return c.json({ error: \"No file\" }, 400);\n if (file.size > MAX_AVATAR_SIZE) return c.json({ error: \"Avatar max size is 100 KB\" }, 400);\n const key = `huddle_avatar_${user.id}_${Date.now()}`;\n const buf = await file.arrayBuffer();\n await blob.set(key, buf);\n await updateUserAvatar(Number(user.id), key);\n return c.json({ ok: true, key });\n});\n\napp.get(\"/api/blob/:key\", async (c) => {\n const key = c.req.param(\"key\");\n const isAvatar = key.startsWith(\"huddle_avatar_\");\n if (!isAvatar) {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n }\n let buf: ArrayBuffer;\n try {\n const resp = await blob.get(key);\n buf = await resp.arrayBuffer();\n } catch {\n return c.json({ error: \"File not found or has expired\" }, 404);\n }\n const lk = key.toLowerCase();\n const mimeMap: Record = {\n \".jpg\": \"image/jpeg\", \".jpeg\": \"image/jpeg\", \".png\": \"image/png\",\n \".gif\": \"image/gif\", \".webp\": \"image/webp\", \".svg\": \"image/svg+xml\",\n \".pdf\": \"application/pdf\", \".txt\": \"text/plain; charset=utf-8\",\n \".md\": \"text/plain; charset=utf-8\", \".csv\": \"text/csv; charset=utf-8\",\n \".mp4\": \"video/mp4\", \".mp3\": \"audio/mpeg\", \".wav\": \"audio/wav\",\n \".zip\": \"application/zip\", \".json\": \"application/json\",\n \".html\": \"text/html; charset=utf-8\", \".htm\": \"text/html; charset=utf-8\",\n \".js\": \"text/javascript\", \".ts\": \"text/plain; charset=utf-8\", \".css\": \"text/css\",\n \".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n \".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n };\n let ct = \"application/octet-stream\";\n for (const [ext, mime] of Object.entries(mimeMap)) {\n if (lk.endsWith(ext)) { ct = mime; break; }\n }\n if (ct === \"application/octet-stream\") {\n const bytes = new Uint8Array(buf).subarray(0, 4);\n if (bytes[0] === 0xFF && bytes[1] === 0xD8) ct = \"image/jpeg\";\n else if (bytes[0] === 0x89 && bytes[1] === 0x50) ct = \"image/png\";\n else if (bytes[0] === 0x47 && bytes[1] === 0x49) ct = \"image/gif\";\n else if (bytes[0] === 0x52 && bytes[1] === 0x49) ct = \"image/webp\";\n }\n return new Response(buf, {\n headers: {\n \"Content-Type\": ct,\n \"Cache-Control\": isAvatar ? \"public, max-age=86400\" : \"private, max-age=3600\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n});\n\napp.get(\"/api/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n // Admin sees only rooms they are actually a member of (or world chat), just like regular users\n const rooms = await getRoomsForUser(Number(user.id));\n return c.json({ rooms });\n});\n\n// Admin-only: get ALL rooms (for admin panel rooms tab)\napp.get(\"/api/admin/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const rooms = await getAllRooms();\n return c.json({ rooms });\n});\n\napp.post(\"/api/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { name } = await c.req.json();\n if (!name?.trim()) return c.json({ error: \"Room name required\" }, 400);\n const roomId = await createRoom(name.trim(), Number(user.id));\n return c.json({ ok: true, roomId });\n});\n\napp.delete(\"/api/rooms/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type === \"world\") return c.json({ error: \"Cannot delete World Chat\" }, 403);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) return c.json({ error: \"Only the creator can delete this room\" }, 403);\n await deleteRoom(roomId);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/members\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n const adminAndMember = isAdmin(user) && (await isRoomMember(roomId, Number(user.id)));\n if (room.type !== \"world\" && !adminAndMember && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n let members = await getRoomMembers(roomId);\n // If admin is viewing a room they weren't actually invited to, exclude themselves from member list\n if (isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n members = (members as any[]).filter((m: any) => m.username?.toLowerCase() !== ADMIN_USERNAME.toLowerCase());\n }\n return c.json({ members });\n});\n\napp.post(\"/api/rooms/:id/invite\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { username } = await c.req.json();\n if (!username) return c.json({ error: \"Username required\" }, 400);\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n const members = await getRoomMembers(roomId);\n const caller = members.find((m: any) => Number(m.id) === Number(user.id));\n if (!caller || caller.role !== \"owner\") return c.json({ error: \"Only the room owner can invite\" }, 403);\n }\n const target = await getUserByUsername(username);\n if (!target) return c.json({ error: \"User not found\" }, 404);\n await inviteToRoom(roomId, Number(target.id), Number(user.id));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/kick\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { userId } = await c.req.json();\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n const members = await getRoomMembers(roomId);\n const caller = members.find((m: any) => Number(m.id) === Number(user.id));\n if (!caller || caller.role !== \"owner\") return c.json({ error: \"Forbidden\" }, 403);\n }\n const kickTarget = await getUserById(Number(userId));\n if (kickTarget && isAdmin({ username: kickTarget.username })) return c.json({ error: \"Cannot kick admin\" }, 403);\n await removeRoomMember(roomId, Number(userId));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/leave\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n await removeRoomMember(roomId, Number(user.id));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const since = c.req.query(\"since\") ? Number(c.req.query(\"since\")) : undefined;\n const msgs = await getMessages(roomId, since);\n const blocked = await getBlockedUsers(Number(user.id));\n const filtered = isAdmin(user) ? msgs : msgs.filter((m: any) => !blocked.includes(Number(m.user_id)));\n let reactions: any[] = [];\n if (!since) reactions = await getReactionsForRoom(roomId);\n return c.json({ messages: filtered, reactions });\n});\n\napp.get(\"/api/rooms/:id/poll\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const since = Number(c.req.query(\"since\") ?? 0);\n const blocked = await getBlockedUsers(Number(user.id));\n const deadline = Date.now() + 25000;\n while (Date.now() < deadline) {\n const msgs = await getMessages(roomId, since);\n const typing = await getTyping(roomId);\n const typingOthers = typing.filter((u: string) => u !== (user.username as string));\n if (msgs.length > 0) {\n const filtered = isAdmin(user) ? msgs : msgs.filter((m: any) => !blocked.includes(Number(m.user_id)));\n return c.json({ messages: filtered, typing: typingOthers });\n }\n if (typingOthers.length > 0) {\n return c.json({ messages: [], typing: typingOthers });\n }\n await new Promise((r) => setTimeout(r, 1000));\n }\n return c.json({ messages: [], typing: [] });\n});\n\napp.post(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (user.is_muted && user.mute_expires_at && new Date(user.mute_expires_at as string) > new Date()) {\n return c.json({ error: \"You are currently muted\" }, 403);\n }\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const { content, reply_to_id } = await c.req.json();\n if (!content?.trim()) return c.json({ error: \"Message cannot be empty\" }, 400);\n if (content.length > 2000) return c.json({ error: \"Message too long (max 2000 chars)\" }, 400);\n const msgId = await createMessage(roomId, Number(user.id), content.trim(), undefined, undefined, undefined, reply_to_id ? Number(reply_to_id) : undefined);\n const mentionRegex = /@([a-zA-Z0-9_]+)/g;\n let match;\n while ((match = mentionRegex.exec(content)) !== null) {\n const mentioned = await getUserByUsername(match[1]);\n if (mentioned && Number(mentioned.id) !== Number(user.id)) {\n await queueMention(Number(mentioned.id), user.username as string, room.name as string);\n }\n }\n const createdMsg = await getMessageById(Number(msgId));\n return c.json({ ok: true, message: createdMsg ? { ...createdMsg, id: Number((createdMsg as any).id) } : null });\n});\n\napp.post(\"/api/rooms/:id/upload\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (user.is_muted && user.mute_expires_at && new Date(user.mute_expires_at as string) > new Date()) {\n return c.json({ error: \"You are currently muted\" }, 403);\n }\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const formData = await c.req.formData();\n const file = formData.get(\"file\") as File | null;\n if (!file) return c.json({ error: \"No file\" }, 400);\n if (file.size > MAX_FILE_SIZE) return c.json({ error: \"File max size is 200 KB\" }, 400);\n const key = `huddle_file_${roomId}_${user.id}_${Date.now()}_${file.name}`;\n const buf = await file.arrayBuffer();\n await blob.set(key, buf);\n await createMessage(roomId, Number(user.id), null, key, file.name, file.size);\n return c.json({ ok: true });\n});\n\napp.patch(\"/api/messages/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { content } = await c.req.json();\n if (!content?.trim()) return c.json({ error: \"Content required\" }, 400);\n if (content.length > 2000) return c.json({ error: \"Message too long\" }, 400);\n const msg = await getMessageById(msgId);\n if (!msg) return c.json({ error: \"Not found\" }, 404);\n if (Number(msg.user_id) !== Number(user.id) && !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n if (!isAdmin(user)) {\n const createdAt = new Date(msg.created_at as string).getTime();\n if (Date.now() - createdAt > 60 * 1000) return c.json({ error: \"Edit window expired (1 min)\" }, 403);\n }\n await editMessage(msgId, Number(user.id), content.trim());\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/messages/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const msg = await getMessageById(msgId);\n if (!msg) return c.json({ error: \"Not found\" }, 404);\n if (Number(msg.user_id) !== Number(user.id) && !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await deleteMessage(msgId);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n await clearRoom(roomId);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/search\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type !== \"world\" && !isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const q = c.req.query(\"q\") ?? \"\";\n if (q.trim().length < 2) return c.json({ messages: [] });\n const msgs = await searchMessages(roomId, q.trim());\n return c.json({ messages: msgs });\n});\n\napp.post(\"/api/messages/:id/react\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { emoji } = await c.req.json();\n if (!emoji) return c.json({ error: \"Emoji required\" }, 400);\n const ALLOWED = [\"👍\",\"❤️\",\"😂\",\"😮\",\"😢\",\"🔥\",\"👀\",\"🎉\",\"💯\",\"🤔\"];\n if (!ALLOWED.includes(emoji)) return c.json({ error: \"Emoji not allowed\" }, 400);\n await addReaction(msgId, Number(user.id), emoji);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/messages/:id/react\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { emoji } = await c.req.json();\n await removeReaction(msgId, Number(user.id), emoji);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/typing\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { typing } = await c.req.json();\n if (typing) {\n await setTyping(roomId, Number(user.id), user.username as string);\n } else {\n await clearTyping(roomId, Number(user.id));\n }\n return c.json({ ok: true });\n});\n\napp.get(\"/api/link-preview\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const url = c.req.query(\"url\");\n if (!url) return c.json({ error: \"URL required\" }, 400);\n try {\n const resp = await fetch(url, {\n headers: { \"User-Agent\": \"Mozilla/5.0 (compatible; Huddle/1.0)\" },\n signal: AbortSignal.timeout(5000),\n });\n if (!resp.ok) return c.json({ error: \"Failed to fetch\" }, 502);\n const html = await resp.text();\n const getTag = (prop: string) => {\n const m = html.match(new RegExp(`]+(?:property|name)=[\"']${prop}[\"'][^>]+content=[\"']([^\"']+)[\"']`, \"i\"))\n || html.match(new RegExp(`]+content=[\"']([^\"']+)[\"'][^>]+(?:property|name)=[\"']${prop}[\"']`, \"i\"));\n return m?.[1] ?? null;\n };\n const titleMatch = html.match(/]*>([^<]+)<\\/title>/i);\n const title = getTag(\"og:title\") || getTag(\"twitter:title\") || titleMatch?.[1]?.trim() || null;\n const description = getTag(\"og:description\") || getTag(\"twitter:description\") || getTag(\"description\") || null;\n const image = getTag(\"og:image\") || getTag(\"twitter:image\") || null;\n const siteName = getTag(\"og:site_name\") || null;\n return c.json({ title, description, image, siteName, url });\n } catch {\n return c.json({ error: \"Could not fetch URL\" }, 502);\n }\n});\n\n// ─── AI Admin — shared helpers ────────────────────────────────────────────────\n\nasync function buildAdminContext(): Promise<{ context: string; userMap: Record }> {\n const allUsers = await getAllUsers();\n const allRooms = await getAllRooms();\n const userMap: Record = {};\n const nonModUsers = (allUsers as any[]).filter((u: any) => u.username.toLowerCase() !== ADMIN_USERNAME.toLowerCase());\n for (const u of nonModUsers) userMap[u.username.toLowerCase()] = Number(u.id);\n const lines: string[] = [];\n lines.push(`=== USERS (${nonModUsers.length}) ===`);\n for (const u of nonModUsers) {\n const banned = u.is_banned ? ` [BANNED${u.ban_expires_at ? \" until \" + u.ban_expires_at : \" PERM\"}]` : \"\";\n const muted = u.is_muted ? ` [MUTED until ${u.mute_expires_at}]` : \"\";\n lines.push(`@${u.username} (id:${u.id})${banned}${muted}`);\n }\n lines.push(`\\n=== ROOMS (${allRooms.length}) ===`);\n for (const room of allRooms as any[]) {\n lines.push(`[room:${room.id}] ${room.name} (${room.type})`);\n try {\n const msgs = await getMessages(Number(room.id), undefined);\n const all = (msgs as any[]).filter(\n (m: any) => !m.is_deleted && m.username?.toLowerCase() !== ADMIN_USERNAME.toLowerCase()\n );\n let charBudget = 5000;\n const recent: any[] = [];\n for (let i = all.length - 1; i >= 0 && charBudget > 0; i--) {\n const text = all[i].content || \"[file]\";\n charBudget -= text.length;\n recent.unshift(all[i]);\n }\n for (const m of recent) {\n lines.push(` [msg:${m.id}] @${m.username}: ${m.content || \"[file]\"}`);\n }\n } catch {}\n }\n return { context: lines.join(\"\\n\").slice(0, 80000), userMap };\n}\n\nasync function execAdminCommand(lastMsg: string): Promise {\n const deleteMsgMatch = lastMsg.match(/^delete\\s+msg(?:s?|essages?)?\\s+([\\d,\\s]+)/i);\n if (deleteMsgMatch) {\n const ids = deleteMsgMatch[1].split(\",\").map((s: string) => Number(s.trim())).filter((n: number) => n > 0);\n const results: string[] = [];\n for (const msgId of ids) {\n const msg = await getMessageById(msgId);\n if (!msg) { results.push(`Failed: message not found.`); continue; }\n await deleteMessage(msgId);\n results.push(`Done: message removed.`);\n }\n return results.join(\"\\n\");\n }\n const clearRoomMatch = lastMsg.match(/^clear\\s+room\\s+([\\d,\\s]+)/i);\n if (clearRoomMatch) {\n const ids = clearRoomMatch[1].split(\",\").map((s: string) => Number(s.trim())).filter((n: number) => n > 0);\n const results: string[] = [];\n for (const roomId of ids) {\n const room = await getRoomById(roomId);\n if (!room) { results.push(`Failed: room not found.`); continue; }\n await clearRoom(roomId);\n results.push(`Done: cleared all messages in ${(room as any).name}.`);\n }\n return results.join(\"\\n\");\n }\n const actionMatch = lastMsg.match(/^(ban|mute|unban|unmute)\\s+([@\\w,\\s]+?)(?:\\s+(\\d+))?$/i);\n if (actionMatch) {\n const cmd = actionMatch[1].toLowerCase();\n const duration = actionMatch[3] ? Number(actionMatch[3]) : null;\n const usernames = actionMatch[2].split(\",\").map((s: string) => s.trim().replace(/^@/, \"\")).filter(Boolean);\n const results: string[] = [];\n for (const targetUsername of usernames) {\n const target = await getUserByUsername(targetUsername);\n if (!target) { results.push(`Failed: @${targetUsername} not found.`); continue; }\n if (isAdmin({ username: target.username })) { results.push(`Failed: cannot moderate admin.`); continue; }\n if (cmd === \"ban\") {\n const expiresAt = duration ? new Date(Date.now() + duration * 3600000).toISOString() : null;\n await banUser(Number(target.id), expiresAt, null);\n results.push(duration ? `Done: banned @${targetUsername} for ${duration}h.` : `Done: permanently banned @${targetUsername}.`);\n } else if (cmd === \"unban\") {\n await unbanUser(Number(target.id));\n results.push(`Done: unbanned @${targetUsername}.`);\n } else if (cmd === \"mute\") {\n const mins = duration ?? 30;\n await muteUser(Number(target.id), new Date(Date.now() + mins * 60000).toISOString());\n results.push(`Done: muted @${targetUsername} for ${mins}m.`);\n } else if (cmd === \"unmute\") {\n await unmuteUser(Number(target.id));\n results.push(`Done: unmuted @${targetUsername}.`);\n }\n }\n return results.join(\"\\n\");\n }\n return null;\n}\n\n// Shared SSE stream helper\nfunction makeSSEStream(text: string, corsHeaders: Record) {\n const enc = new TextEncoder();\n const readable = new ReadableStream({\n start(controller) {\n controller.enqueue(enc.encode(`data: ${JSON.stringify({ t: text })}\\n\\n`));\n controller.enqueue(enc.encode(\"data: [DONE]\\n\\n\"));\n controller.close();\n },\n });\n return new Response(readable, {\n headers: { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", ...corsHeaders },\n });\n}\n\n// ─── TRIAGE endpoint ──────────────────────────────────────────────────────────\napp.post(\"/api/ai/triage\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n\n const { context } = await buildAdminContext();\n\n const TRIAGE_PROMPT = `You are a moderation triage engine for a user-generated chat app. Scan messages and flag ONLY genuine violations. Be lenient — this is casual social chat.\n\nCONTEXT: Users in the [BANNED] state are already banned. Do NOT suggest banning them again. Skip users already marked [BANNED] entirely.\n\nCATEGORIES (only flag if genuinely serious):\n- CRITICAL: explicit death threats, doxxing personal info, malware/phishing links, illegal content\n- VIOLATION: sustained targeted harassment of a specific user, severe slurs directed at someone, coordinated spam\n\nDO NOT FLAG:\n- Trash talk or insults (\"X sucks\", \"you're bad\", \"idiot\")\n- Venting or frustration (\"I hate this\", \"this is stupid\")\n- Mild offensive language not targeting a person\n- Friendly banter even if slightly crude\n- Criticizing a person's skills, taste, or opinions\n\nABSOLUTE RULES:\n1. Silent on normal messages. Zero mention of them.\n2. No emojis anywhere.\n3. No message IDs or numbers in output.\n4. No restating. Write once.\n5. No preamble, no conclusions, no meta-commentary.\n6. Quotes max 10 words.\n7. Reason: 2-4 words.\n8. Action line: one executable command only.\n9. Skip users already listed as [BANNED] — they are already dealt with.\n\nOUTPUT FORMAT (flagged items only):\n\n--- CRITICAL ---\n@username | \"quote\" | reason\nAction: ban @username\n\n--- VIOLATION ---\n@username | \"quote\" | reason\nAction: mute @username 60\n\nIf nothing is flagged: All clear.\n\n=== DATA ===\n${context}\n=== END ===`;\n\n const resp = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Authorization\": `Bearer ${GROQ_API_KEY}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n model: GROQ_ADMIN_MODEL,\n messages: [{ role: \"system\", content: TRIAGE_PROMPT }, { role: \"user\", content: \"Run triage.\" }],\n max_tokens: 800,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"Triage AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const enc = new TextEncoder();\n const readable = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") { controller.enqueue(enc.encode(\"data: [DONE]\\n\\n\")); continue; }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) controller.enqueue(enc.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`));\n } catch {}\n }\n }\n } catch (e) { console.error(\"Triage stream error:\", e); }\n finally { controller.close(); }\n },\n });\n\n return new Response(readable, {\n headers: { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", \"Connection\": \"keep-alive\", ...CORS_HEADERS },\n });\n});\n\n// ─── Admin execute ────────────────────────────────────────────────────────────\napp.post(\"/api/ai/execute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const { command } = await c.req.json();\n if (!command?.trim()) return c.json({ error: \"Command required\" }, 400);\n const result = await execAdminCommand(command.trim());\n if (result === null) return c.json({ error: \"Unrecognised command\" }, 400);\n return c.json({ ok: true, result });\n});\n\n// ─── Admin chat ───────────────────────────────────────────────────────────────\napp.post(\"/api/ai/admin-chat\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n\n const { messages } = await c.req.json();\n if (!messages?.length) return c.json({ error: \"Messages required\" }, 400);\n\n const lastMsg: string = messages[messages.length - 1]?.content ?? \"\";\n\n // Direct command execution\n const directResult = await execAdminCommand(lastMsg);\n if (directResult !== null) return makeSSEStream(directResult, CORS_HEADERS);\n\n // \"yes\" / \"confirm\" → execute last suggested Action\n const confirmPhrases = /^(yes|confirm|do it|execute|apply|go ahead|yep|ok|okay)[\\s!.]*$/i;\n if (confirmPhrases.test(lastMsg.trim())) {\n for (let i = messages.length - 2; i >= 0; i--) {\n const msg = messages[i];\n if (msg.role !== \"assistant\") continue;\n const actionLines = [...(msg.content?.matchAll(/Action:\\s*(.+)/gi) ?? [])];\n if (actionLines.length > 0) {\n const results: string[] = [];\n for (const al of actionLines) {\n const cmds = al[1].split(\"|\").map((s: string) => s.trim());\n for (const cmd of cmds) {\n const r = await execAdminCommand(cmd);\n if (r) results.push(r);\n }\n }\n if (results.length > 0) return makeSSEStream(results.join(\"\\n\"), CORS_HEADERS);\n }\n }\n return makeSSEStream(\"No pending action found. Provide a specific command.\", CORS_HEADERS);\n }\n\n const { context } = await buildAdminContext();\n\n const CHAT_PROMPT = `You are the Huddle Admin AI — moderation assistant for @${ADMIN_USERNAME}.\n\nCONTEXT: Huddle is a casual user-generated chat app. Be lenient. Not every offensive word is a violation.\nUsers marked [BANNED] are already banned — do NOT suggest banning them again.\n\nRULES:\n1. No storytelling. No summaries of normal chat. Output only what matters.\n2. No emojis anywhere.\n3. No message IDs in output.\n4. No restating. Never write the same content twice.\n5. When scanning: show CRITICAL and VIOLATION only. Silent on normal/borderline messages.\n6. CRITICAL = explicit threats, doxxing, malware, illegal content. VIOLATION = targeted harassment, severe slurs directed at a person, coordinated spam. Trash talk, mild insults, and venting are NOT violations.\n7. Skip users already [BANNED] — do not recommend actions for them.\n8. Format for flagged items:\n\n--- CRITICAL ---\n@username | \"quote\" | reason\nAction: ban @username\n\n--- VIOLATION ---\n@username | \"quote\" | reason\nAction: mute @username 60\n\n9. If nothing flagged: reply exactly \"All clear.\"\n10. Admin can say \"yes\" or \"confirm\" to execute the last Action you suggested — always include Action lines for any recommendation.\n11. Supported commands: ban @user [hours] | unban @user | mute @user [mins] | unmute @user | delete msg | clear room \n12. @${ADMIN_USERNAME} is the admin — never flag them.\n13. Max 250 words per response unless asked for more detail.\n\n=== LIVE DATA ===\n${context}\n=== END ===`;\n\n const resp = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Authorization\": `Bearer ${GROQ_API_KEY}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n model: GROQ_ADMIN_MODEL,\n messages: [{ role: \"system\", content: CHAT_PROMPT }, ...messages],\n max_tokens: 900,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"Admin AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const enc2 = new TextEncoder();\n const readable2 = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") { controller.enqueue(enc2.encode(\"data: [DONE]\\n\\n\")); continue; }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) controller.enqueue(enc2.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`));\n } catch {}\n }\n }\n } catch (e) { console.error(\"Admin AI stream error:\", e); }\n finally { controller.close(); }\n },\n });\n\n return new Response(readable2, {\n headers: { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", \"Connection\": \"keep-alive\", ...CORS_HEADERS },\n });\n});\n\n// ─── AI Chat (Mistral / Codestral) ───────────────────────────────────────────\napp.post(\"/api/ai/chat\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { messages, model } = await c.req.json();\n if (!messages?.length) return c.json({ error: \"Messages required\" }, 400);\n\n const isCodestral = model === \"codestral-latest\";\n const apiKey = isCodestral ? CODESTRAL_API_KEY : MISTRAL_API_KEY;\n const apiUrl = isCodestral\n ? \"https://codestral.mistral.ai/v1/chat/completions\"\n : \"https://api.mistral.ai/v1/chat/completions\";\n const selectedModel = isCodestral ? \"codestral-latest\" : \"mistral-large-latest\";\n const systemPrompt = isCodestral\n ? `You are Codestral, an AI coding assistant built into Huddle. Help with debugging, code generation, code review, and technical questions. Be precise and include code examples.`\n : `You are Mist, a helpful AI assistant built into Huddle — a real-time messaging app. Be concise, friendly, and helpful. Help users with Huddle features and general questions.`;\n\n const resp = await fetch(apiUrl, {\n method: \"POST\",\n headers: { \"Authorization\": `Bearer ${apiKey}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n model: selectedModel,\n messages: [{ role: \"system\", content: systemPrompt }, ...messages],\n max_tokens: 1024,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const encoder = new TextEncoder();\n const readable = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") { controller.enqueue(encoder.encode(\"data: [DONE]\\n\\n\")); continue; }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) controller.enqueue(encoder.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`));\n } catch {}\n }\n }\n } catch (e) { console.error(\"Stream error:\", e); }\n finally { controller.close(); }\n },\n });\n\n return new Response(readable, {\n headers: { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", \"Connection\": \"keep-alive\", ...CORS_HEADERS },\n });\n});\n\nexport default app.fetch;\n","deleted","label",[103],"permalink","https://www.val.town/x/ray1/Huddle/code/index.ts","extension","actionData","errors"]