[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_209":210,"_211":212},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_158":-5,"_20":159,"_22":160,"_161":162,"_163":164,"_26":165,"_24":166,"_167":-5,"_168":-5,"_169":52,"_170":171,"_172":43,"_173":-5,"_174":-5,"_175":176},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","StonedSheamus","name","bot-detector","branchName","main","version","path","db.ts","project",{"_33":99,"_13":14,"_44":100,"_101":-5,"_102":52,"_103":104,"_105":104,"_106":107,"_108":-5,"_109":110,"_111":72,"_112":43,"_113":-5,"_114":-5,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":-5,"_126":127,"_128":127,"_129":130,"_131":130,"_132":130,"_133":127,"_134":127,"_135":136,"_137":138,"_139":140,"_141":52},"tree",[55,56,57,58,59],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","38500745-f00c-485f-813c-835b14d9a297","fileId","725abbfa-b0a1-11f1-9048-1607ee4eb77e","parentId","branchId","eef5f215-8cd9-41ea-9861-8707575788d0","branchVersion",19,"latest",true,"createdAt",["D",1789434299195],2,"fileType","script","content","// Storage for the bot-viewer detector — connected broadcasters and their\n// moderator:read:chatters tokens. Mirrors GuildScribe's db.ts / ads_db.ts\n// conventions (INSERT OR REPLACE, broadcaster_id-keyed rows) so behavior\n// matches your other bots if this ever moves into the same monorepo.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function ensureTables() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS oauth_states (state TEXT PRIMARY KEY, expires_at INTEGER)`,\n );\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS broadcasters (\n broadcaster_id TEXT PRIMARY KEY, login TEXT, display_name TEXT,\n subscription_id TEXT, connected_at INTEGER, connected INTEGER NOT NULL DEFAULT 1\n )`,\n );\n // The connecting account's own OAuth token, scope moderator:read:chatters —\n // refreshed on demand (see getValidModToken in twitch.ts). Broadcasters are\n // implicitly moderators of their own channel, so having the broadcaster\n // authorize at /connect is enough; no separate mod account login needed.\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS mod_tokens (\n broadcaster_id TEXT PRIMARY KEY, access_token TEXT NOT NULL, refresh_token TEXT NOT NULL,\n scope TEXT, expires_at INTEGER NOT NULL, updated_at INTEGER NOT NULL\n )`,\n );\n}\n\nexport async function saveOAuthState(state: string, expiresAt: number) {\n await sqlite.execute(\n \"INSERT INTO oauth_states (state, expires_at) VALUES (?,?)\",\n [state, expiresAt],\n );\n}\n\n/** Deletes the state either way (single use), returns whether it was valid. */\nexport async function consumeOAuthState(state: string): Promise {\n const check = await sqlite.execute(\n \"SELECT * FROM oauth_states WHERE state = ? AND expires_at > ?\",\n [\n state,\n Date.now(),\n ],\n );\n await sqlite.execute(\"DELETE FROM oauth_states WHERE state = ?\", [state]);\n return check.rows.length > 0;\n}\n\nexport async function upsertBroadcaster(\n broadcasterId: string,\n login: string,\n displayName: string,\n subscriptionId: string,\n) {\n await sqlite.execute(\n `INSERT OR REPLACE INTO broadcasters (broadcaster_id, login, display_name, subscription_id, connected_at, connected)\n VALUES (?,?,?,?,?,1)`,\n [broadcasterId, login, displayName, subscriptionId, Date.now()],\n );\n}\n\nexport async function getBroadcaster(broadcasterId: string) {\n const res = await sqlite.execute(\n \"SELECT * FROM broadcasters WHERE broadcaster_id = ?\",\n [broadcasterId],\n );\n return res.rows.length ? res.rows[0] : null;\n}\n\n/** This is a personal-use tool, so in practice one channel connects. Used by\n * \"/\" and \"/json\" when no ?channel= query param is given. */\nexport async function getFirstConnectedBroadcaster() {\n const res = await sqlite.execute(\n \"SELECT * FROM broadcasters WHERE connected = 1 ORDER BY connected_at ASC LIMIT 1\",\n );\n return res.rows.length ? res.rows[0] : null;\n}\n\nexport async function saveModToken(\n broadcasterId: string,\n accessToken: string,\n refreshToken: string,\n scope: string,\n expiresAt: number,\n) {\n await sqlite.execute(\n `INSERT OR REPLACE INTO mod_tokens (broadcaster_id, access_token, refresh_token, scope, expires_at, updated_at)\n VALUES (?,?,?,?,?,?)`,\n [broadcasterId, accessToken, refreshToken, scope, expiresAt, Date.now()],\n );\n}\n\nexport async function getModToken(broadcasterId: string) {\n const res = await sqlite.execute(\n \"SELECT * FROM mod_tokens WHERE broadcaster_id = ?\",\n [broadcasterId],\n );\n return res.rows.length ? res.rows[0] : null;\n}","deleted",false,"label",[19],{"_33":91,"_13":92,"_35":93,"_37":-5,"_38":39,"_40":94,"_42":43,"_44":95,"_17":86,"_47":24,"_49":96,"_51":52,"_53":-5,"_67":97,"_18":98},{"_33":83,"_13":84,"_35":85,"_37":-5,"_38":39,"_40":86,"_42":43,"_44":87,"_17":46,"_47":48,"_49":88,"_51":52,"_53":-5,"_67":89,"_18":90},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":80,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_67":81,"_18":82},{"_33":70,"_13":71,"_35":72,"_37":-5,"_38":39,"_40":73,"_42":43,"_44":74,"_17":65,"_47":75,"_49":76,"_51":52,"_53":77,"_67":78,"_18":79},{"_33":60,"_13":61,"_35":62,"_37":-5,"_38":39,"_40":63,"_42":43,"_44":64,"_17":65,"_47":48,"_49":66,"_51":52,"_53":-5,"_67":68,"_18":69},"c92ee92a-14ce-4867-8925-5e290ffb8006","twitch.ts","a3c58130-b09b-11f1-881e-1607ee4eb77e",16,["D",1789434268736],3,"// Twitch Helix API helpers for the bot-viewer detector.\n//\n// Env vars still needed (down from 6 to 4 now that broadcaster/token capture\n// happens automatically via OAuth):\n// TWITCH_CLIENT_ID - your app's Client ID — reuse GuildScribe's\n// TWITCH_CLIENT_SECRET - your app's Client Secret — reuse GuildScribe's\n// TWITCH_BOT_ID - your bot account's numeric user id — reuse GuildScribe's\n// EVENTSUB_SECRET - any random string, used to verify EventSub webhook signatures\n\nimport { getModToken, saveModToken } from \"./db.ts\";\n\nexport const env = (name: string) => {\n const value = Deno.env.get(name);\n if (!value) throw new Error(`Missing environment variable: ${name}`);\n return value;\n};\n\n// ── App access token (client_credentials) — used for Get Users lookups,\n// sending chat messages, and managing EventSub subscriptions. ──\n\nlet cachedAppToken: { token: string; expiresAt: number } | null = null;\n\nexport function invalidateAppToken() {\n cachedAppToken = null;\n}\n\nexport async function getAppToken(): Promise {\n if (cachedAppToken && Date.now() < cachedAppToken.expiresAt) {\n return cachedAppToken.token;\n }\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n grant_type: \"client_credentials\",\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`App token failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n const expiresInMs = Number(data.expires_in ?? 0) * 1000;\n cachedAppToken = {\n token: data.access_token as string,\n expiresAt: Date.now() + Math.max(0, expiresInMs - 60_000),\n };\n return cachedAppToken.token;\n}\n\n// ── Authorization-code OAuth (the broadcaster's own /connect flow) ──\n\nexport async function exchangeCode(code: string, redirectUri: string) {\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n code,\n grant_type: \"authorization_code\",\n redirect_uri: redirectUri,\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`OAuth exchange failed: ${res.status} ${await res.text()}`);\n }\n return await res.json();\n}\n\nexport async function refreshUserToken(refreshToken: string) {\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`Token refresh failed: ${res.status} ${await res.text()}`);\n }\n return await res.json();\n}\n\n/** A valid moderator:read:chatters token for this broadcaster, refreshing\n * (and persisting the refresh) if the stored one is expiring soon. Returns\n * null if this channel was never connected, or the refresh itself fails\n * (revoked) — either way the mod needs to (re)visit /connect. */\nexport async function getValidModToken(\n broadcasterId: string,\n): Promise {\n const row = await getModToken(broadcasterId);\n if (!row) return null;\n if (Date.now() < Number(row.expires_at) - 60_000) {\n return String(row.access_token);\n }\n try {\n const refreshed = await refreshUserToken(String(row.refresh_token));\n const expiresAt = Date.now() +\n Math.max(0, Number(refreshed.expires_in ?? 0) * 1000 - 60_000);\n const scope = Array.isArray(refreshed.scope)\n ? refreshed.scope.join(\" \")\n : String(row.scope ?? \"\");\n await saveModToken(\n broadcasterId,\n refreshed.access_token,\n refreshed.refresh_token ?? String(row.refresh_token),\n scope,\n expiresAt,\n );\n return String(refreshed.access_token);\n } catch (_e) {\n return null;\n }\n}\n\nexport interface TwitchUser {\n id: string;\n login: string;\n display_name: string;\n created_at: string;\n profile_image_url: string;\n}\n\n/** Get Users, batched 100 logins per request (Helix's max). */\nexport async function getUsersByLogin(logins: string[]): Promise {\n const token = await getAppToken();\n const out: TwitchUser[] = [];\n for (let i = 0; i < logins.length; i += 100) {\n const batch = logins.slice(i, i + 100);\n const params = new URLSearchParams();\n for (const l of batch) params.append(\"login\", l);\n const res = await fetch(`https://api.twitch.tv/helix/users?${params}`, {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${token}`,\n },\n });\n if (!res.ok) {\n throw new Error(`Get Users failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n out.push(...data.data);\n }\n return out;\n}\n\n/** The token owner's own Twitch identity — used right after OAuth exchange\n * to find out who just connected, and to resolve moderator_id for Get Chatters. */\nexport async function getSelf(accessToken: string): Promise {\n const res = await fetch(\"https://api.twitch.tv/helix/users\", {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${accessToken}`,\n },\n });\n if (!res.ok) {\n throw new Error(\n `Could not identify token owner: ${res.status} ${await res.text()}`,\n );\n }\n const data = await res.json();\n return data.data[0];\n}\n\nexport interface Chatter {\n user_id: string;\n user_login: string;\n user_name: string;\n}\n\n/** Get Chatters, using the broadcaster's own stored moderator:read:chatters\n * token (broadcasters are implicitly moderators of their own channel, so\n * moderator_id === broadcaster_id here). */\nexport async function getChatters(\n broadcasterId: string,\n modAccessToken: string,\n): Promise {\n const out: Chatter[] = [];\n let cursor: string | undefined;\n do {\n const params = new URLSearchParams({\n broadcaster_id: broadcasterId,\n moderator_id: broadcasterId,\n first: \"1000\",\n });\n if (cursor) params.set(\"after\", cursor);\n const res = await fetch(\n `https://api.twitch.tv/helix/chat/chatters?${params}`,\n {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${modAccessToken}`,\n },\n },\n );\n if (!res.ok) {\n throw new Error(`Get Chatters failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n out.push(...data.data);\n cursor = data.pagination?.cursor || undefined;\n } while (cursor);\n return out;\n}\n\n// ── Sending chat messages (app-token bot flow, same as GuildScribe) ──\n\nexport async function sendChatMessage(\n text: string,\n broadcasterId: string,\n): Promise {\n const message = text.slice(0, 500);\n if (!message.trim()) return true;\n try {\n const send = async (token: string) =>\n fetch(\"https://api.twitch.tv/helix/chat/messages\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n broadcaster_id: broadcasterId,\n sender_id: env(\"TWITCH_BOT_ID\"),\n message,\n }),\n });\n\n let res = await send(await getAppToken());\n if (res.status === 401) {\n invalidateAppToken();\n res = await send(await getAppToken());\n }\n if (!res.ok) {\n console.error(\n `Twitch chat send failed: ${res.status} ${await res.text()}`,\n );\n }\n return res.ok;\n } catch (err) {\n console.error(\"sendChatMessage failed\", err);\n return false;\n }\n}\n\n// ── EventSub subscription management ──\n\nasync function createEventSubSubscription(\n type: string,\n version: string,\n condition: Record,\n callbackUrl: string,\n) {\n const appToken = await getAppToken();\n const res = await fetch(\n \"https://api.twitch.tv/helix/eventsub/subscriptions\",\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${appToken}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n type,\n version,\n condition,\n transport: {\n method: \"webhook\",\n callback: callbackUrl,\n secret: env(\"EVENTSUB_SECRET\"),\n },\n }),\n },\n );\n const text = await res.text();\n if (!res.ok) {\n throw new Error(\n `EventSub subscription failed (${type}): ${res.status} ${text}`,\n );\n }\n return JSON.parse(text).data[0];\n}\n\nexport async function createChatSubscription(\n broadcasterId: string,\n callbackUrl: string,\n) {\n return createEventSubSubscription(\n \"channel.chat.message\",\n \"1\",\n { broadcaster_user_id: broadcasterId, user_id: env(\"TWITCH_BOT_ID\") },\n callbackUrl,\n );\n}\n\nexport async function deleteEventSubSubscription(subscriptionId: string) {\n if (!subscriptionId) return true;\n const appToken = await getAppToken();\n const res = await fetch(\n `https://api.twitch.tv/helix/eventsub/subscriptions?id=${\n encodeURIComponent(subscriptionId)\n }`,\n {\n method: \"DELETE\",\n headers: {\n Authorization: `Bearer ${appToken}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n },\n },\n );\n if (res.status === 404) return true;\n if (!res.ok) {\n throw new Error(\n `EventSub deletion failed: ${res.status} ${await res.text()}`,\n );\n }\n return true;\n}\n\n/** Constant-time string compare, so signature checking doesn't leak timing info. */\nexport function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return diff === 0;\n}\n\nexport async function verifyEventSub(\n req: Request,\n rawBody: string,\n): Promise {\n const id = req.headers.get(\"Twitch-Eventsub-Message-Id\") ?? \"\";\n const timestamp = req.headers.get(\"Twitch-Eventsub-Message-Timestamp\") ?? \"\";\n const received = req.headers.get(\"Twitch-Eventsub-Message-Signature\") ?? \"\";\n if (!id || !timestamp || !received) return false;\n const receivedAt = Date.parse(timestamp);\n if (\n !Number.isFinite(receivedAt) ||\n Math.abs(Date.now() - receivedAt) > 10 * 60 * 1000\n ) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(env(\"EVENTSUB_SECRET\")),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const signature = new Uint8Array(\n await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(id + timestamp + rawBody),\n ),\n );\n const hex = [...signature].map((b) => b.toString(16).padStart(2, \"0\")).join(\n \"\",\n );\n const expected = `sha256=${hex}`;\n return timingSafeEqual(expected, received);\n}","children",[],[61],"cd8fafbf-4252-4f28-bbe6-18065bfca3ef","main.ts","13376976-b09b-11f1-9183-1607ee4eb77e",20,["D",1789434764818],"http","import { Hono } from \"npm:hono\";\nimport {\n consumeOAuthState,\n ensureTables,\n getBroadcaster,\n getFirstConnectedBroadcaster,\n saveModToken,\n saveOAuthState,\n upsertBroadcaster,\n} from \"./db.ts\";\nimport {\n createChatSubscription,\n deleteEventSubSubscription,\n env,\n exchangeCode,\n getChatters,\n getSelf,\n getUsersByLogin,\n getValidModToken,\n sendChatMessage,\n verifyEventSub,\n} from \"./twitch.ts\";\nimport { type BotScoreResult, scoreUser } from \"./botDetection.ts\";\n\nawait ensureTables();\n\nconst app = new Hono();\n\napp.onError((err) => {\n console.error(err);\n return new Response(\n `Error: ${err instanceof Error ? err.message : String(err)}`,\n { status: 500 },\n );\n});\n\nfunction escapeHtml(s: string) {\n return s.replace(\n /[&<>\"']/g,\n (\n c,\n ) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n }[c]!),\n );\n}\n\nfunction page(title: string, body: string) {\n return new Response(\n `${\n escapeHtml(title)\n }\n ${body}`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n\nasync function getFlaggedChatters(\n broadcasterId: string,\n): Promise<{ totalChatters: number; results: BotScoreResult[] } | null> {\n const modToken = await getValidModToken(broadcasterId);\n if (!modToken) return null;\n const chatters = await getChatters(broadcasterId, modToken);\n const users = await getUsersByLogin(chatters.map((ch) => ch.user_login));\n const results = users\n .map(scoreUser)\n .filter((r): r is BotScoreResult => r !== null)\n .sort((a, b) => b.score - a.score);\n return { totalChatters: chatters.length, results };\n}\n\nasync function resolveBroadcasterId(c: any): Promise {\n const q = c.req.query(\"channel\");\n if (q) return q;\n const row = await getFirstConnectedBroadcaster();\n return row ? String(row.broadcaster_id) : null;\n}\n\n// ── Landing page / dashboard ──\n\napp.get(\"/\", async (c) => {\n const broadcasterId = await resolveBroadcasterId(c);\n if (!broadcasterId) {\n return page(\n \"Bot Viewer Detector\",\n `

Bot Viewer Detector

Scans your Twitch chat's current viewer list and flags accounts that look like follow/view-bots, so you can review and block them manually. Nothing is banned automatically.

Connect my channel

After connecting: mod the bot with /mod guildscribebot (or whichever account owns TWITCH_BOT_ID) so it can reply to !botcheck.

`,\n );\n }\n\n const data = await getFlaggedChatters(broadcasterId);\n const broadcaster = await getBroadcaster(broadcasterId);\n if (!data) {\n return page(\n \"Bot Viewer Detector\",\n `

Reconnect needed

This channel's Twitch connection has expired or been revoked.

Reconnect

`,\n );\n }\n\n const rows = data.results\n .map(\n (r) =>\n `${\n escapeHtml(r.displayName)\n }${r.score}${r.accountAgeDays}d${\n escapeHtml(r.reasons.join(\"; \"))\n }`,\n )\n .join(\"\");\n\n return page(\n \"Likely Bot Viewers\",\n `

Likely Bot Viewers${\n broadcaster ? ` — ${escapeHtml(String(broadcaster.display_name))}` : \"\"\n }

${data.totalChatters} chatters checked · ${data.results.length} flagged for review. Heuristic guess, not a certainty — check an account before blocking it.

\n \n \n ${rows || ''}\n

Username	Score	Account age	Why flagged
Nothing flagged right now.

\n \n

Reconnect / grant new permissions

`,\n );\n});\n\napp.get(\"/json\", async (c) => {\n const broadcasterId = await resolveBroadcasterId(c);\n if (!broadcasterId) {\n return c.json({ error: \"No channel connected yet. Visit /connect.\" }, 400);\n }\n const data = await getFlaggedChatters(broadcasterId);\n if (!data) {\n return c.json(\n { error: \"This channel needs to reconnect at /connect.\" },\n 401,\n );\n }\n return c.json({ total_chatters: data.totalChatters, flagged: data.results });\n});\n\n// ── OAuth connect flow ──\n\napp.get(\"/connect\", async (c) => {\n const state = crypto.randomUUID();\n await saveOAuthState(state, Date.now() + 10 * 60 * 1000);\n const url = new URL(c.req.url);\n const auth = new URL(\"https://id.twitch.tv/oauth2/authorize\");\n auth.search = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n redirect_uri: `${url.origin}/callback`,\n response_type: \"code\",\n // Broadcasters are implicitly moderators of their own channel, so\n // authorizing here as the broadcaster covers moderator:read:chatters too.\n scope: \"channel:bot moderator:read:chatters\",\n state,\n }).toString();\n return new Response(null, {\n status: 302,\n headers: { Location: auth.toString() },\n });\n});\n\napp.get(\"/callback\", async (c) => {\n const url = new URL(c.req.url);\n const error = url.searchParams.get(\"error\");\n if (error) {\n return page(\n \"Connection cancelled\",\n `

Connection cancelled

${\n escapeHtml(url.searchParams.get(\"error_description\") ?? error)\n }

`,\n );\n }\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n if (!code || !state) return c.text(\"Missing OAuth code or state\", 400);\n const valid = await consumeOAuthState(state);\n if (!valid) return c.text(\"Invalid or expired OAuth state\", 400);\n\n try {\n const token = await exchangeCode(code, `${url.origin}/callback`);\n const user = await getSelf(token.access_token);\n\n // Reconnecting would otherwise try to create a duplicate\n // channel.chat.message subscription with the same type/condition/\n // callback, which Twitch rejects — clean up first so this is safe to\n // run repeatedly (e.g. to pick up newly requested scopes).\n const existing = await getBroadcaster(user.id);\n if (existing?.subscription_id) {\n try {\n await deleteEventSubSubscription(String(existing.subscription_id));\n } catch (e) {\n console.error(\"eventsub cleanup failed\", e);\n }\n }\n\n const sub = await createChatSubscription(user.id, `${url.origin}/eventsub`);\n await upsertBroadcaster(user.id, user.login, user.display_name, sub.id);\n await saveModToken(\n user.id,\n token.access_token,\n token.refresh_token,\n Array.isArray(token.scope)\n ? token.scope.join(\" \")\n : String(token.scope ?? \"\"),\n Date.now() + Math.max(0, Number(token.expires_in ?? 0) * 1000 - 60_000),\n );\n\n return page(\n \"Connected\",\n `

Connected

${\n escapeHtml(user.display_name)\n } is now connected. !botcheck will work once the bot is modded.

Important: in Twitch chat, run /mod guildscribebot (or whichever account owns TWITCH_BOT_ID) so it can reply.

View dashboard

`,\n );\n } catch (e) {\n console.error(e);\n return page(\n \"Connection failed\",\n `

Connection failed

Could not complete the Twitch connection. Please try again.

`,\n );\n }\n});\n\n// ── EventSub webhook: challenge handshake + incoming chat messages ──\n\napp.post(\"/eventsub\", async (c) => {\n const rawBody = await c.req.text();\n const valid = await verifyEventSub(c.req.raw, rawBody);\n if (!valid) return c.text(\"Invalid signature\", 403);\n\n const messageType = c.req.header(\"Twitch-Eventsub-Message-Type\");\n const payload = JSON.parse(rawBody);\n\n if (messageType === \"webhook_callback_verification\") {\n return c.text(payload.challenge, 200);\n }\n\n if (messageType === \"revocation\") {\n console.error(\"EventSub subscription revoked:\", payload.subscription);\n return c.text(\"\", 200);\n }\n\n if (\n messageType === \"notification\" &&\n payload.subscription?.type === \"channel.chat.message\"\n ) {\n const event = payload.event;\n const text: string = event?.message?.text ?? \"\";\n const broadcasterId: string = event?.broadcaster_user_id;\n\n if (text.trim().toLowerCase().startsWith(\"!botcheck\")) {\n handleBotCheck(broadcasterId).catch((err) =>\n console.error(\"botcheck failed\", err)\n );\n }\n\n return c.text(\"\", 200);\n }\n\n return c.text(\"\", 200);\n});\n\nasync function handleBotCheck(broadcasterId: string) {\n const data = await getFlaggedChatters(broadcasterId);\n if (!data) {\n await sendChatMessage(\n \"🤖 Bot check needs the channel to reconnect — visit /connect.\",\n broadcasterId,\n );\n return;\n }\n const reply = data.results.length === 0\n ? `🤖 No likely bot viewers spotted out of ${data.totalChatters} in chat right now.`\n : `🤖 ${data.results.length} likely bot viewer${\n data.results.length === 1 ? \"\" : \"s\"\n } out of ${data.totalChatters} in chat right now.`;\n await sendChatMessage(reply, broadcasterId);\n}\n\nexport default app.fetch;","botdetector",[],[71],["D",1789434299195],[],[19],"46df2354-64f4-4991-8d06-30482d932865","botDetection.ts","8475738a-b09b-11f1-a52d-1607ee4eb77e",5,["D",1789431761819],"import type { TwitchUser } from \"./twitch.ts\";\n\n// Well-known, legitimate service bots — never flag these regardless of score.\n// Add your own bot accounts here (e.g. your GuildScribe/Hunt & Hoard bot logins).\nconst KNOWN_SAFE_BOTS = new Set([\n \"nightbot\",\n \"streamelements\",\n \"streamlabs\",\n \"moobot\",\n \"soundalerts\",\n \"wizebot\",\n \"fossabot\",\n \"pretzelrocks\",\n \"own3d\",\n \"sery_bot\",\n \"restreambot\",\n \"commanderroot\",\n]);\n\n// Shapes commonly produced by follow/view-bot generator tools.\nconst BOT_NAME_PATTERNS = [\n /^[a-z]{3,12}\\d{5,}$/i, // short word + 5+ trailing digits, e.g. \"coolgamer88421\"\n /^[a-z0-9]{16,}$/i, // long random alphanumeric blob\n];\n\nexport interface BotScoreResult {\n login: string;\n displayName: string;\n score: number;\n reasons: string[];\n accountAgeDays: number;\n profileUrl: string;\n}\n\n/** Returns null if the account isn't flagged at all. */\nexport function scoreUser(user: TwitchUser): BotScoreResult | null {\n const login = user.login.toLowerCase();\n if (KNOWN_SAFE_BOTS.has(login)) return null;\n\n const reasons: string[] = [];\n let score = 0;\n\n const createdAt = new Date(user.created_at).getTime();\n const ageDays = (Date.now() - createdAt) / (1000 * 60 * 60 * 24);\n\n if (ageDays < 3) {\n score += 3;\n reasons.push(`Account is ${ageDays.toFixed(1)} days old`);\n } else if (ageDays < 14) {\n score += 2;\n reasons.push(`Account is only ${Math.round(ageDays)} days old`);\n } else if (ageDays < 45) {\n score += 1;\n reasons.push(`Account is ${Math.round(ageDays)} days old`);\n }\n\n if (\n !user.profile_image_url ||\n user.profile_image_url.includes(\"user-default-pictures\")\n ) {\n score += 2;\n reasons.push(\"Using the default profile picture\");\n }\n\n if (BOT_NAME_PATTERNS.some((p) => p.test(login))) {\n score += 2;\n reasons.push(\"Username matches common bot-generator patterns\");\n }\n\n if (score === 0) return null;\n\n return {\n login: user.login,\n displayName: user.display_name,\n score,\n reasons,\n accountAgeDays: Math.round(ageDays),\n profileUrl: `https://twitch.tv/${user.login}`,\n };\n}",[],[84],"62666a88-9024-4411-9fd6-9955295cd17e","README.md","92e96052-b09b-11f1-b904-1607ee4eb77e",14,["D",1789434214479],"# Bot Viewer Detector\n\nScans your Twitch chat's current viewer list and flags accounts that look like\nfollow/view-bots, so you can review and block them manually. Nothing is banned\nautomatically.\n\n- **`/`** — dashboard: sorted table of flagged accounts with reasons. Once\n connected, this is also the landing page.\n- **`/json`** — same data as JSON.\n- **`!botcheck`** — chat command that replies with just the count, e.g. \"🤖 4\n likely bot viewers out of 212 in chat right now.\"\n\n## What changed from the env-var version\n\nYou no longer set `TWITCH_BROADCASTER_LOGIN` or `TWITCH_MOD_OAUTH_TOKEN` by\nhand. Instead, visiting `/connect` and authorizing on Twitch captures your\nlogin, ID, and a refreshable moderator:read:chatters token automatically — same\nOAuth pattern GuildScribe already uses (`/connect` → Twitch → `/callback`),\nstored in this project's own SQLite database. The token also now refreshes\nitself instead of expiring every ~4 hours.\n\n## How detection works\n\nEach chatter is scored on:\n\n- Account age (younger = more suspicious)\n- Default/missing profile picture\n- Username shape (word+digits, long random strings — common bot-generator\n patterns)\n\nKnown legitimate bots (Nightbot, StreamElements, etc. — see `botDetection.ts`)\nare always excluded. This is heuristic, not certain — glance at a flagged\naccount before blocking it.\n\n## Setup on Val Town\n\n1. Create a new Val Town project and upload `main.ts`, `twitch.ts`, `db.ts`, and\n `botDetection.ts`. Set `main.ts` as the HTTP val entrypoint.\n2. Add these four environment variables (account-level Environment Variables\n page):\n\n | Key | Value |\n | ---------------------- | ------------------------------------------------------------------- |\n | `TWITCH_CLIENT_ID` | your app's Client ID — reuse GuildScribe's |\n | `TWITCH_CLIENT_SECRET` | your app's Client Secret — reuse GuildScribe's |\n | `TWITCH_BOT_ID` | your bot account's numeric user id — reuse GuildScribe's |\n | `EVENTSUB_SECRET` | any random string you make up — doesn't need to match GuildScribe's |\n\n3. Open the val's URL — you'll land on a \"Connect my channel\" page. Click it,\n authorize on Twitch, and you're done: broadcaster login, chatters token, and\n EventSub subscription are all set up automatically in that one step.\n4. In Twitch chat, run `/mod guildscribebot` (or whichever account owns\n `TWITCH_BOT_ID`) if it isn't already modded, so it's allowed to speak.\n5. Type `!botcheck` in chat — you should get a reply within a few seconds.\n6. Reloading `/` from then on shows the dashboard directly, no reconnecting\n needed unless Twitch revokes the authorization.\n\n## Known limitations\n\n- If the stored token ever gets revoked (e.g. you remove the app's access in\n your Twitch settings), `!botcheck` and `/` will say the channel needs to\n reconnect — just visit `/connect` again.\n- `!botcheck` re-scans the whole chatter list on every call, so there's a couple\n seconds of delay before the reply — that's expected, not a bug.",[],[92],"d496d537-568b-465b-b4a8-4b4c42a8f49f",["D",1789431551373],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","cc37ba10-6e6d-4af6-a801-9955c92d23c4","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04ba1-c79f-7319-b4f2-7c4f3772837b","tursoName","d496d537568b465bb4a84b4c42a8f49f","tursoHostname","d496d537568b465bb4a84b4c42a8f49f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789435257646],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_157":153},"org",{"_11":12,"_150":151,"_152":153,"_109":110,"_154":155,"_156":52},"branch",{"_17":73,"_13":16,"_33":39,"_142":99,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":-5,"_148":14,"_149":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Shea Stolp","avatar","https://lh3.googleusercontent.com/a/ACg8ocIWmQgR3gyoMMicg2zCAoN1c7i36qX5mf9gRIdIXm8F2mo-ig=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":99,"_13":14,"_44":204,"_101":-5,"_102":52,"_103":104,"_105":104,"_106":107,"_108":-5,"_109":110,"_111":72,"_112":43,"_113":-5,"_114":-5,"_115":116,"_117":118,"_119":120,"_121":122,"_123":205,"_125":-5,"_126":127,"_128":127,"_129":130,"_131":130,"_132":130,"_133":127,"_134":127,"_135":206,"_137":207,"_139":208,"_141":52},[189,190,191,192,193],"files",[189,190,191,192,193],"counts",{"_178":116,"_179":180,"_181":116,"_32":182,"_183":184},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":177},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches",1,"forks",{"_185":187,"_188":116},"connections",{"_185":116,"_186":116},"count","unfilledCount",4,"emptyCount",{"_33":91,"_13":92,"_35":93,"_37":-5,"_38":39,"_40":94,"_42":43,"_44":95,"_17":86,"_47":24,"_49":96,"_51":52,"_53":-5,"_67":202,"_18":203},{"_33":83,"_13":84,"_35":85,"_37":-5,"_38":39,"_40":86,"_42":43,"_44":87,"_17":46,"_47":48,"_49":88,"_51":52,"_53":-5,"_67":200,"_18":201},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":80,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_67":198,"_18":199},{"_33":70,"_13":71,"_35":72,"_37":-5,"_38":39,"_40":73,"_42":43,"_44":74,"_17":65,"_47":75,"_49":76,"_51":52,"_53":77,"_67":196,"_18":197},{"_33":60,"_13":61,"_35":62,"_37":-5,"_38":39,"_40":63,"_42":43,"_44":64,"_17":65,"_47":48,"_49":66,"_51":52,"_53":-5,"_67":194,"_18":195},[],[61],[],[71],[],[19],[],[84],[],[92],["D",1789431551373],["D",1789435257646],{"_11":12,"_157":153},{"_11":12,"_150":151,"_152":153,"_109":110,"_154":155,"_156":52},{"_17":73,"_13":16,"_33":39,"_142":99,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":-5,"_148":14,"_149":12},"ctx",{"_135":-5,"_174":242,"_243":244,"_245":246,"_247":52,"_248":52,"_249":52,"_250":43,"_251":-5,"_252":-7,"_253":-7,"_254":116,"_255":52,"_256":52,"_257":-5,"_258":52,"_259":52,"_260":52,"_261":-5},"ENV",{"_213":214,"_215":216,"_217":16,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]