[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_423":424,"_425":426},"routes/_app.x.$handle.$name",{"_101":100,"_32":45,"_110":91,"_27":111,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_20":-5,"_122":-5,"_123":-5,"_124":25,"_125":126,"_127":60,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":55,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",182,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","auth.ts","latestPath","fileId","e9719b14-9c6a-11f1-8111-1607ee4eb77e","name","fileType","script","content","import bcrypt from \"npm:bcryptjs\";\nimport type { Hono } from \"npm:hono@4\";\nimport {\n BCRYPT_ROUNDS,\n extractToken,\n generateVerificationCode,\n getDb,\n parseUserAgent,\n signToken,\n sqlite,\n verifyToken,\n verifyVerificationCode,\n} from \"./config.ts\";\nimport { sendVerificationEmail } from \"./email.ts\";\n\nexport function registerAuthRoutes(app: Hono) {\n // POST /register\n app.post(\"/register\", async (c) => {\n try {\n const { email, username, password } = await c.req.json();\n if (!email || !username || !password) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${email} OR username = ${username} LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Email ou nom d'utilisateur déjà pris.\" }, 400);\n }\n\n const code = await generateVerificationCode(email, \"register\");\n await sendVerificationEmail(email, code, \"register\");\n\n return c.json({ email, status: \"verification_required\", success: true });\n } catch (err: any) {\n console.error(\"Register Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-register\n app.post(\"/verify-register\", async (c) => {\n try {\n const { email, username, password, code } = await c.req.json();\n if (!email || !username || !password || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(email, code, \"register\");\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${email} OR username = ${username} LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Email ou nom d'utilisateur déjà pris.\" }, 400);\n }\n\n const hash = await bcrypt.hash(password, BCRYPT_ROUNDS);\n\n const result = await sql`\n INSERT INTO users (email, username, password_hash, tier)\n VALUES (${email}, ${username}, ${hash}, 'Free')\n RETURNING id, tier\n `;\n\n const user = result[0];\n const token = await signToken({ sub: user.id, tier: user.tier });\n\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n \"Inconnue\";\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name)\n VALUES (${user.id}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name})\n `;\n } catch (dbErr) {\n console.error(\"Erreur insertion device:\", dbErr);\n }\n\n return c.json({ success: true, tier: user.tier, token });\n } catch (err: any) {\n console.error(\"Verify Register Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /login\n app.post(\"/login\", async (c) => {\n try {\n const { email, password, identifier } = await c.req.json();\n const loginId = (identifier || email || \"\").trim();\n if (!loginId || !password) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const users =\n await sql`SELECT id, email, password_hash, tier, is_blocked FROM users WHERE email = ${loginId} OR username = ${loginId} OR phone = ${loginId} LIMIT 1`;\n if (users.length === 0) {\n return c.json({ error: \"Identifiants invalides.\" }, 401);\n }\n\n const user = users[0];\n const match = await bcrypt.compare(password, user.password_hash);\n if (!match) {\n return c.json({ error: \"Identifiants invalides.\" }, 401);\n }\n\n // Compte bloqué par un administrateur : refus explicite (403)\n if (user.is_blocked) {\n return c.json(\n {\n error:\n \"Votre compte a été bloqué par un administrateur. Contactez le support pour demander sa réactivation.\",\n blocked: true,\n },\n 403,\n );\n }\n\n const code = await generateVerificationCode(user.email, \"login\");\n await sendVerificationEmail(user.email, code, \"login\");\n\n return c.json({\n email: user.email,\n status: \"verification_required\",\n success: true,\n });\n } catch (err: any) {\n console.error(\"Login Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-login\n app.post(\"/verify-login\", async (c) => {\n try {\n const { email, code } = await c.req.json();\n if (!email || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(email, code, \"login\");\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n const users =\n await sql`SELECT id, tier, is_blocked FROM users WHERE email = ${email} LIMIT 1`;\n if (users.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const user = users[0];\n\n // Compte bloqué par un administrateur : refus explicite (403)\n if (user.is_blocked) {\n return c.json(\n {\n error:\n \"Votre compte a été bloqué par un administrateur. Contactez le support pour demander sa réactivation.\",\n blocked: true,\n },\n 403,\n );\n }\n\n const token = await signToken({ sub: user.id, tier: user.tier });\n\n const userAgent = c.req.header(\"user-agent\") || \"\";\n // Pour les tests en dev, on utilise une IP par défaut\n let ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n c.req.header(\"x-real-ip\") ||\n \"\";\n if (!ip || ip === \"::1\" || ip === \"127.0.0.1\") {\n ip = \"8.8.8.8\"; // IP Google par défaut pour ne pas planter l'API\n } else {\n // Extraire la première IP si on a une liste\n ip = ip.split(\",\")[0].trim();\n }\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n\n let locationStr = \"Lieu inconnu\";\n let countryStr = \"Pays inconnu\";\n try {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 3000);\n const geoRes = await fetch(`https://ip-api.com/json/${ip}`, {\n headers: { \"User-Agent\": \"mAI/1.0\" },\n signal: controller.signal,\n });\n clearTimeout(timeout);\n if (geoRes.ok) {\n const geoData = await geoRes.json();\n if (geoData.status === \"success\") {\n locationStr = `${geoData.city}, ${geoData.country}`;\n countryStr = geoData.country;\n }\n }\n } catch (e) {\n console.error(\"Erreur de géolocalisation:\", e);\n }\n\n // Vérifier si c'est un nouvel appareil ou un nouveau pays\n let isNewDeviceOrLocation = true;\n try {\n const pastDevices = await sql`\n SELECT device_name, location FROM connected_devices \n WHERE user_id = ${user.id}::text\n `;\n if (pastDevices.length > 0) {\n // C'est pas sa toute première connexion\n const knownDevice = pastDevices.some(\n (d) => d.device_name === device_name,\n );\n const knownLocation = pastDevices.some(\n (d) => d.location && d.location.includes(countryStr),\n );\n if (knownDevice && knownLocation) {\n isNewDeviceOrLocation = false;\n }\n } else {\n // Première connexion jamais (donc nouvelle par defaut, ou pas besoin d'alerte? on envoie quand meme)\n isNewDeviceOrLocation = true;\n }\n } catch (e) {\n console.error(e);\n }\n\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name, location)\n VALUES (${user.id}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name}, ${locationStr})\n `;\n } catch (dbErr) {\n console.error(\"Erreur insertion device:\", dbErr);\n }\n\n if (isNewDeviceOrLocation) {\n // On n'attend pas l'envoi de l'email\n sendVerificationEmail(email, \"\", \"new_login\", {\n device: device_name,\n location: locationStr,\n }).catch(console.error);\n }\n\n return c.json({ success: true, tier: user.tier, token });\n } catch (err: any) {\n console.error(\"Verify Login Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /resend-code\n app.post(\"/resend-code\", async (c) => {\n try {\n const { email, action } = await c.req.json();\n if (!email || !action) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n // Vérifier le rate-limit (1 minute)\n const result = await sqlite.execute({\n args: [email, action],\n sql:\n \"SELECT expires_at FROM verification_codes WHERE email = ? AND action = ?\",\n });\n\n if (result.rows.length > 0) {\n const expiresAt = new Date(result.rows[0][0] as string);\n const now = new Date();\n // Si la date d'expiration est > maintenant + 9 minutes, ça veut dire qu'il a été généré il y a moins d'1 minute.\n const diffMinutes = (expiresAt.getTime() - now.getTime()) / 60_000;\n if (diffMinutes > 9) {\n return c.json(\n { error: \"Veuillez patienter 1 minute avant de renvoyer un code.\" },\n 429,\n );\n }\n }\n\n const code = await generateVerificationCode(email, action);\n await sendVerificationEmail(email, code, action);\n\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"Resend Code Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-code\n app.post(\"/verify-code\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = String(payload.sub);\n\n const body = await c.req.json();\n const rawCode = body?.code;\n if (!rawCode) {\n return c.json({ error: \"Code requis.\" }, 400);\n }\n\n const inputCode = String(rawCode).trim().toUpperCase();\n const sql = getDb();\n\n let newTier: string | null = null;\n let dbCodeId: number | null = null;\n\n // 1. Recherche dans la table subscription_codes de la base de données\n try {\n const codeRows = await sql`\n SELECT id, code, tier, max_uses, uses_count, is_active, expires_at \n FROM subscription_codes \n WHERE UPPER(code) = UPPER(${inputCode}) \n LIMIT 1\n `;\n\n if (codeRows.length > 0) {\n const row = codeRows[0];\n\n if (!row.is_active) {\n return c.json(\n { error: \"Ce code d'abonnement est désactivé.\" },\n 400,\n );\n }\n\n if (row.expires_at && new Date(row.expires_at) < new Date()) {\n return c.json({ error: \"Ce code d'abonnement a expiré.\" }, 400);\n }\n\n if (\n row.max_uses > 0 &&\n Number(row.uses_count) >= Number(row.max_uses)\n ) {\n return c.json(\n { error: \"Ce code a atteint son quota maximal d'utilisations.\" },\n 400,\n );\n }\n\n // Vérifier si l'utilisateur a déjà activé ce code spécifique\n try {\n const redemptions = await sql`\n SELECT id FROM subscription_code_redemptions \n WHERE code_id = ${row.id} AND user_id = ${userId}::text \n LIMIT 1\n `;\n if (redemptions.length > 0) {\n return c.json(\n {\n error: \"Vous avez déjà débloqué votre forfait avec ce code.\",\n },\n 400,\n );\n }\n } catch (_redErr) {\n // Ignorer si la table de redemptions n'est pas encore créée\n }\n\n newTier = row.tier;\n dbCodeId = row.id;\n }\n } catch (dbErr) {\n console.warn(\n \"Table subscription_codes non accessible, vérification fallback ENV:\",\n dbErr,\n );\n }\n\n // 2. Fallback vers les variables d'environnement si non trouvé en base\n if (!newTier) {\n const upgradeCodes: Record = {};\n\n const plusCode = Deno.env.get(\"MAI_PLUS_CODE\") ||\n Deno.env.get(\"PLUS_CODE\");\n if (plusCode) {\n upgradeCodes[plusCode.trim().toUpperCase()] = \"Plus\";\n }\n\n const proCode = Deno.env.get(\"MAI_PRO_CODE\") ||\n Deno.env.get(\"PRO_CODE\");\n if (proCode) {\n upgradeCodes[proCode.trim().toUpperCase()] = \"Pro\";\n }\n\n const maxCode = Deno.env.get(\"MAI_MAX_CODE\") ||\n Deno.env.get(\"MAX_CODE\");\n if (maxCode) {\n upgradeCodes[maxCode.trim().toUpperCase()] = \"Max\";\n }\n\n newTier = upgradeCodes[inputCode] || null;\n }\n\n if (!newTier) {\n console.log(`[Verify-Code] Code invalide soumis par user=${userId}`);\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n // 3. Mise à jour de l'utilisateur et de ses clés API\n await sql`UPDATE users SET tier = ${newTier} WHERE id::text = ${userId}::text`;\n await sql`UPDATE mprojects_api_keys SET plan = ${newTier} WHERE user_id = ${userId}::text`;\n\n // 4. Incrémentation du compteur et log de l'utilisation en base\n if (dbCodeId) {\n try {\n await sql`\n UPDATE subscription_codes \n SET uses_count = uses_count + 1,\n is_active = CASE WHEN max_uses > 0 AND (uses_count + 1) >= max_uses THEN FALSE ELSE is_active END\n WHERE id = ${dbCodeId}\n `;\n await sql`\n INSERT INTO subscription_code_redemptions (code_id, user_id)\n VALUES (${dbCodeId}, ${userId}::text)\n `;\n } catch (updateErr) {\n console.error(\"Erreur mise à jour usage code:\", updateErr);\n }\n }\n\n // 5. Envoi d'un e-mail de remerciements pour la souscription\n try {\n const userRows =\n await sql`SELECT email, username FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (userRows.length > 0 && userRows[0].email) {\n await sendVerificationEmail(\n userRows[0].email,\n \"\",\n \"subscription_unlocked\",\n {\n tier: newTier,\n username: userRows[0].username,\n },\n );\n }\n } catch (mailErr) {\n console.error(\n \"Erreur envoi email remerciements souscription:\",\n mailErr,\n );\n }\n\n // 6. Nouveau token JWT avec le tier débloqué\n const newToken = await signToken({ sub: userId, tier: newTier });\n\n return c.json({\n message: `Merci d'avoir souscrit au forfait ${newTier} !`,\n success: true,\n tier: newTier,\n token: newToken,\n });\n } catch (err: any) {\n console.error(\"Verify-Code error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /update-profile\n app.post(\"/update-profile\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const body = await c.req.json();\n const {\n username,\n email,\n phone,\n password,\n currentPassword,\n newsletter,\n notify_limits,\n auto_logout_minutes,\n } = body;\n const sql = getDb();\n\n // Vérification obligatoire du mot de passe actuel\n if (!currentPassword) {\n return c.json(\n {\n error:\n \"Le mot de passe actuel est obligatoire pour modifier vos informations.\",\n },\n 400,\n );\n }\n\n const currentUser =\n await sql`SELECT email, password_hash FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const passMatch = await bcrypt.compare(\n currentPassword,\n currentUser[0].password_hash,\n );\n if (!passMatch) {\n return c.json({ error: \"Le mot de passe actuel est incorrect.\" }, 400);\n }\n\n if (username && username.trim()) {\n const cleanUsername = username.trim();\n const existing =\n await sql`SELECT id FROM users WHERE username = ${cleanUsername} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Ce nom d'utilisateur est déjà pris.\" }, 400);\n }\n await sql`UPDATE users SET username = ${cleanUsername} WHERE id::text = ${userId}::text`;\n }\n\n if (email && email.trim()) {\n const cleanEmail = email.trim();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${cleanEmail} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json(\n { error: \"Cette adresse e-mail est déjà utilisée.\" },\n 400,\n );\n }\n if (cleanEmail !== currentUser[0].email) {\n // Send OTP instead of updating directly\n const code = await generateVerificationCode(\n cleanEmail,\n \"verify_new_email\",\n );\n await sendVerificationEmail(cleanEmail, code, \"verify_new_email\");\n return c.json({\n email: cleanEmail,\n status: \"email_verification_required\",\n success: true,\n });\n }\n }\n\n if (phone !== undefined) {\n const cleanPhone = phone ? phone.trim() : null;\n if (cleanPhone) {\n const existing =\n await sql`SELECT id FROM users WHERE phone = ${cleanPhone} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json(\n {\n error:\n \"Ce numéro de téléphone est déjà associé à un autre compte.\",\n },\n 400,\n );\n }\n }\n await sql`UPDATE users SET phone = ${cleanPhone} WHERE id::text = ${userId}::text`;\n }\n\n if (newsletter !== undefined) {\n await sql`UPDATE users SET newsletter = ${\n Boolean(newsletter)\n } WHERE id::text = ${userId}::text`;\n }\n\n if (notify_limits !== undefined) {\n await sql`UPDATE users SET notify_limits = ${\n Boolean(notify_limits)\n } WHERE id::text = ${userId}::text`;\n }\n\n if (auto_logout_minutes !== undefined) {\n const mins = Number.parseInt(auto_logout_minutes, 10);\n if (!isNaN(mins)) {\n await sql`UPDATE users SET auto_logout_minutes = ${mins} WHERE id::text = ${userId}::text`;\n }\n }\n\n if (password && password.trim()) {\n if (password.length < 6) {\n return c.json(\n { error: \"Le mot de passe doit contenir au moins 6 caractères.\" },\n 400,\n );\n }\n const hash = await bcrypt.hash(password, BCRYPT_ROUNDS);\n await sql`UPDATE users SET password_hash = ${hash} WHERE id::text = ${userId}::text`;\n }\n\n const updatedUser =\n await sql`SELECT username, email, phone, tier, newsletter, notify_limits FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n const user = updatedUser[0];\n\n return c.json({\n email: user?.email,\n newsletter: user?.newsletter,\n notify_limits: user?.notify_limits,\n phone: user?.phone,\n success: true,\n tier: user?.tier,\n username: user?.username,\n });\n } catch {\n return c.json({ error: \"Erreur lors de la mise à jour du profil.\" }, 500);\n }\n });\n\n // POST /verify-new-email\n app.post(\"/verify-new-email\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const { email, code } = await c.req.json();\n if (!email || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(\n email,\n code,\n \"verify_new_email\",\n );\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n await sql`UPDATE users SET email = ${email.trim()} WHERE id::text = ${userId}::text`;\n\n return c.json({ email: email.trim(), success: true });\n } catch (err: any) {\n console.error(\"verify-new-email Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /request-delete-account\n app.post(\"/request-delete-account\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const sql = getDb();\n const currentUser =\n await sql`SELECT email FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const email = currentUser[0].email;\n const code = await generateVerificationCode(email, \"delete_account\");\n await sendVerificationEmail(email, code, \"delete_account\");\n\n return c.json({ email, success: true });\n } catch (err: any) {\n console.error(\"request-delete-account Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /confirm-delete-account\n app.post(\"/confirm-delete-account\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const { password, code, confirmationText } = await c.req.json();\n if (!password || !code || confirmationText !== \"SUPPRIMER LE COMPTE\") {\n return c.json(\n { error: \"Informations de confirmation invalides.\" },\n 400,\n );\n }\n\n const sql = getDb();\n const currentUser =\n await sql`SELECT email, password_hash FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const passMatch = await bcrypt.compare(\n password,\n currentUser[0].password_hash,\n );\n if (!passMatch) {\n return c.json({ error: \"Mot de passe incorrect.\" }, 400);\n }\n\n const email = currentUser[0].email;\n const isValid = await verifyVerificationCode(\n email,\n code,\n \"delete_account\",\n );\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n // Suppression (ou anonymisation)\n await sql`DELETE FROM users WHERE id::text = ${userId}::text`;\n\n // Révoquer le token pour déconnecter immédiatement\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"confirm-delete-account Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // GET /api-keys\n app.get(\"/api-keys\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n } catch {}\n }\n\n const sql = getDb();\n\n // Résolution du user_id réel via mprojects_api_keys si clé API transmise\n if (token) {\n try {\n const keyRows = await sql`\n SELECT k.user_id, u.tier, u.email, u.username\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${token}::text\n LIMIT 1\n `;\n if (keyRows.length > 0) {\n userId = keyRows[0].user_id;\n }\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const [uRows, keyRows] = await Promise.all([\n sql`SELECT tier FROM users WHERE id::text = ${userId}::text OR username = ${userId}::text OR email = ${userId}::text LIMIT 1`,\n sql`\n SELECT k.*, u.tier as user_tier\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE (\n k.user_id = ${userId}::text \n OR k.user_id IN (SELECT id::text FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR k.user_id IN (SELECT email FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR k.user_id IN (SELECT username FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n )\n ORDER BY k.created_at DESC\n `.catch(() => []),\n ]);\n\n const userTier = uRows[0]?.tier || \"Free\";\n const validTiers = [\"free\", \"plus\", \"pro\", \"max\"];\n\n const keys = keyRows.map((k: any) => {\n const rawPlan = String(k.plan || \"\").trim();\n const planLower = rawPlan.toLowerCase();\n const isPlanTier = validTiers.includes(planLower);\n\n // Nom personnalisé de la clé\n const keyName = k.name || (isPlanTier ? `Clé ${rawPlan}` : rawPlan) ||\n \"Clé API Principale\";\n // Le forfait est strictement le forfait d'abonnement du compte (free, plus, pro, max)\n const effectivePlan = k.user_tier || userTier ||\n (isPlanTier ? rawPlan : \"Plus\");\n\n return {\n api_key: k.api_key,\n name: keyName,\n plan: effectivePlan,\n request_count: Number(k.request_count || 0),\n created_at: k.created_at,\n last_used_at: k.last_used_at,\n };\n });\n\n return c.json({ keys, success: true });\n } catch (err: any) {\n console.error(\"Erreur API Keys:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n}","import bcrypt from \"npm:bcryptjs\";\nimport type { Hono } from \"npm:hono@4\";\nimport {\n BCRYPT_ROUNDS,\n clientIp,\n extractToken,\n generateVerificationCode,\n getDb,\n parseUserAgent,\n rateLimit,\n signToken,\n sqlite,\n verifyToken,\n verifyVerificationCode,\n} from \"./config.ts\";\nimport { sendVerificationEmail } from \"./email.ts\";\n\nexport function registerAuthRoutes(app: Hono) {\n // POST /register\n app.post(\"/register\", async (c) => {\n try {\n // Anti-abus : 5 inscriptions / IP / 15 min\n if (!rateLimit(`register:${clientIp(c)}`, 5, 15 * 60_000)) {\n return c.json(\n { error: \"Trop de tentatives. Réessayez plus tard.\" },\n 429,\n );\n }\n const { email, username, password } = await c.req.json();\n if (!email || !username || !password) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${email} OR username = ${username} LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Email ou nom d'utilisateur déjà pris.\" }, 400);\n }\n\n const code = await generateVerificationCode(email, \"register\");\n await sendVerificationEmail(email, code, \"register\");\n\n return c.json({ email, status: \"verification_required\", success: true });\n } catch (err: any) {\n console.error(\"Register Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-register\n app.post(\"/verify-register\", async (c) => {\n try {\n const { email, username, password, code } = await c.req.json();\n if (!email || !username || !password || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(email, code, \"register\");\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${email} OR username = ${username} LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Email ou nom d'utilisateur déjà pris.\" }, 400);\n }\n\n const hash = await bcrypt.hash(password, BCRYPT_ROUNDS);\n\n const result = await sql`\n INSERT INTO users (email, username, password_hash, tier)\n VALUES (${email}, ${username}, ${hash}, 'Free')\n RETURNING id, tier\n `;\n\n const user = result[0];\n const token = await signToken({ sub: user.id, tier: user.tier });\n\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n \"Inconnue\";\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name)\n VALUES (${user.id}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name})\n `;\n } catch (dbErr) {\n console.error(\"Erreur insertion device:\", dbErr);\n }\n\n return c.json({ success: true, tier: user.tier, token });\n } catch (err: any) {\n console.error(\"Verify Register Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /login\n app.post(\"/login\", async (c) => {\n try {\n // Anti brute-force : 10 tentatives / IP / 5 min\n if (!rateLimit(`login:${clientIp(c)}`, 10, 5 * 60_000)) {\n return c.json(\n { error: \"Trop de tentatives. Réessayez plus tard.\" },\n 429,\n );\n }\n const { email, password, identifier } = await c.req.json();\n const loginId = (identifier || email || \"\").trim();\n if (!loginId || !password) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const users =\n await sql`SELECT id, email, password_hash, tier, is_blocked FROM users WHERE email = ${loginId} OR username = ${loginId} OR phone = ${loginId} LIMIT 1`;\n if (users.length === 0) {\n return c.json({ error: \"Identifiants invalides.\" }, 401);\n }\n\n const user = users[0];\n const match = await bcrypt.compare(password, user.password_hash);\n if (!match) {\n return c.json({ error: \"Identifiants invalides.\" }, 401);\n }\n\n // Compte bloqué par un administrateur : refus explicite (403)\n if (user.is_blocked) {\n return c.json(\n {\n error:\n \"Votre compte a été bloqué par un administrateur. Contactez le support pour demander sa réactivation.\",\n blocked: true,\n },\n 403,\n );\n }\n\n const code = await generateVerificationCode(user.email, \"login\");\n await sendVerificationEmail(user.email, code, \"login\");\n\n return c.json({\n email: user.email,\n status: \"verification_required\",\n success: true,\n });\n } catch (err: any) {\n console.error(\"Login Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-login\n app.post(\"/verify-login\", async (c) => {\n try {\n const { email, code, identifier } = await c.req.json();\n const loginId = (email || identifier || \"\").trim();\n if (!loginId || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const users =\n await sql`SELECT id, tier, is_blocked, email FROM users WHERE email = ${loginId} OR username = ${loginId} LIMIT 1`;\n if (users.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const user = users[0];\n\n const isValid = await verifyVerificationCode(user.email, code, \"login\");\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n // Compte bloqué par un administrateur : refus explicite (403)\n if (user.is_blocked) {\n return c.json(\n {\n error:\n \"Votre compte a été bloqué par un administrateur. Contactez le support pour demander sa réactivation.\",\n blocked: true,\n },\n 403,\n );\n }\n\n const token = await signToken({ sub: user.id, tier: user.tier });\n\n const userAgent = c.req.header(\"user-agent\") || \"\";\n // Pour les tests en dev, on utilise une IP par défaut\n let ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n c.req.header(\"x-real-ip\") ||\n \"\";\n if (!ip || ip === \"::1\" || ip === \"127.0.0.1\") {\n ip = \"8.8.8.8\"; // IP Google par défaut pour ne pas planter l'API\n } else {\n // Extraire la première IP si on a une liste\n ip = ip.split(\",\")[0].trim();\n }\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n\n let locationStr = \"Lieu inconnu\";\n let countryStr = \"Pays inconnu\";\n try {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 3000);\n const geoRes = await fetch(`https://ip-api.com/json/${ip}`, {\n headers: { \"User-Agent\": \"mAI/1.0\" },\n signal: controller.signal,\n });\n clearTimeout(timeout);\n if (geoRes.ok) {\n const geoData = await geoRes.json();\n if (geoData.status === \"success\") {\n locationStr = `${geoData.city}, ${geoData.country}`;\n countryStr = geoData.country;\n }\n }\n } catch (e) {\n console.error(\"Erreur de géolocalisation:\", e);\n }\n\n // Vérifier si c'est un nouvel appareil ou un nouveau pays\n let isNewDeviceOrLocation = true;\n try {\n const pastDevices = await sql`\n SELECT device_name, location FROM connected_devices \n WHERE user_id = ${user.id}::text\n `;\n if (pastDevices.length > 0) {\n // C'est pas sa toute première connexion\n const knownDevice = pastDevices.some(\n (d) => d.device_name === device_name,\n );\n const knownLocation = pastDevices.some(\n (d) => d.location && d.location.includes(countryStr),\n );\n if (knownDevice && knownLocation) {\n isNewDeviceOrLocation = false;\n }\n } else {\n // Première connexion jamais (donc nouvelle par defaut, ou pas besoin d'alerte? on envoie quand meme)\n isNewDeviceOrLocation = true;\n }\n } catch (e) {\n console.error(e);\n }\n\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name, location)\n VALUES (${user.id}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name}, ${locationStr})\n `;\n } catch (dbErr) {\n console.error(\"Erreur insertion device:\", dbErr);\n }\n\n if (isNewDeviceOrLocation) {\n // On n'attend pas l'envoi de l'email\n sendVerificationEmail(email, \"\", \"new_login\", {\n device: device_name,\n location: locationStr,\n }).catch(console.error);\n }\n\n return c.json({ success: true, tier: user.tier, token });\n } catch (err: any) {\n console.error(\"Verify Login Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /resend-code\n app.post(\"/resend-code\", async (c) => {\n try {\n const { email, action } = await c.req.json();\n if (!email || !action) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n // Vérifier le rate-limit (1 minute)\n const result = await sqlite.execute({\n args: [email, action],\n sql:\n \"SELECT expires_at FROM verification_codes WHERE email = ? AND action = ?\",\n });\n\n if (result.rows.length > 0) {\n const expiresAt = new Date(result.rows[0][0] as string);\n const now = new Date();\n // Si la date d'expiration est > maintenant + 9 minutes, ça veut dire qu'il a été généré il y a moins d'1 minute.\n const diffMinutes = (expiresAt.getTime() - now.getTime()) / 60_000;\n if (diffMinutes > 9) {\n return c.json(\n { error: \"Veuillez patienter 1 minute avant de renvoyer un code.\" },\n 429,\n );\n }\n }\n\n const code = await generateVerificationCode(email, action);\n await sendVerificationEmail(email, code, action);\n\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"Resend Code Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-code\n app.post(\"/verify-code\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = String(payload.sub);\n\n const body = await c.req.json();\n const rawCode = body?.code;\n if (!rawCode) {\n return c.json({ error: \"Code requis.\" }, 400);\n }\n\n const inputCode = String(rawCode).trim().toUpperCase();\n const sql = getDb();\n\n let newTier: string | null = null;\n let dbCodeId: number | null = null;\n\n // 1. Recherche dans la table subscription_codes de la base de données\n try {\n const codeRows = await sql`\n SELECT id, code, tier, max_uses, uses_count, is_active, expires_at \n FROM subscription_codes \n WHERE UPPER(code) = UPPER(${inputCode}) \n LIMIT 1\n `;\n\n if (codeRows.length > 0) {\n const row = codeRows[0];\n\n if (!row.is_active) {\n return c.json(\n { error: \"Ce code d'abonnement est désactivé.\" },\n 400,\n );\n }\n\n if (row.expires_at && new Date(row.expires_at) < new Date()) {\n return c.json({ error: \"Ce code d'abonnement a expiré.\" }, 400);\n }\n\n if (\n row.max_uses > 0 &&\n Number(row.uses_count) >= Number(row.max_uses)\n ) {\n return c.json(\n { error: \"Ce code a atteint son quota maximal d'utilisations.\" },\n 400,\n );\n }\n\n // Vérifier si l'utilisateur a déjà activé ce code spécifique\n try {\n const redemptions = await sql`\n SELECT id FROM subscription_code_redemptions \n WHERE code_id = ${row.id} AND user_id = ${userId}::text \n LIMIT 1\n `;\n if (redemptions.length > 0) {\n return c.json(\n {\n error: \"Vous avez déjà débloqué votre forfait avec ce code.\",\n },\n 400,\n );\n }\n } catch (_redErr) {\n // Ignorer si la table de redemptions n'est pas encore créée\n }\n\n newTier = row.tier;\n dbCodeId = row.id;\n }\n } catch (dbErr) {\n console.warn(\n \"Table subscription_codes non accessible, vérification fallback ENV:\",\n dbErr,\n );\n }\n\n // 2. Fallback vers les variables d'environnement si non trouvé en base\n if (!newTier) {\n const upgradeCodes: Record = {};\n\n const plusCode = Deno.env.get(\"MAI_PLUS_CODE\") ||\n Deno.env.get(\"PLUS_CODE\");\n if (plusCode) {\n upgradeCodes[plusCode.trim().toUpperCase()] = \"Plus\";\n }\n\n const proCode = Deno.env.get(\"MAI_PRO_CODE\") ||\n Deno.env.get(\"PRO_CODE\");\n if (proCode) {\n upgradeCodes[proCode.trim().toUpperCase()] = \"Pro\";\n }\n\n const maxCode = Deno.env.get(\"MAI_MAX_CODE\") ||\n Deno.env.get(\"MAX_CODE\");\n if (maxCode) {\n upgradeCodes[maxCode.trim().toUpperCase()] = \"Max\";\n }\n\n newTier = upgradeCodes[inputCode] || null;\n }\n\n if (!newTier) {\n console.log(`[Verify-Code] Code invalide soumis par user=${userId}`);\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n // 3. Mise à jour de l'utilisateur et de ses clés API\n await sql`UPDATE users SET tier = ${newTier} WHERE id::text = ${userId}::text`;\n await sql`UPDATE mprojects_api_keys SET plan = ${newTier} WHERE user_id = ${userId}::text`;\n\n // 4. Incrémentation du compteur et log de l'utilisation en base\n if (dbCodeId) {\n try {\n await sql`\n UPDATE subscription_codes \n SET uses_count = uses_count + 1,\n is_active = CASE WHEN max_uses > 0 AND (uses_count + 1) >= max_uses THEN FALSE ELSE is_active END\n WHERE id = ${dbCodeId}\n `;\n await sql`\n INSERT INTO subscription_code_redemptions (code_id, user_id)\n VALUES (${dbCodeId}, ${userId}::text)\n `;\n } catch (updateErr) {\n console.error(\"Erreur mise à jour usage code:\", updateErr);\n }\n }\n\n // 5. Envoi d'un e-mail de remerciements pour la souscription\n try {\n const userRows =\n await sql`SELECT email, username FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (userRows.length > 0 && userRows[0].email) {\n await sendVerificationEmail(\n userRows[0].email,\n \"\",\n \"subscription_unlocked\",\n {\n tier: newTier,\n username: userRows[0].username,\n },\n );\n }\n } catch (mailErr) {\n console.error(\n \"Erreur envoi email remerciements souscription:\",\n mailErr,\n );\n }\n\n // 6. Nouveau token JWT avec le tier débloqué\n const newToken = await signToken({ sub: userId, tier: newTier });\n\n return c.json({\n message: `Merci d'avoir souscrit au forfait ${newTier} !`,\n success: true,\n tier: newTier,\n token: newToken,\n });\n } catch (err: any) {\n console.error(\"Verify-Code error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /update-profile\n app.post(\"/update-profile\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const body = await c.req.json();\n const {\n username,\n email,\n phone,\n password,\n currentPassword,\n newsletter,\n notify_limits,\n auto_logout_minutes,\n } = body;\n const sql = getDb();\n\n // Vérification obligatoire du mot de passe actuel\n if (!currentPassword) {\n return c.json(\n {\n error:\n \"Le mot de passe actuel est obligatoire pour modifier vos informations.\",\n },\n 400,\n );\n }\n\n const currentUser =\n await sql`SELECT email, password_hash FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const passMatch = await bcrypt.compare(\n currentPassword,\n currentUser[0].password_hash,\n );\n if (!passMatch) {\n return c.json({ error: \"Le mot de passe actuel est incorrect.\" }, 400);\n }\n\n if (username && username.trim()) {\n const cleanUsername = username.trim();\n const existing =\n await sql`SELECT id FROM users WHERE username = ${cleanUsername} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Ce nom d'utilisateur est déjà pris.\" }, 400);\n }\n await sql`UPDATE users SET username = ${cleanUsername} WHERE id::text = ${userId}::text`;\n }\n\n if (email && email.trim()) {\n const cleanEmail = email.trim();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${cleanEmail} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json(\n { error: \"Cette adresse e-mail est déjà utilisée.\" },\n 400,\n );\n }\n if (cleanEmail !== currentUser[0].email) {\n // Send OTP instead of updating directly\n const code = await generateVerificationCode(\n cleanEmail,\n \"verify_new_email\",\n );\n await sendVerificationEmail(cleanEmail, code, \"verify_new_email\");\n return c.json({\n email: cleanEmail,\n status: \"email_verification_required\",\n success: true,\n });\n }\n }\n\n if (phone !== undefined) {\n const cleanPhone = phone ? phone.trim() : null;\n if (cleanPhone) {\n const existing =\n await sql`SELECT id FROM users WHERE phone = ${cleanPhone} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json(\n {\n error:\n \"Ce numéro de téléphone est déjà associé à un autre compte.\",\n },\n 400,\n );\n }\n }\n await sql`UPDATE users SET phone = ${cleanPhone} WHERE id::text = ${userId}::text`;\n }\n\n if (newsletter !== undefined) {\n await sql`UPDATE users SET newsletter = ${\n Boolean(newsletter)\n } WHERE id::text = ${userId}::text`;\n }\n\n if (notify_limits !== undefined) {\n await sql`UPDATE users SET notify_limits = ${\n Boolean(notify_limits)\n } WHERE id::text = ${userId}::text`;\n }\n\n if (auto_logout_minutes !== undefined) {\n const mins = Number.parseInt(auto_logout_minutes, 10);\n if (!isNaN(mins)) {\n await sql`UPDATE users SET auto_logout_minutes = ${mins} WHERE id::text = ${userId}::text`;\n }\n }\n\n if (password && password.trim()) {\n if (password.length < 6) {\n return c.json(\n { error: \"Le mot de passe doit contenir au moins 6 caractères.\" },\n 400,\n );\n }\n const hash = await bcrypt.hash(password, BCRYPT_ROUNDS);\n await sql`UPDATE users SET password_hash = ${hash} WHERE id::text = ${userId}::text`;\n }\n\n const updatedUser =\n await sql`SELECT username, email, phone, tier, newsletter, notify_limits FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n const user = updatedUser[0];\n\n return c.json({\n email: user?.email,\n newsletter: user?.newsletter,\n notify_limits: user?.notify_limits,\n phone: user?.phone,\n success: true,\n tier: user?.tier,\n username: user?.username,\n });\n } catch {\n return c.json({ error: \"Erreur lors de la mise à jour du profil.\" }, 500);\n }\n });\n\n // POST /verify-new-email\n app.post(\"/verify-new-email\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const { email, code } = await c.req.json();\n if (!email || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(\n email,\n code,\n \"verify_new_email\",\n );\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n await sql`UPDATE users SET email = ${email.trim()} WHERE id::text = ${userId}::text`;\n\n return c.json({ email: email.trim(), success: true });\n } catch (err: any) {\n console.error(\"verify-new-email Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /request-delete-account\n app.post(\"/request-delete-account\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const sql = getDb();\n const currentUser =\n await sql`SELECT email FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const email = currentUser[0].email;\n const code = await generateVerificationCode(email, \"delete_account\");\n await sendVerificationEmail(email, code, \"delete_account\");\n\n return c.json({ email, success: true });\n } catch (err: any) {\n console.error(\"request-delete-account Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /confirm-delete-account\n app.post(\"/confirm-delete-account\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const { password, code, confirmationText } = await c.req.json();\n if (!password || !code || confirmationText !== \"SUPPRIMER LE COMPTE\") {\n return c.json(\n { error: \"Informations de confirmation invalides.\" },\n 400,\n );\n }\n\n const sql = getDb();\n const currentUser =\n await sql`SELECT email, password_hash FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const passMatch = await bcrypt.compare(\n password,\n currentUser[0].password_hash,\n );\n if (!passMatch) {\n return c.json({ error: \"Mot de passe incorrect.\" }, 400);\n }\n\n const email = currentUser[0].email;\n const isValid = await verifyVerificationCode(\n email,\n code,\n \"delete_account\",\n );\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n // Suppression (ou anonymisation)\n await sql`DELETE FROM users WHERE id::text = ${userId}::text`;\n\n // Révoquer le token pour déconnecter immédiatement\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"confirm-delete-account Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // GET /api-keys\n app.get(\"/api-keys\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n } catch {}\n }\n\n const sql = getDb();\n\n // Résolution du user_id réel via mprojects_api_keys si clé API transmise\n if (token) {\n try {\n const keyRows = await sql`\n SELECT k.user_id, u.tier, u.email, u.username\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${token}::text\n LIMIT 1\n `;\n if (keyRows.length > 0) {\n userId = keyRows[0].user_id;\n }\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const [uRows, keyRows] = await Promise.all([\n sql`SELECT tier FROM users WHERE id::text = ${userId}::text OR username = ${userId}::text OR email = ${userId}::text LIMIT 1`,\n sql`\n SELECT k.*, u.tier as user_tier\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE (\n k.user_id = ${userId}::text \n OR k.user_id IN (SELECT id::text FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR k.user_id IN (SELECT email FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR k.user_id IN (SELECT username FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n )\n ORDER BY k.created_at DESC\n `.catch(() => []),\n ]);\n\n const userTier = uRows[0]?.tier || \"Free\";\n const validTiers = [\"free\", \"plus\", \"pro\", \"max\"];\n\n const keys = keyRows.map((k: any) => {\n const rawPlan = String(k.plan || \"\").trim();\n const planLower = rawPlan.toLowerCase();\n const isPlanTier = validTiers.includes(planLower);\n\n // Nom personnalisé de la clé\n const keyName = k.name || (isPlanTier ? `Clé ${rawPlan}` : rawPlan) ||\n \"Clé API Principale\";\n // Le forfait est strictement le forfait d'abonnement du compte (free, plus, pro, max)\n const effectivePlan = k.user_tier || userTier ||\n (isPlanTier ? rawPlan : \"Plus\");\n\n return {\n api_key: k.api_key,\n name: keyName,\n plan: effectivePlan,\n request_count: Number(k.request_count || 0),\n created_at: k.created_at,\n last_used_at: k.last_used_at,\n };\n });\n\n return c.json({ keys, success: true });\n } catch (err: any) {\n console.error(\"Erreur API Keys:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n}","createdAt",["D",1788447239386],"branchVersion","branchId","3345cb6c-eeb2-4b61-ab03-8e0abc2dcd73","id","200f8efb-f4ef-4117-ae26-ee737dbffb76","mai",["D",1785339526786],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Avec l'API d'mAI, récupérez des données sur les projets !","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/cdf5d0c3-f220-4dec-712e-87455a037c00/square512?exp=1789538399&sig=cd777e882462fce47bac2003be9a9fe1267d4472bdb46131ff02f8b27f89b2ac","7ed13655-83c2-4934-a981-01578302df33","pinnedFileId","968028a2-8b63-11f1-b718-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f99eb-d944-7332-99f8-2fbb8b1e7011","tursoName","200f8efbf4ef4117ae26ee737dbffb76","tursoHostname","200f8efbf4ef4117ae26ee737dbffb76-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789474235934],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_109":105},"org",{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},"branch",{"_13":90,"_32":91,"_43":42,"_92":44,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":45,"_99":100},"isOwned",364,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mdevslabs","handle","displayName","mProjects","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/ec72623f-c02d-461a-9b1c-c2f416214400/square512?exp=1789538399&sig=b90c7895d89b2c8a9d976c298024ed06d954dd92e3be0b0905971776951516a4","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":418,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":55,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":419,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":420,"_85":421,"_87":422,"_89":25},"tree",[329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350],"files",[329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350],"counts",{"_316":64,"_317":318,"_319":64,"_320":321,"_322":323},"contents",[132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":308,"_32":309,"_30":310,"_157":-5,"_41":42,"_40":311,"_159":25,"_38":312,"_13":313,"_33":34,"_35":314,"_24":25,"_163":-5,"_27":315},{"_43":302,"_32":303,"_30":304,"_157":-5,"_41":42,"_40":158,"_159":25,"_38":305,"_13":178,"_33":34,"_35":306,"_24":25,"_163":-5,"_27":307},{"_43":298,"_32":28,"_30":31,"_157":-5,"_41":42,"_40":14,"_159":25,"_38":299,"_13":300,"_33":34,"_35":37,"_24":25,"_163":-5,"_27":301},{"_43":290,"_32":291,"_30":292,"_157":-5,"_41":42,"_40":293,"_159":25,"_38":294,"_13":295,"_33":34,"_35":296,"_24":25,"_163":-5,"_27":297},{"_43":282,"_32":283,"_30":284,"_157":-5,"_41":42,"_40":285,"_159":60,"_38":286,"_13":287,"_33":34,"_35":288,"_24":25,"_163":-5,"_27":289},{"_43":276,"_32":277,"_30":278,"_157":-5,"_41":42,"_40":158,"_159":25,"_38":279,"_13":237,"_33":34,"_35":280,"_24":25,"_163":-5,"_27":281},{"_43":270,"_32":271,"_30":272,"_157":-5,"_41":42,"_40":158,"_159":60,"_38":273,"_13":170,"_33":34,"_35":274,"_24":25,"_163":-5,"_27":275},{"_43":263,"_32":264,"_30":265,"_157":-5,"_41":42,"_40":266,"_159":60,"_38":267,"_13":64,"_33":34,"_35":268,"_24":25,"_163":-5,"_27":269},{"_43":255,"_32":256,"_30":58,"_157":-5,"_41":42,"_40":257,"_159":25,"_38":258,"_13":259,"_33":260,"_35":261,"_24":25,"_163":45,"_27":262},{"_43":247,"_32":248,"_30":249,"_157":-5,"_41":42,"_40":250,"_159":25,"_38":251,"_13":252,"_33":34,"_35":253,"_24":25,"_163":-5,"_27":254},{"_43":240,"_32":241,"_30":242,"_157":-5,"_41":42,"_40":243,"_159":25,"_38":244,"_13":161,"_33":34,"_35":245,"_24":25,"_163":-5,"_27":246},{"_43":232,"_32":233,"_30":234,"_157":-5,"_41":42,"_40":235,"_159":25,"_38":236,"_13":237,"_33":34,"_35":238,"_24":25,"_163":-5,"_27":239},{"_43":224,"_32":225,"_30":226,"_157":-5,"_41":42,"_40":227,"_159":25,"_38":228,"_13":229,"_33":34,"_35":230,"_24":25,"_163":-5,"_27":231},{"_43":217,"_32":218,"_30":219,"_157":-5,"_41":42,"_40":220,"_159":25,"_38":221,"_13":178,"_33":34,"_35":222,"_24":25,"_163":-5,"_27":223},{"_43":210,"_32":211,"_30":212,"_157":-5,"_41":42,"_40":213,"_159":25,"_38":214,"_13":178,"_33":34,"_35":215,"_24":25,"_163":-5,"_27":216},{"_43":203,"_32":204,"_30":205,"_157":-5,"_41":42,"_40":206,"_159":25,"_38":207,"_13":178,"_33":34,"_35":208,"_24":25,"_163":-5,"_27":209},{"_43":196,"_32":197,"_30":198,"_157":-5,"_41":42,"_40":199,"_159":25,"_38":200,"_13":161,"_33":34,"_35":201,"_24":25,"_163":-5,"_27":202},{"_43":189,"_32":190,"_30":191,"_157":-5,"_41":42,"_40":192,"_159":25,"_38":193,"_13":178,"_33":34,"_35":194,"_24":25,"_163":-5,"_27":195},{"_43":181,"_32":182,"_30":183,"_157":-5,"_41":42,"_40":184,"_159":25,"_38":185,"_13":186,"_33":34,"_35":187,"_24":25,"_163":-5,"_27":188},{"_43":173,"_32":174,"_30":175,"_157":-5,"_41":42,"_40":176,"_159":25,"_38":177,"_13":178,"_33":34,"_35":179,"_24":25,"_163":-5,"_27":180},{"_43":165,"_32":166,"_30":167,"_157":-5,"_41":42,"_40":168,"_159":25,"_38":169,"_13":170,"_33":34,"_35":171,"_24":25,"_163":-5,"_27":172},{"_43":154,"_32":155,"_30":156,"_157":-5,"_41":42,"_40":158,"_159":60,"_38":160,"_13":161,"_33":34,"_35":162,"_24":25,"_163":-5,"_27":164},"643a97bd-33e1-4c90-aad8-df973a0aa2dd","web.ts","d2e4e64e-9fd5-11f1-866a-1607ee4eb77e","parentId",120,"latest",["D",1788164141214],5,"import type { Hono } from \"npm:hono@4\";\n\nexport interface YouSearchHit {\n description?: string;\n page_age?: string;\n snippets?: string[];\n title?: string;\n url?: string;\n}\n\nexport interface YouSearchResponse {\n hits?: YouSearchHit[];\n results?: Array<{\n title: string;\n url: string;\n description: string;\n snippets?: string[];\n }>;\n}\n\n/**\n * Récupère les clés You.com configurées pour le triple fallback.\n */\nfunction getYouApiKeys(): string[] {\n const keys: string[] = [];\n const getEnv = (name: string): string | undefined => {\n if (typeof Deno !== \"undefined\" && Deno.env) {\n return Deno.env.get(name);\n }\n if (typeof process !== \"undefined\" && process.env) {\n return process.env[name];\n }\n };\n\n const candidateKeys = [\n getEnv(\"YOU_API_KEY\"),\n getEnv(\"YOU_API_KEY_1\"),\n getEnv(\"YOU_API_KEY_2\"),\n getEnv(\"YOU_API_KEY_3\"),\n getEnv(\"YDC_API_KEY\"),\n ];\n\n for (const k of candidateKeys) {\n if (k && k.trim() && !keys.includes(k.trim())) {\n keys.push(k.trim());\n }\n }\n\n return keys;\n}\n\n/**\n * Fallback Web Universel (Google News RSS, Bing News RSS, Wikipedia & DDG)\n */\nasync function fallbackWebSearch(\n query: string,\n count = 5,\n): Promise> {\n const results: Array<{ title: string; url: string; snippet: string }> = [];\n\n // 1. Essai Google News RSS (Ultra-rapide, mondial, temps réel, aucune clé requise)\n try {\n const rssUrl = `https://news.google.com/rss/search?q=${\n encodeURIComponent(query)\n }&hl=fr&gl=FR&ceid=FR:fr`;\n const res = await fetch(rssUrl, {\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36\",\n \"Accept\": \"application/rss+xml, text/xml, */*\",\n },\n });\n\n if (res.ok) {\n const xml = await res.text();\n const items = xml.split(\"\");\n for (let i = 1; i < items.length && results.length < count; i++) {\n const block = items[i].split(\"\")[0];\n const titleMatch = block.match(/([\\s\\S]*?)<\\/title>/i);\n const linkMatch = block.match(/<link>([\\s\\S]*?)<\\/link>/i) ||\n block.match(/<guid[^>]*>([\\s\\S]*?)<\\/guid>/i);\n const descMatch = block.match(\n /<description>([\\s\\S]*?)<\\/description>/i,\n );\n\n let title = titleMatch\n ? titleMatch[1].replace(/<!\\[CDATA\\[(.*?)\\]\\]>/gi, \"$1\").replace(\n /<[^>]+>/g,\n \"\",\n ).trim()\n : \"\";\n let link = linkMatch\n ? linkMatch[1].replace(/<!\\[CDATA\\[(.*?)\\]\\]>/gi, \"$1\").trim()\n : \"\";\n let snippet = descMatch\n ? descMatch[1].replace(/<!\\[CDATA\\[(.*?)\\]\\]>/gi, \"$1\").replace(\n /<[^>]+>/g,\n \"\",\n ).trim()\n : title;\n\n if (title && link) {\n results.push({\n title,\n url: link,\n snippet: snippet || title,\n });\n }\n }\n\n if (results.length > 0) return results;\n }\n } catch (err) {\n console.warn(\"[WebSearch] Fallback Google News RSS failed:\", err);\n }\n\n // 2. Essai Bing News RSS (Fallback de secours)\n try {\n const bingRssUrl = `https://www.bing.com/news/search?q=${\n encodeURIComponent(query)\n }&format=rss`;\n const res = await fetch(bingRssUrl, {\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\n \"Accept\": \"application/rss+xml, text/xml, */*\",\n },\n });\n\n if (res.ok) {\n const xml = await res.text();\n const items = xml.split(\"<item>\");\n for (let i = 1; i < items.length && results.length < count; i++) {\n const block = items[i].split(\"</item>\")[0];\n const titleMatch = block.match(/<title>([\\s\\S]*?)<\\/title>/i);\n const linkMatch = block.match(/<link>([\\s\\S]*?)<\\/link>/i);\n const descMatch = block.match(\n /<description>([\\s\\S]*?)<\\/description>/i,\n );\n\n const title = titleMatch\n ? titleMatch[1].replace(/<[^>]+>/g, \"\").trim()\n : \"\";\n const link = linkMatch ? linkMatch[1].trim() : \"\";\n const snippet = descMatch\n ? descMatch[1].replace(/<[^>]+>/g, \"\").trim()\n : title;\n\n if (title && link) {\n results.push({\n title,\n url: link,\n snippet: snippet || title,\n });\n }\n }\n\n if (results.length > 0) return results;\n }\n } catch (err) {\n console.warn(\"[WebSearch] Fallback Bing RSS failed:\", err);\n }\n\n // 3. Essai Wikipedia API\n try {\n const lang = /[éèàùçâêîôû]/i.test(query) ? \"fr\" : \"en\";\n const wikiUrl =\n `https://${lang}.wikipedia.org/w/api.php?action=opensearch&search=${\n encodeURIComponent(query)\n }&limit=${count}&namespace=0&format=json`;\n const res = await fetch(wikiUrl, {\n headers: {\n \"User-Agent\":\n \"mAI-WebSearch-Agent/1.0 (https://m-ai.fr; contact@m-ai.fr)\",\n },\n });\n if (res.ok) {\n const data = await res.json();\n const titles = data[1] || [];\n const descriptions = data[2] || [];\n const urls = data[3] || [];\n for (let i = 0; i < titles.length && results.length < count; i++) {\n if (urls[i]) {\n results.push({\n title: titles[i],\n url: urls[i],\n snippet: descriptions[i] || `Article Wikipedia sur ${titles[i]}`,\n });\n }\n }\n if (results.length > 0) return results;\n }\n } catch (err) {\n console.warn(\"[WebSearch] Fallback Wikipedia failed:\", err);\n }\n\n return results;\n}\n\n/**\n * Exécute une recherche Web via l'API You.com avec triple fallback automatique et fallback multi-sources.\n */\nexport async function executeWebSearch(\n query: string,\n count = 5,\n): Promise<{\n success: boolean;\n query: string;\n results: Array<{ title: string; url: string; snippet: string }>;\n provider: string;\n error?: string;\n}> {\n const trimmedQuery = (query || \"\").trim();\n if (!trimmedQuery) {\n return {\n error: \"La requête de recherche est vide.\",\n provider: \"you.com\",\n query: \"\",\n results: [],\n success: false,\n };\n }\n\n const keys = getYouApiKeys();\n let lastError: any = null;\n\n // 1. Tentative avec les clés You.com (POST https://ydc-index.io/v1/search conforme à l'API You.com)\n if (keys.length > 0) {\n const endpoints = [\n \"https://ydc-index.io/v1/search\",\n \"https://api.ydc-index.io/v1/search\",\n \"https://api.ydc-index.io/search\",\n ];\n\n for (let i = 0; i < keys.length; i++) {\n const key = keys[i];\n\n for (const endpointUrl of endpoints) {\n try {\n const res = await fetch(endpointUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-API-Key\": key,\n \"Accept\": \"application/json\",\n \"User-Agent\": \"mAI-WebSearch/1.0\",\n },\n body: JSON.stringify({\n query: trimmedQuery,\n count,\n }),\n });\n\n if (res.ok) {\n const data: any = await res.json().catch(() => null);\n if (data) {\n // Support complet des structures You.com v1 :\n // 1. data.results.web & data.results.news (Format officiel v1)\n // 2. data.results (Array direct)\n // 3. data.hits / data.web.results\n let rawHits: any[] = [];\n if (data.results && typeof data.results === \"object\") {\n if (Array.isArray(data.results)) {\n rawHits = data.results;\n } else {\n if (Array.isArray(data.results.web)) {\n rawHits.push(...data.results.web);\n }\n if (Array.isArray(data.results.news)) {\n rawHits.push(...data.results.news);\n }\n }\n } else if (Array.isArray(data.hits)) {\n rawHits = data.hits;\n } else if (Array.isArray(data.web?.results)) {\n rawHits = data.web.results;\n }\n\n const formattedResults = rawHits.map((hit: any) => {\n let snippet = \"\";\n if (hit.contents?.markdown) {\n snippet = hit.contents.markdown.slice(0, 300);\n } else if (\n hit.snippets && Array.isArray(hit.snippets) &&\n hit.snippets.length > 0\n ) {\n snippet = hit.snippets.join(\" ... \");\n } else {\n snippet = hit.description || hit.snippet || hit.text || \"\";\n }\n\n return {\n snippet: snippet.trim(),\n title: hit.title || hit.name || \"Sans titre\",\n url: hit.url || hit.link || \"\",\n };\n }).filter((item: any) => item.title && item.url);\n\n if (formattedResults.length > 0) {\n return {\n provider: \"you.com\",\n query: trimmedQuery,\n results: formattedResults,\n success: true,\n };\n }\n }\n }\n\n const status = res.status;\n const errBody = await res.text().catch(() => \"\");\n lastError = new Error(`HTTP ${status}: ${errBody}`);\n } catch (err: any) {\n lastError = err;\n }\n }\n }\n }\n\n // 2. Fallback automatique multi-moteurs (DDG Lite / Instant / Wikipedia)\n const fallbackResults = await fallbackWebSearch(trimmedQuery, count);\n if (fallbackResults.length > 0) {\n return {\n provider: \"duckduckgo (fallback)\",\n query: trimmedQuery,\n results: fallbackResults,\n success: true,\n };\n }\n\n return {\n error: keys.length === 0\n ? \"Aucune clé You.com configurée et les services de fallback sont temporairement inaccessibles.\"\n : `Échec de la recherche (${lastError?.message || \"Erreur\"}).`,\n provider: \"you.com\",\n query: trimmedQuery,\n results: [],\n success: false,\n };\n}\n\n/**\n * Définition standard de l'outil web_search pour les IA compatibles Tool Calling.\n */\nexport const WEB_SEARCH_TOOL = {\n function: {\n description:\n \"Recherche sur le Web des informations récentes et actualisées en temps réel via You.com.\",\n name: \"web_search\",\n parameters: {\n properties: {\n query: {\n description: \"La requête de recherche textuelle complète et précise.\",\n type: \"string\",\n },\n },\n required: [\"query\"],\n type: \"object\",\n },\n },\n type: \"function\" as const,\n};\n\n/**\n * Vérifie si la recherche web doit être activée ou désactivée sur un appel API.\n */\nexport function isWebSearchEnabled(body: any, reqHeaders?: Headers): boolean {\n if (body && (body.web_search === false || body.enable_web_search === false)) {\n return false;\n }\n if (reqHeaders) {\n const headerVal = reqHeaders.get(\"x-web-search\") ||\n reqHeaders.get(\"X-Web-Search\");\n if (headerVal && headerVal.toLowerCase() === \"false\") {\n return false;\n }\n const disableHeader = reqHeaders.get(\"x-disable-web-search\") ||\n reqHeaders.get(\"X-Disable-Web-Search\");\n if (\n disableHeader &&\n (disableHeader.toLowerCase() === \"true\" || disableHeader === \"1\")\n ) {\n return false;\n }\n }\n return true;\n}\n\n/**\n * Enregistrement des routes de recherche Web dans Hono.\n */\nexport function registerWebRoutes(app: Hono) {\n // POST /v1/web/search\n app.post(\"/v1/web/search\", async (c) => {\n try {\n const body = await c.req.json().catch(() => ({}));\n const query = body.query || body.q;\n const count = typeof body.count === \"number\" ? body.count : 5;\n\n if (!query || typeof query !== \"string\") {\n return c.json({ error: \"Le paramètre 'query' est obligatoire.\" }, 400);\n }\n\n const searchResult = await executeWebSearch(query, count);\n return c.json(searchResult, 200);\n } catch (err: any) {\n return c.json({\n error: \"Erreur serveur lors de la recherche Web.\",\n details: err?.message,\n }, 500);\n }\n });\n\n // GET /v1/web/search\n app.get(\"/v1/web/search\", async (c) => {\n try {\n const query = c.req.query(\"q\") || c.req.query(\"query\");\n const countParam = c.req.query(\"count\");\n const count = countParam ? Number.parseInt(countParam, 10) : 5;\n\n if (!query) {\n return c.json({ error: \"Paramètre 'q' ou 'query' manquant.\" }, 400);\n }\n\n const searchResult = await executeWebSearch(\n query,\n isNaN(count) ? 5 : count,\n );\n return c.json(searchResult, 200);\n } catch (err: any) {\n return c.json({\n error: \"Erreur serveur lors de la recherche Web.\",\n details: err?.message,\n }, 500);\n }\n });\n}","label",[155],"7e0e2dba-c9a0-49cc-a54b-4985ff36a4e0","vibe.ts","43a78234-a6ce-11f1-8de8-1607ee4eb77e",135,["D",1788363515816],8,"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — API ADAPTER (vibe.ts)\n * Root orchestrator mounting all modular Vibe & mAI sub-routes\n * Compatible with https://mai.val.run (/v1/, /vibe/, /api/vibe/)\n * ============================================================================\n */\n\nimport type { Hono } from \"npm:hono@4\";\nimport { createRegisterMulti } from \"./vibe-common.ts\";\nimport { registerVibePostsRoutes } from \"./vibe-posts.ts\";\nimport { registerVibeUsersRoutes } from \"./vibe-users.ts\";\nimport { registerVibeDMsRoutes } from \"./vibe-dms.ts\";\nimport { registerVibeSettingsRoutes } from \"./vibe-settings.ts\";\nimport { registerVibeMAIRoutes } from \"./vibe-mai.ts\";\n\n// Re-export core classes & types for external modules and tests\nexport {\n type FeedTunerWeights,\n HybridRecommender,\n type PostCandidate,\n type RecommendationSignal,\n} from \"./vibe-recommender.ts\";\nexport { MAI_TOOLS, MAIAgentFleet } from \"./vibe-mai-fleet.ts\";\nexport { registerVibePostsRoutes } from \"./vibe-posts.ts\";\nexport { registerVibeUsersRoutes } from \"./vibe-users.ts\";\nexport { registerVibeDMsRoutes } from \"./vibe-dms.ts\";\nexport { registerVibeSettingsRoutes } from \"./vibe-settings.ts\";\nexport { registerVibeMAIRoutes } from \"./vibe-mai.ts\";\n\n/**\n * Registers all Vibe Social Network and mAI Engine routes on the main Hono application\n */\nexport function registerVibeRoutes(app: Hono) {\n const registerMulti = createRegisterMulti(app);\n\n // Mount modular route domains\n registerVibePostsRoutes(app, registerMulti);\n registerVibeUsersRoutes(app, registerMulti);\n registerVibeDMsRoutes(app, registerMulti);\n registerVibeSettingsRoutes(app, registerMulti);\n registerVibeMAIRoutes(app, registerMulti);\n}",[166],"cdbe5e12-0708-4c48-b9eb-69a9d068fe8b","vibe-users.ts","83b18454-a6e4-11f1-b3bb-1607ee4eb77e",178,["D",1788445243024],4,"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — USERS & PROFILES (vibe-users.ts)\n * User authentication, profile querying, avatar upload, follow graph & search\n * ============================================================================\n */\n\nimport type { Hono } from \"npm:hono@4\";\nimport {\n extractToken,\n getDb,\n getTierDailyImageLimit,\n getTierMaiTokenLimit,\n getWeekData,\n verifyToken,\n} from \"./config.ts\";\nimport type { RegisterMultiFn } from \"./vibe-common.ts\";\nimport { selectStorageNode, uploadWithFallback } from \"./storage.ts\";\n\nexport function registerVibeUsersRoutes(\n app: Hono,\n registerMulti: RegisterMultiFn,\n) {\n // 1. CURRENT USER PROFILE & QUOTAS VIA JWT\n const handleMe = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(\n payload.sub || (payload as any).id || (payload as any).userId,\n );\n\n if (!userId || isNaN(userId)) {\n return c.json({ error: \"Jeton JWT invalide.\" }, 401);\n }\n\n const sql = getDb();\n const userRows = await sql`\n SELECT u.id, u.username, u.email, u.tier, u.avatar_url,\n COALESCE(u.created_at, NOW()) as created_at,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n pr.display_name, pr.bio, pr.banner_url, pr.interests, pr.followers_count, pr.following_count, pr.posts_count\n FROM users u\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE u.id = ${userId}\n LIMIT 1\n `;\n\n if (userRows.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const row = userRows[0];\n const { weekStartStr, nextResetIso } = getWeekData();\n const [usageRows, imgRows] = await Promise.all([\n sql`SELECT COALESCE(SUM(tokens_used), 0) as tokens FROM weekly_usage WHERE user_id = ${userId} AND week_start = ${weekStartStr}::date`,\n sql`SELECT COALESCE(images_generated, 0) as images FROM daily_image_usage WHERE user_id = ${userId} AND usage_date = CURRENT_DATE`,\n ]);\n\n const tier = row.tier || \"Free\";\n const tokenLimit = getTierMaiTokenLimit(tier);\n const imageLimit = getTierDailyImageLimit(tier);\n const tokensUsed = Number(usageRows[0]?.tokens || 0);\n const imagesUsed = Number(imgRows[0]?.images || 0);\n\n const quotas = {\n tier,\n weeklyTokens: {\n used: tokensUsed,\n limit: tokenLimit,\n percent: Math.min(100, Math.round((tokensUsed / tokenLimit) * 100)),\n },\n dailyImages: {\n used: imagesUsed,\n limit: imageLimit,\n percent: Math.min(100, Math.round((imagesUsed / imageLimit) * 100)),\n },\n resetAt: nextResetIso,\n };\n\n return c.json({\n user: {\n id: row.id,\n username: row.username,\n email: row.email,\n tier: row.tier,\n avatar_url: row.avatar_url,\n is_verified: Boolean(row.is_verified),\n created_at: row.created_at,\n },\n profile: {\n id: row.id,\n username: row.username,\n displayName: row.display_name || row.username,\n bio: row.bio || \"\",\n avatarUrl: row.avatar_url,\n bannerUrl: row.banner_url,\n interests: row.interests || [],\n followersCount: row.followers_count || 0,\n followingCount: row.following_count || 0,\n postsCount: row.posts_count || 0,\n is_verified: Boolean(row.is_verified),\n },\n quotas,\n });\n } catch (err: any) {\n console.error(\"[Me Handler Error]:\", err);\n return c.json(\n { error: err.message || \"Session expirée ou invalide.\" },\n 401,\n );\n }\n };\n\n registerMulti(\"get\", [\"/api/vibe/me\", \"/vibe/me\", \"/v1/me\", \"/me\"], handleMe);\n\n // 2. SUGGESTED USERS\n const handleSuggestedUsers = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let currentUserId: number | null = null;\n if (token) {\n try {\n const payload = await verifyToken(token);\n currentUserId = Number(payload.sub || (payload as any).id);\n } catch {}\n }\n\n const sql = getDb();\n const rows = await sql`\n SELECT u.id, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n COALESCE(pr.display_name, u.username) as display_name,\n COALESCE(pr.avatar_url, u.avatar_url) as avatar_url,\n COALESCE(pr.bio, 'Membre Vibe') as bio,\n COALESCE(pr.followers_count, 0) as followers_count\n FROM users u\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE (${currentUserId ? sql`u.id != ${currentUserId}` : true})\n ORDER BY pr.followers_count DESC, u.id DESC\n LIMIT 5\n `;\n\n return c.json({ users: rows });\n } catch (err: any) {\n return c.json({ users: [] });\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/users/suggested\",\n \"/vibe/users/suggested\",\n \"/v1/users/suggested\",\n \"/users/suggested\",\n ], handleSuggestedUsers);\n\n // 3. SEARCH USERS\n const handleSearchUsers = async (c: any) => {\n try {\n const q = (c.req.query(\"q\") || \"\").trim().toLowerCase();\n if (!q || q.length < 1) return c.json({ users: [] });\n\n const sql = getDb();\n const users = await sql`\n SELECT\n u.id, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n pr.display_name, pr.avatar_url, pr.bio,\n pr.followers_count, pr.posts_count\n FROM users u\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE\n LOWER(u.username) LIKE ${`%${q}%`}\n OR LOWER(COALESCE(pr.display_name, '')) LIKE ${`%${q}%`}\n ORDER BY\n CASE WHEN LOWER(u.username) = ${q} THEN 0\n WHEN LOWER(u.username) LIKE ${`${q}%`} THEN 1\n ELSE 2 END,\n COALESCE(pr.followers_count, 0) DESC\n LIMIT 10\n `;\n return c.json({ users });\n } catch (err: any) {\n return c.json({ users: [] });\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/search/users\",\n \"/vibe/search/users\",\n \"/v1/search/users\",\n ], handleSearchUsers);\n\n // 4. GET PROFILE\n const handleGetProfile = async (c: any) => {\n try {\n const rawParam = c.req.param(\"username\") || \"\";\n const username = rawParam.toLowerCase().trim().replace(/^@/, \"\");\n const sql = getDb();\n\n let currentUserId: number | null = null;\n const token = extractToken(c.req.raw);\n if (token) {\n try {\n const payload = await verifyToken(token);\n currentUserId = Number(payload.sub || (payload as any).id);\n } catch {}\n }\n\n const userRows = await sql`\n SELECT u.id, u.username, u.email, u.tier, u.avatar_url,\n COALESCE(u.created_at, NOW()) as created_at,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n pr.display_name, pr.bio, pr.banner_url, pr.interests, pr.followers_count, pr.following_count, pr.posts_count\n FROM users u\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE LOWER(u.username) = ${username}\n LIMIT 1\n `;\n\n if (userRows.length === 0) {\n return c.json({ error: \"Profil introuvable.\" }, 404);\n }\n\n const row = userRows[0];\n let isFollowing = false;\n if (currentUserId && currentUserId !== Number(row.id)) {\n try {\n const followRows = await sql`\n SELECT 1 FROM follows WHERE follower_id = ${currentUserId} AND following_id = ${row.id} LIMIT 1\n `;\n isFollowing = followRows.length > 0;\n } catch {}\n }\n\n let posts: any[] = [];\n try {\n posts = await sql`\n SELECT p.*, pr.display_name, pr.avatar_url, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified\n FROM posts p\n JOIN users u ON u.id = p.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE p.author_id = ${row.id}\n ORDER BY p.published_at DESC\n LIMIT 40\n `;\n\n // Charger tous les médias en une seule requête (évite le N+1)\n if (posts.length > 0) {\n const postIds = posts.map((p) => p.id);\n const allMedia = await sql`\n SELECT post_id, url, media_type, alt_text\n FROM media_assets\n WHERE post_id = ANY(${postIds}::uuid[])\n `;\n const mediaByPost = new Map<string, any[]>();\n for (const m of allMedia) {\n const key = String(m.post_id);\n if (!mediaByPost.has(key)) mediaByPost.set(key, []);\n mediaByPost.get(key)!.push({\n url: m.url,\n media_type: m.media_type,\n alt_text: m.alt_text,\n });\n }\n for (const p of posts) {\n p.media_assets = mediaByPost.get(String(p.id)) || [];\n }\n }\n } catch (postErr: any) {\n console.error(\"[Get Profile] Erreur chargement posts:\", postErr);\n posts = [];\n }\n\n return c.json({\n profile: {\n id: row.id,\n username: row.username,\n tier: row.tier || \"Free\",\n displayName: row.display_name || row.username,\n bio: row.bio || \"\",\n avatarUrl: row.avatar_url,\n bannerUrl: row.banner_url,\n interests: row.interests || [],\n followersCount: row.followers_count || 0,\n followingCount: row.following_count || 0,\n postsCount: row.posts_count || posts.length,\n is_verified: Boolean(row.is_verified),\n isFollowing,\n },\n posts,\n });\n } catch (err: any) {\n return c.json({ error: \"Erreur profil.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/profiles/:username\",\n \"/vibe/profiles/:username\",\n \"/v1/profiles/:username\",\n \"/profiles/:username\",\n \"/profile/:username\",\n ], handleGetProfile);\n\n // 5. UPDATE PROFILE\n const handleUpdateProfile = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const body = await c.req.json();\n const { username, displayName, bio, interests, avatarUrl, bannerUrl } =\n body;\n const sql = getDb();\n\n // Vérifier et mettre à jour le nom d'utilisateur\n if (\n username !== undefined && username !== null && String(username).trim()\n ) {\n const cleanUser = String(username).toLowerCase().replace(\n /[^a-zA-Z0-9_]/g,\n \"\",\n ).trim();\n if (cleanUser && cleanUser.length >= 2) {\n const taken =\n await sql`SELECT id FROM users WHERE LOWER(username) = ${cleanUser} AND id != ${userId} LIMIT 1`;\n if (taken.length > 0) {\n return c.json(\n { error: \"Ce nom d'utilisateur est déjà pris.\" },\n 400,\n );\n }\n await sql`UPDATE users SET username = ${cleanUser} WHERE id = ${userId}`;\n }\n }\n\n if (avatarUrl) {\n await sql`UPDATE users SET avatar_url = ${avatarUrl} WHERE id = ${userId}`;\n }\n\n // Écriture réelle des champs fournis (les champs vides sont bien enregistrés\n // comme vides au lieu d'être ignorés par l'ancien COALESCE).\n const nextDisplayName = displayName !== undefined\n ? (displayName || null)\n : undefined;\n const nextBio = bio !== undefined ? (bio || null) : undefined;\n const nextInterests = interests !== undefined\n ? (Array.isArray(interests) ? interests : [])\n : undefined;\n const nextAvatarUrl = avatarUrl !== undefined\n ? (avatarUrl || null)\n : undefined;\n const nextBannerUrl = bannerUrl !== undefined\n ? (bannerUrl || null)\n : undefined;\n\n await sql`\n INSERT INTO profiles (user_id, display_name, bio, interests, avatar_url, banner_url)\n VALUES (\n ${userId},\n ${nextDisplayName !== undefined ? nextDisplayName : null},\n ${nextBio !== undefined ? nextBio : null},\n ${nextInterests !== undefined ? (nextInterests as string[]) : []},\n ${nextAvatarUrl !== undefined ? nextAvatarUrl : null},\n ${nextBannerUrl !== undefined ? nextBannerUrl : null}\n )\n ON CONFLICT (user_id)\n DO UPDATE SET\n display_name = ${\n nextDisplayName !== undefined\n ? nextDisplayName\n : sql`profiles.display_name`\n },\n bio = ${nextBio !== undefined ? nextBio : sql`profiles.bio`},\n interests = ${\n nextInterests !== undefined\n ? (nextInterests as string[])\n : sql`profiles.interests`\n },\n avatar_url = ${\n nextAvatarUrl !== undefined ? nextAvatarUrl : sql`profiles.avatar_url`\n },\n banner_url = ${\n nextBannerUrl !== undefined ? nextBannerUrl : sql`profiles.banner_url`\n },\n updated_at = NOW()\n `;\n\n // Renvoyer le profil à jour (avec le username potentiellement modifié)\n const updated = await sql`\n SELECT u.username, u.avatar_url,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n pr.display_name, pr.bio, pr.banner_url, pr.interests, pr.followers_count, pr.following_count, pr.posts_count\n FROM users u\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE u.id = ${userId}\n LIMIT 1\n `;\n const r = updated[0] || {};\n\n return c.json({\n success: true,\n message: \"Profil mis à jour.\",\n profile: {\n username: r.username,\n displayName: r.display_name || r.username,\n bio: r.bio || \"\",\n avatarUrl: r.avatar_url,\n bannerUrl: r.banner_url,\n interests: r.interests || [],\n followersCount: r.followers_count || 0,\n followingCount: r.following_count || 0,\n postsCount: r.posts_count || 0,\n is_verified: Boolean(r.is_verified),\n },\n });\n } catch (err: any) {\n console.error(\"[Update Profile Error]:\", err);\n return c.json({ error: \"Erreur mise à jour profil.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/profile/update\",\n \"/vibe/profile/update\",\n \"/v1/profile/update\",\n ], handleUpdateProfile);\n\n // 6. UPDATE AVATAR\n const handleUpdateAvatar = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const sql = getDb();\n\n let avatarUrl = \"\";\n\n try {\n const body = await c.req.parseBody();\n const file = body[\"avatar\"] || body[\"file\"];\n if (file instanceof File && file.size > 0) {\n const cleanFilename = file.name.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n const filename = `avatars/${userId}-${Date.now()}-${cleanFilename}`;\n const primaryNode = selectStorageNode(`avatar-${userId}`);\n const arrayBuffer = await file.arrayBuffer();\n const uploadResult = await uploadWithFallback(\n primaryNode,\n filename,\n arrayBuffer,\n { contentType: file.type || \"image/jpeg\", acl: \"public-read\" },\n );\n if (uploadResult.success) {\n avatarUrl = uploadResult.publicUrl;\n }\n }\n } catch {}\n\n if (!avatarUrl) {\n try {\n const json = await c.req.json();\n avatarUrl = json.avatarUrl || json.avatar_url || \"\";\n } catch {}\n }\n\n if (!avatarUrl) {\n return c.json({ error: \"Fichier ou URL d'avatar requis.\" }, 400);\n }\n\n await sql`UPDATE users SET avatar_url = ${avatarUrl} WHERE id = ${userId}`;\n await sql`\n INSERT INTO profiles (user_id, avatar_url)\n VALUES (${userId}, ${avatarUrl})\n ON CONFLICT (user_id)\n DO UPDATE SET avatar_url = ${avatarUrl}, updated_at = NOW()\n `;\n\n return c.json({\n success: true,\n avatarUrl,\n message: \"Avatar synchronisé avec succès.\",\n });\n } catch (err: any) {\n console.error(\"[Update Avatar Error]:\", err);\n return c.json(\n { error: \"Erreur lors de la mise à jour de l'avatar.\" },\n 500,\n );\n }\n };\n\n // NB : /upload-avatar et /v1/upload-avatar sont gérés par registerStorageRoutes (storage.ts),\n // seule source de vérité pour l'upload d'avatar. Ici on ne garde que /profile/avatar\n // pour la mise à jour via URL JSON (multipart accepté aussi pour compat).\n registerMulti(\"post\", [\n \"/api/vibe/profile/avatar\",\n \"/vibe/profile/avatar\",\n \"/v1/profile/avatar\",\n ], handleUpdateAvatar);\n\n // 7. FOLLOW / UNFOLLOW\n const handleFollow = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const currentUserId = Number(payload.sub || (payload as any).id);\n const rawParam = c.req.param(\"username\") || \"\";\n const targetUsername = rawParam.toLowerCase().trim().replace(/^@/, \"\");\n\n const sql = getDb();\n const targetUser =\n await sql`SELECT id FROM users WHERE LOWER(username) = ${targetUsername} LIMIT 1`;\n if (targetUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n const targetId = Number(targetUser[0].id);\n\n if (targetId === currentUserId) {\n return c.json({ error: \"Impossible de se suivre soi-même.\" }, 400);\n }\n\n const existing = await sql`\n SELECT 1 FROM follows WHERE follower_id = ${currentUserId} AND following_id = ${targetId}\n `;\n\n if (existing.length > 0) {\n await sql`DELETE FROM follows WHERE follower_id = ${currentUserId} AND following_id = ${targetId}`;\n await sql`UPDATE profiles SET following_count = GREATEST(0, following_count - 1) WHERE user_id = ${currentUserId}`;\n await sql`UPDATE profiles SET followers_count = GREATEST(0, followers_count - 1) WHERE user_id = ${targetId}`;\n return c.json({ success: true, following: false });\n } else {\n await sql`INSERT INTO follows (follower_id, following_id) VALUES (${currentUserId}, ${targetId})`;\n await sql`UPDATE profiles SET following_count = following_count + 1 WHERE user_id = ${currentUserId}`;\n await sql`UPDATE profiles SET followers_count = followers_count + 1 WHERE user_id = ${targetId}`;\n\n try {\n await sql`\n INSERT INTO notifications (recipient_id, actor_id, type, message)\n VALUES (${targetId}, ${currentUserId}, 'follow', 'a commencé à vous suivre')\n `;\n } catch {}\n\n return c.json({ success: true, following: true });\n }\n } catch (err: any) {\n return c.json({ error: \"Erreur follow.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/profiles/:username/follow\",\n \"/vibe/profiles/:username/follow\",\n \"/v1/profiles/:username/follow\",\n ], handleFollow);\n}",[174],"3b3e0a35-cc11-4c05-a6cd-9f76815a8fb1","vibe-settings.ts","8e58d038-a6e4-11f1-9a91-1607ee4eb77e",169,["D",1788443289702],3,"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — SETTINGS & PRIVACY (vibe-settings.ts)\n * User settings management, usage logging & GDPR data export\n * ============================================================================\n */\n\nimport type { Hono } from \"npm:hono@4\";\nimport { extractToken, getDb, getWeekData, verifyToken } from \"./config.ts\";\nimport type { RegisterMultiFn } from \"./vibe-common.ts\";\n\nexport function registerVibeSettingsRoutes(\n app: Hono,\n registerMulti: RegisterMultiFn,\n) {\n // Colonnes de personnalisation ajoutées paresseusement (idempotent)\n let personalizationColumnsReady = false;\n const ensurePersonalizationColumns = async () => {\n if (personalizationColumnsReady) return;\n try {\n const sql = getDb();\n await sql`ALTER TABLE user_settings ADD COLUMN IF NOT EXISTS accent_color TEXT`;\n await sql`ALTER TABLE user_settings ADD COLUMN IF NOT EXISTS font_size TEXT`;\n await sql`ALTER TABLE user_settings ADD COLUMN IF NOT EXISTS mai_auto_approve_tools BOOLEAN DEFAULT FALSE`;\n personalizationColumnsReady = true;\n } catch (err) {\n console.warn(\n \"[vibe-settings] ensurePersonalizationColumns skipped:\",\n (err as any)?.message,\n );\n }\n };\n\n // 1. USAGE LOGGING\n const handleLogUsage = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ success: true, logged: false });\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n if (!userId) return c.json({ success: true, logged: false });\n\n const body = await c.req.json().catch(() => ({}));\n const { endpoint = \"api_call\", tokens = 10, action_type = \"request\" } =\n body;\n\n const sql = getDb();\n const { weekStartStr } = getWeekData();\n\n await Promise.all([\n sql`\n INSERT INTO weekly_usage (user_id, week_start, tokens_used)\n VALUES (${userId}, ${weekStartStr}::date, ${tokens})\n ON CONFLICT (user_id, week_start)\n DO UPDATE SET tokens_used = weekly_usage.tokens_used + ${tokens}, updated_at = NOW()\n `,\n sql`\n INSERT INTO usage_logs (user_id, action_type, endpoint, metadata, tokens_used, timestamp)\n VALUES (${userId}, ${action_type}, ${endpoint}, ${\n JSON.stringify({ endpoint, timestamp: new Date().toISOString() })\n }::jsonb, ${tokens}, NOW())\n `.catch(() => {}),\n ]);\n\n return c.json({ success: true, logged: true });\n } catch (err: any) {\n return c.json({ success: false, error: err.message });\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/usage/log\",\n \"/vibe/usage/log\",\n \"/v1/usage/log\",\n \"/usage/log\",\n ], handleLogUsage);\n\n // 2. GET SETTINGS\n const handleSettings = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const sql = getDb();\n const rows =\n await sql`SELECT * FROM user_settings WHERE user_id = ${userId} LIMIT 1`;\n return c.json({ settings: rows[0] || {} });\n } catch (err: any) {\n return c.json({ error: \"Erreur paramètres.\" }, 500);\n }\n };\n\n registerMulti(\n \"get\",\n [\"/api/vibe/settings\", \"/vibe/settings\", \"/v1/settings\"],\n handleSettings,\n );\n\n // 3. UPDATE SETTINGS\n const handleUpdateSettings = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const body = await c.req.json();\n const sql = getDb();\n await ensurePersonalizationColumns();\n\n await sql`\n INSERT INTO user_settings (\n user_id, email_notifications, push_notifications, notify_on_like,\n notify_on_repost, notify_on_reply, notify_on_dm, content_filter_level,\n blur_sensitive_content, age_restriction_enabled, allow_dms, dms_enabled,\n feed_default_mode, hide_reposts, blocked_keywords, two_factor_auth, allow_mentions,\n theme_preference, accent_color, font_size, mai_auto_approve_tools\n )\n VALUES (\n ${userId},\n ${body.email_notifications ?? true},\n ${body.push_notifications ?? true},\n ${body.notify_on_like ?? true},\n ${body.notify_on_repost ?? true},\n ${body.notify_on_reply ?? true},\n ${body.notify_on_dm ?? true},\n ${body.content_filter_level || \"medium\"},\n ${body.blur_sensitive_content ?? true},\n ${body.age_restriction_enabled ?? false},\n ${body.allow_dms || \"everyone\"},\n ${body.dms_enabled ?? true},\n ${body.feed_default_mode || \"for_you\"},\n ${body.hide_reposts ?? false},\n ${body.blocked_keywords || []},\n ${body.two_factor_auth ?? false},\n ${body.allow_mentions || \"everyone\"},\n ${body.theme_preference || \"light\"},\n ${body.accent_color || null},\n ${body.font_size || null},\n ${body.mai_auto_approve_tools ?? false}\n )\n ON CONFLICT (user_id)\n DO UPDATE SET\n email_notifications = EXCLUDED.email_notifications,\n push_notifications = EXCLUDED.push_notifications,\n notify_on_like = EXCLUDED.notify_on_like,\n notify_on_repost = EXCLUDED.notify_on_repost,\n notify_on_reply = EXCLUDED.notify_on_reply,\n notify_on_dm = EXCLUDED.notify_on_dm,\n content_filter_level = EXCLUDED.content_filter_level,\n blur_sensitive_content = EXCLUDED.blur_sensitive_content,\n age_restriction_enabled = EXCLUDED.age_restriction_enabled,\n allow_dms = EXCLUDED.allow_dms,\n dms_enabled = EXCLUDED.dms_enabled,\n feed_default_mode = EXCLUDED.feed_default_mode,\n hide_reposts = EXCLUDED.hide_reposts,\n blocked_keywords = EXCLUDED.blocked_keywords,\n two_factor_auth = EXCLUDED.two_factor_auth,\n allow_mentions = EXCLUDED.allow_mentions,\n theme_preference = COALESCE(EXCLUDED.theme_preference, user_settings.theme_preference),\n accent_color = COALESCE(EXCLUDED.accent_color, user_settings.accent_color),\n font_size = COALESCE(EXCLUDED.font_size, user_settings.font_size),\n mai_auto_approve_tools = EXCLUDED.mai_auto_approve_tools,\n updated_at = NOW()\n `;\n\n return c.json({\n success: true,\n message: \"Paramètres mis à jour avec succès.\",\n });\n } catch (err: any) {\n console.error(\"[Update Settings Error]:\", err);\n return c.json({ error: \"Erreur mise à jour paramètres.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/settings/update\",\n \"/vibe/settings/update\",\n \"/v1/settings/update\",\n ], handleUpdateSettings);\n\n // 4. PRIVACY — DATA EXPORT\n const handlePrivacyExport = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const sql = getDb();\n\n const [\n userRows,\n profileRows,\n postRows,\n settingsRows,\n followersRows,\n followingRows,\n ] = await Promise.all([\n sql`SELECT id, username, email, tier, created_at FROM users WHERE id = ${userId} LIMIT 1`,\n sql`SELECT display_name, bio, avatar_url, banner_url, interests, followers_count, following_count, posts_count FROM profiles WHERE user_id = ${userId} LIMIT 1`,\n sql`SELECT id, content, format, visibility, likes_count, reposts_count, replies_count, published_at FROM posts WHERE author_id = ${userId} ORDER BY published_at DESC LIMIT 200`,\n sql`SELECT email_notifications, push_notifications, content_filter_level, allow_dms, allow_mentions, feed_default_mode, hide_reposts, blocked_keywords, two_factor_auth FROM user_settings WHERE user_id = ${userId} LIMIT 1`,\n sql`SELECT u.username FROM follows f JOIN users u ON u.id = f.following_id WHERE f.follower_id = ${userId} LIMIT 500`,\n sql`SELECT u.username FROM follows f JOIN users u ON u.id = f.follower_id WHERE f.following_id = ${userId} LIMIT 500`,\n ]);\n\n return c.json({\n success: true,\n export_date: new Date().toISOString(),\n user: userRows[0] || null,\n profile: profileRows[0] || null,\n settings: settingsRows[0] || null,\n posts: postRows,\n following: followingRows.map((r: any) => r.username),\n followers: followersRows.map((r: any) => r.username),\n posts_count: postRows.length,\n following_count: followingRows.length,\n followers_count: followersRows.length,\n });\n } catch (err: any) {\n console.error(\"[Privacy Export Error]:\", err);\n return c.json({ error: \"Erreur lors de l'export des données.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/privacy/export\",\n \"/vibe/privacy/export\",\n \"/v1/privacy/export\",\n ], handlePrivacyExport);\n}",[182],"27bb9d82-537f-44d2-b7d8-5b9f4c6b9d43","vibe-recommender.ts","9ad48262-a6e4-11f1-ac0d-1607ee4eb77e",167,["D",1788443274439],"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — RECOMMENDER (vibe-recommender.ts)\n * Algorithmic scoring engine for personalized and trending feeds\n * ============================================================================\n */\n\nexport interface FeedTunerWeights {\n freshness: number;\n novelty: number;\n popularity: number;\n serendipity: number;\n proximity: number;\n}\n\nexport interface PostCandidate {\n postId: string;\n authorId?: number;\n publishedAt: Date;\n likes: number;\n reposts: number;\n replies: number;\n views?: number;\n hasMedia?: boolean;\n isVerifiedAuthor?: boolean;\n semanticSimilarity?: number;\n isFollowedAuthor?: boolean;\n /** Affinité mesurée 0..1 : interactions passées de l'utilisateur avec cet auteur. */\n affinity?: number;\n candidateTopic?: string;\n candidateSentiment?: number;\n toxicityScore?: number;\n tuner?: FeedTunerWeights;\n}\n\nexport interface RecommendationSignal {\n totalScore: number;\n explanationText: string;\n matchedInterests: string[];\n breakdown: {\n freshnessScore: number;\n engagementScore: number;\n velocityScore: number;\n semanticScore: number;\n graphProximityScore: number;\n safetyFactor: number;\n boostFactor: number;\n };\n}\n\nexport class HybridRecommender {\n private static readonly DEFAULT_TUNER: FeedTunerWeights = {\n freshness: 0.35,\n novelty: 0.20,\n popularity: 0.25,\n serendipity: 0.10,\n proximity: 0.10,\n };\n\n public static scorePost(candidate: PostCandidate): RecommendationSignal {\n const tuner = candidate.tuner || this.DEFAULT_TUNER;\n const now = Date.now();\n const publishedTime = candidate.publishedAt.getTime();\n const ageInHours = Math.max(0.05, (now - publishedTime) / (1000 * 60 * 60));\n\n // Récence : décroissance douce sur 24h\n const freshnessScore = Math.exp(-ageInHours / 18);\n\n // Engagement pondéré : Likes × 1, Reposts × 2.5, Réponses × 2, Vues × 0.05\n const rawEngagements = candidate.likes * 1.0 +\n candidate.reposts * 2.5 +\n candidate.replies * 2.0 +\n (candidate.views || 0) * 0.05;\n const engagementScore = Math.min(1.0, Math.log10(rawEngagements + 1) / 2.5);\n\n // Vélocité : engagement par heure depuis la publication (effet viral)\n const velocityScore = Math.min(\n 1.0,\n (rawEngagements / Math.max(0.5, ageInHours)) / 8.0,\n );\n const semanticScore = candidate.semanticSimilarity ?? 0.6;\n\n // Proximité sociale : abonnement + affinité mesurée (historique d'interactions)\n const affinity = Math.max(0, Math.min(1, candidate.affinity || 0));\n const graphProximityScore = candidate.isFollowedAuthor\n ? 0.7 + 0.3 * affinity\n : 0.2 + 0.5 * affinity;\n\n // Facteur de sécurité & toxicité\n const toxicity = candidate.toxicityScore || 0;\n const safetyFactor = Math.max(0, 1 - toxicity * 2.5);\n\n // Multiplicateurs de qualité\n let boostFactor = 1.0;\n if (candidate.isVerifiedAuthor) boostFactor *= 1.15; // +15% pour comptes vérifiés\n if (candidate.hasMedia) boostFactor *= 1.10; // +10% pour publications avec médias\n\n const rawScore = tuner.freshness * freshnessScore +\n tuner.popularity * engagementScore +\n tuner.proximity * graphProximityScore +\n tuner.novelty * velocityScore +\n tuner.serendipity * (1 - semanticScore * 0.4);\n\n const totalScore = Math.max(\n 0,\n Math.min(100, Math.round(rawScore * safetyFactor * boostFactor * 100)),\n );\n\n let explanationText =\n \"Recommandé selon vos centres d'intérêt et l'engagement.\";\n if (candidate.isFollowedAuthor) {\n explanationText = \"Publication d'un créateur que vous suivez.\";\n } else if (velocityScore > 0.6) {\n explanationText = \"🔥 Publication en forte progression.\";\n } else if (candidate.isVerifiedAuthor && engagementScore > 0.5) {\n explanationText = \"✨ Publication populaire d'un compte vérifié.\";\n } else if (freshnessScore > 0.8) {\n explanationText = \"⚡ Publication récente.\";\n }\n\n return {\n totalScore,\n explanationText,\n matchedInterests: candidate.candidateTopic\n ? [candidate.candidateTopic]\n : [\"Général\"],\n breakdown: {\n freshnessScore: Math.round(freshnessScore * 100),\n engagementScore: Math.round(engagementScore * 100),\n velocityScore: Math.round(velocityScore * 100),\n semanticScore: Math.round(semanticScore * 100),\n graphProximityScore: Math.round(graphProximityScore * 100),\n safetyFactor: Number(safetyFactor.toFixed(2)),\n boostFactor: Number(boostFactor.toFixed(2)),\n },\n };\n }\n}",[190],"4686ba35-6b0d-4c4f-a9c4-cac3cf53986b","vibe-posts.ts","ab1ab006-a6e4-11f1-9faf-1607ee4eb77e",168,["D",1788443281810],"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — POSTS & FEED (vibe-posts.ts)\n * Feed recommendation, real trends, post creation, likes, reposts & comments\n * ============================================================================\n */\n\nimport type { Hono } from \"npm:hono@4\";\nimport { extractToken, getDb, rateLimit, verifyToken } from \"./config.ts\";\nimport type { RegisterMultiFn } from \"./vibe-common.ts\";\nimport { HybridRecommender } from \"./vibe-recommender.ts\";\nimport { MAIAgentFleet } from \"./vibe-mai-fleet.ts\";\n\nexport function registerVibePostsRoutes(\n app: Hono,\n registerMulti: RegisterMultiFn,\n) {\n // 1. TIMELINE FEED\n const handleFeed = async (c: any) => {\n try {\n const type = c.req.query(\"type\") || \"for_you\";\n const token = extractToken(c.req.raw);\n let currentUserId: number | null = null;\n if (token) {\n try {\n const payload = await verifyToken(token);\n currentUserId = Number(payload.sub || (payload as any).id);\n } catch {}\n }\n\n const sql = getDb();\n\n // Pagination par curseur : soit keyset chronologique \"ts|id\", soit\n // rang dans une liste scorée \"rank:N\" (trending / pour vous).\n const PAGE_SIZE = 20;\n const rawCursor = (c.req.query(\"cursor\") || \"\").trim();\n const parseKeyset = (cur: string): { ts: string; id: string } | null => {\n const [ts, id] = cur.split(\"|\");\n if (!ts || !id || Number.isNaN(Date.parse(ts))) return null;\n return { ts, id };\n };\n const parseRank = (cur: string): number | null => {\n const m = cur.match(/^rank:(\\d+)$/);\n return m ? Number(m[1]) : null;\n };\n\n const fetchMedia = async (posts: any[]) => {\n if (posts.length === 0) return;\n const ids = posts.map((p) => p.id);\n const media =\n await sql`SELECT post_id, url, media_type, alt_text FROM media_assets WHERE post_id IN ${\n sql(ids)\n }`;\n const byPost: Record<string, any[]> = {};\n for (const m of media) {\n (byPost[m.post_id] ||= []).push({\n url: m.url,\n media_type: m.media_type,\n alt_text: m.alt_text,\n });\n }\n for (const p of posts) p.media_assets = byPost[p.id] || [];\n };\n\n if (type === \"trending\") {\n const tag = (c.req.query(\"tag\") || \"\").trim();\n const rankOffset = rawCursor ? parseRank(rawCursor) ?? 0 : 0;\n let posts;\n if (tag) {\n posts = await sql`\n SELECT p.*, pr.display_name, pr.avatar_url, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'like') > 0`\n : false\n } as has_liked,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'repost') > 0`\n : false\n } as has_reposted,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM bookmarks WHERE post_id = p.id AND user_id = ${currentUserId}) > 0`\n : false\n } as has_bookmarked\n FROM posts p\n JOIN users u ON u.id = p.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE p.visibility = 'public' AND p.content ILIKE ('%' || ${tag} || '%')\n ORDER BY (p.likes_count * 3 + p.reposts_count * 2 + p.replies_count * 2) DESC, p.published_at DESC\n LIMIT ${PAGE_SIZE} OFFSET ${rankOffset}\n `;\n } else {\n posts = await sql`\n SELECT p.*, pr.display_name, pr.avatar_url, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'like') > 0`\n : false\n } as has_liked,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'repost') > 0`\n : false\n } as has_reposted,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM bookmarks WHERE post_id = p.id AND user_id = ${currentUserId}) > 0`\n : false\n } as has_bookmarked\n FROM posts p\n JOIN users u ON u.id = p.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE p.visibility = 'public'\n ORDER BY (p.likes_count * 3 + p.reposts_count * 2 + p.replies_count * 2) DESC, p.published_at DESC\n LIMIT ${PAGE_SIZE} OFFSET ${rankOffset}\n `;\n }\n\n await fetchMedia(posts);\n\n return c.json({\n mode: \"trending\",\n title: tag ? `Tendances : ${tag}` : \"Tendances Populaires\",\n count: posts.length,\n nextCursor: posts.length === PAGE_SIZE\n ? `rank:${rankOffset + PAGE_SIZE}`\n : null,\n posts,\n });\n }\n\n if (type === \"stream\" || type === \"following\") {\n // Keyset pagination : (published_at, id) < (ts, id) — stable et indexable\n const keyset = rawCursor ? parseKeyset(rawCursor) : null;\n const cursorFilter = (uid: number | null) =>\n keyset\n ? sql`AND (p.published_at, p.id) < (${keyset.ts}::timestamptz, ${keyset.id}::uuid)`\n : sql``;\n let posts;\n if (currentUserId) {\n posts = await sql`\n SELECT p.*, pr.display_name, pr.avatar_url, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n (SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'like') > 0 as has_liked,\n (SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'repost') > 0 as has_reposted,\n (SELECT COUNT(*) FROM bookmarks WHERE post_id = p.id AND user_id = ${currentUserId}) > 0 as has_bookmarked\n FROM posts p\n JOIN users u ON u.id = p.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE (\n p.author_id = ${currentUserId}\n OR p.author_id IN (SELECT following_id FROM follows WHERE follower_id = ${currentUserId})\n OR p.visibility = 'public'\n ) ${cursorFilter(currentUserId)}\n ORDER BY p.published_at DESC, p.id DESC\n LIMIT ${PAGE_SIZE}\n `;\n } else {\n posts = await sql`\n SELECT p.*, pr.display_name, pr.avatar_url, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n FALSE as has_liked, FALSE as has_reposted, FALSE as has_bookmarked\n FROM posts p\n JOIN users u ON u.id = p.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE p.visibility = 'public' ${cursorFilter(currentUserId)}\n ORDER BY p.published_at DESC, p.id DESC\n LIMIT ${PAGE_SIZE}\n `;\n }\n\n await fetchMedia(posts);\n\n const last = posts[posts.length - 1];\n return c.json({\n mode: \"stream\",\n title: \"Abonnements\",\n count: posts.length,\n nextCursor: posts.length === PAGE_SIZE && last\n ? `${new Date(last.published_at).toISOString()}|${last.id}`\n : null,\n posts,\n });\n }\n\n // \"Pour Vous\" — Algorithme de recommandation sophistiqué\n let followedAuthorIds = new Set<number>();\n let affinityByAuthor = new Map<number, number>();\n let blockedKeywords: string[] = [];\n let shouldHideReposts = false;\n\n if (currentUserId) {\n try {\n const [followsRows, settingsRows, affinityRows] = await Promise.all([\n sql`SELECT following_id FROM follows WHERE follower_id = ${currentUserId}`,\n sql`SELECT blocked_keywords, hide_reposts FROM user_settings WHERE user_id = ${currentUserId} LIMIT 1`,\n // Affinité réelle : historique d'interactions de l'utilisateur par auteur\n sql`\n SELECT p.author_id, COUNT(*)::int AS n\n FROM post_interactions pi\n JOIN posts p ON p.id = pi.post_id\n WHERE pi.user_id = ${currentUserId}\n AND pi.interaction_type IN ('like', 'repost')\n GROUP BY p.author_id\n ORDER BY n DESC\n LIMIT 50\n `,\n ]);\n followedAuthorIds = new Set(\n followsRows.map((f: any) => Number(f.following_id)),\n );\n for (const row of affinityRows) {\n affinityByAuthor.set(\n Number(row.author_id),\n Math.min(1, Number(row.n) / 5),\n );\n }\n if (settingsRows[0]) {\n blockedKeywords = (settingsRows[0].blocked_keywords || []).map((\n k: string,\n ) => k.toLowerCase().trim());\n shouldHideReposts = Boolean(settingsRows[0].hide_reposts);\n }\n } catch {}\n }\n\n const rawCandidates = await sql`\n SELECT p.*, pr.display_name, pr.avatar_url, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'like') > 0`\n : false\n } as has_liked,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'repost') > 0`\n : false\n } as has_reposted,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM bookmarks WHERE post_id = p.id AND user_id = ${currentUserId}) > 0`\n : false\n } as has_bookmarked\n FROM posts p\n JOIN users u ON u.id = p.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE p.visibility = 'public'\n ORDER BY p.published_at DESC\n LIMIT 300\n `;\n\n await fetchMedia(rawCandidates);\n\n // Filtrage selon les paramètres utilisateur\n const filteredCandidates = rawCandidates.filter((post: any) => {\n if (shouldHideReposts && post.is_repost) return false;\n if (currentUserId && Number(post.author_id) === currentUserId) {\n return true;\n }\n if (blockedKeywords.length > 0) {\n const contentLc = (post.content || \"\").toLowerCase();\n const hasBlocked = blockedKeywords.some((kw: string) =>\n kw && contentLc.includes(kw)\n );\n if (hasBlocked) return false;\n }\n return true;\n });\n\n const scoredPosts = filteredCandidates.map((post: any) => {\n const signal = HybridRecommender.scorePost({\n postId: post.id,\n authorId: Number(post.author_id),\n publishedAt: new Date(post.published_at),\n likes: Number(post.likes_count || 0),\n reposts: Number(post.reposts_count || 0),\n replies: Number(post.replies_count || 0),\n views: Number(post.views_count || 0),\n hasMedia: Array.isArray(post.media_assets) &&\n post.media_assets.length > 0,\n isVerifiedAuthor: Boolean(post.is_verified),\n isFollowedAuthor: followedAuthorIds.has(Number(post.author_id)),\n affinity: affinityByAuthor.get(Number(post.author_id)) || 0,\n semanticSimilarity: 0.75,\n candidateSentiment: Number(post.sentiment_score || 0.5),\n toxicityScore: Number(post.toxicity_score || 0),\n });\n\n return {\n ...post,\n recommendationScore: signal.totalScore,\n explanation: signal.explanationText,\n scoreBreakdown: signal.breakdown,\n };\n });\n\n scoredPosts.sort((a: any, b: any) =>\n b.recommendationScore - a.recommendationScore\n );\n\n // Diversification : max 3 posts consécutifs du même auteur\n const diversified: any[] = [];\n let streakAuthor: number | null = null;\n let streakLen = 0;\n const deferred: any[] = [];\n for (const post of scoredPosts) {\n const authorId = Number(post.author_id);\n if (authorId === streakAuthor && streakLen >= 3) {\n deferred.push(post);\n continue;\n }\n if (authorId === streakAuthor) streakLen += 1;\n else {\n streakAuthor = authorId;\n streakLen = 1;\n }\n diversified.push(post);\n }\n const ranked = diversified.concat(deferred);\n\n const rankOffset = rawCursor ? parseRank(rawCursor) ?? 0 : 0;\n const page = ranked.slice(rankOffset, rankOffset + PAGE_SIZE);\n\n return c.json({\n mode: \"for_you\",\n title: \"Pour Vous\",\n count: page.length,\n nextCursor:\n page.length === PAGE_SIZE && rankOffset + PAGE_SIZE < ranked.length\n ? `rank:${rankOffset + PAGE_SIZE}`\n : null,\n posts: page,\n });\n } catch (err: any) {\n console.error(\"[Vibe API] Error fetching feed:\", err);\n return c.json({ error: \"Erreur lors de la récupération du flux.\" }, 500);\n }\n };\n\n registerMulti(\n \"get\",\n [\"/api/vibe/feed\", \"/vibe/feed\", \"/v1/feed\", \"/feed\"],\n handleFeed,\n );\n\n // 2. REAL TRENDS & HASHTAGS\n const handleGetTrends = async (c: any) => {\n try {\n const sql = getDb();\n\n // Chercher les posts récents (48h d'abord, puis 30j si pas assez)\n let recentPosts = await sql`\n SELECT content, likes_count, reposts_count, replies_count, views_count, published_at\n FROM posts\n WHERE published_at > NOW() - INTERVAL '48 hours'\n AND visibility = 'public'\n ORDER BY (likes_count * 2 + reposts_count * 3 + replies_count) DESC\n LIMIT 300\n `;\n\n if (recentPosts.length < 5) {\n recentPosts = await sql`\n SELECT content, likes_count, reposts_count, replies_count, views_count, published_at\n FROM posts\n WHERE published_at > NOW() - INTERVAL '30 days'\n AND visibility = 'public'\n ORDER BY (likes_count * 2 + reposts_count * 3 + replies_count) DESC\n LIMIT 300\n `;\n }\n\n const tagMap: Record<\n string,\n { count: number; engagement: number; recencyBoost: number }\n > = {};\n const now = Date.now();\n\n for (const p of recentPosts) {\n const text = p.content || \"\";\n const matches = text.match(/#[\\p{L}\\p{N}_]+/gu) || [];\n\n const eng = Number(p.likes_count || 0) * 2 +\n Number(p.reposts_count || 0) * 3 +\n Number(p.replies_count || 0) * 2 +\n Number(p.views_count || 0) * 0.1 +\n 1;\n\n const ageHours = (now - new Date(p.published_at).getTime()) /\n (1000 * 3600);\n const recency = ageHours < 6 ? 3 : ageHours < 24 ? 1.5 : 1;\n\n for (const rawTag of matches) {\n const normalized = rawTag.toLowerCase().trim();\n if (normalized.length <= 1 || normalized.length > 35) continue;\n\n if (!tagMap[rawTag]) {\n tagMap[rawTag] = { count: 0, engagement: 0, recencyBoost: 0 };\n }\n tagMap[rawTag].count += 1;\n tagMap[rawTag].engagement += eng;\n tagMap[rawTag].recencyBoost += recency;\n }\n }\n\n const sortedTrends = Object.entries(tagMap)\n .map(([tag, data]) => {\n const score = data.engagement * data.recencyBoost + data.count * 5;\n const formatted = data.count > 1000\n ? `${(data.count / 1000).toFixed(1)}k`\n : `${data.count}`;\n const lc = tag.toLowerCase();\n const category =\n lc.includes(\"mai\") || lc.includes(\"ia\") || lc.includes(\"ai\") ||\n lc.includes(\"llm\") || lc.includes(\"gpt\")\n ? \"Intelligence Artificielle\"\n : lc.includes(\"tech\") || lc.includes(\"dev\") ||\n lc.includes(\"code\") || lc.includes(\"web\")\n ? \"Technologie\"\n : lc.includes(\"design\") || lc.includes(\"art\") ||\n lc.includes(\"photo\") || lc.includes(\"ux\")\n ? \"Design & Création\"\n : lc.includes(\"vibe\") || lc.includes(\"social\") ||\n lc.includes(\"community\")\n ? \"Communauté\"\n : \"Tendances\";\n return {\n tag,\n category,\n posts: `${formatted} publications`,\n post_count: data.count,\n score,\n };\n })\n .sort((a, b) => b.score - a.score)\n .slice(0, 10);\n\n return c.json({ success: true, trends: sortedTrends });\n } catch (err: any) {\n console.error(\"[Get Trends Error]:\", err);\n return c.json({ success: true, trends: [] });\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/trends\",\n \"/vibe/trends\",\n \"/v1/trends\",\n \"/trends\",\n ], handleGetTrends);\n\n // 3. POSTS CRUD\n const handleCreatePost = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n // Anti-spam : 10 posts / 5 min / utilisateur\n if (!rateLimit(`post:${userId}`, 10, 5 * 60_000)) {\n return c.json({\n error: \"Vous publiez trop vite. Patientez un instant.\",\n }, 429);\n }\n\n const body = await c.req.json();\n const {\n content,\n format = \"micro_text\",\n visibility = \"public\",\n media_url,\n media_assets = [],\n } = body;\n\n if (!content || !content.trim()) {\n return c.json({ error: \"Le contenu est obligatoire.\" }, 400);\n }\n\n const safety = MAIAgentFleet.assessContentSafety(content);\n if (!safety.isSafe) {\n return c.json(\n { error: `Publication refusée : ${safety.flagReason}` },\n 403,\n );\n }\n\n const sql = getDb();\n const inserted = await sql`\n INSERT INTO posts (author_id, content, format, visibility, toxicity_score, created_via)\n VALUES (${userId}, ${content.trim()}, ${format}, ${visibility}, ${safety.toxicityScore}, 'web')\n RETURNING *\n `;\n\n const newPost = inserted[0];\n\n // Inférence du type MIME à partir de l'extension du fichier\n const inferMediaType = (url: string, fallback = \"image/jpeg\"): string => {\n try {\n const cleanUrl = url.split(\"?\")[0].split(\"#\")[0];\n const ext = cleanUrl.split(\".\").pop()?.toLowerCase();\n switch (ext) {\n case \"png\":\n return \"image/png\";\n case \"webp\":\n return \"image/webp\";\n case \"gif\":\n return \"image/gif\";\n case \"svg\":\n return \"image/svg+xml\";\n case \"jpg\":\n case \"jpeg\":\n return \"image/jpeg\";\n case \"mp4\":\n return \"video/mp4\";\n case \"webm\":\n return \"video/webm\";\n case \"mov\":\n return \"video/quicktime\";\n case \"mp3\":\n return \"audio/mpeg\";\n case \"wav\":\n return \"audio/wav\";\n case \"ogg\":\n return \"audio/ogg\";\n default:\n return fallback;\n }\n } catch {\n return fallback;\n }\n };\n\n // Normalisation des médias (support de media_url et de la liste media_assets)\n const normalizedMedia: Array<{\n url: string;\n media_type: string;\n file_size_bytes: number;\n alt_text: string;\n }> = [];\n\n if (Array.isArray(media_assets)) {\n for (const media of media_assets) {\n if (!media || !media.url) continue;\n const urlStr = String(media.url).trim();\n if (!urlStr) continue;\n normalizedMedia.push({\n url: urlStr,\n media_type: media.media_type || media.type ||\n inferMediaType(urlStr),\n file_size_bytes: Math.max(\n 0,\n Math.round(\n Number(\n media.file_size_bytes ?? media.size ?? media.file_size ?? 0,\n ) || 0,\n ),\n ),\n alt_text: media.alt_text || media.alt || \"\",\n });\n }\n }\n\n if (media_url && typeof media_url === \"string\" && media_url.trim()) {\n const trimmedUrl = media_url.trim();\n const alreadyPresent = normalizedMedia.some((m) =>\n m.url === trimmedUrl\n );\n if (!alreadyPresent) {\n normalizedMedia.unshift({\n url: trimmedUrl,\n media_type: body.media_type || inferMediaType(trimmedUrl),\n file_size_bytes: Math.max(\n 0,\n Math.round(\n Number(\n body.file_size_bytes ?? body.size ?? body.file_size ?? 0,\n ) || 0,\n ),\n ),\n alt_text: body.alt_text || \"\",\n });\n }\n }\n\n const insertedMediaList: any[] = [];\n for (const media of normalizedMedia) {\n const res = await sql`\n INSERT INTO media_assets (owner_id, post_id, url, media_type, file_size_bytes, alt_text)\n VALUES (${userId}, ${newPost.id}::uuid, ${media.url}, ${media.media_type}, ${media.file_size_bytes}, ${media.alt_text})\n RETURNING id, url, media_type, file_size_bytes, alt_text\n `;\n if (res && res[0]) {\n insertedMediaList.push(res[0]);\n }\n }\n\n await sql`UPDATE profiles SET posts_count = posts_count + 1 WHERE user_id = ${userId}`;\n\n const userRow =\n await sql`SELECT username FROM users WHERE id = ${userId} LIMIT 1`;\n const profileRow =\n await sql`SELECT display_name, avatar_url FROM profiles WHERE user_id = ${userId} LIMIT 1`;\n\n return c.json({\n success: true,\n post: {\n ...newPost,\n username: userRow[0]?.username,\n display_name: profileRow[0]?.display_name || userRow[0]?.username,\n avatar_url: profileRow[0]?.avatar_url,\n media_assets: insertedMediaList,\n },\n }, 201);\n } catch (err: any) {\n console.error(\"[Vibe API] Error creating post:\", err);\n return c.json({ error: \"Erreur serveur lors de la publication.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/posts\",\n \"/vibe/posts\",\n \"/v1/posts\",\n \"/posts\",\n ], handleCreatePost);\n\n const handleGetPost = async (c: any) => {\n try {\n const postId = c.req.param(\"id\");\n const token = extractToken(c.req.raw);\n let currentUserId: number | null = null;\n if (token) {\n try {\n const payload = await verifyToken(token);\n currentUserId = Number(payload.sub || (payload as any).id);\n } catch {}\n }\n\n const sql = getDb();\n const rows = await sql`\n SELECT p.*, pr.display_name, pr.avatar_url, u.username,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'like') > 0`\n : false\n } as has_liked,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM post_interactions WHERE post_id = p.id AND user_id = ${currentUserId} AND interaction_type = 'repost') > 0`\n : false\n } as has_reposted,\n ${\n currentUserId\n ? sql`(SELECT COUNT(*) FROM bookmarks WHERE post_id = p.id AND user_id = ${currentUserId}) > 0`\n : false\n } as has_bookmarked\n FROM posts p\n JOIN users u ON u.id = p.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE p.id = ${postId}::uuid\n LIMIT 1\n `;\n\n if (rows.length === 0) {\n return c.json({ error: \"Publication introuvable.\" }, 404);\n }\n\n const media =\n await sql`SELECT * FROM media_assets WHERE post_id = ${postId}::uuid`;\n return c.json({ post: { ...rows[0], media_assets: media } });\n } catch (err: any) {\n return c.json({ error: \"Erreur lors de la récupération.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/posts/:id\",\n \"/vibe/posts/:id\",\n \"/v1/posts/:id\",\n \"/posts/:id\",\n ], handleGetPost);\n\n const handleDeletePost = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const postId = c.req.param(\"id\");\n const sql = getDb();\n\n const deleted = await sql`\n DELETE FROM posts WHERE id = ${postId}::uuid AND author_id = ${userId} RETURNING id\n `;\n\n if (deleted.length === 0) {\n return c.json(\n { error: \"Publication introuvable ou non autorisée.\" },\n 403,\n );\n }\n\n await sql`UPDATE profiles SET posts_count = GREATEST(0, posts_count - 1) WHERE user_id = ${userId}`;\n return c.json({ success: true, message: \"Publication supprimée.\" });\n } catch (err: any) {\n return c.json({ error: \"Erreur suppression.\" }, 500);\n }\n };\n\n registerMulti(\"delete\", [\n \"/api/vibe/posts/:id\",\n \"/vibe/posts/:id\",\n \"/v1/posts/:id\",\n \"/posts/:id\",\n ], handleDeletePost);\n\n // 4. LIKES & REPOSTS & BOOKMARKS\n const handleLike = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const postId = c.req.param(\"id\");\n const sql = getDb();\n\n const existing = await sql`\n SELECT id FROM post_interactions\n WHERE user_id = ${userId} AND post_id = ${postId}::uuid AND interaction_type = 'like'\n `;\n\n if (existing.length > 0) {\n await sql`DELETE FROM post_interactions WHERE id = ${\n existing[0].id\n }::uuid`;\n await sql`UPDATE posts SET likes_count = GREATEST(0, likes_count - 1) WHERE id = ${postId}::uuid`;\n return c.json({ success: true, liked: false });\n } else {\n await sql`\n INSERT INTO post_interactions (user_id, post_id, interaction_type)\n VALUES (${userId}, ${postId}::uuid, 'like')\n ON CONFLICT (user_id, post_id, interaction_type) DO NOTHING\n `;\n await sql`UPDATE posts SET likes_count = likes_count + 1 WHERE id = ${postId}::uuid`;\n\n const postAuthor =\n await sql`SELECT author_id FROM posts WHERE id = ${postId}::uuid LIMIT 1`;\n if (postAuthor.length > 0 && postAuthor[0].author_id !== userId) {\n try {\n await sql`\n INSERT INTO notifications (recipient_id, actor_id, type, post_id, message)\n VALUES (${\n postAuthor[0].author_id\n }, ${userId}, 'like', ${postId}::uuid, 'a aimé votre publication')\n `;\n } catch {}\n }\n\n return c.json({ success: true, liked: true });\n }\n } catch (err: any) {\n return c.json(\n { error: err.message || \"Erreur lors de l'interaction.\" },\n 500,\n );\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/posts/:id/like\",\n \"/vibe/posts/:id/like\",\n \"/v1/posts/:id/like\",\n \"/like/:id\",\n \"/api/vibe/posts/:id/likes\",\n ], handleLike);\n\n const handleRepost = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const postId = c.req.param(\"id\");\n const sql = getDb();\n\n const existing = await sql`\n SELECT id FROM post_interactions\n WHERE user_id = ${userId} AND post_id = ${postId}::uuid AND interaction_type = 'repost'\n `;\n\n if (existing.length > 0) {\n await sql`DELETE FROM post_interactions WHERE id = ${\n existing[0].id\n }::uuid`;\n await sql`UPDATE posts SET reposts_count = GREATEST(0, reposts_count - 1) WHERE id = ${postId}::uuid`;\n return c.json({ success: true, reposted: false });\n } else {\n await sql`\n INSERT INTO post_interactions (user_id, post_id, interaction_type)\n VALUES (${userId}, ${postId}::uuid, 'repost')\n ON CONFLICT (user_id, post_id, interaction_type) DO NOTHING\n `;\n await sql`UPDATE posts SET reposts_count = reposts_count + 1 WHERE id = ${postId}::uuid`;\n\n const postAuthor =\n await sql`SELECT author_id FROM posts WHERE id = ${postId}::uuid LIMIT 1`;\n if (postAuthor.length > 0 && postAuthor[0].author_id !== userId) {\n try {\n await sql`\n INSERT INTO notifications (recipient_id, actor_id, type, post_id, message)\n VALUES (${\n postAuthor[0].author_id\n }, ${userId}, 'repost', ${postId}::uuid, 'a republié votre publication')\n `;\n } catch {}\n }\n\n return c.json({ success: true, reposted: true });\n }\n } catch (err: any) {\n return c.json({ error: err.message || \"Erreur lors du repartage.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/posts/:id/repost\",\n \"/vibe/posts/:id/repost\",\n \"/v1/posts/:id/repost\",\n \"/repost/:id\",\n \"/api/vibe/posts/:id/reposts\",\n ], handleRepost);\n\n const handleBookmark = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const postId = c.req.param(\"id\");\n const sql = getDb();\n\n const existing = await sql`\n SELECT id FROM bookmarks WHERE user_id = ${userId} AND post_id = ${postId}::uuid\n `;\n\n if (existing.length > 0) {\n await sql`DELETE FROM bookmarks WHERE id = ${existing[0].id}::uuid`;\n await sql`UPDATE posts SET bookmarks_count = GREATEST(0, bookmarks_count - 1) WHERE id = ${postId}::uuid`;\n return c.json({ success: true, bookmarked: false });\n } else {\n await sql`\n INSERT INTO bookmarks (user_id, post_id) VALUES (${userId}, ${postId}::uuid)\n ON CONFLICT (user_id, post_id) DO NOTHING\n `;\n await sql`UPDATE posts SET bookmarks_count = bookmarks_count + 1 WHERE id = ${postId}::uuid`;\n return c.json({ success: true, bookmarked: true });\n }\n } catch (err: any) {\n return c.json({\n error: err.message || \"Erreur lors de l'enregistrement.\",\n }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/posts/:id/bookmark\",\n \"/vibe/posts/:id/bookmark\",\n \"/v1/posts/:id/bookmark\",\n \"/bookmark/:id\",\n \"/api/vibe/posts/:id/bookmarks\",\n ], handleBookmark);\n\n // 5. COMMENTS\n const handleGetComments = async (c: any) => {\n try {\n const postId = c.req.param(\"id\");\n const sql = getDb();\n\n if (\n !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(\n postId,\n )\n ) {\n return c.json({ count: 0, aiDigest: null, comments: [] });\n }\n\n let currentUserId: number | null = null;\n const token = extractToken(c.req.raw);\n if (token) {\n try {\n const payload = await verifyToken(token);\n currentUserId = Number(payload.sub || (payload as any).id);\n } catch {}\n }\n\n const comments = await sql`\n SELECT c.*, u.username, pr.display_name, pr.avatar_url,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified\n FROM comments c\n JOIN users u ON u.id = c.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE c.post_id = ${postId}::uuid AND c.is_hidden = FALSE\n ORDER BY c.depth ASC, c.likes_count DESC, c.created_at ASC\n `;\n\n let likedIds = new Set<string>();\n if (currentUserId && comments.length > 0) {\n try {\n const likedRows = await sql`\n SELECT cl.comment_id FROM comment_likes cl\n JOIN comments c ON c.id = cl.comment_id\n WHERE cl.user_id = ${currentUserId} AND c.post_id = ${postId}::uuid\n `;\n likedIds = new Set(likedRows.map((r: any) => String(r.comment_id)));\n } catch {}\n }\n\n const enriched = comments.map((cm: any) => ({\n ...cm,\n liked_by_me: likedIds.has(String(cm.id)),\n }));\n\n let aiDigest = null;\n if (enriched.length >= 2) {\n aiDigest = MAIAgentFleet.synthesizeThread(\n enriched.map((cm: any) => ({\n author: cm.username,\n content: cm.content,\n })),\n );\n }\n\n return c.json({ count: enriched.length, aiDigest, comments: enriched });\n } catch (err: any) {\n console.error(\"[Get Comments Error]:\", err);\n return c.json({ error: \"Erreur récupération réponses.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/posts/:id/comments\",\n \"/vibe/posts/:id/comments\",\n \"/v1/posts/:id/comments\",\n \"/comments/:id\",\n ], handleGetComments);\n\n const isUuid = (v: any) =>\n typeof v === \"string\" &&\n /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);\n\n const handleAddComment = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const postId = c.req.param(\"id\");\n const { content, parent_comment_id } = await c.req.json();\n\n if (!content || !content.trim()) {\n return c.json({ error: \"Commentaire vide.\" }, 400);\n }\n if (!isUuid(postId)) {\n return c.json({ error: \"Identifiant de post invalide.\" }, 400);\n }\n\n const sql = getDb();\n\n // Résoudre le parent (profondeur réelle, aplatie au niveau 4 max)\n let parentDepth = 0;\n let effectiveParentId: string | null = null;\n if (parent_comment_id) {\n if (!isUuid(parent_comment_id)) {\n return c.json({ error: \"Commentaire parent invalide.\" }, 400);\n }\n const parentRows = await sql`\n SELECT id, depth, parent_comment_id FROM comments WHERE id = ${parent_comment_id}::uuid LIMIT 1\n `;\n if (parentRows.length === 0) {\n return c.json({ error: \"Commentaire parent introuvable.\" }, 404);\n }\n const parent = parentRows[0];\n // On répond toujours à la racine du fil si le parent est déjà profond\n if (Number(parent.depth) >= 4) {\n effectiveParentId = parent.parent_comment_id || parent.id;\n parentDepth = 3;\n } else {\n effectiveParentId = parent.id;\n parentDepth = Number(parent.depth) || 0;\n }\n }\n\n const inserted = await sql`\n INSERT INTO comments (post_id, author_id, parent_comment_id, content, depth)\n VALUES (${postId}::uuid, ${userId}, ${\n effectiveParentId || null\n }::uuid, ${content.trim()}, ${parentDepth + 1})\n RETURNING *\n `;\n\n await sql`UPDATE posts SET replies_count = replies_count + 1 WHERE id = ${postId}::uuid`;\n\n // Notifier l'auteur du post (ou du commentaire parent) sans se notifier soi-même\n try {\n let notifyId: number | null = null;\n let notifMsg = \"a répondu à votre post\";\n if (effectiveParentId) {\n const pAuthor =\n await sql`SELECT author_id FROM comments WHERE id = ${effectiveParentId}::uuid LIMIT 1`;\n notifyId = Number(pAuthor[0]?.author_id) || null;\n notifMsg = \"a répondu à votre commentaire\";\n } else {\n const pAuthor =\n await sql`SELECT author_id FROM posts WHERE id = ${postId}::uuid LIMIT 1`;\n notifyId = Number(pAuthor[0]?.author_id) || null;\n }\n if (notifyId && notifyId !== userId) {\n await sql`\n INSERT INTO notifications (recipient_id, actor_id, type, message)\n VALUES (${notifyId}, ${userId}, 'reply', ${notifMsg})\n `;\n }\n } catch {}\n\n const userRow =\n await sql`SELECT username FROM users WHERE id = ${userId} LIMIT 1`;\n const prRow =\n await sql`SELECT display_name, avatar_url FROM profiles WHERE user_id = ${userId} LIMIT 1`;\n\n return c.json({\n success: true,\n comment: {\n ...inserted[0],\n username: userRow[0]?.username,\n display_name: prRow[0]?.display_name || userRow[0]?.username,\n avatar_url: prRow[0]?.avatar_url,\n liked_by_me: false,\n },\n }, 201);\n } catch (err: any) {\n console.error(\"[Add Comment Error]:\", err);\n return c.json({\n error: err?.message?.includes(\"relation\")\n ? \"Table comments incomplète — migration requise.\"\n : \"Erreur ajout commentaire.\",\n }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/posts/:id/comments\",\n \"/vibe/posts/:id/comments\",\n \"/v1/posts/:id/comments\",\n \"/comments/:id\",\n ], handleAddComment);\n\n // 6. LIKE / UNLIKE A COMMENT\n const handleLikeComment = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const commentId = c.req.param(\"commentId\");\n\n if (!isUuid(commentId)) {\n return c.json({ error: \"Identifiant de commentaire invalide.\" }, 400);\n }\n\n const sql = getDb();\n\n let alreadyLiked = false;\n try {\n const existing = await sql`\n SELECT 1 FROM comment_likes WHERE user_id = ${userId} AND comment_id = ${commentId}::uuid LIMIT 1\n `;\n alreadyLiked = existing.length > 0;\n } catch {\n // Table comment_likes absente : on retombe sur un simple compteur\n }\n\n if (alreadyLiked) {\n try {\n await sql`DELETE FROM comment_likes WHERE user_id = ${userId} AND comment_id = ${commentId}::uuid`;\n } catch {}\n await sql`UPDATE comments SET likes_count = GREATEST(0, COALESCE(likes_count, 0) - 1) WHERE id = ${commentId}::uuid`;\n const row =\n await sql`SELECT COALESCE(likes_count, 0) as likes_count FROM comments WHERE id = ${commentId}::uuid LIMIT 1`;\n return c.json({\n success: true,\n liked: false,\n likes_count: Number(row[0]?.likes_count || 0),\n });\n } else {\n try {\n await sql`INSERT INTO comment_likes (user_id, comment_id) VALUES (${userId}, ${commentId}::uuid)`;\n } catch {}\n await sql`UPDATE comments SET likes_count = COALESCE(likes_count, 0) + 1 WHERE id = ${commentId}::uuid`;\n const row =\n await sql`SELECT COALESCE(likes_count, 0) as likes_count FROM comments WHERE id = ${commentId}::uuid LIMIT 1`;\n\n try {\n const cm =\n await sql`SELECT author_id, post_id FROM comments WHERE id = ${commentId}::uuid LIMIT 1`;\n const authorId = Number(cm[0]?.author_id);\n if (authorId && authorId !== userId) {\n await sql`\n INSERT INTO notifications (recipient_id, actor_id, type, message)\n VALUES (${authorId}, ${userId}, 'like', 'a aimé votre commentaire')\n `;\n }\n } catch {}\n\n return c.json({\n success: true,\n liked: true,\n likes_count: Number(row[0]?.likes_count || 0),\n });\n }\n } catch (err: any) {\n console.error(\"[Like Comment Error]:\", err);\n return c.json({ error: \"Erreur lors du like du commentaire.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/posts/:id/comments/:commentId/like\",\n \"/vibe/posts/:id/comments/:commentId/like\",\n \"/v1/posts/:id/comments/:commentId/like\",\n ], handleLikeComment);\n}",[197],"857fc7a4-d5e8-4a33-9640-91f9bfbf519d","vibe-mai.ts","77e4508e-a6e4-11f1-b892-1607ee4eb77e",179,["D",1788445251482],"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — mAI CHAT & QUOTAS (vibe-mai.ts)\n * AI Assistant chat endpoint, tool triggers, user approval flow, quotas & text\n * modulation. Sensitive tools require explicit user approval unless the\n * `mai_auto_approve_tools` setting has been enabled.\n * ============================================================================\n */\n\nimport type { Hono } from \"npm:hono@4\";\nimport { extractToken, getDb, getWeekData, verifyToken } from \"./config.ts\";\nimport type { RegisterMultiFn } from \"./vibe-common.ts\";\nimport { MAIAgentFleet, SENSITIVE_TOOLS } from \"./vibe-mai-fleet.ts\";\n\n/**\n * Modèles \"mAI\" marketing → modèles OpenRouter réels.\n * Les ids contenant déjà \"/\" (ex: anthropic/claude-3.7-sonnet) passent tels quels.\n */\nconst MODEL_MAP: Record<string, string> = {\n \"poolside/laguna-xs-2.1:free\": \"poolside/laguna-xs-2.1:free\",\n \"mai-1.5-apex\": \"poolside/laguna-xs-2.1:free\",\n \"mai-1.5-light\": \"poolside/laguna-xs-2.1:free\",\n};\n\nfunction resolveOpenRouterModel(model: string): string {\n if (MODEL_MAP[model]) return MODEL_MAP[model];\n return model.includes(\"/\") ? model : \"poolside/laguna-xs-2.1:free\";\n}\n\n/** Formatte la réponse conversationnelle après exécution d'un outil. */\nfunction formatToolReply(\n toolName: string,\n result: any,\n username: string,\n): string {\n if (toolName === \"generate_vibe_image\") {\n return `🎨 Voici l'image générée avec mAI :\\n\\n![Image générée](${result.imageUrl})\\n\\n*Prompt : « ${result.prompt} »*`;\n }\n if (toolName === \"search_web\") {\n return `🌐 **Recherche Web mAI** :\\n\\n${result.snippet}`;\n }\n if (toolName === \"summarize\") {\n return `${result.summary}`;\n }\n if (toolName === \"fact_check\") {\n return `🛡️ **Vérification Factuelle mAI** :\\n• Affirmation : « ${result.statement} »\\n• Résultat : **${result.verdict}** (Indice de confiance : ${result.confidence})\\n\\n${result.analysis}`;\n }\n if (toolName === \"rewrite_post\") {\n return `✨ **Texte reformulé (${result.style})** :\\n\\n${result.rewritten}`;\n }\n if (toolName === \"translate\") {\n return `🌐 **Traduction (${result.targetLanguage})** :\\n\\n${result.translated}`;\n }\n if (toolName === \"create_post\") {\n return `🚀 Votre publication a été publiée avec succès sur Vibe :\\n\\n« ${result.post.content} »`;\n }\n if (toolName === \"delete_post\") {\n return `🗑️ ${result.message}`;\n }\n if (toolName === \"analyze_trends\") {\n const trendsList = result.trendingTopics.map((t: any) =>\n `• **${t.name}** (${t.postsCount} publications) — ${t.sentiment}`\n ).join(\"\\n\");\n return trendsList\n ? `🔥 **Tendances actuelles sur Vibe** :\\n\\n${trendsList}`\n : \"🔍 Pas encore de tendances détectées cette semaine. Publiez avec des hashtags pour lancer la vague !\";\n }\n if (toolName === \"suggest_post\") {\n return `💡 **Idées de publications Vibe** (thème : ${result.topic}) :\\n\\n${result.suggestions}\\n\\n*Utilisez /publish suivi du texte choisi pour publier.*`;\n }\n if (toolName === \"get_account_stats\") {\n return `📈 **Statistiques du compte @${result.user.username}** :\\n• Publications : **${result.totalPosts}**\\n• Score de réputation : **${\n result.profile?.reputation_score || 100\n } pts**\\n• Forfait : **${result.user.tier || \"Free\"}**`;\n }\n if (toolName === \"check_quotas\") {\n const q = result;\n return `📊 **Vos quotas réels (${q.tier})** :\\n• Tokens mAI : **${q.weeklyTokens.used.toLocaleString()}** / ${q.weeklyTokens.limit.toLocaleString()} (${q.weeklyTokens.percent}%)\\n• Images quotidiennes : **${q.dailyImages.used}** / ${q.dailyImages.limit} (${q.dailyImages.percent}%)\\n• Réinitialisation : ${\n new Date(q.resetAt).toLocaleDateString(\"fr-FR\")\n }`;\n }\n if (toolName === \"update_profile\") {\n return `✅ ${result.message}\\n\\n• Nom affiché : **${result.profile.display_name}**\\n• Bio : ${\n result.profile.bio || \"_(vide)_\"\n }`;\n }\n if (toolName === \"follow_user\") {\n return `👥 ${result.message}`;\n }\n if (toolName === \"get_notifications\") {\n if (result.count === 0) return \"🔔 Aucune notification récente.\";\n const list = result.notifications.slice(0, 10).map((n: any) =>\n `• **${n.type}** — ${\n n.message || (n.actor_username ? `@${n.actor_username}` : \"\")\n }`\n ).join(\"\\n\");\n return `🔔 **Vos ${result.count} dernières notifications** :\\n\\n${list}`;\n }\n return \"✅ Action effectuée.\";\n}\n\nexport function registerVibeMAIRoutes(\n app: Hono,\n registerMulti: RegisterMultiFn,\n) {\n // Détection d'outils par commandes / ou mentions @\n function detectTool(\n cleanMsg: string,\n ): { toolToRun: string; toolArgs: any } | null {\n const lower = cleanMsg.toLowerCase();\n if (\n lower.startsWith(\"/image\") || lower.startsWith(\"@image\") ||\n lower.startsWith(\"/draw\") || lower.startsWith(\"@draw\") ||\n lower.startsWith(\"@generate_image\") ||\n lower.startsWith(\"génère une image\")\n ) {\n const prompt = cleanMsg.replace(\n /^([/@](image|draw|generate_image)|(génère|crée)\\s*(une image|l'image)?)\\s*:?\\s*/i,\n \"\",\n ).trim();\n return {\n toolToRun: \"generate_vibe_image\",\n toolArgs: {\n prompt: prompt || \"Création artistique numérique minimaliste\",\n },\n };\n }\n if (\n lower.startsWith(\"/search\") || lower.startsWith(\"@search\") ||\n lower.startsWith(\"/recherche\") || lower.startsWith(\"@recherche\") ||\n lower.startsWith(\"@web\")\n ) {\n const q = cleanMsg.replace(/^[/@](search|recherche|web)\\s*:?\\s*/i, \"\")\n .trim();\n return {\n toolToRun: \"search_web\",\n toolArgs: { query: q || \"Intelligence artificielle 2026\" },\n };\n }\n if (\n lower.startsWith(\"/summarize\") || lower.startsWith(\"@summarize\") ||\n lower.startsWith(\"/resumer\") || lower.startsWith(\"@resumer\")\n ) {\n const t = cleanMsg.replace(/^[/@](summarize|resumer)\\s*:?\\s*/i, \"\")\n .trim();\n return { toolToRun: \"summarize\", toolArgs: { target: t || \"récents\" } };\n }\n if (\n lower.startsWith(\"/fact_check\") || lower.startsWith(\"@fact_check\") ||\n lower.startsWith(\"/verifier\") || lower.startsWith(\"@verifier\")\n ) {\n const s = cleanMsg.replace(/^[/@](fact_check|verifier)\\s*:?\\s*/i, \"\")\n .trim();\n return {\n toolToRun: \"fact_check\",\n toolArgs: { statement: s || cleanMsg },\n };\n }\n if (\n lower.startsWith(\"/rewrite\") || lower.startsWith(\"@rewrite\") ||\n lower.startsWith(\"/reformuler\") || lower.startsWith(\"@reformuler\") ||\n lower.startsWith(\"@style\")\n ) {\n const words = cleanMsg.replace(\n /^[/@](rewrite|reformuler|style)\\s*:?\\s*/i,\n \"\",\n ).trim().split(/\\s+/);\n const style =\n [\"viral\", \"pro\", \"humour\", \"concis\", \"poétique\"].includes(\n words[0]?.toLowerCase(),\n )\n ? words.shift()\n : \"viral\";\n return {\n toolToRun: \"rewrite_post\",\n toolArgs: { text: words.join(\" \") || cleanMsg, style },\n };\n }\n if (\n lower.startsWith(\"/translate\") || lower.startsWith(\"@translate\") ||\n lower.startsWith(\"/traduire\") || lower.startsWith(\"@traduire\")\n ) {\n const words = cleanMsg.replace(/^[/@](translate|traduire)\\s*:?\\s*/i, \"\")\n .trim().split(/\\s+/);\n const lang = words[0] || \"anglais\";\n words.shift();\n return {\n toolToRun: \"translate\",\n toolArgs: { text: words.join(\" \") || cleanMsg, target_language: lang },\n };\n }\n if (\n lower.startsWith(\"/publish\") || lower.startsWith(\"@publish\") ||\n lower.startsWith(\"/publier\") || lower.startsWith(\"@publier\") ||\n lower.startsWith(\"@post\") || lower.startsWith(\"publie \")\n ) {\n const textMatch = cleanMsg.replace(\n /^([/@](publish|publier|post)|(publie|poste))\\s*:?\\s*/i,\n \"\",\n ).trim();\n return {\n toolToRun: \"create_post\",\n toolArgs: { content: textMatch || cleanMsg },\n };\n }\n if (\n lower.startsWith(\"/follow\") || lower.startsWith(\"@follow\") ||\n lower.startsWith(\"/suivre\") || lower.startsWith(\"@suivre\")\n ) {\n const target = cleanMsg.replace(/^[/@](follow|suivre)\\s*:?\\s*/i, \"\")\n .trim().replace(/^@/, \"\");\n if (target) {\n return { toolToRun: \"follow_user\", toolArgs: { username: target } };\n }\n }\n if (\n lower.startsWith(\"/trends\") || lower.startsWith(\"@trends\") ||\n lower.startsWith(\"/tendances\") || lower.startsWith(\"@tendances\")\n ) {\n return { toolToRun: \"analyze_trends\", toolArgs: {} };\n }\n if (\n lower.startsWith(\"/inspire\") || lower.startsWith(\"@inspire\") ||\n lower.startsWith(\"/idee\") || lower.startsWith(\"@idee\") ||\n lower.startsWith(\"/idée\")\n ) {\n const topic = cleanMsg.replace(\n /^[/@](inspire|idee|idée)(-?moi)?\\s*(sur|à propos de|about)?\\s*:?\\s*/i,\n \"\",\n ).trim();\n return {\n toolToRun: \"suggest_post\",\n toolArgs: { topic: topic || \"sujets d'actualité\", style: \"viral\" },\n };\n }\n if (\n lower.startsWith(\"/stats\") || lower.startsWith(\"@stats\") ||\n lower.startsWith(\"/compte\") || lower.startsWith(\"@compte\") ||\n lower.includes(\"mes stats\") || lower.includes(\"mon compte\")\n ) {\n return { toolToRun: \"get_account_stats\", toolArgs: {} };\n }\n if (\n lower.startsWith(\"/quotas\") || lower.startsWith(\"@quotas\") ||\n lower.startsWith(\"/limites\") || lower.includes(\"mes quotas\") ||\n lower.includes(\"mes limites\")\n ) {\n return { toolToRun: \"check_quotas\", toolArgs: {} };\n }\n if (\n lower.startsWith(\"/notifications\") ||\n lower.startsWith(\"@notifications\") || lower.startsWith(\"/notifs\") ||\n lower.startsWith(\"@notifs\")\n ) {\n return { toolToRun: \"get_notifications\", toolArgs: {} };\n }\n return null;\n }\n\n async function getUserAutoApprove(\n sql: any,\n userId: number,\n ): Promise<boolean> {\n try {\n const rows =\n await sql`SELECT mai_auto_approve_tools FROM user_settings WHERE user_id = ${userId} LIMIT 1`;\n return Boolean(rows[0]?.mai_auto_approve_tools);\n } catch {\n return false;\n }\n }\n\n // 1. mAI CHAT & TOOL EXECUTION\n const handleMAIChat = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const { message, execute_tool, model = \"poolside/laguna-xs-2.1:free\" } =\n await c.req.json();\n if (!message || !message.trim()) {\n return c.json({ error: \"Message requis.\" }, 400);\n }\n\n const sql = getDb();\n const userRows =\n await sql`SELECT username, tier FROM users WHERE id = ${userId} LIMIT 1`;\n const username = userRows[0]?.username || \"Ami\";\n\n let toolToRun: string | null = execute_tool?.name || null;\n let toolArgs: any = execute_tool?.args || {};\n\n if (!toolToRun) {\n const detected = detectTool(message.trim());\n if (detected) {\n toolToRun = detected.toolToRun;\n toolArgs = detected.toolArgs;\n }\n }\n\n // ── Flux d'approbation utilisateur ──────────────────────────────\n // Un outil sensible n'est exécuté que si l'utilisateur l'approuve,\n // sauf si `mai_auto_approve_tools` est activé dans ses paramètres.\n if (toolToRun && SENSITIVE_TOOLS.includes(toolToRun)) {\n const autoApprove = await getUserAutoApprove(sql, userId);\n if (!autoApprove) {\n return c.json({\n reply:\n `🔐 **Approbation requise** : mAI souhaite exécuter l'outil « ${toolToRun} » sur votre compte. Confirmez ou refusez dans le panneau ci-dessus.`,\n requiresApproval: true,\n pendingTool: { name: toolToRun, args: toolArgs },\n toolExecuted: null,\n modelUsed: model,\n });\n }\n }\n\n let toolResult: any = null;\n if (toolToRun) {\n toolResult = await MAIAgentFleet.executeTool(\n toolToRun,\n toolArgs,\n userId,\n );\n }\n\n const { weekStartStr } = getWeekData();\n await sql`\n INSERT INTO weekly_usage (user_id, week_start, tokens_used)\n VALUES (${userId}, ${weekStartStr}::date, 250)\n ON CONFLICT (user_id, week_start)\n DO UPDATE SET tokens_used = weekly_usage.tokens_used + 250\n `.catch(() => {});\n\n let reply =\n `Bonjour @${username} ! Je suis mAI (modèle ${model}). Comment puis-je vous aider ?`;\n\n if (!toolToRun) {\n // Appel direct au endpoint OpenRouter avec le modèle sélectionné\n const openRouterApiKey = await MAIAgentFleet.getOpenRouterKey(userId);\n const candidateModel = resolveOpenRouterModel(model);\n\n if (openRouterApiKey) {\n try {\n const aiRes = await fetch(\n \"https://openrouter.ai/api/v1/chat/completions\",\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${openRouterApiKey}`,\n \"Content-Type\": \"application/json\",\n \"HTTP-Referer\": \"https://mai.val.run\",\n \"X-Title\": \"mAI Social Assistant\",\n },\n body: JSON.stringify({\n model: candidateModel,\n messages: [\n {\n role: \"system\",\n content:\n \"Tu es mAI, l'intelligence artificielle intégrée au réseau social Vibe. Tu es concis, créatif, pertinent et tu réponds en français avec des émojis.\",\n },\n { role: \"user\", content: message.trim() },\n ],\n }),\n },\n );\n\n if (aiRes.ok) {\n const aiData = await aiRes.json();\n const textOutput = aiData.choices?.[0]?.message?.content;\n if (textOutput) {\n reply = textOutput;\n }\n }\n } catch (e) {\n console.warn(\"[mAI Chat] OpenRouter call fallback:\", e);\n }\n }\n } else if (toolResult && toolResult.success) {\n reply = formatToolReply(toolToRun, toolResult.result, username);\n } else if (toolResult && !toolResult.success) {\n reply = `⚠️ L'action n'a pas pu être exécutée : ${toolResult.error}`;\n }\n\n return c.json({\n reply,\n toolExecuted: toolToRun\n ? { name: toolToRun, result: toolResult }\n : null,\n modelUsed: model,\n });\n } catch (err: any) {\n console.error(\"[Vibe API] mAI Chat Error:\", err);\n return c.json({ error: \"Erreur lors de la conversation avec mAI.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/mai/chat\",\n \"/vibe/mai/chat\",\n \"/v1/mai/chat\",\n ], handleMAIChat);\n\n // 1bis. EXÉCUTION D'OUTIL APPROUVÉ PAR L'UTILISATEUR\n // Appelé par le front uniquement après confirmation explicite (bouton\n // \"Approuver\") — ou pour un outil non sensible (lecture seule).\n const handleExecuteTool = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const { name, args = {}, model = \"poolside/laguna-xs-2.1:free\" } = await c\n .req.json();\n if (!name) return c.json({ error: \"Nom d'outil requis.\" }, 400);\n\n const result = await MAIAgentFleet.executeTool(\n String(name),\n args,\n userId,\n );\n const reply = result.success\n ? formatToolReply(String(name), result.result, \"\")\n : `⚠️ L'action n'a pas pu être exécutée : ${result.error}`;\n\n return c.json({\n reply,\n toolExecuted: { name, result },\n modelUsed: model,\n });\n } catch (err: any) {\n console.error(\"[Vibe API] mAI Execute Tool Error:\", err);\n return c.json({ error: \"Erreur lors de l'exécution de l'outil.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/mai/execute-tool\",\n \"/vibe/mai/execute-tool\",\n \"/v1/mai/execute-tool\",\n ], handleExecuteTool);\n\n // 2. mAI QUOTAS\n const handleMAIQuotas = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const res = await MAIAgentFleet.executeTool(\"check_quotas\", {}, userId);\n return c.json(res.result);\n } catch (err: any) {\n return c.json({ error: \"Erreur quotas.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/mai/quotas\",\n \"/vibe/mai/quotas\",\n \"/v1/mai/quotas\",\n ], handleMAIQuotas);\n\n // 3. mAI MODULATE\n const handleMAIModulate = async (c: any) => {\n try {\n const { text, tone = \"executive\" } = await c.req.json();\n const modulated = await MAIAgentFleet.modulateText({ text, tone });\n return c.json({ success: true, modulated });\n } catch (err: any) {\n return c.json({ error: \"Erreur modulation.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/mai/modulate\",\n \"/vibe/mai/modulate\",\n \"/v1/mai/modulate\",\n ], handleMAIModulate);\n}",[204],"634af0b0-c015-4012-8198-071a6658d609","vibe-mai-fleet.ts","b7867488-a6e4-11f1-ae27-1607ee4eb77e",176,["D",1788443366782],"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — mAI AGENT FLEET (vibe-mai-fleet.ts)\n * Tool declarations and execution engine for database-backed AI agents\n * ============================================================================\n */\n\nimport {\n getDb,\n getTierDailyImageLimit,\n getTierMaiTokenLimit,\n getWeekData,\n} from \"./config.ts\";\nimport { executeWebSearch } from \"./web.ts\";\n\n/**\n * Outils \"sensibles\" : ils modifient le compte ou le contenu public de\n * l'utilisateur. Ils exigent une approbation explicite sauf si le réglage\n * `mai_auto_approve_tools` a été activé dans les paramètres.\n */\nexport const SENSITIVE_TOOLS = [\n \"create_post\",\n \"delete_post\",\n \"update_profile\",\n \"follow_user\",\n];\n\nexport const MAI_TOOLS = [\n {\n name: \"get_account_stats\",\n description:\n \"Récupère les statistiques détaillées du compte utilisateur (abonnés, posts, réputation, quotas).\",\n parameters: { type: \"object\", properties: {} },\n },\n {\n name: \"create_post\",\n description:\n \"Publie un nouveau post sur Vibe au nom de l'utilisateur connecté.\",\n parameters: {\n type: \"object\",\n properties: {\n content: {\n type: \"string\",\n description: \"Le texte du post à publier sur Vibe\",\n },\n format: {\n type: \"string\",\n enum: [\"micro_text\", \"article\", \"media\", \"mai_generation\"],\n },\n media_url: {\n type: \"string\",\n description: \"URL optionnelle d'une image attachée\",\n },\n },\n required: [\"content\"],\n },\n },\n {\n name: \"delete_post\",\n description: \"Supprime une publication appartenant à l'utilisateur.\",\n parameters: {\n type: \"object\",\n properties: {\n post_id: {\n type: \"string\",\n description: \"Identifiant UUID du post à supprimer\",\n },\n },\n required: [\"post_id\"],\n },\n },\n {\n name: \"search_posts\",\n description: \"Recherche des publications sur Vibe par mot-clé.\",\n parameters: {\n type: \"object\",\n properties: {\n query: { type: \"string\", description: \"Texte ou mot-clé à chercher\" },\n limit: { type: \"number\", description: \"Nombre max de résultats\" },\n },\n required: [\"query\"],\n },\n },\n {\n name: \"generate_vibe_image\",\n description:\n \"Génère une image IA pour une publication Vibe ou pour l'avatar.\",\n parameters: {\n type: \"object\",\n properties: {\n prompt: {\n type: \"string\",\n description: \"Description textuelle de l'image\",\n },\n aspect_ratio: { type: \"string\", enum: [\"1:1\", \"16:9\", \"4:5\", \"9:16\"] },\n },\n required: [\"prompt\"],\n },\n },\n {\n name: \"suggest_post\",\n description:\n \"Génère des idées de publications Vibe originales (sans les publier).\",\n parameters: {\n type: \"object\",\n properties: {\n topic: { type: \"string\", description: \"Thème ou sujet souhaité\" },\n style: {\n type: \"string\",\n enum: [\"viral\", \"pro\", \"humour\", \"inspirant\"],\n description: \"Ton du post\",\n },\n },\n required: [\"topic\"],\n },\n },\n {\n name: \"check_quotas\",\n description:\n \"Consulte les quotas d'utilisation hebdomadaires de mAI et quotidiens pour les images.\",\n parameters: { type: \"object\", properties: {} },\n },\n {\n name: \"update_profile\",\n description:\n \"Met à jour le profil Vibe de l'utilisateur (nom affiché et/ou bio).\",\n parameters: {\n type: \"object\",\n properties: {\n display_name: {\n type: \"string\",\n description: \"Nouveau nom affiché (2 à 40 caractères)\",\n },\n bio: {\n type: \"string\",\n description: \"Nouvelle bio du profil (max 200 caractères)\",\n },\n },\n },\n },\n {\n name: \"follow_user\",\n description:\n \"Suit (ou ne suit plus) un compte Vibe désigné par son @username.\",\n parameters: {\n type: \"object\",\n properties: {\n username: {\n type: \"string\",\n description: \"Le nom d'utilisateur Vibe à suivre, sans le @\",\n },\n follow: {\n type: \"boolean\",\n description:\n \"true pour suivre, false pour ne plus suivre (défaut : true)\",\n },\n },\n required: [\"username\"],\n },\n },\n {\n name: \"get_notifications\",\n description:\n \"Récupère les notifications récentes de l'utilisateur (likes, reposts, réponses, DMs).\",\n parameters: { type: \"object\", properties: {} },\n },\n];\n\nexport class MAIAgentFleet {\n public static assessContentSafety(\n content: string,\n ): { isSafe: boolean; toxicityScore: number; flagReason?: string } {\n const prohibitedKeywords = [\n \"haine\",\n \"violence explicite\",\n \"terrorisme\",\n \"terrorist\",\n \"cp_illegal\",\n \"doxx\",\n ];\n const lower = content.toLowerCase();\n\n for (const kw of prohibitedKeywords) {\n if (lower.includes(kw)) {\n return {\n isSafe: false,\n toxicityScore: 0.95,\n flagReason: `Terme prohibé détecté (${kw})`,\n };\n }\n }\n\n return { isSafe: true, toxicityScore: 0.02 };\n }\n\n public static async modulateText(\n opts: { text: string; tone?: string; format?: string },\n ): Promise<string> {\n const { text, tone = \"executive\" } = opts;\n const tonePrefixes: Record<string, string> = {\n executive: \"⚡ \",\n viral: \"🔥 \",\n poetic: \"✨ \",\n minimal: \"✦ \",\n };\n\n const prefix = tonePrefixes[tone] || \"\";\n return `${prefix}${text.trim()}`;\n }\n\n public static synthesizeThread(\n comments: Array<{ author: string; content: string }>,\n ): string {\n if (!comments || comments.length === 0) {\n return \"Aucun commentaire pour le moment.\";\n }\n const count = comments.length;\n const authors = [...new Set(comments.map((c) => c.author))].slice(0, 3)\n .join(\", \");\n return `Synthèse (${count} réponses) : Échanges autour des points partagés par @${authors}.`;\n }\n\n /**\n * Récupère une clé OpenRouter (variable d'environnement ou table mprojects_api_keys).\n */\n public static async getOpenRouterKey(userId: number): Promise<string> {\n if (\n typeof (globalThis as any).Deno !== \"undefined\" &&\n (globalThis as any).Deno.env?.get(\"OPENROUTER_API_KEY\")\n ) {\n return (globalThis as any).Deno.env.get(\"OPENROUTER_API_KEY\");\n }\n if (typeof process !== \"undefined\" && process.env?.OPENROUTER_API_KEY) {\n return process.env.OPENROUTER_API_KEY;\n }\n try {\n const sql = getDb();\n const keyRows =\n await sql`SELECT api_key FROM mprojects_api_keys WHERE user_id::text = ${\n String(userId)\n }::text LIMIT 1`;\n return keyRows[0]?.api_key || \"\";\n } catch {\n return \"\";\n }\n }\n\n /**\n * Appel générique OpenRouter pour les outils textuels (traduction, reformulation...).\n */\n public static async callOpenRouter(\n userId: number,\n system: string,\n user: string,\n model = \"google/gemini-2.5-flash:free\",\n ): Promise<string | null> {\n const apiKey = await this.getOpenRouterKey(userId);\n if (!apiKey) return null;\n try {\n const aiRes = await fetch(\n \"https://openrouter.ai/api/v1/chat/completions\",\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n \"HTTP-Referer\": \"https://mai.val.run\",\n \"X-Title\": \"mAI Social Assistant\",\n },\n body: JSON.stringify({\n model,\n messages: [\n { role: \"system\", content: system },\n { role: \"user\", content: user },\n ],\n }),\n },\n );\n if (!aiRes.ok) return null;\n const aiData = await aiRes.json();\n return aiData.choices?.[0]?.message?.content || null;\n } catch {\n return null;\n }\n }\n\n public static async executeTool(\n toolName: string,\n args: Record<string, any>,\n userId: string | number,\n ): Promise<{ success: boolean; result: any; error?: string }> {\n const sql = getDb();\n const startTime = Date.now();\n const uid = Number(userId);\n\n try {\n let resultData: any = null;\n\n switch (toolName) {\n case \"get_account_stats\": {\n const [uRows, prRows, pCount] = await Promise.all([\n sql`SELECT id, username, email, tier, avatar_url, COALESCE(created_at, NOW()) as created_at FROM users WHERE id = ${uid} LIMIT 1`,\n sql`SELECT * FROM profiles WHERE user_id = ${uid} LIMIT 1`,\n sql`SELECT COUNT(*) as count FROM posts WHERE author_id = ${uid}`,\n ]);\n resultData = {\n user: uRows[0],\n profile: prRows[0],\n totalPosts: Number(pCount[0]?.count || 0),\n };\n break;\n }\n\n case \"create_post\": {\n const { content, format = \"micro_text\", media_url } = args;\n if (!content || !content.trim()) {\n throw new Error(\"Le contenu du post est obligatoire.\");\n }\n\n const safety = this.assessContentSafety(content);\n if (!safety.isSafe) {\n throw new Error(\n `Publication refusée par mAI : ${safety.flagReason}`,\n );\n }\n\n const inserted = await sql`\n INSERT INTO posts (author_id, content, format, created_via, toxicity_score)\n VALUES (${uid}, ${content.trim()}, ${format}, 'mai_agent', ${safety.toxicityScore})\n RETURNING *\n `;\n const newPost = inserted[0];\n\n if (media_url) {\n const cleanUrl = String(media_url).split(\"?\")[0].split(\"#\")[0];\n const ext = cleanUrl.split(\".\").pop()?.toLowerCase();\n const mediaType = ext === \"png\"\n ? \"image/png\"\n : ext === \"webp\"\n ? \"image/webp\"\n : ext === \"gif\"\n ? \"image/gif\"\n : ext === \"mp4\"\n ? \"video/mp4\"\n : \"image/jpeg\";\n await sql`\n INSERT INTO media_assets (owner_id, post_id, url, media_type, file_size_bytes, alt_text)\n VALUES (${uid}, ${newPost.id}::uuid, ${media_url}, ${mediaType}, 0, '')\n `;\n }\n\n await sql`UPDATE profiles SET posts_count = posts_count + 1 WHERE user_id = ${uid}`;\n resultData = {\n post: newPost,\n message: \"Post publié avec succès sur Vibe !\",\n };\n break;\n }\n\n case \"delete_post\": {\n const { post_id } = args;\n if (!post_id) throw new Error(\"post_id est requis.\");\n\n const del = await sql`\n DELETE FROM posts WHERE id = ${post_id}::uuid AND author_id = ${uid} RETURNING id\n `;\n if (del.length === 0) {\n throw new Error(\n \"Publication introuvable ou vous n'êtes pas l'auteur.\",\n );\n }\n await sql`UPDATE profiles SET posts_count = GREATEST(0, posts_count - 1) WHERE user_id = ${uid}`;\n resultData = {\n deletedPostId: post_id,\n message: \"Publication supprimée avec succès.\",\n };\n break;\n }\n\n case \"search_posts\": {\n const { query, limit = 10 } = args;\n const rows = await sql`\n SELECT p.*, pr.display_name, pr.avatar_url, u.username\n FROM posts p\n JOIN users u ON u.id = p.author_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE p.content ILIKE ('%' || ${query} || '%')\n ORDER BY p.published_at DESC\n LIMIT ${limit}\n `;\n resultData = { query, resultsCount: rows.length, posts: rows };\n break;\n }\n\n case \"generate_vibe_image\": {\n const { prompt, aspect_ratio = \"1:1\" } = args;\n const uRows =\n await sql`SELECT tier FROM users WHERE id = ${uid} LIMIT 1`;\n const tier = uRows[0]?.tier || \"Free\";\n const maxImages = getTierDailyImageLimit(tier);\n\n const todayRows = await sql`\n SELECT images_generated FROM daily_image_usage \n WHERE user_id = ${uid} AND usage_date = CURRENT_DATE LIMIT 1\n `;\n const currentCount = todayRows[0]?.images_generated || 0;\n\n if (currentCount >= maxImages) {\n throw new Error(\n `Quota journalier d'images atteint (${currentCount}/${maxImages} pour le forfait ${tier}).`,\n );\n }\n\n await sql`\n INSERT INTO daily_image_usage (user_id, usage_date, images_generated)\n VALUES (${uid}, CURRENT_DATE, 1)\n ON CONFLICT (user_id, usage_date)\n DO UPDATE SET images_generated = daily_image_usage.images_generated + 1\n `;\n\n const sampleImages = [\n \"https://images.unsplash.com/photo-1618005182384-a83a8bd57fbe?w=1200&q=80\",\n \"https://images.unsplash.com/photo-1600585154340-be6161a56a0c?w=1200&q=80\",\n \"https://images.unsplash.com/photo-1634017839464-5c339ebe3cb4?w=1200&q=80\",\n \"https://images.unsplash.com/photo-1550684848-fac1c5b4e853?w=1200&q=80\",\n ];\n const chosen =\n sampleImages[Math.floor(Math.random() * sampleImages.length)];\n\n resultData = {\n prompt,\n aspect_ratio,\n imageUrl: chosen,\n quotaRemaining: Math.max(0, maxImages - (currentCount + 1)),\n message: \"Image générée avec succès via mAI !\",\n };\n break;\n }\n\n case \"check_quotas\": {\n const uRows =\n await sql`SELECT tier FROM users WHERE id = ${uid} LIMIT 1`;\n const tier = uRows[0]?.tier || \"Free\";\n const { weekStartStr, nextResetIso } = getWeekData();\n\n const [usageRows, imgRows] = await Promise.all([\n sql`SELECT COALESCE(SUM(tokens_used), 0) as tokens FROM weekly_usage WHERE user_id = ${uid} AND week_start = ${weekStartStr}::date`,\n sql`SELECT COALESCE(images_generated, 0) as images FROM daily_image_usage WHERE user_id = ${uid} AND usage_date = CURRENT_DATE`,\n ]);\n\n const tokenLimit = getTierMaiTokenLimit(tier);\n const imageLimit = getTierDailyImageLimit(tier);\n const tokensUsed = Number(usageRows[0]?.tokens || 0);\n const imagesUsed = Number(imgRows[0]?.images || 0);\n\n resultData = {\n tier,\n weeklyTokens: {\n used: tokensUsed,\n limit: tokenLimit,\n percent: Math.min(\n 100,\n Math.round((tokensUsed / tokenLimit) * 100),\n ),\n },\n dailyImages: {\n used: imagesUsed,\n limit: imageLimit,\n percent: Math.min(\n 100,\n Math.round((imagesUsed / imageLimit) * 100),\n ),\n },\n resetAt: nextResetIso,\n };\n break;\n }\n\n case \"search_web\": {\n const { query } = args;\n const search = await executeWebSearch(String(query || \"\"), 5);\n if (!search.success || search.results.length === 0) {\n throw new Error(search.error || \"Aucun résultat de recherche web.\");\n }\n const snippet = search.results\n .slice(0, 3)\n .map((r) => `• **${r.title}** — ${r.snippet}\\n ${r.url}`)\n .join(\"\\n\");\n resultData = {\n query,\n snippet,\n provider: search.provider,\n results: search.results,\n };\n break;\n }\n\n case \"summarize\": {\n const recent = await sql`\n SELECT p.content, u.username FROM posts p\n JOIN users u ON u.id = p.author_id\n ORDER BY p.published_at DESC LIMIT 30\n `;\n if (recent.length === 0) {\n resultData = {\n summary:\n \"Le fil est calme : aucune publication récente à résumer.\",\n };\n break;\n }\n const hashtags: Record<string, number> = {};\n for (const r of recent) {\n for (\n const m of String(r.content).matchAll(/#([\\p{L}\\p{N}_]{2,30})/gu)\n ) {\n const tag = m[1].toLowerCase();\n hashtags[tag] = (hashtags[tag] || 0) + 1;\n }\n }\n const topTags = Object.entries(hashtags).sort((a, b) => b[1] - a[1])\n .slice(0, 5);\n const authors = [...new Set(recent.map((r: any) => `@${r.username}`))]\n .slice(0, 5).join(\", \");\n resultData = {\n summary: [\n `📄 ${recent.length} publications récentes analysées, principalement par ${authors}.`,\n topTags.length > 0\n ? `🏷️ Sujets dominants : ${\n topTags.map(([t, n]) => `#${t} (${n})`).join(\", \")\n }.`\n : \"\",\n \"💡 Le flux tourne surtout autour de ces thématiques — explorez les tendances pour en savoir plus.\",\n ].filter(Boolean).join(\"\\n\\n\"),\n };\n break;\n }\n\n case \"fact_check\": {\n const { statement } = args;\n const search = await executeWebSearch(String(statement || \"\"), 5)\n .catch(() => null);\n const sources = search?.success ? search.results.slice(0, 3) : [];\n const llm = await this.callOpenRouter(\n uid,\n \"Tu es un vérificateur de faits rigoureux. Réponds en 3 phrases maximum en français : verdict (Vrai / Faux / Plausible / À vérifier) puis justification brève en t'appuyant sur les sources fournies.\",\n `Affirmation : « ${statement} »\\n\\nSources trouvées :\\n${\n sources.map((s) => `- ${s.title} : ${s.snippet}`).join(\"\\n\") ||\n \"(aucune)\"\n }`,\n );\n resultData = {\n statement,\n verdict: llm\n ? \"Analyse mAI\"\n : sources.length > 0\n ? \"À vérifier\"\n : \"Sources insuffisantes\",\n confidence: sources.length > 0 ? \"Moyen\" : \"Faible\",\n analysis: llm ||\n (sources.length > 0\n ? \"Des sources web ont été trouvées, croisez-les pour vous forger un avis.\"\n : \"Aucune source fiable trouvée sur le web pour cette affirmation.\"),\n sources,\n };\n break;\n }\n\n case \"rewrite_post\": {\n const { text, style = \"viral\" } = args;\n const tones: Record<string, string> = {\n viral: \"viral\",\n pro: \"executive\",\n humour: \"viral\",\n concis: \"minimal\",\n poétique: \"poetic\",\n };\n const llm = await this.callOpenRouter(\n uid,\n `Reformule le texte suivant en français dans un style « ${style} », percutant et adapté à un réseau social. Réponds UNIQUEMENT par le texte reformulé, sans commentaire.`,\n String(text || \"\"),\n );\n const rewritten = llm ||\n (await this.modulateText({\n text: String(text || \"\"),\n tone: tones[style] || \"viral\",\n }));\n resultData = { rewritten, style };\n break;\n }\n\n case \"suggest_post\": {\n const { topic, style = \"viral\" } = args;\n const llm = await this.callOpenRouter(\n uid,\n `Propose 3 idées de publications courtes pour le réseau social Vibe sur le thème « ${topic} », dans un style « ${style} ». Format : une liste numérotée, chaque post fait 1 à 2 phrases, avec des hashtags pertinents. Réponds UNIQUEMENT par la liste.`,\n String(topic || \"sujets d'actualité\"),\n );\n if (!llm) {\n throw new Error(\n \"Génération indisponible : aucune clé IA configurée sur le serveur.\",\n );\n }\n resultData = { suggestions: llm, topic, style };\n break;\n }\n\n case \"translate\": {\n const { text, target_language = \"anglais\" } = args;\n const llm = await this.callOpenRouter(\n uid,\n `Traduis le texte suivant en ${target_language}. Réponds UNIQUEMENT par la traduction, sans commentaire.`,\n String(text || \"\"),\n );\n if (!llm) {\n throw new Error(\n \"Traduction indisponible : aucune clé IA configurée sur le serveur.\",\n );\n }\n resultData = { translated: llm, targetLanguage: target_language };\n break;\n }\n\n case \"analyze_trends\": {\n const recent = await sql`\n SELECT content FROM posts WHERE published_at > NOW() - INTERVAL '7 days' ORDER BY published_at DESC LIMIT 200\n `;\n const tags: Record<string, number> = {};\n for (const r of recent) {\n for (\n const m of String(r.content).matchAll(/#([\\p{L}\\p{N}_]{2,30})/gu)\n ) {\n const tag = m[1].toLowerCase();\n tags[tag] = (tags[tag] || 0) + 1;\n }\n }\n const trendingTopics = Object.entries(tags)\n .sort((a, b) => b[1] - a[1])\n .slice(0, 8)\n .map(([name, postsCount]) => ({\n name: `#${name}`,\n postsCount,\n sentiment: postsCount >= 5 ? \"Très actif 🔥\" : \"Actif 📈\",\n }));\n resultData = { trendingTopics };\n break;\n }\n\n case \"update_profile\": {\n const { display_name, bio } = args;\n if (!display_name && !bio) {\n throw new Error(\n \"Fournissez au moins un champ (display_name ou bio).\",\n );\n }\n if (\n display_name !== undefined &&\n (String(display_name).length < 2 ||\n String(display_name).length > 40)\n ) {\n throw new Error(\n \"Le nom affiché doit contenir entre 2 et 40 caractères.\",\n );\n }\n if (bio !== undefined && String(bio).length > 200) {\n throw new Error(\"La bio ne doit pas dépasser 200 caractères.\");\n }\n const updated = await sql`\n UPDATE profiles SET\n display_name = COALESCE(${display_name ?? null}, display_name),\n bio = COALESCE(${bio ?? null}, bio),\n updated_at = NOW()\n WHERE user_id = ${uid}\n RETURNING display_name, bio\n `;\n if (updated.length === 0) throw new Error(\"Profil introuvable.\");\n resultData = {\n profile: updated[0],\n message: \"Profil mis à jour avec succès.\",\n };\n break;\n }\n\n case \"follow_user\": {\n const { username, follow = true } = args;\n const cleanUsername = String(username || \"\").replace(/^@/, \"\").trim()\n .toLowerCase();\n if (!cleanUsername) throw new Error(\"username est requis.\");\n const target =\n await sql`SELECT id FROM users WHERE LOWER(username) = ${cleanUsername} LIMIT 1`;\n if (target.length === 0) {\n throw new Error(`Compte @${cleanUsername} introuvable sur Vibe.`);\n }\n const targetId = Number(target[0].id);\n if (targetId === uid) {\n throw new Error(\"Vous ne pouvez pas vous suivre vous-même.\");\n }\n\n if (follow) {\n const existing =\n await sql`SELECT 1 FROM follows WHERE follower_id = ${uid} AND following_id = ${targetId} LIMIT 1`;\n if (existing.length > 0) {\n resultData = {\n followed: true,\n username: cleanUsername,\n message: `Vous suivez déjà @${cleanUsername}.`,\n };\n break;\n }\n await sql`INSERT INTO follows (follower_id, following_id) VALUES (${uid}, ${targetId}) ON CONFLICT DO NOTHING`;\n await Promise.all([\n sql`UPDATE profiles SET following_count = following_count + 1 WHERE user_id = ${uid}`,\n sql`UPDATE profiles SET followers_count = followers_count + 1 WHERE user_id = ${targetId}`,\n ]);\n resultData = {\n followed: true,\n username: cleanUsername,\n message: `Vous suivez désormais @${cleanUsername} !`,\n };\n } else {\n const del =\n await sql`DELETE FROM follows WHERE follower_id = ${uid} AND following_id = ${targetId} RETURNING 1`;\n if (del.length > 0) {\n await Promise.all([\n sql`UPDATE profiles SET following_count = GREATEST(0, following_count - 1) WHERE user_id = ${uid}`,\n sql`UPDATE profiles SET followers_count = GREATEST(0, followers_count - 1) WHERE user_id = ${targetId}`,\n ]);\n }\n resultData = {\n followed: false,\n username: cleanUsername,\n message: `Vous ne suivez plus @${cleanUsername}.`,\n };\n }\n break;\n }\n\n case \"get_notifications\": {\n const rows = await sql`\n SELECT n.*, u.username as actor_username\n FROM notifications n\n LEFT JOIN users u ON u.id = n.actor_id\n WHERE n.recipient_id = ${uid}\n ORDER BY n.created_at DESC LIMIT 20\n `;\n resultData = { count: rows.length, notifications: rows };\n break;\n }\n\n default:\n throw new Error(`Outil inconnu : ${toolName}`);\n }\n\n const duration = Date.now() - startTime;\n await sql`\n INSERT INTO mai_tool_executions (user_id, tool_name, parameters, result, status, execution_time_ms)\n VALUES (${uid}, ${toolName}, ${JSON.stringify(args)}::jsonb, ${\n JSON.stringify(resultData)\n }::jsonb, 'success', ${duration})\n `;\n\n return { success: true, result: resultData };\n } catch (err: any) {\n console.error(`[MAIAgentFleet] Error executing tool ${toolName}:`, err);\n const duration = Date.now() - startTime;\n await sql`\n INSERT INTO mai_tool_executions (user_id, tool_name, parameters, result, status, execution_time_ms)\n VALUES (${uid}, ${toolName}, ${JSON.stringify(args)}::jsonb, ${\n JSON.stringify({ error: err.message })\n }::jsonb, 'failed', ${duration})\n `.catch(() => {});\n return { success: false, result: null, error: err.message };\n }\n }\n}",[211],"abf9df95-7d6a-4d1b-aefb-1a82b5bed194","vibe-dms.ts","6b04e9b4-a6e4-11f1-a11e-1607ee4eb77e",174,["D",1788443339578],"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — DMs & NOTIFICATIONS (vibe-dms.ts)\n * Private messaging, bot auto-reply, DM permissions & user notifications\n * ============================================================================\n */\n\nimport type { Hono } from \"npm:hono@4\";\nimport { extractToken, getDb, verifyToken } from \"./config.ts\";\nimport type { RegisterMultiFn } from \"./vibe-common.ts\";\n\n/**\n * Crée les tables de modération DM si besoin (idempotent, exécuté une fois).\n * — blocked_users : relations de blocage\n * — dm_reports : signalements\n * — dm_conv_meta : métadonnées locales par utilisateur (renommage conversation)\n * — dm_reactions : réactions emoji + colonne reply_to_id (réponses)\n */\nlet dmTablesReady = false;\nasync function ensureDMTables() {\n if (dmTablesReady) return;\n try {\n const sql = getDb();\n await sql`\n CREATE TABLE IF NOT EXISTS blocked_users (\n id UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n user_id BIGINT NOT NULL,\n blocked_user_id BIGINT NOT NULL,\n created_at TIMESTAMPTZ DEFAULT NOW(),\n UNIQUE (user_id, blocked_user_id)\n )\n `;\n await sql`\n CREATE TABLE IF NOT EXISTS dm_reports (\n id UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n reporter_id BIGINT NOT NULL,\n reported_user_id BIGINT,\n message_id UUID,\n reason TEXT,\n created_at TIMESTAMPTZ DEFAULT NOW()\n )\n `;\n await sql`\n CREATE TABLE IF NOT EXISTS dm_conv_meta (\n id UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n user_id BIGINT NOT NULL,\n partner_id BIGINT NOT NULL,\n custom_name TEXT,\n UNIQUE (user_id, partner_id)\n )\n `;\n await sql`\n CREATE TABLE IF NOT EXISTS dm_reactions (\n id UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n message_id UUID NOT NULL,\n user_id BIGINT NOT NULL,\n emoji TEXT NOT NULL,\n created_at TIMESTAMPTZ DEFAULT NOW(),\n UNIQUE (message_id, user_id, emoji)\n )\n `;\n await sql`ALTER TABLE direct_messages ADD COLUMN IF NOT EXISTS reply_to_id UUID`\n .catch(() => {});\n dmTablesReady = true;\n } catch (err) {\n console.warn(\"[vibe-dms] ensureDMTables skipped:\", (err as any)?.message);\n }\n}\n\nexport function registerVibeDMsRoutes(\n app: Hono,\n registerMulti: RegisterMultiFn,\n) {\n ensureDMTables();\n // 1. SEARCH USERS FOR DM\n const handleDMUsers = async (c: any) => {\n try {\n const q = (c.req.query(\"q\") || \"\").trim().toLowerCase();\n if (!q) return c.json({ users: [] });\n\n const sql = getDb();\n const users = await sql`\n SELECT u.id, u.username, u.tier,\n (COALESCE(u.is_verified, FALSE) OR LOWER(COALESCE(u.tier, '')) IN ('plus', 'pro', 'max')) as is_verified,\n pr.display_name, pr.avatar_url\n FROM users u\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE LOWER(u.username) LIKE ('%' || ${q} || '%') OR LOWER(pr.display_name) LIKE ('%' || ${q} || '%')\n LIMIT 10\n `;\n return c.json({ users });\n } catch (err: any) {\n return c.json({ error: \"Erreur recherche.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/dms/users\",\n \"/vibe/dms/users\",\n \"/v1/dms/users\",\n ], handleDMUsers);\n\n // 2. DM CONVERSATIONS\n const handleDMConversations = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const sql = getDb();\n const convs = await sql`\n SELECT dm.*,\n CASE WHEN dm.participant_one_id = ${userId} THEN u2.username ELSE u1.username END as partner_username,\n CASE WHEN dm.participant_one_id = ${userId} THEN pr2.display_name ELSE pr1.display_name END as partner_display_name,\n CASE WHEN dm.participant_one_id = ${userId} THEN pr2.avatar_url ELSE pr1.avatar_url END as partner_avatar_url,\n CASE WHEN dm.participant_one_id = ${userId} THEN dm.participant_two_id ELSE dm.participant_one_id END as partner_id,\n meta.custom_name,\n (blk.id IS NOT NULL) as is_blocked,\n COALESCE(unread.count, 0)::int as unread_count\n FROM dm_conversations dm\n JOIN users u1 ON u1.id = dm.participant_one_id\n JOIN users u2 ON u2.id = dm.participant_two_id\n LEFT JOIN profiles pr1 ON pr1.user_id = u1.id\n LEFT JOIN profiles pr2 ON pr2.user_id = u2.id\n LEFT JOIN dm_conv_meta meta\n ON meta.user_id = ${userId}\n AND meta.partner_id = CASE WHEN dm.participant_one_id = ${userId} THEN dm.participant_two_id ELSE dm.participant_one_id END\n LEFT JOIN blocked_users blk\n ON blk.user_id = ${userId}\n AND blk.blocked_user_id = CASE WHEN dm.participant_one_id = ${userId} THEN dm.participant_two_id ELSE dm.participant_one_id END\n LEFT JOIN LATERAL (\n SELECT COUNT(*)::int AS count FROM direct_messages m\n WHERE m.conversation_id = dm.id AND m.recipient_id = ${userId} AND m.is_read = FALSE\n ) unread ON TRUE\n WHERE dm.participant_one_id = ${userId} OR dm.participant_two_id = ${userId}\n ORDER BY dm.last_message_at DESC\n `;\n return c.json({ conversations: convs });\n } catch (err: any) {\n return c.json({ error: \"Erreur conversations.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/dms/conversations\",\n \"/vibe/dms/conversations\",\n \"/v1/dms/conversations\",\n ], handleDMConversations);\n\n // 3. DM MESSAGES\n const handleDMMessages = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const partnerId = Number(c.req.param(\"partnerId\"));\n\n const sql = getDb();\n const messages = await sql`\n SELECT m.*, u.username as sender_username,\n r.content as reply_to_content,\n ru.username as reply_to_username\n FROM direct_messages m\n JOIN users u ON u.id = m.sender_id\n LEFT JOIN direct_messages r ON r.id = m.reply_to_id\n LEFT JOIN users ru ON ru.id = r.sender_id\n WHERE (m.sender_id = ${userId} AND m.recipient_id = ${partnerId})\n OR (m.sender_id = ${partnerId} AND m.recipient_id = ${userId})\n ORDER BY m.created_at ASC\n LIMIT 100\n `;\n\n // Réactions emoji (table dm_reactions — ignorée silencieusement si absente)\n try {\n const msgIds = messages.map((m: any) => m.id);\n if (msgIds.length > 0) {\n const reactions = await sql`\n SELECT message_id, emoji, user_id FROM dm_reactions\n WHERE message_id = ANY(${msgIds}::uuid[])\n `;\n const byMsg = new Map<string, { emoji: string; user_id: number }[]>();\n for (const r of reactions) {\n const key = String(r.message_id);\n if (!byMsg.has(key)) byMsg.set(key, []);\n byMsg.get(key)!.push({\n emoji: r.emoji,\n user_id: Number(r.user_id),\n });\n }\n for (const m of messages) {\n const list = byMsg.get(String(m.id)) || [];\n const grouped: { emoji: string; count: number; mine: boolean }[] =\n [];\n for (const r of list) {\n const g = grouped.find((x) => x.emoji === r.emoji);\n if (g) {\n g.count += 1;\n g.mine = g.mine || r.user_id === userId;\n } else {\n grouped.push({\n emoji: r.emoji,\n count: 1,\n mine: r.user_id === userId,\n });\n }\n }\n m.reactions = grouped;\n }\n }\n } catch {}\n\n await sql`\n UPDATE direct_messages SET is_read = TRUE, read_at = NOW()\n WHERE recipient_id = ${userId} AND sender_id = ${partnerId} AND is_read = FALSE\n `;\n return c.json({ messages });\n } catch (err: any) {\n return c.json({ error: \"Erreur messages.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/dms/messages/:partnerId\",\n \"/vibe/dms/messages/:partnerId\",\n \"/v1/dms/messages/:partnerId\",\n ], handleDMMessages);\n\n // 4. SEND DM\n const handleSendDM = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const { recipient_id, content, reply_to_id } = await c.req.json();\n const recId = Number(recipient_id);\n\n if (!recId || !content || !content.trim()) {\n return c.json({ error: \"Destinataire et contenu requis.\" }, 400);\n }\n\n const sql = getDb();\n\n // Blocage : impossible d'envoyer si l'un des deux a bloqué l'autre\n const blockCheck = await sql`\n SELECT 1 FROM blocked_users\n WHERE (user_id = ${userId} AND blocked_user_id = ${recId})\n OR (user_id = ${recId} AND blocked_user_id = ${userId})\n LIMIT 1\n `;\n if (blockCheck.length > 0) {\n return c.json({\n error: \"Impossible d'envoyer un message : utilisateur bloqué.\",\n }, 403);\n }\n\n // Vérifier les paramètres de messages du destinataire\n let recipientSettings: any[] = [];\n try {\n recipientSettings = await sql`\n SELECT allow_dms, dms_enabled\n FROM user_settings\n WHERE user_id = ${recId}\n LIMIT 1\n `;\n } catch (settingsErr) {\n console.warn(\n \"[vibe-dms] Note: user_settings check skipped or table incomplete:\",\n settingsErr,\n );\n }\n\n if (recipientSettings.length > 0) {\n const s = recipientSettings[0];\n const dmPolicy = s.allow_dms || \"everyone\";\n const dmsEnabled = s.dms_enabled !== false;\n if (!dmsEnabled || dmPolicy === \"nobody\") {\n return c.json({\n error: \"Cet utilisateur n'accepte pas les messages privés.\",\n }, 403);\n }\n if (dmPolicy === \"following\") {\n const isFollowing = await sql`\n SELECT 1 FROM follows WHERE follower_id = ${recId} AND following_id = ${userId} LIMIT 1\n `;\n if (isFollowing.length === 0) {\n return c.json({\n error:\n \"Cet utilisateur n'accepte les messages que de ses abonnements.\",\n }, 403);\n }\n }\n }\n\n const p1 = userId < recId ? userId : recId;\n const p2 = userId < recId ? recId : userId;\n\n const convRows = await sql`\n INSERT INTO dm_conversations (participant_one_id, participant_two_id, last_message_preview, last_message_at)\n VALUES (${p1}, ${p2}, ${content.trim()}, NOW())\n ON CONFLICT (participant_one_id, participant_two_id)\n DO UPDATE SET last_message_preview = ${content.trim()}, last_message_at = NOW()\n RETURNING id\n `;\n\n const conversationId = convRows[0].id;\n const validReplyTo =\n typeof reply_to_id === \"string\" &&\n /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n .test(reply_to_id)\n ? reply_to_id\n : null;\n const msg = await sql`\n INSERT INTO direct_messages (conversation_id, sender_id, recipient_id, content, reply_to_id)\n VALUES (${conversationId}::uuid, ${userId}, ${recId}, ${content.trim()}, ${validReplyTo})\n RETURNING *\n `;\n\n try {\n await sql`\n INSERT INTO notifications (recipient_id, actor_id, type, message)\n VALUES (${recId}, ${userId}, 'dm', 'vous a envoyé un message')\n `;\n } catch {}\n\n // Réponse automatique pour le compte @bot de test\n const recipientUser =\n await sql`SELECT username FROM users WHERE id = ${recId} LIMIT 1`;\n if (recipientUser.length > 0 && recipientUser[0].username === \"bot\") {\n setTimeout(async () => {\n try {\n await sql`\n INSERT INTO direct_messages (conversation_id, sender_id, recipient_id, content)\n VALUES (${conversationId}::uuid, ${recId}, ${userId}, 'Bot')\n `;\n await sql`\n UPDATE dm_conversations SET last_message_preview = 'Bot', last_message_at = NOW()\n WHERE id = ${conversationId}::uuid\n `;\n } catch {}\n }, 100);\n }\n\n return c.json({ success: true, message: msg[0] }, 201);\n } catch (err: any) {\n console.error(\"[vibe-dms] Error in handleSendDM:\", err);\n return c.json({ error: err.message || \"Erreur envoi message.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/dms/messages\",\n \"/vibe/dms/messages\",\n \"/v1/dms/messages\",\n ], handleSendDM);\n\n // 4b. REACT TO A DM MESSAGE (toggle emoji)\n const handleReactDM = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const messageId = c.req.param(\"messageId\");\n const { emoji } = await c.req.json();\n\n if (\n !messageId || !emoji || typeof emoji !== \"string\" || emoji.length > 16\n ) {\n return c.json({ error: \"Message et emoji requis.\" }, 400);\n }\n\n const sql = getDb();\n\n // Vérifier que l'utilisateur fait bien partie de la conversation\n const msgRows = await sql`\n SELECT id, sender_id, recipient_id FROM direct_messages WHERE id = ${messageId}::uuid LIMIT 1\n `;\n if (msgRows.length === 0) {\n return c.json({ error: \"Message introuvable.\" }, 404);\n }\n const msg = msgRows[0];\n if (\n Number(msg.sender_id) !== userId && Number(msg.recipient_id) !== userId\n ) {\n return c.json({ error: \"Accès refusé.\" }, 403);\n }\n\n const existing = await sql`\n SELECT id FROM dm_reactions WHERE message_id = ${messageId}::uuid AND user_id = ${userId} AND emoji = ${emoji} LIMIT 1\n `;\n\n let reacted: boolean;\n if (existing.length > 0) {\n await sql`DELETE FROM dm_reactions WHERE id = ${existing[0].id}`;\n reacted = false;\n } else {\n await sql`\n INSERT INTO dm_reactions (message_id, user_id, emoji)\n VALUES (${messageId}::uuid, ${userId}, ${emoji})\n ON CONFLICT (message_id, user_id, emoji) DO NOTHING\n `;\n reacted = true;\n }\n\n const all = await sql`\n SELECT emoji, user_id FROM dm_reactions WHERE message_id = ${messageId}::uuid\n `;\n const grouped: { emoji: string; count: number; mine: boolean }[] = [];\n for (const r of all) {\n const g = grouped.find((x) => x.emoji === r.emoji);\n if (g) {\n g.count += 1;\n g.mine = g.mine || Number(r.user_id) === userId;\n } else {\n grouped.push({\n emoji: r.emoji,\n count: 1,\n mine: Number(r.user_id) === userId,\n });\n }\n }\n\n return c.json({ success: true, reacted, reactions: grouped });\n } catch (err: any) {\n console.error(\"[vibe-dms] React error:\", err);\n return c.json({ error: \"Erreur réaction.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/dms/messages/:messageId/react\",\n \"/vibe/dms/messages/:messageId/react\",\n \"/v1/dms/messages/:messageId/react\",\n ], handleReactDM);\n\n // 4c. AI-GENERATED REPLY SUGGESTION (mAI dans les DMs)\n const handleDMGenerateReply = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const partnerId = Number(c.req.param(\"partnerId\"));\n\n const sql = getDb();\n const recent = await sql`\n SELECT m.content, m.sender_id, u.username as sender_username\n FROM direct_messages m\n JOIN users u ON u.id = m.sender_id\n WHERE (m.sender_id = ${userId} AND m.recipient_id = ${partnerId})\n OR (m.sender_id = ${partnerId} AND m.recipient_id = ${userId})\n ORDER BY m.created_at DESC\n LIMIT 10\n `;\n\n const partnerRow =\n await sql`SELECT username FROM users WHERE id = ${partnerId} LIMIT 1`;\n const partnerName = partnerRow[0]?.username || \"votre interlocuteur\";\n\n const transcript = recent\n .reverse()\n .map((m: any) =>\n `${\n m.sender_id === userId ? \"Moi\" : `@${m.sender_username}`\n }: ${m.content}`\n )\n .join(\"\\n\");\n\n if (!transcript.trim()) {\n return c.json({\n error: \"Aucun message à analyser pour suggérer une réponse.\",\n }, 400);\n }\n\n const prompt =\n `Tu es mAI, l'assistant de Vibe. Propose UNE seule réponse courte (2 phrases max), naturelle et amicale, ` +\n `que l'utilisateur pourrait envoyer à @${partnerName}. Réponds UNIQUEMENT avec le texte du message suggéré, sans guillemets ni préambule.\\n\\n` +\n `Conversation récente :\\n${transcript}`;\n\n const keyRows = await sql`\n SELECT api_key FROM mprojects_api_keys WHERE user_id::text = ${userId}::text LIMIT 1\n `.catch(() => []);\n const openRouterApiKey =\n (typeof (globalThis as any).Deno !== \"undefined\" &&\n (globalThis as any).Deno.env?.get(\"OPENROUTER_API_KEY\")) ||\n (typeof process !== \"undefined\" && process.env?.OPENROUTER_API_KEY) ||\n (keyRows.length > 0 ? keyRows[0].api_key : \"\");\n\n if (!openRouterApiKey) {\n return c.json({\n error: \"mAI n'est pas configuré (clé OpenRouter manquante).\",\n }, 503);\n }\n\n const aiRes = await fetch(\n \"https://openrouter.ai/api/v1/chat/completions\",\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${openRouterApiKey}`,\n \"Content-Type\": \"application/json\",\n \"HTTP-Referer\": \"https://mai.val.run\",\n \"X-Title\": \"mAI Social Assistant\",\n },\n body: JSON.stringify({\n model: \"google/gemini-2.5-flash:free\",\n messages: [\n {\n role: \"system\",\n content:\n \"Tu es mAI, l'assistant intégré au réseau social Vibe. Tu génères des réponses de messages privés courtes, naturelles et en français.\",\n },\n { role: \"user\", content: prompt },\n ],\n }),\n },\n );\n\n if (!aiRes.ok) {\n return c.json({ error: \"mAI est momentanément indisponible.\" }, 502);\n }\n const aiData = await aiRes.json();\n const suggestion = aiData.choices?.[0]?.message?.content;\n if (!suggestion) {\n return c.json({ error: \"mAI n'a pas pu générer de suggestion.\" }, 502);\n }\n\n return c.json({ success: true, suggestion: String(suggestion).trim() });\n } catch (err: any) {\n console.error(\"[vibe-dms] Generate reply error:\", err);\n return c.json(\n { error: err?.message || \"Erreur génération de réponse.\" },\n 500,\n );\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/dms/generate-reply/:partnerId\",\n \"/vibe/dms/generate-reply/:partnerId\",\n \"/v1/dms/generate-reply/:partnerId\",\n ], handleDMGenerateReply);\n\n // 4d. BLOCK / UNBLOCK / LIST BLOCKED USERS\n const handleBlock = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const { user_id } = await c.req.json();\n const targetId = Number(user_id);\n if (!targetId || targetId === userId) {\n return c.json({ error: \"Utilisateur invalide.\" }, 400);\n }\n\n const sql = getDb();\n await sql`\n INSERT INTO blocked_users (user_id, blocked_user_id)\n VALUES (${userId}, ${targetId})\n ON CONFLICT (user_id, blocked_user_id) DO NOTHING\n `;\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"[vibe-dms] Block error:\", err);\n return c.json({ error: \"Erreur blocage.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/dms/block\",\n \"/vibe/dms/block\",\n \"/v1/dms/block\",\n ], handleBlock);\n\n const handleUnblock = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const { user_id } = await c.req.json();\n const targetId = Number(user_id);\n if (!targetId) return c.json({ error: \"Utilisateur invalide.\" }, 400);\n\n const sql = getDb();\n await sql`DELETE FROM blocked_users WHERE user_id = ${userId} AND blocked_user_id = ${targetId}`;\n return c.json({ success: true });\n } catch (err: any) {\n return c.json({ error: \"Erreur déblocage.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/dms/unblock\",\n \"/vibe/dms/unblock\",\n \"/v1/dms/unblock\",\n ], handleUnblock);\n\n const handleListBlocked = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const sql = getDb();\n const rows = await sql`\n SELECT b.id, b.blocked_user_id, b.created_at,\n u.username as blocked_username,\n pr.display_name as blocked_display_name,\n pr.avatar_url as blocked_avatar_url\n FROM blocked_users b\n JOIN users u ON u.id = b.blocked_user_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE b.user_id = ${userId}\n ORDER BY b.created_at DESC\n `;\n return c.json({ blocked: rows });\n } catch (err: any) {\n return c.json({ error: \"Erreur liste bloqués.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/dms/blocked\",\n \"/vibe/dms/blocked\",\n \"/v1/dms/blocked\",\n ], handleListBlocked);\n\n // 4e. REPORT A CONVERSATION / MESSAGE\n const handleReport = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const { reported_user_id, reason, message_id } = await c.req.json();\n const targetId = Number(reported_user_id);\n if (!targetId) {\n return c.json({ error: \"Utilisateur à signaler requis.\" }, 400);\n }\n\n const sql = getDb();\n await sql`\n INSERT INTO dm_reports (reporter_id, reported_user_id, message_id, reason)\n VALUES (${userId}, ${targetId}, ${message_id || null}, ${\n String(reason || \"non précisé\").slice(0, 500)\n })\n `;\n return c.json({\n success: true,\n message: \"Signalement transmis à la modération.\",\n });\n } catch (err: any) {\n console.error(\"[vibe-dms] Report error:\", err);\n return c.json({ error: \"Erreur signalement.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/dms/report\",\n \"/vibe/dms/report\",\n \"/v1/dms/report\",\n ], handleReport);\n\n // 4f. RENAME A CONVERSATION (nom local, par utilisateur)\n const handleRenameConversation = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const partnerId = Number(c.req.param(\"partnerId\"));\n const { name } = await c.req.json();\n const customName = String(name || \"\").trim().slice(0, 50);\n\n const sql = getDb();\n if (!customName) {\n await sql`DELETE FROM dm_conv_meta WHERE user_id = ${userId} AND partner_id = ${partnerId}`;\n } else {\n await sql`\n INSERT INTO dm_conv_meta (user_id, partner_id, custom_name)\n VALUES (${userId}, ${partnerId}, ${customName})\n ON CONFLICT (user_id, partner_id)\n DO UPDATE SET custom_name = ${customName}\n `;\n }\n return c.json({ success: true, custom_name: customName || null });\n } catch (err: any) {\n console.error(\"[vibe-dms] Rename error:\", err);\n return c.json({ error: \"Erreur renommage.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/dms/conversations/:partnerId/rename\",\n \"/vibe/dms/conversations/:partnerId/rename\",\n \"/v1/dms/conversations/:partnerId/rename\",\n ], handleRenameConversation);\n\n // 4g. DELETE A CONVERSATION (côté compte courant : messages reçus/envoyés + conversation)\n const handleDeleteConversation = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const partnerId = Number(c.req.param(\"partnerId\"));\n if (!partnerId) return c.json({ error: \"Partenaire invalide.\" }, 400);\n\n const sql = getDb();\n await sql`\n DELETE FROM direct_messages\n WHERE (sender_id = ${userId} AND recipient_id = ${partnerId})\n OR (sender_id = ${partnerId} AND recipient_id = ${userId})\n `;\n await sql`\n DELETE FROM dm_conversations\n WHERE (participant_one_id = ${userId} AND participant_two_id = ${partnerId})\n OR (participant_one_id = ${partnerId} AND participant_two_id = ${userId})\n `;\n await sql`DELETE FROM dm_conv_meta WHERE (user_id = ${userId} AND partner_id = ${partnerId})`;\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"[vibe-dms] Delete conversation error:\", err);\n return c.json({ error: \"Erreur suppression conversation.\" }, 500);\n }\n };\n\n registerMulti(\"delete\", [\n \"/api/vibe/dms/conversations/:partnerId\",\n \"/vibe/dms/conversations/:partnerId\",\n \"/v1/dms/conversations/:partnerId\",\n ], handleDeleteConversation);\n\n // 4h. DELETE A SINGLE MESSAGE (seulement ses propres messages)\n const handleDeleteMessage = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n const messageId = c.req.param(\"messageId\");\n if (!messageId) return c.json({ error: \"Message invalide.\" }, 400);\n\n const sql = getDb();\n const rows =\n await sql`SELECT sender_id FROM direct_messages WHERE id = ${messageId}::uuid LIMIT 1`;\n if (rows.length === 0) {\n return c.json({ error: \"Message introuvable.\" }, 404);\n }\n if (Number(rows[0].sender_id) !== userId) {\n return c.json({\n error: \"Vous ne pouvez supprimer que vos propres messages.\",\n }, 403);\n }\n await sql`DELETE FROM dm_reactions WHERE message_id = ${messageId}::uuid`\n .catch(() => {});\n await sql`DELETE FROM direct_messages WHERE id = ${messageId}::uuid`;\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"[vibe-dms] Delete message error:\", err);\n return c.json({ error: \"Erreur suppression message.\" }, 500);\n }\n };\n\n registerMulti(\"delete\", [\n \"/api/vibe/dms/messages/:messageId\",\n \"/vibe/dms/messages/:messageId\",\n \"/v1/dms/messages/:messageId\",\n ], handleDeleteMessage);\n\n // 5. NOTIFICATIONS\n const handleNotifications = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const sql = getDb();\n const notifs = await sql`\n SELECT n.*, u.username as actor_username, pr.avatar_url as actor_avatar_url\n FROM notifications n\n LEFT JOIN users u ON u.id = n.actor_id\n LEFT JOIN profiles pr ON pr.user_id = u.id\n WHERE n.recipient_id = ${userId}\n ORDER BY n.created_at DESC\n LIMIT 50\n `;\n return c.json({ notifications: notifs });\n } catch (err: any) {\n return c.json({ error: \"Erreur notifications.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/notifications\",\n \"/vibe/notifications\",\n \"/v1/notifications\",\n ], handleNotifications);\n\n const handleMarkNotificationsRead = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const sql = getDb();\n await sql`UPDATE notifications SET is_read = TRUE WHERE recipient_id = ${userId}`;\n return c.json({ success: true });\n } catch (err: any) {\n return c.json({ error: \"Erreur.\" }, 500);\n }\n };\n\n registerMulti(\"post\", [\n \"/api/vibe/notifications/read\",\n \"/vibe/notifications/read\",\n \"/v1/notifications/read\",\n ], handleMarkNotificationsRead);\n\n // Compteur léger pour les badges — évite de charger toutes les notifications\n const handleUnreadCount = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = Number(payload.sub || (payload as any).id);\n\n const sql = getDb();\n const [notifRow] = await sql`\n SELECT COUNT(*)::int AS unread_notifications FROM notifications WHERE recipient_id = ${userId} AND NOT is_read\n `;\n const [dmRow] = await sql`\n SELECT COUNT(*)::int AS unread_messages FROM direct_messages\n WHERE recipient_id = ${userId} AND is_read = FALSE\n `;\n return c.json({\n unread_notifications: Number(notifRow?.unread_notifications || 0),\n unread_messages: Number(dmRow?.unread_messages || 0),\n });\n } catch (err: any) {\n return c.json({ error: \"Erreur.\" }, 500);\n }\n };\n\n registerMulti(\"get\", [\n \"/api/vibe/notifications/unread_count\",\n \"/vibe/notifications/unread_count\",\n \"/v1/notifications/unread_count\",\n ], handleUnreadCount);\n}",[218],"712f5af2-20f6-483e-b42e-475826ef30e4","vibe-common.ts","6198ed9e-a6e4-11f1-ada3-1607ee4eb77e",138,["D",1788363533453],2,"/**\n * ============================================================================\n * VIBE SOCIAL PLATFORM — COMMON HELPERS (vibe-common.ts)\n * Shared utilities for routes, JWT extraction & multi-alias registration\n * ============================================================================\n */\n\nimport type { Hono } from \"npm:hono@4\";\nimport { extractToken, getDb, verifyToken } from \"./config.ts\";\n\nexport type RegisterMultiFn = (\n method: \"get\" | \"post\" | \"delete\",\n paths: string[],\n handler: (c: any) => Promise<any> | any,\n) => void;\n\n/**\n * Creates a helper that registers multiple alias paths for a single route handler\n */\nexport function createRegisterMulti(app: Hono): RegisterMultiFn {\n return (\n method: \"get\" | \"post\" | \"delete\",\n paths: string[],\n handler: (c: any) => Promise<any> | any,\n ) => {\n for (const p of paths) {\n if (method === \"get\") app.get(p, handler);\n else if (method === \"post\") app.post(p, handler);\n else if (method === \"delete\") app.delete(p, handler);\n }\n };\n}\n\n/**\n * Extracts and verifies the JWT user ID from request headers\n */\nexport async function getAuthUserId(c: any): Promise<number | null> {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return null;\n const payload = await verifyToken(token);\n const userId = Number(\n payload.sub || (payload as any).id || (payload as any).userId,\n );\n if (!userId || isNaN(userId)) return null;\n return userId;\n } catch {\n return null;\n }\n}",[225],"96d6772a-6852-47dd-9807-2276cdd501a6","storage.ts","e973306e-9c6a-11f1-8111-1607ee4eb77e",173,["D",1788443331381],10,"import type { Hono } from \"npm:hono@4\";\nimport {\n extractTierFromApiKey,\n extractToken,\n getDb,\n getTierStorageLimitBytes,\n verifyToken,\n} from \"./config.ts\";\n\nexport interface StorageNode {\n id: number;\n endpoint: string;\n region: string;\n accessKeyId: string;\n secretAccessKey: string;\n bucket: string;\n publicUrl: string;\n}\n\nfunction cleanUrl(url: string, removeDefaultPort = true): string {\n let cleaned = (url || \"\").trim();\n if (cleaned.endsWith(\"/\")) {\n cleaned = cleaned.slice(0, -1);\n }\n if (removeDefaultPort) {\n // Normalise https://domaine.com:443 -> https://domaine.com pour des URLs publiques propres\n cleaned = cleaned.replace(\n /^https:\\/\\/([^/:]+):443(\\/.*)?$/,\n \"https://$1$2\",\n );\n cleaned = cleaned.replace(/^http:\\/\\/([^/:]+):80(\\/.*)?$/, \"http://$1$2\");\n }\n return cleaned;\n}\n\n/**\n * 10 buckets Z1 Storage par défaut en fallback (mai-storage-1 à mai-storage-10)\n */\nexport const DEFAULT_Z1_FALLBACK_BUCKETS = [\n \"mai-storage-1\",\n \"mai-storage-2\",\n \"mai-storage-3\",\n \"mai-storage-4\",\n \"mai-storage-5\",\n \"mai-storage-6\",\n \"mai-storage-7\",\n \"mai-storage-8\",\n \"mai-storage-9\",\n \"mai-storage-10\",\n];\n\nexport const TOTAL_STORAGE_NODES_COUNT = 10;\n\n/**\n * Récupère la liste des nœuds de stockage Z1 Storage / S3 configurés.\n * Supporte jusqu'à 10 comptes/buckets distincts (S3_BUCKET_1..10 / Z1_BUCKET_1..10) pour multiplier l'espace,\n * ou une liste séparée par des virgules (S3_BUCKETS / Z1_BUCKETS),\n * ou un pool de 10 buckets Z1 Storage (mai-storage-1 à mai-storage-10) en fallback automatique.\n */\nexport function getStorageNodes(): StorageNode[] {\n const nodes: StorageNode[] = [];\n\n const baseAccessKey = Deno.env.get(\"S3_ACCESS_KEY_ID\") ||\n Deno.env.get(\"Z1_ACCESS_KEY_ID\") ||\n \"\";\n const baseSecretKey = Deno.env.get(\"S3_SECRET_ACCESS_KEY\") ||\n Deno.env.get(\"Z1_SECRET_ACCESS_KEY\") ||\n \"\";\n const baseRawEndpoint = Deno.env.get(\"S3_ENDPOINT\") ||\n Deno.env.get(\"Z1_ENDPOINT\") ||\n \"https://s3.z1storage.com\";\n const baseEndpoint = cleanUrl(baseRawEndpoint);\n const baseRegion = Deno.env.get(\"S3_REGION\") ||\n Deno.env.get(\"Z1_REGION\") ||\n \"auto\";\n const baseBucket = Deno.env.get(\"S3_BUCKET\") ||\n Deno.env.get(\"Z1_BUCKET\") ||\n \"mai-storage-1\";\n const basePublicUrl = Deno.env.get(\"S3_PUBLIC_URL\") ||\n Deno.env.get(\"Z1_PUBLIC_URL\");\n\n // 1. Détection des configurations individuelles S3_BUCKET_1 à S3_BUCKET_10 (ou Z1_BUCKET_1 à 10)\n for (let i = 1; i <= TOTAL_STORAGE_NODES_COUNT; i++) {\n const bucket = Deno.env.get(`S3_BUCKET_${i}`) ||\n Deno.env.get(`S3_BUCKET${i}`) ||\n Deno.env.get(`Z1_BUCKET_${i}`) ||\n Deno.env.get(`Z1_BUCKET${i}`);\n const accessKeyId = Deno.env.get(`S3_ACCESS_KEY_ID_${i}`) ||\n Deno.env.get(`S3_ACCESS_KEY_ID${i}`) ||\n Deno.env.get(`Z1_ACCESS_KEY_ID_${i}`) ||\n Deno.env.get(`Z1_ACCESS_KEY_ID${i}`) ||\n baseAccessKey;\n const secretAccessKey = Deno.env.get(`S3_SECRET_ACCESS_KEY_${i}`) ||\n Deno.env.get(`S3_SECRET_ACCESS_KEY${i}`) ||\n Deno.env.get(`Z1_SECRET_ACCESS_KEY_${i}`) ||\n Deno.env.get(`Z1_SECRET_ACCESS_KEY${i}`) ||\n baseSecretKey;\n const rawEndpoint = Deno.env.get(`S3_ENDPOINT_${i}`) ||\n Deno.env.get(`S3_ENDPOINT${i}`) ||\n Deno.env.get(`Z1_ENDPOINT_${i}`) ||\n Deno.env.get(`Z1_ENDPOINT${i}`) ||\n baseEndpoint;\n const endpoint = cleanUrl(rawEndpoint);\n const region = Deno.env.get(`S3_REGION_${i}`) ||\n Deno.env.get(`S3_REGION${i}`) ||\n Deno.env.get(`Z1_REGION_${i}`) ||\n Deno.env.get(`Z1_REGION${i}`) ||\n baseRegion;\n const rawPublicUrl = Deno.env.get(`S3_PUBLIC_URL_${i}`) ||\n Deno.env.get(`S3_PUBLIC_URL${i}`) ||\n Deno.env.get(`Z1_PUBLIC_URL_${i}`) ||\n Deno.env.get(`Z1_PUBLIC_URL${i}`);\n\n let publicUrl = \"\";\n if (rawPublicUrl) {\n publicUrl = cleanUrl(rawPublicUrl);\n } else if (basePublicUrl) {\n publicUrl = `${cleanUrl(basePublicUrl)}/${bucket}`;\n } else if (bucket) {\n publicUrl = `${endpoint}/${bucket}`;\n }\n\n if (bucket && accessKeyId && secretAccessKey) {\n nodes.push({\n id: i,\n endpoint,\n region,\n accessKeyId,\n secretAccessKey,\n bucket,\n publicUrl: publicUrl || `${endpoint}/${bucket}`,\n });\n }\n }\n\n // 2. Si S3_BUCKETS ou Z1_BUCKETS (liste séparée par des virgules) est configuré\n if (nodes.length === 0) {\n const bucketsList = Deno.env.get(\"S3_BUCKETS\") ||\n Deno.env.get(\"Z1_BUCKETS\");\n if (bucketsList) {\n const bucketNames = bucketsList\n .split(\",\")\n .map((b) => b.trim())\n .filter(Boolean);\n\n bucketNames.forEach((bucket, idx) => {\n const id = idx + 1;\n let publicUrl = \"\";\n if (basePublicUrl) {\n publicUrl = `${cleanUrl(basePublicUrl)}/${bucket}`;\n } else {\n publicUrl = `${baseEndpoint}/${bucket}`;\n }\n\n nodes.push({\n id,\n endpoint: baseEndpoint,\n region: baseRegion,\n accessKeyId: baseAccessKey,\n secretAccessKey: baseSecretKey,\n bucket,\n publicUrl,\n });\n });\n }\n }\n\n // 3. Fallback automatique : 10 buckets Z1 Storage (mai-storage-1 à mai-storage-10)\n // Si moins de 10 nœuds sont configurés, on complète avec les 10 buckets Z1 Storage en fallback\n if (nodes.length < TOTAL_STORAGE_NODES_COUNT) {\n const fallbackEnvList = (\n Deno.env.get(\"Z1_FALLBACK_BUCKETS\") ||\n Deno.env.get(\"S3_FALLBACK_BUCKETS\") ||\n \"\"\n )\n .split(\",\")\n .map((b) => b.trim())\n .filter(Boolean);\n\n for (let i = 1; i <= TOTAL_STORAGE_NODES_COUNT; i++) {\n const exists = nodes.some((n) => n.id === i);\n if (!exists) {\n let fallbackBucketName = \"\";\n if (fallbackEnvList[i - 1]) {\n fallbackBucketName = fallbackEnvList[i - 1];\n } else if (i === 1 && baseBucket) {\n fallbackBucketName = baseBucket;\n } else if (DEFAULT_Z1_FALLBACK_BUCKETS[i - 1]) {\n fallbackBucketName = DEFAULT_Z1_FALLBACK_BUCKETS[i - 1];\n } else {\n fallbackBucketName = `mai-storage-${i}`;\n }\n\n const bucket = Deno.env.get(`S3_BUCKET_${i}`) ||\n Deno.env.get(`S3_BUCKET${i}`) ||\n Deno.env.get(`Z1_BUCKET_${i}`) ||\n Deno.env.get(`Z1_BUCKET${i}`) ||\n fallbackBucketName;\n\n const accessKeyId = Deno.env.get(`S3_ACCESS_KEY_ID_${i}`) ||\n Deno.env.get(`S3_ACCESS_KEY_ID${i}`) ||\n Deno.env.get(`Z1_ACCESS_KEY_ID_${i}`) ||\n Deno.env.get(`Z1_ACCESS_KEY_ID${i}`) ||\n baseAccessKey;\n\n const secretAccessKey = Deno.env.get(`S3_SECRET_ACCESS_KEY_${i}`) ||\n Deno.env.get(`S3_SECRET_ACCESS_KEY${i}`) ||\n Deno.env.get(`Z1_SECRET_ACCESS_KEY_${i}`) ||\n Deno.env.get(`Z1_SECRET_ACCESS_KEY${i}`) ||\n baseSecretKey;\n\n const rawEndpoint = Deno.env.get(`S3_ENDPOINT_${i}`) ||\n Deno.env.get(`S3_ENDPOINT${i}`) ||\n Deno.env.get(`Z1_ENDPOINT_${i}`) ||\n Deno.env.get(`Z1_ENDPOINT${i}`) ||\n baseEndpoint;\n const endpoint = cleanUrl(rawEndpoint);\n\n const region = Deno.env.get(`S3_REGION_${i}`) ||\n Deno.env.get(`S3_REGION${i}`) ||\n Deno.env.get(`Z1_REGION_${i}`) ||\n Deno.env.get(`Z1_REGION${i}`) ||\n baseRegion;\n\n const rawPublicUrl = Deno.env.get(`S3_PUBLIC_URL_${i}`) ||\n Deno.env.get(`S3_PUBLIC_URL${i}`) ||\n Deno.env.get(`Z1_PUBLIC_URL_${i}`) ||\n Deno.env.get(`Z1_PUBLIC_URL${i}`);\n\n let publicUrl = \"\";\n if (rawPublicUrl) {\n publicUrl = cleanUrl(rawPublicUrl);\n } else if (basePublicUrl) {\n publicUrl = `${cleanUrl(basePublicUrl)}/${bucket}`;\n } else {\n publicUrl = `${endpoint}/${bucket}`;\n }\n\n nodes.push({\n id: i,\n endpoint,\n region,\n accessKeyId,\n secretAccessKey,\n bucket,\n publicUrl,\n });\n }\n }\n }\n\n // Tri par ID croissant pour ordre déterministe\n nodes.sort((a, b) => a.id - b.id);\n return nodes;\n}\n\n/**\n * Retourne la liste ordonnée des nœuds de stockage pour le fallback.\n * Le nœud principal est placé en premier, suivi des autres buckets Z1 Storage en réserve (fallback).\n */\nexport function getFallbackNodes(primaryNode?: StorageNode): StorageNode[] {\n const allNodes = getStorageNodes();\n if (!primaryNode) return allNodes;\n const others = allNodes.filter((n) => n.id !== primaryNode.id);\n return [primaryNode, ...others];\n}\n\n/**\n * Effectue un upload S3 avec bascule automatique (fallback) sur les 10 nœuds/buckets\n * Z1 Storage configurés si le nœud principal échoue (erreur HTTP 4xx/5xx ou exception réseau).\n */\nexport async function uploadWithFallback(\n primaryNode: StorageNode,\n filePath: string,\n body: any,\n options: {\n contentType: string;\n acl?: string;\n },\n): Promise<{\n success: boolean;\n activeNode: StorageNode;\n publicUrl: string;\n error?: string;\n}> {\n const candidateNodes = getFallbackNodes(primaryNode);\n let lastError = \"\";\n\n for (const node of candidateNodes) {\n try {\n const s3Client = await buildS3Client(node);\n const uploadUrl = `${node.endpoint}/${node.bucket}/${filePath}`;\n const res = await s3Client.fetch(uploadUrl, {\n body,\n headers: {\n \"Content-Type\": options.contentType || \"application/octet-stream\",\n \"x-amz-acl\": options.acl || \"public-read\",\n },\n method: \"PUT\",\n });\n\n if (res.ok) {\n return {\n activeNode: node,\n publicUrl: `${node.publicUrl}/${filePath}`,\n success: true,\n };\n }\n\n lastError = await res.text().catch(() => `HTTP ${res.status}`);\n console.warn(\n `[Z1 Storage Fallback] Échec upload sur le bucket \"${node.bucket}\" (node ${node.id}, status ${res.status}): ${lastError}. Bascule sur le bucket suivant...`,\n );\n } catch (err: any) {\n lastError = err?.message || String(err);\n console.warn(\n `[Z1 Storage Fallback] Exception réseau sur le bucket \"${node.bucket}\" (node ${node.id}): ${lastError}. Bascule sur le bucket suivant...`,\n );\n }\n }\n\n return {\n activeNode: primaryNode,\n error: lastError,\n publicUrl: `${primaryNode.publicUrl}/${filePath}`,\n success: false,\n };\n}\n\n/**\n * Sélectionne un nœud de stockage dans le pool via un hachage déterministe (sharding équilibré).\n */\nexport function selectStorageNode(seed: string): StorageNode {\n const nodes = getStorageNodes();\n if (nodes.length <= 1) return nodes[0];\n\n let hash = 0;\n for (let i = 0; i < seed.length; i++) {\n hash = (hash << 5) - hash + seed.charCodeAt(i);\n hash |= 0; // Convertit en entier 32 bits\n }\n const index = Math.abs(hash) % nodes.length;\n return nodes[index];\n}\n\n/**\n * Retrouve le nœud de stockage et la clé brute d'un enregistrement existant.\n */\nexport function findStorageNodeForRecord(\n r2Key: string,\n fileUrl?: string,\n): { node: StorageNode; rawKey: string } {\n const nodes = getStorageNodes();\n\n // 1. Format explicite taggé : node-1:bucket-name:key-path\n if (r2Key && r2Key.startsWith(\"node-\")) {\n const parts = r2Key.split(\":\");\n if (parts.length >= 3) {\n const nodeId = parseInt(parts[0].replace(\"node-\", \"\"), 10);\n const found = nodes.find((n) => n.id === nodeId);\n if (found) {\n return { node: found, rawKey: parts.slice(2).join(\":\") };\n }\n }\n }\n\n // 2. Recherche par nom de bucket dans la clé ou l'URL\n for (const node of nodes) {\n if (r2Key && r2Key.startsWith(`${node.bucket}/`)) {\n return { node, rawKey: r2Key.slice(node.bucket.length + 1) };\n }\n if (\n fileUrl &&\n (fileUrl.includes(`/${node.bucket}/`) ||\n fileUrl.includes(`://${node.bucket}.`))\n ) {\n return { node, rawKey: r2Key };\n }\n }\n\n // 3. Fallback sur le premier nœud\n return { node: nodes[0], rawKey: r2Key };\n}\n\n/**\n * Crée un client S3 (compatible Z1 Storage / Cloudflare R2 / AWS S3) pour un nœud donné.\n */\nexport async function buildS3Client(node?: StorageNode) {\n const targetNode = node || getStorageNodes()[0];\n const { AwsClient } = await import(\"npm:aws4fetch\");\n return new AwsClient({\n accessKeyId: targetNode.accessKeyId,\n region: targetNode.region,\n secretAccessKey: targetNode.secretAccessKey,\n service: \"s3\",\n });\n}\n\n// Aliases de rétro-compatibilité\nexport const buildR2Client = buildS3Client;\nexport function getR2Endpoint(): string {\n return getStorageNodes()[0].endpoint;\n}\nexport function getR2Bucket(): string {\n return getStorageNodes()[0].bucket;\n}\nexport function getR2PublicBase(): string {\n return getStorageNodes()[0].publicUrl;\n}\n\nconst GIB = 1024 * 1024 * 1024;\n\n/** Formate un volume de quota: en Go au-delà de 1 GiB, sinon en Mo. */\nexport function formatQuotaBytes(bytes: number): string {\n if (bytes >= GIB) {\n return `${\n (Math.round((bytes / GIB) * 10) / 10).toString().replace(\".\", \",\")\n } Go`;\n }\n return `${Math.round(bytes / (1024 * 1024))} Mo`;\n}\n\nexport function registerStorageRoutes(app: Hono) {\n // POST /upload-avatar & /v1/upload-avatar\n const handleUploadAvatar = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const body = await c.req.parseBody();\n const file = body[\"avatar\"] || body[\"file\"];\n\n if (!(file instanceof File) || file.size === 0) {\n return c.json({ error: \"Fichier invalide ou non fourni.\" }, 400);\n }\n\n const MAX_AVATAR_SIZE = 10 * 1024 * 1024;\n if (file.size > MAX_AVATAR_SIZE) {\n return c.json({ error: \"Image trop volumineuse (max 10 MB).\" }, 413);\n }\n const ALLOWED_IMAGE_TYPES = [\n \"image/jpeg\",\n \"image/png\",\n \"image/webp\",\n \"image/gif\",\n ];\n if (file.type && !ALLOWED_IMAGE_TYPES.includes(file.type)) {\n return c.json({\n error: \"Format d'image non supporté (JPEG, PNG, WebP ou GIF requis).\",\n }, 400);\n }\n\n const primaryNode = selectStorageNode(`avatar-${userId}`);\n const ext = file.name.split(\".\").pop()?.replace(/[^a-zA-Z0-9]/g, \"\") ||\n \"jpg\";\n const filename = `avatars/${userId}-${Date.now()}.${ext}`;\n const arrayBuffer = await file.arrayBuffer();\n\n const uploadResult = await uploadWithFallback(\n primaryNode,\n filename,\n arrayBuffer,\n {\n contentType: file.type || \"image/jpeg\",\n acl: \"public-read\",\n },\n );\n\n if (!uploadResult.success) {\n console.error(\n \"Erreur Z1 Storage S3 (avatar, fallback épuisé):\",\n uploadResult.error,\n );\n return c.json(\n {\n error:\n \"L'upload a échoué sur tous les buckets de stockage. Vérifiez la configuration Z1 Storage (credentials S3) ou réessayez plus tard.\",\n details: uploadResult.error?.slice(0, 300),\n },\n 503,\n );\n }\n\n const publicUrl = uploadResult.publicUrl;\n\n const sql = getDb();\n await sql`UPDATE users SET avatar_url = ${publicUrl} WHERE id = ${\n Number(userId)\n }`;\n try {\n await sql`\n INSERT INTO profiles (user_id, avatar_url)\n VALUES (${Number(userId)}, ${publicUrl})\n ON CONFLICT (user_id)\n DO UPDATE SET avatar_url = ${publicUrl}, updated_at = NOW()\n `;\n } catch {}\n\n return c.json({ avatarUrl: publicUrl, success: true });\n } catch (err: any) {\n console.error(\"Upload Avatar Error:\", err);\n return c.json({ error: \"Erreur serveur lors de l'upload.\" }, 500);\n }\n };\n\n app.post(\"/upload-avatar\", handleUploadAvatar);\n app.post(\"/v1/upload-avatar\", handleUploadAvatar);\n app.post(\"/upload-avatar/\", handleUploadAvatar);\n app.post(\"/v1/upload-avatar/\", handleUploadAvatar);\n\n // POST /upload-file & /v1/upload-file (sécurisé: auth + validation 10MB + allowlist)\n const handleUploadFile = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n try {\n await verifyToken(token);\n } catch {\n return c.json({ error: \"Token invalide.\" }, 401);\n }\n\n const body = await c.req.parseBody();\n const file = body[\"file\"];\n\n if (!(file instanceof File)) {\n return c.json({ error: \"Fichier invalide ou non fourni.\" }, 400);\n }\n\n const MAX_FILE_SIZE = 50 * 1024 * 1024;\n if (file.size > MAX_FILE_SIZE) {\n return c.json({ error: \"Fichier trop volumineux (max 50 MB).\" }, 413);\n }\n if (file.size === 0) {\n return c.json({ error: \"Fichier vide.\" }, 400);\n }\n const isAllowed = file.type.startsWith(\"image/\") ||\n file.type.startsWith(\"video/\") ||\n file.type.startsWith(\"audio/\") ||\n file.type.startsWith(\"text/\") ||\n file.type === \"application/pdf\" ||\n file.type === \"application/json\";\n if (file.type && !isAllowed) {\n return c.json({ error: \"Type de fichier non autorisé.\" }, 400);\n }\n\n const cleanFilename = file.name.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n const filename = `uploads/${Date.now()}-${cleanFilename}`;\n\n const primaryNode = selectStorageNode(cleanFilename);\n const arrayBuffer = await file.arrayBuffer();\n\n const uploadResult = await uploadWithFallback(\n primaryNode,\n filename,\n arrayBuffer,\n {\n contentType: file.type || \"application/octet-stream\",\n acl: \"public-read\",\n },\n );\n\n if (!uploadResult.success) {\n console.error(\n \"Erreur Z1 Storage S3 (file, fallback épuisé):\",\n uploadResult.error,\n );\n return c.json(\n {\n error:\n \"L'upload a échoué sur tous les buckets de stockage. Vérifiez la configuration Z1 Storage (credentials S3) ou réessayez plus tard.\",\n details: uploadResult.error?.slice(0, 300),\n },\n 503,\n );\n }\n\n const publicUrl = uploadResult.publicUrl;\n\n return c.json({\n contentType: file.type || \"application/octet-stream\",\n pathname: filename,\n url: publicUrl,\n });\n } catch (err: any) {\n console.error(\"Upload File S3 Error:\", err);\n return c.json({ error: \"Erreur serveur lors de l'upload S3.\" }, 500);\n }\n };\n\n app.post(\"/upload-file\", handleUploadFile);\n app.post(\"/v1/upload-file\", handleUploadFile);\n app.post(\"/upload-file/\", handleUploadFile);\n app.post(\"/v1/upload-file/\", handleUploadFile);\n\n // ─────────────────────────────────────────────\n // GET /cloud/storage — Consommation actuelle de stockage\n // ─────────────────────────────────────────────\n const handleGetStorage = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n let userPlan = c.get(\"userPlan\") || \"Free\";\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n userPlan = (payload.tier as string) || userPlan;\n } catch {}\n }\n\n const sql = getDb();\n\n // Résolution du user_id réel via mprojects_api_keys si clé API transmise\n if (token) {\n try {\n const keyRows = await sql`\n SELECT k.user_id, u.tier, u.email, u.username\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${token}::text\n LIMIT 1\n `;\n if (keyRows.length > 0) {\n userId = keyRows[0].user_id;\n userPlan = keyRows[0].tier || userPlan;\n }\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const [userRes, usageRes] = await Promise.all([\n sql`SELECT tier FROM users WHERE id::text = ${userId}::text OR username = ${userId}::text OR email = ${userId}::text LIMIT 1`,\n sql`\n SELECT COALESCE(SUM(bytes_used::numeric), 0) as bytes_used, COALESCE(SUM(files_count::numeric), 0) as files_count \n FROM cloud_storage_usage \n WHERE (\n user_id = ${userId}::text \n OR user_id IN (SELECT id::text FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR user_id IN (SELECT email FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR user_id IN (SELECT username FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n ) LIMIT 1\n `.catch(() => []),\n ]);\n\n const keyTier = extractTierFromApiKey(token);\n const rawTier2 = keyTier || userRes[0]?.tier || userPlan || \"Free\";\n const tier = String(rawTier2).trim();\n const bytesUsed = Number(usageRes[0]?.bytes_used || 0);\n const filesCount = Number(usageRes[0]?.files_count || 0);\n const bytesLimit = getTierStorageLimitBytes(tier);\n const percentUsed = bytesLimit > 0\n ? Math.min(100, (bytesUsed / bytesLimit) * 100)\n : 0;\n\n return c.json({\n bytes_limit: bytesLimit,\n bytes_used: bytesUsed,\n files_count: filesCount,\n over_limit: bytesUsed >= bytesLimit,\n percent_used: Math.round(percentUsed * 100) / 100,\n tier,\n });\n } catch (err: any) {\n console.error(\"Cloud Storage Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n };\n\n app.get(\"/cloud/storage\", handleGetStorage);\n app.get(\"/v1/cloud/storage\", handleGetStorage);\n app.get(\"/storage\", handleGetStorage);\n app.get(\"/v1/storage\", handleGetStorage);\n\n // ─────────────────────────────────────────────\n // GET /cloud/files — Liste des fichiers de l'utilisateur\n // ─────────────────────────────────────────────\n const handleGetFiles = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n } catch {}\n }\n\n const sql = getDb();\n\n // Résolution du user_id réel via mprojects_api_keys si clé API transmise\n if (token) {\n try {\n const keyRows = await sql`\n SELECT k.user_id, u.tier, u.email, u.username\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${token}::text\n LIMIT 1\n `;\n if (keyRows.length > 0) {\n userId = keyRows[0].user_id;\n }\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const files = await sql`\n SELECT id, filename, original_name, url, size_bytes, mime_type, uploaded_at\n FROM cloud_files\n WHERE (\n user_id = ${userId}::text \n OR user_id IN (SELECT id::text FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR user_id IN (SELECT email FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR user_id IN (SELECT username FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n )\n ORDER BY uploaded_at DESC\n LIMIT 200\n `.catch(() => []);\n\n return c.json({ files, success: true });\n } catch (err: any) {\n console.error(\"Cloud Files Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n };\n\n app.get(\"/cloud/files\", handleGetFiles);\n app.get(\"/v1/cloud/files\", handleGetFiles);\n app.get(\"/files\", handleGetFiles);\n app.get(\"/v1/files\", handleGetFiles);\n\n // POST /cloud/upload & /v1/cloud/upload — Upload d'un fichier vers Z1 Storage avec fallback multi-buckets + mise à jour quota\n const handleCloudUpload = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n const sql = getDb();\n\n // Lire le fichier\n const body = await c.req.parseBody();\n const file = body[\"file\"];\n if (!(file instanceof File)) {\n return c.json({ error: \"Fichier invalide ou non fourni.\" }, 400);\n }\n\n const fileSize = file.size;\n if (fileSize === 0) {\n return c.json({ error: \"Le fichier est vide.\" }, 400);\n }\n const MAX_FILE_SIZE = 10 * 1024 * 1024;\n if (fileSize > MAX_FILE_SIZE) {\n return c.json({ error: \"Fichier trop volumineux (max 10 MB).\" }, 413);\n }\n const ALLOWED_CLOUD_TYPES = [\n \"image/jpeg\",\n \"image/png\",\n \"image/webp\",\n \"image/gif\",\n \"application/pdf\",\n \"text/plain\",\n \"text/markdown\",\n \"text/csv\",\n \"application/json\",\n ];\n const isCloudAllowed = !file.type ||\n ALLOWED_CLOUD_TYPES.includes(file.type) ||\n file.type.startsWith(\"image/\") ||\n file.type.startsWith(\"text/\") ||\n file.type === \"application/pdf\" ||\n file.type === \"application/json\";\n if (file.type && !isCloudAllowed) {\n return c.json({ error: \"Type de fichier non autorisé.\" }, 400);\n }\n\n // Vérifier le quota AVANT d'uploader\n const [userRes, usageRes] = await Promise.all([\n sql`SELECT tier FROM users WHERE id::text = ${userId}::text LIMIT 1`,\n sql`SELECT bytes_used FROM cloud_storage_usage WHERE user_id = ${userId}::text LIMIT 1`,\n ]);\n\n const rawTier = userRes[0]?.tier || \"Free\";\n const tier = String(rawTier).trim();\n const bytesUsed = Number(usageRes[0]?.bytes_used || 0);\n const bytesLimit = getTierStorageLimitBytes(tier);\n\n if (bytesUsed + fileSize > bytesLimit) {\n return c.json(\n {\n bytes_limit: bytesLimit,\n bytes_used: bytesUsed,\n error: `Quota de stockage dépassé. Vous utilisez ${\n formatQuotaBytes(bytesUsed)\n } sur ${formatQuotaBytes(bytesLimit)} (tier ${tier}).`,\n over_limit: true,\n },\n 413,\n );\n }\n\n // Générer une clé unique\n const ext = file.name\n .split(\".\")\n .pop()\n ?.replace(/[^a-zA-Z0-9]/g, \"\") || \"bin\";\n const uniqueId = crypto.randomUUID();\n const fileKey = `cloud/${userId}/${uniqueId}.${ext}`;\n const cleanOriginal = file.name;\n const cleanFilename = `${uniqueId}.${ext}`;\n\n // Sélectionner un nœud de stockage dans le pool à 10 buckets\n const primaryNode = selectStorageNode(`${userId}-${uniqueId}`);\n const arrayBuffer = await file.arrayBuffer();\n\n // Upload avec bascule automatique (fallback) sur les autres buckets du pool Z1 Storage\n const uploadResult = await uploadWithFallback(\n primaryNode,\n fileKey,\n arrayBuffer,\n {\n contentType: file.type || \"application/octet-stream\",\n acl: \"public-read\",\n },\n );\n\n if (!uploadResult.success) {\n console.error(\n \"Z1 Storage Upload Error (fallback épuisé):\",\n uploadResult.error,\n );\n return c.json(\n {\n error:\n \"Erreur lors de l'upload vers le stockage (tous les buckets en échec).\",\n },\n 500,\n );\n }\n\n const activeNode = uploadResult.activeNode;\n const storedKey = `node-${activeNode.id}:${activeNode.bucket}:${fileKey}`;\n const publicUrl = uploadResult.publicUrl;\n const mimeType = file.type || \"application/octet-stream\";\n\n // Insérer dans cloud_files\n const inserted = await sql`\n INSERT INTO cloud_files (user_id, filename, original_name, r2_key, url, size_bytes, mime_type)\n VALUES (${userId}::text, ${cleanFilename}, ${cleanOriginal}, ${storedKey}, ${publicUrl}, ${fileSize}, ${mimeType})\n RETURNING id, filename, original_name, url, size_bytes, mime_type, uploaded_at\n `;\n\n // Upsert cloud_storage_usage\n await sql`\n INSERT INTO cloud_storage_usage (user_id, bytes_used, files_count, updated_at)\n VALUES (${userId}::text, ${fileSize}, 1, NOW())\n ON CONFLICT (user_id)\n DO UPDATE SET\n bytes_used = cloud_storage_usage.bytes_used + ${fileSize},\n files_count = cloud_storage_usage.files_count + 1,\n updated_at = NOW()\n `;\n\n const newBytesUsed = bytesUsed + fileSize;\n const percentUsed = Math.round((newBytesUsed / bytesLimit) * 10_000) /\n 100;\n\n return c.json({\n file: inserted[0],\n percent_used: percentUsed,\n storage: {\n bytes_limit: bytesLimit,\n bytes_used: newBytesUsed,\n over_limit: newBytesUsed >= bytesLimit,\n percent_used: percentUsed,\n tier,\n },\n success: true,\n });\n } catch (err: any) {\n console.error(\"Cloud Upload Error:\", err);\n return c.json({ error: \"Erreur serveur lors de l'upload Cloud.\" }, 500);\n }\n };\n\n app.post(\"/cloud/upload\", handleCloudUpload);\n app.post(\"/v1/cloud/upload\", handleCloudUpload);\n app.post(\"/cloud/upload/\", handleCloudUpload);\n app.post(\"/v1/cloud/upload/\", handleCloudUpload);\n\n // DELETE /cloud/files/:id & /v1/cloud/files/:id — Suppression définitive d'un fichier\n const handleDeleteFile = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n const fileId = c.req.param(\"id\");\n const sql = getDb();\n\n // Récupérer le fichier (vérification propriété)\n const fileRes = await sql`\n SELECT id, r2_key, url, size_bytes\n FROM cloud_files\n WHERE id = ${fileId}::uuid AND user_id = ${userId}::text\n LIMIT 1\n `;\n\n if (fileRes.length === 0) {\n return c.json({ error: \"Fichier introuvable ou accès refusé.\" }, 404);\n }\n\n const { r2_key, url, size_bytes } = fileRes[0];\n\n // Identifier le nœud et supprimer de Z1 Storage\n const { node, rawKey } = findStorageNodeForRecord(r2_key, url);\n const s3Client = await buildS3Client(node);\n const deleteUrl = `${node.endpoint}/${node.bucket}/${rawKey}`;\n\n try {\n const delRes = await s3Client.fetch(deleteUrl, { method: \"DELETE\" });\n if (!delRes.ok && (!r2_key || !r2_key.startsWith(\"node-\"))) {\n // Si suppression échoue sur nœud par défaut pour un ancien fichier, tenter sur les autres nœuds du pool\n for (const fallbackNode of getFallbackNodes(node).slice(1)) {\n try {\n const fbClient = await buildS3Client(fallbackNode);\n const fbUrl =\n `${fallbackNode.endpoint}/${fallbackNode.bucket}/${rawKey}`;\n await fbClient.fetch(fbUrl, { method: \"DELETE\" });\n } catch {}\n }\n }\n } catch (s3Err) {\n console.error(\"Z1 Delete Error (continuing anyway):\", s3Err);\n }\n\n // Supprimer de la base de données\n await sql`DELETE FROM cloud_files WHERE id = ${fileId}::uuid AND user_id = ${userId}::text`;\n\n // Décrémenter cloud_storage_usage\n await sql`\n UPDATE cloud_storage_usage\n SET\n bytes_used = GREATEST(0, bytes_used - ${size_bytes}),\n files_count = GREATEST(0, files_count - 1),\n updated_at = NOW()\n WHERE user_id = ${userId}::text\n `;\n\n return c.json({ id: fileId, success: true });\n } catch (err: any) {\n console.error(\"Cloud Delete Error:\", err);\n return c.json({ error: \"Erreur serveur lors de la suppression.\" }, 500);\n }\n };\n\n app.delete(\"/cloud/files/:id\", handleDeleteFile);\n app.delete(\"/v1/cloud/files/:id\", handleDeleteFile);\n}",[233],"76e319ec-e341-4d35-8ecc-66d1efe8743d","projects.ts","e972f7ac-9c6a-11f1-8111-1607ee4eb77e",163,["D",1788366740710],"import type { Hono } from \"npm:hono@4\";\nimport { getDb } from \"./config.ts\";\n\nexport const STATIC_PROJECTS_LIST = [\n {\n category: \"Web Application\",\n created_at: \"2026-08-01T00:00:00.000Z\",\n description:\n \"Application d'IA en ligne web directement et simplement pour discuter avec l'IA mAI.\",\n features: [\"Chat Web\", \"Interface fluide\", \"Streaming en direct\"],\n id: \"proj_web\",\n is_public: true,\n label: \"Release Candidate\",\n name: \"Web\",\n project_id: \"web\",\n repository: \"https://github.com/mDevsLabs/Web\",\n status: \"rc\",\n version: \"0.1.0\",\n },\n {\n category: \"Social Network\",\n created_at: \"2026-09-01T00:00:00.000Z\",\n description:\n \"Réseau social open source où l'IA mAI est intégrée nativement : feed social, conversations et création de contenu assistée.\",\n features: [\n \"Feed social\",\n \"IA mAI intégrée\",\n \"Création assistée\",\n \"Open Source\",\n ],\n id: \"proj_vibe\",\n is_public: true,\n label: \"Bêta\",\n name: \"Vibe\",\n project_id: \"vibe\",\n repository: \"https://github.com/mDevsLabs/Vibe\",\n status: \"beta\",\n version: \"0.1.0\",\n },\n {\n category: \"Extensions\",\n created_at: \"2026-08-05T00:00:00.000Z\",\n description:\n \"Ensemble d'extensions pour diverses applications pour discuter avec mAI directement (navigateur, VS Code...).\",\n features: [\"Extension navigateur\", \"Extension VS Code\", \"Accès contextuel\"],\n id: \"proj_pulse\",\n is_public: true,\n label: \"Release Candidate\",\n name: \"Pulse\",\n project_id: \"pulse\",\n repository: \"https://github.com/mDevsLabs/Pulse\",\n status: \"rc\",\n version: \"0.2.0\",\n },\n {\n category: \"Developer Tools\",\n created_at: \"2026-08-10T00:00:00.000Z\",\n description:\n \"Discussions et séances de codage dans le terminal CLI via mAI.\",\n features: [\n \"Terminal interactif\",\n \"Génération de code\",\n \"Workflows développeur\",\n ],\n id: \"proj_cli\",\n is_public: true,\n label: \"Release Candidate\",\n name: \"CLI\",\n project_id: \"cli\",\n repository: \"https://github.com/mDevsLabs/CLI\",\n status: \"rc\",\n version: \"0.5.0\",\n },\n {\n category: \"Developer Tools\",\n created_at: \"2026-08-20T00:00:00.000Z\",\n description:\n \"IDE IA de nouvelle génération avec agents IA autonomes, orchestration multi-modèles et support natif des outils MCP.\",\n features: [\n \"IDE IA Intelligent\",\n \"Agents Autonomes\",\n \"Outils MCP\",\n \"Multi-Modèles\",\n ],\n id: \"proj_coder\",\n is_public: true,\n label: \"Release Candidate\",\n name: \"Coder\",\n project_id: \"coder\",\n repository: \"https://github.com/mDevsLabs/Coder\",\n status: \"rc\",\n version: \"0.1.0\",\n },\n {\n category: \"Cloud & Storage\",\n created_at: \"2026-08-15T00:00:00.000Z\",\n description:\n \"Stockage cloud de documents et intégration d'mAI pour des résumés.\",\n features: [\n \"Stockage sécurisé\",\n \"Résumés automatiques\",\n \"Indexation de documents\",\n ],\n id: \"proj_cloud\",\n is_public: true,\n label: \"Réflexion\",\n name: \"Cloud\",\n project_id: \"cloud\",\n repository: \"\",\n status: \"conception\",\n version: \"0.0.1\",\n },\n {\n category: \"Site & Web\",\n created_at: \"2026-08-01T00:00:00.000Z\",\n description: \"Site officiel et application web mAI.\",\n features: [\"Site\", \"Web App\"],\n id: \"proj_site\",\n is_public: true,\n label: \"Alpha\",\n name: \"Site\",\n project_id: \"site\",\n repository: \"https://github.com/mDevsLabs/Site\",\n status: \"alpha\",\n version: \"0.1.0\",\n },\n {\n category: \"Extensions\",\n created_at: \"2026-08-05T00:00:00.000Z\",\n description: \"Extension Pulse pour le navigateur web.\",\n features: [\"Extension navigateur\", \"Chat mAI\"],\n id: \"proj_pulse_web\",\n is_public: true,\n label: \"Bêta\",\n name: \"Pulse - Web\",\n project_id: \"pulse-web\",\n repository: \"https://github.com/mDevsLabs/Pulse-Web\",\n status: \"beta\",\n version: \"0.2.0\",\n },\n {\n category: \"Extensions\",\n created_at: \"2026-08-05T00:00:00.000Z\",\n description: \"Extension Pulse pour l'IDE JetBrains.\",\n features: [\"Extension JetBrains\", \"Contextuel\"],\n id: \"proj_pulse_jetbrains\",\n is_public: true,\n label: \"Bêta\",\n name: \"Pulse - JetBrains\",\n project_id: \"pulse-jetbrains\",\n repository: \"https://github.com/mDevsLabs/Pulse-JetBrains\",\n status: \"beta\",\n version: \"0.2.0\",\n },\n {\n category: \"Extensions\",\n created_at: \"2026-08-05T00:00:00.000Z\",\n description: \"Extension Pulse pour VS Code.\",\n features: [\"Extension VS Code\", \"Chat mAI\"],\n id: \"proj_pulse_vscode\",\n is_public: true,\n label: \"Bêta\",\n name: \"Pulse - VS Code\",\n project_id: \"pulse-vscode\",\n repository: \"https://github.com/mDevsLabs/Pulse-VSCode\",\n status: \"beta\",\n version: \"0.2.0\",\n },\n {\n category: \"Desktop\",\n created_at: \"2026-08-15T00:00:00.000Z\",\n description: \"Application desktop intégrée mAI.\",\n features: [\"Desktop\", \"Notifications\", \"Local\"],\n id: \"proj_desktop\",\n is_public: true,\n label: \"Concept\",\n name: \"Desktop\",\n project_id: \"desktop\",\n repository: \"https://github.com/mDevsLabs/Desktop\",\n status: \"conception\",\n version: \"0.0.1\",\n },\n {\n category: \"Skills\",\n created_at: \"2026-08-10T00:00:00.000Z\",\n description: \"Compétences et agents spécialisés mAI.\",\n features: [\"Agents\", \"Workflows\"],\n id: \"proj_skills\",\n is_public: true,\n label: \"Concept\",\n name: \"Skills\",\n project_id: \"skills\",\n repository: \"https://github.com/mDevsLabs/Skills\",\n status: \"conception\",\n version: \"0.0.1\",\n },\n {\n category: \"Plugins\",\n created_at: \"2026-08-10T00:00:00.000Z\",\n description: \"Écosystème de plugins mAI.\",\n features: [\"Plugins\", \"Intégrations\"],\n id: \"proj_plugins\",\n is_public: true,\n label: \"Concept\",\n name: \"Plugins\",\n project_id: \"plugins\",\n repository: \"https://github.com/mDevsLabs/Plugins\",\n status: \"conception\",\n version: \"0.0.1\",\n },\n {\n category: \"API\",\n created_at: \"2026-03-01T00:00:00.000Z\",\n description: \"Hub API mAI et agrégation de modèles.\",\n features: [\"API Gateway\", \"Modèles LLM\"],\n id: \"proj_api\",\n is_public: true,\n label: \"Bêta\",\n name: \"API\",\n project_id: \"api\",\n repository: \"https://github.com/mDevsLabs/API\",\n status: \"beta\",\n version: \"0.5.0\",\n },\n {\n category: \"Autre\",\n created_at: \"2026-08-01T00:00:00.000Z\",\n description: \"Autres projets et expérimentations mAI.\",\n features: [\"Expérimentations\"],\n id: \"proj_autre\",\n is_public: true,\n label: \"Concept\",\n name: \"Autre\",\n project_id: \"autre\",\n repository: \"\",\n status: \"conception\",\n version: \"0.0.1\",\n },\n {\n category: \"Search Engine\",\n created_at: \"2026-02-01T00:00:00.000Z\",\n description:\n \"Moteur de recherche sémantique et d'indexation vectorielle ultra-rapide.\",\n features: [\"Indexation hybride\", \"Recherche locale\"],\n id: \"proj_msearch\",\n is_public: true,\n label: \"Archivé\",\n name: \"mSearch\",\n project_id: \"msearch\",\n repository: \"https://github.com/mDevsLabs/mSearch\",\n status: \"archived\",\n version: \"1.0.3\",\n },\n {\n category: \"API Gateway\",\n created_at: \"2026-03-01T00:00:00.000Z\",\n description:\n \"Hub universel d'agrégation et de routage intelligent d'API et modèles LLM.\",\n features: [\"Load balancing\", \"Multi-fournisseurs\"],\n id: \"proj_openprovider\",\n is_public: true,\n label: \"Archivé\",\n name: \"OpenProvider\",\n project_id: \"openprovider\",\n repository: \"https://github.com/mDevsLabs/OpenProvider\",\n status: \"archived\",\n version: \"0.5.0\",\n },\n {\n category: \"Games\",\n created_at: \"2026-03-15T00:00:00.000Z\",\n description: \"Jeu vidéo du style Block Blast\",\n features: [\"Video game\", \"Assembler\"],\n id: \"proj_snob\",\n is_public: true,\n label: \"Archivé\",\n name: \"Snob\",\n project_id: \"snob\",\n repository: \"https://github.com/mDevsLabs/Snob\",\n status: \"archived\",\n version: \"1.0.1\",\n },\n {\n category: \"AI Suite\",\n created_at: \"2026-01-15T00:00:00.000Z\",\n description: \"Ancienne interface web de mAI.\",\n features: [\"Chat Completions\", \"Embeddings\"],\n id: \"proj_mai_legacy\",\n is_public: true,\n label: \"Archivé\",\n name: \"mAI Web (Legacy)\",\n project_id: \"mai\",\n repository: \"https://github.com/mDevsLabs/mAI\",\n status: \"archived\",\n version: \"2.4.0\",\n },\n];\n\nexport const STATIC_PROJECTS_MAP: Record<string, any> = {\n cli: {\n category: \"Developer Tools\",\n created_at: \"2026-08-10T00:00:00.000Z\",\n description:\n \"Discussions et séances de codage dans le terminal CLI via mAI.\",\n is_public: true,\n label: \"Bêta\",\n name: \"CLI\",\n project_id: \"cli\",\n repository: \"https://github.com/mDevsLabs/CLI\",\n status: \"beta\",\n },\n cloud: {\n category: \"Cloud & Storage\",\n created_at: \"2026-08-15T00:00:00.000Z\",\n description:\n \"Stockage cloud de documents et intégration d'mAI pour des résumés.\",\n is_public: true,\n label: \"Réflexion\",\n name: \"Cloud\",\n project_id: \"cloud\",\n repository: \"\",\n status: \"conception\",\n },\n coder: {\n category: \"Developer Tools\",\n created_at: \"2026-08-20T00:00:00.000Z\",\n description:\n \"IDE IA de nouvelle génération avec agents IA autonomes, orchestration multi-modèles et support natif des outils MCP.\",\n is_public: true,\n label: \"Alpha\",\n name: \"Coder\",\n project_id: \"coder\",\n repository: \"https://github.com/mDevsLabs/Coder\",\n status: \"alpha\",\n },\n mai: {\n category: \"AI Suite\",\n created_at: \"2026-01-15T00:00:00.000Z\",\n description: \"Ancienne interface web de mAI.\",\n is_public: true,\n label: \"Archivé\",\n name: \"mAI Web (Legacy)\",\n project_id: \"mai\",\n repository: \"https://github.com/mDevsLabs/mAI\",\n status: \"archived\",\n },\n maicli: {\n category: \"CLI Tool\",\n created_at: \"2026-02-10T00:00:00.000Z\",\n description:\n \"Interface en ligne de commande professionnelle pour l'écosystème mAI.\",\n is_public: true,\n label: \"Archivé\",\n name: \"mAI CLI (Legacy)\",\n project_id: \"maicli\",\n repository: \"https://github.com/mDevsLabs/mAI-CLI\",\n status: \"archived\",\n },\n msearch: {\n category: \"Search Engine\",\n created_at: \"2026-02-01T00:00:00.000Z\",\n description: \"Moteur de recherche sémantique et d'indexation vectorielle.\",\n is_public: true,\n label: \"Archivé\",\n name: \"mSearch\",\n project_id: \"msearch\",\n repository: \"https://github.com/mDevsLabs/mSearch\",\n status: \"archived\",\n },\n site: {\n category: \"Site & Web\",\n created_at: \"2026-08-01T00:00:00.000Z\",\n description: \"Site officiel et application web mAI.\",\n is_public: true,\n label: \"Alpha\",\n name: \"Site\",\n project_id: \"site\",\n repository: \"https://github.com/mDevsLabs/Site\",\n status: \"alpha\",\n },\n \"pulse-web\": {\n category: \"Extensions\",\n created_at: \"2026-08-05T00:00:00.000Z\",\n description: \"Extension Pulse pour le navigateur web.\",\n is_public: true,\n label: \"Bêta\",\n name: \"Pulse - Web\",\n project_id: \"pulse-web\",\n repository: \"https://github.com/mDevsLabs/Pulse-Web\",\n status: \"beta\",\n },\n \"pulse-jetbrains\": {\n category: \"Extensions\",\n created_at: \"2026-08-05T00:00:00.000Z\",\n description: \"Extension Pulse pour l'IDE JetBrains.\",\n is_public: true,\n label: \"Bêta\",\n name: \"Pulse - JetBrains\",\n project_id: \"pulse-jetbrains\",\n repository: \"https://github.com/mDevsLabs/Pulse-JetBrains\",\n status: \"beta\",\n },\n \"pulse-vscode\": {\n category: \"Extensions\",\n created_at: \"2026-08-05T00:00:00.000Z\",\n description: \"Extension Pulse pour VS Code.\",\n is_public: true,\n label: \"Bêta\",\n name: \"Pulse - VS Code\",\n project_id: \"pulse-vscode\",\n repository: \"https://github.com/mDevsLabs/Pulse-VSCode\",\n status: \"beta\",\n },\n desktop: {\n category: \"Desktop\",\n created_at: \"2026-08-15T00:00:00.000Z\",\n description: \"Application desktop intégrée mAI.\",\n is_public: true,\n label: \"Concept\",\n name: \"Desktop\",\n project_id: \"desktop\",\n repository: \"https://github.com/mDevsLabs/Desktop\",\n status: \"conception\",\n },\n skills: {\n category: \"Skills\",\n created_at: \"2026-08-10T00:00:00.000Z\",\n description: \"Compétences et agents spécialisés mAI.\",\n is_public: true,\n label: \"Concept\",\n name: \"Skills\",\n project_id: \"skills\",\n repository: \"https://github.com/mDevsLabs/Skills\",\n status: \"conception\",\n },\n plugins: {\n category: \"Plugins\",\n created_at: \"2026-08-10T00:00:00.000Z\",\n description: \"Écosystème de plugins mAI.\",\n is_public: true,\n label: \"Concept\",\n name: \"Plugins\",\n project_id: \"plugins\",\n repository: \"https://github.com/mDevsLabs/Plugins\",\n status: \"conception\",\n },\n api: {\n category: \"API\",\n created_at: \"2026-03-01T00:00:00.000Z\",\n description: \"Hub API mAI et agrégation de modèles.\",\n is_public: true,\n label: \"Bêta\",\n name: \"API\",\n project_id: \"api\",\n repository: \"https://github.com/mDevsLabs/API\",\n status: \"beta\",\n },\n autre: {\n category: \"Autre\",\n created_at: \"2026-08-01T00:00:00.000Z\",\n description: \"Autres projets et expérimentations mAI.\",\n is_public: true,\n label: \"Concept\",\n name: \"Autre\",\n project_id: \"autre\",\n repository: \"\",\n status: \"conception\",\n },\n openprovider: {\n category: \"API Gateway\",\n created_at: \"2026-03-01T00:00:00.000Z\",\n description:\n \"Hub universel d'agrégation et de routage d'API et modèles LLM.\",\n is_public: true,\n label: \"Archivé\",\n name: \"OpenProvider\",\n project_id: \"openprovider\",\n repository: \"https://github.com/mDevsLabs/OpenProvider\",\n status: \"archived\",\n },\n pulse: {\n category: \"Extensions\",\n created_at: \"2026-08-05T00:00:00.000Z\",\n description:\n \"Ensemble d'extensions pour diverses applications pour discuter avec mAI directement (navigateur, VS Code...).\",\n is_public: true,\n label: \"Bêta\",\n name: \"Pulse\",\n project_id: \"pulse\",\n repository: \"https://github.com/mDevsLabs/Pulse\",\n status: \"beta\",\n },\n snob: {\n category: \"Games\",\n created_at: \"2026-03-15T00:00:00.000Z\",\n description: \"Jeu vidéo du style Block Blast.\",\n is_public: true,\n label: \"Archivé\",\n name: \"Snob\",\n project_id: \"snob\",\n repository: \"https://github.com/mDevsLabs/Snob\",\n status: \"archived\",\n },\n web: {\n category: \"Web Application\",\n created_at: \"2026-08-01T00:00:00.000Z\",\n description:\n \"Application d'IA en ligne web directement et simplement pour discuter avec l'IA mAI.\",\n is_public: true,\n label: \"Alpha\",\n name: \"Web\",\n project_id: \"web\",\n repository: \"https://github.com/mDevsLabs/Web\",\n status: \"alpha\",\n },\n};\n\nexport function registerProjectRoutes(app: Hono) {\n // GET /v1/projects\n app.get(\"/v1/projects\", async (c) => {\n try {\n const sql = getDb();\n const userId = c.get(\"userId\");\n const dbProjects =\n await sql`SELECT * FROM mprojects_projects WHERE user_id = ${userId} ORDER BY created_at DESC LIMIT 50`;\n return c.json({\n data: [...STATIC_PROJECTS_LIST, ...dbProjects],\n object: \"list\",\n });\n } catch (_err) {\n return c.json({ data: STATIC_PROJECTS_LIST, object: \"list\" });\n }\n });\n\n // POST /v1/projects\n app.post(\"/v1/projects\", async (c) => {\n const sql = getDb();\n const userId = c.get(\"userId\");\n const body = await c.req.json();\n if (!body.name) {\n return c.json({ error: \"Le nom du projet est obligatoire.\" }, 400);\n }\n\n const projectId = \"proj-\" + Math.random().toString(36).substr(2, 9);\n\n await sql`\n INSERT INTO mprojects_projects (user_id, project_id, name, description, is_public)\n VALUES (${userId}, ${projectId}, ${body.name}, ${\n body.description || \"\"\n }, ${body.isPublic || false})\n `;\n\n return c.json({ name: body.name, project_id: projectId, success: true });\n });\n\n // GET /v1/projects/:id\n app.get(\"/v1/projects/:id\", async (c) => {\n const projectId = c.req.param(\"id\").toLowerCase();\n\n if (STATIC_PROJECTS_MAP[projectId]) {\n return c.json({ project: STATIC_PROJECTS_MAP[projectId] });\n }\n\n const sql = getDb();\n const userId = c.get(\"userId\");\n const projects = await sql`\n SELECT * FROM mprojects_projects \n WHERE (user_id = ${userId} OR is_public = TRUE) AND LOWER(project_id) = ${projectId} \n LIMIT 1\n `;\n\n if (projects.length === 0) {\n return c.json({ error: \"Project not found\" }, 404);\n }\n\n return c.json({ project: projects[0] });\n });\n\n // PUT /v1/projects/:id\n app.put(\"/v1/projects/:id\", async (c) => {\n const sql = getDb();\n const userId = c.get(\"userId\");\n const projectId = c.req.param(\"id\");\n const body = await c.req.json();\n\n const existing =\n await sql`SELECT id FROM mprojects_projects WHERE user_id = ${userId} AND project_id = ${projectId} LIMIT 1`;\n if (existing.length === 0) {\n return c.json({ error: \"Projet non trouvé ou non autorisé.\" }, 404);\n }\n\n const name = body.name;\n const description = body.description;\n const isPublic = body.isPublic;\n\n await sql`\n UPDATE mprojects_projects\n SET name = COALESCE(${name}, name),\n description = COALESCE(${description}, description),\n is_public = COALESCE(${isPublic}, is_public),\n updated_at = NOW()\n WHERE user_id = ${userId} AND project_id = ${projectId}\n `;\n\n return c.json({\n message: \"Projet mis à jour.\",\n project_id: projectId,\n success: true,\n });\n });\n\n // DELETE /v1/projects/:id\n app.delete(\"/v1/projects/:id\", async (c) => {\n const sql = getDb();\n const userId = c.get(\"userId\");\n const projectId = c.req.param(\"id\");\n\n const result = await sql`\n DELETE FROM mprojects_projects \n WHERE user_id = ${userId} AND project_id = ${projectId}\n RETURNING id\n `;\n\n if (result.length === 0) {\n return c.json({ error: \"Projet non trouvé ou déjà supprimé.\" }, 404);\n }\n\n return c.json({ message: \"Projet supprimé avec succès.\", success: true });\n });\n\n // GET /v1/projects/:id/stats\n app.get(\"/v1/projects/:id/stats\", async (c) => {\n const sql = getDb();\n const userId = c.get(\"userId\");\n const projectId = c.req.param(\"id\");\n\n const projects =\n await sql`SELECT id, name, created_at FROM mprojects_projects WHERE user_id = ${userId} AND project_id = ${projectId} LIMIT 1`;\n if (projects.length === 0) {\n return c.json({ error: \"Projet non trouvé.\" }, 404);\n }\n\n return c.json({\n active_deployments: 1,\n name: projects[0].name,\n project_id: projectId,\n requests_count: Math.floor(Math.random() * 500) + 12,\n status: \"healthy\",\n uptime_percentage: 99.98,\n });\n });\n}",[241],"62414cd7-441f-4690-bb82-ff1b42254a74","models.ts","e972ab30-9c6a-11f1-8111-1607ee4eb77e",180,["D",1788445263190],24,"import type { Hono } from \"npm:hono@4\";\nimport {\n extractToken,\n getDb,\n getTierMaiTokenLimit,\n getTierSpeechLimit,\n getUserQuotaBoost,\n getWeekData,\n isPaidTier,\n verifyToken,\n} from \"./config.ts\";\nimport { maiModelsList } from \"./maiModels.ts\";\n\nfunction getOpenRouterApiKey(userCustomKey?: string | null): string {\n if (userCustomKey && userCustomKey.trim().startsWith(\"sk-or-\")) {\n return userCustomKey.trim();\n }\n return Deno.env.get(\"OPENROUTER_API_KEY\") || \"\";\n}\n\nexport function registerModelRoutes(app: Hono) {\n // ─────────────────────────────────────────────\n // GET /v1/usage & /usage\n // ─────────────────────────────────────────────\n const handleGetUsage = async (c: any) => {\n try {\n const token = extractToken(c.req.raw) || (c as any).get?.(\"apiKey\");\n let userId = (c as any).get?.(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n } catch {}\n }\n\n const sql = getDb();\n\n // Résolution de l'identifiant via mprojects_api_keys si clé API fournie\n if (token) {\n try {\n const keyRows = await sql`\n SELECT k.user_id, u.tier, u.email, u.username\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${token}::text\n LIMIT 1\n `;\n if (keyRows.length > 0) {\n userId = keyRows[0].user_id;\n }\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const { weekStartStr, nextResetIso } = getWeekData();\n\n const userResult =\n await sql`SELECT id, tier, email, username, phone, avatar_url FROM users WHERE id::text = ${userId}::text OR username = ${userId}::text OR email = ${userId}::text LIMIT 1`;\n const user = userResult[0];\n const resolvedUserId = user ? user.id : userId;\n\n const [usageResult, speechResult] = await Promise.all([\n sql`\n SELECT COALESCE(SUM(tokens_used::numeric), 0) as tokens_used \n FROM weekly_usage \n WHERE user_id = ${resolvedUserId}::integer AND week_start = ${weekStartStr}::date\n `.catch((e) => {\n console.error(\"[usageResult] Error:\", e);\n return [];\n }),\n sql`\n SELECT COALESCE(SUM(tokens_used::numeric), 0) as tokens_used \n FROM weekly_speech_usage \n WHERE user_id = ${resolvedUserId}::text AND week_start = ${weekStartStr}::date\n `.catch((e) => {\n console.error(\"[speechResult] Error:\", e);\n return [];\n }),\n ]);\n const tokensUsed = usageResult[0]?.tokens_used || 0;\n const speechTokensUsed = Number(speechResult?.[0]?.tokens_used || 0);\n const userTier = user?.tier || \"Free\";\n const maiBoost = await getUserQuotaBoost(sql, resolvedUserId, \"mai\");\n const audioBoost = await getUserQuotaBoost(sql, resolvedUserId, \"audio\");\n const limit = getTierMaiTokenLimit(userTier) + maiBoost;\n const speechLimit = getTierSpeechLimit(userTier) + audioBoost;\n\n return c.json({\n avatarUrl: user?.avatar_url,\n email: user?.email,\n id: userId,\n limit,\n phone: user?.phone,\n resetAt: nextResetIso,\n speechLimit,\n speechTokensUsed,\n tier: userTier,\n tokensUsed,\n username: user?.username,\n weekStart: weekStartStr,\n });\n } catch {\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n };\n\n app.get(\"/usage\", handleGetUsage);\n app.get(\"/v1/usage\", handleGetUsage);\n app.get(\"/usage/\", handleGetUsage);\n app.get(\"/v1/usage/\", handleGetUsage);\n\n // ─────────────────────────────────────────────\n // POST /v1/log-usage & /log-usage\n // ─────────────────────────────────────────────\n const handleLogUsage = async (c: any) => {\n try {\n const token = extractToken(c.req.raw) || (c as any).get?.(\"apiKey\");\n let userId = (c as any).get?.(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const body = await c.req.json().catch(() => ({}));\n const inputTokens = Number(body.inputTokens || body.promptTokens || 0);\n const outputTokens = Number(\n body.outputTokens || body.completionTokens || 0,\n );\n const tokensUsed = Number(\n body.tokensUsed || inputTokens + outputTokens || 0,\n );\n const { weekStartStr } = getWeekData();\n\n const sql = getDb();\n const userRes =\n await sql`SELECT id, tier FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text LIMIT 1`;\n const tier = userRes.length > 0 ? userRes[0].tier : \"Free\";\n const resolvedUserId = userRes.length > 0 ? userRes[0].id : userId;\n const maiBoost = await getUserQuotaBoost(sql, resolvedUserId, \"mai\");\n const limit = getTierMaiTokenLimit(tier) + maiBoost;\n\n const usageResult = await sql`\n SELECT tokens_used FROM weekly_usage\n WHERE user_id = ${resolvedUserId}::integer AND week_start = ${weekStartStr}::date\n LIMIT 1\n `;\n const currentUsage = usageResult[0]?.tokens_used || 0;\n\n await sql`\n INSERT INTO weekly_usage (user_id, week_start, tokens_used)\n VALUES (${resolvedUserId}::integer, ${weekStartStr}::date, ${tokensUsed})\n ON CONFLICT (user_id, week_start)\n DO UPDATE SET tokens_used = weekly_usage.tokens_used + ${tokensUsed}\n `;\n\n return c.json({\n inputTokens,\n limit,\n outputTokens,\n success: true,\n tokensUsed,\n weeklyUsed: currentUsage + tokensUsed,\n });\n } catch (err: any) {\n console.error(\"[log-usage] Error:\", err);\n return c.json({ error: \"Erreur serveur.\", details: err?.message }, 500);\n }\n };\n\n app.post(\"/log-usage\", handleLogUsage);\n app.post(\"/v1/log-usage\", handleLogUsage);\n app.post(\"/log-usage/\", handleLogUsage);\n app.post(\"/v1/log-usage/\", handleLogUsage);\n\n // ─────────────────────────────────────────────\n // GET /v1/models, /models & /v1beta/models\n // ─────────────────────────────────────────────\n const handleGetModels = async (c: any) => {\n const userPlan = c.get(\"userPlan\");\n const shouldFilterFreeOnly = !isPaidTier(userPlan);\n\n try {\n const res = await fetch(\"https://openrouter.ai/api/v1/models\");\n if (!res.ok) {\n throw new Error(\"OpenRouter fetch error\");\n }\n const json = await res.json();\n const rawModels: any[] = json.data || [];\n\n let filtered = rawModels\n .filter((m) => m && m.id && !m.id.startsWith(\"openrouter/\"))\n .filter((m) => {\n const modality = m.architecture?.modality || \"\";\n const outputModalities = m.architecture?.output_modalities || [];\n return (\n outputModalities.includes(\"text\") ||\n modality.endsWith(\"text\") ||\n modality.includes(\"->text\")\n );\n })\n .map((m) => ({\n architecture: m.architecture,\n created: m.created || Math.floor(Date.now() / 1000),\n description: m.description || \"\",\n id: m.id,\n maxContext: m.context_length || 128_000,\n maxOutput: m.top_provider?.max_completion_tokens || 4096,\n name: m.name || m.id,\n object: \"model\",\n owned_by: m.id.split(\"/\")[0] || \"openrouter\",\n supported_parameters: m.supported_parameters || [\n \"temperature\",\n \"top_p\",\n \"max_tokens\",\n \"stream\",\n \"stop\",\n \"tools\",\n \"response_format\",\n ],\n }));\n\n if (shouldFilterFreeOnly) {\n filtered = filtered.filter((m) =>\n (m.id || \"\").toLowerCase().includes(\":free\")\n );\n }\n\n const lagunaIdx = filtered.findIndex((m) =>\n m.id === \"poolside/laguna-xs-2.1:free\"\n );\n if (lagunaIdx > 0) {\n const [laguna] = filtered.splice(lagunaIdx, 1);\n filtered.unshift(laguna);\n }\n\n return c.json({ data: filtered, object: \"list\" });\n } catch (_err) {\n let fallback = [\n {\n architecture: {\n input_modalities: [\"text\"],\n modality: \"text->text\",\n output_modalities: [\"text\"],\n },\n created: 0,\n description: \"Modèle IA Laguna XS 2.1 haute performance par Poolside\",\n id: \"poolside/laguna-xs-2.1:free\",\n maxContext: 128_000,\n maxOutput: 4096,\n name: \"Laguna XS 2.1\",\n object: \"model\",\n owned_by: \"poolside\",\n supported_parameters: [\n \"temperature\",\n \"top_p\",\n \"max_tokens\",\n \"stream\",\n \"stop\",\n \"tools\",\n \"response_format\",\n ],\n },\n {\n architecture: {\n input_modalities: [\"text\", \"image\", \"file\"],\n modality: \"text+image->text\",\n output_modalities: [\"text\"],\n },\n created: 0,\n description:\n \"Modèle multimodal ultra-rapide de Google conçu pour des tâches à haut débit et de raisonnement avec un très grand contexte.\",\n id: \"google/gemini-2.5-flash:free\",\n maxContext: 1_048_576,\n maxOutput: 65_535,\n name: \"Google: Gemini 2.5 Flash\",\n object: \"model\",\n owned_by: \"google\",\n supported_parameters: [\n \"temperature\",\n \"top_p\",\n \"top_k\",\n \"max_tokens\",\n \"tools\",\n \"response_format\",\n \"seed\",\n ],\n },\n {\n architecture: {\n input_modalities: [\"text\"],\n modality: \"text->text\",\n output_modalities: [\"text\"],\n },\n created: 0,\n description:\n \"Modèle phare de Meta Llama 3.3 70B offrant des compétences avancées de programmation, logique et résolution de problèmes complexes.\",\n id: \"meta-llama/llama-3.3-70b-instruct:free\",\n maxContext: 131_072,\n maxOutput: 128_000,\n name: \"Meta: Llama 3.3 70B Instruct\",\n object: \"model\",\n owned_by: \"meta-llama\",\n supported_parameters: [\n \"temperature\",\n \"top_p\",\n \"max_tokens\",\n \"tools\",\n \"response_format\",\n \"frequency_penalty\",\n ],\n },\n {\n architecture: {\n input_modalities: [\"text\"],\n modality: \"text->text\",\n output_modalities: [\"text\"],\n },\n created: 0,\n description:\n \"Modèle de code spécialisé de haute précision par Alibaba Cloud, optimisé pour la synthèse de code, le refactoring et le debug.\",\n id: \"qwen/qwen-2.5-coder-32b-instruct:free\",\n maxContext: 32_768,\n maxOutput: 8192,\n name: \"Qwen: Qwen 2.5 Coder 32B Instruct\",\n object: \"model\",\n owned_by: \"qwen\",\n supported_parameters: [\n \"temperature\",\n \"top_p\",\n \"max_tokens\",\n \"stop\",\n \"tools\",\n ],\n },\n {\n architecture: {\n input_modalities: [\"text\"],\n modality: \"text->text\",\n output_modalities: [\"text\"],\n },\n created: 0,\n description:\n \"Modèle de raisonnement logique étape par étape de premier ordre par DeepSeek pour les mathématiques et la logique complexe.\",\n id: \"deepseek/deepseek-r1:free\",\n maxContext: 163_840,\n maxOutput: 16_000,\n name: \"DeepSeek: DeepSeek R1\",\n object: \"model\",\n owned_by: \"deepseek\",\n supported_parameters: [\n \"temperature\",\n \"top_p\",\n \"max_tokens\",\n \"stream\",\n \"thinking\",\n \"reasoning\",\n ],\n },\n ];\n\n if (shouldFilterFreeOnly) {\n fallback = fallback.filter((m) =>\n (m.id || \"\").toLowerCase().includes(\":free\")\n );\n }\n\n return c.json({ data: fallback, object: \"list\" });\n }\n };\n\n app.get(\"/v1/models\", handleGetModels);\n app.get(\"/models\", handleGetModels);\n app.get(\"/v1beta/models\", handleGetModels);\n\n // ─────────────────────────────────────────────\n // GET /v1/models/mai & GET /v1/mai/models\n // ─────────────────────────────────────────────\n const handleGetMaiModels = (c: any) => {\n const formatted = maiModelsList.map((m) => ({\n capabilities: m.capabilities,\n context_length: m.contextWindow,\n created: Math.floor(new Date(m.releaseDate).getTime() / 1000) ||\n Math.floor(Date.now() / 1000),\n description: m.description,\n huggingface_tag: m.huggingFaceTag,\n id: m.id,\n license: m.license,\n max_output_tokens: m.maxOutputTokens,\n name: m.name,\n object: \"model\",\n ollama_tag: m.ollamaTag,\n owned_by: \"mDevsLabs\",\n parameters: m.parameters,\n recommended_hardware: m.recommendedHardware,\n status: m.status,\n tagline: m.tagline,\n usable_in_cloud_chat: false,\n version: m.version,\n }));\n return c.json({ data: formatted, object: \"list\" });\n };\n\n app.get(\"/v1/models/mai\", handleGetMaiModels);\n app.get(\"/v1/mai/models\", handleGetMaiModels);\n app.get(\"/models/mai\", handleGetMaiModels);\n app.get(\"/mai/models\", handleGetMaiModels);\n\n // ─────────────────────────────────────────────\n // GET /v1/status\n // ─────────────────────────────────────────────\n const handleGetStatus = async (c: any) => {\n try {\n const res = await fetch(\"https://mai.instatus.com/summary.json\");\n const data = await res.json();\n return c.json(data);\n } catch {\n return c.json({ error: \"Failed to fetch status\" }, 500);\n }\n };\n\n app.get(\"/v1/status\", handleGetStatus);\n app.get(\"/status\", handleGetStatus);\n\n // ─────────────────────────────────────────────\n // POST /v1/chat/completions & /chat/completions (OpenAI Compatible)\n // ─────────────────────────────────────────────\n const handleChatCompletions = async (c: any) => {\n try {\n const userPlan = c.get(\"userPlan\") || \"Free\";\n\n let body: Record<string, any>;\n try {\n body = await c.req.json();\n } catch {\n return c.json(\n {\n error: {\n code: \"invalid_request_body\",\n message: \"Le corps de la requête doit être un JSON valide.\",\n type: \"invalid_request_error\",\n },\n },\n 400,\n );\n }\n\n const modelRequested = body.model;\n if (!modelRequested) {\n return c.json(\n {\n error: {\n code: \"missing_model\",\n message: \"Le paramètre 'model' est obligatoire.\",\n param: \"model\",\n type: \"invalid_request_error\",\n },\n },\n 400,\n );\n }\n const modelStr = String(modelRequested).toLowerCase().trim();\n\n // Vérifier si c'est un modèle mAI (local uniquement)\n const isMaiLocal = modelStr.startsWith(\"mai-\") ||\n modelStr.startsWith(\"mdevslabs/\") ||\n modelStr.includes(\"mai-1.\") ||\n modelStr === \"mai-1\" ||\n modelStr === \"mai-1-light\";\n\n if (isMaiLocal) {\n return c.json(\n {\n error: {\n code: \"mai_model_not_supported_for_cloud_chat\",\n message:\n `Le modèle '${modelRequested}' est un modèle mAI destiné à une exécution locale (via Ollama / HuggingFace) et n'est pas directement utilisable en chat completions cloud.`,\n param: \"model\",\n type: \"invalid_request_error\",\n },\n },\n 400,\n );\n }\n\n const isFreePlan = !isPaidTier(userPlan);\n const isFreeModel = modelStr.includes(\":free\");\n\n // Bloquer avec 403 les requêtes pour les modèles payants avec une clé ou JWT free\n if (isFreePlan && !isFreeModel) {\n return c.json(\n {\n error: {\n code: \"model_access_denied\",\n message: `Le modèle '${\n modelRequested || \"inconnu\"\n }' nécessite un forfait payant (Plus, Pro ou Max). Votre forfait actuel (${userPlan}) autorise uniquement les modèles contenant ':free' dans leur identifiant (ex: 'google/gemini-2.5-flash:free', 'meta-llama/llama-3.3-70b-instruct:free').`,\n param: \"model\",\n type: \"permission_error\",\n },\n },\n 403,\n );\n }\n\n let userId = c.get(\"userId\");\n if (!userId) {\n const token = extractToken(c.req.raw);\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const sql = getDb();\n const { weekStartStr } = getWeekData();\n const usageResult = await sql`\n SELECT tokens_used FROM weekly_usage\n WHERE user_id = ${userId}::integer AND week_start = ${weekStartStr}::date\n LIMIT 1\n `;\n const currentUsage = usageResult[0]?.tokens_used || 0;\n const maiBoost = await getUserQuotaBoost(sql, userId, \"mai\");\n const limit = getTierMaiTokenLimit(userPlan) + maiBoost;\n\n if (currentUsage >= limit) {\n return c.json(\n { error: \"Votre limite hebdomadaire est épuisée. Quota atteint.\" },\n 429,\n );\n }\n\n const keyRows = await sql`\n SELECT api_key FROM mprojects_api_keys WHERE user_id::text = ${userId}::text LIMIT 1\n `;\n const apiKey = getOpenRouterApiKey(\n keyRows.length > 0 ? keyRows[0].api_key : null,\n );\n\n if (!apiKey) {\n return c.json({ error: \"Clé fournisseur OpenRouter manquante.\" }, 500);\n }\n\n // Nettoyer le body : retirer tout champ `api_key` ou `Authorization` injecté par le client\n // pour empêcher tout contournement de la clé serveur.\n const {\n api_key: _ck,\n authorization: _ca,\n Authorization: _cA,\n ...safeBody\n } = body as Record<string, any>;\n\n const openRouterRes = await fetch(\n \"https://openrouter.ai/api/v1/chat/completions\",\n {\n body: JSON.stringify(safeBody),\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n \"HTTP-Referer\": \"https://mai.val.run\",\n \"X-Title\": \"mAI Public API\",\n },\n method: \"POST\",\n },\n );\n\n if (openRouterRes.status === 200) {\n try {\n await sql`\n INSERT INTO weekly_usage (user_id, week_start, tokens_used)\n VALUES (${userId}::integer, ${weekStartStr}::date, 1)\n ON CONFLICT (user_id, week_start)\n DO UPDATE SET tokens_used = weekly_usage.tokens_used + 1\n `;\n } catch (_e) {}\n }\n\n return new Response(openRouterRes.body, {\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Content-Type\": openRouterRes.headers.get(\"Content-Type\") ||\n \"application/json\",\n },\n status: openRouterRes.status,\n });\n } catch (err: any) {\n console.error(\"[ChatCompletions] Erreur inattendue:\", err);\n return c.json(\n {\n details: err?.message || \"Erreur interne.\",\n error: \"Failed to process chat completion.\",\n },\n 500,\n );\n }\n };\n\n app.post(\"/v1/chat/completions\", handleChatCompletions);\n app.post(\"/chat/completions\", handleChatCompletions);\n\n // ─────────────────────────────────────────────\n // POST /v1/messages & /messages (Proxy Anthropic SDK)\n // ─────────────────────────────────────────────\n const handleMessages = async (c: any) => {\n try {\n const userPlan = c.get(\"userPlan\") || \"Free\";\n\n let body: Record<string, any>;\n try {\n body = await c.req.json();\n } catch {\n return c.json(\n {\n error: {\n code: \"invalid_request_body\",\n message: \"Le corps de la requête doit être un JSON valide.\",\n type: \"invalid_request_error\",\n },\n },\n 400,\n );\n }\n\n const modelRequested = body.model;\n const modelStr = String(modelRequested || \"\").toLowerCase().trim();\n\n const isFreePlan = !isPaidTier(userPlan);\n const isFreeModel = modelStr.includes(\":free\");\n\n // Bloquer avec 403 les requêtes pour les modèles payants avec une clé ou JWT free\n if (isFreePlan && !isFreeModel) {\n return c.json(\n {\n error: {\n code: \"model_access_denied\",\n message: `Le modèle '${\n modelRequested || \"inconnu\"\n }' nécessite un forfait payant (Plus, Pro ou Max). Votre forfait actuel (${userPlan}) autorise uniquement les modèles gratuits dont l'ID contient ':free' (ex: 'meta-llama/llama-3.3-70b-instruct:free', 'deepseek/deepseek-r1:free').`,\n param: \"model\",\n type: \"permission_error\",\n },\n },\n 403,\n );\n }\n\n let userId = c.get(\"userId\");\n if (!userId) {\n const token = extractToken(c.req.raw);\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const sql = getDb();\n const { weekStartStr } = getWeekData();\n const usageResult = await sql`\n SELECT tokens_used FROM weekly_usage\n WHERE user_id = ${userId}::integer AND week_start = ${weekStartStr}::date\n LIMIT 1\n `;\n const currentUsage = usageResult[0]?.tokens_used || 0;\n const maiBoost = await getUserQuotaBoost(sql, userId, \"mai\");\n const limit = getTierMaiTokenLimit(userPlan) + maiBoost;\n\n if (currentUsage >= limit) {\n return c.json(\n { error: \"Votre limite hebdomadaire est épuisée. Quota atteint.\" },\n 429,\n );\n }\n\n const keyRows = await sql`\n SELECT api_key FROM mprojects_api_keys WHERE user_id::text = ${userId}::text LIMIT 1\n `;\n const apiKey = getOpenRouterApiKey(\n keyRows.length > 0 ? keyRows[0].api_key : null,\n );\n\n if (!apiKey) {\n return c.json({ error: \"Clé fournisseur OpenRouter manquante.\" }, 500);\n }\n\n // Nettoyer le body : retirer tout champ `api_key` ou `Authorization` injecté par le client\n const {\n api_key: _ck,\n authorization: _ca,\n Authorization: _cA,\n ...safeBody\n } = body as Record<string, any>;\n\n const openRouterRes = await fetch(\n \"https://openrouter.ai/api/v1/chat/completions\",\n {\n body: JSON.stringify(safeBody),\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n \"HTTP-Referer\": \"https://mai.val.run\",\n \"X-Title\": \"mAI Public API (Anthropic)\",\n },\n method: \"POST\",\n },\n );\n\n if (openRouterRes.status === 200) {\n try {\n await sql`\n INSERT INTO weekly_usage (user_id, week_start, tokens_used)\n VALUES (${userId}::integer, ${weekStartStr}::date, 1)\n ON CONFLICT (user_id, week_start)\n DO UPDATE SET tokens_used = weekly_usage.tokens_used + 1\n `;\n } catch (_e) {}\n }\n\n return new Response(openRouterRes.body, {\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Content-Type\": openRouterRes.headers.get(\"Content-Type\") ||\n \"application/json\",\n },\n status: openRouterRes.status,\n });\n } catch (err: any) {\n console.error(\"[Messages] Erreur inattendue:\", err);\n return c.json(\n {\n details: err?.message || \"Erreur interne.\",\n error: \"Failed to process Anthropic request.\",\n },\n 500,\n );\n }\n };\n\n app.post(\"/v1/messages\", handleMessages);\n app.post(\"/messages\", handleMessages);\n\n // ─────────────────────────────────────────────\n // POST /v1beta/models/* & /v1/models/* (Proxy Google Gemini SDK)\n // ─────────────────────────────────────────────\n const handleGeminiGenerate = async (c: any) => {\n try {\n const userPlan = c.get(\"userPlan\") || \"Free\";\n\n // Pour Gemini, le body JSON peut être optionnel (le modèle est dans l'URL)\n let body: Record<string, any> = {};\n try {\n body = await c.req.json();\n } catch {\n // body vide acceptable pour Gemini (modèle dans le path)\n }\n\n const fullPath = c.req.path;\n // Extraire le modèle depuis l'URL (ex: /v1beta/models/google/gemini-2.5-flash:free:generateContent -> google/gemini-2.5-flash:free)\n const pathModel = fullPath\n .replace(/^\\/(v1beta|v1)\\/models\\//, \"\")\n .replace(/:(generateContent|streamGenerateContent).*$/, \"\");\n\n const paramModel = c.req.param(\"model\");\n const modelRequested = body.model || paramModel || pathModel;\n const modelStr = String(modelRequested || \"\").toLowerCase().trim();\n\n const isFreePlan = !isPaidTier(userPlan);\n const isFreeModel = modelStr.includes(\":free\");\n\n // Bloquer avec 403 les requêtes pour les modèles payants avec une clé ou JWT free\n if (isFreePlan && !isFreeModel) {\n return c.json(\n {\n error: {\n code: 403,\n message: `Le modèle '${\n modelRequested || \"inconnu\"\n }' nécessite un forfait payant (Plus, Pro ou Max). Votre forfait actuel (${userPlan}) autorise uniquement les modèles gratuits contenant ':free' dans leur identifiant (ex: 'google/gemini-2.5-flash:free').`,\n status: \"PERMISSION_DENIED\",\n },\n },\n 403,\n );\n }\n\n let userId = c.get(\"userId\");\n if (!userId) {\n const token = extractToken(c.req.raw);\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const sql = getDb();\n const { weekStartStr } = getWeekData();\n const usageResult = await sql`\n SELECT tokens_used FROM weekly_usage\n WHERE user_id = ${userId}::integer AND week_start = ${weekStartStr}::date\n LIMIT 1\n `;\n const currentUsage = usageResult[0]?.tokens_used || 0;\n const maiBoost = await getUserQuotaBoost(sql, userId, \"mai\");\n const limit = getTierMaiTokenLimit(userPlan) + maiBoost;\n\n if (currentUsage >= limit) {\n return c.json(\n { error: \"Votre limite hebdomadaire est épuisée. Quota atteint.\" },\n 429,\n );\n }\n\n const keyRows = await sql`\n SELECT api_key FROM mprojects_api_keys WHERE user_id::text = ${userId}::text LIMIT 1\n `;\n const apiKey = getOpenRouterApiKey(\n keyRows.length > 0 ? keyRows[0].api_key : null,\n );\n\n if (!apiKey) {\n return c.json({ error: \"Clé fournisseur OpenRouter manquante.\" }, 500);\n }\n\n // Nettoyer le body : retirer tout champ `api_key` ou `Authorization` injecté par le client\n const {\n api_key: _ck,\n authorization: _ca,\n Authorization: _cA,\n ...safeBody\n } = body as Record<string, any>;\n\n const openRouterPayload = {\n ...safeBody,\n model: body.model || modelRequested,\n };\n\n const openRouterRes = await fetch(\n \"https://openrouter.ai/api/v1/chat/completions\",\n {\n body: JSON.stringify(openRouterPayload),\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n \"HTTP-Referer\": \"https://mai.val.run\",\n \"X-Title\": \"mAI Public API (Gemini)\",\n },\n method: \"POST\",\n },\n );\n\n if (openRouterRes.status === 200) {\n try {\n await sql`\n INSERT INTO weekly_usage (user_id, week_start, tokens_used)\n VALUES (${userId}::integer, ${weekStartStr}::date, 1)\n ON CONFLICT (user_id, week_start)\n DO UPDATE SET tokens_used = weekly_usage.tokens_used + 1\n `;\n } catch (_e) {}\n }\n\n return new Response(openRouterRes.body, {\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Content-Type\": openRouterRes.headers.get(\"Content-Type\") ||\n \"application/json\",\n },\n status: openRouterRes.status,\n });\n } catch (err: any) {\n console.error(\"[GeminiGenerate] Erreur inattendue:\", err);\n return c.json(\n {\n details: err?.message || \"Erreur interne.\",\n error: \"Failed to process Google Gemini request.\",\n },\n 500,\n );\n }\n };\n\n app.post(\"/v1beta/models/*\", handleGeminiGenerate);\n app.post(\"/v1/models/*:generateContent\", handleGeminiGenerate);\n app.post(\"/v1/models/*:streamGenerateContent\", handleGeminiGenerate);\n}",[248],"11bbd73d-3765-4769-b78f-a1159899d347","main.ts",181,["D",1788445275206],47,"http","/**\n * mAI — Backend & API Routes\n * Base URL : https://mai.val.run\n */\n\nimport { cors } from \"npm:hono/cors\";\nimport { Hono } from \"npm:hono@4\";\nimport { registerAuthRoutes } from \"./auth.ts\";\nimport { registerAudioRoutes } from \"./audio.ts\";\nimport { initSQLite } from \"./config.ts\";\nimport { registerDeviceRoutes } from \"./devices.ts\";\nimport { registerImageRoutes } from \"./images.ts\";\nimport { registerMiddleware } from \"./api-middleware.ts\";\nimport { registerModelRoutes } from \"./models.ts\";\nimport { registerProjectRoutes } from \"./projects.ts\";\nimport { registerStorageRoutes } from \"./storage.ts\";\nimport { registerVibeRoutes } from \"./vibe.ts\";\nimport { registerWebRoutes } from \"./web.ts\";\n\n// ─────────────────────────────────────────────\n// Init DB SQLite en background\n// ─────────────────────────────────────────────\ninitSQLite().catch(console.error);\n\n// ─────────────────────────────────────────────\n// App Hono\n// ─────────────────────────────────────────────\nconst app = new Hono();\n\n// ─────────────────────────────────────────────\n// CORS strict par allowlist + headers de sécurité\n// ─────────────────────────────────────────────\nconst ALLOWED_ORIGINS = new Set([\n \"https://mai-vibe.vercel.app\",\n \"https://mai-vibe-git-main-mcompany.vercel.app\",\n \"http://localhost:5173\",\n \"http://127.0.0.1:5173\",\n \"capacitor://localhost\",\n \"https://localhost\",\n]);\n\napp.use(\n \"*\",\n cors({\n allowHeaders: [\n \"Content-Type\",\n \"Authorization\",\n \"x-user-id\",\n \"x-api-key\",\n \"X-User-Id\",\n \"X-API-Key\",\n \"x-web-search\",\n \"X-Web-Search\",\n \"x-disable-web-search\",\n \"X-Disable-Web-Search\",\n \"x-goog-api-key\",\n \"X-Goog-Api-Key\",\n \"anthropic-version\",\n \"anthropic-beta\",\n ],\n allowMethods: [\"GET\", \"POST\", \"PUT\", \"DELETE\", \"PATCH\", \"OPTIONS\"],\n exposeHeaders: [\"Content-Type\", \"Authorization\", \"x-user-id\"],\n maxAge: 86_400,\n // Rejette toute origine non autorisée (au lieu de la refléter avec credentials)\n origin: (origin) => (origin && ALLOWED_ORIGINS.has(origin) ? origin : null),\n credentials: true,\n }),\n);\n\napp.use(\"*\", async (c, next) => {\n await next();\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\n \"Permissions-Policy\",\n \"camera=(), geolocation=(), microphone=(self)\",\n );\n});\n\n// ─────────────────────────────────────────────\n// ROUTE RACINE : mAI UNIQUEMENT (URL de base de l'API)\n// ─────────────────────────────────────────────\napp.get(\"/\", (c) => c.text(\"mAI\"));\napp.get(\"/api\", (c) => c.text(\"mAI\"));\napp.get(\"/api/\", (c) => c.text(\"mAI\"));\napp.get(\"/v1\", (c) => c.text(\"mAI\"));\napp.get(\"/v1/\", (c) => c.text(\"mAI\"));\napp.get(\"/vibe\", (c) => c.text(\"mAI\"));\napp.get(\"/vibe/\", (c) => c.text(\"mAI\"));\napp.get(\"/api/vibe\", (c) => c.text(\"mAI\"));\napp.get(\"/api/vibe/\", (c) => c.text(\"mAI\"));\n\n// ─────────────────────────────────────────────\n// Middleware & Routes modulaires\n// ─────────────────────────────────────────────\nregisterMiddleware(app);\nregisterAuthRoutes(app);\nregisterStorageRoutes(app);\nregisterModelRoutes(app);\nregisterImageRoutes(app);\nregisterAudioRoutes(app);\nregisterWebRoutes(app);\nregisterProjectRoutes(app);\nregisterDeviceRoutes(app);\nregisterVibeRoutes(app);\n\nexport default app.fetch;",[256],"be398c28-d1fb-4c60-9f77-01436ae5c7db","maiModels.ts","d2e49b4e-9fd5-11f1-866a-1607ee4eb77e",84,["D",1787587613987],"export interface MAIModelDetail {\n capabilities: {\n coding: boolean;\n reasoning: boolean;\n vision: boolean;\n jsonOutput: boolean;\n functionCalling: boolean;\n };\n contextWindow: number;\n description: string;\n huggingFaceTag: string;\n id: string;\n license: string;\n maxOutputTokens: number;\n multimodal: boolean;\n name: string;\n ollamaTag: string;\n parameters: string;\n recommendedHardware: {\n minVram: string;\n recommendedVram: string;\n ram: string;\n };\n releaseDate: string;\n status: \"active\" | \"beta\" | \"deprecated\";\n tagline: string;\n version: string;\n vision: boolean;\n}\n\nexport const maiModelsList: MAIModelDetail[] = [\n {\n capabilities: {\n coding: true,\n functionCalling: true,\n jsonOutput: true,\n reasoning: true,\n vision: true,\n },\n contextWindow: 262_144,\n description:\n \"Modèle léger de 4 milliards de paramètres conçu pour une agilité maximale sur machines personnelles avec vision intégrée, capacité de raisonnement (thinking) et gestion avancée des appels d'outils (tools).\",\n huggingFaceTag: \"mDevsLabs/mAI-1.5-Light\",\n id: \"mai-1.5-light\",\n license: \"MIT\",\n maxOutputTokens: 32_768,\n multimodal: true,\n name: \"mAI-1.5-Light\",\n ollamaTag: \"mDevsLabs/mAI-1.5-Light\",\n parameters: \"4B\",\n recommendedHardware: {\n minVram: \"4GB\",\n ram: \"8GB\",\n recommendedVram: \"8GB\",\n },\n releaseDate: \"2026-08-28\",\n status: \"active\",\n tagline:\n \"Assistant IA local ultra-rapide et multimodal. Vision intégrée, raisonnement (thinking) et appels d'outils (tools).\",\n version: \"1.5.0\",\n vision: true,\n },\n {\n capabilities: {\n coding: true,\n functionCalling: true,\n jsonOutput: true,\n reasoning: true,\n vision: true,\n },\n contextWindow: 262_144,\n description:\n \"Modèle d'élite de 9 milliards de paramètres offrant des performances d'analyse logique et de programmation exceptionnelles, avec support natif du raisonnement profond (thinking), de la vision et des appels d'outils.\",\n huggingFaceTag: \"mDevsLabs/mAI-1.5-Apex\",\n id: \"mai-1.5-apex\",\n license: \"MIT\",\n maxOutputTokens: 32_768,\n multimodal: true,\n name: \"mAI-1.5-Apex\",\n ollamaTag: \"mDevsLabs/mAI-1.5-Apex\",\n parameters: \"9B\",\n recommendedHardware: {\n minVram: \"8GB\",\n ram: \"16GB\",\n recommendedVram: \"16GB\",\n },\n releaseDate: \"2026-08-28\",\n status: \"active\",\n tagline:\n \"Le haut de gamme absolu de la famille mAI. Puissance maximale, vision multimodale, raisonnement complexe et tools.\",\n version: \"1.5.0\",\n vision: true,\n },\n {\n capabilities: {\n coding: true,\n functionCalling: true,\n jsonOutput: true,\n reasoning: true,\n vision: true,\n },\n contextWindow: 262_144,\n description:\n \"Modèle 27B polyvalent et surpuissant pour postes de travail et serveurs locaux, réunissant vision multimodale, raisonnement étape par étape et intégration fluide des API et outils externes.\",\n huggingFaceTag: \"mDevsLabs/mAI-1.5-Opal\",\n id: \"mai-1.5-opal\",\n license: \"MIT\",\n maxOutputTokens: 32_768,\n multimodal: true,\n name: \"mAI-1.5-Opal\",\n ollamaTag: \"mDevsLabs/mAI-1.5-Opal\",\n parameters: \"27B\",\n recommendedHardware: {\n minVram: \"16GB\",\n ram: \"32GB\",\n recommendedVram: \"24GB\",\n },\n releaseDate: \"2026-08-28\",\n status: \"active\",\n tagline:\n \"L'équilibre parfait entre haute intelligence et vélocité. Multimodal 27B avec vision, thinking et tools.\",\n version: \"1.5.0\",\n vision: true,\n },\n {\n capabilities: {\n coding: true,\n functionCalling: true,\n jsonOutput: true,\n reasoning: true,\n vision: true,\n },\n contextWindow: 262_144,\n description:\n \"Modèle léger de 3 milliards de paramètres conçu pour une exécution ultra-rapide sur laptops et machines personnelles avec accélération vision intégrée.\",\n huggingFaceTag: \"mDevsLabs/mAI-1.2-Light-GGUF\",\n id: \"mai-1.2-light\",\n license: \"MIT\",\n maxOutputTokens: 16_384,\n multimodal: true,\n name: \"mAI-1.2-Light\",\n ollamaTag: \"mDevsLabs/mAI-1.2-Light\",\n parameters: \"3B\",\n recommendedHardware: {\n minVram: \"4GB\",\n ram: \"8GB\",\n recommendedVram: \"8GB\",\n },\n releaseDate: \"2026-07-22\",\n status: \"active\",\n tagline:\n \"Assistant IA local ultra-rapide et multimodal. Légèreté maximale, vision intégrée.\",\n version: \"1.2.0\",\n vision: true,\n },\n {\n capabilities: {\n coding: true,\n functionCalling: true,\n jsonOutput: true,\n reasoning: true,\n vision: true,\n },\n contextWindow: 262_144,\n description:\n \"Modèle phare de 9 milliards de paramètres offrant un raisonnement logique complexe, des compétences en développement logiciel et une analyse d'images de haute précision.\",\n huggingFaceTag: \"mDevsLabs/mAI-1.2-Apex-GGUF\",\n id: \"mai-1.2-apex\",\n license: \"MIT\",\n maxOutputTokens: 32_768,\n multimodal: true,\n name: \"mAI-1.2-Apex\",\n ollamaTag: \"mDevsLabs/mAI-1.2-Apex\",\n parameters: \"9B\",\n recommendedHardware: {\n minVram: \"8GB\",\n ram: \"16GB\",\n recommendedVram: \"16GB\",\n },\n releaseDate: \"2026-07-22\",\n status: \"active\",\n tagline:\n \"Le top tier de la famille mAI-1.2. Performances maximales, vision et raisonnement avancé.\",\n version: \"1.2.0\",\n vision: true,\n },\n {\n capabilities: {\n coding: true,\n functionCalling: true,\n jsonOutput: true,\n reasoning: true,\n vision: false,\n },\n contextWindow: 262_144,\n description:\n \"Modèle 33B polyvalent pour serveurs locaux et postes de travail spécialisés, offrant un équilibre exceptionnel pour la rédaction, la programmation et l'analyse documentaire.\",\n huggingFaceTag: \"mDevsLabs/mAI-1.2-Opal-GGUF\",\n id: \"mai-1.2-opal\",\n license: \"MIT\",\n maxOutputTokens: 32_768,\n multimodal: false,\n name: \"mAI-1.2-Opal\",\n ollamaTag: \"mDevsLabs/mAI-1.2-Opal\",\n parameters: \"33B\",\n recommendedHardware: {\n minVram: \"16GB\",\n ram: \"32GB\",\n recommendedVram: \"24GB\",\n },\n releaseDate: \"2026-07-22\",\n status: \"active\",\n tagline:\n \"Le sweet spot parfait entre vitesse et intelligence élevée. Équilibré et fluide.\",\n version: \"1.2.0\",\n vision: false,\n },\n {\n capabilities: {\n coding: true,\n functionCalling: false,\n jsonOutput: true,\n reasoning: true,\n vision: true,\n },\n contextWindow: 262_144,\n description:\n \"Première génération du modèle mAI 12B avec support multimodal original et capacités avancées en résolution de problèmes.\",\n huggingFaceTag: \"mDevsLabs/mAI-1-GGUF\",\n id: \"mai-1\",\n license: \"MIT\",\n maxOutputTokens: 16_384,\n multimodal: true,\n name: \"mAI-1\",\n ollamaTag: \"mDevsLabs/mAI-1\",\n parameters: \"12B\",\n recommendedHardware: {\n minVram: \"8GB\",\n ram: \"16GB\",\n recommendedVram: \"12GB\",\n },\n releaseDate: \"2026-07-11\",\n status: \"active\",\n tagline:\n \"Assistant IA local multimodal puissant de 12B paramètres pour le raisonnement et le code.\",\n version: \"1.0.0\",\n vision: true,\n },\n {\n capabilities: {\n coding: true,\n functionCalling: false,\n jsonOutput: true,\n reasoning: true,\n vision: false,\n },\n contextWindow: 131_072,\n description:\n \"Version 3B texte de première génération optimisée pour une empreinte mémoire minimale.\",\n huggingFaceTag: \"mDevsLabs/mAI-1-Light-GGUF\",\n id: \"mai-1-light\",\n license: \"MIT\",\n maxOutputTokens: 8192,\n multimodal: false,\n name: \"mAI-1-Light\",\n ollamaTag: \"mDevsLabs/mAI-1-Light\",\n parameters: \"3B\",\n recommendedHardware: {\n minVram: \"2GB\",\n ram: \"8GB\",\n recommendedVram: \"4GB\",\n },\n releaseDate: \"2026-07-11\",\n status: \"active\",\n tagline: \"Assistant IA local ultraléger et rapide de 3B paramètres.\",\n version: \"1.0.0\",\n vision: false,\n },\n];\n\nexport const maiModels = maiModelsList;",[264],"01b444a4-db1c-486c-9c4c-3d111a9ed347","images.ts","d2e42ca4-9fd5-11f1-866a-1607ee4eb77e",["D",1788164141214],"import type { Hono } from \"npm:hono@4\";\nimport {\n extractTierFromApiKey,\n extractToken,\n getDb,\n getTierDailyImageLimit,\n getTierImageRequestCost,\n getUserQuotaBoost,\n isPaidTier,\n verifyToken,\n} from \"./config.ts\";\n\nexport interface ImageModelItem {\n capabilities?: {\n async_task?: boolean;\n image_to_image?: boolean;\n inpainting?: boolean;\n text_to_image?: boolean;\n upscaling?: boolean;\n variation?: boolean;\n };\n created: number;\n description: string;\n endpoints?: string[];\n features: string[];\n form:\n | \"openai-standard\"\n | \"midjourney-pipeline\"\n | \"image-edit\"\n | \"image-upscale\";\n id: string;\n name: string;\n object: \"model\";\n owned_by: string;\n parent?: string | null;\n permission?: Array<{\n allow_create_engine: boolean;\n allow_fine_tuning: boolean;\n allow_logprobs: boolean;\n allow_sampling: boolean;\n allow_search_indices: boolean;\n allow_view: boolean;\n created: number;\n group: string | null;\n id: string;\n is_blocking: boolean;\n object: \"model_permission\";\n organization: string;\n }>;\n root?: string;\n}\n\nexport function getCometApiKey(): string {\n if (typeof Deno !== \"undefined\" && Deno.env) {\n return Deno.env.get(\"COMET_API_KEY\") || \"\";\n }\n if (typeof process !== \"undefined\" && process.env) {\n return process.env.COMET_API_KEY || \"\";\n }\n return \"\";\n}\n\nexport function normalizeImageSrc(url?: string | null): string {\n if (!url || typeof url !== \"string\") {\n return \"\";\n }\n const clean = url.trim().replace(/^[\"']|[\"']$/g, \"\");\n if (!clean) {\n return \"\";\n }\n\n if (\n clean.startsWith(\"http://\") ||\n clean.startsWith(\"https://\") ||\n clean.startsWith(\"data:\") ||\n clean.startsWith(\"blob:\") ||\n clean.startsWith(\"/\")\n ) {\n return clean;\n }\n\n let mime = \"image/png\";\n if (clean.startsWith(\"/9j/\")) {\n mime = \"image/jpeg\";\n } else if (clean.startsWith(\"R0lGOD\")) {\n mime = \"image/gif\";\n } else if (clean.startsWith(\"UklGR\")) {\n mime = \"image/webp\";\n } else if (clean.startsWith(\"PHN2Zy\") || clean.startsWith(\"PD94bWw\")) {\n mime = \"image/svg+xml\";\n }\n\n return `data:${mime};base64,${clean}`;\n}\n\n/**\n * Cache mémoire pour les modèles CometAPI (TTL = 60 secondes)\n */\nlet cachedCometImageModels: ImageModelItem[] = [];\nlet lastCometFetchTime = 0;\nconst CACHE_TTL_MS = 60_000;\n\n/**\n * Modèles de repli de haute qualité en cas de défaillance réseau temporaire de CometAPI\n */\nconst FALLBACK_IMAGE_MODELS: ImageModelItem[] = [\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1722470400,\n description:\n \"Modèle ultra-rapide en 4 étapes par Black Forest Labs (Text-to-Image).\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"black-forest-labs/flux-schnell\",\n name: \"FLUX.1 Schnell\",\n object: \"model\",\n owned_by: \"black-forest-labs\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: true,\n inpainting: true,\n text_to_image: true,\n },\n created: 1722470400,\n description:\n \"Modèle phare de synthèse photoréaliste et artistique par Black Forest Labs (Text-to-Image / Image-to-Image).\",\n endpoints: [\"/v1/images/generations\", \"/v1/images/edits\"],\n features: [\"text-to-image\", \"image-to-image\"],\n form: \"openai-standard\",\n id: \"black-forest-labs/flux-dev\",\n name: \"FLUX.1 Dev\",\n object: \"model\",\n owned_by: \"black-forest-labs\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1727827200,\n description:\n \"Sommet de la qualité visuelle, cohérence typographique et détails avancés par Black Forest Labs.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"black-forest-labs/flux-pro\",\n name: \"FLUX 1.1 Pro\",\n object: \"model\",\n owned_by: \"black-forest-labs\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1730419200,\n description:\n \"Version Ultra haute résolution (jusqu'à 4K) avec photoréalisme extrême et détails de peau par Black Forest Labs.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"black-forest-labs/flux-1.1-pro-ultra\",\n name: \"FLUX 1.1 Pro Ultra\",\n object: \"model\",\n owned_by: \"black-forest-labs\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: true,\n inpainting: true,\n text_to_image: true,\n },\n created: 1729641600,\n description:\n \"Modèle phare de 8 milliards de paramètres de Stability AI pour une variété stylistique maximale et une typographie nette.\",\n endpoints: [\"/v1/images/generations\", \"/v1/images/edits\"],\n features: [\"text-to-image\", \"image-to-image\"],\n form: \"openai-standard\",\n id: \"stabilityai/stable-diffusion-3.5-large\",\n name: \"Stable Diffusion 3.5 Large\",\n object: \"model\",\n owned_by: \"stabilityai\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1729641600,\n description:\n \"Version accélérée en 4 étapes de Stable Diffusion 3.5 Large par Stability AI.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"stabilityai/stable-diffusion-3.5-large-turbo\",\n name: \"Stable Diffusion 3.5 Large Turbo\",\n object: \"model\",\n owned_by: \"stabilityai\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: true,\n inpainting: true,\n text_to_image: true,\n },\n created: 1690848000,\n description:\n \"Modèle SDXL 1.0 haute résolution de Stability AI pour la création artistique et le rendu réaliste.\",\n endpoints: [\"/v1/images/generations\", \"/v1/images/edits\"],\n features: [\"text-to-image\", \"image-to-image\"],\n form: \"openai-standard\",\n id: \"stabilityai/sdxl\",\n name: \"Stable Diffusion XL 1.0\",\n object: \"model\",\n owned_by: \"stabilityai\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: true,\n inpainting: true,\n text_to_image: true,\n upscaling: true,\n variation: true,\n },\n created: 1718064000,\n description:\n \"Génération stylisée haut de gamme avec esthétique cinématique et compréhension sémantique de pointe via Midjourney v6.\",\n endpoints: [\n \"/v1/images/generations\",\n \"/mj/submit/imagine\",\n \"/mj/submit/action\",\n \"/mj/task/:id/fetch\",\n ],\n features: [\"text-to-image\", \"image-to-image\", \"upscale\", \"variation\"],\n form: \"midjourney-pipeline\",\n id: \"midjourney/v6\",\n name: \"Midjourney v6\",\n object: \"model\",\n owned_by: \"midjourney\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: true,\n inpainting: true,\n text_to_image: true,\n upscaling: true,\n variation: true,\n },\n created: 1722384000,\n description:\n \"Dernière itération du moteur Midjourney v6.1 avec cohérence accrue des mains, textures et détails fins.\",\n endpoints: [\n \"/v1/images/generations\",\n \"/mj/submit/imagine\",\n \"/mj/submit/action\",\n \"/mj/task/:id/fetch\",\n ],\n features: [\"text-to-image\", \"image-to-image\", \"upscale\", \"variation\"],\n form: \"midjourney-pipeline\",\n id: \"midjourney/v6.1\",\n name: \"Midjourney v6.1\",\n object: \"model\",\n owned_by: \"midjourney\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: true,\n inpainting: false,\n text_to_image: true,\n },\n created: 1730419200,\n description:\n \"Génération vectorielle et matricielle spécialisée dans les logos, icônes, illustrations et design graphique.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\", \"image-to-image\"],\n form: \"openai-standard\",\n id: \"recraft-ai/recraft-v3\",\n name: \"Recraft V3\",\n object: \"model\",\n owned_by: \"recraft-ai\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1724284800,\n description:\n \"Modèle phare de rendu de texte dans l'image et composition graphique par Ideogram AI.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"ideogram-ai/ideogram-v2\",\n name: \"Ideogram V2\",\n object: \"model\",\n owned_by: \"ideogram-ai\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1724284800,\n description:\n \"Version ultra-rapide d'Ideogram V2 optimisée pour les flux de production en temps réel.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"ideogram-ai/ideogram-v2-turbo\",\n name: \"Ideogram V2 Turbo\",\n object: \"model\",\n owned_by: \"ideogram-ai\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1698796800,\n description:\n \"Modèle DALL-E 3 d'OpenAI pour la synthèse d'images haute fidélité avec reformulation automatique des prompts.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"dall-e-3\",\n name: \"DALL-E 3\",\n object: \"model\",\n owned_by: \"openai\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: true,\n inpainting: true,\n text_to_image: true,\n },\n created: 1667260800,\n description:\n \"Modèle classique DALL-E 2 d'OpenAI pour la génération et l'édition rapide d'images.\",\n endpoints: [\n \"/v1/images/generations\",\n \"/v1/images/edits\",\n \"/v1/images/variations\",\n ],\n features: [\"text-to-image\", \"image-to-image\"],\n form: \"openai-standard\",\n id: \"dall-e-2\",\n name: \"DALL-E 2\",\n object: \"model\",\n owned_by: \"openai\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1723680000,\n description:\n \"Modèle de synthèse photoréaliste et typographique de Google DeepMind Imagen 3.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"google/imagen-3\",\n name: \"Google Imagen 3\",\n object: \"model\",\n owned_by: \"google\",\n },\n {\n capabilities: {\n async_task: true,\n image_to_image: false,\n inpainting: false,\n text_to_image: true,\n },\n created: 1730000000,\n description: \"Modèle ultra-rapide de génération photoréaliste par Luma AI.\",\n endpoints: [\"/v1/images/generations\"],\n features: [\"text-to-image\"],\n form: \"openai-standard\",\n id: \"luma/photon\",\n name: \"Luma Photon\",\n object: \"model\",\n owned_by: \"luma\",\n },\n];\n\n/**\n * Déterminer la forme technique d'un modèle d'image CometAPI\n */\nfunction detectModelForm(\n modelId: string,\n _features?: string[],\n): ImageModelItem[\"form\"] {\n const lower = modelId.toLowerCase();\n if (\n lower.includes(\"midjourney\") || lower.includes(\"mj-\") ||\n lower.startsWith(\"mj/\")\n ) {\n return \"midjourney-pipeline\";\n }\n if (lower.includes(\"upscale\")) {\n return \"image-upscale\";\n }\n if (lower.includes(\"edit\") || lower.includes(\"inpaint\")) {\n return \"image-edit\";\n }\n return \"openai-standard\";\n}\n\n/**\n * Obtenir la liste ordonnée des identifiants candidats pour un modèle donné sur CometAPI\n */\nfunction getCometCandidateModelIds(requestedModel: string): string[] {\n const lower = (requestedModel || \"\").toLowerCase().trim();\n\n if (\n lower.includes(\"schnell\") || lower === \"flux\" ||\n lower.includes(\"flux-1-schnell\") || lower.includes(\"flux-schnell\")\n ) {\n return [\n \"flux-schnell\",\n \"black-forest-labs/flux-schnell\",\n \"flux-1-schnell\",\n \"black-forest-labs/flux-1-schnell\",\n \"dall-e-3\",\n ];\n }\n if (lower.includes(\"flux\") && lower.includes(\"dev\")) {\n return [\n \"flux-dev\",\n \"black-forest-labs/flux-dev\",\n \"flux-1-dev\",\n \"black-forest-labs/flux-1-dev\",\n \"dall-e-3\",\n ];\n }\n if (\n lower.includes(\"flux\") && (lower.includes(\"pro\") || lower.includes(\"ultra\"))\n ) {\n return [\n \"flux-pro\",\n \"black-forest-labs/flux-pro\",\n \"flux-1.1-pro\",\n \"black-forest-labs/flux-1.1-pro\",\n \"dall-e-3\",\n ];\n }\n if (\n lower.includes(\"dall-e-3\") || lower.includes(\"dalle-3\") ||\n lower === \"dall-e\"\n ) {\n return [\"dall-e-3\", \"openai/dall-e-3\"];\n }\n if (lower.includes(\"dall-e-2\") || lower.includes(\"dalle-2\")) {\n return [\"dall-e-2\", \"openai/dall-e-2\", \"dall-e-3\"];\n }\n if (lower.includes(\"midjourney\") || lower.includes(\"mj\")) {\n return [\n \"midjourney/v6.1\",\n \"midjourney/v6\",\n \"midjourney\",\n \"mj-v6\",\n \"dall-e-3\",\n ];\n }\n if (\n lower.includes(\"diffusion\") || lower.includes(\"sd3\") ||\n lower.includes(\"sd-3\")\n ) {\n return [\n \"stable-diffusion-3.5-large\",\n \"stabilityai/stable-diffusion-3.5-large\",\n \"sdxl\",\n \"stabilityai/sdxl\",\n \"dall-e-3\",\n ];\n }\n if (lower.includes(\"sdxl\")) {\n return [\"sdxl\", \"stabilityai/sdxl\", \"dall-e-3\"];\n }\n if (lower.includes(\"recraft\")) {\n return [\"recraft-v3\", \"recraft-ai/recraft-v3\", \"dall-e-3\"];\n }\n if (lower.includes(\"ideogram\")) {\n return [\n \"ideogram-v2\",\n \"ideogram-ai/ideogram-v2\",\n \"ideogram-v2-turbo\",\n \"dall-e-3\",\n ];\n }\n if (lower.includes(\"imagen\")) {\n return [\"google/imagen-3\", \"imagen-3\", \"dall-e-3\"];\n }\n if (lower.includes(\"photon\")) {\n return [\"luma/photon\", \"photon\", \"dall-e-3\"];\n }\n\n return [requestedModel, \"flux-schnell\", \"dall-e-3\"];\n}\n\n/**\n * Résolution des alias de modèles\n */\nfunction resolveImageModel(requestedModel: string): string {\n if (!requestedModel) return \"flux-schnell\";\n const candidates = getCometCandidateModelIds(requestedModel);\n return candidates[0] || requestedModel;\n}\n\n/**\n * Formatage d'un modèle d'image selon le schéma OpenAI Model Specification\n */\nfunction formatOpenAiImageModel(m: any): ImageModelItem {\n const modelId = m.id || \"image-model\";\n const org = m.owned_by || modelId.split(\"/\")[0] || \"cometapi\";\n const created = Number(m.created) ||\n Math.floor(Date.now() / 1000) - 86_400 * 30;\n const features = m.features ||\n m.supported_features ||\n (modelId.toLowerCase().includes(\"diffusion\") ||\n modelId.toLowerCase().includes(\"midjourney\")\n ? [\"text-to-image\", \"image-to-image\"]\n : [\"text-to-image\"]);\n\n const form = m.form || detectModelForm(modelId, features);\n const endpoints = m.endpoints || (\n form === \"midjourney-pipeline\"\n ? [\n \"/v1/images/generations\",\n \"/mj/submit/imagine\",\n \"/mj/submit/action\",\n \"/mj/task/:id/fetch\",\n ]\n : form === \"image-edit\"\n ? [\"/v1/images/edits\", \"/v1/images/generations\"]\n : form === \"image-upscale\"\n ? [\"/v1/images/upscale\"]\n : [\"/v1/images/generations\", \"/v1/images/edits\"]\n );\n\n return {\n capabilities: {\n async_task: true,\n image_to_image: features.includes(\"image-to-image\") ||\n form === \"image-edit\",\n inpainting: features.includes(\"inpainting\") ||\n features.includes(\"image-to-image\"),\n text_to_image: true,\n upscaling: features.includes(\"upscale\") || form === \"image-upscale\" ||\n form === \"midjourney-pipeline\",\n variation: features.includes(\"variation\") ||\n form === \"midjourney-pipeline\",\n },\n created,\n description: m.description ||\n `Modèle de génération d'images haute fidélité ${m.name || modelId}.`,\n endpoints,\n features,\n form,\n id: modelId,\n name: m.name || modelId,\n object: \"model\",\n owned_by: org,\n parent: null,\n permission: [\n {\n allow_create_engine: false,\n allow_fine_tuning: false,\n allow_logprobs: true,\n allow_sampling: true,\n allow_search_indices: false,\n allow_view: true,\n created,\n group: null,\n id: `modelperm-${modelId.replace(/[^a-zA-Z0-9]/g, \"-\")}`,\n is_blocking: false,\n object: \"model_permission\",\n organization: \"*\",\n },\n ],\n root: modelId,\n };\n}\n\n/**\n * Récupération dynamique et filtrage en temps réel des modèles d'images depuis CometAPI\n */\nasync function fetchLiveCometImageModels(): Promise<ImageModelItem[]> {\n const now = Date.now();\n if (\n cachedCometImageModels.length > 0 && now - lastCometFetchTime < CACHE_TTL_MS\n ) {\n return cachedCometImageModels;\n }\n\n const cometApiKey = getCometApiKey();\n if (!cometApiKey) {\n return FALLBACK_IMAGE_MODELS;\n }\n\n try {\n const res = await fetch(\"https://api.cometapi.com/v1/models\", {\n headers: {\n Authorization: `Bearer ${cometApiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n });\n\n if (!res.ok) {\n console.warn(`[CometAPI] /v1/models réponse non-OK (${res.status})`);\n return cachedCometImageModels.length > 0\n ? cachedCometImageModels\n : FALLBACK_IMAGE_MODELS;\n }\n\n const json = await res.json();\n const rawModels: any[] = json.data || json.models || [];\n\n // Filtrage dynamique multi-formes des modèles d'image\n const imageModels = rawModels.filter((m: any) => {\n if (!m || !m.id) return false;\n const mType = String(\n m.model_type ||\n m.type ||\n m.architecture?.modality ||\n m.object ||\n \"\",\n ).toLowerCase();\n const outputModalities = (m.architecture?.output_modalities || []).map((\n o: string,\n ) => String(o).toLowerCase());\n const features = (m.features || m.supported_features || []).map((\n f: string,\n ) => String(f).toLowerCase());\n const idLower = String(m.id).toLowerCase();\n\n const isImageModality = mType.includes(\"image\") ||\n outputModalities.includes(\"image\") ||\n mType.endsWith(\"->image\") ||\n mType.includes(\"text->image\");\n\n const hasImageFeature = features.includes(\"text-to-image\") ||\n features.includes(\"image-to-image\") ||\n features.includes(\"inpainting\") ||\n features.includes(\"image\");\n\n const matchesImageKeyword = idLower.includes(\"flux\") ||\n idLower.includes(\"diffusion\") ||\n idLower.includes(\"dall-e\") ||\n idLower.includes(\"midjourney\") ||\n idLower.includes(\"mj-\") ||\n idLower.includes(\"recraft\") ||\n idLower.includes(\"ideogram\") ||\n idLower.includes(\"imagen\") ||\n idLower.includes(\"photon\") ||\n idLower.includes(\"kling\") ||\n idLower.includes(\"kolors\") ||\n idLower.includes(\"sdxl\") ||\n idLower.includes(\"stable-diffusion\") ||\n idLower.startsWith(\"sd-\") ||\n idLower.includes(\"qwen-image\") ||\n idLower.includes(\"gpt-image\");\n\n return isImageModality || hasImageFeature || matchesImageKeyword;\n });\n\n if (imageModels.length > 0) {\n const formatted = imageModels.map(formatOpenAiImageModel);\n cachedCometImageModels = formatted;\n lastCometFetchTime = now;\n return formatted;\n }\n\n return cachedCometImageModels.length > 0\n ? cachedCometImageModels\n : FALLBACK_IMAGE_MODELS;\n } catch (err) {\n console.error(\"[CometAPI] Erreur de récupération des modèles:\", err);\n return cachedCometImageModels.length > 0\n ? cachedCometImageModels\n : FALLBACK_IMAGE_MODELS;\n }\n}\n\n/**\n * Exécuteur robuste multi-stratégie pour la génération d'images CometAPI\n */\nasync function callCometImageGeneration(params: {\n apiKey: string;\n isEdit?: boolean;\n isVariation?: boolean;\n mask?: string;\n model: string;\n n: number;\n negativePrompt?: string;\n prompt: string;\n quality?: string;\n responseFormat?: string;\n seed?: number;\n size: string;\n sourceImage?: string;\n style?: string;\n}): Promise<\n {\n data: Array<{ b64_json?: string; revised_prompt?: string; url?: string }>;\n usedModel: string;\n }\n> {\n const {\n apiKey,\n prompt,\n size,\n n,\n responseFormat,\n quality,\n style,\n negativePrompt,\n seed,\n sourceImage,\n mask,\n isEdit,\n isVariation,\n } = params;\n\n const candidateModels = getCometCandidateModelIds(params.model);\n let lastErrorText = \"\";\n\n for (const candidate of candidateModels) {\n // 1. Construire le payload de base minimal\n const basePayload: Record<string, unknown> = {\n model: candidate,\n prompt,\n size: size || \"1024x1024\",\n };\n\n if (n && n > 1) {\n basePayload.n = Math.min(n, 4);\n }\n if (responseFormat && responseFormat === \"b64_json\") {\n basePayload.response_format = \"b64_json\";\n }\n if (quality) {\n basePayload.quality = quality;\n }\n if (style) {\n basePayload.style = style;\n }\n if (negativePrompt) {\n basePayload.negative_prompt = negativePrompt;\n }\n if (seed !== undefined) {\n basePayload.seed = seed;\n }\n if (sourceImage) {\n basePayload.image = sourceImage;\n }\n if (mask) {\n basePayload.mask = mask;\n }\n\n const endpointUrl = isEdit\n ? \"https://api.cometapi.com/v1/images/edits\"\n : isVariation\n ? \"https://api.cometapi.com/v1/images/variations\"\n : \"https://api.cometapi.com/v1/images/generations\";\n\n let currentPayload = { ...basePayload };\n\n for (let attempt = 0; attempt < 2; attempt++) {\n try {\n const res = await fetch(endpointUrl, {\n body: JSON.stringify(currentPayload),\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n method: \"POST\",\n });\n\n if (res.ok) {\n const json = await res.json().catch(() => ({}));\n const rawList = json.data || json.images || [];\n if (Array.isArray(rawList) && rawList.length > 0) {\n const formatted = rawList.map((img: any) => {\n const rawUrl = img.url || \"\";\n const b64 = img.b64_json || \"\";\n const resolved = normalizeImageSrc(rawUrl || b64);\n return {\n b64_json: b64 ||\n (responseFormat === \"b64_json\" && resolved.startsWith(\"data:\")\n ? resolved.split(\",\")[1]\n : undefined),\n revised_prompt: img.revised_prompt || prompt,\n url: resolved || rawUrl,\n };\n });\n return { data: formatted, usedModel: candidate };\n }\n }\n\n lastErrorText = await res.text().catch(() => \"\");\n console.warn(\n `[CometAPI] Modèle '${candidate}' tentative ${\n attempt + 1\n } échouée (${res.status}):`,\n lastErrorText,\n );\n\n // Si l'erreur indique un paramètre inconnu (ex: 'style', 'quality', 'seed', etc.)\n if (\n lastErrorText.includes(\"Unknown parameter\") ||\n lastErrorText.includes(\"unknown_parameter\")\n ) {\n // Supprimer les paramètres optionnels et re-tenter immédiatement\n currentPayload = {\n model: candidate,\n prompt,\n size: size || \"1024x1024\",\n };\n continue;\n }\n } catch (fetchErr: unknown) {\n lastErrorText = fetchErr instanceof Error\n ? fetchErr.message\n : \"Erreur réseau\";\n console.warn(\n `[CometAPI] Exception fetch '${candidate}':`,\n lastErrorText,\n );\n }\n break;\n }\n }\n\n // 2. Fallback alternatif : essayer via /v1/chat/completions sur CometAPI\n try {\n const chatRes = await fetch(\n \"https://api.cometapi.com/v1/chat/completions\",\n {\n body: JSON.stringify({\n messages: [\n {\n content: `Generate this image: ${prompt}`,\n role: \"user\",\n },\n ],\n model: \"dall-e-3\",\n }),\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n method: \"POST\",\n },\n );\n\n if (chatRes.ok) {\n const chatJson = await chatRes.json();\n const content = chatJson.choices?.[0]?.message?.content || \"\";\n const match = content.match(/!\\[.*?\\]\$(https?:\\/\\/[^\\s\$]+)\\)/) ||\n content.match(/(https?:\\/\\/[^\\s\\)]+\\.(?:png|jpg|jpeg|webp))/i);\n if (match && match[1]) {\n return {\n data: [\n {\n revised_prompt: prompt,\n url: normalizeImageSrc(match[1]),\n },\n ],\n usedModel: \"chat-image-fallback\",\n };\n }\n }\n } catch {}\n\n throw new Error(\n `Erreur fournisseur Comet API: ${\n lastErrorText ||\n \"Impossible de générer l'image après plusieurs tentatives\"\n }`,\n );\n}\n\n/**\n * Exécuteur et pont asynchrone pour les tâches Midjourney sur CometAPI\n */\nasync function executeMidjourneyImagineBridge(\n prompt: string,\n cometApiKey: string,\n options?: {\n aspectRatio?: string;\n base64Array?: string[];\n notifyHook?: string;\n },\n): Promise<\n { failReason?: string; imageUrl: string; progress?: string; taskId?: string }\n> {\n let finalPrompt = prompt.trim();\n if (options?.aspectRatio && !finalPrompt.includes(\"--ar\")) {\n finalPrompt = `${finalPrompt} --ar ${options.aspectRatio}`;\n }\n\n const payload: Record<string, unknown> = {\n prompt: finalPrompt,\n };\n if (options?.base64Array && options.base64Array.length > 0) {\n payload.base64Array = options.base64Array;\n }\n if (options?.notifyHook) {\n payload.notifyHook = options.notifyHook;\n }\n\n try {\n const submitRes = await fetch(\n \"https://api.cometapi.com/mj/submit/imagine\",\n {\n body: JSON.stringify(payload),\n headers: {\n Authorization: `Bearer ${cometApiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n method: \"POST\",\n },\n );\n\n if (submitRes.ok) {\n const submitJson = await submitRes.json();\n const taskId = submitJson.result || submitJson.task_id || submitJson.id;\n\n if (taskId) {\n // Polling actif jusqu'à succès (max 60s)\n const maxAttempts = 35;\n const pollIntervalMs = 1800;\n\n for (let attempt = 0; attempt < maxAttempts; attempt++) {\n await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));\n\n try {\n const fetchRes = await fetch(\n `https://api.cometapi.com/mj/task/${taskId}/fetch`,\n {\n headers: {\n Authorization: `Bearer ${cometApiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n },\n );\n\n if (!fetchRes.ok) continue;\n\n const taskJson = await fetchRes.json();\n const status = String(taskJson.status || \"\").toUpperCase();\n\n if (status === \"SUCCESS\") {\n const imgUrl = taskJson.imageUrl || taskJson.cdnImage ||\n taskJson.discordImage || taskJson.image_url;\n if (imgUrl) {\n return {\n imageUrl: imgUrl,\n progress: \"100%\",\n taskId,\n };\n }\n } else if (status === \"FAILURE\" || status === \"FAILED\") {\n break;\n }\n } catch {}\n }\n }\n }\n } catch (err) {\n console.warn(\"[CometAPI] Midjourney imagine bridge error:\", err);\n }\n\n // Si le bridge MJ natif échoue ou timeout, fallback transparent sur les générateurs d'images CometAPI\n const fallbackRes = await callCometImageGeneration({\n apiKey: cometApiKey,\n model: \"dall-e-3\",\n n: 1,\n prompt,\n size: \"1024x1024\",\n });\n\n return {\n imageUrl: fallbackRes.data[0]?.url || \"\",\n progress: \"100%\",\n taskId: \"fallback-standard\",\n };\n}\n\nexport function registerImageRoutes(app: Hono) {\n // ─────────────────────────────────────────────\n // GET /v1/models/images, /models/images & /v1/images/models (OpenAI Compatible)\n // ─────────────────────────────────────────────\n const handleGetImageModels = async (c: any) => {\n const userPlan = c.get(\"userPlan\");\n const shouldFilterFreeOnly = !isPaidTier(userPlan);\n\n try {\n let models = await fetchLiveCometImageModels();\n\n if (shouldFilterFreeOnly) {\n models = models.filter((m) => {\n const idLower = (m.id || \"\").toLowerCase();\n return idLower.includes(\"flux\") || idLower.includes(\"schnell\") ||\n idLower.includes(\"free\");\n });\n }\n\n return c.json({ data: models, object: \"list\" });\n } catch (_err) {\n let fallback = FALLBACK_IMAGE_MODELS;\n if (shouldFilterFreeOnly) {\n fallback = fallback.filter((m) => m.id.toLowerCase().includes(\"flux\"));\n }\n return c.json({\n data: fallback.map(formatOpenAiImageModel),\n object: \"list\",\n });\n }\n };\n\n app.get(\"/v1/models/images\", handleGetImageModels);\n app.get(\"/models/images\", handleGetImageModels);\n app.get(\"/v1/images/models\", handleGetImageModels);\n app.get(\"/images/models\", handleGetImageModels);\n\n // ─────────────────────────────────────────────\n // GET /v1/models/images/:id & /models/images/:id (OpenAI Model Detail)\n // ─────────────────────────────────────────────\n const handleGetSingleImageModel = async (c: any) => {\n const rawId = c.req.param(\"id\") || \"\";\n const resolvedId = resolveImageModel(rawId);\n\n const liveModels = await fetchLiveCometImageModels();\n const found = liveModels.find(\n (m) =>\n m.id.toLowerCase() === rawId.toLowerCase() ||\n m.id.toLowerCase() === resolvedId.toLowerCase() ||\n m.name.toLowerCase() === rawId.toLowerCase(),\n ) ||\n FALLBACK_IMAGE_MODELS.find(\n (m) =>\n m.id.toLowerCase() === rawId.toLowerCase() ||\n m.id.toLowerCase() === resolvedId.toLowerCase() ||\n m.name.toLowerCase() === rawId.toLowerCase(),\n ) || {\n created: Math.floor(Date.now() / 1000),\n description: `Modèle d'image ${rawId}.`,\n features: [\"text-to-image\"],\n form: detectModelForm(resolvedId, [\"text-to-image\"]),\n id: resolvedId,\n name: rawId,\n object: \"model\" as const,\n owned_by: resolvedId.split(\"/\")[0] || \"cometapi\",\n };\n\n return c.json(formatOpenAiImageModel(found));\n };\n\n app.get(\"/v1/models/images/:id\", handleGetSingleImageModel);\n app.get(\"/models/images/:id\", handleGetSingleImageModel);\n\n // ─────────────────────────────────────────────\n // GET /v1/images/usage & /images/usage\n // ─────────────────────────────────────────────\n const handleGetImageUsage = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n let userPlan = c.get(\"userPlan\") || \"Free\";\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n userPlan = (payload.tier as string) || userPlan;\n } catch {\n // Token non JWT ignoré\n }\n }\n\n const sql = getDb();\n\n if (token) {\n try {\n const keyRows = await sql`\n SELECT k.user_id, u.tier, u.email, u.username\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${token}::text\n LIMIT 1\n `;\n if (keyRows.length > 0) {\n userId = keyRows[0].user_id;\n userPlan = keyRows[0].tier || userPlan;\n }\n } catch {\n // Erreur DB ignorée\n }\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const [uRows, countRows] = await Promise.all([\n sql`SELECT tier FROM users WHERE id::text = ${userId}::text OR username = ${userId}::text OR email = ${userId}::text LIMIT 1`,\n sql`\n SELECT COALESCE(SUM(images_generated::numeric), 0) as images_generated \n FROM mprojects_daily_image_usage \n WHERE (\n user_id = ${userId}::text \n OR user_id IN (SELECT id::text FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR user_id IN (SELECT email FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR user_id IN (SELECT username FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n ) AND usage_date = CURRENT_DATE \n LIMIT 1\n `.catch(() => []),\n ]);\n\n const keyTier = extractTierFromApiKey(token);\n const effectiveTier = keyTier || uRows[0]?.tier || userPlan || \"Free\";\n const usedToday = Number(countRows[0]?.images_generated || 0);\n const imageBoost = await getUserQuotaBoost(sql, userId, \"images\");\n const dailyLimit = getTierDailyImageLimit(effectiveTier) + imageBoost;\n\n const now = new Date();\n const tomorrowMidnight = new Date(\n Date.UTC(\n now.getUTCFullYear(),\n now.getUTCMonth(),\n now.getUTCDate() + 1,\n 0,\n 0,\n 0,\n ),\n );\n\n return c.json({\n dailyLimit,\n plan: effectiveTier,\n resetAt: tomorrowMidnight.toISOString(),\n usedToday,\n userId,\n });\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : \"Erreur inconnue\";\n return c.json(\n {\n details: msg,\n error: \"Erreur lors de la récupération de l'usage image.\",\n },\n 500,\n );\n }\n };\n\n app.get(\"/v1/images/usage\", handleGetImageUsage);\n app.get(\"/images/usage\", handleGetImageUsage);\n\n // ─────────────────────────────────────────────\n // GET /v1/images/history & /images/history\n // ─────────────────────────────────────────────\n const handleGetImageHistory = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {\n // Token invalide ignoré\n }\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const sql = getDb();\n const history = await sql`\n SELECT id, title, pinned, model, prompt, negative_prompt, width, height, image_url, status, created_at\n FROM mprojects_image_generations\n WHERE user_id = ${userId}::text\n ORDER BY pinned DESC, created_at DESC\n LIMIT 50\n `.catch(() => []);\n\n const formattedHistory = history.map((item: any) => ({\n ...item,\n image_url: normalizeImageSrc(item.image_url),\n pinned: Boolean(item.pinned),\n title: item.title || null,\n }));\n\n return c.json({ data: formattedHistory, success: true });\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : \"Erreur inconnue\";\n return c.json(\n { details: msg, error: \"Erreur historique images.\" },\n 500,\n );\n }\n };\n\n const handleUpdateImageHistory = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const id = c.req.param(\"id\") || c.req.query(\"id\");\n if (!id) {\n return c.json({ error: \"ID manquant.\" }, 400);\n }\n\n const body = await c.req.json().catch(() => ({}));\n const sql = getDb();\n const sets: string[] = [];\n const values: any[] = [];\n let idx = 1;\n\n if (body.title !== undefined) {\n sets.push(`title = $${idx++}`);\n values.push(\n body.title ? String(body.title).trim().slice(0, 200) : null,\n );\n }\n if (body.pinned !== undefined) {\n sets.push(`pinned = $${idx++}`);\n values.push(Boolean(body.pinned));\n }\n\n if (sets.length === 0) {\n return c.json({ success: true });\n }\n\n values.push(id, userId);\n const query = `UPDATE mprojects_image_generations SET ${\n sets.join(\", \")\n } WHERE id::text = $${idx++}::text AND user_id = $${idx}::text RETURNING id, title, pinned`;\n const result = await sql.unsafe(query, values);\n\n return c.json({ data: result[0] || null, success: true });\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : \"Erreur inconnue\";\n return c.json({ details: msg, error: \"Erreur mise à jour image.\" }, 500);\n }\n };\n\n app.get(\"/v1/images/history\", handleGetImageHistory);\n app.get(\"/images/history\", handleGetImageHistory);\n app.patch(\"/v1/images/history/:id\", handleUpdateImageHistory);\n app.patch(\"/v1/images/history\", handleUpdateImageHistory);\n app.patch(\"/images/history/:id\", handleUpdateImageHistory);\n app.patch(\"/images/history\", handleUpdateImageHistory);\n\n // ─────────────────────────────────────────────\n // POST /v1/images/generations & Formes Multi-Modèles (OpenAI, Midjourney, Google SDK)\n // ─────────────────────────────────────────────\n const handleImageGeneration = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n const authHeader = c.req.header(\"Authorization\");\n const headerApiKey = c.req.header(\"x-api-key\") ||\n c.req.header(\"X-API-Key\") ||\n c.req.header(\"x-goog-api-key\") ||\n c.req.header(\"X-Goog-Api-Key\");\n const apiKey = authHeader?.startsWith(\"Bearer \")\n ? authHeader.slice(7)\n : headerApiKey || null;\n\n let userId = c.get(\"userId\");\n let userPlan = c.get(\"userPlan\") || \"Free\";\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n userPlan = (payload.tier as string) || userPlan;\n } catch {\n // Token non JWT ignoré\n }\n }\n\n if (!userId) {\n return c.json(\n {\n error: {\n code: \"invalid_api_key\",\n message: \"Non authentifié. Clé API ou token requis.\",\n param: null,\n type: \"authentication_error\",\n },\n },\n 401,\n );\n }\n\n const body = await c.req.json().catch(() => ({}));\n const reqPath = c.req.path || \"\";\n const isGoogleFormat = reqPath.includes(\":generateImages\") ||\n reqPath.includes(\":predict\") ||\n Boolean(body.instances || body.numberOfImages || body.aspectRatio);\n\n const rawPrompt = body.prompt ||\n body.instances?.[0]?.prompt ||\n body.parameters?.prompt ||\n \"\";\n const prompt = typeof rawPrompt === \"string\" ? rawPrompt.trim() : \"\";\n\n const pathModel = reqPath\n .replace(/^\\/(v1beta|v1)\\/models\\//, \"\")\n .replace(/:(generateImages|predict).*$/, \"\");\n const requestedModel = body.model || pathModel ||\n \"black-forest-labs/flux-schnell\";\n\n const model = resolveImageModel(requestedModel);\n const modelForm = detectModelForm(model, []);\n\n // Résolution des dimensions et aspect ratio\n let width = 1024;\n let height = 1024;\n const aspectRatioStr = body.aspect_ratio || body.aspectRatio || \"\";\n\n if (aspectRatioStr) {\n const ar = String(aspectRatioStr).trim();\n if (ar === \"16:9\") {\n width = 1280;\n height = 720;\n } else if (ar === \"9:16\") {\n width = 720;\n height = 1280;\n } else if (ar === \"4:3\") {\n width = 1024;\n height = 768;\n } else if (ar === \"3:4\") {\n width = 768;\n height = 1024;\n } else if (ar === \"21:9\") {\n width = 1536;\n height = 640;\n }\n } else if (body.size) {\n const parts = String(body.size).split(\"x\");\n if (parts.length === 2) {\n width = Number.parseInt(parts[0], 10) || 1024;\n height = Number.parseInt(parts[1], 10) || 1024;\n }\n } else {\n if (body.width) width = Number(body.width);\n if (body.height) height = Number(body.height);\n }\n\n const negativePrompt = body.negative_prompt || \"\";\n const n = Math.max(\n 1,\n Math.min(Number(body.n || body.numberOfImages || 1), 4),\n );\n const responseFormat = body.response_format || \"url\";\n const quality = body.quality ? String(body.quality) : undefined;\n const style = body.style ? String(body.style) : undefined;\n\n if (!prompt) {\n return c.json(\n {\n error: {\n code: \"missing_prompt\",\n message:\n \"Le paramètre 'prompt' est obligatoire pour la génération d'images.\",\n param: \"prompt\",\n type: \"invalid_request_error\",\n },\n },\n 400,\n );\n }\n\n const sql = getDb();\n\n // Vérifier le forfait utilisateur réel\n const uRows = await sql`\n SELECT tier FROM users \n WHERE id::text = ${userId}::text OR username = ${userId}::text \n LIMIT 1\n `;\n const keyTier = extractTierFromApiKey(token);\n const effectiveTier = keyTier || uRows[0]?.tier || userPlan || \"Free\";\n const requestQuota = (c as any).get?.(\"requestQuota\") as\n | {\n apiKey: string | null;\n limit: number;\n remaining: number;\n used: number;\n }\n | undefined;\n\n if (!isPaidTier(effectiveTier)) {\n return c.json(\n {\n error: {\n code: \"image_generation_tier_restricted\",\n message:\n `La génération d'images via l'API est réservée aux abonnements payants (Plus, Pro, Max). Les clés API issues d'un compte Free ne sont pas autorisées à effectuer de requêtes de génération d'images.`,\n param: null,\n type: \"permission_error\",\n },\n },\n 403,\n );\n }\n\n const imageBoost = await getUserQuotaBoost(sql, userId, \"images\");\n const dailyLimit = getTierDailyImageLimit(effectiveTier) + imageBoost;\n const usageRows = await sql`\n SELECT images_generated \n FROM mprojects_daily_image_usage \n WHERE user_id = ${userId}::text AND usage_date = CURRENT_DATE \n LIMIT 1\n `;\n const currentDailyUsage = Number(usageRows[0]?.images_generated || 0);\n\n if (currentDailyUsage + n > dailyLimit) {\n return c.json(\n {\n error: {\n code: \"daily_image_quota_exceeded\",\n limit: dailyLimit,\n message:\n `Votre quota journalier de génération d'images est épuisé (${currentDailyUsage}/${dailyLimit} par jour pour le forfait ${effectiveTier}, ${n} image(s) demandée(s)). Réinitialisation automatique à minuit UTC.`,\n requested: n,\n type: \"quota_error\",\n used: currentDailyUsage,\n },\n },\n 429,\n );\n }\n\n // Le crédit API débité est le coût du tier multiplié par le nombre d'images demandées:\n // il doit rester assez pour la requête AVANT d'appeler le fournisseur.\n const totalRequestCost = getTierImageRequestCost(effectiveTier) * n;\n if (\n requestQuota &&\n requestQuota.used + totalRequestCost > requestQuota.limit\n ) {\n return c.json(\n {\n error: {\n code: \"insufficient_api_requests\",\n dailyLimit,\n limit: requestQuota.limit,\n message:\n `Requête refusée : ${totalRequestCost} crédits API sont nécessaires pour générer ${n} image(s) avec le forfait ${effectiveTier}, il n'en reste que ${requestQuota.remaining} sur ${requestQuota.limit} cette semaine.`,\n remaining: requestQuota.remaining,\n required: totalRequestCost,\n type: \"quota_error\",\n used: requestQuota.used,\n },\n },\n 429,\n );\n }\n\n // Appel de Comet API avec exécution multi-stratégie & gestion des erreurs\n const cometApiKey = getCometApiKey();\n let generatedImageUrl = \"\";\n let cometResultData: Array<\n { b64_json?: string; revised_prompt?: string; url?: string }\n > = [];\n let finalUsedModel = model;\n\n if (cometApiKey) {\n if (\n modelForm === \"midjourney-pipeline\" && !reqPath.includes(\"/edits\")\n ) {\n const mjRes = await executeMidjourneyImagineBridge(\n prompt,\n cometApiKey,\n {\n aspectRatio: aspectRatioStr ||\n (width !== height ? `${width}:${height}` : undefined),\n base64Array: body.image ? [body.image] : undefined,\n },\n );\n generatedImageUrl = normalizeImageSrc(mjRes.imageUrl);\n cometResultData = [{\n revised_prompt: prompt,\n url: generatedImageUrl,\n }];\n } else {\n const genResult = await callCometImageGeneration({\n apiKey: cometApiKey,\n isEdit: reqPath.includes(\"/edits\") ||\n Boolean(body.image && body.mask),\n isVariation: reqPath.includes(\"/variations\"),\n mask: body.mask,\n model,\n n,\n negativePrompt,\n prompt,\n quality,\n responseFormat,\n seed: body.seed,\n size: `${width}x${height}`,\n sourceImage: body.image || body.image_url,\n style,\n });\n\n cometResultData = genResult.data;\n finalUsedModel = genResult.usedModel;\n if (cometResultData.length > 0) {\n generatedImageUrl = cometResultData[0].url || \"\";\n }\n }\n } else {\n generatedImageUrl = `https://picsum.photos/seed/${\n encodeURIComponent(prompt.slice(0, 20))\n }/${width}/${height}`;\n cometResultData = [{ revised_prompt: prompt, url: generatedImageUrl }];\n }\n\n // Incrémentation du quota journalier (1 par image générée)\n await sql`\n INSERT INTO mprojects_daily_image_usage (user_id, usage_date, images_generated, updated_at)\n VALUES (${userId}::text, CURRENT_DATE, ${n}, NOW())\n ON CONFLICT (user_id, usage_date)\n DO UPDATE SET \n images_generated = mprojects_daily_image_usage.images_generated + ${n},\n updated_at = NOW()\n `;\n\n // Enregistrement dans l'historique\n await sql`\n INSERT INTO mprojects_image_generations (\n user_id, api_key, model, prompt, negative_prompt, width, height, image_url, status\n ) VALUES (\n ${userId}::text,\n ${apiKey || null},\n ${finalUsedModel}::text,\n ${prompt}::text,\n ${negativePrompt || null},\n ${width}::integer,\n ${height}::integer,\n ${generatedImageUrl}::text,\n 'completed'\n )\n `;\n\n // Débit du compteur de requêtes de la clé API (cout x n verifie avant l'appel)\n const debitKey = requestQuota?.apiKey || apiKey;\n if (debitKey) {\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = request_count + ${totalRequestCost}, last_used_at = NOW()\n WHERE api_key = ${debitKey}::text\n `;\n (c as any).set?.(\"quotaDebitedByHandler\", true);\n }\n\n // Log de requête\n try {\n await sql`\n INSERT INTO mprojects_api_logs (api_key, endpoint, method, status_code, latency_ms, created_at)\n VALUES (${apiKey || \"anonymous\"}::text, ${\n reqPath || \"/v1/images/generations\"\n }::text, 'POST', 200, 1500, NOW())\n `;\n } catch {}\n\n // Format Google GenAI\n if (isGoogleFormat) {\n return c.json({\n generatedImages: cometResultData.map((img) => ({\n image: {\n imageBytes: img.b64_json || \"\",\n mimeType: \"image/png\",\n uri: img.url || generatedImageUrl,\n },\n })),\n });\n }\n\n // Format OpenAI Standard\n return c.json({\n created: Math.floor(Date.now() / 1000),\n data: cometResultData,\n model: finalUsedModel,\n usage: {\n daily_limit: dailyLimit,\n daily_used: currentDailyUsage + n,\n plan: effectiveTier,\n request_cost: totalRequestCost,\n requests_counted: totalRequestCost,\n },\n });\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : \"Erreur inconnue\";\n console.error(\"[ImagesAPI] Erreur serveur génération:\", err);\n return c.json(\n {\n error: {\n code: \"image_generation_failed\",\n details: msg,\n message: `Erreur lors de la génération d'image : ${msg}`,\n type: \"api_error\",\n },\n },\n 500,\n );\n }\n };\n\n // ─────────────────────────────────────────────\n // POST & GET Routes Midjourney Dédiées (`/mj/*` et `/v1/mj/*`)\n // ─────────────────────────────────────────────\n const handleMidjourneyForward = async (c: any) => {\n const cometApiKey = getCometApiKey();\n if (!cometApiKey) {\n return c.json({\n error: \"Clé COMET_API_KEY non configurée sur le serveur.\",\n }, 500);\n }\n\n const subPath = c.req.path.replace(/^\\/v1\\/mj\\//, \"\").replace(\n /^\\/mj\\//,\n \"\",\n );\n const targetUrl = `https://api.cometapi.com/mj/${subPath}`;\n const method = c.req.method;\n\n try {\n const init: RequestInit = {\n headers: {\n Authorization: `Bearer ${cometApiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n method,\n };\n\n if (method === \"POST\" || method === \"PUT\" || method === \"PATCH\") {\n const reqBody = await c.req.json().catch(() => ({}));\n init.body = JSON.stringify(reqBody);\n }\n\n const res = await fetch(targetUrl, init);\n const data = await res.json().catch(() => ({}));\n return c.json(data, res.status as any);\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : \"Erreur inconnue\";\n return c.json(\n { error: \"Erreur proxy Midjourney CometAPI\", details: msg },\n 500,\n );\n }\n };\n\n app.post(\"/mj/submit/imagine\", handleMidjourneyForward);\n app.post(\"/v1/mj/submit/imagine\", handleMidjourneyForward);\n app.get(\"/mj/task/:id/fetch\", handleMidjourneyForward);\n app.get(\"/v1/mj/task/:id/fetch\", handleMidjourneyForward);\n app.post(\"/mj/submit/action\", handleMidjourneyForward);\n app.post(\"/v1/mj/submit/action\", handleMidjourneyForward);\n app.post(\"/mj/submit/describe\", handleMidjourneyForward);\n app.post(\"/v1/mj/submit/describe\", handleMidjourneyForward);\n app.post(\"/mj/submit/blend\", handleMidjourneyForward);\n app.post(\"/v1/mj/submit/blend\", handleMidjourneyForward);\n app.post(\"/mj/submit/change\", handleMidjourneyForward);\n app.post(\"/v1/mj/submit/change\", handleMidjourneyForward);\n app.post(\"/mj/submit/modal\", handleMidjourneyForward);\n app.post(\"/v1/mj/submit/modal\", handleMidjourneyForward);\n app.post(\"/mj/submit/shorten\", handleMidjourneyForward);\n app.post(\"/v1/mj/submit/shorten\", handleMidjourneyForward);\n app.post(\"/mj/submit/swap-face\", handleMidjourneyForward);\n app.post(\"/v1/mj/submit/swap-face\", handleMidjourneyForward);\n\n // ─────────────────────────────────────────────\n // POST & GET Routes Upscale, Edits, Variations & Tasks\n // ─────────────────────────────────────────────\n const handleImageUpscale = async (c: any) => {\n const cometApiKey = getCometApiKey();\n if (!cometApiKey) {\n return c.json({ error: \"Clé COMET_API_KEY non configurée.\" }, 500);\n }\n try {\n const body = await c.req.json().catch(() => ({}));\n const res = await fetch(\"https://api.cometapi.com/v1/images/upscale\", {\n body: JSON.stringify(body),\n headers: {\n Authorization: `Bearer ${cometApiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n method: \"POST\",\n });\n const data = await res.json().catch(() => ({}));\n return c.json(data, res.status as any);\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : \"Erreur inconnue\";\n return c.json({ error: \"Erreur upscale image\", details: msg }, 500);\n }\n };\n\n app.post(\"/v1/images/upscale\", handleImageUpscale);\n app.post(\"/images/upscale\", handleImageUpscale);\n\n const handleFetchImageTask = async (c: any) => {\n const taskId = c.req.param(\"id\");\n const cometApiKey = getCometApiKey();\n if (!cometApiKey) {\n return c.json({ error: \"Clé COMET_API_KEY non configurée.\" }, 500);\n }\n try {\n const res = await fetch(\n `https://api.cometapi.com/mj/task/${taskId}/fetch`,\n {\n headers: {\n Authorization: `Bearer ${cometApiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n },\n );\n const data = await res.json().catch(() => ({}));\n return c.json(data, res.status as any);\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : \"Erreur inconnue\";\n return c.json({ error: \"Erreur récupération tâche\", details: msg }, 500);\n }\n };\n\n app.get(\"/v1/images/tasks/:id\", handleFetchImageTask);\n app.get(\"/images/tasks/:id\", handleFetchImageTask);\n app.get(\"/v1/tasks/:id\", handleFetchImageTask);\n app.get(\"/tasks/:id\", handleFetchImageTask);\n\n // Routes OpenAI & Anthropic SDK\n app.post(\"/v1/images/generations\", handleImageGeneration);\n app.post(\"/images/generations\", handleImageGeneration);\n app.post(\"/v1/images\", handleImageGeneration);\n app.post(\"/images\", handleImageGeneration);\n app.post(\"/v1/images/edits\", handleImageGeneration);\n app.post(\"/images/edits\", handleImageGeneration);\n app.post(\"/v1/images/variations\", handleImageGeneration);\n app.post(\"/images/variations\", handleImageGeneration);\n\n // Routes Google GenAI / Gemini / Vertex SDK\n app.post(\"/v1beta/models/*:generateImages\", handleImageGeneration);\n app.post(\"/v1/models/*:generateImages\", handleImageGeneration);\n app.post(\"/v1beta/models/*:predict\", handleImageGeneration);\n app.post(\"/v1/models/*:predict\", handleImageGeneration);\n}",[271],"646983a8-643a-4deb-bfd9-b75047499f3c","email.ts","e9725edc-9c6a-11f1-8111-1607ee4eb77e",["D",1788164141214],"import nodemailer from \"npm:nodemailer\";\n\nfunction escapeHtml(str: string): string {\n return String(str)\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nfunction getEnv(key: string): string | undefined {\n if (typeof process !== \"undefined\" && process.env && process.env[key]) {\n return process.env[key];\n }\n // @ts-expect-error Nodemailer transport typing is incompatible with the configured transport.\n if (typeof Deno !== \"undefined\" && Deno.env && Deno.env.get) {\n // @ts-expect-error Nodemailer transport typing is incompatible with the configured transport.\n return Deno.env.get(key);\n }\n return undefined;\n}\n\nexport async function sendVerificationEmail(\n email: string,\n code: string,\n action: string,\n extraInfo?: any,\n) {\n // Log du code pour développement / debugging\n const maskedEmail = email.replace(/(.{2}).*(@.*)/, \"$1***$2\");\n console.log(\n `[EMAIL] action=${action} to=${maskedEmail} hasCode=${\n Boolean(code)\n } code=${code}`,\n );\n\n let subject = \"Notification - mAI\";\n let title = \"Notification\";\n let textContent = \"\";\n let showCode = code ? true : false;\n\n switch (action) {\n case \"register\":\n subject = \"Vérifiez votre adresse e-mail - mAI\";\n title = \"Vérification d'inscription\";\n textContent =\n \"Voici votre code de vérification à 6 chiffres pour votre compte <strong>mAI</strong> :\";\n break;\n case \"login\":\n subject = \"Code de vérification de connexion - mAI\";\n title = \"Vérification de connexion\";\n textContent =\n \"Voici votre code de vérification à 6 chiffres pour votre compte <strong>mAI</strong> :\";\n break;\n case \"verify_new_email\":\n subject = \"Vérification de votre nouvelle adresse e-mail - mAI\";\n title = \"Changement d'e-mail\";\n textContent =\n \"Voici le code de vérification pour confirmer votre nouvelle adresse e-mail :\";\n break;\n case \"delete_account\":\n subject = \"Code de suppression de compte - mAI\";\n title = \"Suppression du compte\";\n textContent =\n \"Vous avez demandé la suppression de votre compte. Voici votre code à 8 chiffres :\";\n break;\n case \"subscription_unlocked\": {\n const tierUnlocked = escapeHtml(extraInfo?.tier || \"Pro\");\n subject = `Merci d'avoir souscrit au forfait ${tierUnlocked} ! - mAI`;\n title = `Merci d'avoir souscrit au forfait ${tierUnlocked} !`;\n showCode = false;\n textContent =\n `Nous vous remercions chaleureusement pour votre souscription au forfait <strong>${tierUnlocked}</strong> sur <strong>mAI</strong> !<br><br>\n Votre compte bénéficie dès maintenant de vos nouveaux quotas étendus pour l'ensemble de vos applications et clés d'API (tokens mAI, requêtes API et stockage Cloud).<br><br>\n Toute l'équipe mDevsLabs vous remercie pour votre confiance et vous souhaite une excellente expérience créative et productive avec mAI.`;\n break;\n }\n case \"new_login\": {\n subject = \"Nouvelle connexion détectée - mAI\";\n title = \"Alerte de sécurité\";\n showCode = false;\n const device = escapeHtml(extraInfo?.device || \"Appareil inconnu\");\n const location = escapeHtml(extraInfo?.location || \"Lieu inconnu\");\n textContent =\n `Une nouvelle connexion à votre compte <strong>mAI</strong> a été détectée depuis :<br><br>\n <strong>Appareil :</strong> ${device}<br>\n <strong>Localisation :</strong> ${location}<br><br>\n Si vous êtes à l'origine de cette connexion, aucune action n'est requise. Sinon, modifiez immédiatement votre mot de passe et déconnectez cet appareil.`;\n break;\n }\n }\n\n const html = `\n <!DOCTYPE html>\n <html>\n <head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n </head>\n <body style=\"margin:0; padding:0; background-color:#090d16; font-family:'Segoe UI', Roboto, Helvetica, Arial, sans-serif; color:#f8fafc;\">\n <div style=\"max-width:560px; margin:40px auto; background:#111827; border:1px solid #1f293d; border-radius:16px; overflow:hidden; box-shadow:0 20px 25px -5px rgba(0,0,0,0.5);\">\n \n \n <div style=\"background:linear-gradient(135deg, #1e1b4b 0%, #31104b 100%); padding:32px 24px; text-align:center; border-bottom:1px solid #2e1065;\">\n <img src=\"https://upload.fs.fr/azq3C6GLea.png\" alt=\"mAI Logo\" style=\"height:48px; width:auto; max-width:180px; object-fit:contain; display:inline-block;\" />\n <h1 style=\"color:#ffffff; font-size:20px; font-weight:700; margin:16px 0 0 0; letter-spacing:-0.5px;\">${title}</h1>\n </div>\n\n \n <div style=\"padding:32px 28px; line-height:1.6; font-size:15px; color:#cbd5e1;\">\n <p style=\"margin-top:0;\">Bonjour,</p>\n <p>${textContent}</p>\n \n ${\n showCode\n ? `\n \n <div style=\"background:#1e293b; border:1px solid #334155; border-radius:12px; padding:24px; text-align:center; margin:28px 0;\">\n <div style=\"font-size:34px; font-weight:800; letter-spacing:8px; color:#a855f7; font-family:Consolas, Monaco, monospace; margin-bottom:12px; user-select:all;\">\n ${escapeHtml(code)}\n </div>\n <p style=\"font-size:12px; color:#94a3b8; margin:0;\">Code unique • Expire dans 10 minutes</p>\n </div>\n `\n : \"\"\n }\n\n <p style=\"font-size:13px; color:#94a3b8; margin-top:28px;\">Si vous n'êtes pas à l'origine de cette demande, vous pouvez l'ignorer ou sécuriser votre compte.</p>\n </div>\n\n \n <div style=\"background-color:#0b0f19; padding:20px 24px; text-align:center; border-top:1px solid #1e293b; font-size:12px; color:#64748b;\">\n <p style=\"margin:0 0 6px 0;\">© 2026 mAI — Plateforme d'Intelligence Artificielle & APIs</p>\n <p style=\"margin:0;\">Cet e-mail automatique a été envoyé de manière sécurisée.</p>\n </div>\n\n </div>\n </body>\n </html>\n `;\n\n await sendHtmlEmail(email, subject, html);\n}\n\n// ─────────────────────────────────────────────\n// Envoi d'e-mail générique avec fallback\n// ─────────────────────────────────────────────\nexport async function sendHtmlEmail(\n to: string,\n subject: string,\n html: string,\n): Promise<boolean> {\n // 1. Google Apps Script (Recommandé)\n const googleScriptsUrl = getEnv(\"GOOGLE_SCRIPTS_URL\") ||\n getEnv(\"GOOGLE_SCRIPT_URL\");\n const googleScriptSecret = getEnv(\"GOOGLE_SCRIPTS_SECRET\") ||\n getEnv(\"GOOGLE_SCRIPT_SECRET\");\n\n if (googleScriptsUrl && googleScriptSecret) {\n try {\n const res = await fetch(googleScriptsUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n secret: googleScriptSecret,\n to,\n subject,\n htmlBody: html,\n body: \"Veuillez activer l'affichage HTML pour lire cet e-mail mAI.\",\n }),\n });\n\n if (res.ok) {\n const data = await res.json();\n if (data.success) {\n const maskedTo = to.replace(/(.{2}).*(@.*)/, \"$1***$2\");\n console.log(`[EMAIL] Google Apps Script OK to=${maskedTo}`);\n return true;\n } else {\n console.error(\"Erreur de retour Google Apps Script :\", data.error);\n }\n } else {\n console.error(\n \"Erreur HTTP Google Apps Script :\",\n res.status,\n res.statusText,\n );\n }\n } catch (err: any) {\n console.error(\n \"Erreur envoi via Google Apps Script :\",\n err?.message || err,\n );\n }\n }\n\n // 2. Fallback Gmail SMTP via Nodemailer\n const gmailUser = getEnv(\"GMAIL_USER\") || \"tusseaumathias85@gmail.com\";\n const gmailAppPass = getEnv(\"GMAIL_APP_PASSWORD\");\n\n if (gmailUser && gmailAppPass) {\n try {\n const transporter = nodemailer.createTransport({\n auth: {\n pass: gmailAppPass,\n user: gmailUser,\n },\n service: \"gmail\",\n });\n\n await transporter.sendMail({\n from: `\"mAI Support\" <${gmailUser}>`,\n html,\n subject,\n to,\n });\n\n const maskedTo = to.replace(/(.{2}).*(@.*)/, \"$1***$2\");\n console.log(`[EMAIL] Gmail SMTP OK to=${maskedTo}`);\n return true;\n } catch (err: any) {\n console.error(\"Erreur envoi Gmail SMTP :\", err?.message || err);\n }\n } else {\n console.warn(\n \"[EMAIL] Ni Google Apps Script ni Gmail SMTP configurés pour l'envoi.\",\n );\n }\n\n return false;\n}\n\n// ─────────────────────────────────────────────\n// Notifications pour le Support & Signalement de bugs\n// ─────────────────────────────────────────────\nexport interface SupportTicketEmailPayload {\n id: string;\n ticket_number?: number | string;\n user_id: string;\n user_email: string;\n user_name: string;\n user_tier?: string;\n title: string;\n description: string;\n category: string;\n project: string;\n priority: string;\n status?: string;\n created_at?: string;\n isAiGenerated?: boolean;\n}\n\nconst PRIORITY_COLORS: Record<\n string,\n { label: string; bg: string; text: string; border: string }\n> = {\n urgent: {\n label: \"Critique / Urgent\",\n bg: \"rgba(239, 68, 68, 0.15)\",\n text: \"#ef4444\",\n border: \"rgba(239, 68, 68, 0.4)\",\n },\n high: {\n label: \"Haute\",\n bg: \"rgba(249, 115, 22, 0.15)\",\n text: \"#f97316\",\n border: \"rgba(249, 115, 22, 0.4)\",\n },\n medium: {\n label: \"Normale\",\n bg: \"rgba(16, 185, 129, 0.15)\",\n text: \"#10b981\",\n border: \"rgba(16, 185, 129, 0.4)\",\n },\n low: {\n label: \"Faible\",\n bg: \"rgba(59, 130, 246, 0.15)\",\n text: \"#3b82f6\",\n border: \"rgba(59, 130, 246, 0.4)\",\n },\n};\n\n/**\n * Envoie un e-mail à mathias.tss2012@gmail.com pour lui présenter le nouveau ticket créé.\n */\nexport async function sendSupportTicketCreatedEmail({\n ticket,\n appUrl = \"https://m-ai.fr\",\n}: {\n ticket: SupportTicketEmailPayload;\n appUrl?: string;\n}) {\n const adminEmail = \"mathias.tss2012@gmail.com\";\n const ticketRef = ticket.ticket_number\n ? `#TICK-${ticket.ticket_number}`\n : `#${ticket.id.slice(0, 8)}`;\n const subject = `[Support mAI] Nouveau ticket ${ticketRef} : ${ticket.title}`;\n\n const priorityInfo = PRIORITY_COLORS[ticket.priority.toLowerCase()] ||\n PRIORITY_COLORS.medium;\n const directLink = `${\n appUrl.replace(/\\/$/, \"\")\n }/support/tickets/${ticket.id}`;\n const safeDescription = escapeHtml(ticket.description).replace(/\\n/g, \"<br>\");\n\n const html = `\n <!DOCTYPE html>\n <html lang=\"fr\">\n <head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n <title>${escapeHtml(subject)}\n \n \n

\n \n \n

\n $\"mAI$ \n

Nouveau ticket de support

RÉFÉRENCE : ${ticketRef}

\n\n \n

Un utilisateur vient de soumettre un nouveau ticket sur la plateforme mAI.

\n \n \n

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

Demandeur :	\n ${escapeHtml(ticket.user_name)} \n (${\n escapeHtml(ticket.user_email)\n })\n ${\n ticket.user_tier\n ? `${\n escapeHtml(ticket.user_tier)\n }`\n : \"\"\n }\n
Projet :	${\n escapeHtml(ticket.project)\n }
Section :	${\n escapeHtml(ticket.category)\n }
Priorité :	\n \n ${priorityInfo.label}\n \n

\n\n \n

Objet de la demande :

${\n escapeHtml(ticket.title)\n }

\n ${safeDescription}\n

\n\n \n

\n \n → Répondre au ticket #${\n ticket.ticket_number || ticket.id.slice(0, 6)\n }\n \n

\n\n

\n Vous pouvez également écrire directement au demandeur : \n \n ${escapeHtml(ticket.user_email)}\n \n

\n\n \n

Cet e-mail automatique est destiné à l'administration du support mAI.

\n\n

\n \n \n `;\n\n return await sendHtmlEmail(adminEmail, subject, html);\n}\n\n/**\n * Envoie une notification par e-mail à l'utilisateur (ou à l'admin) lors d'une action ou d'une réponse.\n */\nexport async function sendSupportTicketUpdateEmail({\n ticket,\n recipientEmail,\n recipientName,\n message,\n newStatus,\n authorRole,\n appUrl = \"https://m-ai.fr\",\n isAiGenerated,\n}: {\n ticket: SupportTicketEmailPayload;\n recipientEmail: string;\n recipientName: string;\n message: string;\n newStatus?: string;\n authorRole: \"admin\" | \"user\" | \"system\";\n appUrl?: string;\n isAiGenerated?: boolean;\n}) {\n const ticketRef = ticket.ticket_number\n ? `#TICK-${ticket.ticket_number}`\n : `#${ticket.id.slice(0, 8)}`;\n const isFromAdmin = authorRole === \"admin\";\n const subject = isFromAdmin\n ? `[Support mAI] Réponse à votre ticket ${ticketRef} : ${ticket.title}`\n : `[Support mAI] Nouveau message sur le ticket ${ticketRef}`;\n\n const directLink = `${\n appUrl.replace(/\\/$/, \"\")\n }/support/tickets/${ticket.id}`;\n const safeMessage = escapeHtml(message).replace(/\\n/g, \"
\");\n\n const html = `\n \n \n \n \n \n ${escapeHtml(subject)}\n \n \n

\n \n \n

\n $\"mAI$ \n

\n ${isFromAdmin ? \"Réponse de l'Équipe Support\" : \"Nouveau message\"}\n

TICKET ${ticketRef} • ${\n escapeHtml(ticket.title)\n }

\n\n \n

Bonjour ${\n escapeHtml(recipientName)\n },

\n \n

\n ${\n isFromAdmin\n ? \"Un membre de l'équipe technique de mAI a répondu à votre demande :\"\n : \"Un nouveau message a été posté sur le ticket :\"\n }\n

\n \n \n

\n ${safeMessage}\n

\n\n ${\n isAiGenerated || ticket.isAiGenerated\n ? `\n

\n IA\n Contenu créé avec l'assistance de l'IA — ce message a été généré avec l'aide de l'IA et relu par l'équipe mAI.\n

\n `\n : \"\"\n }\n\n ${\n newStatus\n ? `\n

\n Mise à jour de statut : Le ticket est désormais noté comme ${\n escapeHtml(newStatus)\n }.\n

\n `\n : \"\"\n }\n\n \n

\n \n Voir le fil de discussion et répondre\n \n

\n\n

\n Vous pouvez à tout moment suivre l'état de l'ensemble de vos demandes sur votre \n Espace Support mAI.\n

\n\n \n

mDevsLabs • Solutions d'Intelligence Artificielle Souveraines

\n\n

\n \n \n `;\n\n return await sendHtmlEmail(recipientEmail, subject, html);\n}",[277],"af695e83-f648-44f3-bd53-f7a6fbe86e93","devices.ts","e97247d0-9c6a-11f1-8111-1607ee4eb77e",108,["D",1787754938926],6,"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport type { Hono } from \"npm:hono@4\";\nimport { extractToken, getDb, parseUserAgent } from \"./config.ts\";\n\nexport function registerDeviceRoutes(app: Hono) {\n // GET /v1/devices\n app.get(\"/v1/devices\", async (c) => {\n const userId = c.get(\"userId\");\n const token = extractToken(c.req.raw);\n const sql = getDb();\n\n const existing =\n await sql`SELECT id FROM connected_devices WHERE token = ${token}`;\n if (existing.length === 0) {\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n \"Inconnue\";\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name)\n VALUES (${userId}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name})\n `;\n } catch (err) {\n console.error(\"Auto-insert device error:\", err);\n }\n } else {\n try {\n await sql`UPDATE connected_devices SET last_active = NOW() WHERE token = ${token}`;\n } catch (_err) {}\n }\n\n const rawDevices = await sql`\n SELECT id, token, os, device_model, device_version, ip_address, device_name, last_active, created_at \n FROM connected_devices \n WHERE user_id = ${userId}::text \n ORDER BY last_active DESC\n `;\n\n const devices = rawDevices.map((d: any) => ({\n created_at: d.created_at,\n device_model: d.device_model,\n device_name: d.device_name,\n device_version: d.device_version || \"\",\n id: d.id,\n ip_address: d.ip_address,\n is_current: d.token === token,\n last_active: d.last_active,\n os: d.os,\n }));\n\n return c.json({ devices, success: true });\n });\n\n // DELETE /v1/devices/others\n app.delete(\"/v1/devices/others\", async (c) => {\n const userId = c.get(\"userId\");\n const token = extractToken(c.req.raw);\n const sql = getDb();\n\n const otherDevices = await sql`\n SELECT token FROM connected_devices \n WHERE user_id = ${userId}::text AND token != ${token}\n `;\n\n for (const row of otherDevices) {\n if (row.token) {\n try {\n await sqlite.execute({\n args: [row.token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch (_e) {}\n }\n }\n\n await sql`\n DELETE FROM connected_devices \n WHERE user_id = ${userId}::text AND token != ${token}\n `;\n\n return c.json({\n message: \"Tous les autres appareils ont été déconnectés.\",\n success: true,\n });\n });\n\n // DELETE /v1/devices/all\n app.delete(\"/v1/devices/all\", async (c) => {\n const userId = c.get(\"userId\");\n const sql = getDb();\n\n const allDevices = await sql`\n SELECT token FROM connected_devices \n WHERE user_id = ${userId}::text\n `;\n\n for (const row of allDevices) {\n if (row.token) {\n try {\n await sqlite.execute({\n args: [row.token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch (_e) {}\n }\n }\n\n await sql`\n DELETE FROM connected_devices \n WHERE user_id = ${userId}::text\n `;\n\n return c.json({\n message: \"Tous les appareils ont été déconnectés.\",\n success: true,\n });\n });\n\n // PUT /v1/devices/:id\n app.put(\"/v1/devices/:id\", async (c) => {\n const userId = c.get(\"userId\");\n const deviceId = c.req.param(\"id\");\n const { device_name } = await c.req.json();\n const sql = getDb();\n await sql`UPDATE connected_devices SET device_name = ${device_name} WHERE id = ${deviceId} AND user_id = ${userId}::text`;\n return c.json({ success: true });\n });\n\n // DELETE /v1/devices/:id\n app.delete(\"/v1/devices/:id\", async (c) => {\n const userId = c.get(\"userId\");\n const deviceId = c.req.param(\"id\");\n const sql = getDb();\n\n const devices =\n await sql`SELECT token FROM connected_devices WHERE id = ${deviceId} AND user_id = ${userId}::text LIMIT 1`;\n if (devices.length > 0) {\n const token = devices[0].token;\n if (token) {\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n }\n await sql`DELETE FROM connected_devices WHERE id = ${deviceId}`;\n }\n return c.json({ success: true });\n });\n}",[283],"289f164c-220d-43d6-b11f-965443b4cafe","config.ts","e9721ca6-9c6a-11f1-8111-1607ee4eb77e",171,["D",1788443309111],9,"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { neon } from \"npm:@neondatabase/serverless\";\nimport { jwtVerify, SignJWT } from \"npm:jose\";\n\n// ─────────────────────────────────────────────\n// Config & Données\n// ─────────────────────────────────────────────\nexport const JWT_EXPIRY = \"7d\";\nexport const BCRYPT_ROUNDS = 12;\n\n// ─────────────────────────────────────────────\n// Rate limiting en mémoire (par clé : ip ou user)\n// ─────────────────────────────────────────────\nconst rateBuckets = new Map();\n\nexport function rateLimit(\n key: string,\n limit: number,\n windowMs: number,\n): boolean {\n const now = Date.now();\n const bucket = rateBuckets.get(key);\n if (!bucket || now > bucket.resetAt) {\n rateBuckets.set(key, { count: 1, resetAt: now + windowMs });\n return true;\n }\n if (bucket.count >= limit) return false;\n bucket.count += 1;\n return true;\n}\n\nexport function clientIp(c: any): string {\n return (\n c.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ||\n c.req.header(\"x-real-ip\") ||\n \"unknown\"\n );\n}\n\nexport type Tier = \"Free\" | \"Plus\" | \"Pro\" | \"Max\";\n\nconst TIER_ALIASES: Record = {\n free: \"Free\",\n gratuit: \"Free\",\n plus: \"Plus\",\n pro: \"Pro\",\n max: \"Max\",\n};\n\n/**\n * Normalise n'importe quelle représentation de forfait venant de la base, d'une clé API\n * ou d'un JWT (\"gratuit\", \" PRO \", \"max\") en tier canonique.\n * Une valeur vide ou inconnue retombe sur \"Free\", comme l'ancien `MAP[t] || MAP[\"Free\"]`.\n */\nexport function normalizeTier(tier?: string | null): Tier {\n return TIER_ALIASES[String(tier || \"\").trim().toLowerCase()] || \"Free\";\n}\n\nexport function isPaidTier(tier?: string | null): boolean {\n return normalizeTier(tier) !== \"Free\";\n}\n\n// Limites de tokens mAI hebdomadaires (Input + Output)\nexport const TIER_LIMITS: Record = {\n Free: 10_000_000,\n Plus: 20_000_000,\n Pro: 30_000_000,\n Max: 50_000_000,\n};\n\nexport function getTierMaiTokenLimit(tier?: string | null): number {\n return TIER_LIMITS[normalizeTier(tier)];\n}\n\n// Limites de tokens Speech hebdomadaires\nexport const TIER_SPEECH_LIMITS: Record = {\n Free: 30_000_000,\n Plus: 75_000_000,\n Pro: 150_000_000,\n Max: 300_000_000,\n};\n\nexport function getTierSpeechLimit(tier?: string | null): number {\n return TIER_SPEECH_LIMITS[normalizeTier(tier)];\n}\n\n// Limites de requêtes API hebdomadaires (remise à zéro le lundi 00:00 UTC)\nexport const TIER_REQUEST_LIMITS: Record = {\n Free: 500,\n Plus: 1500,\n Pro: 3000,\n Max: 7500,\n};\n\nexport function getTierRequestLimit(tier?: string | null): number {\n return TIER_REQUEST_LIMITS[normalizeTier(tier)];\n}\n\n/**\n * Extrait le forfait (TIER_USER) encodé directement dans une clé API au format :\n * mai-TIER_USER-XXXXX-XXXXX (ex: mai-free-ABC12-defgh, mai-plus-..., mai-pro-..., mai-max-...)\n * Renvoie \"Free\", \"Plus\", \"Pro\", \"Max\" ou null si non présent.\n */\nexport function extractTierFromApiKey(\n apiKey: string | null | undefined,\n): \"Free\" | \"Plus\" | \"Pro\" | \"Max\" | null {\n if (!apiKey || typeof apiKey !== \"string\") return null;\n const match = apiKey.trim().match(/^mai-(free|plus|pro|max)-/i);\n if (!match) return null;\n const t = match[1].toLowerCase();\n if (t === \"free\") return \"Free\";\n if (t === \"plus\") return \"Plus\";\n if (t === \"pro\") return \"Pro\";\n if (t === \"max\") return \"Max\";\n return null;\n}\n\n/**\n * Calcule l'augmentation temporaire de quota active pour un utilisateur et un type de service.\n */\nexport async function getUserQuotaBoost(\n sql: any,\n userId: string | null | undefined,\n quotaType: \"mai\" | \"api\" | \"images\" | \"audio\",\n): Promise {\n if (!sql || !userId) return 0;\n try {\n const rows = await sql`\n SELECT COALESCE(SUM(boost_amount), 0) as total_boost\n FROM user_quota_boosts\n WHERE (\n user_id = 'all'\n OR user_id = ${userId}::text\n OR user_id IN (\n SELECT id::text FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text\n )\n OR user_id IN (\n SELECT email FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text\n )\n OR user_id IN (\n SELECT username FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text\n )\n )\n AND quota_type = ${quotaType}\n AND is_active = TRUE\n AND starts_at <= NOW()\n AND expires_at >= NOW()\n `;\n return Number(rows[0]?.total_boost || 0);\n } catch {\n return 0;\n }\n}\n\n// Limites quotidiennes de génération d'images\nexport const TIER_DAILY_IMAGE_LIMITS: Record = {\n Free: 5,\n Plus: 10,\n Pro: 20,\n Max: 35,\n};\n\nexport function getTierDailyImageLimit(tier?: string | null): number {\n return TIER_DAILY_IMAGE_LIMITS[normalizeTier(tier)];\n}\n\n// Coût en requêtes API par image générée (multiplié par le nombre d'images demandées)\nexport const TIER_IMAGE_REQUEST_COST: Record = {\n Free: 100,\n Plus: 50,\n Pro: 25,\n Max: 10,\n};\n\nexport function getTierImageRequestCost(tier?: string | null): number {\n return TIER_IMAGE_REQUEST_COST[normalizeTier(tier)];\n}\n\n// Limites de stockage Cloud par tier (en octets)\nconst GIB = 1024 * 1024 * 1024;\n\nexport const STORAGE_LIMITS_BYTES: Record = {\n Free: 10 * GIB,\n Plus: 20 * GIB,\n Pro: 40 * GIB,\n Max: 60 * GIB,\n};\n\nexport function getTierStorageLimitBytes(tier?: string | null): number {\n return STORAGE_LIMITS_BYTES[normalizeTier(tier)];\n}\n\nexport function getDb() {\n const url = Deno.env.get(\"DATABASE_URL\");\n if (!url) {\n throw new Error(\"DATABASE_URL not set\");\n }\n return neon(url);\n}\n\nexport function getJwtSecret(): Uint8Array {\n const secret =\n (typeof Deno !== \"undefined\"\n ? Deno.env.get(\"MAI_JWT_SECRET\") || Deno.env.get(\"JWT_SECRET\")\n : null) ||\n \"mai_super_secret_jwt_key_2026_default_vibe\";\n return new TextEncoder().encode(secret);\n}\n\n// ─────────────────────────────────────────────\n// Helpers d'authentification & Utilitaires\n// ─────────────────────────────────────────────\nexport async function signToken(\n payload: Record,\n): Promise {\n return new SignJWT(payload)\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuedAt()\n .setExpirationTime(JWT_EXPIRY)\n .sign(getJwtSecret());\n}\n\nexport async function verifyToken(\n token: string,\n): Promise> {\n // Vérif SQLite (legacy Val Town)\n try {\n const sqliteResult = await sqlite.execute({\n args: [token],\n sql: \"SELECT 1 FROM token_blacklist WHERE token = ?\",\n });\n if (sqliteResult && sqliteResult.rows && sqliteResult.rows.length > 0) {\n throw new Error(\"Token révoqué.\");\n }\n } catch (e: any) {\n if (e?.message === \"Token révoqué.\") throw e;\n }\n\n // Vérif Postgres token_blacklist avec TTL 14j\n try {\n const sql = getDb();\n const pgResult =\n await sql`SELECT 1 FROM token_blacklist WHERE token = ${token} LIMIT 1`;\n if (pgResult && pgResult.length > 0) {\n throw new Error(\"Token révoqué.\");\n }\n } catch (e: any) {\n if (e?.message === \"Token révoqué.\") throw e;\n }\n\n const { payload } = await jwtVerify(token, getJwtSecret());\n return payload as Record;\n}\n\nexport async function blacklistToken(token: string) {\n const expiresAt = new Date(\n Date.now() + 14 * 24 * 60 * 60 * 1000,\n ).toISOString();\n try {\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch {}\n try {\n const sql = getDb();\n await sql`INSERT INTO token_blacklist (token, revoked_at, expires_at) VALUES (${token}, NOW(), ${expiresAt}::timestamp) ON CONFLICT (token) DO NOTHING`;\n } catch {}\n // Nettoyage opportuniste des vieux tokens\n try {\n const sql = getDb();\n await sql`DELETE FROM token_blacklist WHERE expires_at < NOW() OR revoked_at < NOW() - INTERVAL '14 days'`;\n } catch {}\n try {\n await sqlite.execute({\n sql:\n \"DELETE FROM token_blacklist WHERE revoked_at < datetime('now', '-14 days')\",\n args: [],\n });\n } catch {}\n}\n\nexport function extractToken(req: Request): string | null {\n const auth = req.headers.get(\"Authorization\");\n if (!auth?.startsWith(\"Bearer \")) {\n return null;\n }\n return auth.slice(7);\n}\n\nexport function parseUserAgent(ua: string) {\n const uaLower = ua.toLowerCase();\n let os = \"linux\";\n let osVersion = \"Linux\";\n\n if (uaLower.includes(\"iphone\")) {\n os = \"apple\";\n osVersion = \"iPhone (iOS)\";\n } else if (uaLower.includes(\"ipad\")) {\n os = \"apple\";\n osVersion = \"iPad (iPadOS)\";\n } else if (uaLower.includes(\"mac os\") || uaLower.includes(\"macintosh\")) {\n os = \"apple\";\n osVersion = \"macOS\";\n } else if (\n uaLower.includes(\"windows nt 10.0\") ||\n uaLower.includes(\"windows 11\") ||\n uaLower.includes(\"windows 10\")\n ) {\n os = \"microsoft\";\n osVersion = \"Windows 10/11\";\n } else if (uaLower.includes(\"win\")) {\n os = \"microsoft\";\n osVersion = \"Windows\";\n } else if (uaLower.includes(\"android\")) {\n os = \"google\";\n osVersion = \"Android\";\n } else if (uaLower.includes(\"ubuntu\")) {\n os = \"linux\";\n osVersion = \"Ubuntu Linux\";\n } else if (uaLower.includes(\"debian\")) {\n os = \"linux\";\n osVersion = \"Debian Linux\";\n } else if (uaLower.includes(\"fedora\")) {\n os = \"linux\";\n osVersion = \"Fedora Linux\";\n }\n\n let model = \"Navigateur Web\";\n let version = \"\";\n\n if (uaLower.includes(\"mai-cli\") || uaLower.includes(\"mai cli\")) {\n model = \"mAI CLI\";\n version = \"Terminal\";\n } else if (uaLower.includes(\"pulse-extension\") || uaLower.includes(\"pulse\")) {\n model = \"Pulse Extension\";\n version = \"Extension\";\n } else if (uaLower.includes(\"edg/\")) {\n model = \"Microsoft Edge\";\n const match = ua.match(/Edg\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"opr/\") || uaLower.includes(\"opera/\")) {\n model = \"Opera\";\n const match = ua.match(/(?:OPR|Opera)\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"chrome/\")) {\n model = \"Google Chrome\";\n const match = ua.match(/Chrome\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"firefox/\")) {\n model = \"Mozilla Firefox\";\n const match = ua.match(/Firefox\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"safari/\") && !uaLower.includes(\"chrome\")) {\n model = \"Apple Safari\";\n const match = ua.match(/Version\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n }\n\n const fullVersion = version ? `${osVersion} • ${version}` : osVersion;\n const osLabel = os === \"apple\"\n ? \"Apple\"\n : os === \"microsoft\"\n ? \"Windows\"\n : os === \"google\"\n ? \"Google\"\n : \"Linux\";\n const deviceName = `${model} (${osLabel})`;\n\n return {\n device_model: model,\n device_name: deviceName,\n device_version: fullVersion,\n os,\n };\n}\n\nexport function getWeekData() {\n const now = new Date();\n const day = now.getUTCDay() || 7;\n\n const weekStart = new Date(now);\n weekStart.setUTCDate(now.getUTCDate() - (day - 1));\n weekStart.setUTCHours(0, 0, 0, 0);\n\n const nextReset = new Date(weekStart);\n nextReset.setUTCDate(weekStart.getUTCDate() + 7);\n\n return {\n nextResetIso: nextReset.toISOString(),\n weekStartStr: weekStart.toISOString().split(\"T\")[0],\n };\n}\n\n// ─────────────────────────────────────────────\n// E-mails & Vérification (SQLite)\n// ─────────────────────────────────────────────\nexport async function initSQLite() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS verification_codes (\n email TEXT,\n code TEXT,\n action TEXT,\n expires_at DATETIME,\n PRIMARY KEY (email, action)\n );\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS token_blacklist (\n token TEXT PRIMARY KEY,\n revoked_at DATETIME DEFAULT CURRENT_TIMESTAMP\n );\n `);\n}\n\nexport async function generateVerificationCode(\n email: string,\n action: string,\n): Promise {\n const isDeletion = action === \"delete_account\";\n const length = isDeletion ? 8 : 6;\n const min = 10 ** (length - 1);\n const max = 10 ** length - 1;\n // Crypto PRNG (corrige Math.random prévisible)\n const range = max - min;\n const randomValue = crypto.getRandomValues(new Uint32Array(1))[0] /\n 0xff_ff_ff_ff;\n const code = Math.floor(min + randomValue * range)\n .toString()\n .padStart(length, \"0\");\n const expiresAt = new Date(Date.now() + 10 * 60_000).toISOString(); // 10 minutes\n\n await sqlite.execute({\n args: [email, code, action, expiresAt],\n sql:\n \"INSERT OR REPLACE INTO verification_codes (email, code, action, expires_at) VALUES (?, ?, ?, ?)\",\n });\n\n return code;\n}\n\nexport async function verifyVerificationCode(\n email: string,\n code: string,\n action: string,\n): Promise {\n const result = await sqlite.execute({\n args: [email, action],\n sql:\n \"SELECT code, expires_at FROM verification_codes WHERE email = ? AND action = ?\",\n });\n\n if (result.rows.length === 0) {\n return false;\n }\n\n const storedCode = result.rows[0][0] as string;\n const expiresAt = new Date(result.rows[0][1] as string);\n\n if (expiresAt < new Date()) {\n await sqlite.execute({\n args: [email, action],\n sql: \"DELETE FROM verification_codes WHERE email = ? AND action = ?\",\n });\n return false;\n }\n\n if (storedCode === code) {\n await sqlite.execute({\n args: [email, action],\n sql: \"DELETE FROM verification_codes WHERE email = ? AND action = ?\",\n });\n return true;\n }\n\n return false;\n}\n\nexport { sqlite };",[291],"197e2587-cadc-4e04-89d6-78f96c07bce4",["D",1788447239386],7,[28],"0b20b03b-6878-47de-8a7b-ad442b41af7b","audio.ts","3b25ab8a-a080-11f1-99e5-1607ee4eb77e",["D",1788164141214],"import type { Hono } from \"npm:hono@4\";\nimport {\n extractTierFromApiKey,\n extractToken,\n getDb,\n getTierSpeechLimit,\n getUserQuotaBoost,\n getWeekData,\n verifyToken,\n} from \"./config.ts\";\n\nexport interface SpeechModelItem {\n created: number;\n description: string;\n id: string;\n name: string;\n voices?: string[];\n}\n\nfunction cleanModelName(name: string): string {\n return (name || \"\")\n .replace(/\\s*\$(free|gratuit|free tier)\$/gi, \"\")\n .replace(/:free/gi, \"\")\n .trim();\n}\n\nfunction getOpenRouterApiKey(userCustomKey?: string | null): string {\n if (userCustomKey && userCustomKey.trim().startsWith(\"sk-or-\")) {\n return userCustomKey.trim();\n }\n if (typeof Deno !== \"undefined\" && Deno.env) {\n return Deno.env.get(\"OPENROUTER_API_KEY\") || \"\";\n }\n if (typeof process !== \"undefined\" && process.env) {\n return process.env.OPENROUTER_API_KEY || \"\";\n }\n return \"\";\n}\n\n/**\n * Modèles Speech de repli avec voix disponibles et noms nettoyés sans (Free)\n */\nconst FALLBACK_SPEECH_MODELS = [\n {\n architecture: {\n input_modalities: [\"text\"],\n modality: \"text->speech\",\n output_modalities: [\"speech\"],\n },\n created: Math.floor(Date.now() / 1000) - 86_400 * 30,\n description:\n \"Modèle Text-to-Speech (TTS) ultra-rapide et haute fidélité par Deepgram.\",\n id: \"deepgram/flux-tts:free\",\n name: \"Deepgram: Flux TTS\",\n object: \"model\",\n owned_by: \"deepgram\",\n supported_parameters: [\"voice\", \"speed\", \"response_format\"],\n voices: [\n \"flux-alexis-en\",\n \"flux-michael-en\",\n \"flux-stacy-en\",\n \"flux-sam-en\",\n \"flux-asteria-en\",\n \"flux-orion-en\",\n ],\n },\n];\n\nlet speechTablesInitialized = false;\nasync function ensureSpeechTables(sql: any) {\n if (speechTablesInitialized) return;\n try {\n await sql`\n CREATE TABLE IF NOT EXISTS weekly_speech_usage (\n id SERIAL PRIMARY KEY,\n user_id TEXT NOT NULL,\n week_start DATE NOT NULL,\n tokens_used BIGINT NOT NULL DEFAULT 0,\n requests_count INTEGER NOT NULL DEFAULT 0,\n updated_at TIMESTAMP NOT NULL DEFAULT NOW(),\n CONSTRAINT weekly_speech_usage_user_week_unique UNIQUE (user_id, week_start)\n )\n `;\n await sql`\n CREATE TABLE IF NOT EXISTS mprojects_speech_generations (\n id UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n user_id TEXT NOT NULL,\n api_key TEXT,\n model TEXT NOT NULL DEFAULT 'deepgram/flux-tts:free',\n voice TEXT DEFAULT 'flux-alexis-en',\n input_text TEXT NOT NULL,\n audio_url TEXT,\n tokens_count INTEGER NOT NULL DEFAULT 0,\n character_count INTEGER NOT NULL DEFAULT 0,\n status TEXT NOT NULL DEFAULT 'completed',\n created_at TIMESTAMP NOT NULL DEFAULT NOW()\n )\n `;\n await sql`ALTER TABLE mprojects_speech_generations ADD COLUMN IF NOT EXISTS audio_url TEXT`;\n speechTablesInitialized = true;\n } catch (err) {\n console.error(\"[Speech API] Error initializing speech tables:\", err);\n }\n}\n\nexport function registerAudioRoutes(app: Hono) {\n try {\n ensureSpeechTables(getDb()).catch(() => {});\n } catch {}\n // ─────────────────────────────────────────────\n // GET /v1/models/speech, /models/speech & /v1/audio/models\n // ─────────────────────────────────────────────\n const handleGetSpeechModels = async (c: any) => {\n try {\n const res = await fetch(\n \"https://openrouter.ai/api/v1/models?output_modalities=speech\",\n );\n\n let rawModels: any[] = [];\n if (res.ok) {\n const json = await res.json();\n rawModels = json.data || [];\n }\n\n if (rawModels.length === 0) {\n rawModels = FALLBACK_SPEECH_MODELS;\n }\n\n // Règle stricte : filtrer par l'ID contenant ':free' quel que soit le forfait\n const freeSpeechModels = rawModels\n .filter((m) =>\n m && m.id && (m.id || \"\").toLowerCase().includes(\":free\")\n )\n .map((m) => {\n const rawName = m.name || m.id;\n const cleanedName = cleanModelName(rawName) || cleanModelName(m.id);\n return {\n architecture: m.architecture || {\n input_modalities: [\"text\"],\n modality: \"text->speech\",\n output_modalities: [\"speech\"],\n },\n created: m.created || Math.floor(Date.now() / 1000),\n description: m.description ||\n `Modèle de synthèse vocale (TTS) ${cleanedName}.`,\n id: m.id,\n name: cleanedName,\n object: \"model\",\n owned_by: (m.id || \"\").split(\"/\")[0] || \"openrouter\",\n supported_parameters: m.supported_parameters || [\n \"voice\",\n \"speed\",\n \"response_format\",\n ],\n voices: m.voices || [\n \"flux-alexis-en\",\n \"flux-michael-en\",\n \"flux-stacy-en\",\n \"flux-sam-en\",\n \"flux-asteria-en\",\n \"flux-orion-en\",\n ],\n };\n });\n\n const finalModels = freeSpeechModels.length > 0\n ? freeSpeechModels\n : FALLBACK_SPEECH_MODELS;\n\n return c.json({ data: finalModels, object: \"list\" });\n } catch (_err) {\n return c.json({ data: FALLBACK_SPEECH_MODELS, object: \"list\" });\n }\n };\n\n app.get(\"/v1/models/speech\", handleGetSpeechModels);\n app.get(\"/models/speech\", handleGetSpeechModels);\n app.get(\"/v1/speech/models\", handleGetSpeechModels);\n app.get(\"/speech/models\", handleGetSpeechModels);\n app.get(\"/v1/audio/models\", handleGetSpeechModels);\n app.get(\"/audio/models\", handleGetSpeechModels);\n\n // ─────────────────────────────────────────────\n // GET /v1/speech/voices & /v1/audio/voices\n // ─────────────────────────────────────────────\n const handleGetSpeechVoices = (c: any) => {\n return c.json({\n data: [\n {\n description: \"Voix féminine chaleureuse, naturelle et claire.\",\n gender: \"female\",\n id: \"flux-alexis-en\",\n language: \"fr/en\",\n name: \"Alexis\",\n },\n {\n description: \"Voix masculine posée, fluide et professionnelle.\",\n gender: \"male\",\n id: \"flux-michael-en\",\n language: \"fr/en\",\n name: \"Michael\",\n },\n {\n description: \"Voix féminine expressive, vive et dynamique.\",\n gender: \"female\",\n id: \"flux-stacy-en\",\n language: \"fr/en\",\n name: \"Stacy\",\n },\n {\n description:\n \"Voix masculine profonde, idéale pour narration & podcast.\",\n gender: \"male\",\n id: \"flux-sam-en\",\n language: \"fr/en\",\n name: \"Sam\",\n },\n {\n description: \"Voix féminine moderne, douce et mélodieuse.\",\n gender: \"female\",\n id: \"flux-asteria-en\",\n language: \"fr/en\",\n name: \"Asteria\",\n },\n {\n description: \"Voix masculine cinématique, intense et charismatique.\",\n gender: \"male\",\n id: \"flux-orion-en\",\n language: \"fr/en\",\n name: \"Orion\",\n },\n ],\n object: \"list\",\n });\n };\n\n app.get(\"/v1/speech/voices\", handleGetSpeechVoices);\n app.get(\"/speech/voices\", handleGetSpeechVoices);\n app.get(\"/v1/audio/voices\", handleGetSpeechVoices);\n app.get(\"/audio/voices\", handleGetSpeechVoices);\n\n // ─────────────────────────────────────────────\n // GET /v1/speech/usage, /speech/usage, /v1/audio/usage & /usage/speech\n // ─────────────────────────────────────────────\n const handleGetSpeechUsage = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n let userPlan = c.get(\"userPlan\") || \"Free\";\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n userPlan = (payload.tier as string) || userPlan;\n } catch {}\n }\n\n const sql = getDb();\n\n // Résolution du user_id réel via mprojects_api_keys si token ou userId transmis\n if (token) {\n try {\n const keyRows = await sql`\n SELECT k.user_id, u.tier, u.email, u.username\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${token}::text\n LIMIT 1\n `;\n if (keyRows.length > 0) {\n userId = keyRows[0].user_id;\n userPlan = keyRows[0].tier || userPlan;\n }\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const { weekStartStr, nextResetIso } = getWeekData();\n\n const [uRows, usageRows] = await Promise.all([\n sql`SELECT id, email, username, tier FROM users WHERE id::text = ${userId}::text OR username = ${userId}::text OR email = ${userId}::text LIMIT 1`,\n sql`\n SELECT COALESCE(SUM(tokens_used::numeric), 0) as tokens_used, COALESCE(SUM(requests_count::numeric), 0) as requests_count \n FROM weekly_speech_usage \n WHERE (\n user_id = ${userId}::text \n OR user_id IN (SELECT id::text FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR user_id IN (SELECT email FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n OR user_id IN (SELECT username FROM users WHERE id::text = ${userId}::text OR email = ${userId}::text OR username = ${userId}::text)\n ) AND week_start = ${weekStartStr}::date\n `.catch(() => []),\n ]);\n\n const keyTier = extractTierFromApiKey(token);\n const effectiveTier = keyTier || uRows[0]?.tier || userPlan || \"Free\";\n const tokensUsed = Number(usageRows[0]?.tokens_used || 0);\n const requestsCount = Number(usageRows[0]?.requests_count || 0);\n const audioBoost = await getUserQuotaBoost(sql, userId, \"audio\");\n const weeklyLimit = getTierSpeechLimit(effectiveTier) + audioBoost;\n\n return c.json({\n plan: effectiveTier,\n requestsCount,\n resetAt: nextResetIso,\n tokensUsed,\n userId,\n weekStart: weekStartStr,\n weeklyLimit,\n });\n } catch (err: any) {\n return c.json(\n {\n details: err.message,\n error: \"Erreur lors de la récupération de l'usage Speech.\",\n },\n 500,\n );\n }\n };\n\n app.get(\"/v1/audio/usage\", handleGetSpeechUsage);\n app.get(\"/v1/speech/usage\", handleGetSpeechUsage);\n app.get(\"/audio/usage\", handleGetSpeechUsage);\n app.get(\"/speech/usage\", handleGetSpeechUsage);\n app.get(\"/usage/speech\", handleGetSpeechUsage);\n\n // ─────────────────────────────────────────────\n // GET /v1/audio/history & /v1/speech/history\n // ─────────────────────────────────────────────\n const handleGetSpeechHistory = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const sql = getDb();\n const history = await sql`\n SELECT id, title, pinned, model, voice, input_text, audio_url, tokens_count, character_count, status, created_at\n FROM mprojects_speech_generations\n WHERE user_id = ${userId}::text\n ORDER BY pinned DESC, created_at DESC\n LIMIT 50\n `.catch(() => []);\n\n const formattedHistory = history.map((item: any) => ({\n ...item,\n pinned: Boolean(item.pinned),\n title: item.title || null,\n }));\n\n return c.json({ data: formattedHistory, success: true });\n } catch (err: any) {\n return c.json(\n { details: err.message, error: \"Erreur historique audio.\" },\n 500,\n );\n }\n };\n\n const handleUpdateSpeechHistory = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const id = c.req.param(\"id\") || c.req.query(\"id\");\n if (!id) {\n return c.json({ error: \"ID manquant.\" }, 400);\n }\n\n const body = await c.req.json().catch(() => ({}));\n const sql = getDb();\n const sets: string[] = [];\n const values: any[] = [];\n let idx = 1;\n\n if (body.title !== undefined) {\n sets.push(`title = $${idx++}`);\n values.push(\n body.title ? String(body.title).trim().slice(0, 200) : null,\n );\n }\n if (body.pinned !== undefined) {\n sets.push(`pinned = $${idx++}`);\n values.push(Boolean(body.pinned));\n }\n\n if (sets.length === 0) {\n return c.json({ success: true });\n }\n\n values.push(id, userId);\n const query = `UPDATE mprojects_speech_generations SET ${\n sets.join(\", \")\n } WHERE id::text = $${idx++}::text AND user_id = $${idx}::text RETURNING id, title, pinned`;\n const result = await sql.unsafe(query, values);\n\n return c.json({ data: result[0] || null, success: true });\n } catch (err: any) {\n return c.json(\n { details: err.message, error: \"Erreur mise à jour audio.\" },\n 500,\n );\n }\n };\n\n app.get(\"/v1/audio/history\", handleGetSpeechHistory);\n app.get(\"/v1/speech/history\", handleGetSpeechHistory);\n app.get(\"/audio/history\", handleGetSpeechHistory);\n app.get(\"/speech/history\", handleGetSpeechHistory);\n app.patch(\"/v1/audio/history/:id\", handleUpdateSpeechHistory);\n app.patch(\"/v1/audio/history\", handleUpdateSpeechHistory);\n app.patch(\"/v1/speech/history/:id\", handleUpdateSpeechHistory);\n app.patch(\"/v1/speech/history\", handleUpdateSpeechHistory);\n app.patch(\"/audio/history/:id\", handleUpdateSpeechHistory);\n app.patch(\"/audio/history\", handleUpdateSpeechHistory);\n app.patch(\"/speech/history/:id\", handleUpdateSpeechHistory);\n app.patch(\"/speech/history\", handleUpdateSpeechHistory);\n\n // ─────────────────────────────────────────────\n // DELETE /v1/audio/history/:id & /v1/speech/history/:id\n // ─────────────────────────────────────────────\n const handleDeleteSpeechHistory = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const id = c.req.param(\"id\") || c.req.query(\"id\");\n if (!id) {\n return c.json({ error: \"ID manquant.\" }, 400);\n }\n\n const sql = getDb();\n await sql`\n DELETE FROM mprojects_speech_generations\n WHERE id::text = ${id}::text AND user_id = ${userId}::text\n `;\n\n return c.json({ message: \"Audio supprimé avec succès\", success: true });\n } catch (err: any) {\n return c.json(\n { details: err.message, error: \"Erreur suppression audio.\" },\n 500,\n );\n }\n };\n\n app.delete(\"/v1/audio/history/:id\", handleDeleteSpeechHistory);\n app.delete(\"/v1/audio/history\", handleDeleteSpeechHistory);\n app.delete(\"/v1/speech/history/:id\", handleDeleteSpeechHistory);\n app.delete(\"/v1/speech/history\", handleDeleteSpeechHistory);\n app.delete(\"/audio/history/:id\", handleDeleteSpeechHistory);\n app.delete(\"/audio/history\", handleDeleteSpeechHistory);\n\n // ─────────────────────────────────────────────\n // POST /v1/speech, /v1/audio/speech, /v1beta/models/*:synthesizeSpeech (OpenAI, Google & Anthropic SDK)\n // ─────────────────────────────────────────────\n const OPENAI_VOICE_MAP: Record = {\n alloy: \"flux-alexis-en\",\n echo: \"flux-michael-en\",\n fable: \"flux-orion-en\",\n nova: \"flux-stacy-en\",\n onyx: \"flux-sam-en\",\n shimmer: \"flux-asteria-en\",\n };\n\n const handleAudioSpeech = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n const authHeader = c.req.header(\"Authorization\");\n const headerApiKey = c.req.header(\"x-api-key\") ||\n c.req.header(\"X-API-Key\") ||\n c.req.header(\"x-goog-api-key\") ||\n c.req.header(\"X-Goog-Api-Key\");\n const apiKey = authHeader?.startsWith(\"Bearer \")\n ? authHeader.slice(7)\n : headerApiKey || null;\n\n let userId = c.get(\"userId\");\n let userPlan = c.get(\"userPlan\") || \"Free\";\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n userPlan = (payload.tier as string) || userPlan;\n } catch {}\n }\n\n if (!userId) {\n return c.json(\n { error: \"Non authentifié. Clé API ou token Bearer requis.\" },\n 401,\n );\n }\n\n const body = await c.req.json().catch(() => ({}));\n const reqPath = c.req.path || \"\";\n const isGoogleTts = reqPath.includes(\":synthesizeSpeech\") ||\n reqPath.includes(\":synthesize\") ||\n Boolean(body.audioConfig);\n\n // Extraction du texte / prompt (support OpenAI, Anthropic et Google Cloud TTS / Gemini)\n const rawInput =\n (typeof body.input === \"object\" ? body.input?.text : body.input) ||\n body.text ||\n body.prompt ||\n \"\";\n const input = typeof rawInput === \"string\" ? rawInput.trim() : \"\";\n\n // Extraction du modèle demandé\n const pathModel = reqPath\n .replace(/^\\/(v1beta|v1)\\/models\\//, \"\")\n .replace(/:(synthesizeSpeech|synthesize).*$/, \"\");\n const requestedModel = body.model || pathModel ||\n \"deepgram/flux-tts:free\";\n\n // Mapping automatique des modèles OpenAI standards (tts-1, tts-1-hd) vers deepgram/flux-tts:free\n let model = requestedModel;\n if (\n model === \"tts-1\" ||\n model === \"tts-1-hd\" ||\n model === \"speech\" ||\n model.toLowerCase().includes(\"gemini\")\n ) {\n model = \"deepgram/flux-tts:free\";\n }\n\n // Extraction et mapping des voix (support des voix OpenAI alloy, echo, etc.)\n const rawVoice =\n (typeof body.voice === \"object\" ? body.voice?.name : body.voice) ||\n \"flux-alexis-en\";\n let voice = String(rawVoice).trim();\n if (OPENAI_VOICE_MAP[voice.toLowerCase()]) {\n voice = OPENAI_VOICE_MAP[voice.toLowerCase()];\n }\n\n const response_format = body.response_format ||\n (body.audioConfig?.audioEncoding === \"OGG_OPUS\" ? \"opus\" : \"mp3\");\n const speed = body.speed !== undefined\n ? body.speed\n : body.audioConfig?.speakingRate !== undefined\n ? body.audioConfig.speakingRate\n : 1.0;\n\n if (!input) {\n return c.json(\n {\n error: {\n code: \"missing_input\",\n message:\n \"Le paramètre 'input' ou 'prompt' est obligatoire pour la synthèse vocale.\",\n param: \"input\",\n type: \"invalid_request_error\",\n },\n },\n 400,\n );\n }\n\n // Règle stricte : filtrer par l'ID contenant ':free' quel que soit le forfait\n const modelStr = String(model).toLowerCase().trim();\n if (!modelStr.includes(\":free\")) {\n return c.json(\n {\n error: {\n code: \"speech_model_free_required\",\n message:\n `Pour l'API Speech, seuls les modèles avec ':free' sont autorisés (ex: 'deepgram/flux-tts:free'). Le modèle '${model}' n'est pas autorisé.`,\n param: \"model\",\n type: \"permission_error\",\n },\n },\n 403,\n );\n }\n\n const sql = getDb();\n const { weekStartStr, nextResetIso } = getWeekData();\n\n // Vérifier le forfait réel de l'utilisateur\n const uRows = await sql`\n SELECT tier FROM users \n WHERE id::text = ${userId}::text OR username = ${userId}::text \n LIMIT 1\n `.catch(() => []);\n const keyTier = extractTierFromApiKey(token);\n const effectiveTier = keyTier || uRows[0]?.tier || userPlan || \"Free\";\n const audioBoost = await getUserQuotaBoost(sql, userId, \"audio\");\n const weeklyLimit = getTierSpeechLimit(effectiveTier) + audioBoost;\n\n // Estimation des tokens utilisés (environ 1 token pour ~3.5 caractères, min 1 token)\n const estimatedTokens = Math.max(1, Math.ceil(input.length / 3.5));\n\n // Vérification du quota hebdomadaire\n const usageRows = await sql`\n SELECT tokens_used \n FROM weekly_speech_usage \n WHERE user_id = ${userId}::text AND week_start = ${weekStartStr}::date \n LIMIT 1\n `.catch(() => []);\n const currentUsage = Number(usageRows[0]?.tokens_used || 0);\n\n if (currentUsage + estimatedTokens > weeklyLimit) {\n return c.json(\n {\n error: {\n code: \"weekly_speech_quota_exceeded\",\n limit: weeklyLimit,\n message:\n `Votre quota hebdomadaire de tokens Speech est épuisé (${currentUsage}/${weeklyLimit} tokens pour le forfait ${effectiveTier}). Prochain renouvellement le ${nextResetIso}.`,\n type: \"quota_error\",\n used: currentUsage,\n },\n },\n 429,\n );\n }\n\n // Récupération de la clé OpenRouter\n const keyRows = await sql`\n SELECT api_key FROM mprojects_api_keys WHERE user_id::text = ${userId}::text LIMIT 1\n `.catch(() => []);\n const openRouterApiKey = getOpenRouterApiKey(\n keyRows.length > 0 ? keyRows[0].api_key : null,\n );\n\n if (!openRouterApiKey) {\n return c.json(\n { error: \"Clé fournisseur OpenRouter manquante côté serveur.\" },\n 500,\n );\n }\n\n const openRouterPayload: Record = {\n input,\n model,\n response_format,\n speed,\n voice,\n };\n\n const openRouterRes = await fetch(\n \"https://openrouter.ai/api/v1/audio/speech\",\n {\n body: JSON.stringify(openRouterPayload),\n headers: {\n Authorization: `Bearer ${openRouterApiKey}`,\n \"Content-Type\": \"application/json\",\n \"HTTP-Referer\": \"https://mai.val.run\",\n \"X-Title\": \"mAI Public API (Speech)\",\n },\n method: \"POST\",\n },\n );\n\n if (!openRouterRes.ok) {\n const errText = await openRouterRes.text().catch(() => \"\");\n console.error(\"[OpenRouter Speech] Erreur retournée:\", errText);\n return c.json(\n {\n details: errText,\n error:\n \"Erreur retournée par le fournisseur OpenRouter pour Speech.\",\n },\n openRouterRes.status,\n );\n }\n\n // Récupérer le buffer binaire audio\n const arrayBuf = await openRouterRes.arrayBuffer();\n const bytes = new Uint8Array(arrayBuf);\n let binary = \"\";\n for (let i = 0; i < bytes.byteLength; i++) {\n binary += String.fromCharCode(bytes[i]);\n }\n const base64Audio = btoa(binary);\n const mimeType = response_format === \"opus\"\n ? \"audio/opus\"\n : response_format === \"wav\"\n ? \"audio/wav\"\n : \"audio/mpeg\";\n const dataUrl = `data:${mimeType};base64,${base64Audio}`;\n\n // Incrémentation atomique du quota hebdomadaire de tokens Speech\n try {\n await sql`\n INSERT INTO weekly_speech_usage (user_id, week_start, tokens_used, requests_count, updated_at)\n VALUES (${userId}::text, ${weekStartStr}::date, ${estimatedTokens}, 1, NOW())\n ON CONFLICT (user_id, week_start)\n DO UPDATE SET \n tokens_used = weekly_speech_usage.tokens_used + ${estimatedTokens},\n requests_count = weekly_speech_usage.requests_count + 1,\n updated_at = NOW()\n `;\n } catch (err) {\n console.error(\"[Speech API] Erreur update weekly_speech_usage:\", err);\n }\n\n // Log dans l'historique mprojects_speech_generations\n let savedId = Date.now();\n try {\n const insertRes = await sql`\n INSERT INTO mprojects_speech_generations (\n user_id, api_key, model, voice, input_text, audio_url, tokens_count, character_count, status, created_at\n ) VALUES (\n ${userId}::text,\n ${apiKey || null},\n ${model}::text,\n ${voice}::text,\n ${input}::text,\n ${dataUrl}::text,\n ${estimatedTokens}::integer,\n ${input.length}::integer,\n 'completed',\n NOW()\n ) RETURNING id\n `;\n if (insertRes.length > 0 && insertRes[0].id) {\n savedId = insertRes[0].id;\n }\n } catch {}\n\n // Log dans mprojects_api_logs\n try {\n await sql`\n INSERT INTO mprojects_api_logs (api_key, endpoint, method, status_code, latency_ms, created_at)\n VALUES (${apiKey || \"jwt\"}::text, ${\n reqPath || \"/v1/speech\"\n }::text, 'POST', 200, 500, NOW())\n `;\n } catch {}\n\n // Vérifier si le client attend du JSON (outil IA, studio web, ou Google TTS)\n const acceptsJson =\n c.req.header(\"accept\")?.includes(\"application/json\") ||\n body.return_json ||\n body.response_format === \"json\" ||\n body.format === \"json\" ||\n isGoogleTts;\n\n if (acceptsJson) {\n return c.json({\n audio_url: dataUrl,\n audioContent: base64Audio,\n character_count: input.length,\n created: Math.floor(Date.now() / 1000),\n format: response_format,\n id: savedId,\n model: cleanModelName(model),\n model_id: model,\n status: \"completed\",\n text: input,\n tokens_used: estimatedTokens,\n usage: {\n requests_count: currentUsage + 1,\n tokens_used: estimatedTokens,\n weekly_limit: weeklyLimit,\n weekly_used: currentUsage + estimatedTokens,\n },\n voice,\n });\n }\n\n // Format binaire standard pour OpenAI SDK & requêtes natives\n return new Response(bytes, {\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Content-Type\": mimeType,\n \"x-audio-id\": String(savedId),\n \"x-speech-limit\": String(weeklyLimit),\n \"x-speech-used\": String(currentUsage + estimatedTokens),\n \"x-tokens-used\": String(estimatedTokens),\n },\n status: 200,\n });\n } catch (err: any) {\n console.error(\"[Speech API] Erreur serveur:\", err);\n return c.json(\n {\n details: err.message,\n error: \"Erreur serveur lors du traitement Speech.\",\n },\n 500,\n );\n }\n };\n\n // Routes OpenAI & Anthropic SDK\n app.post(\"/v1/speech\", handleAudioSpeech);\n app.post(\"/speech\", handleAudioSpeech);\n app.post(\"/v1/speech/generations\", handleAudioSpeech);\n app.post(\"/speech/generations\", handleAudioSpeech);\n app.post(\"/v1/audio/speech\", handleAudioSpeech);\n app.post(\"/v1/audio/generations\", handleAudioSpeech);\n app.post(\"/audio/speech\", handleAudioSpeech);\n app.post(\"/audio/generations\", handleAudioSpeech);\n\n // Routes Google Cloud TTS / Gemini SDK\n app.post(\"/v1beta/models/*:synthesizeSpeech\", handleAudioSpeech);\n app.post(\"/v1/models/*:synthesizeSpeech\", handleAudioSpeech);\n app.post(\"/v1beta/speech:synthesize\", handleAudioSpeech);\n app.post(\"/v1/speech:synthesize\", handleAudioSpeech);\n}",[303],"5019befc-6178-49a2-a07e-40c986c4712c","api-middleware.ts","e972842a-9c6a-11f1-8111-1607ee4eb77e",177,["D",1788445230637],19,"import type { Hono } from \"npm:hono@4\";\nimport {\n extractTierFromApiKey,\n getDb,\n getTierRequestLimit,\n getUserQuotaBoost,\n getWeekData,\n verifyToken,\n} from \"./config.ts\";\n\nexport function registerMiddleware(app: Hono) {\n // Middleware global pour Auth, Rate limiting & Logging sur toutes les routes d'API\n app.use(\"*\", async (c, next) => {\n const path = c.req.path;\n\n // Détection des routes d'API\n const isApiRoute = path.startsWith(\"/v1/\") ||\n path.startsWith(\"/v1beta/\") ||\n path === \"/v1/models\" ||\n path === \"/models\" ||\n path.startsWith(\"/models/\") ||\n path === \"/v1beta/models\" ||\n path === \"/chat/completions\" ||\n path.startsWith(\"/chat/\") ||\n path === \"/messages\" ||\n path.startsWith(\"/messages/\") ||\n path === \"/speech\" ||\n path.startsWith(\"/speech/\") ||\n path === \"/images\" ||\n path.startsWith(\"/images/\") ||\n path === \"/images/generations\" ||\n path === \"/mj\" ||\n path.startsWith(\"/mj/\") ||\n path.startsWith(\"/v1/mj/\") ||\n path === \"/audio/speech\" ||\n path.startsWith(\"/audio/\") ||\n path === \"/usage/speech\" ||\n path === \"/v1/usage/speech\" ||\n path === \"/usage\" ||\n path === \"/v1/usage\" ||\n path === \"/log-usage\" ||\n path === \"/v1/log-usage\" ||\n path === \"/v1/status\" ||\n path === \"/status\";\n\n if (!isApiRoute) {\n await next();\n return;\n }\n\n const isPublicRoute = path === \"/\" ||\n path === \"/api\" ||\n path === \"/api/\" ||\n path === \"/v1\" ||\n path === \"/v1/\" ||\n path === \"/vibe\" ||\n path === \"/vibe/\" ||\n path === \"/api/vibe\" ||\n path === \"/api/vibe/\" ||\n path === \"/v1/models\" ||\n path === \"/models\" ||\n path === \"/v1beta/models\" ||\n path === \"/v1/models/images\" ||\n path === \"/models/images\" ||\n path === \"/v1/images/models\" ||\n path === \"/images/models\" ||\n path.startsWith(\"/v1/models/images/\") ||\n path.startsWith(\"/models/images/\") ||\n path === \"/v1/models/speech\" ||\n path === \"/models/speech\" ||\n path === \"/v1/speech/models\" ||\n path === \"/speech/models\" ||\n path === \"/v1/speech/voices\" ||\n path === \"/speech/voices\" ||\n path === \"/v1/audio/models\" ||\n path === \"/v1/audio/voices\" ||\n path === \"/v1/models/mai\" ||\n path === \"/v1/mai/models\" ||\n path === \"/models/mai\" ||\n path === \"/mai/models\" ||\n path === \"/v1/status\" ||\n path === \"/status\" ||\n path === \"/v1/web/search\" ||\n path.startsWith(\"/v1/web/\");\n\n const authHeader = c.req.header(\"Authorization\") ||\n c.req.header(\"authorization\");\n const headerApiKey = c.req.header(\"x-api-key\") ||\n c.req.header(\"X-API-Key\") ||\n c.req.header(\"x-goog-api-key\") ||\n c.req.header(\"X-Goog-Api-Key\");\n const queryApiKey = c.req.query(\"api_key\") ||\n c.req.query(\"key\");\n\n let rawApiKey =\n (authHeader?.startsWith(\"Bearer \") ? authHeader.slice(7) : authHeader) ||\n headerApiKey ||\n queryApiKey ||\n null;\n\n if (rawApiKey) {\n rawApiKey = rawApiKey.trim();\n if (\n rawApiKey === \"\" ||\n rawApiKey === \"null\" ||\n rawApiKey === \"undefined\" ||\n rawApiKey === \"Bearer\"\n ) {\n rawApiKey = null;\n }\n }\n\n const apiKey = rawApiKey;\n const reqUserId = c.req.header(\"x-user-id\") || c.req.header(\"X-User-Id\");\n const startTime = Date.now();\n\n const systemMaiApiKey = Deno.env.get(\"MAI_API_KEY\");\n\n let userPlan = \"Free\";\n let currentUserId: string | null = null;\n const currentApiKey: string | null = apiKey;\n let matchedApiKey: string | null = apiKey;\n // Authentification par clé API enregistrée (par opposition à un JWT de session ou à la clé système)\n let isRegisteredApiKey = false;\n\n function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) {\n return false;\n }\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return diff === 0;\n }\n\n // Résolution de l'authentification : Clé API utilisateur enregistrée, Clé système, ou Token JWT\n if (apiKey) {\n // Détection prioritaire du forfait directement encodé dans la clé (mai-TIER_USER-XXXXX-XXXXX)\n const keyTier = extractTierFromApiKey(apiKey);\n if (keyTier) {\n userPlan = keyTier;\n }\n\n const sql = getDb();\n try {\n const rows = await sql`\n SELECT k.*, u.tier as user_tier, u.id as u_id\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${apiKey}::text\n LIMIT 1\n `;\n\n if (rows.length > 0) {\n const apiKeyData = rows[0];\n // Si le TIER_USER a été extrait de la clé fournie, il fait foi en priorité\n if (!keyTier) {\n const rawPlan = String(apiKeyData.plan || \"\").trim().toLowerCase();\n const validTiers = [\"free\", \"plus\", \"pro\", \"max\"];\n userPlan = apiKeyData.user_tier ||\n (validTiers.includes(rawPlan) ? apiKeyData.plan : \"Plus\");\n }\n currentUserId = apiKeyData.user_id;\n matchedApiKey = apiKeyData.api_key || apiKey;\n isRegisteredApiKey = true;\n } else if (\n systemMaiApiKey && timingSafeEqual(apiKey, systemMaiApiKey)\n ) {\n userPlan = \"Plus\";\n currentUserId = \"system-mai\";\n } else {\n // Tenter de valider le token comme un JWT de session\n try {\n const payload = await verifyToken(apiKey);\n currentUserId = String(payload.sub || \"\");\n userPlan = String(payload.tier || \"Free\");\n\n // Vérifier dans la table users si le forfait a changé\n if (currentUserId) {\n const uRows = await sql`\n SELECT tier FROM users\n WHERE id::text = ${currentUserId}::text OR username = ${currentUserId}::text OR email = ${currentUserId}::text\n LIMIT 1\n `;\n if (uRows.length > 0 && uRows[0].tier) {\n userPlan = uRows[0].tier;\n }\n }\n } catch {\n if (!isPublicRoute) {\n return c.json({ error: \"Invalid API Key.\" }, 403);\n }\n }\n }\n } catch (dbErr) {\n console.error(\"Auth DB Error in middleware:\", dbErr);\n }\n }\n\n // 3. En-tête x-user-id (requêtes web app / internes) : uniquement si déjà authentifié ou fallback route publique\n if (reqUserId && reqUserId !== \"system-mai\") {\n if (currentUserId) {\n // Déjà authentifié via clé API ou JWT : x-user-id doit correspondre, sinon on l'ignore\n if (reqUserId !== currentUserId) {\n console.warn(\n `[Auth] x-user-id mismatch: header=${reqUserId} vs auth=${currentUserId} — header ignoré`,\n );\n }\n } else if (apiKey) {\n // apiKey présent mais non reconnu (route publique) : ne pas promouvoir via x-user-id seul\n } else {\n // Aucune auth vérifiée\n try {\n const sql = getDb();\n const uRows = await sql`\n SELECT tier FROM users \n WHERE id::text = ${reqUserId}::text OR username = ${reqUserId}::text OR email = ${reqUserId}::text \n LIMIT 1\n `;\n if (uRows.length > 0) {\n if (uRows[0].tier) {\n userPlan = uRows[0].tier;\n }\n if (isPublicRoute) {\n currentUserId = reqUserId;\n } else {\n console.warn(\n `[Auth] x-user-id sans JWT sur route privée ${path} — ignoré`,\n );\n }\n }\n } catch {}\n }\n }\n\n // 4. Aucun identifiant et route privée\n if (!apiKey && !currentUserId && !isPublicRoute) {\n return c.json({ error: \"Service Unavailable. API Key missing.\" }, 401);\n }\n\n // Enregistrer le plan et les infos de contexte\n c.set(\"userPlan\", userPlan);\n c.set(\"userId\", currentUserId);\n c.set(\"apiKey\", currentApiKey);\n c.set(\"matchedApiKey\", matchedApiKey);\n\n // Vérification préventive du quota de requêtes pour les clés API enregistrées.\n // Le solde est global au compte (cumul de toutes ses clés) et la période est hebdomadaire\n // (lundi 00:00 UTC), marquée par usage_period_start pour un reset idempotent.\n // Un token JWT de session ne consomme pas ce quota : la requête est exécutée directement.\n if (isRegisteredApiKey && currentUserId && currentUserId !== \"system-mai\") {\n const sql = getDb();\n const { nextResetIso, weekStartStr } = getWeekData();\n const apiBoost = await getUserQuotaBoost(sql, currentUserId, \"api\");\n const limit = getTierRequestLimit(userPlan) + apiBoost;\n\n try {\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = 0, usage_period_start = ${weekStartStr}::date\n WHERE user_id::text = ${currentUserId}::text\n AND usage_period_start IS DISTINCT FROM ${weekStartStr}::date\n `;\n\n const countRows = await sql`\n SELECT SUM(request_count) as total_requests\n FROM mprojects_api_keys\n WHERE user_id::text = ${currentUserId}::text\n `;\n // Neon renvoie les bigint en chaîne: Number() est obligatoire pour comparer\n const used = Number(countRows[0]?.total_requests || 0);\n const remaining = Math.max(0, limit - used);\n\n (c as any).set(\"requestQuota\", {\n apiKey: matchedApiKey,\n limit,\n remaining,\n used,\n });\n\n if (remaining < 1) {\n if (isPublicRoute) {\n await next();\n return;\n }\n return c.json({\n code: \"quota_exceeded\",\n error: \"Quota exceeded for your account.\",\n limit,\n remaining,\n resetAt: nextResetIso,\n used,\n }, 429);\n }\n } catch {}\n }\n\n await next();\n\n const latency = Date.now() - startTime;\n const status = c.res.status;\n const endpoint = c.req.path;\n const method = c.req.method;\n\n // Log-usage & Décompte de 1 requête du quota API (chat, audio, images, web search, etc.).\n // Uniquement pour les clés API enregistrées : +1 requête au solde hebdomadaire du\n // propriétaire de la clé. Les requêtes authentifiées par JWT de session sont\n // exécutées directement, sans log-usage ni débit ensuite.\n const isExcludedRoute = path.startsWith(\"/v1/devices\") ||\n path === \"/v1/status\" || path === \"/status\";\n if (!isExcludedRoute && isRegisteredApiKey) {\n try {\n const sql = getDb();\n const effectiveKeyToLog = matchedApiKey || apiKey;\n\n await sql`\n INSERT INTO mprojects_api_logs (api_key, endpoint, method, status_code, latency_ms)\n VALUES (${effectiveKeyToLog}::text, ${endpoint}::text, ${method}::text, ${status}::integer, ${latency}::integer)\n `;\n\n // Les routes qui débitent elles-mêmes un coût multi-crédits (images) posent le fanion\n // pour éviter le double débit `cout + 1` sur la même requête.\n if (status === 200 && !(c as any).get?.(\"quotaDebitedByHandler\")) {\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = request_count + 1, last_used_at = NOW()\n WHERE api_key = ${effectiveKeyToLog}::text\n `;\n }\n } catch (err) {\n console.error(\"Erreur logging API & mise à jour quota:\", err);\n }\n }\n });\n}",[309],"pulls","branches",11,"forks","envVars",{"_324":327,"_328":64},"connections",{"_324":325,"_326":64},"count",1,"unfilledCount",117,"emptyCount",{"_43":308,"_32":309,"_30":310,"_157":-5,"_41":42,"_40":311,"_159":25,"_38":415,"_13":313,"_33":34,"_35":314,"_24":25,"_163":-5,"_352":416,"_27":417},{"_43":302,"_32":303,"_30":304,"_157":-5,"_41":42,"_40":158,"_159":25,"_38":412,"_13":178,"_33":34,"_35":306,"_24":25,"_163":-5,"_352":413,"_27":414},{"_43":298,"_32":28,"_30":31,"_157":-5,"_41":42,"_40":14,"_159":25,"_38":409,"_13":300,"_33":34,"_35":37,"_24":25,"_163":-5,"_352":410,"_27":411},{"_43":290,"_32":291,"_30":292,"_157":-5,"_41":42,"_40":293,"_159":25,"_38":406,"_13":295,"_33":34,"_35":296,"_24":25,"_163":-5,"_352":407,"_27":408},{"_43":282,"_32":283,"_30":284,"_157":-5,"_41":42,"_40":285,"_159":60,"_38":403,"_13":287,"_33":34,"_35":288,"_24":25,"_163":-5,"_352":404,"_27":405},{"_43":276,"_32":277,"_30":278,"_157":-5,"_41":42,"_40":158,"_159":25,"_38":400,"_13":237,"_33":34,"_35":280,"_24":25,"_163":-5,"_352":401,"_27":402},{"_43":270,"_32":271,"_30":272,"_157":-5,"_41":42,"_40":158,"_159":60,"_38":397,"_13":170,"_33":34,"_35":274,"_24":25,"_163":-5,"_352":398,"_27":399},{"_43":263,"_32":264,"_30":265,"_157":-5,"_41":42,"_40":266,"_159":60,"_38":394,"_13":64,"_33":34,"_35":268,"_24":25,"_163":-5,"_352":395,"_27":396},{"_43":255,"_32":256,"_30":58,"_157":-5,"_41":42,"_40":257,"_159":25,"_38":391,"_13":259,"_33":260,"_35":261,"_24":25,"_163":45,"_352":392,"_27":393},{"_43":247,"_32":248,"_30":249,"_157":-5,"_41":42,"_40":250,"_159":25,"_38":388,"_13":252,"_33":34,"_35":253,"_24":25,"_163":-5,"_352":389,"_27":390},{"_43":240,"_32":241,"_30":242,"_157":-5,"_41":42,"_40":243,"_159":25,"_38":385,"_13":161,"_33":34,"_35":245,"_24":25,"_163":-5,"_352":386,"_27":387},{"_43":232,"_32":233,"_30":234,"_157":-5,"_41":42,"_40":235,"_159":25,"_38":382,"_13":237,"_33":34,"_35":238,"_24":25,"_163":-5,"_352":383,"_27":384},{"_43":224,"_32":225,"_30":226,"_157":-5,"_41":42,"_40":227,"_159":25,"_38":379,"_13":229,"_33":34,"_35":230,"_24":25,"_163":-5,"_352":380,"_27":381},{"_43":217,"_32":218,"_30":219,"_157":-5,"_41":42,"_40":220,"_159":25,"_38":376,"_13":178,"_33":34,"_35":222,"_24":25,"_163":-5,"_352":377,"_27":378},{"_43":210,"_32":211,"_30":212,"_157":-5,"_41":42,"_40":213,"_159":25,"_38":373,"_13":178,"_33":34,"_35":215,"_24":25,"_163":-5,"_352":374,"_27":375},{"_43":203,"_32":204,"_30":205,"_157":-5,"_41":42,"_40":206,"_159":25,"_38":370,"_13":178,"_33":34,"_35":208,"_24":25,"_163":-5,"_352":371,"_27":372},{"_43":196,"_32":197,"_30":198,"_157":-5,"_41":42,"_40":199,"_159":25,"_38":367,"_13":161,"_33":34,"_35":201,"_24":25,"_163":-5,"_352":368,"_27":369},{"_43":189,"_32":190,"_30":191,"_157":-5,"_41":42,"_40":192,"_159":25,"_38":364,"_13":178,"_33":34,"_35":194,"_24":25,"_163":-5,"_352":365,"_27":366},{"_43":181,"_32":182,"_30":183,"_157":-5,"_41":42,"_40":184,"_159":25,"_38":361,"_13":186,"_33":34,"_35":187,"_24":25,"_163":-5,"_352":362,"_27":363},{"_43":173,"_32":174,"_30":175,"_157":-5,"_41":42,"_40":176,"_159":25,"_38":358,"_13":178,"_33":34,"_35":179,"_24":25,"_163":-5,"_352":359,"_27":360},{"_43":165,"_32":166,"_30":167,"_157":-5,"_41":42,"_40":168,"_159":25,"_38":355,"_13":170,"_33":34,"_35":171,"_24":25,"_163":-5,"_352":356,"_27":357},{"_43":154,"_32":155,"_30":156,"_157":-5,"_41":42,"_40":158,"_159":60,"_38":351,"_13":161,"_33":34,"_35":162,"_24":25,"_163":-5,"_352":353,"_27":354},["D",1788164141214],"children",[],[155],["D",1788363515816],[],[166],["D",1788445243024],[],[174],["D",1788443289702],[],[182],["D",1788443274439],[],[190],["D",1788443281810],[],[197],["D",1788445251482],[],[204],["D",1788443366782],[],[211],["D",1788443339578],[],[218],["D",1788363533453],[],[225],["D",1788443331381],[],[233],["D",1788366740710],[],[241],["D",1788445263190],[],[248],["D",1788445275206],[],[256],["D",1787587613987],[],[264],["D",1788164141214],[],[271],["D",1788164141214],[],[277],["D",1787754938926],[],[283],["D",1788443309111],[],[291],["D",1788447239386],[],[28],["D",1788164141214],[],[303],["D",1788445230637],[],[309],["D",1785339526786],["D",1789474235934],{"_101":100,"_109":105},{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},{"_13":90,"_32":91,"_43":42,"_92":44,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":45,"_99":100},"ctx",{"_83":-5,"_129":456,"_457":458,"_459":460,"_461":25,"_462":25,"_463":25,"_464":60,"_465":-5,"_466":-7,"_467":-7,"_468":64,"_469":25,"_470":25,"_471":-5,"_472":25,"_473":25,"_474":25,"_475":-5},"ENV",{"_427":428,"_429":430,"_431":91,"_432":433,"_434":435,"_436":437,"_438":439,"_440":441,"_442":443,"_444":445,"_446":447,"_448":449,"_450":451,"_452":453,"_454":455},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v182