LiveChat 💬

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_253":254,"_255":256},"routes/_app.x.$handle.$name",{"_105":104,"_38":52,"_113":95,"_33":114,"_13":14,"_115":-5,"_11":116,"_117":118,"_119":120,"_121":122,"_123":124,"_26":-5,"_125":-5,"_126":-5,"_127":31,"_128":129,"_130":131,"_132":-5,"_133":-5,"_134":135},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_50":51,"_38":52,"_45":53,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":-5,"_64":31,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":88,"_89":90,"_91":92,"_93":31},"version",17,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","52d9fbd6-6ee1-488c-ba49-5340b021dfa3","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":39,"_40":41,"_42":44,"_45":46,"_47":14,"_48":49,"_30":31},"previous",{"_36":37,"_38":39,"_40":41,"_42":43},"deleted",false,"deletedHere","path","database/queries.ts","latestPath","fileId","009ca616-2ef8-11f1-8561-42dde27851f2","name","queries.ts","fileType","script","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { createHmac, randomBytes } from \"node:crypto\";\n\nconst SECRET_KEY = Deno.env.get(\"CHAT_SECRET_KEY\") || \"default-secret-key-change-me\";\n\n// ─── Password Hashing ─────────────────────────────────────────────────────────\nexport function hashPassword(password: string): string {\n return createHmac(\"sha256\", SECRET_KEY).update(password).digest(\"hex\");\n}\n\nexport function verifyPassword(password: string, hash: string): boolean {\n return hashPassword(password) === hash;\n}\n\n// ─── Session ID / Token generation ───────────────────────────────────────────\nexport function generateSessionId(): string {\n return randomBytes(32).toString(\"hex\");\n}\n\n// ─── Users ────────────────────────────────────────────────────────────────────\nexport async function createUser(\n username: string,\n password: string,\n): Promise<{ id: number; username: string; avatar_color: string } | null> {\n const colors = [\"#6366f1\", \"#ec4899\", \"#f59e0b\", \"#10b981\", \"#3b82f6\", \"#ef4444\", \"#8b5cf6\", \"#14b8a6\"];\n const color = colors[Math.floor(Math.random() * colors.length)];\n const hash = hashPassword(password);\n try {\n const result = await sqlite.execute({\n sql: `INSERT INTO users (username, password_hash, avatar_color) VALUES (?, ?, ?)`,\n args: [username, hash, color],\n });\n return { id: Number(result.lastInsertRowid), username, avatar_color: color };\n } catch {\n return null; // username already taken\n }\n}\n\nexport async function getUserByCredentials(username: string, password: string) {\n const result = await sqlite.execute({\n sql: `SELECT id, username, avatar_color, password_hash FROM users WHERE username = ?`,\n args: [username],\n });\n if (!result.rows.length) return null;\n const user = result.rows[0] as {\n id: number; username: string; avatar_color: string; password_hash: string;\n };\n if (!verifyPassword(password, user.password_hash)) return null;\n return { id: user.id, username: user.username, avatar_color: user.avatar_color };\n}\n\n// ─── Sessions ─────────────────────────────────────────────────────────────────\nexport async function createSession(userId: number): Promise {\n const sessionId = generateSessionId();\n const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute({\n sql: `INSERT INTO sessions (id, user_id, expires_at) VALUES (?, ?, ?)`,\n args: [sessionId, userId, expiresAt],\n });\n return sessionId;\n}\n\nexport async function getSessionUser(sessionId: string) {\n const result = await sqlite.execute({\n sql: `SELECT u.id, u.username, u.avatar_color FROM sessions s\n JOIN users u ON u.id = s.user_id\n WHERE s.id = ? AND s.expires_at > datetime('now')`,\n args: [sessionId],\n });\n if (!result.rows.length) return null;\n return result.rows[0] as { id: number; username: string; avatar_color: string };\n}\n\nexport async function deleteSession(sessionId: string) {\n await sqlite.execute({ sql: `DELETE FROM sessions WHERE id = ?`, args: [sessionId] });\n}\n\n// ─── API Tokens (for bookmarklets / external clients) ────────────────────────\nexport async function createApiToken(userId: number): Promise {\n const token = randomBytes(40).toString(\"hex\");\n // tokens never expire — user can generate a new one any time\n await sqlite.execute({\n sql: `INSERT INTO api_tokens (token, user_id) VALUES (?, ?)`,\n args: [token, userId],\n });\n return token;\n}\n\nexport async function getUserByToken(token: string) {\n const result = await sqlite.execute({\n sql: `SELECT u.id, u.username, u.avatar_color FROM api_tokens t\n JOIN users u ON u.id = t.user_id\n WHERE t.token = ?`,\n args: [token],\n });\n if (!result.rows.length) return null;\n return result.rows[0] as { id: number; username: string; avatar_color: string };\n}\n\n// ─── Messages ─────────────────────────────────────────────────────────────────\nexport async function saveMessage(\n userId: number,\n username: string,\n avatarColor: string,\n content: string,\n): Promise {\n const result = await sqlite.execute({\n sql: `INSERT INTO messages (user_id, username, avatar_color, content) VALUES (?, ?, ?, ?)`,\n args: [userId, username, avatarColor, content],\n });\n return Number(result.lastInsertRowid);\n}\n\n/**\n * Returns the most recent `limit` messages in chronological order (oldest first).\n * Default limit = 20 to match the public GET /api/messages contract.\n */\nexport async function getRecentMessages(limit = 20) {\n const result = await sqlite.execute({\n sql: `SELECT id, username, avatar_color, content, created_at\n FROM messages ORDER BY id DESC LIMIT ?`,\n args: [limit],\n });\n return (\n result.rows as {\n id: number; username: string; avatar_color: string; content: string; created_at: string;\n }[]\n ).reverse(); // flip so oldest → newest\n}\n\nexport async function getMessagesSince(lastId: number) {\n const result = await sqlite.execute({\n sql: `SELECT id, username, avatar_color, content, created_at\n FROM messages WHERE id > ? ORDER BY id ASC`,\n args: [lastId],\n });\n return result.rows as {\n id: number; username: string; avatar_color: string; content: string; created_at: string;\n }[];\n}\n","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { createHmac, randomBytes } from \"node:crypto\";\n\nconst SECRET_KEY = Deno.env.get(\"CHAT_SECRET_KEY\") || \"default-secret-key-change-me\";\n\n// ─── Password Hashing ─────────────────────────────────────────────────────────\nexport function hashPassword(password: string): string {\n return createHmac(\"sha256\", SECRET_KEY).update(password).digest(\"hex\");\n}\nexport function verifyPassword(password: string, hash: string): boolean {\n return hashPassword(password) === hash;\n}\n\n// ─── Users ────────────────────────────────────────────────────────────────────\nexport async function createUser(\n username: string,\n password: string,\n): Promise<{ id: number; username: string; avatar_color: string } | null> {\n const colors = [\"#6366f1\", \"#ec4899\", \"#f59e0b\", \"#10b981\", \"#3b82f6\", \"#ef4444\", \"#8b5cf6\", \"#14b8a6\"];\n const color = colors[Math.floor(Math.random() * colors.length)];\n const hash = hashPassword(password);\n try {\n const result = await sqlite.execute({\n sql: `INSERT INTO users (username, password_hash, avatar_color) VALUES (?, ?, ?)`,\n args: [username, hash, color],\n });\n return { id: Number(result.lastInsertRowid), username, avatar_color: color };\n } catch {\n return null;\n }\n}\n\nexport async function getUserByCredentials(username: string, password: string) {\n const result = await sqlite.execute({\n sql: `SELECT id, username, avatar_color, password_hash FROM users WHERE username = ?`,\n args: [username],\n });\n if (!result.rows.length) return null;\n const user = result.rows[0] as { id: number; username: string; avatar_color: string; password_hash: string };\n if (!verifyPassword(password, user.password_hash)) return null;\n return { id: user.id, username: user.username, avatar_color: user.avatar_color };\n}\n\n// ─── Sessions ─────────────────────────────────────────────────────────────────\nexport async function createSession(userId: number): Promise {\n const sessionId = randomBytes(32).toString(\"hex\");\n const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute({\n sql: `INSERT INTO sessions (id, user_id, expires_at) VALUES (?, ?, ?)`,\n args: [sessionId, userId, expiresAt],\n });\n return sessionId;\n}\n\nexport async function getSessionUser(sessionId: string) {\n const result = await sqlite.execute({\n sql: `SELECT u.id, u.username, u.avatar_color FROM sessions s\n JOIN users u ON u.id = s.user_id\n WHERE s.id = ? AND s.expires_at > datetime('now')`,\n args: [sessionId],\n });\n if (!result.rows.length) return null;\n return result.rows[0] as { id: number; username: string; avatar_color: string };\n}\n\nexport async function deleteSession(sessionId: string) {\n await sqlite.execute({ sql: `DELETE FROM sessions WHERE id = ?`, args: [sessionId] });\n}\n\n// ─── API Tokens ───────────────────────────────────────────────────────────────\nexport async function createApiToken(userId: number): Promise {\n const token = randomBytes(40).toString(\"hex\");\n await sqlite.execute({\n sql: `INSERT INTO api_tokens (token, user_id) VALUES (?, ?)`,\n args: [token, userId],\n });\n return token;\n}\n\nexport async function getUserByToken(token: string) {\n const result = await sqlite.execute({\n sql: `SELECT u.id, u.username, u.avatar_color FROM api_tokens t\n JOIN users u ON u.id = t.user_id WHERE t.token = ?`,\n args: [token],\n });\n if (!result.rows.length) return null;\n return result.rows[0] as { id: number; username: string; avatar_color: string };\n}\n\n// ─── Messages ─────────────────────────────────────────────────────────────────\nexport async function saveMessage(\n userId: number, username: string, avatarColor: string, content: string,\n): Promise {\n const result = await sqlite.execute({\n sql: `INSERT INTO messages (user_id, username, avatar_color, content) VALUES (?, ?, ?, ?)`,\n args: [userId, username, avatarColor, content],\n });\n return Number(result.lastInsertRowid);\n}\n\n/** Last N messages, only from the past 24 hours, oldest first */\nexport async function getRecentMessages(limit = 20) {\n const result = await sqlite.execute({\n sql: `SELECT id, username, avatar_color, content, created_at\n FROM messages\n WHERE created_at > datetime('now', '-24 hours')\n ORDER BY id DESC LIMIT ?`,\n args: [limit],\n });\n return (result.rows as {\n id: number; username: string; avatar_color: string; content: string; created_at: string;\n }[]).reverse();\n}\n\n/** New messages since lastId, only within 24 hours */\nexport async function getMessagesSince(lastId: number) {\n const result = await sqlite.execute({\n sql: `SELECT id, username, avatar_color, content, created_at\n FROM messages\n WHERE id > ? AND created_at > datetime('now', '-24 hours')\n ORDER BY id ASC`,\n args: [lastId],\n });\n return result.rows as {\n id: number; username: string; avatar_color: string; content: string; created_at: string;\n }[];\n}\n\n/** Delete messages older than 24 hours — call from a cleanup cron */\nexport async function deleteExpiredMessages() {\n const result = await sqlite.execute(\n `DELETE FROM messages WHERE created_at <= datetime('now', '-24 hours')`\n );\n return result.rowsAffected;\n}\n","createdAt",["D",1775179145640],"branchVersion","branchId","f42b2574-2ef7-11f1-ab55-42dde27851f2","id","f42a4ed8-2ef7-11f1-ab55-42dde27851f2","live-groupchat",["D",1775177791326],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Live groupchat with user auth and secure data storage","imageUrl","019d50d6-6e5e-72f9-bffe-0f2f8a74be8e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019d50d6-6e5e-72f9-bffe-12eb0819d881","tursoName","f42a4ed82ef711f1ab5542dde27851f2","tursoHostname","f42a4ed82ef711f1ab5542dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789516253896],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_105":104,"_112":108},"org",{"_105":104,"_106":-5,"_107":108,"_19":62,"_109":110,"_111":31},"branch",{"_13":94,"_38":95,"_50":49,"_96":51,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":52,"_103":104},"isOwned",19,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","MJK","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNCcEVmOEdvazVHU1JjUXNpbkJpOUpRVFE1YSJ9","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_50":51,"_38":52,"_45":248,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":-5,"_64":31,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":249,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":250,"_89":251,"_91":252,"_93":31},"tree",[181,183,186,190],"files",[181,182,183,184,185,186,187,188,189,190],"counts",{"_171":68,"_172":162,"_173":68,"_174":175,"_176":177},"contents",[136,137,138,139],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_50":165,"_38":166,"_36":167,"_143":-5,"_48":49,"_47":168,"_145":131,"_45":169,"_13":68,"_40":157,"_42":-5,"_30":31,"_150":-5,"_33":170},{"_50":159,"_38":160,"_36":161,"_143":-5,"_48":49,"_47":162,"_145":131,"_45":163,"_13":68,"_40":157,"_42":-5,"_30":31,"_150":-5,"_33":164},{"_50":152,"_38":153,"_36":154,"_143":-5,"_48":49,"_47":155,"_145":131,"_45":156,"_13":68,"_40":157,"_42":-5,"_30":31,"_150":-5,"_33":158},{"_50":140,"_38":141,"_36":142,"_143":-5,"_48":49,"_47":144,"_145":131,"_45":146,"_13":147,"_40":148,"_42":149,"_30":31,"_150":-5,"_33":151},"2a938d66-2efa-11f1-8742-42dde27851f2","main.ts","2cb58f1a-2ef8-11f1-9463-42dde27851f2","parentId",15,"latest",["D",1775178741609],2,"http","import { Hono } from \"npm:hono@4\";\nimport { serveFile, parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { runMigrations } from \"./database/migrations.ts\";\nimport {\n createUser, getUserByCredentials,\n createSession, getSessionUser, deleteSession,\n saveMessage, getRecentMessages, getMessagesSince,\n getUserByToken, createApiToken,\n} from \"./database/queries.ts\";\n\nawait runMigrations();\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\n// ─── CORS ────────────────────────────────────────────────────────────────────\n// Applied to EVERY response so bookmarklets on any origin can call the API.\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\n// Handle all preflight OPTIONS requests up-front\napp.options(\"*\", (c) => {\n return new Response(null, { status: 204, headers: CORS_HEADERS });\n});\n\n// Inject CORS headers into every response\napp.use(\"*\", async (c, next) => {\n await next();\n for (const [k, v] of Object.entries(CORS_HEADERS)) c.res.headers.set(k, v);\n});\n\n// ─── Auth helpers ────────────────────────────────────────────────────────────\nfunction getSessionId(req: Request): string | null {\n const cookie = req.headers.get(\"cookie\") || \"\";\n const match = cookie.match(/session=([^;]+)/);\n return match ? match[1] : null;\n}\n\n/** Bearer token from Authorization header (for bookmarklets / API clients) */\nfunction getBearerToken(req: Request): string | null {\n const auth = req.headers.get(\"authorization\") || \"\";\n const match = auth.match(/^Bearer\\s+(.+)$/i);\n return match ? match[1] : null;\n}\n\nfunction sessionCookie(id: string, maxAge = 604800) {\n // SameSite=None + Secure so cross-site bookmarklets can send the cookie too\n return `session=${id}; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=${maxAge}`;\n}\n\n/** Returns the authenticated user via session cookie OR Bearer token */\nasync function requireAuth(c: any) {\n // 1. Session cookie\n const sid = getSessionId(c.req.raw);\n if (sid) {\n const user = await getSessionUser(sid);\n if (user) return user;\n }\n // 2. Bearer API token\n const token = getBearerToken(c.req.raw);\n if (token) {\n const user = await getUserByToken(token);\n if (user) return user;\n }\n return null;\n}\n\n// ─── Auth routes ─────────────────────────────────────────────────────────────\napp.post(\"/api/register\", async (c) => {\n const { username, password } = await c.req.json();\n if (!username || !password) return c.json({ error: \"Username and password required\" }, 400);\n if (username.length < 2 || username.length > 20) return c.json({ error: \"Username must be 2–20 chars\" }, 400);\n if (!/^[a-zA-Z0-9_]+$/.test(username)) return c.json({ error: \"Username: letters, numbers, underscores only\" }, 400);\n if (password.length < 6) return c.json({ error: \"Password must be at least 6 characters\" }, 400);\n const user = await createUser(username, password);\n if (!user) return c.json({ error: \"Username already taken\" }, 409);\n const sid = await createSession(user.id);\n c.header(\"Set-Cookie\", sessionCookie(sid));\n // Also return a Bearer token so cross-origin clients (bookmarklets) don't need cookies\n const token = await createApiToken(user.id);\n return c.json({ user: { id: user.id, username: user.username, avatar_color: user.avatar_color }, token });\n});\n\napp.post(\"/api/login\", async (c) => {\n const { username, password } = await c.req.json();\n if (!username || !password) return c.json({ error: \"Username and password required\" }, 400);\n const user = await getUserByCredentials(username, password);\n if (!user) return c.json({ error: \"Invalid username or password\" }, 401);\n const sid = await createSession(user.id);\n c.header(\"Set-Cookie\", sessionCookie(sid));\n // Also return a Bearer token so cross-origin clients (bookmarklets) don't need cookies\n const token = await createApiToken(user.id);\n return c.json({ user: { id: user.id, username: user.username, avatar_color: user.avatar_color }, token });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const sid = getSessionId(c.req.raw);\n if (sid) await deleteSession(sid);\n c.header(\"Set-Cookie\", sessionCookie(\"\", 0));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await requireAuth(c);\n if (!user) return c.json({ error: \"Unauthorized\" }, 401);\n return c.json({ user });\n});\n\n/** Generate a long-lived API token — useful for bookmarklets */\napp.post(\"/api/token\", async (c) => {\n const user = await requireAuth(c);\n if (!user) return c.json({ error: \"Unauthorized\" }, 401);\n const token = await createApiToken(user.id);\n return c.json({ token });\n});\n\n// ─── Messages ────────────────────────────────────────────────────────────────\n\n/**\n * GET /api/messages\n * Returns the last 20 messages as JSON. No auth required — readable by anyone,\n * including bookmarklets on other sites.\n *\n * Optional query param: ?limit=N (1–100, default 20)\n */\napp.get(\"/api/messages\", async (c) => {\n const limit = Math.min(100, Math.max(1, Number(c.req.query(\"limit\") || \"20\")));\n const messages = await getRecentMessages(limit);\n return c.json({ messages });\n});\n\n/**\n * GET /api/messages/poll?since=\n * Returns all messages with id > lastId. Requires auth.\n */\napp.get(\"/api/messages/poll\", async (c) => {\n const user = await requireAuth(c);\n if (!user) return c.json({ error: \"Unauthorized\" }, 401);\n const since = Number(c.req.query(\"since\") || \"0\");\n const messages = await getMessagesSince(since);\n return c.json({ messages });\n});\n\n/**\n * POST /api/messages\n * Save a new message. Accepts auth via:\n * - Session cookie (in-app users)\n * - Authorization: Bearer (bookmarklets / API clients)\n *\n * Body: { \"content\": \"hello world\" }\n *\n * For unauthenticated bookmarklet use, you can also pass:\n * { \"content\": \"hello\", \"username\": \"myname\", \"api_key\": \"\" }\n * This lets anonymous guests post if you set CHAT_API_KEY in your env.\n */\napp.post(\"/api/messages\", async (c) => {\n const body = await c.req.json();\n\n // --- Authenticated path (session or Bearer token) ---\n let user = await requireAuth(c);\n\n // --- Guest / bookmarklet path (shared API key) ---\n if (!user) {\n const sharedKey = Deno.env.get(\"CHAT_API_KEY\");\n if (sharedKey && body.api_key === sharedKey && body.username) {\n const guestName = String(body.username).replace(/[^a-zA-Z0-9_ ]/g, \"\").slice(0, 20) || \"Guest\";\n user = { id: 0, username: guestName, avatar_color: \"#94a3b8\" } as any;\n }\n }\n\n if (!user) return c.json({ error: \"Unauthorized — login or provide a Bearer token / api_key\" }, 401);\n\n const content = String(body.content || \"\").trim().slice(0, 500);\n if (!content) return c.json({ error: \"content is required\" }, 400);\n\n const id = await saveMessage(user.id, user.username, user.avatar_color, content);\n return c.json({ ok: true, id, username: user.username });\n});\n\n// ─── Source & static ─────────────────────────────────────────────────────────\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"*\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\n\nexport default app.fetch;\n","label",[141],"0666cd60-2ef8-11f1-8561-42dde27851f2","frontend","b501ffcf-0dce-4a1c-a1c7-2032c83dbfa9",3,["D",1775177821530],"directory",[153],"f8f9b20a-2ef7-11f1-a3d8-42dde27851f2","database","e057c3b1-c233-4139-b46f-1ca324d9d565",1,["D",1775177799201],[160],"382ce5d6-2ef9-11f1-977e-42dde27851f2","bookmarklet","761c320d-60c7-4a68-9911-89597f56de08",13,["D",1775178334898],[166],"pulls","branches","forks","envVars",{"_178":68,"_180":68},"connections",{"_178":68,"_179":68},"count","unfilledCount","emptyCount",{"_50":165,"_38":166,"_36":167,"_143":-5,"_48":49,"_47":168,"_145":131,"_45":245,"_13":68,"_40":157,"_42":-5,"_30":31,"_150":-5,"_192":246,"_33":247},{"_50":237,"_38":238,"_36":239,"_143":167,"_48":49,"_47":240,"_145":31,"_45":241,"_13":147,"_40":26,"_42":242,"_30":31,"_150":-5,"_192":243,"_33":244},{"_50":159,"_38":160,"_36":161,"_143":-5,"_48":49,"_47":162,"_145":131,"_45":234,"_13":68,"_40":157,"_42":-5,"_30":31,"_150":-5,"_192":235,"_33":236},{"_50":226,"_38":227,"_36":228,"_143":161,"_48":49,"_47":229,"_145":131,"_45":230,"_13":162,"_40":41,"_42":231,"_30":31,"_150":-5,"_192":232,"_33":233},{"_50":222,"_38":39,"_36":37,"_143":161,"_48":49,"_47":14,"_145":131,"_45":223,"_13":147,"_40":41,"_42":44,"_30":31,"_150":-5,"_192":224,"_33":225},{"_50":152,"_38":153,"_36":154,"_143":-5,"_48":49,"_47":155,"_145":131,"_45":219,"_13":68,"_40":157,"_42":-5,"_30":31,"_150":-5,"_192":220,"_33":221},{"_50":211,"_38":212,"_36":213,"_143":154,"_48":49,"_47":214,"_145":131,"_45":215,"_13":162,"_40":26,"_42":216,"_30":31,"_150":-5,"_192":217,"_33":218},{"_50":203,"_38":204,"_36":205,"_143":154,"_48":49,"_47":206,"_145":131,"_45":207,"_13":162,"_40":26,"_42":208,"_30":31,"_150":-5,"_192":209,"_33":210},{"_50":195,"_38":196,"_36":197,"_143":154,"_48":49,"_47":198,"_145":131,"_45":199,"_13":162,"_40":26,"_42":200,"_30":31,"_150":-5,"_192":201,"_33":202},{"_50":140,"_38":141,"_36":142,"_143":-5,"_48":49,"_47":144,"_145":131,"_45":191,"_13":147,"_40":148,"_42":149,"_30":31,"_150":-5,"_192":193,"_33":194},["D",1775178741609],"children",[],[141],"8105b338-2ef8-11f1-8957-42dde27851f2","style.css","170f1bc2-2ef8-11f1-8777-42dde27851f2",12,["D",1775178027556],"*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }\n\n:root {\n --bg: #0f0f13;\n --surface: #1a1a24;\n --surface2: #23232f;\n --border: #2e2e3e;\n --accent: #6366f1;\n --accent-hover: #4f46e5;\n --text: #f1f1f5;\n --muted: #8888aa;\n --error: #ef4444;\n --radius: 12px;\n}\n\nbody {\n font-family: 'Segoe UI', system-ui, sans-serif;\n background: var(--bg);\n color: var(--text);\n height: 100dvh;\n display: flex;\n flex-direction: column;\n}\n\n/* AUTH */\n.screen { display: flex; flex-direction: column; height: 100dvh; }\n\n.auth-box {\n margin: auto;\n background: var(--surface);\n border: 1px solid var(--border);\n border-radius: var(--radius);\n padding: 2.5rem 2rem;\n width: 100%;\n max-width: 380px;\n box-shadow: 0 20px 60px rgba(0,0,0,0.5);\n}\n\n.logo { font-size: 2rem; font-weight: 800; text-align: center; margin-bottom: 0.4rem; }\n.tagline { text-align: center; color: var(--muted); font-size: 0.875rem; margin-bottom: 1.5rem; }\n\n.tab-row { display: flex; border-radius: 8px; background: var(--bg); padding: 4px; gap: 4px; margin-bottom: 1.2rem; }\n.tab {\n flex: 1; padding: 0.5rem; border: none; border-radius: 6px;\n background: transparent; color: var(--muted); cursor: pointer;\n font-size: 0.9rem; font-weight: 600; transition: all 0.2s;\n}\n.tab.active { background: var(--accent); color: white; }\n\n#auth-form { display: flex; flex-direction: column; gap: 0.75rem; }\n\n#auth-form input {\n padding: 0.75rem 1rem; border-radius: 8px;\n border: 1px solid var(--border); background: var(--bg);\n color: var(--text); font-size: 1rem; outline: none; transition: border 0.2s;\n}\n#auth-form input:focus { border-color: var(--accent); }\n\n#auth-form button[type=submit] {\n padding: 0.75rem; border-radius: 8px; border: none;\n background: var(--accent); color: white; font-size: 1rem;\n font-weight: 700; cursor: pointer; transition: background 0.2s;\n margin-top: 0.25rem;\n}\n#auth-form button[type=submit]:hover { background: var(--accent-hover); }\n\n.error-msg { color: var(--error); font-size: 0.85rem; text-align: center; }\n.source-link { text-align: center; margin-top: 1rem; font-size: 0.8rem; }\n.source-link a { color: var(--muted); text-decoration: none; }\n.source-link a:hover { color: var(--text); }\n\n/* CHAT */\nheader {\n display: flex; align-items: center; justify-content: space-between;\n padding: 1rem 1.5rem; background: var(--surface);\n border-bottom: 1px solid var(--border); flex-shrink: 0;\n}\n.header-left { font-size: 1.1rem; }\n.header-right { display: flex; align-items: center; gap: 0.75rem; color: var(--muted); font-size: 0.875rem; }\n.logout-btn {\n padding: 0.35rem 0.75rem; border-radius: 6px; border: 1px solid var(--border);\n background: transparent; color: var(--muted); cursor: pointer; font-size: 0.85rem;\n transition: all 0.2s;\n}\n.logout-btn:hover { background: var(--error); color: white; border-color: var(--error); }\n\n.messages {\n flex: 1; overflow-y: auto; padding: 1rem 1.5rem;\n display: flex; flex-direction: column; gap: 0.5rem;\n scroll-behavior: smooth;\n}\n.messages::-webkit-scrollbar { width: 6px; }\n.messages::-webkit-scrollbar-track { background: transparent; }\n.messages::-webkit-scrollbar-thumb { background: var(--border); border-radius: 3px; }\n\n.msg {\n display: flex; gap: 0.75rem; align-items: flex-start;\n animation: fadeIn 0.2s ease;\n}\n@keyframes fadeIn { from { opacity: 0; transform: translateY(6px); } to { opacity: 1; transform: none; } }\n\n.avatar {\n width: 36px; height: 36px; border-radius: 50%;\n display: flex; align-items: center; justify-content: center;\n font-weight: 700; font-size: 0.85rem; flex-shrink: 0; color: white;\n text-transform: uppercase;\n}\n\n.msg-body { display: flex; flex-direction: column; gap: 0.15rem; max-width: calc(100% - 50px); }\n.msg-meta { display: flex; align-items: baseline; gap: 0.5rem; }\n.msg-user { font-weight: 700; font-size: 0.875rem; }\n.msg-time { color: var(--muted); font-size: 0.75rem; }\n.msg-text {\n background: var(--surface2); padding: 0.5rem 0.75rem;\n border-radius: 0 12px 12px 12px; font-size: 0.95rem;\n line-height: 1.5; word-break: break-word;\n border: 1px solid var(--border);\n}\n\n.msg.own { flex-direction: row-reverse; }\n.msg.own .msg-meta { flex-direction: row-reverse; }\n.msg.own .msg-text {\n background: var(--accent); border-color: var(--accent);\n border-radius: 12px 0 12px 12px;\n}\n\n.divider {\n text-align: center; color: var(--muted); font-size: 0.75rem;\n position: relative; margin: 0.5rem 0;\n}\n.divider::before, .divider::after {\n content: ''; position: absolute; top: 50%;\n width: 40%; height: 1px; background: var(--border);\n}\n.divider::before { left: 0; }\n.divider::after { right: 0; }\n\n.input-area {\n padding: 1rem 1.5rem; background: var(--surface);\n border-top: 1px solid var(--border); flex-shrink: 0;\n}\n.input-area form { display: flex; gap: 0.75rem; }\n#msg-input {\n flex: 1; padding: 0.75rem 1rem; border-radius: 10px;\n border: 1px solid var(--border); background: var(--bg);\n color: var(--text); font-size: 1rem; outline: none; transition: border 0.2s;\n}\n#msg-input:focus { border-color: var(--accent); }\n.input-area button {\n padding: 0.75rem 1.25rem; border-radius: 10px; border: none;\n background: var(--accent); color: white; font-size: 1rem;\n font-weight: 700; cursor: pointer; transition: background 0.2s;\n}\n.input-area button:hover { background: var(--accent-hover); }\n\n.system-msg { text-align: center; color: var(--muted); font-size: 0.8rem; font-style: italic; }\n\n@media (max-width: 500px) {\n .auth-box { border-radius: 0; border: none; height: 100dvh; display: flex; flex-direction: column; justify-content: center; }\n .messages { padding: 0.75rem; }\n .input-area { padding: 0.75rem; }\n header { padding: 0.75rem 1rem; }\n}\n\n/* ── API Token button ── */\n.token-btn {\n padding: 0.35rem 0.75rem; border-radius: 6px; border: 1px solid var(--border);\n background: transparent; color: var(--muted); cursor: pointer; font-size: 0.85rem;\n transition: all 0.2s;\n}\n.token-btn:hover { background: var(--accent); color: white; border-color: var(--accent); }\n\n/* ── Modal ── */\n.modal-backdrop {\n position: fixed; inset: 0; background: rgba(0,0,0,0.7);\n display: flex; align-items: center; justify-content: center;\n z-index: 100; padding: 1rem;\n}\n.modal {\n background: var(--surface); border: 1px solid var(--border);\n border-radius: var(--radius); padding: 2rem; max-width: 520px; width: 100%;\n box-shadow: 0 24px 60px rgba(0,0,0,0.6); display: flex; flex-direction: column; gap: 1rem;\n}\n.modal h3 { font-size: 1.1rem; }\n.modal p { color: var(--muted); font-size: 0.875rem; line-height: 1.5; }\n.token-display {\n background: var(--bg); border: 1px solid var(--border); border-radius: 8px;\n padding: 0.75rem 1rem; font-family: monospace; font-size: 0.8rem;\n word-break: break-all; color: #a5f3fc;\n}\n.modal-actions { display: flex; gap: 0.75rem; }\n.copy-btn {\n flex: 1; padding: 0.6rem; border-radius: 8px; border: none;\n background: var(--accent); color: white; cursor: pointer; font-weight: 700;\n transition: background 0.2s;\n}\n.copy-btn:hover { background: var(--accent-hover); }\n.close-btn {\n flex: 1; padding: 0.6rem; border-radius: 8px;\n border: 1px solid var(--border); background: transparent;\n color: var(--muted); cursor: pointer; transition: all 0.2s;\n}\n.close-btn:hover { background: var(--border); color: var(--text); }\n\n/* ── Bookmarklet section ── */\n.bookmarklet-section { border-top: 1px solid var(--border); padding-top: 0.75rem; }\n.bookmarklet-section summary {\n cursor: pointer; color: var(--muted); font-size: 0.85rem; user-select: none;\n}\n.code-block {\n margin-top: 0.75rem; background: var(--bg); border: 1px solid var(--border);\n border-radius: 8px; padding: 0.75rem; font-size: 0.75rem; font-family: monospace;\n white-space: pre-wrap; word-break: break-all; color: #86efac; line-height: 1.6;\n max-height: 200px; overflow-y: auto;\n}\n",[],[153,196],"6900f928-2ef8-11f1-982b-42dde27851f2","index.html","0666badc-2ef8-11f1-8561-42dde27851f2",10,["D",1775177987327],"\n\n\n \n \n LiveChat 💬\n \n \n\n\n

💬 LiveChat

Real-time groupchat — join the conversation

\n \n \n

\n \n

view source

\n\n \n\n \n \n\n \n\n\n",[],[153,204],"78c0d068-2ef8-11f1-9449-42dde27851f2","app.js","22d03c98-2ef8-11f1-8174-42dde27851f2",11,["D",1775178013768],"// ─── State ────────────────────────────────────────────────────────────────────\nlet currentUser = null;\nlet lastMessageId = 0;\nlet pollInterval = null;\nlet currentTab = \"login\";\nlet cachedToken = null;\n\n// ─── Helpers ──────────────────────────────────────────────────────────────────\nfunction formatTime(isoStr) {\n const d = new Date(isoStr.endsWith(\"Z\") ? isoStr : isoStr + \"Z\");\n return d.toLocaleTimeString([], { hour: \"2-digit\", minute: \"2-digit\" });\n}\n\nfunction escapeHtml(str) {\n return String(str)\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\n// ─── Tab switching ────────────────────────────────────────────────────────────\nwindow.showTab = function (tab) {\n currentTab = tab;\n document.getElementById(\"tab-login\").classList.toggle(\"active\", tab === \"login\");\n document.getElementById(\"tab-register\").classList.toggle(\"active\", tab === \"register\");\n document.getElementById(\"auth-submit\").textContent =\n tab === \"login\" ? \"Login\" : \"Create Account\";\n document.getElementById(\"auth-error\").style.display = \"none\";\n};\n\n// ─── Auth ─────────────────────────────────────────────────────────────────────\nwindow.submitAuth = async function (e) {\n e.preventDefault();\n const username = document.getElementById(\"auth-username\").value.trim();\n const password = document.getElementById(\"auth-password\").value;\n const errorEl = document.getElementById(\"auth-error\");\n errorEl.style.display = \"none\";\n\n const endpoint = currentTab === \"login\" ? \"/api/login\" : \"/api/register\";\n try {\n const res = await fetch(endpoint, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ username, password }),\n });\n const data = await res.json();\n if (!res.ok) {\n errorEl.textContent = data.error || \"Something went wrong\";\n errorEl.style.display = \"block\";\n return;\n }\n currentUser = data.user;\n showChat();\n } catch {\n errorEl.textContent = \"Network error. Try again.\";\n errorEl.style.display = \"block\";\n }\n};\n\nwindow.logout = async function () {\n await fetch(\"/api/logout\", { method: \"POST\" });\n currentUser = null;\n cachedToken = null;\n lastMessageId = 0;\n clearInterval(pollInterval);\n pollInterval = null;\n document.getElementById(\"chat-screen\").style.display = \"none\";\n document.getElementById(\"auth-screen\").style.display = \"flex\";\n document.getElementById(\"messages\").innerHTML = \"\";\n};\n\n// ─── Chat ─────────────────────────────────────────────────────────────────────\nfunction showChat() {\n document.getElementById(\"auth-screen\").style.display = \"none\";\n document.getElementById(\"chat-screen\").style.display = \"flex\";\n document.getElementById(\"header-user\").textContent = \"👤 \" + currentUser.username;\n loadMessages();\n pollInterval = setInterval(pollMessages, 1500);\n document.getElementById(\"msg-input\").focus();\n}\n\nfunction renderMessage(msg) {\n const isOwn = currentUser && msg.username === currentUser.username;\n const initial = msg.username[0].toUpperCase();\n const div = document.createElement(\"div\");\n div.className = \"msg\" + (isOwn ? \" own\" : \"\");\n div.dataset.id = msg.id;\n div.innerHTML = `\n

${initial}

\n ${isOwn ? \"You\" : escapeHtml(msg.username)}\n ${formatTime(msg.created_at)}\n

${escapeHtml(msg.content)}

`;\n return div;\n}\n\nasync function loadMessages() {\n const res = await fetch(\"/api/messages?limit=20\");\n const data = await res.json();\n const container = document.getElementById(\"messages\");\n container.innerHTML = \"\";\n if (!data.messages.length) {\n container.innerHTML = '

No messages yet. Say hello! 👋

';\n } else {\n data.messages.forEach((m) => container.appendChild(renderMessage(m)));\n lastMessageId = data.messages[data.messages.length - 1].id;\n }\n container.scrollTop = container.scrollHeight;\n}\n\nasync function pollMessages() {\n if (!currentUser) return;\n try {\n const res = await fetch(`/api/messages/poll?since=${lastMessageId}`);\n if (!res.ok) return;\n const data = await res.json();\n if (data.messages?.length) {\n const container = document.getElementById(\"messages\");\n const wasAtBottom =\n container.scrollHeight - container.scrollTop - container.clientHeight < 80;\n const placeholder = container.querySelector(\".system-msg\");\n if (placeholder) placeholder.remove();\n data.messages.forEach((m) => container.appendChild(renderMessage(m)));\n lastMessageId = data.messages[data.messages.length - 1].id;\n if (wasAtBottom) container.scrollTop = container.scrollHeight;\n }\n } catch { /* ignore polling errors */ }\n}\n\nwindow.sendMessage = async function (e) {\n e.preventDefault();\n const input = document.getElementById(\"msg-input\");\n const content = input.value.trim();\n if (!content) return;\n input.value = \"\";\n try {\n await fetch(\"/api/messages\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ content }),\n });\n await pollMessages();\n } catch {\n input.value = content;\n }\n};\n\n// ─── API Token modal ──────────────────────────────────────────────────────────\nconst BASE_URL = window.location.origin;\n\nwindow.showTokenModal = async function () {\n const modal = document.getElementById(\"token-modal\");\n modal.style.display = \"flex\";\n const display = document.getElementById(\"token-display\");\n\n if (cachedToken) {\n display.textContent = cachedToken;\n updateBookmarklet(cachedToken);\n return;\n }\n\n display.textContent = \"Generating…\";\n try {\n const res = await fetch(\"/api/token\", { method: \"POST\" });\n const data = await res.json();\n cachedToken = data.token;\n display.textContent = cachedToken;\n updateBookmarklet(cachedToken);\n } catch {\n display.textContent = \"Error generating token. Try again.\";\n }\n};\n\nfunction updateBookmarklet(token) {\n const code = document.getElementById(\"bookmarklet-code\");\n const snippet = `// Paste in browser console or use as bookmarklet:\nfetch(\"${BASE_URL}/api/messages\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": \"Bearer ${token}\"\n },\n body: JSON.stringify({ content: \"Hello from my bookmarklet!\" })\n}).then(r => r.json()).then(console.log);`;\n code.textContent = snippet;\n}\n\nwindow.copyToken = function () {\n if (!cachedToken) return;\n navigator.clipboard.writeText(cachedToken).then(() => {\n const btn = document.querySelector(\".copy-btn\");\n btn.textContent = \"Copied ✓\";\n setTimeout(() => (btn.textContent = \"Copy\"), 2000);\n });\n};\n\nwindow.closeTokenModal = function (e) {\n if (!e || e.target.id === \"token-modal\") {\n document.getElementById(\"token-modal\").style.display = \"none\";\n }\n};\n\n// ─── Init — check if already logged in ────────────────────────────────────────\n(async () => {\n try {\n const res = await fetch(\"/api/me\");\n if (res.ok) {\n const data = await res.json();\n currentUser = data.user;\n showChat();\n }\n } catch { /* not logged in */ }\n})();\n",[],[153,212],["D",1775177821530],[187,188,189],[153],"1b66a71e-2efb-11f1-b457-42dde27851f2",["D",1775179145640],[],[160,39],"606766a8-2ef8-11f1-a3f4-42dde27851f2","migrations.ts","f8f999f0-2ef7-11f1-a3d8-42dde27851f2",9,["D",1775177972912],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function runMigrations() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n avatar_color TEXT NOT NULL DEFAULT '#6366f1',\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS sessions (\n id TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n expires_at TEXT NOT NULL,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n )\n `);\n\n // Long-lived tokens for bookmarklets / external API clients\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS api_tokens (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS messages (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL DEFAULT 0,\n username TEXT NOT NULL,\n avatar_color TEXT NOT NULL DEFAULT '#94a3b8',\n content TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )\n `);\n}\n",[],[160,227],["D",1775177799201],[184,185],[160],"4e7ab42a-2efa-11f1-a773-42dde27851f2","source.js","382c7858-2ef9-11f1-977e-42dde27851f2",16,["D",1775178801845],"// =============================================================\n// LiveChat — All-in-One Bookmarklet (readable source)\n// Minified version ready to paste as a bookmark URL is at EOF.\n// =============================================================\n(function () {\n var BASE = 'https://MJK--2cb58f1a2ef811f1946342dde27851f2.web.val.run';\n var ID = '__lc';\n\n // ── Toggle: click again to close ─────────────────────────\n if (document.getElementById(ID)) { document.getElementById(ID).remove(); return; }\n\n // ── Persistent state via localStorage ────────────────────\n // Token + username survive page reloads and browser restarts.\n // No login prompt until the token actually fails.\n var token = localStorage.getItem('__lc_tok') || null;\n var me = localStorage.getItem('__lc_me') || null;\n var lastId = 0, timer = null, authTab = 'login';\n\n // ── Build the panel shell ─────────────────────────────────\n var panel = document.createElement('div');\n panel.id = ID;\n\n // Restore saved position/size, or use defaults\n var savedW = parseInt(localStorage.getItem('__lc_w') || '330');\n var savedH = parseInt(localStorage.getItem('__lc_h') || '480');\n var savedX = parseInt(localStorage.getItem('__lc_x') || (window.innerWidth - savedW - 20));\n var savedY = parseInt(localStorage.getItem('__lc_y') || (window.innerHeight - savedH - 20));\n\n panel.style.cssText = [\n 'all:initial',\n 'position:fixed',\n 'left:' + savedX + 'px',\n 'top:' + savedY + 'px',\n 'width:' + savedW + 'px',\n 'height:' + savedH + 'px',\n 'min-width:260px',\n 'min-height:300px',\n 'background:#1a1a24',\n 'border:1px solid #2e2e3e',\n 'border-radius:14px',\n 'z-index:2147483647',\n 'display:flex',\n 'flex-direction:column',\n 'box-shadow:0 12px 40px rgba(0,0,0,.75)',\n 'font-family:system-ui,sans-serif',\n 'overflow:hidden',\n 'resize:both', // native CSS resize handle (bottom-right corner)\n 'user-select:none',\n ].join(';');\n\n document.body.appendChild(panel);\n\n // ── Helper: create element ────────────────────────────────\n function h(tag, css, html, attrs) {\n var n = document.createElement(tag);\n if (css) n.style.cssText = css;\n if (html) n.innerHTML = html;\n if (attrs) Object.assign(n, attrs);\n return n;\n }\n\n // ── Header (drag handle) ──────────────────────────────────\n var hdr = h('div',\n 'background:#23232f;padding:10px 14px;display:flex;justify-content:space-between;align-items:center;border-bottom:1px solid #2e2e3e;flex-shrink:0;cursor:grab;',\n '💬 LiveChat'\n );\n var closeBtn = h('button',\n 'background:none;border:none;color:#888;font-size:22px;cursor:pointer;line-height:1;padding:0;',\n '×'\n );\n closeBtn.onclick = function () { clearInterval(timer); panel.remove(); };\n hdr.appendChild(closeBtn);\n panel.appendChild(hdr);\n\n // ── Drag logic (mouse) ────────────────────────────────────\n var dragging = false, dragStartX, dragStartY, panelStartX, panelStartY;\n hdr.addEventListener('mousedown', function (e) {\n if (e.target === closeBtn) return;\n dragging = true;\n dragStartX = e.clientX; dragStartY = e.clientY;\n panelStartX = panel.offsetLeft; panelStartY = panel.offsetTop;\n hdr.style.cursor = 'grabbing';\n e.preventDefault();\n });\n document.addEventListener('mousemove', function (e) {\n if (!dragging) return;\n var nx = panelStartX + (e.clientX - dragStartX);\n var ny = panelStartY + (e.clientY - dragStartY);\n // clamp inside viewport\n nx = Math.max(0, Math.min(nx, window.innerWidth - panel.offsetWidth));\n ny = Math.max(0, Math.min(ny, window.innerHeight - panel.offsetHeight));\n panel.style.left = nx + 'px';\n panel.style.top = ny + 'px';\n });\n document.addEventListener('mouseup', function () {\n if (!dragging) return;\n dragging = false;\n hdr.style.cursor = 'grab';\n localStorage.setItem('__lc_x', panel.offsetLeft);\n localStorage.setItem('__lc_y', panel.offsetTop);\n });\n\n // ── Track resize via ResizeObserver ──────────────────────\n if (window.ResizeObserver) {\n new ResizeObserver(function () {\n localStorage.setItem('__lc_w', panel.offsetWidth);\n localStorage.setItem('__lc_h', panel.offsetHeight);\n }).observe(panel);\n }\n\n // ── Body slot ─────────────────────────────────────────────\n var body = h('div', 'display:flex;flex-direction:column;flex:1;overflow:hidden;');\n panel.appendChild(body);\n\n // ═══════════════════════════════════════════════════════════\n // AUTH SCREEN\n // ═══════════════════════════════════════════════════════════\n function showAuth() {\n clearInterval(timer);\n body.innerHTML = '';\n var wrap = h('div', 'display:flex;flex-direction:column;gap:10px;padding:24px 18px;flex:1;justify-content:center;');\n body.appendChild(wrap);\n\n wrap.appendChild(h('div', 'color:#f1f1f5;font-size:15px;font-weight:700;text-align:center;margin-bottom:4px;', '💬 LiveChat'));\n\n var tabs = h('div', 'display:flex;background:#0f0f13;border-radius:8px;padding:3px;gap:3px;');\n var tLogin = h('button', 'flex:1;padding:6px;border:none;border-radius:6px;background:#6366f1;color:#fff;cursor:pointer;font-size:13px;font-weight:600;', 'Login');\n var tReg = h('button', 'flex:1;padding:6px;border:none;border-radius:6px;background:transparent;color:#888;cursor:pointer;font-size:13px;font-weight:600;', 'Register');\n tabs.appendChild(tLogin); tabs.appendChild(tReg);\n wrap.appendChild(tabs);\n\n var inpU = h('input', 'padding:9px 12px;border-radius:8px;border:1px solid #2e2e3e;background:#0f0f13;color:#f1f1f5;font-size:14px;outline:none;width:100%;', '', { placeholder: 'Username', type: 'text' });\n var inpP = h('input', 'padding:9px 12px;border-radius:8px;border:1px solid #2e2e3e;background:#0f0f13;color:#f1f1f5;font-size:14px;outline:none;width:100%;', '', { placeholder: 'Password', type: 'password' });\n var errEl = h('div', 'color:#ef4444;font-size:12px;text-align:center;min-height:14px;', '');\n var subBtn = h('button', 'padding:9px;border-radius:8px;border:none;background:#6366f1;color:#fff;font-size:14px;font-weight:700;cursor:pointer;width:100%;', 'Login');\n\n [inpU, inpP, errEl, subBtn].forEach(function (n) { wrap.appendChild(n); });\n setTimeout(function () { inpU.focus(); }, 50);\n\n tLogin.onclick = function () {\n authTab = 'login';\n tLogin.style.background = '#6366f1'; tLogin.style.color = '#fff';\n tReg.style.background = 'transparent'; tReg.style.color = '#888';\n subBtn.textContent = 'Login'; errEl.textContent = '';\n };\n tReg.onclick = function () {\n authTab = 'register';\n tReg.style.background = '#6366f1'; tReg.style.color = '#fff';\n tLogin.style.background = 'transparent'; tLogin.style.color = '#888';\n subBtn.textContent = 'Create Account'; errEl.textContent = '';\n };\n inpP.onkeydown = function (e) { if (e.key === 'Enter') doAuth(); };\n subBtn.onclick = doAuth;\n\n async function doAuth() {\n var u = inpU.value.trim(), p = inpP.value;\n errEl.textContent = '';\n if (!u || !p) { errEl.textContent = 'Fill in both fields'; return; }\n subBtn.textContent = '…'; subBtn.disabled = true;\n try {\n var r = await fetch(BASE + '/api/' + authTab, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ username: u, password: p }),\n });\n var d = await r.json();\n if (!r.ok) {\n errEl.textContent = d.error || 'Error';\n subBtn.textContent = authTab === 'login' ? 'Login' : 'Create Account';\n subBtn.disabled = false;\n return;\n }\n // ✅ Token comes back directly in the login/register response — no cookie needed\n token = d.token;\n me = d.user.username;\n localStorage.setItem('__lc_tok', token);\n localStorage.setItem('__lc_me', me);\n showChat();\n } catch (e) {\n errEl.textContent = 'Network error';\n subBtn.textContent = authTab === 'login' ? 'Login' : 'Create Account';\n subBtn.disabled = false;\n }\n }\n }\n\n // ═══════════════════════════════════════════════════════════\n // CHAT SCREEN\n // ═══════════════════════════════════════════════════════════\n function showChat() {\n body.innerHTML = '';\n\n // Logged-in bar\n var logbar = h('div',\n 'display:flex;justify-content:space-between;align-items:center;padding:5px 14px;background:#23232f;font-size:11px;color:#888;flex-shrink:0;border-bottom:1px solid #2e2e3e;'\n );\n logbar.innerHTML = 'Chatting as ' + me + '';\n var loBtn = h('button', 'background:none;border:none;color:#555;cursor:pointer;font-size:11px;', 'logout');\n loBtn.onclick = doLogout;\n logbar.appendChild(loBtn);\n body.appendChild(logbar);\n\n // Messages list\n var msgs = h('div', 'flex:1;overflow-y:auto;padding:10px;display:flex;flex-direction:column;gap:5px;scroll-behavior:smooth;');\n msgs.innerHTML = '

Loading…

';\n body.appendChild(msgs);\n\n // Input row\n var footer = h('div', 'padding:8px;border-top:1px solid #2e2e3e;display:flex;gap:6px;flex-shrink:0;');\n var inp = h('input',\n 'flex:1;background:#0f0f13;border:1px solid #2e2e3e;border-radius:8px;padding:7px 10px;color:#f1f1f5;font-size:13px;outline:none;',\n '', { placeholder: 'Type a message…', maxLength: 500, type: 'text' }\n );\n var sendBtn = h('button',\n 'background:#6366f1;border:none;border-radius:8px;padding:7px 14px;color:#fff;cursor:pointer;font-weight:700;font-size:13px;',\n 'Send'\n );\n footer.appendChild(inp); footer.appendChild(sendBtn);\n body.appendChild(footer);\n setTimeout(function () { inp.focus(); }, 50);\n\n function addMsg(m) {\n var empty = msgs.querySelector('[data-empty]');\n if (empty) empty.remove();\n var isOwn = m.username === me;\n var d = h('div',\n 'font-size:12px;padding:6px 9px;border-radius:8px;color:#f1f1f5;line-height:1.5;word-break:break-word;background:' + (isOwn ? '#4f46e5' : '#23232f') + ';'\n );\n d.innerHTML = '' + m.username + ': ' + m.content.replace(/

🔑 Your API Token

Diff · v17