🥸 ${BOT_NAME}

${BOT_NAME} slips into your Twitch chat undercover, then blows\n its own cover with a playful roast — or a quote pulled live from\n your own channel's StreamElements !quote list.

Add ${BOT_NAME} to your channel

\n First time setting this bot up? The bot account itself needs a\n one-time authorization at /auth/bot-setup\n before any channel invites will work.\n

\n `);\n }\n // ---- Streamer invite flow ----\n if (url.pathname === \"/auth/start\") {\n return Response.redirect(authorizeUrl(\"channel:bot\", \"channel\"), 302);\n }\n // ---- Bot's own one-time authorization ----\n // user:bot lets it send chat via the App Access Token; user:read:chat\n // lets it receive chat via EventSub so the new-message counter works.\n if (url.pathname === \"/auth/bot-setup\") {\n return Response.redirect(\n authorizeUrl(\"user:bot user:read:chat\", \"bot\"),\n 302,\n );\n }\n // ---- Shared OAuth callback ----\n if (url.pathname === \"/auth/callback\") {\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\"); // \"bot\" or \"channel\"\n const error = url.searchParams.get(\"error\");\n if (error) {\n return page(`

Not authorized

Twitch reported: ${error}

`);\n }\n if (!code) {\n return page(\n `

Missing code

Something went wrong — try again.

`,\n );\n }\n const tokenRes = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n code,\n grant_type: \"authorization_code\",\n redirect_uri: REDIRECT_URI,\n }),\n });\n if (!tokenRes.ok) {\n return page(`

Auth failed

${await tokenRes.text()}

`);\n }\n const tokenData = await tokenRes.json();\n const userRes = await fetch(\"https://api.twitch.tv/helix/users\", {\n headers: {\n \"Client-Id\": CLIENT_ID,\n \"Authorization\": `Bearer ${tokenData.access_token}`,\n },\n });\n const userData = await userRes.json();\n const user = userData.data?.[0];\n if (!user) {\n return page(`

Couldn't identify that account

`);\n }\n // ---- Branch: bot's own one-time setup ----\n if (state === \"bot\") {\n await setKv(\"bot_user_id\", user.id);\n await setKv(\"bot_login\", user.login);\n return page(`\n

✅ Bot account connected

${user.display_name} is now authorized to send\n chat as ${BOT_NAME}. You only need to do this once.

Back home

\n `);\n }\n // ---- Branch: a streamer inviting the bot to their channel ----\n let seChannelId: string | null = null;\n try {\n const seRes = await fetch(\n `https://api.streamelements.com/kappa/v2/channels/${user.login}`,\n );\n if (seRes.ok) {\n const seData = await seRes.json();\n seChannelId = seData?._id ?? null;\n }\n } catch {\n // No StreamElements channel found — roasts alone still work fine.\n }\n await sqlite.execute({\n sql: `\n INSERT INTO channels (broadcaster_id, broadcaster_login, se_channel_id, enabled, message_count, is_live, added_at)\n VALUES (:id, :login, :se, 1, 0, 0, :now)\n ON CONFLICT(broadcaster_id) DO UPDATE SET\n broadcaster_login = excluded.broadcaster_login,\n se_channel_id = excluded.se_channel_id\n `,\n args: {\n id: user.id,\n login: user.login,\n se: seChannelId,\n now: Date.now(),\n },\n });\n // Best-effort: subscribe to this channel's chat (for the\n // new-message counter) and stream on/off events (for the live\n // toggle). Doesn't block the install if either fails (e.g. the\n // bot hasn't done /auth/bot-setup with user:read:chat yet).\n try {\n await subscribeChatEvents(user.id, `${url.origin}/eventsub/callback`);\n await subscribeStreamEvents(user.id, `${url.origin}/eventsub/callback`);\n } catch (err) {\n console.error(\"EventSub subscribe error during install:\", err);\n }\n return page(`\n

✅ Added!

${BOT_NAME} is now live in ${user.display_name}'s channel.

${\n seChannelId\n ? \"Found your StreamElements channel too — quotes will mix in automatically.\"\n : \"Didn't find a matching StreamElements channel, so it'll stick to roasts for now.\"\n }

\n ${BOT_NAME} waits for at least 5 new chat messages before it'll\n post anything, so it won't talk over a quiet chat. It also only\n posts while you're actually live — it'll go quiet automatically\n when the stream ends and pick back up next time you go live.\n

\n `);\n }\n // ---- EventSub webhook: receives chat + stream on/off, updates state ----\n if (url.pathname === \"/eventsub/callback\" && req.method === \"POST\") {\n const rawBody = await req.text();\n const valid = await verifyEventSubSignature(req, rawBody);\n if (!valid) {\n return new Response(\"Invalid signature\", { status: 403 });\n }\n const messageType = req.headers.get(\"Twitch-Eventsub-Message-Type\");\n if (messageType === \"webhook_callback_verification\") {\n const body = JSON.parse(rawBody);\n return new Response(body.challenge, {\n status: 200,\n headers: { \"Content-Type\": \"text/plain\" },\n });\n }\n if (messageType === \"revocation\") {\n console.log(\"EventSub subscription revoked:\", rawBody.slice(0, 300));\n return new Response(\"\", { status: 200 });\n }\n if (messageType === \"notification\") {\n const body = JSON.parse(rawBody);\n const subType = body.subscription?.type;\n if (subType === \"channel.chat.message\") {\n await countChatMessage(body.event).catch((err) =>\n console.error(\"countChatMessage error:\", err)\n );\n } else if (subType === \"stream.online\") {\n console.log(`${body.event.broadcaster_user_login} went live`);\n await setLiveStatus(body.event.broadcaster_user_id, true).catch(\n (err) => console.error(\"setLiveStatus(online) error:\", err),\n );\n } else if (subType === \"stream.offline\") {\n console.log(`${body.event.broadcaster_user_login} ended stream`);\n await setLiveStatus(body.event.broadcaster_user_id, false).catch(\n (err) => console.error(\"setLiveStatus(offline) error:\", err),\n );\n }\n return new Response(\"\", { status: 200 });\n }\n return new Response(\"\", { status: 200 });\n }\n // ---- Admin: subscribe every installed channel to chat + stream events (one-time backfill) ----\n if (url.pathname === \"/admin/sync-eventsub\") {\n const key = url.searchParams.get(\"key\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized — add ?key= to the URL.\", {\n status: 401,\n });\n }\n const { rows } = await sqlite.execute(\n \"SELECT broadcaster_id, broadcaster_login FROM channels\",\n );\n const results: string[] = [];\n for (const row of rows) {\n const id = row[0] as string;\n const login = row[1] as string;\n try {\n await subscribeChatEvents(id, `${url.origin}/eventsub/callback`);\n await subscribeStreamEvents(id, `${url.origin}/eventsub/callback`);\n results.push(`${login}: subscribed (or already was)`);\n } catch (err) {\n results.push(`${login}: FAILED — ${err}`);\n }\n }\n return page(`\n

EventSub sync

Attempted to subscribe ${rows.length} channel${\n rows.length === 1 ? \"\" : \"s\"\n } to chat and stream on/off events.

${r}

Back to admin

\n `);\n }\n // ---- Admin: list / remove installed channels ----\n if (url.pathname === \"/channels\") {\n const key = url.searchParams.get(\"key\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized — add ?key= to the URL.\", {\n status: 401,\n });\n }\n const botEnabledRaw = await getKv(\"bot_enabled\");\n const botEnabled = botEnabledRaw !== \"0\"; // default ON if never set\n const { rows } = await sqlite.execute(\n \"SELECT broadcaster_id, broadcaster_login, se_channel_id, added_at, enabled, message_count, is_live FROM channels ORDER BY added_at DESC\",\n );\n const tableRows = rows\n .map((row) => {\n const id = row[0] as string;\n const login = row[1] as string;\n const se = row[2] as string | null;\n const addedAt = new Date(row[3] as number).toLocaleString();\n const chEnabled = row[4] === null || row[4] === undefined\n ? true\n : Number(row[4]) === 1;\n const msgCount = row[5] === null || row[5] === undefined\n ? 0\n : Number(row[5]);\n const isLive = row[6] === null || row[6] === undefined\n ? false\n : Number(row[6]) === 1;\n return `\n \n ${login}\n ${se ? \"✅\" : \"—\"}\n ${\n chEnabled ? \"ON\" : \"OFF\"\n }\n ${\n isLive ? \"LIVE\" : \"OFFLINE\"\n }\n ${msgCount} / 5 new msgs\n ${addedAt}\n \n \n \n \n `;\n })\n .join(\"\");\n return page(`\n

Installed channels

\n \n

${rows.length} channel${\n rows.length === 1 ? \"\" : \"s\"\n } currently have ${BOT_NAME}. Live reflects each\n broadcaster's actual Twitch stream status via stream.online /\n stream.offline events — the poster only posts to channels that\n are LIVE.

\n \n \n ${\n tableRows || ``\n }\n

Channel	StreamElements	Status	Live	Chat activity	Added
No channels yet.

Back home

\n `);\n }\n // ---- Admin: global on/off switch ----\n if (url.pathname === \"/admin/toggle-bot\" && req.method === \"POST\") {\n const form = await req.formData();\n const key = form.get(\"key\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n const current = await getKv(\"bot_enabled\");\n const currentlyEnabled = current !== \"0\";\n await setKv(\"bot_enabled\", currentlyEnabled ? \"0\" : \"1\");\n return Response.redirect(\n `${url.origin}/channels?key=${encodeURIComponent(key as string)}`,\n 302,\n );\n }\n // ---- Admin: per-channel pause/resume ----\n if (url.pathname === \"/channels/toggle\" && req.method === \"POST\") {\n const form = await req.formData();\n const key = form.get(\"key\");\n const id = form.get(\"id\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n if (id) {\n const { rows } = await sqlite.execute({\n sql: \"SELECT enabled FROM channels WHERE broadcaster_id = :id\",\n args: { id: id as string },\n });\n const currentlyEnabled = rows.length\n ? (rows[0][0] === null || rows[0][0] === undefined\n ? true\n : Number(rows[0][0]) === 1)\n : true;\n await sqlite.execute({\n sql: \"UPDATE channels SET enabled = :e WHERE broadcaster_id = :id\",\n args: { e: currentlyEnabled ? 0 : 1, id: id as string },\n });\n }\n return Response.redirect(\n `${url.origin}/channels?key=${encodeURIComponent(key as string)}`,\n 302,\n );\n }\n if (url.pathname === \"/channels/remove\" && req.method === \"POST\") {\n const form = await req.formData();\n const key = form.get(\"key\");\n const id = form.get(\"id\");\n if (!ADMIN_KEY || key !== ADMIN_KEY) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n if (id) {\n await sqlite.execute({\n sql: \"DELETE FROM channels WHERE broadcaster_id = :id\",\n args: { id: id as string },\n });\n }\n return Response.redirect(\n `${url.origin}/channels?key=${encodeURIComponent(key as string)}`,\n 302,\n );\n }\n return page(`

404

Go home

`);\n}","deleted","label",[113],"pulls","branches",1,"forks","envVars",{"_136":138,"_139":42},"connections",{"_136":42,"_137":42},"count","unfilledCount",5,"emptyCount",{"_18":112,"_20":113,"_114":36,"_115":-5,"_116":71,"_117":69,"_118":38,"_22":141,"_68":120,"_121":122,"_123":124,"_125":26,"_126":-5,"_142":143,"_89":144},["D",1788979684891],"children",[],[113],["D",1788213389549],["D",1789446061244],{"_16":17,"_87":83},{"_16":17,"_80":81,"_82":83,"_33":34,"_84":85,"_86":26},{"_68":69,"_20":70,"_18":71,"_72":19,"_73":-5,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":21,"_79":17},"ctx",{"_61":-5,"_108":183,"_184":185,"_186":187,"_188":26,"_189":26,"_190":26,"_191":38,"_192":-5,"_193":-7,"_194":-7,"_195":42,"_196":26,"_197":26,"_198":-5,"_199":26,"_200":26,"_201":26,"_202":-5},"ENV",{"_154":155,"_156":157,"_158":70,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]