C’est fait.

' +\n \"

Tu ne recevras plus d’offres de voyage d’Acolyte. Ton compte et tes voyages ne sont pas touchés.

\",\n {\n status: 200,\n headers: { ...cors, \"Content-Type\": \"text/html; charset=utf-8\" },\n },\n );\n }\n\n if (path === \"/admin/promo\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n await promoTable();\n\n if (request.method === \"POST\") {\n const b = await request.json().catch(() => ({}));\n\n if (typeof b.actif !== \"undefined\") {\n await setConf(\"promo_actif\", b.actif ? \"1\" : \"0\");\n }\n\n if (b.envoyer) {\n if ((await conf(\"promo_actif\", \"0\")) !== \"1\") {\n return json({\n error:\n \"La lettre est désactivée. Active-la d’abord, en connaissance de cause.\",\n }, 409);\n }\n if (!mailReady(env)) {\n return json({\n error: \"Les variables EMAILJS_* ne sont pas configurées.\",\n }, 409);\n }\n\n const sujet = String(b.sujet || \"\").trim().slice(0, 120);\n const message = String(b.message || \"\").trim().slice(0, 4000);\n if (sujet.length < 3 || message.length < 20) {\n return json({ error: \"Il faut un objet et un message.\" }, 400);\n }\n\n const cibles = (await sqlite.execute(\n `SELECT email FROM aco_users WHERE promo_ok = 1 AND verified = 1 LIMIT 2000`,\n )).rows || [];\n const liste = cibles.map((r) => String(r.email ?? r[0]));\n\n if (!b.pour_de_vrai) {\n return json({\n simulation: true,\n destinataires: liste.length,\n note:\n \"Rien n’a été envoyé. Rappelle avec pour_de_vrai:true pour expédier.\",\n });\n }\n\n let ok = 0, ko = 0;\n for (const email of liste) {\n const stop = `${url.origin}/promo/stop?e=${\n encodeURIComponent(email)\n }&t=${await promoJeton(email)}`;\n const corps = message +\n `\\n\\n— \\nTu reçois ce message parce que tu as accepté les offres de voyage d’Acolyte.` +\n `\\nMe désinscrire : ${stop}`;\n try {\n const r = await fetch(\n \"https://api.emailjs.com/api/v1.0/email/send\",\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n service_id: env(\"EMAILJS_SERVICE\"),\n template_id: env(\"EMAILJS_TEMPLATE\"),\n user_id: env(\"EMAILJS_PUBLIC\"),\n accessToken: env(\"EMAILJS_PRIVATE\"),\n template_params: {\n to_email: email,\n email,\n sujet,\n code: sujet,\n message: corps,\n },\n }),\n },\n );\n r.ok ? ok++ : ko++;\n } catch (e) {\n ko++;\n }\n\n await new Promise((r) => setTimeout(r, 250));\n }\n await setConf(\"promo_dernier\", String(Date.now()));\n return json({ envoye: ok, echecs: ko });\n }\n }\n\n const total =\n (await sqlite.execute(\n `SELECT COUNT(*) AS n FROM aco_users WHERE verified = 1`,\n )).rows[0];\n const oui =\n (await sqlite.execute(\n `SELECT COUNT(*) AS n FROM aco_users WHERE promo_ok = 1 AND verified = 1`,\n )).rows[0];\n const dernier = parseInt(await conf(\"promo_dernier\", \"0\"), 10) || 0;\n return json({\n actif: (await conf(\"promo_actif\", \"0\")) === \"1\",\n mail_pret: mailReady(env),\n clients_verifies: total ? Number(total.n ?? total[0]) : 0,\n consentants: oui ? Number(oui.n ?? oui[0]) : 0,\n dernier_envoi: dernier,\n });\n }\n\n if (path === \"/admin/blog/auto\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n if (request.method === \"POST\") {\n const b = await request.json().catch(() => ({}));\n if (typeof b.actif !== \"undefined\") {\n await setConf(\"blog_auto\", b.actif ? \"1\" : \"0\");\n }\n if (b.intervalle) {\n await setConf(\n \"blog_intervalle\",\n String(\n Math.max(\n 1,\n Math.min(\n 168,\n parseInt(b.intervalle, 10) || BLOG_INTERVALLE_DEFAUT,\n ),\n ),\n ),\n );\n }\n if (b.regarnir) await blogRegarnit();\n\n if (b.maintenant) await setConf(\"blog_dernier\", \"0\");\n }\n await blogConfTable();\n const attente = await sqlite.execute(\n `SELECT COUNT(*) AS n FROM aco_queue WHERE statut = 'attente'`,\n );\n const suivants = await sqlite.execute(\n `SELECT sujet FROM aco_queue WHERE statut = 'attente' ORDER BY ajoute_le ASC LIMIT 5`,\n );\n const dernier = parseInt(await conf(\"blog_dernier\", \"0\"), 10) || 0;\n const intervalle =\n parseInt(\n await conf(\"blog_intervalle\", String(BLOG_INTERVALLE_DEFAUT)),\n 10,\n ) || BLOG_INTERVALLE_DEFAUT;\n\n const dernierOk = parseInt(await conf(\"blog_dernier_ok\", \"0\"), 10) || 0;\n const depuisOk = dernierOk ? Date.now() - dernierOk : null;\n return json({\n actif: (await conf(\"blog_auto\", \"1\")) === \"1\",\n intervalle,\n dernier,\n prochain_dans_minutes: dernier\n ? Math.max(\n 0,\n Math.ceil((dernier + intervalle * 3600e3 - Date.now()) / 60e3),\n )\n : 0,\n en_attente: attente.rows[0]\n ? Number(attente.rows[0].n ?? attente.rows[0][0])\n : 0,\n suivants: (suivants.rows || []).map((r) => String(r.sujet ?? r[0])),\n dernier_ok: dernierOk,\n heures_depuis_dernier: depuisOk === null\n ? null\n : +(depuisOk / 3600e3).toFixed(1),\n en_retard: depuisOk !== null && depuisOk > intervalle * 2 * 3600e3,\n ecrits: parseInt(await conf(\"blog_ecrits\", \"0\"), 10) || 0,\n echecs: parseInt(await conf(\"blog_echecs\", \"0\"), 10) || 0,\n });\n }\n\n if (path === \"/admin/blog/generate\" && request.method === \"POST\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n\n const b = await request.json().catch(() => ({}));\n const sujet = String(b.sujet || \"\").trim().slice(0, 80);\n const categorie = BLOG_CATS[b.categorie] ? b.categorie : \"nature\";\n if (sujet.length < 3) return json({ error: \"Sujet manquant\" }, 400);\n\n await blogTable();\n const deja = await sqlite.execute({\n sql: \"SELECT slug FROM aco_posts WHERE slug = ?\",\n args: [slugify(sujet)],\n });\n if (deja.rows[0] && !b.remplacer) {\n return json({\n error: \"Un article existe déjà sur ce sujet\",\n slug: slugify(sujet),\n }, 409);\n }\n\n const r = await blogRedige(\n sujet,\n categorie,\n String(b.ton || \"vivant\"),\n \"brouillon\",\n );\n if (r.erreur) return json({ error: r.erreur }, r.code || 502);\n return json({\n ok: true,\n slug: r.slug,\n titre: r.titre,\n sections: r.sections,\n image: r.image,\n });\n }\n\n if (path === \"/admin/blog/list\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n await blogTable();\n const r = await sqlite.execute(\n `SELECT slug,sujet,categorie,titre,statut,created_at,\n (image IS NOT NULL AND image <> '') AS a_image FROM aco_posts ORDER BY created_at DESC LIMIT 200`,\n );\n return json({\n articles: (r.rows || []).map((x) => ({\n slug: String(x.slug ?? x[0]),\n sujet: String(x.sujet ?? x[1]),\n categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]),\n statut: String(x.statut ?? x[4]),\n quand: Number(x.created_at ?? x[5]),\n image: !!Number(x.a_image ?? x[6]),\n })),\n });\n }\n\n if (path === \"/admin/blog/statut\" && request.method === \"POST\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n const b = await request.json().catch(() => ({}));\n const st = b.statut === \"publie\" ? \"publie\" : \"brouillon\";\n await blogTable();\n await sqlite.execute({\n sql: \"UPDATE aco_posts SET statut = ? WHERE slug = ?\",\n args: [st, String(b.slug || \"\").slice(0, 70)],\n });\n return json({ ok: true, statut: st });\n }\n if (path === \"/admin/blog\" && request.method === \"DELETE\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n await blogTable();\n await sqlite.execute({\n sql: \"DELETE FROM aco_posts WHERE slug = ?\",\n args: [String(url.searchParams.get(\"slug\") || \"\").slice(0, 70)],\n });\n return json({ ok: true });\n }\n\n if (path === \"/blog\") {\n await blogTable();\n const r = await sqlite.execute(\n `SELECT slug,sujet,categorie,titre,sous_titre,resume,lecture,image,created_at\n FROM aco_posts WHERE statut = 'publie' ORDER BY created_at DESC LIMIT 60`,\n );\n return json({\n articles: (r.rows || []).map((x) => ({\n slug: String(x.slug ?? x[0]),\n sujet: String(x.sujet ?? x[1]),\n categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]),\n sous_titre: String(x.sous_titre ?? x[4] ?? \"\"),\n resume: String(x.resume ?? x[5] ?? \"\"),\n lecture: String(x.lecture ?? x[6] ?? \"\"),\n image: String(x.image ?? x[7] ?? \"\"),\n quand: Number(x.created_at ?? x[8]),\n })),\n });\n }\n\n if (path === \"/blog/index\") {\n await blogTable();\n const r = await sqlite.execute(\n `SELECT slug,sujet,titre FROM aco_posts WHERE statut = 'publie' LIMIT 300`,\n );\n return json({\n index: (r.rows || []).map((x) => ({\n slug: String(x.slug ?? x[0]),\n sujet: String(x.sujet ?? x[1]),\n titre: String(x.titre ?? x[2]),\n })),\n });\n }\n if (path === \"/blog/article\") {\n await blogTable();\n const r = await sqlite.execute({\n sql:\n `SELECT slug,sujet,categorie,titre,sous_titre,resume,lecture,corps,image,credit,created_at\n FROM aco_posts WHERE slug = ? AND statut = 'publie'`,\n args: [String(url.searchParams.get(\"slug\") || \"\").slice(0, 70)],\n });\n const x = r.rows[0];\n if (!x) return json({ error: \"Article introuvable\" }, 404);\n let corps = { sections: [], faits: [], tags: [] };\n try {\n corps = JSON.parse(String(x.corps ?? x[7]));\n } catch (e) {}\n return json({\n article: {\n slug: String(x.slug ?? x[0]),\n sujet: String(x.sujet ?? x[1]),\n categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]),\n sous_titre: String(x.sous_titre ?? x[4] ?? \"\"),\n resume: String(x.resume ?? x[5] ?? \"\"),\n lecture: String(x.lecture ?? x[6] ?? \"\"),\n image: String(x.image ?? x[8] ?? \"\"),\n credit: String(x.credit ?? x[9] ?? \"\"),\n quand: Number(x.created_at ?? x[10]),\n ...corps,\n },\n });\n }\n if (path === \"/capabilities\") {\n return json({\n comptes: mailReady(env),\n gemini: !!env(\"GEMINI_KEY\"),\n groq: !!env(\"GROQ_KEY\"),\n travelpayouts: !!env(\"TRAVELPAYOUTS_KEY\"),\n });\n }\n\n if (path === \"/maildiag\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n return json({\n variables: {\n EMAILJS_PUBLIC: !!env(\"EMAILJS_PUBLIC\"),\n EMAILJS_PRIVATE: !!env(\"EMAILJS_PRIVATE\"),\n EMAILJS_SERVICE: env(\"EMAILJS_SERVICE\") || \"(vide)\",\n EMAILJS_TEMPLATE: env(\"EMAILJS_TEMPLATE\") || \"(vide)\",\n },\n derniereReponseEmailJS: await readMail(),\n });\n }\n\n const newSession = async (email) => {\n const token = randomHex(32);\n await sqlite.execute({\n sql:\n \"INSERT INTO aco_sessions(token_h, email, expires_at) VALUES(?,?,?)\",\n args: [await sha256(token), email, Date.now() + SESS_TTL],\n });\n\n try {\n await sqlite.execute({\n sql: `DELETE FROM aco_sessions WHERE email = ? AND token_h NOT IN (\n SELECT token_h FROM aco_sessions WHERE email = ?\n ORDER BY expires_at DESC LIMIT ?)`,\n args: [email, email, SESS_MAX],\n });\n } catch (e) {}\n return token;\n };\n\n const issueCode = async (email) => {\n if (!mailReady(env)) {\n return {\n err: \"L'envoi d'email n'est pas configuré sur le serveur\",\n status: 501,\n };\n }\n const now = Date.now();\n const prev = await sqlite.execute({\n sql: \"SELECT sent_at FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n if (prev.rows[0] && now - Number(prev.rows[0][0]) < CODE_WAIT) {\n return {\n err: \"Un code vient déjà d’être envoyé. Attends une minute.\",\n status: 429,\n };\n }\n const code = String(Math.floor(100000 + Math.random() * 900000));\n if (!(await sendCodeMail(env, email, code))) {\n return {\n err: \"L'email n'a pas pu être envoyé. Réessaie dans un instant.\",\n status: 502,\n };\n }\n await sqlite.execute({\n sql:\n `INSERT INTO aco_codes(email, code_h, expires_at, tries, sent_at) VALUES(?,?,?,0,?)\n ON CONFLICT(email) DO UPDATE SET code_h=excluded.code_h,\n expires_at=excluded.expires_at, tries=0, sent_at=excluded.sent_at`,\n args: [\n email,\n await sha256(\"aco::\" + email + \"::\" + code),\n now + CODE_TTL,\n now,\n ],\n });\n return { ok: true };\n };\n\n const checkCode = async (email, code) => {\n const r = await sqlite.execute({\n sql: \"SELECT code_h, expires_at, tries FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n const row = r.rows[0];\n if (!row) return { err: \"Demande un nouveau code\", status: 400 };\n if (Number(row[1]) < Date.now()) {\n await sqlite.execute({\n sql: \"DELETE FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n return { err: \"Code expiré — demandes-en un nouveau\", status: 400 };\n }\n if (Number(row[2]) >= CODE_TRIES) {\n await sqlite.execute({\n sql: \"DELETE FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n return { err: \"Trop d’essais — demande un nouveau code\", status: 429 };\n }\n if (\n !safeEqual(String(row[0]), await sha256(\"aco::\" + email + \"::\" + code))\n ) {\n await sqlite.execute({\n sql: \"UPDATE aco_codes SET tries = tries + 1 WHERE email = ?\",\n args: [email],\n });\n return { err: \"Code incorrect\", status: 400 };\n }\n await sqlite.execute({\n sql: \"DELETE FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n return { ok: true };\n };\n\n if (path === \"/auth/signup\" && request.method === \"POST\") {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email), pass = cleanPass(body.password);\n if (!email) return json({ error: \"Adresse email invalide\" }, 400);\n if (!pass) {\n return json(\n { error: `Mot de passe : ${PASS_MIN} caractères minimum` },\n 400,\n );\n }\n await db();\n const ex = await sqlite.execute({\n sql: \"SELECT verified FROM aco_users WHERE email = ?\",\n args: [email],\n });\n if (ex.rows[0] && Number(ex.rows[0][0]) === 1) {\n return json({\n error: \"Un compte existe déjà avec cette adresse — connecte-toi\",\n }, 409);\n }\n\n const salt = randomHex(16);\n\n await sqlite.execute({\n sql:\n `INSERT INTO aco_users(email, pass_h, salt, verified, created_at) VALUES(?,?,?,0,?)\n ON CONFLICT(email) DO UPDATE SET pass_h=excluded.pass_h, salt=excluded.salt`,\n args: [email, await hashPass(pass, salt), salt, Date.now()],\n });\n const r = await issueCode(email);\n if (r.err) return json({ error: r.err }, r.status);\n return json({ ok: true, etape: \"verification\" });\n }\n\n if (path === \"/auth/verify\" && request.method === \"POST\") {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email),\n code = String(body.code || \"\").trim();\n if (!email || !/^\\d{6}$/.test(code)) {\n return json({ error: \"Code invalide\" }, 400);\n }\n await db();\n const c = await checkCode(email, code);\n if (c.err) return json({ error: c.err }, c.status);\n await sqlite.execute({\n sql: \"UPDATE aco_users SET verified = 1 WHERE email = ?\",\n args: [email],\n });\n return json({ token: await newSession(email), email });\n }\n\n if (path === \"/auth/login\" && request.method === \"POST\") {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email), pass = String(body.password || \"\");\n if (!email || !pass) {\n return json({ error: \"Identifiants invalides\" }, 400);\n }\n await db();\n const now = Date.now();\n const lk = await sqlite.execute({\n sql: \"SELECT fails, locked_until FROM aco_logins WHERE email = ?\",\n args: [email],\n });\n if (lk.rows[0] && Number(lk.rows[0][1]) > now) {\n return json({\n error: \"Trop de tentatives — réessaie dans un quart d’heure\",\n }, 429);\n }\n\n const u = await sqlite.execute({\n sql: \"SELECT pass_h, salt, verified FROM aco_users WHERE email = ?\",\n args: [email],\n });\n const row = u.rows[0];\n\n const salt = row ? String(row[1]) : randomHex(16);\n const calc = await hashPass(pass, salt);\n const good = !!row && safeEqual(String(row[0]), calc);\n\n if (!good) {\n const fails = (lk.rows[0] ? Number(lk.rows[0][0]) : 0) + 1;\n await sqlite.execute({\n sql: `INSERT INTO aco_logins(email, fails, locked_until) VALUES(?,?,?)\n ON CONFLICT(email) DO UPDATE SET fails=excluded.fails, locked_until=excluded.locked_until`,\n args: [email, fails, fails >= LOGIN_FAILS ? now + LOGIN_LOCK : 0],\n });\n return json({ error: \"Email ou mot de passe incorrect\" }, 401);\n }\n if (Number(row[2]) !== 1) {\n const r = await issueCode(email);\n return json({\n error: \"Adresse non vérifiée — un code vient de t’être envoyé\",\n etape: \"verification\",\n envoye: !r.err,\n }, 403);\n }\n await sqlite.execute({\n sql: \"DELETE FROM aco_logins WHERE email = ?\",\n args: [email],\n });\n return json({ token: await newSession(email), email });\n }\n\n if (path === \"/auth/forgot\" && request.method === \"POST\") {\n const email = cleanEmail((await request.json().catch(() => ({}))).email);\n if (!email) return json({ error: \"Adresse email invalide\" }, 400);\n await db();\n const ex = await sqlite.execute({\n sql: \"SELECT email FROM aco_users WHERE email = ?\",\n args: [email],\n });\n\n if (ex.rows[0]) await issueCode(email);\n return json({ ok: true });\n }\n\n if (path === \"/auth/reset\" && request.method === \"POST\") {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email),\n code = String(body.code || \"\").trim();\n const pass = cleanPass(body.password);\n if (!email || !/^\\d{6}$/.test(code)) {\n return json({ error: \"Code invalide\" }, 400);\n }\n if (!pass) {\n return json(\n { error: `Mot de passe : ${PASS_MIN} caractères minimum` },\n 400,\n );\n }\n await db();\n const c = await checkCode(email, code);\n if (c.err) return json({ error: c.err }, c.status);\n const salt = randomHex(16);\n await sqlite.execute({\n sql:\n \"UPDATE aco_users SET pass_h = ?, salt = ?, verified = 1 WHERE email = ?\",\n args: [await hashPass(pass, salt), salt, email],\n });\n\n await sqlite.execute({\n sql: \"DELETE FROM aco_sessions WHERE email = ?\",\n args: [email],\n });\n await sqlite.execute({\n sql: \"DELETE FROM aco_logins WHERE email = ?\",\n args: [email],\n });\n purge();\n return json({ token: await newSession(email), email });\n }\n\n if (path === \"/auth/logout\" && request.method === \"POST\") {\n const h = request.headers.get(\"Authorization\") || \"\";\n const tok = h.startsWith(\"Bearer \") ? h.slice(7).trim() : \"\";\n if (tok) {\n await db();\n await sqlite.execute({\n sql: \"DELETE FROM aco_sessions WHERE token_h = ?\",\n args: [await sha256(tok)],\n });\n }\n return json({ ok: true });\n }\n\n if (path === \"/sync\") {\n const email = await sessionEmail(request);\n if (!email) {\n return json({ error: \"Session expirée — reconnecte-toi\" }, 401);\n }\n\n if (request.method === \"GET\") {\n const r = await sqlite.execute({\n sql: \"SELECT payload, updated_at FROM aco_trips WHERE email = ?\",\n args: [email],\n });\n const row = r.rows[0];\n return json(\n row\n ? {\n payload: JSON.parse(String(row[0])),\n updated_at: Number(row[1]),\n }\n : { payload: null, updated_at: 0 },\n );\n }\n if (request.method === \"POST\") {\n const body = await request.json().catch(() => null);\n if (!body || typeof body.payload === \"undefined\") {\n return json({ error: \"Contenu manquant\" }, 400);\n }\n const txt = JSON.stringify(body.payload);\n if (txt.length > MAX_PAYLOAD) {\n return json({ error: \"Sauvegarde trop volumineuse\" }, 413);\n }\n const now = Date.now();\n\n await sqlite.execute({\n sql: `INSERT INTO aco_trips(email, payload, updated_at) VALUES(?,?,?)\n ON CONFLICT(email) DO UPDATE SET payload=excluded.payload, updated_at=excluded.updated_at`,\n args: [email, txt, now],\n });\n return json({ ok: true, updated_at: now });\n }\n }\n\n if (path === \"/account\" && request.method === \"DELETE\") {\n const email = await sessionEmail(request);\n if (!email) {\n return json({ error: \"Session expirée — reconnecte-toi\" }, 401);\n }\n\n for (\n const t of [\n \"aco_trips\",\n \"aco_sessions\",\n \"aco_codes\",\n \"aco_logins\",\n \"aco_users\",\n \"aco_scores\",\n \"aco_ai\",\n ]\n ) {\n try {\n await sqlite.execute({\n sql: `DELETE FROM ${t} WHERE email = ?`,\n args: [email],\n });\n } catch (e) {}\n }\n return json({ ok: true });\n }\n\n if (path === \"/game/score\" && request.method === \"POST\") {\n const email = await sessionEmail(request);\n if (!email) {\n return json({ error: \"Connecte-toi pour enregistrer ton score\" }, 401);\n }\n const body = await request.json().catch(() => ({}));\n const score = Math.max(\n 0,\n Math.min(1_000_000, parseInt(body.score, 10) || 0),\n );\n const name = String(body.name || \"Voyageur\").trim().slice(0, 20) ||\n \"Voyageur\";\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_scores(\n email TEXT PRIMARY KEY, name TEXT NOT NULL, score INTEGER NOT NULL, at INTEGER NOT NULL)`);\n\n await sqlite.execute({\n sql: `INSERT INTO aco_scores(email, name, score, at) VALUES(?,?,?,?)\n ON CONFLICT(email) DO UPDATE SET name=excluded.name,\n score=MAX(aco_scores.score, excluded.score), at=excluded.at`,\n args: [email, name, score, Date.now()],\n });\n return json({ ok: true });\n }\n if (path === \"/game/top\") {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_scores(\n email TEXT PRIMARY KEY, name TEXT NOT NULL, score INTEGER NOT NULL, at INTEGER NOT NULL)`);\n const r = await sqlite.execute(\n `SELECT name, score FROM aco_scores ORDER BY score DESC, at ASC LIMIT 10`,\n );\n const top = (r.rows || []).map((row) => ({\n name: String(row.name ?? row[0]),\n score: Number(row.score ?? row[1]),\n }));\n return json({ top });\n }\n\n if (path === \"/admin/stats\") {\n const admin = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const email = await sessionEmail(request);\n\n if (!admin || !email || !safeEqual(email, admin)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n\n const K = 5;\n const now = Date.now(), J7 = now - 7 * 864e5, J30 = now - 30 * 864e5;\n\n const cnt = async (sql, args = []) => {\n const r = await sqlite.execute({ sql, args });\n const row = r.rows?.[0];\n return row ? Number(row.n ?? row[0]) : 0;\n };\n const comptes = {\n total: await cnt(`SELECT COUNT(*) AS n FROM aco_users`),\n verifies: await cnt(\n `SELECT COUNT(*) AS n FROM aco_users WHERE verified = 1`,\n ),\n nouveaux7j: await cnt(\n `SELECT COUNT(*) AS n FROM aco_users WHERE created_at > ?`,\n [J7],\n ),\n nouveaux30j: await cnt(\n `SELECT COUNT(*) AS n FROM aco_users WHERE created_at > ?`,\n [J30],\n ),\n };\n\n const courbe = [];\n try {\n const jours = new Map();\n for (let i = 29; i >= 0; i--) {\n const d = new Date(now - i * 864e5);\n jours.set(\n `${d.getUTCFullYear()}-${\n String(d.getUTCMonth() + 1).padStart(2, \"0\")\n }-${String(d.getUTCDate()).padStart(2, \"0\")}`,\n 0,\n );\n }\n const r = await sqlite.execute({\n sql: `SELECT created_at FROM aco_users WHERE created_at > ?`,\n args: [now - 30 * 864e5],\n });\n for (const row of (r.rows || [])) {\n const d = new Date(Number(row.created_at ?? row[0]));\n const k = `${d.getUTCFullYear()}-${\n String(d.getUTCMonth() + 1).padStart(2, \"0\")\n }-${String(d.getUTCDate()).padStart(2, \"0\")}`;\n if (jours.has(k)) jours.set(k, jours.get(k) + 1);\n }\n for (const [j, n] of jours) courbe.push({ j, n });\n } catch (e) {}\n\n const dest = new Map(), pays = new Map();\n const modes = { avion: 0, train: 0, voiture: 0, autre: 0 };\n const budget = { petit: 0, moyen: 0, confort: 0, eleve: 0, inconnu: 0 };\n const duree = {\n weekend: 0,\n semaine: 0,\n deuxSemaines: 0,\n plus: 0,\n inconnu: 0,\n };\n const avecQui = {\n solo: 0,\n couple: 0,\n amis: 0,\n famille: 0,\n collegues: 0,\n inconnu: 0,\n };\n const sejour = {\n hotel: 0,\n appartement: 0,\n auberge: 0,\n luxe: 0,\n inconnu: 0,\n };\n const mois = new Array(12).fill(0);\n let voyagesTotal = 0,\n avecPlan = 0,\n actifs7j = 0,\n actifs30j = 0,\n multiBase = 0;\n\n const casier = (v, table) => {\n const s = String(v || \"\").toLowerCase();\n for (const [motif, cle] of table) if (motif.test(s)) return cle;\n return \"inconnu\";\n };\n const T_BUDGET = [\n [/petit|<\\s*500|moins/, \"petit\"],\n [/moyen|500/, \"moyen\"],\n [/confort|1200/, \"confort\"],\n [/élev|eleve|2500|luxe/, \"eleve\"],\n ];\n const T_DUREE = [\n [/week|2-3/, \"weekend\"],\n [/1 semaine|7 j|une semaine/, \"semaine\"],\n [/2 semaines|14/, \"deuxSemaines\"],\n [/3 semaines|21|mois|\\+/, \"plus\"],\n ];\n const T_QUI = [\n [/solo|seul/, \"solo\"],\n [/couple/, \"couple\"],\n [/ami/, \"amis\"],\n [/famille|enfant/, \"famille\"],\n [/collègue|collegue|travail/, \"collegues\"],\n ];\n const T_SEJOUR = [\n [/hôtel|hotel/, \"hotel\"],\n [/appart|airbnb/, \"appartement\"],\n [/auberge|hostel|éco|eco/, \"auberge\"],\n [/luxe|luxury/, \"luxe\"],\n ];\n\n try {\n const rows =\n (await sqlite.execute(`SELECT payload, updated_at FROM aco_trips`))\n .rows || [];\n for (const row of rows) {\n voyagesTotal++;\n const maj = Number(row.updated_at ?? row[1]) || 0;\n if (maj > J7) actifs7j++;\n if (maj > J30) actifs30j++;\n try {\n const p = JSON.parse(String(row.payload ?? row[0]));\n const st = p?.trip || {};\n const nom = st?.trip?.nom, pa = st?.trip?.pays;\n if (nom) {\n dest.set(\n String(nom).slice(0, 60),\n (dest.get(String(nom).slice(0, 60)) || 0) + 1,\n );\n }\n if (pa) {\n pays.set(\n String(pa).slice(0, 60),\n (pays.get(String(pa).slice(0, 60)) || 0) + 1,\n );\n }\n const m = st?.cache?.plan?.transport?.mode;\n if (m && modes[m] !== undefined) modes[m]++;\n else if (m) modes.autre++;\n if (st?.cache?.plan) avecPlan++;\n if ((st?.cache?.plan?.logement?.etapes || []).length > 1) {\n multiBase++;\n }\n const pr = st?.prefs || {};\n budget[casier(pr.budget, T_BUDGET)]++;\n duree[casier(pr.days, T_DUREE)]++;\n avecQui[casier(pr.withWho, T_QUI)]++;\n sejour[casier(pr.stay, T_SEJOUR)]++;\n\n const dep = String(pr.depart || \"\");\n const mm = dep.match(/^\\d{4}-(\\d{2})/);\n if (mm) {\n const i = +mm[1] - 1;\n if (i >= 0 && i < 12) mois[i]++;\n }\n } catch (e) {}\n }\n } catch (e) {}\n\n const auSeuil = (map) => {\n const vus = [], masq = { lieux: 0, voyages: 0 };\n for (const [nom, n] of map) {\n if (n >= K) vus.push({ nom, n });\n else {\n masq.lieux++;\n masq.voyages += n;\n }\n }\n vus.sort((a, b) => b.n - a.n);\n return { vus: vus.slice(0, 12), masq };\n };\n const D = auSeuil(dest), P = auSeuil(pays);\n\n const assezDeMonde = voyagesTotal >= K;\n\n let jeu = [], joueurs = 0;\n try {\n const r = await sqlite.execute(\n `SELECT name, score FROM aco_scores ORDER BY score DESC LIMIT 10`,\n );\n jeu = (r.rows || []).map((x) => ({\n name: String(x.name ?? x[0]).slice(0, 20),\n score: Number(x.score ?? x[1]),\n }));\n joueurs = await cnt(`SELECT COUNT(*) AS n FROM aco_scores`);\n } catch (e) {}\n\n let appareils = 0, iaHeure = 0, iaComptes = 0;\n try {\n appareils = await cnt(\n `SELECT COUNT(*) AS n FROM aco_sessions WHERE expires_at > ?`,\n [now],\n );\n } catch (e) {}\n try {\n iaHeure = await cnt(\n `SELECT COALESCE(SUM(n),0) AS n FROM aco_ai WHERE window_start > ?`,\n [now - 3600 * 1000],\n );\n iaComptes = await cnt(\n `SELECT COUNT(*) AS n FROM aco_ai WHERE window_start > ?`,\n [now - 3600 * 1000],\n );\n } catch (e) {}\n\n return json({\n comptes,\n\n voyages: {\n total: voyagesTotal,\n avecPlan,\n actifs7j,\n actifs30j,\n multiBase: assezDeMonde ? multiBase : null,\n },\n courbe,\n destinations: D.vus,\n destinationsMasquees: D.masq,\n pays: P.vus,\n paysMasques: P.masq,\n\n transports: assezDeMonde ? modes : null,\n budget: assezDeMonde ? budget : null,\n duree: assezDeMonde ? duree : null,\n avecQui: assezDeMonde ? avecQui : null,\n sejour: assezDeMonde ? sejour : null,\n mois: assezDeMonde ? mois : null,\n assezDeMonde,\n technique: { appareils, iaHeure, iaComptes },\n jeu,\n joueurs,\n seuil: K,\n genere: now,\n });\n }\n\n if (path === \"/gemini/models\") {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env(\"GEMINI_KEY\")) {\n return json({ error: \"GEMINI_KEY non configurée\" }, 501);\n }\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models?key=${\n env(\"GEMINI_KEY\")\n }&pageSize=100`,\n );\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n if (path === \"/gemini\") {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env(\"GEMINI_KEY\")) {\n return json({ error: \"GEMINI_KEY non configurée\" }, 501);\n }\n const { model, body } = await request.json();\n const m = String(model || \"gemini-2.5-flash\").replace(\n /[^a-zA-Z0-9.\\-_]/g,\n \"\",\n );\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/${m}:generateContent?key=${\n env(\"GEMINI_KEY\")\n }`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n },\n );\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n if (path === \"/groq\") {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env(\"GROQ_KEY\")) {\n return json({ error: \"GROQ_KEY non configurée\" }, 501);\n }\n const { body } = await request.json();\n const r = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: `Bearer ${env(\"GROQ_KEY\")}`,\n },\n body: JSON.stringify(body),\n });\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n if (path === \"/hotels\") {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env(\"TRAVELPAYOUTS_KEY\")) {\n return json({ error: \"TRAVELPAYOUTS_KEY non configurée\" }, 501);\n }\n const p = url.searchParams;\n const api = new URL(\"https://engine.hotellook.com/api/v2/cache.json\");\n [\n \"location\",\n \"checkIn\",\n \"checkOut\",\n \"adults\",\n \"children\",\n \"currency\",\n \"limit\",\n ].forEach((k) => {\n if (p.get(k)) api.searchParams.set(k, p.get(k));\n });\n api.searchParams.set(\"token\", env(\"TRAVELPAYOUTS_KEY\"));\n const r = await fetch(api.toString(), {\n headers: { Accept: \"application/json\" },\n });\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n const target = url.searchParams.get(\"url\");\n if (target) {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n let u;\n try {\n u = new URL(target);\n } catch {\n return json({ error: \"URL invalide\" }, 400);\n }\n if (!RELAY_HOSTS.includes(u.hostname)) {\n return json({ error: \"Domaine non autorisé : \" + u.hostname }, 403);\n }\n const r = await fetch(u.toString(), {\n headers: { Accept: \"application/json\" },\n });\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n return json({\n error: \"Route inconnue\",\n routes: [\n \"/capabilities\",\n \"/gemini\",\n \"/gemini/models\",\n \"/groq\",\n \"/hotels\",\n \"/?url=\",\n ],\n }, 404);\n } catch (e) {\n return json({ error: \"Backend : \" + e.message }, 502);\n }\n}","label",[129],"pulls","branches",1,"forks","envVars",{"_148":150,"_151":61},"connections",{"_148":61,"_149":61},"count","unfilledCount",10,"emptyCount",{"_42":128,"_32":129,"_30":130,"_131":-5,"_40":41,"_39":132,"_133":48,"_37":153,"_13":135,"_33":136,"_35":137,"_24":48,"_138":-5,"_154":155,"_27":156},["D",1785748805913],"children",[],[129],["D",1784210218734],["D",1789473046147],{"_98":97,"_105":101},{"_98":97,"_99":97,"_100":101,"_18":55,"_102":103,"_104":48},{"_13":87,"_32":88,"_42":41,"_89":43,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":44,"_96":97},"ctx",{"_80":-5,"_124":195,"_196":197,"_198":199,"_200":48,"_201":48,"_202":48,"_203":25,"_204":-5,"_205":-7,"_206":-7,"_207":61,"_208":48,"_209":48,"_210":-5,"_211":48,"_212":48,"_213":48,"_214":-5},"ENV",{"_166":167,"_168":169,"_170":88,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v29