[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_172":173,"_174":175},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_106":88,"_27":53,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":123,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",43,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","2ec0f9a6-860b-11f1-83cf-1607ee4eb77e","name","fileType","http","content","// ===========================================================\n// FICHIER GENERE - NE PAS MODIFIER ICI.\n// Produit par : node outils/valtown-build.js\n// Source (commentee, a corriger la-bas) : valtown-backend.js\n// Les commentaires sont retires pour tenir sous les 80000 caracteres\n// que Val Town autorise par val. Relance le script apres chaque\n// correction : ce fichier est ecrase a chaque passage.\n//\n// --- Variables d'environnement (Val Town > onglet Secrets) ---\n// - ADMIN_EMAIL\n// - ALLOWED_ORIGIN\n// - EMAILJS_PRIVATE\n// - EMAILJS_PUBLIC\n// - EMAILJS_SERVICE\n// - EMAILJS_TEMPLATE\n// - GEMINI_KEY\n// - GROQ_KEY\n// - TRAVELPAYOUTS_KEY\n//\n// GEMINI_KEY et les quatre EMAILJS_* sont indispensables : sans elles,\n// la redaction d'articles et l'envoi de courriels ne marchent pas.\n// ALLOWED_ORIGIN = l'adresse du site, sans barre oblique finale.\n// ADMIN_EMAIL = l'adresse qui ouvre le panneau de statistiques.\n// ===========================================================\nconst RELAY_HOSTS = ['engine.hotellook.com', 'yasen.hotellook.com', 'api.travelpayouts.com'];\n\nconst AI_MAX_H = 120;\n\nimport { sqlite } from 'https://esm.town/v/std/sqlite';\n\nconst CODE_TTL = 10 * 60 * 1000; \nconst CODE_WAIT = 60 * 1000; \nconst CODE_TRIES = 5; \n\nconst SESS_TTL = 30 * 24 * 3600 * 1000;\nconst SESS_MAX = 5; \nconst MAX_PAYLOAD = 400_000; \nconst PASS_MIN = 8; \nconst PBKDF2_IT = 210_000; \nconst LOGIN_FAILS = 8; \nconst LOGIN_LOCK = 15 * 60 * 1000; \n\nlet _dbReady = null;\nfunction db() {\n \n if (!_dbReady) _dbReady = (async () => {\n \n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_users(\n email TEXT PRIMARY KEY, pass_h TEXT NOT NULL, salt TEXT NOT NULL,\n verified INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_logins(\n email TEXT PRIMARY KEY, fails INTEGER NOT NULL DEFAULT 0,\n locked_until INTEGER NOT NULL DEFAULT 0)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_codes(\n email TEXT PRIMARY KEY, code_h TEXT NOT NULL, expires_at INTEGER NOT NULL,\n tries INTEGER NOT NULL DEFAULT 0, sent_at INTEGER NOT NULL)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_sessions(\n token_h TEXT PRIMARY KEY, email TEXT NOT NULL, expires_at INTEGER NOT NULL)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_trips(\n email TEXT PRIMARY KEY, payload TEXT NOT NULL, updated_at INTEGER NOT NULL)`);\n \n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_posts(\n slug TEXT PRIMARY KEY, sujet TEXT NOT NULL, categorie TEXT NOT NULL,\n titre TEXT NOT NULL, sous_titre TEXT, resume TEXT, lecture TEXT,\n corps TEXT NOT NULL, image TEXT, credit TEXT,\n statut TEXT NOT NULL DEFAULT 'brouillon', created_at INTEGER NOT NULL)`);\n })();\n return _dbReady;\n}\n\nasync function sha256(txt) {\n const b = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(txt));\n return [...new Uint8Array(b)].map(x => x.toString(16).padStart(2, '0')).join('');\n}\nfunction randomHex(bytes = 32) {\n return [...crypto.getRandomValues(new Uint8Array(bytes))]\n .map(x => x.toString(16).padStart(2, '0')).join('');\n}\n\nasync function hashPass(password, saltHex) {\n const salt = Uint8Array.from(saltHex.match(/../g).map(h => parseInt(h, 16)));\n const key = await crypto.subtle.importKey(\n 'raw', new TextEncoder().encode(password), 'PBKDF2', false, ['deriveBits']);\n const bits = await crypto.subtle.deriveBits(\n { name: 'PBKDF2', salt, iterations: PBKDF2_IT, hash: 'SHA-256' }, key, 256);\n return [...new Uint8Array(bits)].map(x => x.toString(16).padStart(2, '0')).join('');\n}\n\nfunction safeEqual(a, b) {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\nfunction cleanPass(v) {\n const p = String(v || '');\n return p.length >= PASS_MIN && p.length <= 200 ? p : null;\n}\n\nfunction cleanEmail(v) {\n const e = String(v || '').trim().toLowerCase();\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(e) && e.length <= 190 ? e : null;\n}\n\nasync function sessionEmail(request) {\n const h = request.headers.get('Authorization') || '';\n const tok = h.startsWith('Bearer ') ? h.slice(7).trim() : '';\n if (tok.length < 32) return null;\n await db();\n const r = await sqlite.execute({\n sql: 'SELECT email, expires_at FROM aco_sessions WHERE token_h = ?',\n args: [await sha256(tok)],\n });\n const row = r.rows[0];\n if (!row) return null;\n if (Number(row[1]) < Date.now()) { \n await sqlite.execute({ sql: 'DELETE FROM aco_sessions WHERE token_h = ?', args: [await sha256(tok)] });\n return null;\n }\n return String(row[0]);\n}\n\nfunction mailReady(env) {\n return !!(env('EMAILJS_PUBLIC') && env('EMAILJS_PRIVATE')\n && env('EMAILJS_SERVICE') && env('EMAILJS_TEMPLATE'));\n}\n\nasync function diagTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS aco_diag(k TEXT PRIMARY KEY, v TEXT NOT NULL, ts INTEGER NOT NULL)`);\n}\n\nasync function aiGuard(request) {\n const email = await sessionEmail(request);\n if (!email) return { err: 'Connecte-toi pour utiliser Acolyte', status: 401 };\n try {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_ai(\n email TEXT PRIMARY KEY, n INTEGER NOT NULL, window_start INTEGER NOT NULL)`);\n const now = Date.now(), H = 3600 * 1000;\n const r = await sqlite.execute({ sql: 'SELECT n, window_start FROM aco_ai WHERE email = ?', args: [email] });\n const row = r.rows[0];\n const debut = row ? Number(row[1]) : 0;\n \n const n = (row && now - debut < H) ? Number(row[0]) : 0;\n const fenetre = (row && now - debut < H) ? debut : now;\n if (n >= AI_MAX_H) return { err: 'Beaucoup de demandes d’un coup — réessaie dans un moment', status: 429 };\n await sqlite.execute({\n sql: `INSERT INTO aco_ai(email, n, window_start) VALUES(?,?,?)\n ON CONFLICT(email) DO UPDATE SET n = excluded.n, window_start = excluded.window_start`,\n args: [email, n + 1, fenetre],\n });\n } catch (e) { }\n return { email };\n}\n\nasync function purge() {\n try {\n const now = Date.now();\n await sqlite.execute({ sql: 'DELETE FROM aco_sessions WHERE expires_at < ?', args: [now] });\n await sqlite.execute({ sql: 'DELETE FROM aco_codes WHERE expires_at < ?', args: [now - 3600 * 1000] });\n await sqlite.execute({ sql: 'DELETE FROM aco_logins WHERE locked_until < ? AND fails > 0', args: [now - 24 * 3600 * 1000] });\n } catch (e) {}\n}\n\nasync function noteMail(msg) {\n try {\n await diagTable();\n await sqlite.execute({\n sql: `INSERT INTO aco_diag(k, v, ts) VALUES('mail', ?, ?)\n ON CONFLICT(k) DO UPDATE SET v = excluded.v, ts = excluded.ts`,\n args: [String(msg).slice(0, 300), Date.now()],\n });\n } catch (e) { }\n}\nasync function readMail() {\n try {\n await diagTable();\n const r = await sqlite.execute({ sql: `SELECT v, ts FROM aco_diag WHERE k = 'mail'`, args: [] });\n if (!r.rows || !r.rows[0]) return 'aucun envoi enregistré';\n const row = r.rows[0];\n \n const v = row.v ?? row[0], ts = Number(row.ts ?? row[1]);\n return `${v} (il y a ${Math.round((Date.now() - ts) / 1000)} s)`;\n } catch (e) {\n \n return 'ERREUR DE LECTURE → ' + String(e && e.message || e).slice(0, 200);\n }\n}\n\nasync function sendCodeMail(env, email, code) {\n if (!mailReady(env)) { await noteMail('variables EMAILJS_* incomplètes'); return false; }\n try {\n const r = await fetch('https://api.emailjs.com/api/v1.0/email/send', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n service_id: env('EMAILJS_SERVICE'),\n template_id: env('EMAILJS_TEMPLATE'),\n user_id: env('EMAILJS_PUBLIC'),\n accessToken: env('EMAILJS_PRIVATE'),\n template_params: { to_email: email, email, code },\n }),\n });\n const txt = await r.text().catch(() => '');\n const why = `HTTP ${r.status} · ${txt.slice(0, 200) || '(corps vide)'}`;\n console.log('[acolyte] EmailJS →', why); \n await noteMail(why);\n return r.ok;\n } catch (e) {\n const why = 'appel impossible : ' + String(e).slice(0, 120);\n console.log('[acolyte] EmailJS →', why);\n await noteMail(why);\n return false;\n }\n}\n\nexport default async function (request) {\n const env = (k) => Deno.env.get(k) || '';\n const origin = request.headers.get('Origin') || '';\n \n const allowedBrut = env('ALLOWED_ORIGIN') || '*';\n const allowedList = allowedBrut.split(',').map(s => s.trim().replace(/\\/+$/, '')).filter(Boolean);\n const allowed = allowedList[0] || '*';\n const okOrigin = allowedBrut === '*'\n || allowedList.includes(origin)\n || origin.startsWith('http://localhost');\n const cors = {\n \n 'Access-Control-Allow-Origin': okOrigin ? (origin || '*') : allowed,\n 'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',\n 'Access-Control-Allow-Headers': 'Content-Type, Authorization',\n 'Access-Control-Max-Age': '86400',\n 'Vary': 'Origin',\n };\n const json = (obj, status = 200) =>\n new Response(JSON.stringify(obj), { status, headers: { ...cors, 'Content-Type': 'application/json; charset=utf-8' } });\n\n if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers: cors });\n\n const url = new URL(request.url);\n const path = url.pathname.replace(/\\/+$/, '');\n\n if (path === '/ping') {\n return json({\n ok: true,\n service: 'Acolyte backend',\n origines_attendues: allowedBrut === '*' ? '*' : allowedList,\n origine_recue: origin || '(aucune — navigation directe, c’est normal)',\n cette_origine_passe: okOrigin,\n heure: new Date().toISOString(),\n aide: allowedBrut === '*'\n ? 'ALLOWED_ORIGIN n’est pas définie : le backend accepte TOUTES les origines. À corriger avant la mise en service.'\n : 'ALLOWED_ORIGIN accepte plusieurs origines séparées par des virgules. Une origine = protocole + domaine, SANS chemin ni barre oblique finale. Ex. : https://lechat45.github.io',\n });\n }\n\n const STAT_CLES = new Set([\n 'arrivee', 'inscription', 'connexion',\n 'questions_finies', 'questions_passees',\n 'voyage_genere', 'voyage_ouvert', 'carte_ouverte', 'blog_ouvert',\n 'assistant_utilise', 'horaires_verifies', 'install'\n ]);\n async function statTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_stats(\n jour TEXT NOT NULL, cle TEXT NOT NULL, n INTEGER NOT NULL DEFAULT 0,\n PRIMARY KEY(jour, cle))`);\n }\n \n if (path === '/stat' && request.method === 'POST') {\n try {\n const b = await request.json().catch(() => ({}));\n const cle = String(b?.cle || '');\n if (!STAT_CLES.has(cle)) return json({ ok: false }, 204);\n await statTable();\n const jour = new Date().toISOString().slice(0, 10);\n await sqlite.execute({\n sql: `INSERT INTO aco_stats(jour, cle, n) VALUES(?, ?, 1)\n ON CONFLICT(jour, cle) DO UPDATE SET n = n + 1`,\n args: [jour, cle] });\n } catch (e) { }\n return json({ ok: true });\n }\n\n const SANS_ORIGINE = new Set(['/ping', '/promo/stop', '/blog/tick', '/blog']);\n if (!okOrigin && !SANS_ORIGINE.has(path)) return json({ error: 'Origine non autorisée' }, 403);\n\n try {\n \n const BLOG_CATS = { nature:'Merveille naturelle', bati:'Merveille bâtie', ville:'Grande ville' };\n \n const slugify = (s) => String(s || '').normalize('NFD').replace(/[̀-ͯ]/g, '')\n .toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 70);\n\n async function blogTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_posts(\n slug TEXT PRIMARY KEY, sujet TEXT NOT NULL, categorie TEXT NOT NULL,\n titre TEXT NOT NULL, sous_titre TEXT, resume TEXT, lecture TEXT,\n corps TEXT NOT NULL, image TEXT, credit TEXT,\n statut TEXT NOT NULL DEFAULT 'brouillon', created_at INTEGER NOT NULL)`);\n }\n\n async function wikiResume(langue, titre) {\n try {\n const r = await fetch(`https://${langue}.wikipedia.org/api/rest_v1/page/summary/`\n + encodeURIComponent(titre), { headers: { 'Accept': 'application/json' } });\n if (!r.ok) return '';\n const d = await r.json();\n return d?.originalimage?.source || d?.thumbnail?.source || '';\n } catch (e) { return ''; }\n }\n async function wikiCherche(langue, texte) {\n try {\n const r = await fetch(`https://${langue}.wikipedia.org/w/api.php?action=query&list=search`\n + `&srsearch=${encodeURIComponent(texte)}&srlimit=1&format=json&origin=*`);\n if (!r.ok) return '';\n const d = await r.json();\n return d?.query?.search?.[0]?.title || '';\n } catch (e) { return ''; }\n }\n async function blogImage(sujet) {\n const propre = String(sujet || '').trim();\n if (!propre) return { url: '', credit: '' };\n \n let src = await wikiResume('fr', propre);\n \n if (!src) {\n const vrai = await wikiCherche('fr', propre);\n if (vrai && vrai.toLowerCase() !== propre.toLowerCase()) src = await wikiResume('fr', vrai);\n }\n \n if (!src) {\n const en = await wikiCherche('en', propre);\n if (en) src = await wikiResume('en', en);\n }\n if (!src) return { url: '', credit: '' };\n \n return { url: src.replace(/\\/\\d+px-/, '/960px-'), credit: 'Wikipédia' };\n }\n\n function blogPrompt(sujet, categorie, ton) {\n const cat = BLOG_CATS[categorie] || 'Merveille du monde';\n const tons = { vivant:'vivant et immersif', sobre:'informatif et sobre',\n poetique:'poétique et évocateur', concis:'concis et direct' };\n return `Tu es grand reporter, géographe et historien, et tu écris pour le magazine Acolyte.\nRédige un grand article de fond sur : ${sujet}.\nCatégorie : ${cat}. Ton : ${tons[ton] || tons.vivant}.\n\nExigences :\n1. Français impeccable, vivant, précis. Niveau grand reportage — jamais de remplissage.\n2. 4 à 5 sections, titres évocateurs. Chaque section fait 3 paragraphes DENSES et intègre :\n les origines (histoire, géologie ou architecture), une anecdote ou légende peu connue,\n la géographie ou l'atmosphère du lieu, et un conseil d'initié (bonne heure, coin discret).\n3. 6 à 8 faits chiffrés PRÉCIS et vérifiables : hauteur ou superficie, année ou époque,\n fréquentation annuelle, matériaux ou géologie, localisation, meilleure saison.\n4. RÈGLE ABSOLUE : uniquement des faits réels et vérifiables. Si tu n'es pas sûr d'un\n chiffre, donne un ordre de grandeur ou omets-le. N'invente RIEN.\n5. N'écris ni HTML ni Markdown : uniquement du texte. La mise en forme est faite ailleurs.\n\nCe qui sépare un bon article d'un texte d'IA — applique-le :\n6. ATTAQUE. Commence par une scène concrète, un détail sensoriel ou un chiffre qui\n surprend. Jamais par une définition ni par « Situé au cœur de… ».\n7. PHRASES INÉGALES. Alterne les longueurs. Une phrase courte après deux longues frappe.\n Un paragraphe entier de phrases de même longueur endort.\n8. DU CONCRET, PAS DES ADJECTIFS. « Un escalier de 1 350 marches taillé dans le basalte »\n vaut mieux que « un lieu absolument époustouflant ». Bannis : incontournable,\n emblématique, véritable joyau, à couper le souffle, mythique, unique au monde,\n qui ne laisse personne indifférent, plongez au cœur de.\n9. PAS DE CONCLUSION QUI RÉSUME. La dernière section apporte quelque chose de neuf ;\n elle ne récapitule pas ce qu'on vient de lire.\n10. VOIX ACTIVE, présent de narration quand ça sert la scène. Pas de « il est\n intéressant de noter que », pas de « en conclusion », pas de « de nos jours ».\n11. NOMS PROPRES. Cite des personnes, des dates, des matériaux, des rues, des plats\n précis. C'est ce qui prouve qu'on connaît le lieu.\n12. Le titre ne contient ni « : » suivi d'un slogan, ni superlatif creux. Il dit une\n chose précise sur CE lieu-là.\n\nRéponds UNIQUEMENT en JSON :\n{\n \"titre\":\"titre captivant, sans deux-points à rallonge\",\n \"sous_titre\":\"une phrase d'accroche\",\n \"resume\":\"2-3 phrases qui donnent envie de lire\",\n \"lecture\":\"ex : 6 min de lecture\",\n \"sujet\":\"le nom exact du lieu traité\",\n \"sections\":[{\"titre\":\"titre de section\",\"texte\":\"3 paragraphes séparés par des retours à la ligne\"}],\n \"faits\":[{\"label\":\"Hauteur\",\"valeur\":\"324 m\"}],\n \"tags\":[\"3 à 5 mots-clés\"]\n}`;\n }\n\n const BLOG_INTERVALLE_DEFAUT = 1; \n \n const BLOG_RETRI_MINUTES = 6;\n \n const BLOG_AMORCE = [\n ['Mont Fuji','nature'], ['Grand Canyon','nature'], ['Aurores boréales','nature'],\n ['Chutes Victoria','nature'], ['Baie d’Halong','nature'], ['Fjords de Norvège','nature'],\n ['Salar d’Uyuni','nature'], ['Great Barrier Reef','nature'], ['Cappadoce','nature'],\n ['Colisée','bati'], ['Taj Mahal','bati'], ['Machu Picchu','bati'],\n ['Sagrada Família','bati'], ['Angkor Vat','bati'], ['Petra','bati'],\n ['Grande Muraille','bati'], ['Mont Saint-Michel','bati'], ['Alhambra','bati'],\n \n ['Tour Eiffel','bati'], ['Palais de Westminster','bati'],\n ['Statue de la Liberté','bati'], ['Opéra de Sydney','bati'],\n ['Pyramide de Khéops','bati'], ['Tour de Pise','bati'],\n ['Parthénon','bati'], ['Château de Neuschwanstein','bati'],\n ['Chichén Itzá','bati'], ['Basilique Saint-Marc','bati'],\n ['Tokyo','ville'], ['Lisbonne','ville'], ['Istanbul','ville'], ['Marrakech','ville'],\n ['Kyoto','ville'], ['Buenos Aires','ville'], ['Copenhague','ville'], ['Séville','ville'],\n ];\n\n async function blogConfTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_conf(k TEXT PRIMARY KEY, v TEXT NOT NULL)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_queue(\n sujet TEXT PRIMARY KEY, categorie TEXT NOT NULL,\n statut TEXT NOT NULL DEFAULT 'attente', ajoute_le INTEGER NOT NULL)`);\n }\n async function conf(k, defaut) {\n await blogConfTable();\n const r = await sqlite.execute({ sql: 'SELECT v FROM aco_conf WHERE k = ?', args: [k] });\n return r.rows[0] ? String(r.rows[0].v ?? r.rows[0][0]) : defaut;\n }\n async function setConf(k, v) {\n await blogConfTable();\n await sqlite.execute({\n sql: `INSERT INTO aco_conf(k,v) VALUES(?,?) ON CONFLICT(k) DO UPDATE SET v = excluded.v`,\n args: [k, String(v)] });\n }\n\n async function blogRegarnit() {\n await blogConfTable(); await blogTable();\n const pris = new Set();\n try {\n const a = await sqlite.execute(`SELECT sujet FROM aco_posts`);\n for (const r of (a.rows || [])) pris.add(slugify(String(r.sujet ?? r[0])));\n const b = await sqlite.execute(`SELECT sujet FROM aco_queue`);\n for (const r of (b.rows || [])) pris.add(slugify(String(r.sujet ?? r[0])));\n } catch (e) {}\n\n const aAjouter = [];\n \n const TOPONYME = /^[\\p{L}][\\p{L}\\p{M}\\s'’\\-.]{2,39}$/u;\n const nomPublicOk = (s) => TOPONYME.test(s) && !/\\d|@|https?:|www\\./i.test(s);\n const SEUIL_PARTAGE = 2;\n try {\n const rows = (await sqlite.execute(`SELECT payload FROM aco_trips LIMIT 400`)).rows || [];\n const vus = new Map();\n for (const row of rows) {\n try {\n const st = JSON.parse(String(row.payload ?? row[0]))?.trip || {};\n const nom = String(st?.trip?.nom ?? '').trim().slice(0, 40);\n if (!nom || /→/.test(nom) || !nomPublicOk(nom)) continue;\n vus.set(nom, (vus.get(nom) || 0) + 1);\n } catch (e) {}\n }\n \n for (const [nom, n] of [...vus.entries()].sort((x, y) => y[1] - x[1])) {\n if (n < SEUIL_PARTAGE) continue;\n if (!pris.has(slugify(nom))) { aAjouter.push([nom, 'ville']); pris.add(slugify(nom)); }\n }\n } catch (e) {}\n \n for (const [nom, cat] of BLOG_AMORCE) {\n if (!pris.has(slugify(nom))) { aAjouter.push([nom, cat]); pris.add(slugify(nom)); }\n }\n\n if (!aAjouter.length && env('GEMINI_KEY')) {\n try {\n const dejaVus = [...pris].slice(-120).join(', ');\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${env('GEMINI_KEY')}`,\n { method: 'POST', headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n contents: [{ parts: [{ text:\n `Donne 25 destinations de voyage réelles et notables à traiter dans un blog de voyage francophone.\\n`\n + `Interdit d'utiliser ces sujets, déjà traités : ${dejaVus}\\n`\n + `Varie les continents et les genres. Pour chacune, la catégorie exacte parmi :\\n`\n + `\"nature\" (merveille naturelle), \"bati\" (monument ou site construit), \"ville\" (grande ville).\\n`\n + `Réponds en JSON strict : {\"sujets\":[{\"nom\":\"...\",\"categorie\":\"nature|bati|ville\"}]}\\n`\n + `Le \"nom\" est un toponyme seul, sans chiffre, sans ponctuation superflue, 3 à 39 caractères.` }] }],\n generationConfig: { responseMimeType: 'application/json', temperature: 0.9, maxOutputTokens: 2048 },\n }) });\n if (r.ok) {\n const d = await r.json();\n const brut = d?.candidates?.[0]?.content?.parts?.[0]?.text || '{}';\n const sujets = JSON.parse(brut)?.sujets || [];\n const CATS = new Set(['nature', 'bati', 'ville']);\n for (const s of sujets) {\n const nom = String(s?.nom ?? '').trim().slice(0, 40);\n const cat = String(s?.categorie ?? '').trim();\n \n if (!nom || !nomPublicOk(nom) || !CATS.has(cat)) continue;\n if (pris.has(slugify(nom))) continue;\n aAjouter.push([nom, cat]); pris.add(slugify(nom));\n }\n }\n } catch (e) {}\n }\n\n const now = Date.now();\n for (const [nom, cat] of aAjouter.slice(0, 60)) {\n try {\n await sqlite.execute({\n sql: `INSERT INTO aco_queue(sujet,categorie,statut,ajoute_le) VALUES(?,?,'attente',?)\n ON CONFLICT(sujet) DO NOTHING`, args: [nom, cat, now] });\n } catch (e) {}\n }\n return aAjouter.length;\n }\n\n async function blogRedige(sujet, categorie, ton, statut) {\n if (!env('GEMINI_KEY')) return { erreur: 'GEMINI_KEY non configurée', code: 501 };\n const slug = slugify(sujet);\n await blogTable();\n let data;\n try {\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${env('GEMINI_KEY')}`,\n { method: 'POST', headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n contents: [{ parts: [{ text: blogPrompt(sujet, categorie, ton) }] }],\n generationConfig: { responseMimeType: 'application/json', temperature: 0.75, maxOutputTokens: 8192 },\n }) });\n if (!r.ok) return { erreur: 'Le moteur de rédaction a refusé la demande (' + r.status + ')', code: 502 };\n const g = await r.json();\n const txt = g?.candidates?.[0]?.content?.parts?.[0]?.text || '';\n const m = txt.match(/\\{[\\s\\S]*\\}/);\n data = JSON.parse(m ? m[0] : txt);\n } catch (e) { return { erreur: 'Réponse illisible du moteur de rédaction', code: 502 }; }\n if (!data?.titre || !Array.isArray(data.sections) || !data.sections.length)\n return { erreur: 'Article incomplet', code: 502 };\n\n async function relire(art) {\n try {\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${env('GEMINI_KEY')}`,\n { method: 'POST', headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n contents: [{ parts: [{ text:\n`Tu es chef d'édition. Voici un article destiné à la publication. Réécris-le pour le rendre MEILLEUR, sans rien inventer.\n\nARTICLE : ${JSON.stringify({ titre: art.titre, sous_titre: art.sous_titre, resume: art.resume, sections: art.sections })}\n\nCe que tu corriges, dans cet ordre :\n1. LA LANGUE DE BOIS. Supprime : incontournable, emblématique, véritable joyau, à couper le souffle, mythique, unique au monde, ne laisse personne indifférent, plongez au cœur de, véritable, authentique, magique, féerique. Remplace chacun par un FAIT concret ou coupe la phrase.\n2. LES ATTAQUES MOLLES. Si une section commence par « Situé au cœur de », « Niché entre », une définition ou une généralité, refais la première phrase : une scène, un détail matériel, ou un chiffre qui surprend.\n3. LE RYTHME. Si trois phrases de suite ont la même longueur, casse-en une. Une phrase courte après deux longues frappe.\n4. LES RÉPÉTITIONS. Un même mot marquant ne revient pas deux fois dans le même paragraphe.\n5. LA CONCLUSION QUI RÉSUME. Si la dernière section récapitule ce qu'on vient de lire, remplace-la par quelque chose de neuf : ce que le lieu devient hors saison, ce qu'on y entend à l'aube, ce que les habitants en disent.\n6. LE TITRE. S'il contient un superlatif creux ou un slogan après deux-points, refais-le : il doit dire une chose précise sur CE lieu.\n\nRÈGLES ABSOLUES :\n· N'INVENTE AUCUN FAIT, aucun chiffre, aucun nom. Tu réécris, tu ne documentes pas. Si une phrase te paraît douteuse, rends-la plus prudente au lieu de la préciser.\n· Garde le même nombre de sections et le même sujet.\n· Ni HTML ni Markdown : du texte seulement. Les paragraphes sont séparés par des retours à la ligne.\n\nRéponds UNIQUEMENT en JSON :\n{\"titre\":\"…\",\"sous_titre\":\"…\",\"resume\":\"…\",\"sections\":[{\"titre\":\"…\",\"texte\":\"…\"}]}` }] }],\n generationConfig: { responseMimeType: 'application/json', temperature: 0.6, maxOutputTokens: 8192 },\n }) });\n if (!r.ok) return null;\n const g = await r.json();\n const txt = g?.candidates?.[0]?.content?.parts?.[0]?.text || '';\n const m = txt.match(/\\{[\\s\\S]*\\}/);\n const v = JSON.parse(m ? m[0] : txt);\n \n if (!v?.titre || !Array.isArray(v.sections)) return null;\n if (v.sections.length !== art.sections.length) return null;\n const avant = art.sections.reduce((n, s) => n + String(s.texte || '').length, 0);\n const apres = v.sections.reduce((n, s) => n + String(s.texte || '').length, 0);\n if (apres < avant * 0.75) return null; \n return v;\n } catch (e) { return null; }\n }\n const mieux = await relire(data);\n if (mieux) {\n data = { ...data, titre: mieux.titre, sous_titre: mieux.sous_titre || data.sous_titre,\n resume: mieux.resume || data.resume, sections: mieux.sections, _relu: 1 };\n }\n\n const corps = {\n sections: data.sections.slice(0, 8).map(s => ({\n titre: String(s.titre || '').slice(0, 140),\n texte: String(s.texte || '').slice(0, 6000),\n })),\n faits: (Array.isArray(data.faits) ? data.faits : []).slice(0, 10).map(f => ({\n label: String(f.label || '').slice(0, 60), valeur: String(f.valeur || '').slice(0, 90),\n })),\n tags: (Array.isArray(data.tags) ? data.tags : []).slice(0, 6).map(t => String(t).slice(0, 40)),\n };\n const img = await blogImage(String(data.sujet || sujet));\n const now = Date.now();\n await sqlite.execute({\n sql: `INSERT INTO aco_posts(slug,sujet,categorie,titre,sous_titre,resume,lecture,corps,image,credit,statut,created_at)\n VALUES(?,?,?,?,?,?,?,?,?,?,?,?)\n ON CONFLICT(slug) DO UPDATE SET sujet=excluded.sujet,categorie=excluded.categorie,\n titre=excluded.titre,sous_titre=excluded.sous_titre,resume=excluded.resume,\n lecture=excluded.lecture,corps=excluded.corps,image=excluded.image,credit=excluded.credit`,\n args: [slug, String(data.sujet || sujet).slice(0, 80), categorie,\n String(data.titre).slice(0, 180), String(data.sous_titre || '').slice(0, 240),\n String(data.resume || '').slice(0, 600), String(data.lecture || '').slice(0, 40),\n JSON.stringify(corps), img.url, img.credit, statut || 'brouillon', now],\n });\n return { ok: true, slug, titre: String(data.titre), sections: corps.sections.length, image: !!img.url };\n }\n\n if (path === '/blog/tick') {\n const actif = (await conf('blog_auto', '1')) === '1';\n if (!actif) return json({ fait: false, raison: 'automatisme en pause' });\n const intervalle = Math.max(1, parseInt(await conf('blog_intervalle', String(BLOG_INTERVALLE_DEFAUT)), 10) || BLOG_INTERVALLE_DEFAUT);\n const dernier = parseInt(await conf('blog_dernier', '0'), 10) || 0;\n const reste = dernier + intervalle * 3600e3 - Date.now();\n if (reste > 0) return json({ fait: false, raison: 'pas encore l’heure', dans_minutes: Math.ceil(reste / 60e3) });\n\n await setConf('blog_dernier', String(Date.now()));\n\n const replier = async () => {\n await setConf('blog_dernier',\n String(Date.now() - intervalle * 3600e3 + BLOG_RETRI_MINUTES * 60e3));\n };\n const compte = async (cle) => {\n const n = parseInt(await conf(cle, '0'), 10) || 0;\n await setConf(cle, String(n + 1));\n };\n\n await blogConfTable();\n let q = await sqlite.execute(`SELECT sujet,categorie FROM aco_queue WHERE statut = 'attente' ORDER BY ajoute_le ASC LIMIT 1`);\n if (!q.rows[0]) { \n await blogRegarnit();\n q = await sqlite.execute(`SELECT sujet,categorie FROM aco_queue WHERE statut = 'attente' ORDER BY ajoute_le ASC LIMIT 1`);\n }\n if (!q.rows[0]) { await replier(); return json({ fait: false, raison: 'plus aucun sujet à traiter', retente_dans_minutes: BLOG_RETRI_MINUTES }); }\n\n const sujet = String(q.rows[0].sujet ?? q.rows[0][0]);\n const categorie = String(q.rows[0].categorie ?? q.rows[0][1]);\n let r;\n try {\n r = await blogRedige(sujet, categorie, 'vivant', 'publie');\n } catch (e) {\n \n r = { ok: false, erreur: String(e && e.message || e).slice(0, 200) };\n }\n await sqlite.execute({ sql: `UPDATE aco_queue SET statut = ? WHERE sujet = ?`,\n args: [r.ok ? 'ecrit' : 'echec', sujet] });\n if (!r.ok) {\n await replier();\n await compte('blog_echecs');\n return json({ fait: false, sujet, erreur: r.erreur, retente_dans_minutes: BLOG_RETRI_MINUTES });\n }\n \n await setConf('blog_dernier_ok', String(Date.now()));\n await compte('blog_ecrits');\n return json({ fait: true, sujet, slug: r.slug, titre: r.titre, prochain_dans_h: intervalle });\n }\n\n async function promoTable() {\n await blogConfTable();\n \n try {\n await sqlite.execute(`ALTER TABLE aco_users ADD COLUMN promo_ok INTEGER NOT NULL DEFAULT 0`);\n } catch (e) {}\n }\n \n async function promoSecret() {\n let s = await conf('promo_secret', '');\n if (!s) { s = randomHex(32); await setConf('promo_secret', s); }\n return s;\n }\n async function promoJeton(email) {\n const cle = await crypto.subtle.importKey('raw',\n new TextEncoder().encode(await promoSecret()),\n { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);\n const sig = await crypto.subtle.sign('HMAC', cle, new TextEncoder().encode(email));\n return [...new Uint8Array(sig)].map(x => x.toString(16).padStart(2, '0')).join('').slice(0, 32);\n }\n\n if (path === '/promo/stop') {\n await promoTable();\n const email = String(url.searchParams.get('e') || '').trim().toLowerCase().slice(0, 160);\n const jeton = String(url.searchParams.get('t') || '');\n if (!email || !jeton) return json({ error: 'lien incomplet' }, 400);\n const attendu = await promoJeton(email);\n \n if (!safeEqual(jeton, attendu)) return json({ error: 'lien invalide' }, 403);\n await sqlite.execute({ sql: `UPDATE aco_users SET promo_ok = 0 WHERE email = ?`, args: [email] });\n return new Response(\n 'Désinscription'\n + ''\n + '

C’est fait.

'\n + '

Tu ne recevras plus d’offres de voyage d’Acolyte. Ton compte et tes voyages ne sont pas touchés.

',\n { status: 200, headers: { ...cors, 'Content-Type': 'text/html; charset=utf-8' } });\n }\n\n if (path === '/admin/stats') {\n const adm = env('ADMIN_EMAIL').trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) return json({ error: 'Accès refusé' }, 403);\n await statTable();\n \n const depuis = new Date(Date.now() - 60 * 864e5).toISOString().slice(0, 10);\n const rows = (await sqlite.execute({\n sql: `SELECT jour, cle, n FROM aco_stats WHERE jour >= ? ORDER BY jour DESC`,\n args: [depuis] })).rows || [];\n const parJour = {}, totaux = {};\n for (const r of rows) {\n const j = String(r.jour ?? r[0]), c = String(r.cle ?? r[1]), n = Number(r.n ?? r[2]) || 0;\n (parJour[j] = parJour[j] || {})[c] = n;\n totaux[c] = (totaux[c] || 0) + n;\n }\n \n const pc = (a, b) => b ? Math.round((a / b) * 100) : null;\n const e = totaux;\n return json({\n ok: true, jours: parJour, totaux,\n entonnoir: {\n arrivees: e.arrivee || 0,\n inscrits: e.inscription || 0, taux_inscription: pc(e.inscription, e.arrivee),\n questions_au_bout: e.questions_finies || 0,\n questions_passees: e.questions_passees || 0,\n voyages_generes: e.voyage_genere || 0, taux_voyage: pc(e.voyage_genere, e.inscription)\n }\n });\n }\n\n if (path === '/admin/promo') {\n const adm = env('ADMIN_EMAIL').trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) return json({ error: 'Accès refusé' }, 403);\n await promoTable();\n\n if (request.method === 'POST') {\n const b = await request.json().catch(() => ({}));\n\n if (typeof b.actif !== 'undefined') {\n await setConf('promo_actif', b.actif ? '1' : '0');\n }\n\n if (b.envoyer) {\n \n if ((await conf('promo_actif', '0')) !== '1')\n return json({ error: 'La lettre est désactivée. Active-la d’abord, en connaissance de cause.' }, 409);\n if (!mailReady(env))\n return json({ error: 'Les variables EMAILJS_* ne sont pas configurées.' }, 409);\n\n const sujet = String(b.sujet || '').trim().slice(0, 120);\n const message = String(b.message || '').trim().slice(0, 4000);\n if (sujet.length < 3 || message.length < 20)\n return json({ error: 'Il faut un objet et un message.' }, 400);\n\n const cibles = (await sqlite.execute(\n `SELECT email FROM aco_users WHERE promo_ok = 1 AND verified = 1 LIMIT 2000`\n )).rows || [];\n const liste = cibles.map(r => String(r.email ?? r[0]));\n\n if (!b.pour_de_vrai)\n return json({ simulation: true, destinataires: liste.length,\n note: 'Rien n’a été envoyé. Rappelle avec pour_de_vrai:true pour expédier.' });\n\n let ok = 0, ko = 0;\n for (const email of liste) {\n \n const stop = `${url.origin}/promo/stop?e=${encodeURIComponent(email)}&t=${await promoJeton(email)}`;\n const corps = message\n + `\\n\\n— \\nTu reçois ce message parce que tu as accepté les offres de voyage d’Acolyte.`\n + `\\nMe désinscrire : ${stop}`;\n try {\n const r = await fetch('https://api.emailjs.com/api/v1.0/email/send', {\n method: 'POST', headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n service_id: env('EMAILJS_SERVICE'), template_id: env('EMAILJS_TEMPLATE'),\n user_id: env('EMAILJS_PUBLIC'), accessToken: env('EMAILJS_PRIVATE'),\n template_params: { to_email: email, email, sujet, code: sujet, message: corps },\n }),\n });\n r.ok ? ok++ : ko++;\n } catch (e) { ko++; }\n \n await new Promise(r => setTimeout(r, 250));\n }\n await setConf('promo_dernier', String(Date.now()));\n return json({ envoye: ok, echecs: ko });\n }\n }\n\n const total = (await sqlite.execute(`SELECT COUNT(*) AS n FROM aco_users WHERE verified = 1`)).rows[0];\n const oui = (await sqlite.execute(`SELECT COUNT(*) AS n FROM aco_users WHERE promo_ok = 1 AND verified = 1`)).rows[0];\n const dernier = parseInt(await conf('promo_dernier', '0'), 10) || 0;\n return json({\n actif: (await conf('promo_actif', '0')) === '1',\n mail_pret: mailReady(env),\n clients_verifies: total ? Number(total.n ?? total[0]) : 0,\n consentants: oui ? Number(oui.n ?? oui[0]) : 0,\n dernier_envoi: dernier,\n });\n }\n\n if (path === '/admin/blog/auto') {\n const adm = env('ADMIN_EMAIL').trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) return json({ error: 'Accès refusé' }, 403);\n if (request.method === 'POST') {\n const b = await request.json().catch(() => ({}));\n if (typeof b.actif !== 'undefined') await setConf('blog_auto', b.actif ? '1' : '0');\n if (b.intervalle) await setConf('blog_intervalle', String(Math.max(1, Math.min(168, parseInt(b.intervalle, 10) || BLOG_INTERVALLE_DEFAUT))));\n if (b.regarnir) await blogRegarnit();\n \n if (b.maintenant) await setConf('blog_dernier', '0');\n }\n await blogConfTable();\n const attente = await sqlite.execute(`SELECT COUNT(*) AS n FROM aco_queue WHERE statut = 'attente'`);\n const suivants = await sqlite.execute(`SELECT sujet FROM aco_queue WHERE statut = 'attente' ORDER BY ajoute_le ASC LIMIT 5`);\n const dernier = parseInt(await conf('blog_dernier', '0'), 10) || 0;\n const intervalle = parseInt(await conf('blog_intervalle', String(BLOG_INTERVALLE_DEFAUT)), 10) || BLOG_INTERVALLE_DEFAUT;\n \n const dernierOk = parseInt(await conf('blog_dernier_ok', '0'), 10) || 0;\n const depuisOk = dernierOk ? Date.now() - dernierOk : null;\n return json({\n actif: (await conf('blog_auto', '1')) === '1',\n intervalle, dernier,\n prochain_dans_minutes: dernier ? Math.max(0, Math.ceil((dernier + intervalle * 3600e3 - Date.now()) / 60e3)) : 0,\n en_attente: attente.rows[0] ? Number(attente.rows[0].n ?? attente.rows[0][0]) : 0,\n suivants: (suivants.rows || []).map(r => String(r.sujet ?? r[0])),\n dernier_ok: dernierOk,\n heures_depuis_dernier: depuisOk === null ? null : +(depuisOk / 3600e3).toFixed(1),\n en_retard: depuisOk !== null && depuisOk > intervalle * 2 * 3600e3,\n ecrits: parseInt(await conf('blog_ecrits', '0'), 10) || 0,\n echecs: parseInt(await conf('blog_echecs', '0'), 10) || 0,\n });\n }\n\n if (path === '/admin/blog/generate' && request.method === 'POST') {\n const adm = env('ADMIN_EMAIL').trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) return json({ error: 'Accès refusé' }, 403);\n\n const b = await request.json().catch(() => ({}));\n const sujet = String(b.sujet || '').trim().slice(0, 80);\n const categorie = BLOG_CATS[b.categorie] ? b.categorie : 'nature';\n if (sujet.length < 3) return json({ error: 'Sujet manquant' }, 400);\n\n await blogTable();\n const deja = await sqlite.execute({ sql: 'SELECT slug FROM aco_posts WHERE slug = ?', args: [slugify(sujet)] });\n if (deja.rows[0] && !b.remplacer) return json({ error: 'Un article existe déjà sur ce sujet', slug: slugify(sujet) }, 409);\n\n const r = await blogRedige(sujet, categorie, String(b.ton || 'vivant'), 'brouillon');\n if (r.erreur) return json({ error: r.erreur }, r.code || 502);\n return json({ ok: true, slug: r.slug, titre: r.titre, sections: r.sections, image: r.image });\n }\n\n if (path === '/admin/blog/list') {\n const adm = env('ADMIN_EMAIL').trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) return json({ error: 'Accès refusé' }, 403);\n await blogTable();\n const r = await sqlite.execute(`SELECT slug,sujet,categorie,titre,statut,created_at,\n (image IS NOT NULL AND image <> '') AS a_image FROM aco_posts ORDER BY created_at DESC LIMIT 200`);\n return json({ articles: (r.rows || []).map(x => ({\n slug: String(x.slug ?? x[0]), sujet: String(x.sujet ?? x[1]), categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]), statut: String(x.statut ?? x[4]),\n quand: Number(x.created_at ?? x[5]), image: !!Number(x.a_image ?? x[6]) })) });\n }\n\n if (path === '/admin/blog/statut' && request.method === 'POST') {\n const adm = env('ADMIN_EMAIL').trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) return json({ error: 'Accès refusé' }, 403);\n const b = await request.json().catch(() => ({}));\n const st = b.statut === 'publie' ? 'publie' : 'brouillon';\n await blogTable();\n await sqlite.execute({ sql: 'UPDATE aco_posts SET statut = ? WHERE slug = ?',\n args: [st, String(b.slug || '').slice(0, 70)] });\n return json({ ok: true, statut: st });\n }\n if (path === '/admin/blog' && request.method === 'DELETE') {\n const adm = env('ADMIN_EMAIL').trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) return json({ error: 'Accès refusé' }, 403);\n await blogTable();\n await sqlite.execute({ sql: 'DELETE FROM aco_posts WHERE slug = ?',\n args: [String(url.searchParams.get('slug') || '').slice(0, 70)] });\n return json({ ok: true });\n }\n\n if (path === '/blog') {\n await blogTable();\n const r = await sqlite.execute(\n `SELECT slug,sujet,categorie,titre,sous_titre,resume,lecture,image,created_at\n FROM aco_posts WHERE statut = 'publie' ORDER BY created_at DESC LIMIT 60`);\n return json({ articles: (r.rows || []).map(x => ({\n slug: String(x.slug ?? x[0]), sujet: String(x.sujet ?? x[1]), categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]), sous_titre: String(x.sous_titre ?? x[4] ?? ''),\n resume: String(x.resume ?? x[5] ?? ''), lecture: String(x.lecture ?? x[6] ?? ''),\n image: String(x.image ?? x[7] ?? ''), quand: Number(x.created_at ?? x[8]) })) });\n }\n \n if (path === '/blog/index') {\n await blogTable();\n const r = await sqlite.execute(`SELECT slug,sujet,titre FROM aco_posts WHERE statut = 'publie' LIMIT 300`);\n return json({ index: (r.rows || []).map(x => ({\n slug: String(x.slug ?? x[0]), sujet: String(x.sujet ?? x[1]), titre: String(x.titre ?? x[2]) })) });\n }\n if (path === '/blog/article') {\n await blogTable();\n const r = await sqlite.execute({\n sql: `SELECT slug,sujet,categorie,titre,sous_titre,resume,lecture,corps,image,credit,created_at\n FROM aco_posts WHERE slug = ? AND statut = 'publie'`,\n args: [String(url.searchParams.get('slug') || '').slice(0, 70)] });\n const x = r.rows[0];\n if (!x) return json({ error: 'Article introuvable' }, 404);\n let corps = { sections: [], faits: [], tags: [] };\n try { corps = JSON.parse(String(x.corps ?? x[7])); } catch (e) {}\n return json({ article: {\n slug: String(x.slug ?? x[0]), sujet: String(x.sujet ?? x[1]), categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]), sous_titre: String(x.sous_titre ?? x[4] ?? ''),\n resume: String(x.resume ?? x[5] ?? ''), lecture: String(x.lecture ?? x[6] ?? ''),\n image: String(x.image ?? x[8] ?? ''), credit: String(x.credit ?? x[9] ?? ''),\n quand: Number(x.created_at ?? x[10]), ...corps } });\n }\n if (path === '/capabilities') {\n return json({\n comptes: mailReady(env),\n gemini: !!env('GEMINI_KEY'),\n groq: !!env('GROQ_KEY'),\n travelpayouts: !!env('TRAVELPAYOUTS_KEY'),\n });\n }\n\n if (path === '/maildiag') {\n \n const adm = env('ADMIN_EMAIL').trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) return json({ error: 'Accès refusé' }, 403);\n return json({\n variables: {\n EMAILJS_PUBLIC: !!env('EMAILJS_PUBLIC'),\n EMAILJS_PRIVATE: !!env('EMAILJS_PRIVATE'),\n EMAILJS_SERVICE: env('EMAILJS_SERVICE') || '(vide)',\n EMAILJS_TEMPLATE: env('EMAILJS_TEMPLATE') || '(vide)',\n },\n derniereReponseEmailJS: await readMail(),\n });\n }\n\n const newSession = async (email) => {\n const token = randomHex(32);\n await sqlite.execute({\n sql: 'INSERT INTO aco_sessions(token_h, email, expires_at) VALUES(?,?,?)',\n args: [await sha256(token), email, Date.now() + SESS_TTL],\n });\n \n try {\n await sqlite.execute({\n sql: `DELETE FROM aco_sessions WHERE email = ? AND token_h NOT IN (\n SELECT token_h FROM aco_sessions WHERE email = ?\n ORDER BY expires_at DESC LIMIT ?)`,\n args: [email, email, SESS_MAX],\n });\n } catch (e) { }\n return token;\n };\n \n const issueCode = async (email) => {\n if (!mailReady(env))\n return { err: \"L'envoi d'email n'est pas configuré sur le serveur\", status: 501 };\n const now = Date.now();\n const prev = await sqlite.execute({ sql: 'SELECT sent_at FROM aco_codes WHERE email = ?', args: [email] });\n if (prev.rows[0] && now - Number(prev.rows[0][0]) < CODE_WAIT)\n return { err: 'Un code vient déjà d’être envoyé. Attends une minute.', status: 429 };\n const code = String(Math.floor(100000 + Math.random() * 900000));\n if (!(await sendCodeMail(env, email, code)))\n return { err: \"L'email n'a pas pu être envoyé. Réessaie dans un instant.\", status: 502 };\n await sqlite.execute({\n sql: `INSERT INTO aco_codes(email, code_h, expires_at, tries, sent_at) VALUES(?,?,?,0,?)\n ON CONFLICT(email) DO UPDATE SET code_h=excluded.code_h,\n expires_at=excluded.expires_at, tries=0, sent_at=excluded.sent_at`,\n args: [email, await sha256('aco::' + email + '::' + code), now + CODE_TTL, now],\n });\n return { ok: true };\n };\n \n const checkCode = async (email, code) => {\n const r = await sqlite.execute({\n sql: 'SELECT code_h, expires_at, tries FROM aco_codes WHERE email = ?', args: [email],\n });\n const row = r.rows[0];\n if (!row) return { err: 'Demande un nouveau code', status: 400 };\n if (Number(row[1]) < Date.now()) {\n await sqlite.execute({ sql: 'DELETE FROM aco_codes WHERE email = ?', args: [email] });\n return { err: 'Code expiré — demandes-en un nouveau', status: 400 };\n }\n if (Number(row[2]) >= CODE_TRIES) {\n await sqlite.execute({ sql: 'DELETE FROM aco_codes WHERE email = ?', args: [email] });\n return { err: 'Trop d’essais — demande un nouveau code', status: 429 };\n }\n if (!safeEqual(String(row[0]), await sha256('aco::' + email + '::' + code))) {\n await sqlite.execute({ sql: 'UPDATE aco_codes SET tries = tries + 1 WHERE email = ?', args: [email] });\n return { err: 'Code incorrect', status: 400 };\n }\n await sqlite.execute({ sql: 'DELETE FROM aco_codes WHERE email = ?', args: [email] });\n return { ok: true };\n };\n\n if (path === '/auth/signup' && request.method === 'POST') {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email), pass = cleanPass(body.password);\n if (!email) return json({ error: 'Adresse email invalide' }, 400);\n if (!pass) return json({ error: `Mot de passe : ${PASS_MIN} caractères minimum` }, 400);\n await db();\n const ex = await sqlite.execute({ sql: 'SELECT verified FROM aco_users WHERE email = ?', args: [email] });\n if (ex.rows[0] && Number(ex.rows[0][0]) === 1)\n return json({ error: 'Un compte existe déjà avec cette adresse — connecte-toi' }, 409);\n\n const salt = randomHex(16);\n \n await sqlite.execute({\n sql: `INSERT INTO aco_users(email, pass_h, salt, verified, created_at) VALUES(?,?,?,0,?)\n ON CONFLICT(email) DO UPDATE SET pass_h=excluded.pass_h, salt=excluded.salt`,\n args: [email, await hashPass(pass, salt), salt, Date.now()],\n });\n const r = await issueCode(email);\n if (r.err) return json({ error: r.err }, r.status);\n return json({ ok: true, etape: 'verification' });\n }\n\n if (path === '/auth/verify' && request.method === 'POST') {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email), code = String(body.code || '').trim();\n if (!email || !/^\\d{6}$/.test(code)) return json({ error: 'Code invalide' }, 400);\n await db();\n const c = await checkCode(email, code);\n if (c.err) return json({ error: c.err }, c.status);\n await sqlite.execute({ sql: 'UPDATE aco_users SET verified = 1 WHERE email = ?', args: [email] });\n return json({ token: await newSession(email), email });\n }\n\n if (path === '/auth/login' && request.method === 'POST') {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email), pass = String(body.password || '');\n if (!email || !pass) return json({ error: 'Identifiants invalides' }, 400);\n await db();\n const now = Date.now();\n const lk = await sqlite.execute({ sql: 'SELECT fails, locked_until FROM aco_logins WHERE email = ?', args: [email] });\n if (lk.rows[0] && Number(lk.rows[0][1]) > now)\n return json({ error: 'Trop de tentatives — réessaie dans un quart d’heure' }, 429);\n\n const u = await sqlite.execute({\n sql: 'SELECT pass_h, salt, verified FROM aco_users WHERE email = ?', args: [email],\n });\n const row = u.rows[0];\n \n const salt = row ? String(row[1]) : randomHex(16);\n const calc = await hashPass(pass, salt);\n const good = !!row && safeEqual(String(row[0]), calc);\n\n if (!good) {\n const fails = (lk.rows[0] ? Number(lk.rows[0][0]) : 0) + 1;\n await sqlite.execute({\n sql: `INSERT INTO aco_logins(email, fails, locked_until) VALUES(?,?,?)\n ON CONFLICT(email) DO UPDATE SET fails=excluded.fails, locked_until=excluded.locked_until`,\n args: [email, fails, fails >= LOGIN_FAILS ? now + LOGIN_LOCK : 0],\n });\n return json({ error: 'Email ou mot de passe incorrect' }, 401);\n }\n if (Number(row[2]) !== 1) {\n const r = await issueCode(email);\n return json({ error: 'Adresse non vérifiée — un code vient de t’être envoyé',\n etape: 'verification', envoye: !r.err }, 403);\n }\n await sqlite.execute({ sql: 'DELETE FROM aco_logins WHERE email = ?', args: [email] });\n return json({ token: await newSession(email), email });\n }\n\n if (path === '/auth/forgot' && request.method === 'POST') {\n const email = cleanEmail((await request.json().catch(() => ({}))).email);\n if (!email) return json({ error: 'Adresse email invalide' }, 400);\n await db();\n const ex = await sqlite.execute({ sql: 'SELECT email FROM aco_users WHERE email = ?', args: [email] });\n \n if (ex.rows[0]) await issueCode(email);\n return json({ ok: true });\n }\n\n if (path === '/auth/reset' && request.method === 'POST') {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email), code = String(body.code || '').trim();\n const pass = cleanPass(body.password);\n if (!email || !/^\\d{6}$/.test(code)) return json({ error: 'Code invalide' }, 400);\n if (!pass) return json({ error: `Mot de passe : ${PASS_MIN} caractères minimum` }, 400);\n await db();\n const c = await checkCode(email, code);\n if (c.err) return json({ error: c.err }, c.status);\n const salt = randomHex(16);\n await sqlite.execute({\n sql: 'UPDATE aco_users SET pass_h = ?, salt = ?, verified = 1 WHERE email = ?',\n args: [await hashPass(pass, salt), salt, email],\n });\n \n await sqlite.execute({ sql: 'DELETE FROM aco_sessions WHERE email = ?', args: [email] });\n await sqlite.execute({ sql: 'DELETE FROM aco_logins WHERE email = ?', args: [email] });\n purge(); \n return json({ token: await newSession(email), email });\n }\n\n if (path === '/auth/logout' && request.method === 'POST') {\n const h = request.headers.get('Authorization') || '';\n const tok = h.startsWith('Bearer ') ? h.slice(7).trim() : '';\n if (tok) {\n await db();\n await sqlite.execute({ sql: 'DELETE FROM aco_sessions WHERE token_h = ?', args: [await sha256(tok)] });\n }\n return json({ ok: true });\n }\n\n if (path === '/sync') {\n const email = await sessionEmail(request);\n if (!email) return json({ error: 'Session expirée — reconnecte-toi' }, 401);\n\n if (request.method === 'GET') {\n const r = await sqlite.execute({\n sql: 'SELECT payload, updated_at FROM aco_trips WHERE email = ?', args: [email],\n });\n const row = r.rows[0];\n return json(row ? { payload: JSON.parse(String(row[0])), updated_at: Number(row[1]) }\n : { payload: null, updated_at: 0 });\n }\n if (request.method === 'POST') {\n const body = await request.json().catch(() => null);\n if (!body || typeof body.payload === 'undefined') return json({ error: 'Contenu manquant' }, 400);\n const txt = JSON.stringify(body.payload);\n if (txt.length > MAX_PAYLOAD) return json({ error: 'Sauvegarde trop volumineuse' }, 413);\n const now = Date.now();\n \n await sqlite.execute({\n sql: `INSERT INTO aco_trips(email, payload, updated_at) VALUES(?,?,?)\n ON CONFLICT(email) DO UPDATE SET payload=excluded.payload, updated_at=excluded.updated_at`,\n args: [email, txt, now],\n });\n return json({ ok: true, updated_at: now });\n }\n }\n\n if (path === '/account' && request.method === 'DELETE') {\n const email = await sessionEmail(request);\n if (!email) return json({ error: 'Session expirée — reconnecte-toi' }, 401);\n \n for (const t of ['aco_trips', 'aco_sessions', 'aco_codes', 'aco_logins', 'aco_users', 'aco_scores', 'aco_ai']) {\n \n try { await sqlite.execute({ sql: `DELETE FROM ${t} WHERE email = ?`, args: [email] }); }\n catch (e) {}\n }\n return json({ ok: true });\n }\n\n if (path === '/game/score' && request.method === 'POST') {\n const email = await sessionEmail(request);\n if (!email) return json({ error: 'Connecte-toi pour enregistrer ton score' }, 401);\n const body = await request.json().catch(() => ({}));\n const score = Math.max(0, Math.min(1_000_000, parseInt(body.score, 10) || 0));\n const name = String(body.name || 'Voyageur').trim().slice(0, 20) || 'Voyageur';\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_scores(\n email TEXT PRIMARY KEY, name TEXT NOT NULL, score INTEGER NOT NULL, at INTEGER NOT NULL)`);\n \n await sqlite.execute({\n sql: `INSERT INTO aco_scores(email, name, score, at) VALUES(?,?,?,?)\n ON CONFLICT(email) DO UPDATE SET name=excluded.name,\n score=MAX(aco_scores.score, excluded.score), at=excluded.at`,\n args: [email, name, score, Date.now()],\n });\n return json({ ok: true });\n }\n if (path === '/game/top') {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_scores(\n email TEXT PRIMARY KEY, name TEXT NOT NULL, score INTEGER NOT NULL, at INTEGER NOT NULL)`);\n const r = await sqlite.execute(`SELECT name, score FROM aco_scores ORDER BY score DESC, at ASC LIMIT 10`);\n const top = (r.rows || []).map(row => ({ name: String(row.name ?? row[0]), score: Number(row.score ?? row[1]) }));\n return json({ top });\n }\n\n if (path === '/admin/stats') {\n const admin = env('ADMIN_EMAIL').trim().toLowerCase();\n const email = await sessionEmail(request);\n \n if (!admin || !email || !safeEqual(email, admin)) return json({ error: 'Accès refusé' }, 403);\n\n const K = 5; \n const now = Date.now(), J7 = now - 7 * 864e5, J30 = now - 30 * 864e5;\n\n const cnt = async (sql, args = []) => {\n const r = await sqlite.execute({ sql, args });\n const row = r.rows?.[0];\n return row ? Number(row.n ?? row[0]) : 0;\n };\n const comptes = {\n total: await cnt(`SELECT COUNT(*) AS n FROM aco_users`),\n verifies: await cnt(`SELECT COUNT(*) AS n FROM aco_users WHERE verified = 1`),\n nouveaux7j: await cnt(`SELECT COUNT(*) AS n FROM aco_users WHERE created_at > ?`, [J7]),\n nouveaux30j:await cnt(`SELECT COUNT(*) AS n FROM aco_users WHERE created_at > ?`, [J30]),\n };\n\n const courbe = [];\n try {\n const jours = new Map();\n for (let i = 29; i >= 0; i--) {\n const d = new Date(now - i * 864e5);\n jours.set(`${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}-${String(d.getUTCDate()).padStart(2, '0')}`, 0);\n }\n const r = await sqlite.execute({ sql: `SELECT created_at FROM aco_users WHERE created_at > ?`, args: [now - 30 * 864e5] });\n for (const row of (r.rows || [])) {\n const d = new Date(Number(row.created_at ?? row[0]));\n const k = `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}-${String(d.getUTCDate()).padStart(2, '0')}`;\n if (jours.has(k)) jours.set(k, jours.get(k) + 1);\n }\n for (const [j, n] of jours) courbe.push({ j, n });\n } catch (e) {}\n\n const dest = new Map(), pays = new Map();\n const modes = { avion: 0, train: 0, voiture: 0, autre: 0 };\n const budget = { petit: 0, moyen: 0, confort: 0, eleve: 0, inconnu: 0 };\n const duree = { weekend: 0, semaine: 0, deuxSemaines: 0, plus: 0, inconnu: 0 };\n const avecQui = { solo: 0, couple: 0, amis: 0, famille: 0, collegues: 0, inconnu: 0 };\n const sejour = { hotel: 0, appartement: 0, auberge: 0, luxe: 0, inconnu: 0 };\n const mois = new Array(12).fill(0);\n let voyagesTotal = 0, avecPlan = 0, actifs7j = 0, actifs30j = 0, multiBase = 0;\n\n const casier = (v, table) => {\n const s = String(v || '').toLowerCase();\n for (const [motif, cle] of table) if (motif.test(s)) return cle;\n return 'inconnu';\n };\n const T_BUDGET = [[/petit|<\\s*500|moins/, 'petit'], [/moyen|500/, 'moyen'], [/confort|1200/, 'confort'], [/élev|eleve|2500|luxe/, 'eleve']];\n const T_DUREE = [[/week|2-3/, 'weekend'], [/1 semaine|7 j|une semaine/, 'semaine'], [/2 semaines|14/, 'deuxSemaines'], [/3 semaines|21|mois|\\+/, 'plus']];\n const T_QUI = [[/solo|seul/, 'solo'], [/couple/, 'couple'], [/ami/, 'amis'], [/famille|enfant/, 'famille'], [/collègue|collegue|travail/, 'collegues']];\n const T_SEJOUR = [[/hôtel|hotel/, 'hotel'], [/appart|airbnb/, 'appartement'], [/auberge|hostel|éco|eco/, 'auberge'], [/luxe|luxury/, 'luxe']];\n\n try {\n const rows = (await sqlite.execute(`SELECT payload, updated_at FROM aco_trips`)).rows || [];\n for (const row of rows) {\n voyagesTotal++;\n const maj = Number(row.updated_at ?? row[1]) || 0;\n if (maj > J7) actifs7j++;\n if (maj > J30) actifs30j++;\n try {\n const p = JSON.parse(String(row.payload ?? row[0]));\n const st = p?.trip || {};\n const nom = st?.trip?.nom, pa = st?.trip?.pays;\n if (nom) dest.set(String(nom).slice(0, 60), (dest.get(String(nom).slice(0, 60)) || 0) + 1);\n if (pa) pays.set(String(pa).slice(0, 60), (pays.get(String(pa).slice(0, 60)) || 0) + 1);\n const m = st?.cache?.plan?.transport?.mode;\n if (m && modes[m] !== undefined) modes[m]++; else if (m) modes.autre++;\n if (st?.cache?.plan) avecPlan++;\n if ((st?.cache?.plan?.logement?.etapes || []).length > 1) multiBase++;\n const pr = st?.prefs || {};\n budget[casier(pr.budget, T_BUDGET)]++;\n duree[casier(pr.days, T_DUREE)]++;\n avecQui[casier(pr.withWho, T_QUI)]++;\n sejour[casier(pr.stay, T_SEJOUR)]++;\n \n const dep = String(pr.depart || '');\n const mm = dep.match(/^\\d{4}-(\\d{2})/);\n if (mm) { const i = +mm[1] - 1; if (i >= 0 && i < 12) mois[i]++; }\n } catch (e) { }\n }\n } catch (e) { }\n\n const auSeuil = (map) => {\n const vus = [], masq = { lieux: 0, voyages: 0 };\n for (const [nom, n] of map) {\n if (n >= K) vus.push({ nom, n });\n else { masq.lieux++; masq.voyages += n; }\n }\n vus.sort((a, b) => b.n - a.n);\n return { vus: vus.slice(0, 12), masq };\n };\n const D = auSeuil(dest), P = auSeuil(pays);\n\n const assezDeMonde = voyagesTotal >= K;\n\n let jeu = [], joueurs = 0;\n try {\n const r = await sqlite.execute(`SELECT name, score FROM aco_scores ORDER BY score DESC LIMIT 10`);\n jeu = (r.rows || []).map(x => ({ name: String(x.name ?? x[0]).slice(0, 20), score: Number(x.score ?? x[1]) }));\n joueurs = await cnt(`SELECT COUNT(*) AS n FROM aco_scores`);\n } catch (e) {}\n\n let appareils = 0, iaHeure = 0, iaComptes = 0;\n try { appareils = await cnt(`SELECT COUNT(*) AS n FROM aco_sessions WHERE expires_at > ?`, [now]); } catch (e) {}\n try {\n iaHeure = await cnt(`SELECT COALESCE(SUM(n),0) AS n FROM aco_ai WHERE window_start > ?`, [now - 3600 * 1000]);\n iaComptes = await cnt(`SELECT COUNT(*) AS n FROM aco_ai WHERE window_start > ?`, [now - 3600 * 1000]);\n } catch (e) {}\n\n return json({\n comptes,\n \n voyages: { total: voyagesTotal, avecPlan, actifs7j, actifs30j,\n multiBase: assezDeMonde ? multiBase : null },\n courbe,\n destinations: D.vus,\n destinationsMasquees: D.masq,\n pays: P.vus,\n paysMasques: P.masq,\n \n transports: assezDeMonde ? modes : null,\n budget: assezDeMonde ? budget : null,\n duree: assezDeMonde ? duree : null,\n avecQui: assezDeMonde ? avecQui : null,\n sejour: assezDeMonde ? sejour : null,\n mois: assezDeMonde ? mois : null,\n assezDeMonde,\n technique: { appareils, iaHeure, iaComptes },\n jeu, joueurs,\n seuil: K,\n genere: now,\n });\n }\n\n if (path === '/gemini/models') {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env('GEMINI_KEY')) return json({ error: 'GEMINI_KEY non configurée' }, 501);\n const r = await fetch(`https://generativelanguage.googleapis.com/v1beta/models?key=${env('GEMINI_KEY')}&pageSize=100`);\n return new Response(await r.text(), { status: r.status, headers: { ...cors, 'Content-Type': 'application/json' } });\n }\n\n if (path === '/gemini') {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env('GEMINI_KEY')) return json({ error: 'GEMINI_KEY non configurée' }, 501);\n const { model, body } = await request.json();\n const m = String(model || 'gemini-2.5-flash').replace(/[^a-zA-Z0-9.\\-_]/g, '');\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/${m}:generateContent?key=${env('GEMINI_KEY')}`,\n { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }\n );\n return new Response(await r.text(), { status: r.status, headers: { ...cors, 'Content-Type': 'application/json' } });\n }\n\n if (path === '/groq') {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env('GROQ_KEY')) return json({ error: 'GROQ_KEY non configurée' }, 501);\n const { body } = await request.json();\n const r = await fetch('https://api.groq.com/openai/v1/chat/completions', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${env('GROQ_KEY')}` },\n body: JSON.stringify(body),\n });\n return new Response(await r.text(), { status: r.status, headers: { ...cors, 'Content-Type': 'application/json' } });\n }\n\n if (path === '/hotels') {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env('TRAVELPAYOUTS_KEY')) return json({ error: 'TRAVELPAYOUTS_KEY non configurée' }, 501);\n const p = url.searchParams;\n const api = new URL('https://engine.hotellook.com/api/v2/cache.json');\n ['location', 'checkIn', 'checkOut', 'adults', 'children', 'currency', 'limit'].forEach(k => {\n if (p.get(k)) api.searchParams.set(k, p.get(k));\n });\n api.searchParams.set('token', env('TRAVELPAYOUTS_KEY'));\n const r = await fetch(api.toString(), { headers: { Accept: 'application/json' } });\n return new Response(await r.text(), { status: r.status, headers: { ...cors, 'Content-Type': 'application/json' } });\n }\n\n const target = url.searchParams.get('url');\n if (target) {\n \n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n let u;\n try { u = new URL(target); } catch { return json({ error: 'URL invalide' }, 400); }\n if (!RELAY_HOSTS.includes(u.hostname)) return json({ error: 'Domaine non autorisé : ' + u.hostname }, 403);\n const r = await fetch(u.toString(), { headers: { Accept: 'application/json' } });\n return new Response(await r.text(), { status: r.status, headers: { ...cors, 'Content-Type': 'application/json' } });\n }\n\n return json({ error: 'Route inconnue', routes: ['/capabilities', '/gemini', '/gemini/models', '/groq', '/hotels', '/?url='] }, 404);\n } catch (e) {\n return json({ error: 'Backend : ' + e.message }, 502);\n }\n}","// ===========================================================\n// FICHIER GENERE - NE PAS MODIFIER ICI.\n// Produit par : node outils/valtown-build.js\n// Source (commentee, a corriger la-bas) : valtown-backend.js\n// Les commentaires sont retires pour tenir sous les 80000 caracteres\n// que Val Town autorise par val. Relance le script apres chaque\n// correction : ce fichier est ecrase a chaque passage.\n//\n// --- Variables d'environnement (Val Town > onglet Secrets) ---\n// - ADMIN_EMAIL\n// - ALLOWED_ORIGIN\n// - EMAILJS_PRIVATE\n// - EMAILJS_PUBLIC\n// - EMAILJS_SERVICE\n// - EMAILJS_TEMPLATE\n// - GEMINI_KEY\n// - GROQ_KEY\n// - TRAVELPAYOUTS_KEY\n//\n// GEMINI_KEY et les quatre EMAILJS_* sont indispensables : sans elles,\n// la redaction d'articles et l'envoi de courriels ne marchent pas.\n// ALLOWED_ORIGIN = l'adresse du site, sans barre oblique finale.\n// ADMIN_EMAIL = l'adresse qui ouvre le panneau de statistiques.\n// ===========================================================\nconst RELAY_HOSTS = [\n \"engine.hotellook.com\",\n \"yasen.hotellook.com\",\n \"api.travelpayouts.com\",\n];\n\nconst AI_MAX_H = 120;\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst CODE_TTL = 10 * 60 * 1000;\nconst CODE_WAIT = 60 * 1000;\nconst CODE_TRIES = 5;\n\nconst SESS_TTL = 30 * 24 * 3600 * 1000;\nconst SESS_MAX = 5;\nconst MAX_PAYLOAD = 400_000;\nconst PASS_MIN = 8;\nconst PBKDF2_IT = 210_000;\nconst LOGIN_FAILS = 8;\nconst LOGIN_LOCK = 15 * 60 * 1000;\n\nlet _dbReady = null;\nfunction db() {\n if (!_dbReady) {\n _dbReady = (async () => {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_users(\n email TEXT PRIMARY KEY, pass_h TEXT NOT NULL, salt TEXT NOT NULL,\n verified INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_logins(\n email TEXT PRIMARY KEY, fails INTEGER NOT NULL DEFAULT 0,\n locked_until INTEGER NOT NULL DEFAULT 0)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_codes(\n email TEXT PRIMARY KEY, code_h TEXT NOT NULL, expires_at INTEGER NOT NULL,\n tries INTEGER NOT NULL DEFAULT 0, sent_at INTEGER NOT NULL)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_sessions(\n token_h TEXT PRIMARY KEY, email TEXT NOT NULL, expires_at INTEGER NOT NULL)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_trips(\n email TEXT PRIMARY KEY, payload TEXT NOT NULL, updated_at INTEGER NOT NULL)`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_posts(\n slug TEXT PRIMARY KEY, sujet TEXT NOT NULL, categorie TEXT NOT NULL,\n titre TEXT NOT NULL, sous_titre TEXT, resume TEXT, lecture TEXT,\n corps TEXT NOT NULL, image TEXT, credit TEXT,\n statut TEXT NOT NULL DEFAULT 'brouillon', created_at INTEGER NOT NULL)`);\n })();\n }\n return _dbReady;\n}\n\nasync function sha256(txt) {\n const b = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(txt),\n );\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\nfunction randomHex(bytes = 32) {\n return [...crypto.getRandomValues(new Uint8Array(bytes))]\n .map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPass(password, saltHex) {\n const salt = Uint8Array.from(\n saltHex.match(/../g).map((h) => parseInt(h, 16)),\n );\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations: PBKDF2_IT, hash: \"SHA-256\" },\n key,\n 256,\n );\n return [...new Uint8Array(bits)].map((x) => x.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nfunction safeEqual(a, b) {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\nfunction cleanPass(v) {\n const p = String(v || \"\");\n return p.length >= PASS_MIN && p.length <= 200 ? p : null;\n}\n\nfunction cleanEmail(v) {\n const e = String(v || \"\").trim().toLowerCase();\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(e) && e.length <= 190 ? e : null;\n}\n\nasync function sessionEmail(request) {\n const h = request.headers.get(\"Authorization\") || \"\";\n const tok = h.startsWith(\"Bearer \") ? h.slice(7).trim() : \"\";\n if (tok.length < 32) return null;\n await db();\n const r = await sqlite.execute({\n sql: \"SELECT email, expires_at FROM aco_sessions WHERE token_h = ?\",\n args: [await sha256(tok)],\n });\n const row = r.rows[0];\n if (!row) return null;\n if (Number(row[1]) < Date.now()) {\n await sqlite.execute({\n sql: \"DELETE FROM aco_sessions WHERE token_h = ?\",\n args: [await sha256(tok)],\n });\n return null;\n }\n return String(row[0]);\n}\n\nfunction mailReady(env) {\n return !!(env(\"EMAILJS_PUBLIC\") && env(\"EMAILJS_PRIVATE\") &&\n env(\"EMAILJS_SERVICE\") && env(\"EMAILJS_TEMPLATE\"));\n}\n\nasync function diagTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS aco_diag(k TEXT PRIMARY KEY, v TEXT NOT NULL, ts INTEGER NOT NULL)`,\n );\n}\n\nasync function aiGuard(request) {\n const email = await sessionEmail(request);\n if (!email) return { err: \"Connecte-toi pour utiliser Acolyte\", status: 401 };\n try {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_ai(\n email TEXT PRIMARY KEY, n INTEGER NOT NULL, window_start INTEGER NOT NULL)`);\n const now = Date.now(), H = 3600 * 1000;\n const r = await sqlite.execute({\n sql: \"SELECT n, window_start FROM aco_ai WHERE email = ?\",\n args: [email],\n });\n const row = r.rows[0];\n const debut = row ? Number(row[1]) : 0;\n\n const n = (row && now - debut < H) ? Number(row[0]) : 0;\n const fenetre = (row && now - debut < H) ? debut : now;\n if (n >= AI_MAX_H) {\n return {\n err: \"Beaucoup de demandes d’un coup — réessaie dans un moment\",\n status: 429,\n };\n }\n await sqlite.execute({\n sql: `INSERT INTO aco_ai(email, n, window_start) VALUES(?,?,?)\n ON CONFLICT(email) DO UPDATE SET n = excluded.n, window_start = excluded.window_start`,\n args: [email, n + 1, fenetre],\n });\n } catch (e) {}\n return { email };\n}\n\nasync function purge() {\n try {\n const now = Date.now();\n await sqlite.execute({\n sql: \"DELETE FROM aco_sessions WHERE expires_at < ?\",\n args: [now],\n });\n await sqlite.execute({\n sql: \"DELETE FROM aco_codes WHERE expires_at < ?\",\n args: [now - 3600 * 1000],\n });\n await sqlite.execute({\n sql: \"DELETE FROM aco_logins WHERE locked_until < ? AND fails > 0\",\n args: [now - 24 * 3600 * 1000],\n });\n } catch (e) {}\n}\n\nasync function noteMail(msg) {\n try {\n await diagTable();\n await sqlite.execute({\n sql: `INSERT INTO aco_diag(k, v, ts) VALUES('mail', ?, ?)\n ON CONFLICT(k) DO UPDATE SET v = excluded.v, ts = excluded.ts`,\n args: [String(msg).slice(0, 300), Date.now()],\n });\n } catch (e) {}\n}\nasync function readMail() {\n try {\n await diagTable();\n const r = await sqlite.execute({\n sql: `SELECT v, ts FROM aco_diag WHERE k = 'mail'`,\n args: [],\n });\n if (!r.rows || !r.rows[0]) return \"aucun envoi enregistré\";\n const row = r.rows[0];\n\n const v = row.v ?? row[0], ts = Number(row.ts ?? row[1]);\n return `${v} (il y a ${Math.round((Date.now() - ts) / 1000)} s)`;\n } catch (e) {\n return \"ERREUR DE LECTURE → \" + String(e && e.message || e).slice(0, 200);\n }\n}\n\nasync function sendCodeMail(env, email, code) {\n if (!mailReady(env)) {\n await noteMail(\"variables EMAILJS_* incomplètes\");\n return false;\n }\n try {\n const r = await fetch(\"https://api.emailjs.com/api/v1.0/email/send\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n service_id: env(\"EMAILJS_SERVICE\"),\n template_id: env(\"EMAILJS_TEMPLATE\"),\n user_id: env(\"EMAILJS_PUBLIC\"),\n accessToken: env(\"EMAILJS_PRIVATE\"),\n template_params: { to_email: email, email, code },\n }),\n });\n const txt = await r.text().catch(() => \"\");\n const why = `HTTP ${r.status} · ${txt.slice(0, 200) || \"(corps vide)\"}`;\n console.log(\"[acolyte] EmailJS →\", why);\n await noteMail(why);\n return r.ok;\n } catch (e) {\n const why = \"appel impossible : \" + String(e).slice(0, 120);\n console.log(\"[acolyte] EmailJS →\", why);\n await noteMail(why);\n return false;\n }\n}\n\nexport default async function (request) {\n const env = (k) => Deno.env.get(k) || \"\";\n const origin = request.headers.get(\"Origin\") || \"\";\n\n const allowedBrut = env(\"ALLOWED_ORIGIN\") || \"*\";\n const allowedList = allowedBrut.split(\",\").map((s) =>\n s.trim().replace(/\\/+$/, \"\")\n ).filter(Boolean);\n const allowed = allowedList[0] || \"*\";\n const okOrigin = allowedBrut === \"*\" ||\n allowedList.includes(origin) ||\n origin.startsWith(\"http://localhost\");\n const cors = {\n \"Access-Control-Allow-Origin\": okOrigin ? (origin || \"*\") : allowed,\n \"Access-Control-Allow-Methods\": \"GET, POST, DELETE, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n \"Access-Control-Max-Age\": \"86400\",\n \"Vary\": \"Origin\",\n };\n const json = (obj, status = 200) =>\n new Response(JSON.stringify(obj), {\n status,\n headers: { ...cors, \"Content-Type\": \"application/json; charset=utf-8\" },\n });\n\n if (request.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: cors });\n }\n\n const url = new URL(request.url);\n const path = url.pathname.replace(/\\/+$/, \"\");\n\n if (path === \"/ping\") {\n return json({\n ok: true,\n service: \"Acolyte backend\",\n origines_attendues: allowedBrut === \"*\" ? \"*\" : allowedList,\n origine_recue: origin || \"(aucune — navigation directe, c’est normal)\",\n cette_origine_passe: okOrigin,\n heure: new Date().toISOString(),\n aide: allowedBrut === \"*\"\n ? \"ALLOWED_ORIGIN n’est pas définie : le backend accepte TOUTES les origines. À corriger avant la mise en service.\"\n : \"ALLOWED_ORIGIN accepte plusieurs origines séparées par des virgules. Une origine = protocole + domaine, SANS chemin ni barre oblique finale. Ex. : https://lechat45.github.io\",\n });\n }\n\n const STAT_CLES = new Set([\n \"arrivee\",\n \"inscription\",\n \"connexion\",\n \"questions_finies\",\n \"questions_passees\",\n \"voyage_genere\",\n \"voyage_ouvert\",\n \"carte_ouverte\",\n \"blog_ouvert\",\n \"assistant_utilise\",\n \"assistant_annule\",\n \"horaires_verifies\",\n \"install\",\n\n \"questionnaire_commence\",\n \"ia_echec\",\n \"hors_ligne\",\n \"jour_j\",\n \"reservation_clic\",\n \"papiers_ouvert\",\n \"postcard_cree\",\n \"ics_telecharge\",\n \"partage\",\n ]);\n async function statTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_stats(\n jour TEXT NOT NULL, cle TEXT NOT NULL, n INTEGER NOT NULL DEFAULT 0,\n PRIMARY KEY(jour, cle))`);\n }\n\n if (path === \"/stat\" && request.method === \"POST\") {\n try {\n const b = await request.json().catch(() => ({}));\n const cle = String(b?.cle || \"\");\n if (!STAT_CLES.has(cle)) return json({ ok: false }, 204);\n await statTable();\n const jour = new Date().toISOString().slice(0, 10);\n await sqlite.execute({\n sql: `INSERT INTO aco_stats(jour, cle, n) VALUES(?, ?, 1)\n ON CONFLICT(jour, cle) DO UPDATE SET n = n + 1`,\n args: [jour, cle],\n });\n } catch (e) {}\n return json({ ok: true });\n }\n\n const SANS_ORIGINE = new Set([\"/ping\", \"/promo/stop\", \"/blog/tick\", \"/blog\"]);\n if (!okOrigin && !SANS_ORIGINE.has(path)) {\n return json({ error: \"Origine non autorisée\" }, 403);\n }\n\n try {\n const BLOG_CATS = {\n nature: \"Merveille naturelle\",\n bati: \"Merveille bâtie\",\n ville: \"Grande ville\",\n };\n\n const slugify = (s) =>\n String(s || \"\").normalize(\"NFD\").replace(/[̀-ͯ]/g, \"\")\n .toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-+|-+$/g, \"\")\n .slice(0, 70);\n\n async function blogTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_posts(\n slug TEXT PRIMARY KEY, sujet TEXT NOT NULL, categorie TEXT NOT NULL,\n titre TEXT NOT NULL, sous_titre TEXT, resume TEXT, lecture TEXT,\n corps TEXT NOT NULL, image TEXT, credit TEXT,\n statut TEXT NOT NULL DEFAULT 'brouillon', created_at INTEGER NOT NULL)`);\n }\n\n async function wikiResume(langue, titre) {\n try {\n const r = await fetch(\n `https://${langue}.wikipedia.org/api/rest_v1/page/summary/` +\n encodeURIComponent(titre),\n { headers: { \"Accept\": \"application/json\" } },\n );\n if (!r.ok) return \"\";\n const d = await r.json();\n return d?.originalimage?.source || d?.thumbnail?.source || \"\";\n } catch (e) {\n return \"\";\n }\n }\n async function wikiCherche(langue, texte) {\n try {\n const r = await fetch(\n `https://${langue}.wikipedia.org/w/api.php?action=query&list=search` +\n `&srsearch=${\n encodeURIComponent(texte)\n }&srlimit=1&format=json&origin=*`,\n );\n if (!r.ok) return \"\";\n const d = await r.json();\n return d?.query?.search?.[0]?.title || \"\";\n } catch (e) {\n return \"\";\n }\n }\n async function blogImage(sujet) {\n const propre = String(sujet || \"\").trim();\n if (!propre) return { url: \"\", credit: \"\" };\n\n let src = await wikiResume(\"fr\", propre);\n\n if (!src) {\n const vrai = await wikiCherche(\"fr\", propre);\n if (vrai && vrai.toLowerCase() !== propre.toLowerCase()) {\n src = await wikiResume(\"fr\", vrai);\n }\n }\n\n if (!src) {\n const en = await wikiCherche(\"en\", propre);\n if (en) src = await wikiResume(\"en\", en);\n }\n if (!src) return { url: \"\", credit: \"\" };\n\n return { url: src.replace(/\\/\\d+px-/, \"/960px-\"), credit: \"Wikipédia\" };\n }\n\n function blogPrompt(sujet, categorie, ton) {\n const cat = BLOG_CATS[categorie] || \"Merveille du monde\";\n const tons = {\n vivant: \"vivant et immersif\",\n sobre: \"informatif et sobre\",\n poetique: \"poétique et évocateur\",\n concis: \"concis et direct\",\n };\n return `Tu es grand reporter, géographe et historien, et tu écris pour le magazine Acolyte.\nRédige un grand article de fond sur : ${sujet}.\nCatégorie : ${cat}. Ton : ${tons[ton] || tons.vivant}.\n\nExigences :\n1. Français impeccable, vivant, précis. Niveau grand reportage — jamais de remplissage.\n2. 4 à 5 sections, titres évocateurs. Chaque section fait 3 paragraphes DENSES et intègre :\n les origines (histoire, géologie ou architecture), une anecdote ou légende peu connue,\n la géographie ou l'atmosphère du lieu, et un conseil d'initié (bonne heure, coin discret).\n3. 6 à 8 faits chiffrés PRÉCIS et vérifiables : hauteur ou superficie, année ou époque,\n fréquentation annuelle, matériaux ou géologie, localisation, meilleure saison.\n4. RÈGLE ABSOLUE : uniquement des faits réels et vérifiables. Si tu n'es pas sûr d'un\n chiffre, donne un ordre de grandeur ou omets-le. N'invente RIEN.\n5. N'écris ni HTML ni Markdown : uniquement du texte. La mise en forme est faite ailleurs.\n\nCe qui sépare un bon article d'un texte d'IA — applique-le :\n6. ATTAQUE. Commence par une scène concrète, un détail sensoriel ou un chiffre qui\n surprend. Jamais par une définition ni par « Situé au cœur de… ».\n7. PHRASES INÉGALES. Alterne les longueurs. Une phrase courte après deux longues frappe.\n Un paragraphe entier de phrases de même longueur endort.\n8. DU CONCRET, PAS DES ADJECTIFS. « Un escalier de 1 350 marches taillé dans le basalte »\n vaut mieux que « un lieu absolument époustouflant ». Bannis : incontournable,\n emblématique, véritable joyau, à couper le souffle, mythique, unique au monde,\n qui ne laisse personne indifférent, plongez au cœur de.\n9. PAS DE CONCLUSION QUI RÉSUME. La dernière section apporte quelque chose de neuf ;\n elle ne récapitule pas ce qu'on vient de lire.\n10. VOIX ACTIVE, présent de narration quand ça sert la scène. Pas de « il est\n intéressant de noter que », pas de « en conclusion », pas de « de nos jours ».\n11. NOMS PROPRES. Cite des personnes, des dates, des matériaux, des rues, des plats\n précis. C'est ce qui prouve qu'on connaît le lieu.\n12. Le titre ne contient ni « : » suivi d'un slogan, ni superlatif creux. Il dit une\n chose précise sur CE lieu-là.\n\nRéponds UNIQUEMENT en JSON :\n{\n \"titre\":\"titre captivant, sans deux-points à rallonge\",\n \"sous_titre\":\"une phrase d'accroche\",\n \"resume\":\"2-3 phrases qui donnent envie de lire\",\n \"lecture\":\"ex : 6 min de lecture\",\n \"sujet\":\"le nom exact du lieu traité\",\n \"sections\":[{\"titre\":\"titre de section\",\"texte\":\"3 paragraphes séparés par des retours à la ligne\"}],\n \"faits\":[{\"label\":\"Hauteur\",\"valeur\":\"324 m\"}],\n \"tags\":[\"3 à 5 mots-clés\"]\n}`;\n }\n\n const BLOG_INTERVALLE_DEFAUT = 1;\n\n const BLOG_RETRI_MINUTES = 6;\n\n const BLOG_AMORCE = [\n [\"Mont Fuji\", \"nature\"],\n [\"Grand Canyon\", \"nature\"],\n [\"Aurores boréales\", \"nature\"],\n [\"Chutes Victoria\", \"nature\"],\n [\"Baie d’Halong\", \"nature\"],\n [\"Fjords de Norvège\", \"nature\"],\n [\"Salar d’Uyuni\", \"nature\"],\n [\"Great Barrier Reef\", \"nature\"],\n [\"Cappadoce\", \"nature\"],\n [\"Colisée\", \"bati\"],\n [\"Taj Mahal\", \"bati\"],\n [\"Machu Picchu\", \"bati\"],\n [\"Sagrada Família\", \"bati\"],\n [\"Angkor Vat\", \"bati\"],\n [\"Petra\", \"bati\"],\n [\"Grande Muraille\", \"bati\"],\n [\"Mont Saint-Michel\", \"bati\"],\n [\"Alhambra\", \"bati\"],\n\n [\"Tour Eiffel\", \"bati\"],\n [\"Palais de Westminster\", \"bati\"],\n [\"Statue de la Liberté\", \"bati\"],\n [\"Opéra de Sydney\", \"bati\"],\n [\"Pyramide de Khéops\", \"bati\"],\n [\"Tour de Pise\", \"bati\"],\n [\"Parthénon\", \"bati\"],\n [\"Château de Neuschwanstein\", \"bati\"],\n [\"Chichén Itzá\", \"bati\"],\n [\"Basilique Saint-Marc\", \"bati\"],\n [\"Tokyo\", \"ville\"],\n [\"Lisbonne\", \"ville\"],\n [\"Istanbul\", \"ville\"],\n [\"Marrakech\", \"ville\"],\n [\"Kyoto\", \"ville\"],\n [\"Buenos Aires\", \"ville\"],\n [\"Copenhague\", \"ville\"],\n [\"Séville\", \"ville\"],\n ];\n\n async function blogConfTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS aco_conf(k TEXT PRIMARY KEY, v TEXT NOT NULL)`,\n );\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_queue(\n sujet TEXT PRIMARY KEY, categorie TEXT NOT NULL,\n statut TEXT NOT NULL DEFAULT 'attente', ajoute_le INTEGER NOT NULL)`);\n }\n async function conf(k, defaut) {\n await blogConfTable();\n const r = await sqlite.execute({\n sql: \"SELECT v FROM aco_conf WHERE k = ?\",\n args: [k],\n });\n return r.rows[0] ? String(r.rows[0].v ?? r.rows[0][0]) : defaut;\n }\n async function setConf(k, v) {\n await blogConfTable();\n await sqlite.execute({\n sql:\n `INSERT INTO aco_conf(k,v) VALUES(?,?) ON CONFLICT(k) DO UPDATE SET v = excluded.v`,\n args: [k, String(v)],\n });\n }\n\n async function blogRegarnit() {\n await blogConfTable();\n await blogTable();\n const pris = new Set();\n try {\n const a = await sqlite.execute(`SELECT sujet FROM aco_posts`);\n for (const r of (a.rows || [])) {\n pris.add(slugify(String(r.sujet ?? r[0])));\n }\n const b = await sqlite.execute(`SELECT sujet FROM aco_queue`);\n for (const r of (b.rows || [])) {\n pris.add(slugify(String(r.sujet ?? r[0])));\n }\n } catch (e) {}\n\n const aAjouter = [];\n\n const TOPONYME = /^[\\p{L}][\\p{L}\\p{M}\\s'’\\-.]{2,39}$/u;\n const nomPublicOk = (s) =>\n TOPONYME.test(s) && !/\\d|@|https?:|www\\./i.test(s);\n const SEUIL_PARTAGE = 2;\n try {\n const rows =\n (await sqlite.execute(`SELECT payload FROM aco_trips LIMIT 400`))\n .rows || [];\n const vus = new Map();\n for (const row of rows) {\n try {\n const st = JSON.parse(String(row.payload ?? row[0]))?.trip || {};\n const nom = String(st?.trip?.nom ?? \"\").trim().slice(0, 40);\n if (!nom || /→/.test(nom) || !nomPublicOk(nom)) continue;\n vus.set(nom, (vus.get(nom) || 0) + 1);\n } catch (e) {}\n }\n\n for (const [nom, n] of [...vus.entries()].sort((x, y) => y[1] - x[1])) {\n if (n < SEUIL_PARTAGE) continue;\n if (!pris.has(slugify(nom))) {\n aAjouter.push([nom, \"ville\"]);\n pris.add(slugify(nom));\n }\n }\n } catch (e) {}\n\n for (const [nom, cat] of BLOG_AMORCE) {\n if (!pris.has(slugify(nom))) {\n aAjouter.push([nom, cat]);\n pris.add(slugify(nom));\n }\n }\n\n if (!aAjouter.length && env(\"GEMINI_KEY\")) {\n try {\n const dejaVus = [...pris].slice(-120).join(\", \");\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${\n env(\"GEMINI_KEY\")\n }`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n contents: [{\n parts: [{\n text:\n `Donne 25 destinations de voyage réelles et notables à traiter dans un blog de voyage francophone.\\n` +\n `Interdit d'utiliser ces sujets, déjà traités : ${dejaVus}\\n` +\n `Varie les continents et les genres. Pour chacune, la catégorie exacte parmi :\\n` +\n `\"nature\" (merveille naturelle), \"bati\" (monument ou site construit), \"ville\" (grande ville).\\n` +\n `Réponds en JSON strict : {\"sujets\":[{\"nom\":\"...\",\"categorie\":\"nature|bati|ville\"}]}\\n` +\n `Le \"nom\" est un toponyme seul, sans chiffre, sans ponctuation superflue, 3 à 39 caractères.`,\n }],\n }],\n generationConfig: {\n responseMimeType: \"application/json\",\n temperature: 0.9,\n maxOutputTokens: 2048,\n },\n }),\n },\n );\n if (r.ok) {\n const d = await r.json();\n const brut = d?.candidates?.[0]?.content?.parts?.[0]?.text || \"{}\";\n const sujets = JSON.parse(brut)?.sujets || [];\n const CATS = new Set([\"nature\", \"bati\", \"ville\"]);\n for (const s of sujets) {\n const nom = String(s?.nom ?? \"\").trim().slice(0, 40);\n const cat = String(s?.categorie ?? \"\").trim();\n\n if (!nom || !nomPublicOk(nom) || !CATS.has(cat)) continue;\n if (pris.has(slugify(nom))) continue;\n aAjouter.push([nom, cat]);\n pris.add(slugify(nom));\n }\n }\n } catch (e) {}\n }\n\n const now = Date.now();\n for (const [nom, cat] of aAjouter.slice(0, 60)) {\n try {\n await sqlite.execute({\n sql:\n `INSERT INTO aco_queue(sujet,categorie,statut,ajoute_le) VALUES(?,?,'attente',?)\n ON CONFLICT(sujet) DO NOTHING`,\n args: [nom, cat, now],\n });\n } catch (e) {}\n }\n return aAjouter.length;\n }\n\n async function blogRedige(sujet, categorie, ton, statut) {\n if (!env(\"GEMINI_KEY\")) {\n return { erreur: \"GEMINI_KEY non configurée\", code: 501 };\n }\n const slug = slugify(sujet);\n await blogTable();\n let data;\n try {\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${\n env(\"GEMINI_KEY\")\n }`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n contents: [{\n parts: [{ text: blogPrompt(sujet, categorie, ton) }],\n }],\n generationConfig: {\n responseMimeType: \"application/json\",\n temperature: 0.75,\n maxOutputTokens: 8192,\n },\n }),\n },\n );\n if (!r.ok) {\n return {\n erreur: \"Le moteur de rédaction a refusé la demande (\" + r.status +\n \")\",\n code: 502,\n };\n }\n const g = await r.json();\n const txt = g?.candidates?.[0]?.content?.parts?.[0]?.text || \"\";\n const m = txt.match(/\\{[\\s\\S]*\\}/);\n data = JSON.parse(m ? m[0] : txt);\n } catch (e) {\n return {\n erreur: \"Réponse illisible du moteur de rédaction\",\n code: 502,\n };\n }\n if (\n !data?.titre || !Array.isArray(data.sections) || !data.sections.length\n ) {\n return { erreur: \"Article incomplet\", code: 502 };\n }\n\n async function relire(art) {\n try {\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${\n env(\"GEMINI_KEY\")\n }`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n contents: [{\n parts: [{\n text:\n `Tu es chef d'édition. Voici un article destiné à la publication. Réécris-le pour le rendre MEILLEUR, sans rien inventer.\n\nARTICLE : ${\n JSON.stringify({\n titre: art.titre,\n sous_titre: art.sous_titre,\n resume: art.resume,\n sections: art.sections,\n })\n }\n\nCe que tu corriges, dans cet ordre :\n1. LA LANGUE DE BOIS. Supprime : incontournable, emblématique, véritable joyau, à couper le souffle, mythique, unique au monde, ne laisse personne indifférent, plongez au cœur de, véritable, authentique, magique, féerique. Remplace chacun par un FAIT concret ou coupe la phrase.\n2. LES ATTAQUES MOLLES. Si une section commence par « Situé au cœur de », « Niché entre », une définition ou une généralité, refais la première phrase : une scène, un détail matériel, ou un chiffre qui surprend.\n3. LE RYTHME. Si trois phrases de suite ont la même longueur, casse-en une. Une phrase courte après deux longues frappe.\n4. LES RÉPÉTITIONS. Un même mot marquant ne revient pas deux fois dans le même paragraphe.\n5. LA CONCLUSION QUI RÉSUME. Si la dernière section récapitule ce qu'on vient de lire, remplace-la par quelque chose de neuf : ce que le lieu devient hors saison, ce qu'on y entend à l'aube, ce que les habitants en disent.\n6. LE TITRE. S'il contient un superlatif creux ou un slogan après deux-points, refais-le : il doit dire une chose précise sur CE lieu.\n\nRÈGLES ABSOLUES :\n· N'INVENTE AUCUN FAIT, aucun chiffre, aucun nom. Tu réécris, tu ne documentes pas. Si une phrase te paraît douteuse, rends-la plus prudente au lieu de la préciser.\n· Garde le même nombre de sections et le même sujet.\n· Ni HTML ni Markdown : du texte seulement. Les paragraphes sont séparés par des retours à la ligne.\n\nRéponds UNIQUEMENT en JSON :\n{\"titre\":\"…\",\"sous_titre\":\"…\",\"resume\":\"…\",\"sections\":[{\"titre\":\"…\",\"texte\":\"…\"}]}`,\n }],\n }],\n generationConfig: {\n responseMimeType: \"application/json\",\n temperature: 0.6,\n maxOutputTokens: 8192,\n },\n }),\n },\n );\n if (!r.ok) return null;\n const g = await r.json();\n const txt = g?.candidates?.[0]?.content?.parts?.[0]?.text || \"\";\n const m = txt.match(/\\{[\\s\\S]*\\}/);\n const v = JSON.parse(m ? m[0] : txt);\n\n if (!v?.titre || !Array.isArray(v.sections)) return null;\n if (v.sections.length !== art.sections.length) return null;\n const avant = art.sections.reduce(\n (n, s) => n + String(s.texte || \"\").length,\n 0,\n );\n const apres = v.sections.reduce(\n (n, s) => n + String(s.texte || \"\").length,\n 0,\n );\n if (apres < avant * 0.75) return null;\n return v;\n } catch (e) {\n return null;\n }\n }\n const mieux = await relire(data);\n if (mieux) {\n data = {\n ...data,\n titre: mieux.titre,\n sous_titre: mieux.sous_titre || data.sous_titre,\n resume: mieux.resume || data.resume,\n sections: mieux.sections,\n _relu: 1,\n };\n }\n\n const corps = {\n sections: data.sections.slice(0, 8).map((s) => ({\n titre: String(s.titre || \"\").slice(0, 140),\n texte: String(s.texte || \"\").slice(0, 6000),\n })),\n faits: (Array.isArray(data.faits) ? data.faits : []).slice(0, 10).map(\n (f) => ({\n label: String(f.label || \"\").slice(0, 60),\n valeur: String(f.valeur || \"\").slice(0, 90),\n })\n ),\n tags: (Array.isArray(data.tags) ? data.tags : []).slice(0, 6).map((t) =>\n String(t).slice(0, 40)\n ),\n };\n const img = await blogImage(String(data.sujet || sujet));\n const now = Date.now();\n await sqlite.execute({\n sql:\n `INSERT INTO aco_posts(slug,sujet,categorie,titre,sous_titre,resume,lecture,corps,image,credit,statut,created_at)\n VALUES(?,?,?,?,?,?,?,?,?,?,?,?)\n ON CONFLICT(slug) DO UPDATE SET sujet=excluded.sujet,categorie=excluded.categorie,\n titre=excluded.titre,sous_titre=excluded.sous_titre,resume=excluded.resume,\n lecture=excluded.lecture,corps=excluded.corps,image=excluded.image,credit=excluded.credit`,\n args: [\n slug,\n String(data.sujet || sujet).slice(0, 80),\n categorie,\n String(data.titre).slice(0, 180),\n String(data.sous_titre || \"\").slice(0, 240),\n String(data.resume || \"\").slice(0, 600),\n String(data.lecture || \"\").slice(0, 40),\n JSON.stringify(corps),\n img.url,\n img.credit,\n statut || \"brouillon\",\n now,\n ],\n });\n return {\n ok: true,\n slug,\n titre: String(data.titre),\n sections: corps.sections.length,\n image: !!img.url,\n };\n }\n\n if (path === \"/blog/tick\") {\n const actif = (await conf(\"blog_auto\", \"1\")) === \"1\";\n if (!actif) return json({ fait: false, raison: \"automatisme en pause\" });\n const intervalle = Math.max(\n 1,\n parseInt(\n await conf(\"blog_intervalle\", String(BLOG_INTERVALLE_DEFAUT)),\n 10,\n ) || BLOG_INTERVALLE_DEFAUT,\n );\n const dernier = parseInt(await conf(\"blog_dernier\", \"0\"), 10) || 0;\n const reste = dernier + intervalle * 3600e3 - Date.now();\n if (reste > 0) {\n return json({\n fait: false,\n raison: \"pas encore l’heure\",\n dans_minutes: Math.ceil(reste / 60e3),\n });\n }\n\n await setConf(\"blog_dernier\", String(Date.now()));\n\n const replier = async () => {\n await setConf(\n \"blog_dernier\",\n String(Date.now() - intervalle * 3600e3 + BLOG_RETRI_MINUTES * 60e3),\n );\n };\n const compte = async (cle) => {\n const n = parseInt(await conf(cle, \"0\"), 10) || 0;\n await setConf(cle, String(n + 1));\n };\n\n await blogConfTable();\n let q = await sqlite.execute(\n `SELECT sujet,categorie FROM aco_queue WHERE statut = 'attente' ORDER BY ajoute_le ASC LIMIT 1`,\n );\n if (!q.rows[0]) {\n await blogRegarnit();\n q = await sqlite.execute(\n `SELECT sujet,categorie FROM aco_queue WHERE statut = 'attente' ORDER BY ajoute_le ASC LIMIT 1`,\n );\n }\n if (!q.rows[0]) {\n await replier();\n return json({\n fait: false,\n raison: \"plus aucun sujet à traiter\",\n retente_dans_minutes: BLOG_RETRI_MINUTES,\n });\n }\n\n const sujet = String(q.rows[0].sujet ?? q.rows[0][0]);\n const categorie = String(q.rows[0].categorie ?? q.rows[0][1]);\n let r;\n try {\n r = await blogRedige(sujet, categorie, \"vivant\", \"publie\");\n } catch (e) {\n r = { ok: false, erreur: String(e && e.message || e).slice(0, 200) };\n }\n await sqlite.execute({\n sql: `UPDATE aco_queue SET statut = ? WHERE sujet = ?`,\n args: [r.ok ? \"ecrit\" : \"echec\", sujet],\n });\n if (!r.ok) {\n await replier();\n await compte(\"blog_echecs\");\n return json({\n fait: false,\n sujet,\n erreur: r.erreur,\n retente_dans_minutes: BLOG_RETRI_MINUTES,\n });\n }\n\n await setConf(\"blog_dernier_ok\", String(Date.now()));\n await compte(\"blog_ecrits\");\n return json({\n fait: true,\n sujet,\n slug: r.slug,\n titre: r.titre,\n prochain_dans_h: intervalle,\n });\n }\n\n async function promoTable() {\n await blogConfTable();\n\n try {\n await sqlite.execute(\n `ALTER TABLE aco_users ADD COLUMN promo_ok INTEGER NOT NULL DEFAULT 0`,\n );\n } catch (e) {}\n }\n\n async function promoSecret() {\n let s = await conf(\"promo_secret\", \"\");\n if (!s) {\n s = randomHex(32);\n await setConf(\"promo_secret\", s);\n }\n return s;\n }\n async function promoJeton(email) {\n const cle = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(await promoSecret()),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\n \"HMAC\",\n cle,\n new TextEncoder().encode(email),\n );\n return [...new Uint8Array(sig)].map((x) =>\n x.toString(16).padStart(2, \"0\")\n ).join(\"\").slice(0, 32);\n }\n\n if (path === \"/promo/stop\") {\n await promoTable();\n const email = String(url.searchParams.get(\"e\") || \"\").trim().toLowerCase()\n .slice(0, 160);\n const jeton = String(url.searchParams.get(\"t\") || \"\");\n if (!email || !jeton) return json({ error: \"lien incomplet\" }, 400);\n const attendu = await promoJeton(email);\n\n if (!safeEqual(jeton, attendu)) {\n return json({ error: \"lien invalide\" }, 403);\n }\n await sqlite.execute({\n sql: `UPDATE aco_users SET promo_ok = 0 WHERE email = ?`,\n args: [email],\n });\n return new Response(\n 'Désinscription' +\n '' +\n '

C’est fait.

' +\n \"

Tu ne recevras plus d’offres de voyage d’Acolyte. Ton compte et tes voyages ne sont pas touchés.

\",\n {\n status: 200,\n headers: { ...cors, \"Content-Type\": \"text/html; charset=utf-8\" },\n },\n );\n }\n\n if (path === \"/admin/stats\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n await statTable();\n\n const depuis = new Date(Date.now() - 60 * 864e5).toISOString().slice(\n 0,\n 10,\n );\n const rows = (await sqlite.execute({\n sql:\n `SELECT jour, cle, n FROM aco_stats WHERE jour >= ? ORDER BY jour DESC`,\n args: [depuis],\n })).rows || [];\n const parJour = {}, totaux = {};\n for (const r of rows) {\n const j = String(r.jour ?? r[0]),\n c = String(r.cle ?? r[1]),\n n = Number(r.n ?? r[2]) || 0;\n (parJour[j] = parJour[j] || {})[c] = n;\n totaux[c] = (totaux[c] || 0) + n;\n }\n\n const pc = (a, b) => b ? Math.round((a / b) * 100) : null;\n const e = totaux;\n return json({\n ok: true,\n jours: parJour,\n totaux,\n entonnoir: {\n arrivees: e.arrivee || 0,\n inscrits: e.inscription || 0,\n taux_inscription: pc(e.inscription, e.arrivee),\n questions_au_bout: e.questions_finies || 0,\n questions_passees: e.questions_passees || 0,\n voyages_generes: e.voyage_genere || 0,\n taux_voyage: pc(e.voyage_genere, e.inscription),\n },\n });\n }\n\n if (path === \"/admin/promo\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n await promoTable();\n\n if (request.method === \"POST\") {\n const b = await request.json().catch(() => ({}));\n\n if (typeof b.actif !== \"undefined\") {\n await setConf(\"promo_actif\", b.actif ? \"1\" : \"0\");\n }\n\n if (b.envoyer) {\n if ((await conf(\"promo_actif\", \"0\")) !== \"1\") {\n return json({\n error:\n \"La lettre est désactivée. Active-la d’abord, en connaissance de cause.\",\n }, 409);\n }\n if (!mailReady(env)) {\n return json({\n error: \"Les variables EMAILJS_* ne sont pas configurées.\",\n }, 409);\n }\n\n const sujet = String(b.sujet || \"\").trim().slice(0, 120);\n const message = String(b.message || \"\").trim().slice(0, 4000);\n if (sujet.length < 3 || message.length < 20) {\n return json({ error: \"Il faut un objet et un message.\" }, 400);\n }\n\n const cibles = (await sqlite.execute(\n `SELECT email FROM aco_users WHERE promo_ok = 1 AND verified = 1 LIMIT 2000`,\n )).rows || [];\n const liste = cibles.map((r) => String(r.email ?? r[0]));\n\n if (!b.pour_de_vrai) {\n return json({\n simulation: true,\n destinataires: liste.length,\n note:\n \"Rien n’a été envoyé. Rappelle avec pour_de_vrai:true pour expédier.\",\n });\n }\n\n let ok = 0, ko = 0;\n for (const email of liste) {\n const stop = `${url.origin}/promo/stop?e=${\n encodeURIComponent(email)\n }&t=${await promoJeton(email)}`;\n const corps = message +\n `\\n\\n— \\nTu reçois ce message parce que tu as accepté les offres de voyage d’Acolyte.` +\n `\\nMe désinscrire : ${stop}`;\n try {\n const r = await fetch(\n \"https://api.emailjs.com/api/v1.0/email/send\",\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n service_id: env(\"EMAILJS_SERVICE\"),\n template_id: env(\"EMAILJS_TEMPLATE\"),\n user_id: env(\"EMAILJS_PUBLIC\"),\n accessToken: env(\"EMAILJS_PRIVATE\"),\n template_params: {\n to_email: email,\n email,\n sujet,\n code: sujet,\n message: corps,\n },\n }),\n },\n );\n r.ok ? ok++ : ko++;\n } catch (e) {\n ko++;\n }\n\n await new Promise((r) => setTimeout(r, 250));\n }\n await setConf(\"promo_dernier\", String(Date.now()));\n return json({ envoye: ok, echecs: ko });\n }\n }\n\n const total =\n (await sqlite.execute(\n `SELECT COUNT(*) AS n FROM aco_users WHERE verified = 1`,\n )).rows[0];\n const oui =\n (await sqlite.execute(\n `SELECT COUNT(*) AS n FROM aco_users WHERE promo_ok = 1 AND verified = 1`,\n )).rows[0];\n const dernier = parseInt(await conf(\"promo_dernier\", \"0\"), 10) || 0;\n return json({\n actif: (await conf(\"promo_actif\", \"0\")) === \"1\",\n mail_pret: mailReady(env),\n clients_verifies: total ? Number(total.n ?? total[0]) : 0,\n consentants: oui ? Number(oui.n ?? oui[0]) : 0,\n dernier_envoi: dernier,\n });\n }\n\n if (path === \"/admin/blog/auto\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n if (request.method === \"POST\") {\n const b = await request.json().catch(() => ({}));\n if (typeof b.actif !== \"undefined\") {\n await setConf(\"blog_auto\", b.actif ? \"1\" : \"0\");\n }\n if (b.intervalle) {\n await setConf(\n \"blog_intervalle\",\n String(\n Math.max(\n 1,\n Math.min(\n 168,\n parseInt(b.intervalle, 10) || BLOG_INTERVALLE_DEFAUT,\n ),\n ),\n ),\n );\n }\n if (b.regarnir) await blogRegarnit();\n\n if (b.maintenant) await setConf(\"blog_dernier\", \"0\");\n }\n await blogConfTable();\n const attente = await sqlite.execute(\n `SELECT COUNT(*) AS n FROM aco_queue WHERE statut = 'attente'`,\n );\n const suivants = await sqlite.execute(\n `SELECT sujet FROM aco_queue WHERE statut = 'attente' ORDER BY ajoute_le ASC LIMIT 5`,\n );\n const dernier = parseInt(await conf(\"blog_dernier\", \"0\"), 10) || 0;\n const intervalle =\n parseInt(\n await conf(\"blog_intervalle\", String(BLOG_INTERVALLE_DEFAUT)),\n 10,\n ) || BLOG_INTERVALLE_DEFAUT;\n\n const dernierOk = parseInt(await conf(\"blog_dernier_ok\", \"0\"), 10) || 0;\n const depuisOk = dernierOk ? Date.now() - dernierOk : null;\n return json({\n actif: (await conf(\"blog_auto\", \"1\")) === \"1\",\n intervalle,\n dernier,\n prochain_dans_minutes: dernier\n ? Math.max(\n 0,\n Math.ceil((dernier + intervalle * 3600e3 - Date.now()) / 60e3),\n )\n : 0,\n en_attente: attente.rows[0]\n ? Number(attente.rows[0].n ?? attente.rows[0][0])\n : 0,\n suivants: (suivants.rows || []).map((r) => String(r.sujet ?? r[0])),\n dernier_ok: dernierOk,\n heures_depuis_dernier: depuisOk === null\n ? null\n : +(depuisOk / 3600e3).toFixed(1),\n en_retard: depuisOk !== null && depuisOk > intervalle * 2 * 3600e3,\n ecrits: parseInt(await conf(\"blog_ecrits\", \"0\"), 10) || 0,\n echecs: parseInt(await conf(\"blog_echecs\", \"0\"), 10) || 0,\n });\n }\n\n if (path === \"/admin/blog/generate\" && request.method === \"POST\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n\n const b = await request.json().catch(() => ({}));\n const sujet = String(b.sujet || \"\").trim().slice(0, 80);\n const categorie = BLOG_CATS[b.categorie] ? b.categorie : \"nature\";\n if (sujet.length < 3) return json({ error: \"Sujet manquant\" }, 400);\n\n await blogTable();\n const deja = await sqlite.execute({\n sql: \"SELECT slug FROM aco_posts WHERE slug = ?\",\n args: [slugify(sujet)],\n });\n if (deja.rows[0] && !b.remplacer) {\n return json({\n error: \"Un article existe déjà sur ce sujet\",\n slug: slugify(sujet),\n }, 409);\n }\n\n const r = await blogRedige(\n sujet,\n categorie,\n String(b.ton || \"vivant\"),\n \"brouillon\",\n );\n if (r.erreur) return json({ error: r.erreur }, r.code || 502);\n return json({\n ok: true,\n slug: r.slug,\n titre: r.titre,\n sections: r.sections,\n image: r.image,\n });\n }\n\n if (path === \"/admin/blog/list\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n await blogTable();\n const r = await sqlite.execute(\n `SELECT slug,sujet,categorie,titre,statut,created_at,\n (image IS NOT NULL AND image <> '') AS a_image FROM aco_posts ORDER BY created_at DESC LIMIT 200`,\n );\n return json({\n articles: (r.rows || []).map((x) => ({\n slug: String(x.slug ?? x[0]),\n sujet: String(x.sujet ?? x[1]),\n categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]),\n statut: String(x.statut ?? x[4]),\n quand: Number(x.created_at ?? x[5]),\n image: !!Number(x.a_image ?? x[6]),\n })),\n });\n }\n\n if (path === \"/admin/blog/statut\" && request.method === \"POST\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n const b = await request.json().catch(() => ({}));\n const st = b.statut === \"publie\" ? \"publie\" : \"brouillon\";\n await blogTable();\n await sqlite.execute({\n sql: \"UPDATE aco_posts SET statut = ? WHERE slug = ?\",\n args: [st, String(b.slug || \"\").slice(0, 70)],\n });\n return json({ ok: true, statut: st });\n }\n if (path === \"/admin/blog\" && request.method === \"DELETE\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n await blogTable();\n await sqlite.execute({\n sql: \"DELETE FROM aco_posts WHERE slug = ?\",\n args: [String(url.searchParams.get(\"slug\") || \"\").slice(0, 70)],\n });\n return json({ ok: true });\n }\n\n if (path === \"/blog\") {\n await blogTable();\n const r = await sqlite.execute(\n `SELECT slug,sujet,categorie,titre,sous_titre,resume,lecture,image,created_at\n FROM aco_posts WHERE statut = 'publie' ORDER BY created_at DESC LIMIT 60`,\n );\n return json({\n articles: (r.rows || []).map((x) => ({\n slug: String(x.slug ?? x[0]),\n sujet: String(x.sujet ?? x[1]),\n categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]),\n sous_titre: String(x.sous_titre ?? x[4] ?? \"\"),\n resume: String(x.resume ?? x[5] ?? \"\"),\n lecture: String(x.lecture ?? x[6] ?? \"\"),\n image: String(x.image ?? x[7] ?? \"\"),\n quand: Number(x.created_at ?? x[8]),\n })),\n });\n }\n\n if (path === \"/blog/index\") {\n await blogTable();\n const r = await sqlite.execute(\n `SELECT slug,sujet,titre FROM aco_posts WHERE statut = 'publie' LIMIT 300`,\n );\n return json({\n index: (r.rows || []).map((x) => ({\n slug: String(x.slug ?? x[0]),\n sujet: String(x.sujet ?? x[1]),\n titre: String(x.titre ?? x[2]),\n })),\n });\n }\n if (path === \"/blog/article\") {\n await blogTable();\n const r = await sqlite.execute({\n sql:\n `SELECT slug,sujet,categorie,titre,sous_titre,resume,lecture,corps,image,credit,created_at\n FROM aco_posts WHERE slug = ? AND statut = 'publie'`,\n args: [String(url.searchParams.get(\"slug\") || \"\").slice(0, 70)],\n });\n const x = r.rows[0];\n if (!x) return json({ error: \"Article introuvable\" }, 404);\n let corps = { sections: [], faits: [], tags: [] };\n try {\n corps = JSON.parse(String(x.corps ?? x[7]));\n } catch (e) {}\n return json({\n article: {\n slug: String(x.slug ?? x[0]),\n sujet: String(x.sujet ?? x[1]),\n categorie: String(x.categorie ?? x[2]),\n titre: String(x.titre ?? x[3]),\n sous_titre: String(x.sous_titre ?? x[4] ?? \"\"),\n resume: String(x.resume ?? x[5] ?? \"\"),\n lecture: String(x.lecture ?? x[6] ?? \"\"),\n image: String(x.image ?? x[8] ?? \"\"),\n credit: String(x.credit ?? x[9] ?? \"\"),\n quand: Number(x.created_at ?? x[10]),\n ...corps,\n },\n });\n }\n if (path === \"/capabilities\") {\n return json({\n comptes: mailReady(env),\n gemini: !!env(\"GEMINI_KEY\"),\n groq: !!env(\"GROQ_KEY\"),\n travelpayouts: !!env(\"TRAVELPAYOUTS_KEY\"),\n });\n }\n\n if (path === \"/maildiag\") {\n const adm = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const who = await sessionEmail(request);\n if (!adm || !who || !safeEqual(who, adm)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n return json({\n variables: {\n EMAILJS_PUBLIC: !!env(\"EMAILJS_PUBLIC\"),\n EMAILJS_PRIVATE: !!env(\"EMAILJS_PRIVATE\"),\n EMAILJS_SERVICE: env(\"EMAILJS_SERVICE\") || \"(vide)\",\n EMAILJS_TEMPLATE: env(\"EMAILJS_TEMPLATE\") || \"(vide)\",\n },\n derniereReponseEmailJS: await readMail(),\n });\n }\n\n const newSession = async (email) => {\n const token = randomHex(32);\n await sqlite.execute({\n sql:\n \"INSERT INTO aco_sessions(token_h, email, expires_at) VALUES(?,?,?)\",\n args: [await sha256(token), email, Date.now() + SESS_TTL],\n });\n\n try {\n await sqlite.execute({\n sql: `DELETE FROM aco_sessions WHERE email = ? AND token_h NOT IN (\n SELECT token_h FROM aco_sessions WHERE email = ?\n ORDER BY expires_at DESC LIMIT ?)`,\n args: [email, email, SESS_MAX],\n });\n } catch (e) {}\n return token;\n };\n\n const issueCode = async (email) => {\n if (!mailReady(env)) {\n return {\n err: \"L'envoi d'email n'est pas configuré sur le serveur\",\n status: 501,\n };\n }\n const now = Date.now();\n const prev = await sqlite.execute({\n sql: \"SELECT sent_at FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n if (prev.rows[0] && now - Number(prev.rows[0][0]) < CODE_WAIT) {\n return {\n err: \"Un code vient déjà d’être envoyé. Attends une minute.\",\n status: 429,\n };\n }\n const code = String(Math.floor(100000 + Math.random() * 900000));\n if (!(await sendCodeMail(env, email, code))) {\n return {\n err: \"L'email n'a pas pu être envoyé. Réessaie dans un instant.\",\n status: 502,\n };\n }\n await sqlite.execute({\n sql:\n `INSERT INTO aco_codes(email, code_h, expires_at, tries, sent_at) VALUES(?,?,?,0,?)\n ON CONFLICT(email) DO UPDATE SET code_h=excluded.code_h,\n expires_at=excluded.expires_at, tries=0, sent_at=excluded.sent_at`,\n args: [\n email,\n await sha256(\"aco::\" + email + \"::\" + code),\n now + CODE_TTL,\n now,\n ],\n });\n return { ok: true };\n };\n\n const checkCode = async (email, code) => {\n const r = await sqlite.execute({\n sql: \"SELECT code_h, expires_at, tries FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n const row = r.rows[0];\n if (!row) return { err: \"Demande un nouveau code\", status: 400 };\n if (Number(row[1]) < Date.now()) {\n await sqlite.execute({\n sql: \"DELETE FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n return { err: \"Code expiré — demandes-en un nouveau\", status: 400 };\n }\n if (Number(row[2]) >= CODE_TRIES) {\n await sqlite.execute({\n sql: \"DELETE FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n return { err: \"Trop d’essais — demande un nouveau code\", status: 429 };\n }\n if (\n !safeEqual(String(row[0]), await sha256(\"aco::\" + email + \"::\" + code))\n ) {\n await sqlite.execute({\n sql: \"UPDATE aco_codes SET tries = tries + 1 WHERE email = ?\",\n args: [email],\n });\n return { err: \"Code incorrect\", status: 400 };\n }\n await sqlite.execute({\n sql: \"DELETE FROM aco_codes WHERE email = ?\",\n args: [email],\n });\n return { ok: true };\n };\n\n if (path === \"/auth/signup\" && request.method === \"POST\") {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email), pass = cleanPass(body.password);\n if (!email) return json({ error: \"Adresse email invalide\" }, 400);\n if (!pass) {\n return json(\n { error: `Mot de passe : ${PASS_MIN} caractères minimum` },\n 400,\n );\n }\n await db();\n const ex = await sqlite.execute({\n sql: \"SELECT verified FROM aco_users WHERE email = ?\",\n args: [email],\n });\n if (ex.rows[0] && Number(ex.rows[0][0]) === 1) {\n return json({\n error: \"Un compte existe déjà avec cette adresse — connecte-toi\",\n }, 409);\n }\n\n const salt = randomHex(16);\n\n await sqlite.execute({\n sql:\n `INSERT INTO aco_users(email, pass_h, salt, verified, created_at) VALUES(?,?,?,0,?)\n ON CONFLICT(email) DO UPDATE SET pass_h=excluded.pass_h, salt=excluded.salt`,\n args: [email, await hashPass(pass, salt), salt, Date.now()],\n });\n const r = await issueCode(email);\n if (r.err) return json({ error: r.err }, r.status);\n return json({ ok: true, etape: \"verification\" });\n }\n\n if (path === \"/auth/verify\" && request.method === \"POST\") {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email),\n code = String(body.code || \"\").trim();\n if (!email || !/^\\d{6}$/.test(code)) {\n return json({ error: \"Code invalide\" }, 400);\n }\n await db();\n const c = await checkCode(email, code);\n if (c.err) return json({ error: c.err }, c.status);\n await sqlite.execute({\n sql: \"UPDATE aco_users SET verified = 1 WHERE email = ?\",\n args: [email],\n });\n return json({ token: await newSession(email), email });\n }\n\n if (path === \"/auth/login\" && request.method === \"POST\") {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email), pass = String(body.password || \"\");\n if (!email || !pass) {\n return json({ error: \"Identifiants invalides\" }, 400);\n }\n await db();\n const now = Date.now();\n const lk = await sqlite.execute({\n sql: \"SELECT fails, locked_until FROM aco_logins WHERE email = ?\",\n args: [email],\n });\n if (lk.rows[0] && Number(lk.rows[0][1]) > now) {\n return json({\n error: \"Trop de tentatives — réessaie dans un quart d’heure\",\n }, 429);\n }\n\n const u = await sqlite.execute({\n sql: \"SELECT pass_h, salt, verified FROM aco_users WHERE email = ?\",\n args: [email],\n });\n const row = u.rows[0];\n\n const salt = row ? String(row[1]) : randomHex(16);\n const calc = await hashPass(pass, salt);\n const good = !!row && safeEqual(String(row[0]), calc);\n\n if (!good) {\n const fails = (lk.rows[0] ? Number(lk.rows[0][0]) : 0) + 1;\n await sqlite.execute({\n sql: `INSERT INTO aco_logins(email, fails, locked_until) VALUES(?,?,?)\n ON CONFLICT(email) DO UPDATE SET fails=excluded.fails, locked_until=excluded.locked_until`,\n args: [email, fails, fails >= LOGIN_FAILS ? now + LOGIN_LOCK : 0],\n });\n return json({ error: \"Email ou mot de passe incorrect\" }, 401);\n }\n if (Number(row[2]) !== 1) {\n const r = await issueCode(email);\n return json({\n error: \"Adresse non vérifiée — un code vient de t’être envoyé\",\n etape: \"verification\",\n envoye: !r.err,\n }, 403);\n }\n await sqlite.execute({\n sql: \"DELETE FROM aco_logins WHERE email = ?\",\n args: [email],\n });\n return json({ token: await newSession(email), email });\n }\n\n if (path === \"/auth/forgot\" && request.method === \"POST\") {\n const email = cleanEmail((await request.json().catch(() => ({}))).email);\n if (!email) return json({ error: \"Adresse email invalide\" }, 400);\n await db();\n const ex = await sqlite.execute({\n sql: \"SELECT email FROM aco_users WHERE email = ?\",\n args: [email],\n });\n\n if (ex.rows[0]) await issueCode(email);\n return json({ ok: true });\n }\n\n if (path === \"/auth/reset\" && request.method === \"POST\") {\n const body = await request.json().catch(() => ({}));\n const email = cleanEmail(body.email),\n code = String(body.code || \"\").trim();\n const pass = cleanPass(body.password);\n if (!email || !/^\\d{6}$/.test(code)) {\n return json({ error: \"Code invalide\" }, 400);\n }\n if (!pass) {\n return json(\n { error: `Mot de passe : ${PASS_MIN} caractères minimum` },\n 400,\n );\n }\n await db();\n const c = await checkCode(email, code);\n if (c.err) return json({ error: c.err }, c.status);\n const salt = randomHex(16);\n await sqlite.execute({\n sql:\n \"UPDATE aco_users SET pass_h = ?, salt = ?, verified = 1 WHERE email = ?\",\n args: [await hashPass(pass, salt), salt, email],\n });\n\n await sqlite.execute({\n sql: \"DELETE FROM aco_sessions WHERE email = ?\",\n args: [email],\n });\n await sqlite.execute({\n sql: \"DELETE FROM aco_logins WHERE email = ?\",\n args: [email],\n });\n purge();\n return json({ token: await newSession(email), email });\n }\n\n if (path === \"/auth/logout\" && request.method === \"POST\") {\n const h = request.headers.get(\"Authorization\") || \"\";\n const tok = h.startsWith(\"Bearer \") ? h.slice(7).trim() : \"\";\n if (tok) {\n await db();\n await sqlite.execute({\n sql: \"DELETE FROM aco_sessions WHERE token_h = ?\",\n args: [await sha256(tok)],\n });\n }\n return json({ ok: true });\n }\n\n if (path === \"/sync\") {\n const email = await sessionEmail(request);\n if (!email) {\n return json({ error: \"Session expirée — reconnecte-toi\" }, 401);\n }\n\n if (request.method === \"GET\") {\n const r = await sqlite.execute({\n sql: \"SELECT payload, updated_at FROM aco_trips WHERE email = ?\",\n args: [email],\n });\n const row = r.rows[0];\n return json(\n row\n ? {\n payload: JSON.parse(String(row[0])),\n updated_at: Number(row[1]),\n }\n : { payload: null, updated_at: 0 },\n );\n }\n if (request.method === \"POST\") {\n const body = await request.json().catch(() => null);\n if (!body || typeof body.payload === \"undefined\") {\n return json({ error: \"Contenu manquant\" }, 400);\n }\n const txt = JSON.stringify(body.payload);\n if (txt.length > MAX_PAYLOAD) {\n return json({ error: \"Sauvegarde trop volumineuse\" }, 413);\n }\n const now = Date.now();\n\n await sqlite.execute({\n sql: `INSERT INTO aco_trips(email, payload, updated_at) VALUES(?,?,?)\n ON CONFLICT(email) DO UPDATE SET payload=excluded.payload, updated_at=excluded.updated_at`,\n args: [email, txt, now],\n });\n return json({ ok: true, updated_at: now });\n }\n }\n\n if (path === \"/account\" && request.method === \"DELETE\") {\n const email = await sessionEmail(request);\n if (!email) {\n return json({ error: \"Session expirée — reconnecte-toi\" }, 401);\n }\n\n for (\n const t of [\n \"aco_trips\",\n \"aco_sessions\",\n \"aco_codes\",\n \"aco_logins\",\n \"aco_users\",\n \"aco_scores\",\n \"aco_ai\",\n ]\n ) {\n try {\n await sqlite.execute({\n sql: `DELETE FROM ${t} WHERE email = ?`,\n args: [email],\n });\n } catch (e) {}\n }\n return json({ ok: true });\n }\n\n if (path === \"/game/score\" && request.method === \"POST\") {\n const email = await sessionEmail(request);\n if (!email) {\n return json({ error: \"Connecte-toi pour enregistrer ton score\" }, 401);\n }\n const body = await request.json().catch(() => ({}));\n const score = Math.max(\n 0,\n Math.min(1_000_000, parseInt(body.score, 10) || 0),\n );\n const name = String(body.name || \"Voyageur\").trim().slice(0, 20) ||\n \"Voyageur\";\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_scores(\n email TEXT PRIMARY KEY, name TEXT NOT NULL, score INTEGER NOT NULL, at INTEGER NOT NULL)`);\n\n await sqlite.execute({\n sql: `INSERT INTO aco_scores(email, name, score, at) VALUES(?,?,?,?)\n ON CONFLICT(email) DO UPDATE SET name=excluded.name,\n score=MAX(aco_scores.score, excluded.score), at=excluded.at`,\n args: [email, name, score, Date.now()],\n });\n return json({ ok: true });\n }\n if (path === \"/game/top\") {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS aco_scores(\n email TEXT PRIMARY KEY, name TEXT NOT NULL, score INTEGER NOT NULL, at INTEGER NOT NULL)`);\n const r = await sqlite.execute(\n `SELECT name, score FROM aco_scores ORDER BY score DESC, at ASC LIMIT 10`,\n );\n const top = (r.rows || []).map((row) => ({\n name: String(row.name ?? row[0]),\n score: Number(row.score ?? row[1]),\n }));\n return json({ top });\n }\n\n if (path === \"/admin/stats\") {\n const admin = env(\"ADMIN_EMAIL\").trim().toLowerCase();\n const email = await sessionEmail(request);\n\n if (!admin || !email || !safeEqual(email, admin)) {\n return json({ error: \"Accès refusé\" }, 403);\n }\n\n const K = 5;\n const now = Date.now(), J7 = now - 7 * 864e5, J30 = now - 30 * 864e5;\n\n const cnt = async (sql, args = []) => {\n const r = await sqlite.execute({ sql, args });\n const row = r.rows?.[0];\n return row ? Number(row.n ?? row[0]) : 0;\n };\n const comptes = {\n total: await cnt(`SELECT COUNT(*) AS n FROM aco_users`),\n verifies: await cnt(\n `SELECT COUNT(*) AS n FROM aco_users WHERE verified = 1`,\n ),\n nouveaux7j: await cnt(\n `SELECT COUNT(*) AS n FROM aco_users WHERE created_at > ?`,\n [J7],\n ),\n nouveaux30j: await cnt(\n `SELECT COUNT(*) AS n FROM aco_users WHERE created_at > ?`,\n [J30],\n ),\n };\n\n const courbe = [];\n try {\n const jours = new Map();\n for (let i = 29; i >= 0; i--) {\n const d = new Date(now - i * 864e5);\n jours.set(\n `${d.getUTCFullYear()}-${\n String(d.getUTCMonth() + 1).padStart(2, \"0\")\n }-${String(d.getUTCDate()).padStart(2, \"0\")}`,\n 0,\n );\n }\n const r = await sqlite.execute({\n sql: `SELECT created_at FROM aco_users WHERE created_at > ?`,\n args: [now - 30 * 864e5],\n });\n for (const row of (r.rows || [])) {\n const d = new Date(Number(row.created_at ?? row[0]));\n const k = `${d.getUTCFullYear()}-${\n String(d.getUTCMonth() + 1).padStart(2, \"0\")\n }-${String(d.getUTCDate()).padStart(2, \"0\")}`;\n if (jours.has(k)) jours.set(k, jours.get(k) + 1);\n }\n for (const [j, n] of jours) courbe.push({ j, n });\n } catch (e) {}\n\n const dest = new Map(), pays = new Map();\n const modes = { avion: 0, train: 0, voiture: 0, autre: 0 };\n const budget = { petit: 0, moyen: 0, confort: 0, eleve: 0, inconnu: 0 };\n const duree = {\n weekend: 0,\n semaine: 0,\n deuxSemaines: 0,\n plus: 0,\n inconnu: 0,\n };\n const avecQui = {\n solo: 0,\n couple: 0,\n amis: 0,\n famille: 0,\n collegues: 0,\n inconnu: 0,\n };\n const sejour = {\n hotel: 0,\n appartement: 0,\n auberge: 0,\n luxe: 0,\n inconnu: 0,\n };\n const mois = new Array(12).fill(0);\n let voyagesTotal = 0,\n avecPlan = 0,\n actifs7j = 0,\n actifs30j = 0,\n multiBase = 0;\n\n const casier = (v, table) => {\n const s = String(v || \"\").toLowerCase();\n for (const [motif, cle] of table) if (motif.test(s)) return cle;\n return \"inconnu\";\n };\n const T_BUDGET = [\n [/petit|<\\s*500|moins/, \"petit\"],\n [/moyen|500/, \"moyen\"],\n [/confort|1200/, \"confort\"],\n [/élev|eleve|2500|luxe/, \"eleve\"],\n ];\n const T_DUREE = [\n [/week|2-3/, \"weekend\"],\n [/1 semaine|7 j|une semaine/, \"semaine\"],\n [/2 semaines|14/, \"deuxSemaines\"],\n [/3 semaines|21|mois|\\+/, \"plus\"],\n ];\n const T_QUI = [\n [/solo|seul/, \"solo\"],\n [/couple/, \"couple\"],\n [/ami/, \"amis\"],\n [/famille|enfant/, \"famille\"],\n [/collègue|collegue|travail/, \"collegues\"],\n ];\n const T_SEJOUR = [\n [/hôtel|hotel/, \"hotel\"],\n [/appart|airbnb/, \"appartement\"],\n [/auberge|hostel|éco|eco/, \"auberge\"],\n [/luxe|luxury/, \"luxe\"],\n ];\n\n try {\n const rows =\n (await sqlite.execute(`SELECT payload, updated_at FROM aco_trips`))\n .rows || [];\n for (const row of rows) {\n voyagesTotal++;\n const maj = Number(row.updated_at ?? row[1]) || 0;\n if (maj > J7) actifs7j++;\n if (maj > J30) actifs30j++;\n try {\n const p = JSON.parse(String(row.payload ?? row[0]));\n const st = p?.trip || {};\n const nom = st?.trip?.nom, pa = st?.trip?.pays;\n if (nom) {\n dest.set(\n String(nom).slice(0, 60),\n (dest.get(String(nom).slice(0, 60)) || 0) + 1,\n );\n }\n if (pa) {\n pays.set(\n String(pa).slice(0, 60),\n (pays.get(String(pa).slice(0, 60)) || 0) + 1,\n );\n }\n const m = st?.cache?.plan?.transport?.mode;\n if (m && modes[m] !== undefined) modes[m]++;\n else if (m) modes.autre++;\n if (st?.cache?.plan) avecPlan++;\n if ((st?.cache?.plan?.logement?.etapes || []).length > 1) {\n multiBase++;\n }\n const pr = st?.prefs || {};\n budget[casier(pr.budget, T_BUDGET)]++;\n duree[casier(pr.days, T_DUREE)]++;\n avecQui[casier(pr.withWho, T_QUI)]++;\n sejour[casier(pr.stay, T_SEJOUR)]++;\n\n const dep = String(pr.depart || \"\");\n const mm = dep.match(/^\\d{4}-(\\d{2})/);\n if (mm) {\n const i = +mm[1] - 1;\n if (i >= 0 && i < 12) mois[i]++;\n }\n } catch (e) {}\n }\n } catch (e) {}\n\n const auSeuil = (map) => {\n const vus = [], masq = { lieux: 0, voyages: 0 };\n for (const [nom, n] of map) {\n if (n >= K) vus.push({ nom, n });\n else {\n masq.lieux++;\n masq.voyages += n;\n }\n }\n vus.sort((a, b) => b.n - a.n);\n return { vus: vus.slice(0, 12), masq };\n };\n const D = auSeuil(dest), P = auSeuil(pays);\n\n const assezDeMonde = voyagesTotal >= K;\n\n let jeu = [], joueurs = 0;\n try {\n const r = await sqlite.execute(\n `SELECT name, score FROM aco_scores ORDER BY score DESC LIMIT 10`,\n );\n jeu = (r.rows || []).map((x) => ({\n name: String(x.name ?? x[0]).slice(0, 20),\n score: Number(x.score ?? x[1]),\n }));\n joueurs = await cnt(`SELECT COUNT(*) AS n FROM aco_scores`);\n } catch (e) {}\n\n let appareils = 0, iaHeure = 0, iaComptes = 0;\n try {\n appareils = await cnt(\n `SELECT COUNT(*) AS n FROM aco_sessions WHERE expires_at > ?`,\n [now],\n );\n } catch (e) {}\n try {\n iaHeure = await cnt(\n `SELECT COALESCE(SUM(n),0) AS n FROM aco_ai WHERE window_start > ?`,\n [now - 3600 * 1000],\n );\n iaComptes = await cnt(\n `SELECT COUNT(*) AS n FROM aco_ai WHERE window_start > ?`,\n [now - 3600 * 1000],\n );\n } catch (e) {}\n\n return json({\n comptes,\n\n voyages: {\n total: voyagesTotal,\n avecPlan,\n actifs7j,\n actifs30j,\n multiBase: assezDeMonde ? multiBase : null,\n },\n courbe,\n destinations: D.vus,\n destinationsMasquees: D.masq,\n pays: P.vus,\n paysMasques: P.masq,\n\n transports: assezDeMonde ? modes : null,\n budget: assezDeMonde ? budget : null,\n duree: assezDeMonde ? duree : null,\n avecQui: assezDeMonde ? avecQui : null,\n sejour: assezDeMonde ? sejour : null,\n mois: assezDeMonde ? mois : null,\n assezDeMonde,\n technique: { appareils, iaHeure, iaComptes },\n jeu,\n joueurs,\n seuil: K,\n genere: now,\n });\n }\n\n if (path === \"/gemini/models\") {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env(\"GEMINI_KEY\")) {\n return json({ error: \"GEMINI_KEY non configurée\" }, 501);\n }\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models?key=${\n env(\"GEMINI_KEY\")\n }&pageSize=100`,\n );\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n if (path === \"/gemini\") {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env(\"GEMINI_KEY\")) {\n return json({ error: \"GEMINI_KEY non configurée\" }, 501);\n }\n const { model, body } = await request.json();\n const m = String(model || \"gemini-2.5-flash\").replace(\n /[^a-zA-Z0-9.\\-_]/g,\n \"\",\n );\n const r = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/${m}:generateContent?key=${\n env(\"GEMINI_KEY\")\n }`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n },\n );\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n if (path === \"/groq\") {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env(\"GROQ_KEY\")) {\n return json({ error: \"GROQ_KEY non configurée\" }, 501);\n }\n const { body } = await request.json();\n const r = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: `Bearer ${env(\"GROQ_KEY\")}`,\n },\n body: JSON.stringify(body),\n });\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n if (path === \"/hotels\") {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n if (!env(\"TRAVELPAYOUTS_KEY\")) {\n return json({ error: \"TRAVELPAYOUTS_KEY non configurée\" }, 501);\n }\n const p = url.searchParams;\n const api = new URL(\"https://engine.hotellook.com/api/v2/cache.json\");\n [\n \"location\",\n \"checkIn\",\n \"checkOut\",\n \"adults\",\n \"children\",\n \"currency\",\n \"limit\",\n ].forEach((k) => {\n if (p.get(k)) api.searchParams.set(k, p.get(k));\n });\n api.searchParams.set(\"token\", env(\"TRAVELPAYOUTS_KEY\"));\n const r = await fetch(api.toString(), {\n headers: { Accept: \"application/json\" },\n });\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n const target = url.searchParams.get(\"url\");\n if (target) {\n const g = await aiGuard(request);\n if (g.err) return json({ error: g.err }, g.status);\n let u;\n try {\n u = new URL(target);\n } catch {\n return json({ error: \"URL invalide\" }, 400);\n }\n if (!RELAY_HOSTS.includes(u.hostname)) {\n return json({ error: \"Domaine non autorisé : \" + u.hostname }, 403);\n }\n const r = await fetch(u.toString(), {\n headers: { Accept: \"application/json\" },\n });\n return new Response(await r.text(), {\n status: r.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n }\n\n return json({\n error: \"Route inconnue\",\n routes: [\n \"/capabilities\",\n \"/gemini\",\n \"/gemini/models\",\n \"/groq\",\n \"/hotels\",\n \"/?url=\",\n ],\n }, 404);\n } catch (e) {\n return json({ error: \"Backend : \" + e.message }, 502);\n }\n}","createdAt",["D",1786095917187],"branchVersion","branchId","368d0bc6-313a-4987-b738-c88bf9de4210","id","b1003388-b33c-45f4-9cd2-3fc55c5c5fb3","Acolyte",["D",1784210218734],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","f874ae3c-562e-4ee5-89ab-18713e0a1c85","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f6b36-1181-7702-9b22-e92bc9eddf83","tursoName","b1003388b33c45f49cd23fc55c5c5fb3","tursoHostname","b1003388b33c45f49cd23fc55c5c5fb3-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789473046147],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_105":101},"org",{"_98":97,"_99":97,"_100":101,"_18":55,"_102":103,"_104":25},"branch",{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned",48,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","lechat45","handle","displayName","avatar","https://avatars.githubusercontent.com/u/219686589?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":167,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":168,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":169,"_82":170,"_84":171,"_86":25},"tree",[158,159],"files",[158,159],"counts",{"_146":61,"_147":148,"_149":61,"_150":151,"_152":153},"contents",[128,129],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":142,"_32":28,"_30":31,"_133":-5,"_41":42,"_40":14,"_135":25,"_38":143,"_13":144,"_33":34,"_35":37,"_24":25,"_140":-5,"_27":145},{"_43":130,"_32":131,"_30":132,"_133":-5,"_41":42,"_40":134,"_135":123,"_38":136,"_13":137,"_33":138,"_35":139,"_24":25,"_140":-5,"_27":141},"4b7b45f8-32ed-4eaf-aa2c-3aeb03e20916","new-file-3471.ts","6575f7f0-8f1e-11f1-a26b-1607ee4eb77e","parentId",42,"latest",["D",1786031358785],6,"interval","// Learn more: https://docs.val.town/vals/cron/\n// ===========================================================\n// ACOLYTE — CRON DU BLOG\n// À coller dans un val de type CRON, planifié « 0 * * * * » (toutes les heures).\n//\n// ⚠️ POURQUOI CE FICHIER EXISTE. La route /blog/tick sait décider s'il est\n// l'heure d'écrire, mais elle ne se déclenche pas toute seule : seuls les\n// VISITEURS l'appelaient, en ouvrant l'onglet Blog. Résultat, aucune visite\n// pendant la nuit = aucun article, et le blog pouvait rester muet des jours\n// sans que rien ne le signale. C'est ce Cron qui rend vraie la promesse\n// « un article par heure ».\n//\n// Le double garde-fou de /blog/tick reste en place : même appelé trop souvent,\n// il ne sortira jamais plus d'un article par intervalle. Ce fichier ne peut\n// donc pas faire exploser la dépense.\n//\n// Aucun secret ici : /blog/tick est publique par conception, c'est son\n// intervalle qui la protège, pas un mot de passe.\n//\n// ⚠️ Commentaires en « // » et non en bloc « /* */ » : au collage, perdre le\n// premier caractère d'un bloc emporte tout le fichier — c'est arrivé une fois.\n// Avec des « // », chaque ligne se protège elle-même.\n// ===========================================================\n\nconst BASE = \"https://lechat45--2ec0f9a6860b11f183cf1607ee4eb77e.web.val.run\";\n\nexport default async function () {\n const debut = Date.now();\n // Un délai franc : écrire un article demande un appel à l'IA plus la\n // recherche d'image. Sans délai, on couperait la connexion en pleine\n // rédaction — et l'article serait perdu alors que le jalon, lui, aurait\n // déjà été posé côté serveur.\n const ctrl = new AbortController();\n const minuteur = setTimeout(() => ctrl.abort(), 110000);\n try {\n const r = await fetch(BASE + \"/blog/tick\", { signal: ctrl.signal });\n const corps: any = await r.json().catch(() => ({}));\n const ms = Date.now() - debut;\n\n if (!r.ok) {\n console.error(`[blog] HTTP ${r.status} en ${ms} ms`, corps);\n // On LÈVE : c'est ce qui fait apparaître l'échec dans l'historique du\n // Cron. Sans ça, une panne durable passerait inaperçue.\n throw new Error(`/blog/tick a répondu ${r.status}`);\n }\n\n if (corps.fait) {\n console.log(`[blog] écrit en ${ms} ms : « ${corps.titre} » (${corps.sujet})`);\n return;\n }\n\n // Cas NORMAUX : l'automatisme est en pause, ou ce n'est pas encore l'heure\n // (le Cron passe chaque heure, mais l'intervalle peut être réglé plus large\n // depuis le panneau admin). Ce ne sont pas des erreurs.\n console.log(\n `[blog] rien à faire (${corps.raison || \"sans raison donnée\"})`\n + (corps.dans_minutes ? ` — dans ${corps.dans_minutes} min` : \"\"),\n );\n // Une erreur de RÉDACTION, elle, doit remonter : le serveur a déjà reculé\n // son jalon pour retenter dans quelques minutes, mais on veut la voir.\n if (corps.erreur) throw new Error(`rédaction échouée : ${corps.erreur}`);\n } catch (e: any) {\n if (e && e.name === \"AbortError\") {\n console.error(\"[blog] délai dépassé (110 s) — l’IA est probablement lente\");\n throw new Error(\"délai dépassé sur /blog/tick\");\n }\n throw e;\n } finally {\n clearTimeout(minuteur);\n }\n}","label",[131],"ff08e02f-8f29-4d36-996d-1617999c3519",["D",1786095917187],23,[28],"pulls","branches",1,"forks","envVars",{"_154":156,"_157":61},"connections",{"_154":61,"_155":61},"count","unfilledCount",10,"emptyCount",{"_43":142,"_32":28,"_30":31,"_133":-5,"_41":42,"_40":14,"_135":25,"_38":164,"_13":144,"_33":34,"_35":37,"_24":25,"_140":-5,"_161":165,"_27":166},{"_43":130,"_32":131,"_30":132,"_133":-5,"_41":42,"_40":134,"_135":123,"_38":160,"_13":137,"_33":138,"_35":139,"_24":25,"_140":-5,"_161":162,"_27":163},["D",1786031358785],"children",[],[131],["D",1786095917187],[],[28],["D",1784210218734],["D",1789473046147],{"_98":97,"_105":101},{"_98":97,"_99":97,"_100":101,"_18":55,"_102":103,"_104":25},{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_80":-5,"_125":205,"_206":207,"_208":209,"_210":25,"_211":25,"_212":25,"_213":123,"_214":-5,"_215":-7,"_216":-7,"_217":61,"_218":25,"_219":25,"_220":-5,"_221":25,"_222":25,"_223":25,"_224":-5},"ENV",{"_176":177,"_178":179,"_180":88,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v43