[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_159":160,"_161":162},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_107":88,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",22,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","undercoverburn-invite.ts","latestPath","fileId","d231d1f6-a586-11f1-9558-1607ee4eb77e","name","fileType","http","content","// Val Town HTTP Val — UndercoverBurn invite/onboarding page\n// ------------------------------------------------------------\n// Set this val's trigger type to \"HTTP\". Once deployed, Val Town gives\n// it a public URL like https://yourname-undercoverburn-invite.val.run\n// — that IS your \"invite bot to channel\" link (share the root URL).\n//\n// This uses Twitch's \"Installed Chatbot\" model:\n// - The BOT's own Twitch account authorizes once with scope user:bot.\n// - Each STREAMER authorizes once with scope channel:bot for their\n// own channel.\n// - Once both exist, an App Access Token (client_credentials grant)\n// can send chat messages into that streamer's channel as the bot —\n// no per-streamer token storage needed, ever.\n//\n// NEW: only reply once at least 5 new chat messages have come in since\n// the bot's last post to that channel. Requires reading chat, which\n// means subscribing to Twitch's EventSub \"channel.chat.message\" feed\n// via a webhook on this val (/eventsub/callback). Every non-bot\n// message increments a per-channel counter; the poster val checks\n// that counter and resets it to 0 whenever it actually posts.\n//\n// NEW: broadcaster live on/off toggle. Subscribes to Twitch's\n// \"stream.online\" / \"stream.offline\" EventSub events per channel and\n// flips a per-channel is_live flag as soon as they fire. The poster\n// val only posts to channels where is_live = 1, so the bot goes quiet\n// automatically the moment a stream ends and picks back up the moment\n// it starts. Unlike chat events, these don't need any extra bot scope\n// — stream up/down status is public, so the App Access Token alone is\n// enough to subscribe.\n//\n// This requires:\n// - Re-running /auth/bot-setup ONCE after deploying, so the bot's\n// authorization includes user:read:chat (needed to receive chat)\n// alongside user:bot (needed to send it).\n// - A new EVENTSUB_SECRET env var (see step 3 below).\n// - Channels installed BEFORE this update need a one-time backfill:\n// visit \"/admin/sync-eventsub?key=\" once.\n//\n// SETUP:\n//\n// 1. Register an app at https://dev.twitch.tv/console/apps\n// Category: Chat Bot. Grab Client ID + generate a Client Secret.\n//\n// 2. Deploy this val, copy its public URL, and add\n// \"/auth/callback\" as an OAuth Redirect URL on the app.\n//\n// 3. In Val Town, set these Environment Variables (Secrets):\n// TWITCH_CLIENT_ID\n// TWITCH_CLIENT_SECRET\n// TWITCH_REDIRECT_URI <- \"/auth/callback\"\n// ADMIN_KEY <- any password you make up, protects /channels\n// EVENTSUB_SECRET <- any random 10-100 char string you make up,\n// used to verify Twitch's webhook calls are real\n//\n// 4. Visit \"/auth/bot-setup\" ONCE, logged in as the BOT's own\n// Twitch account, to authorize it with user:bot AND user:read:chat\n// (both requested together). This records the bot's numeric user id\n// automatically. If you ran bot-setup before this update, run it\n// again — the old authorization can't read chat.\n//\n// 5. Share \"/\" (the root) as your public invite link. Any\n// streamer who clicks \"Add UndercoverBurn\" and approves gets added\n// to the channels table, the poster cron starts visiting them, and\n// this val auto-subscribes to their chat AND stream on/off events.\n//\n// 6. Visit \"/channels?key=\" any time to see every\n// installed channel, flip the bot on/off, or remove a channel.\n//\n// 7. If you had channels installed BEFORE this update, run\n// \"/admin/sync-eventsub?key=\" once to subscribe\n// them all to chat and stream on/off events. Note: this only\n// subscribes going forward — a channel that's already live at\n// backfill time won't show as LIVE until its next stream.online\n// event (i.e. next time they go live).\n//\n// Data (which channels are installed, whether the bot is on, each\n// channel's new-message counter, whether each channel is currently\n// live, the bot's user id, cached app token) is stored in your Val\n// Town account-wide SQLite database (std/sqlite \"global\"), so the\n// companion cron val (undercoverburn-poster.ts) can read the same\n// data.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/global.ts\";\nconst CLIENT_ID = Deno.env.get(\"TWITCH_CLIENT_ID\")!;\nconst CLIENT_SECRET = Deno.env.get(\"TWITCH_CLIENT_SECRET\")!;\nconst REDIRECT_URI = Deno.env.get(\"TWITCH_REDIRECT_URI\")!;\nconst ADMIN_KEY = Deno.env.get(\"ADMIN_KEY\")!;\nconst EVENTSUB_SECRET = Deno.env.get(\"EVENTSUB_SECRET\")!;\nconst BOT_NAME = \"UndercoverBurn\";\nasync function ensureTables() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS channels (\n broadcaster_id TEXT PRIMARY KEY,\n broadcaster_login TEXT,\n se_channel_id TEXT,\n enabled INTEGER DEFAULT 1,\n message_count INTEGER DEFAULT 0,\n is_live INTEGER DEFAULT 0,\n added_at INTEGER\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS kv (\n key TEXT PRIMARY KEY,\n value TEXT\n )\n `);\n // Migrations for tables created before these columns existed.\n try {\n await sqlite.execute(\n `ALTER TABLE channels ADD COLUMN enabled INTEGER DEFAULT 1`,\n );\n } catch {\n // Column already exists — fine.\n }\n try {\n await sqlite.execute(\n `ALTER TABLE channels ADD COLUMN message_count INTEGER DEFAULT 0`,\n );\n } catch {\n // Column already exists — fine.\n }\n try {\n await sqlite.execute(\n `ALTER TABLE channels ADD COLUMN is_live INTEGER DEFAULT 0`,\n );\n } catch {\n // Column already exists — fine.\n }\n}\nasync function getKv(key: string): Promise {\n const result = await sqlite.execute({\n sql: \"SELECT value FROM kv WHERE key = :k\",\n args: { k: key },\n });\n return result.rows.length ? (result.rows[0][0] as string) : null;\n}\nasync function setKv(key: string, value: string) {\n await sqlite.execute({\n sql: `INSERT INTO kv (key, value) VALUES (:k, :v)\n ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n args: { k: key, v: value },\n });\n}\nasync function setLiveStatus(broadcasterId: string, live: boolean) {\n await sqlite.execute({\n sql: `UPDATE channels SET is_live = :live WHERE broadcaster_id = :id`,\n args: { live: live ? 1 : 0, id: broadcasterId },\n });\n}\nasync function getAppAccessToken(): Promise {\n const cachedRaw = await getKv(\"app_token\");\n if (cachedRaw) {\n const cached = JSON.parse(cachedRaw);\n if (cached.expires_at > Date.now() + 60_000) return cached.access_token;\n }\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n grant_type: \"client_credentials\",\n }),\n });\n if (!res.ok) {\n throw new Error(\n `App access token fetch failed: ${res.status} ${await res.text()}`,\n );\n }\n const data = await res.json();\n const token = {\n access_token: data.access_token,\n expires_at: Date.now() + data.expires_in * 1000,\n };\n await setKv(\"app_token\", JSON.stringify(token));\n return token.access_token;\n}\n// Subscribes the bot to this channel's chat messages via EventSub\n// webhook, so the message counter fills in. Uses the App Access\n// Token — this works as long as the bot completed /auth/bot-setup\n// with the user:read:chat scope at least once. Safe to call\n// repeatedly; a 409 means it's already subscribed, which we ignore.\nasync function subscribeChatEvents(broadcasterId: string, callbackUrl: string) {\n const botUserId = await getKv(\"bot_user_id\");\n if (!botUserId) {\n console.log(\"Skipping EventSub subscribe — bot not authorized yet.\");\n return;\n }\n const accessToken = await getAppAccessToken();\n const res = await fetch(\n \"https://api.twitch.tv/helix/eventsub/subscriptions\",\n {\n method: \"POST\",\n headers: {\n \"Client-Id\": CLIENT_ID,\n \"Authorization\": `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n type: \"channel.chat.message\",\n version: \"1\",\n condition: { broadcaster_user_id: broadcasterId, user_id: botUserId },\n transport: {\n method: \"webhook\",\n callback: callbackUrl,\n secret: EVENTSUB_SECRET,\n },\n }),\n },\n );\n if (!res.ok && res.status !== 409) {\n console.error(\n `EventSub subscribe failed for ${broadcasterId}:`,\n res.status,\n await res.text(),\n );\n }\n}\n// Subscribes the bot to this channel's stream.online / stream.offline\n// events via EventSub webhook, so is_live flips automatically the\n// moment a broadcaster goes live or ends their stream. Unlike chat\n// events, these don't need any bot user scope — stream up/down status\n// is public, so the App Access Token alone is enough. Safe to call\n// repeatedly; a 409 means it's already subscribed, which we ignore.\nasync function subscribeStreamEvents(\n broadcasterId: string,\n callbackUrl: string,\n) {\n const accessToken = await getAppAccessToken();\n for (const type of [\"stream.online\", \"stream.offline\"] as const) {\n const res = await fetch(\n \"https://api.twitch.tv/helix/eventsub/subscriptions\",\n {\n method: \"POST\",\n headers: {\n \"Client-Id\": CLIENT_ID,\n \"Authorization\": `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n type,\n version: \"1\",\n condition: { broadcaster_user_id: broadcasterId },\n transport: {\n method: \"webhook\",\n callback: callbackUrl,\n secret: EVENTSUB_SECRET,\n },\n }),\n },\n );\n if (!res.ok && res.status !== 409) {\n console.error(\n `EventSub subscribe (${type}) failed for ${broadcasterId}:`,\n res.status,\n await res.text(),\n );\n }\n }\n}\nasync function verifyEventSubSignature(\n req: Request,\n rawBody: string,\n): Promise {\n const messageId = req.headers.get(\"Twitch-Eventsub-Message-Id\") ?? \"\";\n const timestamp = req.headers.get(\"Twitch-Eventsub-Message-Timestamp\") ?? \"\";\n const signature = req.headers.get(\"Twitch-Eventsub-Message-Signature\") ?? \"\";\n if (!signature) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(EVENTSUB_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sigBuffer = await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(messageId + timestamp + rawBody),\n );\n const hex = [...new Uint8Array(sigBuffer)]\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n return `sha256=${hex}` === signature;\n}\n// Bumps the per-channel new-message counter for a single incoming\n// channel.chat.message event. Ignores messages sent by the bot itself.\nasync function countChatMessage(event: {\n broadcaster_user_id: string;\n chatter_user_id: string;\n}) {\n const botUserId = await getKv(\"bot_user_id\");\n if (botUserId && event.chatter_user_id === botUserId) return;\n await sqlite.execute({\n sql: `UPDATE channels SET message_count = COALESCE(message_count, 0) + 1\n WHERE broadcaster_id = :id`,\n args: { id: event.broadcaster_user_id },\n });\n}\nfunction page(body: string) {\n return new Response(\n `${BOT_NAME}\n ${body}`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\nfunction authorizeUrl(scope: string, state: string) {\n const u = new URL(\"https://id.twitch.tv/oauth2/authorize\");\n u.searchParams.set(\"client_id\", CLIENT_ID);\n u.searchParams.set(\"redirect_uri\", REDIRECT_URI);\n u.searchParams.set(\"response_type\", \"code\");\n u.searchParams.set(\"scope\", scope);\n u.searchParams.set(\"state\", state);\n return u.toString();\n}\nexport default async function (req: Request): Promise {\n await ensureTables();\n const url = new URL(req.url);\n // ---- Landing page ----\n if (url.pathname === \"/\" || url.pathname === \"\") {\n return page(`\n

🥸 ${BOT_NAME}

${BOT_NAME} slips into your Twitch chat undercover, then blows\n its own cover with a playful roast — or a quote pulled live from\n your own channel's StreamElements !quote list.

Add ${BOT_NAME} to your channel

\n First time setting this bot up? The bot account itself needs a\n one-time authorization at /auth/bot-setup\n before any channel invites will work.\n

\n `);\n }\n // ---- Streamer invite flow ----\n if (url.pathname === \"/auth/start\") {\n return Response.redirect(authorizeUrl(\"channel:bot\", \"channel\"), 302);\n }\n // ---- Bot's own one-time authorization ----\n // user:bot lets it send chat via the App Access Token; user:read:chat\n // lets it receive chat via EventSub so the new-message counter works.\n if (url.pathname === \"/auth/bot-setup\") {\n return Response.redirect(\n authorizeUrl(\"user:bot user:read:chat\", \"bot\"),\n 302,\n );\n }\n // ---- Shared OAuth callback ----\n if (url.pathname === \"/auth/callback\") {\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\"); // \"bot\" or \"channel\"\n const error = url.searchParams.get(\"error\");\n if (error) {\n return page(`

Not authorized

Twitch reported: ${error}

`);\n }\n if (!code) {\n return page(\n `

Missing code

Something went wrong — try again.

`,\n );\n }\n const tokenRes = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n code,\n grant_type: \"authorization_code\",\n redirect_uri: REDIRECT_URI,\n }),\n });\n if (!tokenRes.ok) {\n return page(`

Auth failed

${await tokenRes.text()}

`);\n }\n const tokenData = await tokenRes.json();\n const userRes = await fetch(\"https://api.twitch.tv/helix/users\", {\n headers: {\n \"Client-Id\": CLIENT_ID,\n \"Authorization\": `Bearer ${tokenData.access_token}`,\n },\n });\n const userData = await userRes.json();\n const user = userData.data?.[0];\n if (!user) {\n return page(`

Couldn't identify that account

`);\n }\n // ---- Branch: bot's own one-time setup ----\n if (state === \"bot\") {\n await setKv(\"bot_user_id\", user.id);\n await setKv(\"bot_login\", user.login);\n return page(`\n

✅ Bot account connected

${user.display_name} is now authorized to send\n chat as ${BOT_NAME}. You only need to do this once.

Back home

\n `);\n }\n // ---- Branch: a streamer inviting the bot to their channel ----\n let seChannelId: string | null = null;\n try {\n const seRes = await fetch(\n `https://api.streamelements.com/kappa/v2/channels/${user.login}`,\n );\n if (seRes.ok) {\n const seData = await seRes.json();\n seChannelId = seData?._id ?? null;\n }\n } catch {\n // No StreamElements channel found — roasts alone still work fine.\n }\n await sqlite.execute({\n sql: `\n INSERT INTO channels (broadcaster_id, broadcaster_login, se_channel_id, enabled, message_count, is_live, added_at)\n VALUES (:id, :login, :se, 1, 0, 0, :now)\n ON CONFLICT(broadcaster_id) DO UPDATE SET\n broadcaster_login = excluded.broadcaster_login,\n se_channel_id = excluded.se_channel_id\n `,\n args: {\n id: user.id,\n login: user.login,\n se: seChannelId,\n now: Date.now(),\n },\n });\n // Best-effort: subscribe to this channel's chat (for the\n // new-message counter) and stream on/off events (for the live\n // toggle). Doesn't block the install if either fails (e.g. the\n // bot hasn't done /auth/bot-setup with user:read:chat yet).\n try {\n await subscribeChatEvents(user.id, `${url.origin}/eventsub/callback`);\n await subscribeStreamEvents(user.id, `${url.origin}/eventsub/callback`);\n } catch (err) {\n console.error(\"EventSub subscribe error during install:\", err);\n }\n return page(`\n

✅ Added!

${BOT_NAME} is now live in ${user.display_name}'s channel.

${\n seChannelId\n ? \"Found your StreamElements channel too — quotes will mix in automatically.\"\n : \"Didn't find a matching StreamElements channel, so it'll stick to roasts for now.\"\n }

\n ${BOT_NAME} waits for at least 5 new chat messages before it'll\n post anything, so it won't talk over a quiet chat. It also only\n posts while you're actually live — it'll go quiet automatically\n when the stream ends and pick back up next time you go live.\n

\n `);\n }\n // ---- EventSub webhook: receives chat + stream on/off, updates state ----\n if (url.pathname === \"/eventsub/callback\" && req.method === \"POST\") {\n const rawBody = await req.text();\n const valid = await verifyEventSubSignature(req, rawBody);\n if (!valid) {\n return new Response(\"Invalid signature\", { status: 403 });\n }\n const messageType = req.headers.get(\"Twitch-Eventsub-Message-Type\");\n if (messageType === \"webhook_callback_verification\") {\n const body = JSON.parse(rawBody);\n return new Response(body.challenge, {\n status: 200,\n headers: { \"Content-Type\": \"text/plain\" },\n });\n }\n if (messageType === \"revocation\") {\n console.log(\"EventSub subscription revoked:\", rawBody.slice(0, 300));\n return new Response(\"\", { status: 200 });\n }\n if (messageType === \"notification\") {\n const body = JSON.parse(rawBody);\n const subType = body.subscription?.type;\n if (subType === \"channel.chat.message\") {\n await countChatMessage(body.event).catch((err) =>\n console.error(\"countChatMessage error:\", err)\n );\n } else if (subType === \"stream.online\") {\n console.log(`${body.event.broadcaster_user_login} went live`);\n await setLiveStatus(body.event.broadcaster_user_id, true).catch(\n (err) => console.error(\"setLiveStatus(online) error:\", err),\n );\n } else if (subType === \"stream.offline\") {\n console.log(`${body.event.broadcaster_user_login} ended stream`);\n await setLiveStatus(body.event.broadcaster_user_id, false).catch(\n (err) => console.error(\"setLiveStatus(offline) error:\", err),\n );\n }\n return new Response(\"\", { status: 200 });\n }\n return new Response(\"\", { status: 200 });\n }\n // ---- Admin: subscribe every installed channel to chat + stream events (one-time backfill) ----\n if (url.pathname === \"/admin/sync-eventsub\") {\n const key = url.searchParams.get(\"key\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized — add ?key= to the URL.\", {\n status: 401,\n });\n }\n const { rows } = await sqlite.execute(\n \"SELECT broadcaster_id, broadcaster_login FROM channels\",\n );\n const results: string[] = [];\n for (const row of rows) {\n const id = row[0] as string;\n const login = row[1] as string;\n try {\n await subscribeChatEvents(id, `${url.origin}/eventsub/callback`);\n await subscribeStreamEvents(id, `${url.origin}/eventsub/callback`);\n results.push(`${login}: subscribed (or already was)`);\n } catch (err) {\n results.push(`${login}: FAILED — ${err}`);\n }\n }\n return page(`\n

EventSub sync

Attempted to subscribe ${rows.length} channel${\n rows.length === 1 ? \"\" : \"s\"\n } to chat and stream on/off events.

${r}

Back to admin

\n `);\n }\n // ---- Admin: list / remove installed channels ----\n if (url.pathname === \"/channels\") {\n const key = url.searchParams.get(\"key\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized — add ?key= to the URL.\", {\n status: 401,\n });\n }\n const botEnabledRaw = await getKv(\"bot_enabled\");\n const botEnabled = botEnabledRaw !== \"0\"; // default ON if never set\n const { rows } = await sqlite.execute(\n \"SELECT broadcaster_id, broadcaster_login, se_channel_id, added_at, enabled, message_count, is_live FROM channels ORDER BY added_at DESC\",\n );\n const tableRows = rows\n .map((row) => {\n const id = row[0] as string;\n const login = row[1] as string;\n const se = row[2] as string | null;\n const addedAt = new Date(row[3] as number).toLocaleString();\n const chEnabled = row[4] === null || row[4] === undefined\n ? true\n : Number(row[4]) === 1;\n const msgCount = row[5] === null || row[5] === undefined\n ? 0\n : Number(row[5]);\n const isLive = row[6] === null || row[6] === undefined\n ? false\n : Number(row[6]) === 1;\n return `\n \n ${login}\n ${se ? \"✅\" : \"—\"}\n ${\n chEnabled ? \"ON\" : \"OFF\"\n }\n ${\n isLive ? \"LIVE\" : \"OFFLINE\"\n }\n ${msgCount} / 5 new msgs\n ${addedAt}\n \n \n \n \n `;\n })\n .join(\"\");\n return page(`\n

Installed channels

\n \n

${rows.length} channel${\n rows.length === 1 ? \"\" : \"s\"\n } currently have ${BOT_NAME}. Live reflects each\n broadcaster's actual Twitch stream status via stream.online /\n stream.offline events — the poster only posts to channels that\n are LIVE.

\n \n \n ${\n tableRows || ``\n }\n

Channel	StreamElements	Status	Live	Chat activity	Added
No channels yet.

Back home

\n `);\n }\n // ---- Admin: global on/off switch ----\n if (url.pathname === \"/admin/toggle-bot\" && req.method === \"POST\") {\n const form = await req.formData();\n const key = form.get(\"key\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n const current = await getKv(\"bot_enabled\");\n const currentlyEnabled = current !== \"0\";\n await setKv(\"bot_enabled\", currentlyEnabled ? \"0\" : \"1\");\n return Response.redirect(\n `${url.origin}/channels?key=${encodeURIComponent(key as string)}`,\n 302,\n );\n }\n // ---- Admin: per-channel pause/resume ----\n if (url.pathname === \"/channels/toggle\" && req.method === \"POST\") {\n const form = await req.formData();\n const key = form.get(\"key\");\n const id = form.get(\"id\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n if (id) {\n const { rows } = await sqlite.execute({\n sql: \"SELECT enabled FROM channels WHERE broadcaster_id = :id\",\n args: { id: id as string },\n });\n const currentlyEnabled = rows.length\n ? (rows[0][0] === null || rows[0][0] === undefined\n ? true\n : Number(rows[0][0]) === 1)\n : true;\n await sqlite.execute({\n sql: \"UPDATE channels SET enabled = :e WHERE broadcaster_id = :id\",\n args: { e: currentlyEnabled ? 0 : 1, id: id as string },\n });\n }\n return Response.redirect(\n `${url.origin}/channels?key=${encodeURIComponent(key as string)}`,\n 302,\n );\n }\n if (url.pathname === \"/channels/remove\" && req.method === \"POST\") {\n const form = await req.formData();\n const key = form.get(\"key\");\n const id = form.get(\"id\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n if (id) {\n await sqlite.execute({\n sql: \"DELETE FROM channels WHERE broadcaster_id = :id\",\n args: { id: id as string },\n });\n }\n return Response.redirect(\n `${url.origin}/channels?key=${encodeURIComponent(key as string)}`,\n 302,\n );\n }\n return page(`

404

Go home

`);\n}","// Val Town HTTP Val — UndercoverBurn invite/onboarding page\n// ------------------------------------------------------------\n//\n// Set this val's trigger type to \"HTTP\". Once deployed, Val Town gives\n// it a public URL like https://yourname-undercoverburn-invite.val.run\n// — that IS your \"invite bot to channel\" link (share the root URL).\n//\n// This uses Twitch's \"Installed Chatbot\" model:\n// - The BOT's own Twitch account authorizes once with scope user:bot.\n// - Each STREAMER authorizes once with scope channel:bot for their\n// own channel.\n// - Once both exist, an App Access Token (client_credentials grant)\n// can send chat messages into that streamer's channel as the bot —\n// no per-streamer token storage needed, ever.\n//\n// NEW: only reply once at least 5 new chat messages have come in since\n// the bot's last post to that channel. Requires reading chat, which\n// means subscribing to Twitch's EventSub \"channel.chat.message\" feed\n// via a webhook on this val (/eventsub/callback). Every non-bot\n// message increments a per-channel counter; the poster val checks\n// that counter and resets it to 0 whenever it actually posts.\n//\n// NEW: broadcaster live on/off toggle. Subscribes to Twitch's\n// \"stream.online\" / \"stream.offline\" EventSub events per channel and\n// flips a per-channel is_live flag as soon as they fire. The poster\n// val only posts to channels where is_live = 1, so the bot goes quiet\n// automatically the moment a stream ends and picks back up the moment\n// it starts. Unlike chat events, these don't need any extra bot scope\n// — stream up/down status is public, so the App Access Token alone is\n// enough to subscribe.\n//\n// This requires:\n// - Re-running /auth/bot-setup ONCE after deploying, so the bot's\n// authorization includes user:read:chat (needed to receive chat)\n// alongside user:bot (needed to send it).\n// - A new EVENTSUB_SECRET env var (see step 3 below).\n// - Channels installed BEFORE this update need a one-time backfill:\n// visit \"/admin/sync-eventsub?key=\" once.\n//\n// SETUP:\n//\n// 1. Register an app at https://dev.twitch.tv/console/apps\n// Category: Chat Bot. Grab Client ID + generate a Client Secret.\n//\n// 2. Deploy this val, copy its public URL, and add\n// \"/auth/callback\" as an OAuth Redirect URL on the app.\n//\n// 3. In Val Town, set these Environment Variables (Secrets):\n// TWITCH_CLIENT_ID\n// TWITCH_CLIENT_SECRET\n// TWITCH_REDIRECT_URI <- \"/auth/callback\"\n// ADMIN_KEY <- any password you make up, protects /channels\n// EVENTSUB_SECRET <- any random 10-100 char string you make up,\n// used to verify Twitch's webhook calls are real\n//\n// 4. Visit \"/auth/bot-setup\" ONCE, logged in as the BOT's own\n// Twitch account, to authorize it with user:bot AND user:read:chat\n// (both requested together). This records the bot's numeric user id\n// automatically. If you ran bot-setup before this update, run it\n// again — the old authorization can't read chat.\n//\n// 5. Share \"/\" (the root) as your public invite link. Any\n// streamer who clicks \"Add UndercoverBurn\" and approves gets added\n// to the channels table, the poster cron starts visiting them, and\n// this val auto-subscribes to their chat AND stream on/off events.\n//\n// 6. Visit \"/channels?key=\" any time to see every\n// installed channel, flip the bot on/off, or remove a channel.\n//\n// 7. If you had channels installed BEFORE this update, run\n// \"/admin/sync-eventsub?key=\" once to subscribe\n// them all to chat and stream on/off events. Note: this only\n// subscribes going forward — a channel that's already live at\n// backfill time won't show as LIVE until its next stream.online\n// event (i.e. next time they go live).\n//\n// Data (which channels are installed, whether the bot is on, each\n// channel's new-message counter, whether each channel is currently\n// live, the bot's user id, cached app token) is stored in your Val\n// Town account-wide SQLite database (std/sqlite \"global\"), so the\n// companion cron val (undercoverburn-poster.ts) can read the same\n// data.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/global.ts\";\nconst CLIENT_ID = Deno.env.get(\"TWITCH_CLIENT_ID\")!;\nconst CLIENT_SECRET = Deno.env.get(\"TWITCH_CLIENT_SECRET\")!;\nconst REDIRECT_URI = Deno.env.get(\"TWITCH_REDIRECT_URI\")!;\nconst ADMIN_KEY = Deno.env.get(\"ADMIN_KEY\")!;\nconst EVENTSUB_SECRET = Deno.env.get(\"EVENTSUB_SECRET\")!;\nconst BOT_NAME = \"UndercoverBurn\";\nasync function ensureTables() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS channels (\n broadcaster_id TEXT PRIMARY KEY,\n broadcaster_login TEXT,\n se_channel_id TEXT,\n enabled INTEGER DEFAULT 1,\n message_count INTEGER DEFAULT 0,\n is_live INTEGER DEFAULT 0,\n added_at INTEGER\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS kv (\n key TEXT PRIMARY KEY,\n value TEXT\n )\n `);\n // Migrations for tables created before these columns existed.\n try {\n await sqlite.execute(\n `ALTER TABLE channels ADD COLUMN enabled INTEGER DEFAULT 1`,\n );\n } catch {\n // Column already exists — fine.\n }\n try {\n await sqlite.execute(\n `ALTER TABLE channels ADD COLUMN message_count INTEGER DEFAULT 0`,\n );\n } catch {\n // Column already exists — fine.\n }\n try {\n await sqlite.execute(\n `ALTER TABLE channels ADD COLUMN is_live INTEGER DEFAULT 0`,\n );\n } catch {\n // Column already exists — fine.\n }\n}\nasync function getKv(key: string): Promise {\n const result = await sqlite.execute({\n sql: \"SELECT value FROM kv WHERE key = :k\",\n args: { k: key },\n });\n return result.rows.length ? (result.rows[0][0] as string) : null;\n}\nasync function setKv(key: string, value: string) {\n await sqlite.execute({\n sql: `INSERT INTO kv (key, value) VALUES (:k, :v)\n ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n args: { k: key, v: value },\n });\n}\nasync function setLiveStatus(broadcasterId: string, live: boolean) {\n await sqlite.execute({\n sql: `UPDATE channels SET is_live = :live WHERE broadcaster_id = :id`,\n args: { live: live ? 1 : 0, id: broadcasterId },\n });\n}\nasync function getAppAccessToken(): Promise {\n const cachedRaw = await getKv(\"app_token\");\n if (cachedRaw) {\n const cached = JSON.parse(cachedRaw);\n if (cached.expires_at > Date.now() + 60_000) return cached.access_token;\n }\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n grant_type: \"client_credentials\",\n }),\n });\n if (!res.ok) {\n throw new Error(\n `App access token fetch failed: ${res.status} ${await res.text()}`,\n );\n }\n const data = await res.json();\n const token = {\n access_token: data.access_token,\n expires_at: Date.now() + data.expires_in * 1000,\n };\n await setKv(\"app_token\", JSON.stringify(token));\n return token.access_token;\n}\n// Subscribes the bot to this channel's chat messages via EventSub\n// webhook, so the message counter fills in. Uses the App Access\n// Token — this works as long as the bot completed /auth/bot-setup\n// with the user:read:chat scope at least once. Safe to call\n// repeatedly; a 409 means it's already subscribed, which we ignore.\nasync function subscribeChatEvents(broadcasterId: string, callbackUrl: string) {\n const botUserId = await getKv(\"bot_user_id\");\n if (!botUserId) {\n console.log(\"Skipping EventSub subscribe — bot not authorized yet.\");\n return;\n }\n const accessToken = await getAppAccessToken();\n const res = await fetch(\n \"https://api.twitch.tv/helix/eventsub/subscriptions\",\n {\n method: \"POST\",\n headers: {\n \"Client-Id\": CLIENT_ID,\n \"Authorization\": `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n type: \"channel.chat.message\",\n version: \"1\",\n condition: { broadcaster_user_id: broadcasterId, user_id: botUserId },\n transport: {\n method: \"webhook\",\n callback: callbackUrl,\n secret: EVENTSUB_SECRET,\n },\n }),\n },\n );\n if (!res.ok && res.status !== 409) {\n console.error(\n `EventSub subscribe failed for ${broadcasterId}:`,\n res.status,\n await res.text(),\n );\n }\n}\n// Subscribes the bot to this channel's stream.online / stream.offline\n// events via EventSub webhook, so is_live flips automatically the\n// moment a broadcaster goes live or ends their stream. Unlike chat\n// events, these don't need any bot user scope — stream up/down status\n// is public, so the App Access Token alone is enough. Safe to call\n// repeatedly; a 409 means it's already subscribed, which we ignore.\nasync function subscribeStreamEvents(\n broadcasterId: string,\n callbackUrl: string,\n) {\n const accessToken = await getAppAccessToken();\n for (const type of [\"stream.online\", \"stream.offline\"] as const) {\n const res = await fetch(\n \"https://api.twitch.tv/helix/eventsub/subscriptions\",\n {\n method: \"POST\",\n headers: {\n \"Client-Id\": CLIENT_ID,\n \"Authorization\": `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n type,\n version: \"1\",\n condition: { broadcaster_user_id: broadcasterId },\n transport: {\n method: \"webhook\",\n callback: callbackUrl,\n secret: EVENTSUB_SECRET,\n },\n }),\n },\n );\n if (!res.ok && res.status !== 409) {\n console.error(\n `EventSub subscribe (${type}) failed for ${broadcasterId}:`,\n res.status,\n await res.text(),\n );\n }\n }\n}\nasync function verifyEventSubSignature(\n req: Request,\n rawBody: string,\n): Promise {\n const messageId = req.headers.get(\"Twitch-Eventsub-Message-Id\") ?? \"\";\n const timestamp = req.headers.get(\"Twitch-Eventsub-Message-Timestamp\") ?? \"\";\n const signature = req.headers.get(\"Twitch-Eventsub-Message-Signature\") ?? \"\";\n if (!signature) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(EVENTSUB_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sigBuffer = await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(messageId + timestamp + rawBody),\n );\n const hex = [...new Uint8Array(sigBuffer)]\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n return `sha256=${hex}` === signature;\n}\n// Bumps the per-channel new-message counter for a single incoming\n// channel.chat.message event. Ignores messages sent by the bot itself.\nasync function countChatMessage(event: {\n broadcaster_user_id: string;\n chatter_user_id: string;\n}) {\n const botUserId = await getKv(\"bot_user_id\");\n if (botUserId && event.chatter_user_id === botUserId) return;\n await sqlite.execute({\n sql: `UPDATE channels SET message_count = COALESCE(message_count, 0) + 1\n WHERE broadcaster_id = :id`,\n args: { id: event.broadcaster_user_id },\n });\n}\nfunction page(body: string) {\n return new Response(\n `${BOT_NAME}\n ${body}`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\nfunction authorizeUrl(scope: string, state: string) {\n const u = new URL(\"https://id.twitch.tv/oauth2/authorize\");\n u.searchParams.set(\"client_id\", CLIENT_ID);\n u.searchParams.set(\"redirect_uri\", REDIRECT_URI);\n u.searchParams.set(\"response_type\", \"code\");\n u.searchParams.set(\"scope\", scope);\n u.searchParams.set(\"state\", state);\n return u.toString();\n}\nexport default async function (req: Request): Promise {\n await ensureTables();\n const url = new URL(req.url);\n // ---- Landing page ----\n if (url.pathname === \"/\" || url.pathname === \"\") {\n return page(`\n

🥸 ${BOT_NAME}

${BOT_NAME} slips into your Twitch chat undercover, then blows\n its own cover with a playful roast — or a quote pulled live from\n your own channel's StreamElements !quote list.

Add ${BOT_NAME} to your channel

\n First time setting this bot up? The bot account itself needs a\n one-time authorization at /auth/bot-setup\n before any channel invites will work.\n

Not authorized

Twitch reported: ${error}

`);\n }\n if (!code) {\n return page(\n `

Missing code

Something went wrong — try again.

Auth failed

${await tokenRes.text()}

Couldn't identify that account

`);\n }\n // ---- Branch: bot's own one-time setup ----\n if (state === \"bot\") {\n await setKv(\"bot_user_id\", user.id);\n await setKv(\"bot_login\", user.login);\n return page(`\n

✅ Bot account connected

${user.display_name} is now authorized to send\n chat as ${BOT_NAME}. You only need to do this once.

Back home

✅ Added!

${BOT_NAME} is now live in ${user.display_name}'s channel.

${\n seChannelId\n ? \"Found your StreamElements channel too — quotes will mix in automatically.\"\n : \"Didn't find a matching StreamElements channel, so it'll stick to roasts for now.\"\n }

EventSub sync

Attempted to subscribe ${rows.length} channel${\n rows.length === 1 ? \"\" : \"s\"\n } to chat and stream on/off events.

${r}

Back to admin

Installed channels

\n \n

\n \n \n ${\n tableRows || ``\n }\n

Channel	StreamElements	Status	Live	Chat activity	Added
No channels yet.

Back home

404

Go home

`);\n}","createdAt",["D",1788979684891],"branchVersion","branchId","a8b2d958-bb72-47e2-ab64-cc8a5ad38d08","id","ae50d28c-bf6b-42be-bbe3-a0cd1a8c9c71","roastbot",["D",1788213389549],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","UndercoverBurn auto roasting and quote pulling twitch chat bot","imageUrl","cc37ba10-6e6d-4af6-a801-9955c92d23c4","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04ba1-c79f-7319-b4f2-7c4f3772837b","tursoName","ae50d28cbf6b42bebbe3a0cd1a8c9c71","tursoHostname","ae50d28cbf6b42bebbe3a0cd1a8c9c71-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789533091345],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},"branch",{"_13":14,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","StonedSheamus","handle","displayName","Shea Stolp","avatar","https://lh3.googleusercontent.com/a/ACg8ocIWmQgR3gyoMMicg2zCAoN1c7i36qX5mf9gRIdIXm8F2mo-ig=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":154,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":155,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":156,"_83":157,"_85":158,"_87":25},"tree",[149],"files",[149],"counts",{"_137":62,"_138":139,"_140":62,"_141":142,"_143":144},"contents",[129],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":130,"_32":28,"_30":31,"_131":-5,"_41":42,"_40":14,"_132":58,"_38":133,"_13":134,"_33":34,"_35":37,"_24":25,"_135":-5,"_27":136},"b9d13a08-0679-4081-8fee-ae7898a53478","parentId","latest",["D",1788979684891],16,"label",[28],"pulls","branches",1,"forks","envVars",{"_145":147,"_148":62},"connections",{"_145":62,"_146":62},"count","unfilledCount",5,"emptyCount",{"_43":130,"_32":28,"_30":31,"_131":-5,"_41":42,"_40":14,"_132":58,"_38":150,"_13":134,"_33":34,"_35":37,"_24":25,"_135":-5,"_151":152,"_27":153},["D",1788979684891],"children",[],[28],["D",1788213389549],["D",1789533091345],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},{"_13":14,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_81":-5,"_126":192,"_193":194,"_195":196,"_197":25,"_198":25,"_199":25,"_200":58,"_201":-5,"_202":-7,"_203":-7,"_204":62,"_205":25,"_206":25,"_207":-5,"_208":25,"_209":25,"_210":25,"_211":-5},"ENV",{"_163":164,"_165":166,"_167":88,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v22