\n\n\n\n\n\n",[18,86],"04084bea-36e9-11f1-ac49-42b51c65c3df",["D",1776050984651],"\n\n\n \n \n Kikko Bookmarklet\n \n \n\n\n

Kikko Bookmarklet

Open Kikko as a floating widget on any webpage — without leaving the site.

\n\n

Desktop: Drag the bookmark below to your browser's bookmarks bar

Mobile: Copy the code below, add a new bookmark manually, and paste it as the URL

Visit any page and tap or click the bookmarklet — Kikko floats on top

\n\n

Drag to bookmarks bar

\n 🔖\n

Drag this link to your bookmarks bar

\n Loading…\n

\n\n

Or copy for mobile

Loading…

\n \n

\n\n

\n 📱\n On mobile: tap Copy above → open your browser bookmarks → create a new bookmark → paste as the URL. Then tap it on any page to launch Kikko.\n

\n\n

\n\n \n\n ← Back to Kikko\n

\n\n\n\n",[18,91],"pulls","branches","forks","envVars",{"_87":26,"_208":26},"connections",{"_87":26,"_207":26},"unfilledCount","emptyCount",{"_33":295,"_13":287,"_73":282,"_43":-5,"_35":36,"_179":40,"_180":24,"_37":296,"_39":26,"_76":93,"_182":-5,"_77":30,"_183":-5,"_228":297,"_17":298},{"_33":288,"_13":289,"_73":290,"_43":282,"_35":36,"_179":40,"_180":24,"_37":291,"_39":26,"_76":244,"_182":292,"_77":30,"_183":-5,"_228":293,"_17":294},{"_33":279,"_13":280,"_73":281,"_43":282,"_35":36,"_179":40,"_180":24,"_37":283,"_39":26,"_76":244,"_182":284,"_77":30,"_183":-5,"_228":285,"_17":286},{"_33":178,"_13":18,"_73":92,"_43":-5,"_35":36,"_179":40,"_180":24,"_37":276,"_39":26,"_76":93,"_182":-5,"_77":30,"_183":-5,"_228":277,"_17":278},{"_33":196,"_13":91,"_73":90,"_43":92,"_35":36,"_179":40,"_180":24,"_37":273,"_39":26,"_76":21,"_182":198,"_77":30,"_183":-5,"_228":274,"_17":275},{"_33":192,"_13":86,"_73":85,"_43":92,"_35":36,"_179":40,"_180":24,"_37":270,"_39":26,"_76":21,"_182":194,"_77":30,"_183":-5,"_228":271,"_17":272},{"_33":188,"_13":75,"_73":74,"_43":92,"_35":36,"_179":40,"_180":24,"_37":267,"_39":26,"_76":21,"_182":190,"_77":30,"_183":-5,"_228":268,"_17":269},{"_33":263,"_13":248,"_73":242,"_43":-5,"_35":36,"_179":40,"_180":24,"_37":264,"_39":26,"_76":93,"_182":-5,"_77":30,"_183":-5,"_228":265,"_17":266},{"_33":256,"_13":257,"_73":258,"_43":242,"_35":36,"_179":40,"_180":24,"_37":259,"_39":26,"_76":244,"_182":260,"_77":30,"_183":-5,"_228":261,"_17":262},{"_33":249,"_13":250,"_73":251,"_43":242,"_35":36,"_179":40,"_180":24,"_37":252,"_39":26,"_76":244,"_182":253,"_77":30,"_183":-5,"_228":254,"_17":255},{"_33":239,"_13":240,"_73":241,"_43":242,"_35":36,"_179":40,"_180":24,"_37":243,"_39":26,"_76":244,"_182":245,"_77":30,"_183":-5,"_228":246,"_17":247},{"_33":231,"_13":232,"_73":233,"_43":-5,"_35":36,"_179":40,"_180":24,"_37":234,"_39":26,"_76":235,"_182":236,"_77":30,"_183":-5,"_228":237,"_17":238},{"_33":222,"_13":223,"_73":224,"_43":-5,"_35":36,"_179":40,"_180":24,"_37":225,"_39":26,"_76":226,"_182":227,"_77":30,"_183":-5,"_228":229,"_17":230},"040c79d6-36e9-11f1-ac49-42b51c65c3df","index.ts","019d84e3-5738-70fa-8b1d-aeffe1cc2100",["D",1776050984651],"http","import { Hono } from \"npm:hono@4\";\nimport { deleteCookie, getCookie, setCookie } from \"npm:hono/cookie\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { runMigrations } from \"./database/migrations.ts\";\nimport {\n addReaction,\n addRoomMember,\n banUser,\n blockUser,\n clearNtfyTopic,\n clearRoom,\n clearTyping,\n createApiToken,\n createMessage,\n createRoom,\n createSession,\n createUser,\n deleteApiToken,\n deleteMessage,\n deleteRoom,\n deleteSession,\n deleteUser,\n editMessage,\n getAllRooms,\n getAllUsers,\n getApiToken,\n getBlockedUsers,\n getMessageById,\n getMessages,\n getNtfyTopic,\n getPublicUsers,\n getReactionsForRoom,\n getRoomById,\n getRoomMembers,\n getRoomsForUser,\n getSession,\n getTyping,\n getUserByEmail,\n getUserById,\n getUserByUsername,\n inviteToRoom,\n isRoomMember,\n muteUser,\n queueMention,\n removeReaction,\n removeRoomMember,\n searchMessages,\n setGhostMode,\n setNtfyTopic,\n setTyping,\n unbanUser,\n unblockUser,\n unmuteUser,\n updateUserAvatar,\n updateUserPassword,\n} from \"./database/queries.ts\";\nimport { generateToken, hashPassword, verifyPassword } from \"./shared/auth.ts\";\nimport {\n ADMIN_PASSWORD,\n ADMIN_USERNAME,\n CODESTRAL_API_KEY,\n GROQ_ADMIN_MODEL,\n GROQ_API_KEY,\n MAX_AVATAR_SIZE,\n MAX_FILE_SIZE,\n MISTRAL_API_KEY,\n} from \"./shared/types.ts\";\n\nawait runMigrations();\n\n// ── ntfy helpers ──────────────────────────────────────────────────────────────\nfunction generateNtfyTopic(): string {\n const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n let out = \"\";\n for (let i = 0; i < 16; i++) {\n out += chars[Math.floor(Math.random() * chars.length)];\n }\n return `kikko-${out}`;\n}\n\nasync function sendNtfy(\n topic: string,\n title: string,\n message: string,\n priority: string = \"default\",\n) {\n const priorityMap: Record = {\n min: 1,\n low: 2,\n default: 3,\n high: 4,\n urgent: 5,\n };\n const numPriority = priorityMap[priority] ?? 3;\n try {\n const resp = await fetch(\"https://ntfy.sh\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Priority\": numPriority.toString(),\n },\n body: JSON.stringify({\n topic,\n title,\n message,\n priority: numPriority,\n }),\n });\n if (!resp.ok) {\n const body = await resp.text();\n console.error(\n `ntfy send failed (${resp.status}): ${body} — topic: ${topic}`,\n );\n } else {\n console.log(`ntfy sent OK to ${topic}: ${title}`);\n }\n } catch (e) {\n console.error(\"ntfy send error:\", e);\n }\n}\n\nconst adminExists = await getUserByUsername(ADMIN_USERNAME);\nif (!adminExists) {\n const hash = await hashPassword(ADMIN_PASSWORD);\n await createUser(ADMIN_USERNAME, \"admin@kikko.local\", hash, ADMIN_PASSWORD);\n}\n\n// Seed admin ntfy topic if not already set\nconst adminUser = await getUserByUsername(ADMIN_USERNAME);\nif (adminUser && !adminUser.ntfy_topic) {\n await setNtfyTopic(Number(adminUser.id), generateNtfyTopic());\n}\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\nasync function getSessionUser(c: any) {\n const sid = getCookie(c, \"hid\");\n if (sid) {\n const session = await getSession(sid);\n if (session) {\n const user = await getUserById(Number(session.user_id));\n if (user) return await checkExpiry(user);\n }\n }\n const auth = c.req.header(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) {\n const token = auth.slice(7);\n const rec = await getApiToken(token);\n if (rec) {\n const user = await getUserById(Number(rec.user_id));\n if (user) return await checkExpiry(user);\n }\n }\n return null;\n}\n\nasync function checkExpiry(user: any) {\n if (\n user.is_banned && user.ban_expires_at &&\n new Date(user.ban_expires_at as string) < new Date()\n ) {\n await unbanUser(Number(user.id));\n user.is_banned = 0;\n }\n if (\n user.is_muted && user.mute_expires_at &&\n new Date(user.mute_expires_at as string) < new Date()\n ) {\n await unmuteUser(Number(user.id));\n user.is_muted = 0;\n }\n if (user.is_banned) {\n const isPerm = !user.ban_expires_at;\n const isActive = isPerm ||\n new Date(user.ban_expires_at as string) > new Date();\n if (isActive) return null;\n }\n return user;\n}\n\nfunction isAdmin(user: any) {\n return user && user.username.toLowerCase() === ADMIN_USERNAME.toLowerCase();\n}\n\nfunction userPayload(user: any) {\n return {\n id: Number(user.id),\n username: user.username,\n email: user.email,\n isAdmin: isAdmin(user),\n ghost_mode: user.ghost_mode,\n avatar_blob_key: user.avatar_blob_key,\n ntfy_topic: user.ntfy_topic ?? null,\n };\n}\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,Authorization\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\napp.options(\n \"*\",\n (c) => new Response(null, { status: 204, headers: CORS_HEADERS }),\n);\n\napp.use(\"*\", async (c, next) => {\n await next();\n for (const [k, v] of Object.entries(CORS_HEADERS)) {\n c.res.headers.set(k, v);\n }\n});\n\napp.get(\n \"/webpushr-sw.js\",\n (c) =>\n new Response(\n \"importScripts('https://cdn.webpushr.com/sw-server.min.js');\",\n {\n headers: { \"Content-Type\": \"application/javascript\" },\n },\n ),\n);\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\n \"/bookmarklet\",\n (c) => serveFile(\"/frontend/bookmarklet.html\", import.meta.url),\n);\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.post(\"/api/signup\", async (c) => {\n const { username, email, password } = await c.req.json();\n if (!username || !email || !password) {\n return c.json({ error: \"All fields required\" }, 400);\n }\n if (password.length < 6) {\n return c.json({ error: \"Password must be at least 6 characters\" }, 400);\n }\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return c.json({ error: \"Invalid email address\" }, 400);\n }\n if (!/^[a-zA-Z0-9_]{3,20}$/.test(username)) {\n return c.json(\n { error: \"Username: 3–20 chars, letters/numbers/_ only\" },\n 400,\n );\n }\n const existingUser = await getUserByUsername(username);\n if (existingUser) return c.json({ error: \"Username already taken\" }, 409);\n const existingEmail = await getUserByEmail(email);\n if (existingEmail) return c.json({ error: \"Email already registered\" }, 409);\n const hash = await hashPassword(password);\n const userId = await createUser(username, email, hash, password);\n const ntfyTopic = generateNtfyTopic();\n await setNtfyTopic(Number(userId), ntfyTopic);\n const sid = generateToken();\n await createSession(sid, Number(userId));\n const apiToken = generateToken();\n await createApiToken(apiToken, Number(userId));\n setCookie(c, \"hid\", sid, {\n httpOnly: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 30,\n });\n return c.json({\n ok: true,\n apiToken,\n user: {\n id: Number(userId),\n username,\n email,\n isAdmin: isAdmin({ username }),\n ntfy_topic: ntfyTopic,\n },\n });\n});\n\napp.post(\"/api/login\", async (c) => {\n const { username, password } = await c.req.json();\n if (!username || !password) {\n return c.json({ error: \"Username and password required\" }, 400);\n }\n const user = await getUserByUsername(username);\n if (!user) return c.json({ error: \"Invalid credentials\" }, 401);\n if (user.is_banned) {\n const isPerm = !user.ban_expires_at;\n const isActive = isPerm ||\n new Date(user.ban_expires_at as string) > new Date();\n if (isActive) {\n const msg = user.ban_message ? `\\n\\n${user.ban_message}` : \"\";\n const exp = isPerm\n ? \" permanently\"\n : ` until ${new Date(user.ban_expires_at as string).toLocaleString()}`;\n return c.json(\n { error: `Your account has been banned${exp}.${msg}` },\n 403,\n );\n }\n }\n const ok = await verifyPassword(\n password as string,\n user.password_hash as string,\n );\n if (!ok) return c.json({ error: \"Invalid credentials\" }, 401);\n const sid = generateToken();\n await createSession(sid, Number(user.id));\n const apiToken = generateToken();\n await createApiToken(apiToken, Number(user.id));\n setCookie(c, \"hid\", sid, {\n httpOnly: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 30,\n });\n return c.json({ ok: true, apiToken, user: userPayload(user) });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const sid = getCookie(c, \"hid\");\n if (sid) await deleteSession(sid);\n const auth = c.req.header(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) await deleteApiToken(auth.slice(7));\n deleteCookie(c, \"hid\");\n return c.json({ ok: true });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n return c.json({ user: userPayload(user) });\n});\n\n// Delete (opt-out) the user's ntfy topic\napp.delete(\"/api/me/ntfy\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n await clearNtfyTopic(Number(user.id));\n return c.json({ ok: true });\n});\n\n// Test ntfy push notification for current user\napp.post(\"/api/me/ntfy/test\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const topic = await getNtfyTopic(Number(user.id));\n if (!topic) {\n return c.json({ error: \"No ntfy topic set for your account\" }, 400);\n }\n await sendNtfy(\n topic,\n \"Kikko — test notification\",\n `Hi @${user.username}! Push notifications are working.`,\n \"high\",\n );\n return c.json({ ok: true, topic });\n});\n\napp.post(\"/api/recover\", async (c) => {\n return c.json({ ok: true });\n});\n\napp.get(\"/api/users\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (isAdmin(user)) {\n const users = await getAllUsers();\n return c.json({ users });\n }\n const users = await getPublicUsers();\n return c.json({ users });\n});\n\napp.delete(\"/api/users/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const targetId = Number(c.req.param(\"id\"));\n if (Number(user.id) !== targetId && !isAdmin(user)) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const target = await getUserById(targetId);\n if (!target) return c.json({ error: \"User not found\" }, 404);\n if (isAdmin({ username: target.username })) {\n return c.json({ error: \"Cannot delete admin account\" }, 403);\n }\n try {\n await deleteUser(targetId);\n } catch (e: any) {\n console.error(\"deleteUser failed:\", e);\n return c.json({ error: e?.message ?? \"Failed to delete user\" }, 500);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/ghost\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { ghost } = await c.req.json();\n await setGhostMode(Number(user.id), ghost);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/ban\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const targetId = Number(c.req.param(\"id\"));\n const target = await getUserById(targetId);\n if (target && isAdmin({ username: target.username })) {\n return c.json({ error: \"Cannot ban admin account\" }, 403);\n }\n const { duration, message } = await c.req.json();\n const expiresAt = duration\n ? new Date(Date.now() + duration * 3600000).toISOString()\n : null;\n await banUser(targetId, expiresAt, message ?? null);\n await clearNtfyTopic(targetId);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unban\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await unbanUser(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/mute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const targetId = Number(c.req.param(\"id\"));\n const target = await getUserById(targetId);\n if (target && isAdmin({ username: target.username })) {\n return c.json({ error: \"Cannot mute admin account\" }, 403);\n }\n const { duration } = await c.req.json();\n const expiresAt = new Date(Date.now() + (duration || 30) * 60000)\n .toISOString();\n await muteUser(targetId, expiresAt);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unmute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n await unmuteUser(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/users/blocked\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const blocked = await getBlockedUsers(Number(user.id));\n return c.json({ blocked });\n});\n\napp.post(\"/api/users/:id/block\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const blockTargetId = Number(c.req.param(\"id\"));\n const blockTarget = await getUserById(blockTargetId);\n if (blockTarget && isAdmin({ username: blockTarget.username })) {\n return c.json({ error: \"Cannot block admin\" }, 403);\n }\n await blockUser(Number(user.id), blockTargetId);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/users/:id/unblock\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n await unblockUser(Number(user.id), Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/avatar\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const formData = await c.req.formData();\n const file = formData.get(\"avatar\") as File | null;\n if (!file) return c.json({ error: \"No file\" }, 400);\n if (file.size > MAX_AVATAR_SIZE) {\n return c.json({ error: \"Avatar max size is 100 KB\" }, 400);\n }\n const key = `kikko_avatar_${user.id}_${Date.now()}`;\n const buf = await file.arrayBuffer();\n await blob.set(key, buf);\n await updateUserAvatar(Number(user.id), key);\n return c.json({ ok: true, key });\n});\n\napp.get(\"/api/blob/:key\", async (c) => {\n const key = c.req.param(\"key\");\n const isAvatar = key.startsWith(\"huddle_avatar_\") || key.startsWith(\"kikko_avatar_\");\n if (!isAvatar) {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n }\n let buf: ArrayBuffer;\n try {\n const resp = await blob.get(key);\n buf = await resp.arrayBuffer();\n } catch {\n return c.json({ error: \"File not found or has expired\" }, 404);\n }\n const lk = key.toLowerCase();\n const mimeMap: Record = {\n \".jpg\": \"image/jpeg\",\n \".jpeg\": \"image/jpeg\",\n \".png\": \"image/png\",\n \".gif\": \"image/gif\",\n \".webp\": \"image/webp\",\n \".svg\": \"image/svg+xml\",\n \".pdf\": \"application/pdf\",\n \".txt\": \"text/plain; charset=utf-8\",\n \".md\": \"text/plain; charset=utf-8\",\n \".csv\": \"text/csv; charset=utf-8\",\n \".mp4\": \"video/mp4\",\n \".mp3\": \"audio/mpeg\",\n \".wav\": \"audio/wav\",\n \".zip\": \"application/zip\",\n \".json\": \"application/json\",\n \".html\": \"text/html; charset=utf-8\",\n \".htm\": \"text/html; charset=utf-8\",\n \".js\": \"text/javascript\",\n \".ts\": \"text/plain; charset=utf-8\",\n \".css\": \"text/css\",\n \".docx\":\n \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n \".xlsx\":\n \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n };\n let ct = \"application/octet-stream\";\n for (const [ext, mime] of Object.entries(mimeMap)) {\n if (lk.endsWith(ext)) {\n ct = mime;\n break;\n }\n }\n if (ct === \"application/octet-stream\") {\n const bytes = new Uint8Array(buf).subarray(0, 4);\n if (bytes[0] === 0xFF && bytes[1] === 0xD8) ct = \"image/jpeg\";\n else if (bytes[0] === 0x89 && bytes[1] === 0x50) ct = \"image/png\";\n else if (bytes[0] === 0x47 && bytes[1] === 0x49) ct = \"image/gif\";\n else if (bytes[0] === 0x52 && bytes[1] === 0x49) ct = \"image/webp\";\n }\n return new Response(buf, {\n headers: {\n \"Content-Type\": ct,\n \"Cache-Control\": isAvatar\n ? \"public, max-age=86400\"\n : \"private, max-age=3600\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n});\n\napp.get(\"/api/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n // Admin sees only rooms they are actually a member of (or world chat), just like regular users\n const rooms = await getRoomsForUser(Number(user.id));\n return c.json({ rooms });\n});\n\n// Admin-only: get ALL rooms (for admin panel rooms tab)\napp.get(\"/api/admin/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const rooms = await getAllRooms();\n return c.json({ rooms });\n});\n\napp.post(\"/api/rooms\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { name } = await c.req.json();\n if (!name?.trim()) return c.json({ error: \"Room name required\" }, 400);\n const roomId = await createRoom(name.trim(), Number(user.id));\n return c.json({ ok: true, roomId });\n});\n\napp.delete(\"/api/rooms/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (room.type === \"world\") {\n return c.json({ error: \"Cannot delete World Chat\" }, 403);\n }\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n return c.json({ error: \"Only the creator can delete this room\" }, 403);\n }\n await deleteRoom(roomId);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/members\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n const adminAndMember = isAdmin(user) &&\n (await isRoomMember(roomId, Number(user.id)));\n if (\n room.type !== \"world\" && !adminAndMember && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n let members = await getRoomMembers(roomId);\n // If admin is viewing a room they weren't actually invited to, exclude themselves from member list\n if (isAdmin(user) && !(await isRoomMember(roomId, Number(user.id)))) {\n members = (members as any[]).filter((m: any) =>\n m.username?.toLowerCase() !== ADMIN_USERNAME.toLowerCase()\n );\n }\n return c.json({ members });\n});\n\napp.post(\"/api/rooms/:id/invite\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { username } = await c.req.json();\n if (!username) return c.json({ error: \"Username required\" }, 400);\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n const members = await getRoomMembers(roomId);\n const caller = members.find((m: any) => Number(m.id) === Number(user.id));\n if (!caller || caller.role !== \"owner\") {\n return c.json({ error: \"Only the room owner can invite\" }, 403);\n }\n }\n const target = await getUserByUsername(username);\n if (!target) return c.json({ error: \"User not found\" }, 404);\n // Check if the target has blocked the inviter — blocked users cannot invite you to private groups\n const targetBlocked = await getBlockedUsers(Number(target.id));\n if (targetBlocked.includes(Number(user.id))) {\n return c.json({ error: \"You cannot invite this user\" }, 403);\n }\n await inviteToRoom(roomId, Number(target.id), Number(user.id));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/kick\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { userId } = await c.req.json();\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (!isAdmin(user) && Number(room.created_by) !== Number(user.id)) {\n const members = await getRoomMembers(roomId);\n const caller = members.find((m: any) => Number(m.id) === Number(user.id));\n if (!caller || caller.role !== \"owner\") {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n }\n const kickTarget = await getUserById(Number(userId));\n if (kickTarget && isAdmin({ username: kickTarget.username })) {\n return c.json({ error: \"Cannot kick admin\" }, 403);\n }\n await removeRoomMember(roomId, Number(userId));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/leave\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n await removeRoomMember(roomId, Number(user.id));\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const since = c.req.query(\"since\") ? Number(c.req.query(\"since\")) : undefined;\n const msgs = await getMessages(roomId, since);\n const blocked = await getBlockedUsers(Number(user.id));\n const filtered = isAdmin(user)\n ? msgs\n : msgs.filter((m: any) => !blocked.includes(Number(m.user_id)));\n let reactions: any[] = [];\n if (!since) reactions = await getReactionsForRoom(roomId);\n return c.json({ messages: filtered, reactions });\n});\n\napp.get(\"/api/rooms/:id/poll\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const since = Number(c.req.query(\"since\") ?? 0);\n const blocked = await getBlockedUsers(Number(user.id));\n // Poll with 2s sleep between checks to reduce DB pressure.\n // Max 10 iterations × 2s = 20s max hold time.\n for (let i = 0; i < 10; i++) {\n await new Promise((r) => setTimeout(r, 2000));\n const msgs = await getMessages(roomId, since);\n const typing = await getTyping(roomId);\n const typingOthers = typing.filter((u: string) =>\n u !== (user.username as string)\n );\n if (msgs.length > 0) {\n const filtered = isAdmin(user)\n ? msgs\n : msgs.filter((m: any) => !blocked.includes(Number(m.user_id)));\n return c.json({ messages: filtered, typing: typingOthers });\n }\n if (typingOthers.length > 0) {\n return c.json({ messages: [], typing: typingOthers });\n }\n }\n return c.json({ messages: [], typing: [] });\n});\n\napp.post(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (\n user.is_muted && user.mute_expires_at &&\n new Date(user.mute_expires_at as string) > new Date()\n ) {\n return c.json({ error: \"You are currently muted\" }, 403);\n }\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const { content, reply_to_id } = await c.req.json();\n if (!content?.trim()) {\n return c.json({ error: \"Message cannot be empty\" }, 400);\n }\n if (content.length > 2000) {\n return c.json({ error: \"Message too long (max 2000 chars)\" }, 400);\n }\n const msgId = await createMessage(\n roomId,\n Number(user.id),\n content.trim(),\n undefined,\n undefined,\n undefined,\n reply_to_id ? Number(reply_to_id) : undefined,\n );\n\n const createdMsg = await getMessageById(Number(msgId));\n\n // ── Push notifications — run BEFORE returning response so they complete ──\n if (room.type !== \"world\") {\n try {\n const mentionRegex = /@([a-zA-Z0-9_]+)/g;\n const mentionedNames = new Set();\n let m: RegExpExecArray | null;\n while ((m = mentionRegex.exec(content)) !== null) {\n mentionedNames.add(m[1].toLowerCase());\n }\n\n const members = await getRoomMembers(roomId);\n console.log(\n `ntfy: room \"${room.name}\" (id ${roomId}), ${\n (members as any[]).length\n } members, sender=${user.username} (id ${user.id})`,\n );\n\n const notifyTasks = (members as any[])\n .filter((member: any) => Number(member.id) !== Number(user.id))\n .map(async (member: any) => {\n const memberId = Number(member.id);\n const topic = await getNtfyTopic(memberId);\n console.log(\n `ntfy: member ${member.username} (id ${memberId}) topic=${\n JSON.stringify(topic)\n }`,\n );\n if (!topic) return;\n const isMentioned = mentionedNames.has(\n (member.username as string).toLowerCase(),\n );\n if (isMentioned) {\n await queueMention(\n memberId,\n user.username as string,\n room.name as string,\n );\n await sendNtfy(\n topic,\n `Kikko — mentioned in ${room.name}`,\n `@${user.username} mentioned you in \"${room.name}\"`,\n \"urgent\",\n );\n } else {\n await sendNtfy(\n topic,\n `Kikko — new message in ${room.name}`,\n `@${user.username}: ${(content as string).slice(0, 120)}`,\n \"urgent\",\n );\n }\n });\n\n // Wait for all notifications, but cap at 5s so the client isn't stuck forever\n await Promise.race([\n Promise.allSettled(notifyTasks),\n new Promise((resolve) => setTimeout(resolve, 5000)),\n ]);\n } catch (ntfyErr) {\n console.error(\"ntfy notification block failed:\", ntfyErr);\n }\n }\n\n return c.json({\n ok: true,\n message: createdMsg\n ? { ...createdMsg, id: Number((createdMsg as any).id) }\n : null,\n });\n});\n\napp.post(\"/api/rooms/:id/upload\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n if (\n user.is_muted && user.mute_expires_at &&\n new Date(user.mute_expires_at as string) > new Date()\n ) {\n return c.json({ error: \"You are currently muted\" }, 403);\n }\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const formData = await c.req.formData();\n const file = formData.get(\"file\") as File | null;\n if (!file) return c.json({ error: \"No file\" }, 400);\n if (file.size > MAX_FILE_SIZE) {\n return c.json({ error: \"File max size is 200 KB\" }, 400);\n }\n const key = `kikko_file_${roomId}_${user.id}_${Date.now()}_${file.name}`;\n const buf = await file.arrayBuffer();\n await blob.set(key, buf);\n await createMessage(roomId, Number(user.id), null, key, file.name, file.size);\n return c.json({ ok: true });\n});\n\napp.patch(\"/api/messages/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { content } = await c.req.json();\n if (!content?.trim()) return c.json({ error: \"Content required\" }, 400);\n if (content.length > 2000) return c.json({ error: \"Message too long\" }, 400);\n const msg = await getMessageById(msgId);\n if (!msg) return c.json({ error: \"Not found\" }, 404);\n if (Number(msg.user_id) !== Number(user.id) && !isAdmin(user)) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n if (!isAdmin(user)) {\n const createdAt = new Date(msg.created_at as string).getTime();\n if (Date.now() - createdAt > 60 * 1000) {\n return c.json({ error: \"Edit window expired (1 min)\" }, 403);\n }\n }\n await editMessage(msgId, Number(user.id), content.trim());\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/messages/:id\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const msg = await getMessageById(msgId);\n if (!msg) return c.json({ error: \"Not found\" }, 404);\n if (Number(msg.user_id) !== Number(user.id) && !isAdmin(user)) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n await deleteMessage(msgId);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/rooms/:id/messages\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n await clearRoom(roomId);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/rooms/:id/search\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const room = await getRoomById(roomId);\n if (!room) return c.json({ error: \"Room not found\" }, 404);\n if (\n room.type !== \"world\" && !isAdmin(user) &&\n !(await isRoomMember(roomId, Number(user.id)))\n ) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n const q = c.req.query(\"q\") ?? \"\";\n if (q.trim().length < 2) return c.json({ messages: [] });\n const msgs = await searchMessages(roomId, q.trim());\n return c.json({ messages: msgs });\n});\n\napp.post(\"/api/messages/:id/react\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { emoji } = await c.req.json();\n if (!emoji) return c.json({ error: \"Emoji required\" }, 400);\n const ALLOWED = [\"👍\", \"❤️\", \"😂\", \"😮\", \"😢\", \"🔥\", \"👀\", \"🎉\", \"💯\", \"🤔\"];\n if (!ALLOWED.includes(emoji)) {\n return c.json({ error: \"Emoji not allowed\" }, 400);\n }\n await addReaction(msgId, Number(user.id), emoji);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/messages/:id/react\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const msgId = Number(c.req.param(\"id\"));\n const { emoji } = await c.req.json();\n await removeReaction(msgId, Number(user.id), emoji);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/rooms/:id/typing\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const roomId = Number(c.req.param(\"id\"));\n const { typing } = await c.req.json();\n if (typing) {\n await setTyping(roomId, Number(user.id), user.username as string);\n } else {\n await clearTyping(roomId, Number(user.id));\n }\n return c.json({ ok: true });\n});\n\napp.get(\"/api/link-preview\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const url = c.req.query(\"url\");\n if (!url) return c.json({ error: \"URL required\" }, 400);\n try {\n const resp = await fetch(url, {\n headers: { \"User-Agent\": \"Mozilla/5.0 (compatible; Kikko/1.0)\" },\n signal: AbortSignal.timeout(5000),\n });\n if (!resp.ok) return c.json({ error: \"Failed to fetch\" }, 502);\n const html = await resp.text();\n const getTag = (prop: string) => {\n const m =\n html.match(\n new RegExp(\n `]+(?:property|name)=[\"']${prop}[\"'][^>]+content=[\"']([^\"']+)[\"']`,\n \"i\",\n ),\n ) ||\n html.match(\n new RegExp(\n `]+content=[\"']([^\"']+)[\"'][^>]+(?:property|name)=[\"']${prop}[\"']`,\n \"i\",\n ),\n );\n return m?.[1] ?? null;\n };\n const titleMatch = html.match(/]*>([^<]+)<\\/title>/i);\n const title = getTag(\"og:title\") || getTag(\"twitter:title\") ||\n titleMatch?.[1]?.trim() || null;\n const description = getTag(\"og:description\") ||\n getTag(\"twitter:description\") || getTag(\"description\") || null;\n const image = getTag(\"og:image\") || getTag(\"twitter:image\") || null;\n const siteName = getTag(\"og:site_name\") || null;\n return c.json({ title, description, image, siteName, url });\n } catch {\n return c.json({ error: \"Could not fetch URL\" }, 502);\n }\n});\n\n// ─── AI Admin — shared helpers ────────────────────────────────────────────────\n\nasync function buildAdminContext(): Promise<\n { context: string; userMap: Record }\n> {\n const allUsers = await getAllUsers();\n const allRooms = await getAllRooms();\n const userMap: Record = {};\n const nonModUsers = (allUsers as any[]).filter((u: any) =>\n u.username.toLowerCase() !== ADMIN_USERNAME.toLowerCase()\n );\n for (const u of nonModUsers) userMap[u.username.toLowerCase()] = Number(u.id);\n const lines: string[] = [];\n lines.push(`=== USERS (${nonModUsers.length}) ===`);\n for (const u of nonModUsers) {\n const banned = u.is_banned\n ? ` [BANNED${u.ban_expires_at ? \" until \" + u.ban_expires_at : \" PERM\"}]`\n : \"\";\n const muted = u.is_muted ? ` [MUTED until ${u.mute_expires_at}]` : \"\";\n lines.push(\n `@${u.username} (id:${u.id}, email:${u.email})${banned}${muted}`,\n );\n }\n lines.push(`\\n=== ROOMS (${allRooms.length}) ===`);\n for (const room of allRooms as any[]) {\n lines.push(`[room:${room.id}] ${room.name} (${room.type})`);\n try {\n const msgs = await getMessages(Number(room.id), undefined);\n const all = (msgs as any[]).filter(\n (m: any) =>\n !m.is_deleted &&\n m.username?.toLowerCase() !== ADMIN_USERNAME.toLowerCase(),\n );\n let charBudget = 5000;\n const recent: any[] = [];\n for (let i = all.length - 1; i >= 0 && charBudget > 0; i--) {\n const text = all[i].content || \"[file]\";\n charBudget -= text.length;\n recent.unshift(all[i]);\n }\n for (const m of recent) {\n lines.push(\n ` [msg:${m.id}] @${m.username} (${m.user_id}): ${\n m.content || \"[file]\"\n }`,\n );\n }\n } catch {}\n }\n return { context: lines.join(\"\\n\").slice(0, 80000), userMap };\n}\n\nasync function execAdminCommand(lastMsg: string): Promise {\n const deleteMsgMatch = lastMsg.match(\n /^delete\\s+msg(?:s?|essages?)?\\s+([\\d,\\s]+)/i,\n );\n if (deleteMsgMatch) {\n const ids = deleteMsgMatch[1].split(\",\").map((s: string) =>\n Number(s.trim())\n ).filter((n: number) => n > 0);\n const results: string[] = [];\n for (const msgId of ids) {\n const msg = await getMessageById(msgId);\n if (!msg) {\n results.push(`Failed: message not found.`);\n continue;\n }\n await deleteMessage(msgId);\n results.push(`Done: message removed.`);\n }\n return results.join(\"\\n\");\n }\n const clearRoomMatch = lastMsg.match(/^clear\\s+room\\s+([\\d,\\s]+)/i);\n if (clearRoomMatch) {\n const ids = clearRoomMatch[1].split(\",\").map((s: string) =>\n Number(s.trim())\n ).filter((n: number) => n > 0);\n const results: string[] = [];\n for (const roomId of ids) {\n const room = await getRoomById(roomId);\n if (!room) {\n results.push(`Failed: room not found.`);\n continue;\n }\n await clearRoom(roomId);\n results.push(`Done: cleared all messages in ${(room as any).name}.`);\n }\n return results.join(\"\\n\");\n }\n const actionMatch = lastMsg.match(\n /^(ban|mute|unban|unmute)\\s+([@\\w,\\s]+?)(?:\\s+(\\d+))?$/i,\n );\n if (actionMatch) {\n const cmd = actionMatch[1].toLowerCase();\n const duration = actionMatch[3] ? Number(actionMatch[3]) : null;\n const usernames = actionMatch[2].split(\",\").map((s: string) =>\n s.trim().replace(/^@/, \"\")\n ).filter(Boolean);\n const results: string[] = [];\n for (const targetUsername of usernames) {\n const target = await getUserByUsername(targetUsername);\n if (!target) {\n results.push(`Failed: @${targetUsername} not found.`);\n continue;\n }\n if (isAdmin({ username: target.username })) {\n results.push(`Failed: cannot moderate admin.`);\n continue;\n }\n if (cmd === \"ban\") {\n const expiresAt = duration\n ? new Date(Date.now() + duration * 3600000).toISOString()\n : null;\n await banUser(Number(target.id), expiresAt, null);\n results.push(\n duration\n ? `Done: banned @${targetUsername} for ${duration}h.`\n : `Done: permanently banned @${targetUsername}.`,\n );\n } else if (cmd === \"unban\") {\n await unbanUser(Number(target.id));\n results.push(`Done: unbanned @${targetUsername}.`);\n } else if (cmd === \"mute\") {\n const mins = duration ?? 30;\n await muteUser(\n Number(target.id),\n new Date(Date.now() + mins * 60000).toISOString(),\n );\n results.push(`Done: muted @${targetUsername} for ${mins}m.`);\n } else if (cmd === \"unmute\") {\n await unmuteUser(Number(target.id));\n results.push(`Done: unmuted @${targetUsername}.`);\n }\n }\n return results.join(\"\\n\");\n }\n return null;\n}\n\n// Shared SSE stream helper\nfunction makeSSEStream(text: string, corsHeaders: Record) {\n const enc = new TextEncoder();\n const readable = new ReadableStream({\n start(controller) {\n controller.enqueue(\n enc.encode(`data: ${JSON.stringify({ t: text })}\\n\\n`),\n );\n controller.enqueue(enc.encode(\"data: [DONE]\\n\\n\"));\n controller.close();\n },\n });\n return new Response(readable, {\n headers: {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n ...corsHeaders,\n },\n });\n}\n\n// ─── TRIAGE endpoint ──────────────────────────────────────────────────────────\napp.post(\"/api/ai/triage\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n\n const { context } = await buildAdminContext();\n\n const TRIAGE_PROMPT =\n `You are a moderation triage engine for Kikko. Scan for violations AND ban evasion. Be strict about what counts as a violation — casual language is never a problem.\n\nMESSAGES: Lines like \"@alice: what the hell\" mean alice typed that. Do NOT flag casual language.\n\nFLAG — VIOLATIONS:\n- CRITICAL: credible death threats at a specific real person, doxxing (address/phone/SSN), malware/phishing, CSAM, calls for real violence\n- VIOLATION: sustained targeted harassment across multiple messages, slurs weaponized against a specific person, coordinated spam/brigading\n\nIGNORE: swearing, profanity, insults, venting, dark humor, sarcasm, trash talk, isolated slurs not aimed at anyone.\n\nFLAG — BAN EVASION:\nCompare every username and email. Flag if a non-banned account looks like a banned account:\n- Very similar username (added numbers/letters/symbols, leetspeak: a↔4 e↔3 i↔1 o↔0, prefix/suffix, reversed)\n- Same or very similar email (same local part, or similar local part across free-mail domains)\n- Account created after a ban with a matching pattern\nFormat: --- BAN EVASION SUSPECT --- / @newuser may be @banneduser | reason / Action: ban @newuser\n\nRULES:\n1. Zero output for normal messages — only output if something is flagged.\n2. No emojis, no message IDs, no preamble, no summaries.\n3. Quotes max 8 words. Reason max 5 words.\n4. One Action line per flagged user.\n5. Skip [BANNED] users for violation flags (but check them for evasion alts).\n\nOUTPUT FORMAT:\n\n--- CRITICAL ---\n@username | \"exact quote\" | reason\nAction: ban @username\n\n--- VIOLATION ---\n@username | \"exact quote\" | reason\nAction: mute @username 60\n\n--- BAN EVASION SUSPECT ---\n@newuser may be @banneduser | reason\nAction: ban @newuser\n\nIf nothing to flag: All clear.\n\n=== DATA ===\n${context}\n=== END ===`;\n\n const resp = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${GROQ_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n model: GROQ_ADMIN_MODEL,\n messages: [{ role: \"system\", content: TRIAGE_PROMPT }, {\n role: \"user\",\n content: \"Run triage.\",\n }],\n max_tokens: 800,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"Triage AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const enc = new TextEncoder();\n const readable = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") {\n controller.enqueue(enc.encode(\"data: [DONE]\\n\\n\"));\n continue;\n }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) {\n controller.enqueue(\n enc.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`),\n );\n }\n } catch {}\n }\n }\n } catch (e) {\n console.error(\"Triage stream error:\", e);\n } finally {\n controller.close();\n }\n },\n });\n\n return new Response(readable, {\n headers: {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n \"Connection\": \"keep-alive\",\n ...CORS_HEADERS,\n },\n });\n});\n\n// ─── Admin execute ────────────────────────────────────────────────────────────\napp.post(\"/api/ai/execute\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n const { command } = await c.req.json();\n if (!command?.trim()) return c.json({ error: \"Command required\" }, 400);\n const result = await execAdminCommand(command.trim());\n if (result === null) return c.json({ error: \"Unrecognised command\" }, 400);\n return c.json({ ok: true, result });\n});\n\n// ─── Admin chat ───────────────────────────────────────────────────────────────\napp.post(\"/api/ai/admin-chat\", async (c) => {\n const user = await getSessionUser(c);\n if (!user || !isAdmin(user)) return c.json({ error: \"Forbidden\" }, 403);\n\n const { messages } = await c.req.json();\n if (!messages?.length) return c.json({ error: \"Messages required\" }, 400);\n\n const lastMsg: string = messages[messages.length - 1]?.content ?? \"\";\n\n // Direct command execution\n const directResult = await execAdminCommand(lastMsg);\n if (directResult !== null) return makeSSEStream(directResult, CORS_HEADERS);\n\n // \"yes\" / \"confirm\" → execute last suggested Action\n const confirmPhrases =\n /^(yes|confirm|do it|execute|apply|go ahead|yep|ok|okay)[\\s!.]*$/i;\n if (confirmPhrases.test(lastMsg.trim())) {\n for (let i = messages.length - 2; i >= 0; i--) {\n const msg = messages[i];\n if (msg.role !== \"assistant\") continue;\n const actionLines = [\n ...(msg.content?.matchAll(/Action:\\s*(.+)/gi) ?? []),\n ];\n if (actionLines.length > 0) {\n const results: string[] = [];\n for (const al of actionLines) {\n const cmds = al[1].split(\"|\").map((s: string) => s.trim());\n for (const cmd of cmds) {\n const r = await execAdminCommand(cmd);\n if (r) results.push(r);\n }\n }\n if (results.length > 0) {\n return makeSSEStream(results.join(\"\\n\"), CORS_HEADERS);\n }\n }\n }\n return makeSSEStream(\n \"No pending action found. Provide a specific command.\",\n CORS_HEADERS,\n );\n }\n\n const { context } = await buildAdminContext();\n\n const CHAT_PROMPT =\n `You are the Kikko Admin AI — a private assistant and moderation tool for @${ADMIN_USERNAME}, the admin of Kikko.\n\nYou have TWO modes. Read the admin's message and decide which applies.\n\n━━━ MODE 1: CONVERSATION & INVESTIGATION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nWhen the admin asks a question, requests info, or wants to discuss something — answer helpfully and directly. This includes: \"who is this user\", \"tell me about X\", \"what's happening in room Y\", \"how many users\", \"who joined recently\", \"look up X\", general chat, etc.\n\nYou have full access to ALL live data:\n- Every user's username, ID, email, ban/mute status, ghost mode\n- All room names, types, IDs\n- Recent messages in every room with author usernames\n\nUse this data to answer factually. You MAY share emails when admin asks. Never say \"All clear\" as a response to a question — that phrase is only for triage scans that find nothing.\n\n━━━ MODE 2: MODERATION FLAGS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nWhen asked to scan/triage, ONLY flag genuine serious issues:\n- CRITICAL: credible death threats at a specific real person, doxxing (address/phone/SSN), malware/phishing links, CSAM, calls for real-world violence\n- VIOLATION: sustained targeted harassment across multiple messages, slurs weaponized against a specific person, coordinated spam or brigading\n\nCompletely ignore: swearing, profanity, insults, venting, dark humor, sarcasm, trash talk, one-off slurs not aimed at anyone, criticizing the app.\n\n━━━ BAN EVASION DETECTION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nWhen scanning OR when admin asks to check for ban evasion, compare all usernames and emails across the user list. Flag potential evaders using:\n- Very similar usernames: same base + added/changed numbers, letters, symbols (alex → alex2, alex_, al3x, alexx, xalex)\n- Leetspeak: a↔4, e↔3, i↔1, o↔0, s↔5\n- Prefix/suffix additions, reversed names, inserted dots/underscores\n- Same or very similar email addresses (same local part, similar local part, or same base on different free-mail domains)\n- Accounts created shortly after a ban with a similar username or email\n\nFormat as:\n--- BAN EVASION SUSPECT ---\n@newuser may be @banneduser | reason (username similarity / email similarity / timing)\nAction: ban @newuser\n\n━━━ UNIVERSAL RULES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Never hallucinate. Only state what is in the live data. If something isn't in the data, say so.\n2. Never say \"All clear\" except after a moderation scan that genuinely found nothing to flag.\n3. No emojis.\n4. Skip @${ADMIN_USERNAME} in all checks.\n5. Skip [BANNED] users in violation flags but still check them for ban evasion (to catch their alt accounts).\n6. Format moderation flags as:\n --- CRITICAL ---\n @username | \"quote\" | reason\n Action: ban @username\n\n --- VIOLATION ---\n @username | \"quote\" | reason\n Action: mute @username 60\n\n7. Always include Action: lines when recommending action so admin can execute with \"yes\".\n8. Supported commands: ban @user [hours] | unban @user | mute @user [mins] | unmute @user | delete msg | clear room \n9. Be direct and concise. Don't pad. Don't repeat yourself. Max 400 words unless more is clearly needed.\n\n=== LIVE DATA ===\n${context}\n=== END ===`;\n\n const resp = await fetch(\"https://api.groq.com/openai/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${GROQ_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n model: GROQ_ADMIN_MODEL,\n messages: [{ role: \"system\", content: CHAT_PROMPT }, ...messages],\n max_tokens: 900,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"Admin AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const enc2 = new TextEncoder();\n const readable2 = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") {\n controller.enqueue(enc2.encode(\"data: [DONE]\\n\\n\"));\n continue;\n }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) {\n controller.enqueue(\n enc2.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`),\n );\n }\n } catch {}\n }\n }\n } catch (e) {\n console.error(\"Admin AI stream error:\", e);\n } finally {\n controller.close();\n }\n },\n });\n\n return new Response(readable2, {\n headers: {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n \"Connection\": \"keep-alive\",\n ...CORS_HEADERS,\n },\n });\n});\n\n// ─── AI Chat (Mistral / Codestral) ───────────────────────────────────────────\napp.post(\"/api/ai/chat\", async (c) => {\n const user = await getSessionUser(c);\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n const { messages, model } = await c.req.json();\n if (!messages?.length) return c.json({ error: \"Messages required\" }, 400);\n\n const isCodestral = model === \"codestral-latest\";\n const apiKey = isCodestral ? CODESTRAL_API_KEY : MISTRAL_API_KEY;\n const apiUrl = isCodestral\n ? \"https://codestral.mistral.ai/v1/chat/completions\"\n : \"https://api.mistral.ai/v1/chat/completions\";\n const selectedModel = isCodestral\n ? \"codestral-latest\"\n : \"mistral-large-latest\";\n const systemPrompt = isCodestral\n ? `You are Codestral, an expert AI coding assistant built into Kikko. You specialize in debugging, code generation, code review, refactoring, and all technical questions across any programming language or framework. Be precise, thorough, and always include working code examples. Help with any coding or technical task the user brings you.`\n : `You are Mist, a smart and friendly AI assistant built into Kikko — a real-time chat app. You are a capable general-purpose AI: you can help with writing, analysis, research, brainstorming, math, summaries, planning, creative tasks, answering questions, and much more. Be concise and direct by default, but go into detail when the user needs it. If you don't know something, say so honestly.`;\n\n const resp = await fetch(apiUrl, {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n model: selectedModel,\n messages: [{ role: \"system\", content: systemPrompt }, ...messages],\n max_tokens: 1024,\n stream: true,\n }),\n });\n\n if (!resp.ok) {\n const err = await resp.text();\n console.error(\"AI error:\", err);\n return c.json({ error: \"AI service error\" }, 502);\n }\n\n const encoder = new TextEncoder();\n const readable = new ReadableStream({\n async start(controller) {\n const reader = resp.body!.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() || \"\";\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || !trimmed.startsWith(\"data: \")) continue;\n const payload = trimmed.slice(6);\n if (payload === \"[DONE]\") {\n controller.enqueue(encoder.encode(\"data: [DONE]\\n\\n\"));\n continue;\n }\n try {\n const json = JSON.parse(payload);\n const delta = json.choices?.[0]?.delta?.content;\n if (delta) {\n controller.enqueue(\n encoder.encode(`data: ${JSON.stringify({ t: delta })}\\n\\n`),\n );\n }\n } catch {}\n }\n }\n } catch (e) {\n console.error(\"Stream error:\", e);\n } finally {\n controller.close();\n }\n },\n });\n\n return new Response(readable, {\n headers: {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n \"Connection\": \"keep-alive\",\n ...CORS_HEADERS,\n },\n });\n});\n\nexport default app.fetch;","children",[],[223],"040c7152-36e9-11f1-ac49-42b51c65c3df","cron-cleanup.ts","019d84e3-5738-70fa-8b1d-a9d8c81ce16a",["D",1776050984651],"interval","// Huddle — blob cleanup (runs every 6 hours, removes chat file blobs older than 12h)\n// Profile avatars are NEVER deleted — they persist indefinitely\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport default async function (_interval: Interval) {\n const cutoff = new Date(Date.now() - 22 * 3600 * 1000).toISOString();\n\n // Remove file blobs from messages older than 12h (chat uploads only, NOT avatars)\n const expiredMsgs = await sqlite.execute({\n sql:\n `SELECT blob_key FROM messages WHERE blob_key IS NOT NULL AND created_at < ?`,\n args: [cutoff],\n });\n let deleted = 0;\n for (const row of expiredMsgs.rows) {\n if (row.blob_key) {\n try {\n await blob.delete(row.blob_key as string);\n deleted++;\n } catch {}\n }\n }\n\n console.log(\n `Blob cleanup: removed ${deleted} expired chat file blobs (avatars are permanent)`,\n );\n}",[],[232],"040c5e9c-36e9-11f1-ac49-42b51c65c3df","types.ts","019d84e3-5738-70fa-8b1d-a258aef95e9b","019d84e3-5738-70fa-8b1d-a6a95d2913e7",["D",1776050984651],"script","export const ADMIN_USERNAME = \"mjk\";\nexport const ADMIN_PASSWORD = \"110908\";\nexport const MAX_FILE_SIZE = 200 * 1024; // 200 KB\nexport const MAX_AVATAR_SIZE = 100 * 1024; // 100 KB\nexport const MENTION_EMAIL_INTERVAL_HOURS = 6;\nexport const APP_NAME = \"Kikko\";\nexport const MISTRAL_API_KEY = \"NMJb1HJcdzM7GnzYxvXp3VDVC8L0PcFB\";\nexport const CODESTRAL_API_KEY = \"fMTrjftODu0xedkR1deQh0YyEJZPBLnJ\";\nexport const GROQ_API_KEY = \"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\";\nexport const GROQ_ADMIN_MODEL = \"meta-llama/llama-4-scout-17b-16e-instruct\";\nexport const RESEND_API_KEY = \"re_81SGe9Uh_MqSo2yX182iPDJkS3xVzeXZU\";\n",[],[248,240],"shared","040c4876-36e9-11f1-ac49-42b51c65c3df","email.ts","019d84e3-5738-70fa-8b1d-9c60bbd73ca7",["D",1776050984651],"import { RESEND_API_KEY, APP_NAME } from \"./types.ts\";\n\nconst FROM_EMAIL = `${APP_NAME} `;\n\nexport async function sendEmail(to: string, subject: string, html: string): Promise {\n if (!RESEND_API_KEY) {\n console.warn(\"RESEND_API_KEY not set, skipping email to\", to);\n return false;\n }\n try {\n const res = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${RESEND_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ from: FROM_EMAIL, to, subject, html }),\n });\n if (!res.ok) {\n const err = await res.text();\n console.error(\"Resend error:\", err);\n return false;\n }\n return true;\n } catch (e) {\n console.error(\"Email send failed:\", e);\n return false;\n }\n}\n\nexport function mentionEmailHtml(mentions: Array<{ sender_username: string; room_name: string }>): string {\n const items = mentions\n .map((m) => `

${m.sender_username} mentioned you in ${m.room_name}

`)\n .join(\"\");\n return `\n

Kikko — You were mentioned

You have new mentions in Kikko:

${items}\n

`;\n}\n\nexport function recoveryEmailHtml(password: string): string {\n return `\n

Kikko — Password Recovery

Your Kikko account password is:

${password}

If you did not request this, please change your password immediately after logging in.

`;\n}\n",[],[248,250],"040c41be-36e9-11f1-ac49-42b51c65c3df","auth.ts","019d84e3-5738-70fa-8b1d-98bbef51872d",["D",1776050984651],"import bcrypt from \"npm:bcryptjs\";\n\nexport async function hashPassword(password: string): Promise {\n return bcrypt.hash(password, 10);\n}\n\nexport async function verifyPassword(password: string, hash: string): Promise {\n return bcrypt.compare(password, hash);\n}\n\nexport function generateToken(length = 32): string {\n const arr = new Uint8Array(length);\n crypto.getRandomValues(arr);\n return Array.from(arr).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n",[],[248,257],"040c690a-36e9-11f1-ac49-42b51c65c3df",["D",1776050984651],[217,218,219],[248],["D",1776050984651],[],[18,75],["D",1776050984651],[],[18,86],["D",1776050984651],[],[18,91],["D",1776050984651],[213,214,215],[18],"0407fe56-36e9-11f1-ac49-42b51c65c3df","queries.ts","019d84e3-5738-70fa-8b1d-83d7ae1744f5","019d84e3-5738-70fa-8b1d-86aa98532473",["D",1776050984651],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ---- Users ----\nexport async function createUser(username: string, email: string, passwordHash: string, passwordPlain: string) {\n const result = await sqlite.execute({\n sql: `INSERT INTO users (username, email, password_hash, password_plain) VALUES (?, ?, ?, ?)`,\n args: [username, email, passwordHash, passwordPlain],\n });\n return result.lastInsertRowid;\n}\n\nexport async function getUserByUsername(username: string) {\n const r = await sqlite.execute({\n sql: `SELECT * FROM users WHERE username = ? COLLATE NOCASE`,\n args: [username],\n });\n return r.rows[0] ?? null;\n}\n\nexport async function getUserByEmail(email: string) {\n const r = await sqlite.execute({\n sql: `SELECT * FROM users WHERE email = ? COLLATE NOCASE`,\n args: [email],\n });\n return r.rows[0] ?? null;\n}\n\nexport async function getUserById(id: number) {\n const r = await sqlite.execute({ sql: `SELECT * FROM users WHERE id = ?`, args: [id] });\n return r.rows[0] ?? null;\n}\n\nexport async function updateUserAvatar(userId: number, blobKey: string) {\n await sqlite.execute({ sql: `UPDATE users SET avatar_blob_key = ? WHERE id = ?`, args: [blobKey, userId] });\n}\n\nexport async function setGhostMode(userId: number, ghost: boolean) {\n await sqlite.execute({ sql: `UPDATE users SET ghost_mode = ? WHERE id = ?`, args: [ghost ? 1 : 0, userId] });\n}\n\nexport async function banUser(userId: number, expiresAt: string | null, message: string | null) {\n await sqlite.execute({\n sql: `UPDATE users SET is_banned = 1, ban_expires_at = ?, ban_message = ? WHERE id = ?`,\n args: [expiresAt, message, userId],\n });\n}\n\nexport async function unbanUser(userId: number) {\n await sqlite.execute({ sql: `UPDATE users SET is_banned = 0, ban_expires_at = NULL, ban_message = NULL WHERE id = ?`, args: [userId] });\n}\n\nexport async function muteUser(userId: number, expiresAt: string) {\n await sqlite.execute({\n sql: `UPDATE users SET is_muted = 1, mute_expires_at = ? WHERE id = ?`,\n args: [expiresAt, userId],\n });\n}\n\nexport async function unmuteUser(userId: number) {\n await sqlite.execute({ sql: `UPDATE users SET is_muted = 0, mute_expires_at = NULL WHERE id = ?`, args: [userId] });\n}\n\nexport async function getPublicUsers() {\n const r = await sqlite.execute(`SELECT id, username, avatar_blob_key, ghost_mode FROM users WHERE ghost_mode = 0 ORDER BY username ASC`);\n return r.rows;\n}\n\nexport async function getAllUsers() {\n const r = await sqlite.execute(`SELECT id, username, email, ghost_mode, is_banned, ban_expires_at, ban_message, is_muted, mute_expires_at, avatar_blob_key, created_at FROM users ORDER BY username ASC`);\n return r.rows;\n}\n\n// ---- Sessions ----\nexport async function createSession(sessionId: string, userId: number) {\n await sqlite.execute({ sql: `INSERT INTO sessions (id, user_id) VALUES (?, ?)`, args: [sessionId, userId] });\n}\n\nexport async function getSession(sessionId: string) {\n const r = await sqlite.execute({ sql: `SELECT * FROM sessions WHERE id = ?`, args: [sessionId] });\n return r.rows[0] ?? null;\n}\n\nexport async function deleteSession(sessionId: string) {\n await sqlite.execute({ sql: `DELETE FROM sessions WHERE id = ?`, args: [sessionId] });\n}\n\n// ---- API Tokens (for cross-origin bookmarklet) ----\nexport async function createApiToken(token: string, userId: number) {\n await sqlite.execute({ sql: `INSERT OR REPLACE INTO api_tokens (token, user_id) VALUES (?, ?)`, args: [token, userId] });\n}\n\nexport async function getApiToken(token: string) {\n const r = await sqlite.execute({ sql: `SELECT * FROM api_tokens WHERE token = ?`, args: [token] });\n return r.rows[0] ?? null;\n}\n\nexport async function deleteApiToken(token: string) {\n await sqlite.execute({ sql: `DELETE FROM api_tokens WHERE token = ?`, args: [token] });\n}\n\n// ---- Rooms ----\nexport async function createRoom(name: string, createdBy: number) {\n const r = await sqlite.execute({\n sql: `INSERT INTO rooms (name, type, created_by) VALUES (?, 'group', ?)`,\n args: [name, createdBy],\n });\n const roomId = Number(r.lastInsertRowid);\n await sqlite.execute({ sql: `INSERT INTO room_members (room_id, user_id, role) VALUES (?, ?, 'owner')`, args: [roomId, createdBy] });\n return roomId;\n}\n\nexport async function getRoomById(roomId: number) {\n const r = await sqlite.execute({ sql: `SELECT * FROM rooms WHERE id = ?`, args: [roomId] });\n return r.rows[0] ?? null;\n}\n\nexport async function deleteRoom(roomId: number) {\n await sqlite.execute({ sql: `DELETE FROM room_members WHERE room_id = ?`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM room_invites WHERE room_id = ?`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM reactions WHERE message_id IN (SELECT id FROM messages WHERE room_id = ?)`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM messages WHERE room_id = ?`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM typing WHERE room_id = ?`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM rooms WHERE id = ?`, args: [roomId] });\n}\n\nexport async function getRoomsForUser(userId: number) {\n const r = await sqlite.execute({\n sql: `SELECT r.* FROM rooms r\n LEFT JOIN room_members rm ON r.id = rm.room_id AND rm.user_id = ?\n WHERE r.type = 'world' OR rm.user_id = ?\n ORDER BY r.id ASC`,\n args: [userId, userId],\n });\n return r.rows;\n}\n\nexport async function getAllRooms() {\n const r = await sqlite.execute(`SELECT * FROM rooms ORDER BY id ASC`);\n return r.rows;\n}\n\nexport async function getRoomMembers(roomId: number) {\n const r = await sqlite.execute({\n sql: `SELECT u.id, u.username, u.avatar_blob_key, rm.role FROM users u\n JOIN room_members rm ON u.id = rm.user_id WHERE rm.room_id = ?\n ORDER BY rm.role DESC, u.username ASC`,\n args: [roomId],\n });\n return r.rows;\n}\n\nexport async function addRoomMember(roomId: number, userId: number, role = \"member\") {\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO room_members (room_id, user_id, role) VALUES (?, ?, ?)`,\n args: [roomId, userId, role],\n });\n}\n\nexport async function removeRoomMember(roomId: number, userId: number) {\n await sqlite.execute({ sql: `DELETE FROM room_members WHERE room_id = ? AND user_id = ?`, args: [roomId, userId] });\n}\n\nexport async function isRoomMember(roomId: number, userId: number): Promise {\n const r = await sqlite.execute({\n sql: `SELECT 1 FROM room_members WHERE room_id = ? AND user_id = ?`,\n args: [roomId, userId],\n });\n return r.rows.length > 0;\n}\n\nexport async function inviteToRoom(roomId: number, invitedUserId: number, invitedBy: number) {\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO room_invites (room_id, invited_user_id, invited_by) VALUES (?, ?, ?)`,\n args: [roomId, invitedUserId, invitedBy],\n });\n await addRoomMember(roomId, invitedUserId);\n}\n\n// ---- Messages ----\nexport async function createMessage(\n roomId: number,\n userId: number,\n content: string | null,\n blobKey?: string,\n blobName?: string,\n blobSize?: number,\n replyToId?: number,\n) {\n const r = await sqlite.execute({\n sql: `INSERT INTO messages (room_id, user_id, content, blob_key, blob_name, blob_size, reply_to_id) VALUES (?, ?, ?, ?, ?, ?, ?)`,\n args: [roomId, userId, content, blobKey ?? null, blobName ?? null, blobSize ?? null, replyToId ?? null],\n });\n // Prune to 300 messages per room (keeps newest, deletes oldest)\n await sqlite.execute({\n sql: `DELETE FROM messages WHERE room_id = ? AND id NOT IN (SELECT id FROM messages WHERE room_id = ? ORDER BY id DESC LIMIT 300)`,\n args: [roomId, roomId],\n });\n return r.lastInsertRowid;\n}\n\nexport async function editMessage(messageId: number, userId: number, content: string) {\n // Save original_content on first edit only (if not already saved)\n await sqlite.execute({\n sql: `UPDATE messages SET\n original_content = CASE WHEN original_content IS NULL THEN messages.content ELSE original_content END,\n content = ?,\n edited_at = datetime('now')\n WHERE id = ? AND user_id = ?`,\n args: [content, messageId, userId],\n });\n}\n\nexport async function getMessageById(messageId: number) {\n const r = await sqlite.execute({\n sql: `SELECT m.*,\n CASE WHEN m.is_deleted = 1 THEN m.deleted_username ELSE u.username END AS username,\n CASE WHEN m.is_deleted = 1 THEN NULL ELSE u.avatar_blob_key END AS avatar_blob_key\n FROM messages m\n LEFT JOIN users u ON m.user_id = u.id\n WHERE m.id = ?`,\n args: [messageId],\n });\n return r.rows[0] ?? null;\n}\n\nexport async function getMessages(roomId: number, since?: number) {\n if (since) {\n const r = await sqlite.execute({\n sql: `SELECT m.*,\n CASE WHEN m.is_deleted = 1 THEN m.deleted_username ELSE u.username END AS username,\n CASE WHEN m.is_deleted = 1 THEN NULL ELSE u.avatar_blob_key END AS avatar_blob_key\n FROM messages m\n LEFT JOIN users u ON m.user_id = u.id\n WHERE m.room_id = ? AND m.id > ? ORDER BY m.id ASC`,\n args: [roomId, since],\n });\n return r.rows;\n }\n const r = await sqlite.execute({\n sql: `SELECT m.*,\n CASE WHEN m.is_deleted = 1 THEN m.deleted_username ELSE u.username END AS username,\n CASE WHEN m.is_deleted = 1 THEN NULL ELSE u.avatar_blob_key END AS avatar_blob_key\n FROM messages m\n LEFT JOIN users u ON m.user_id = u.id\n WHERE m.room_id = ? ORDER BY m.id ASC LIMIT 300`,\n args: [roomId],\n });\n return r.rows;\n}\n\nexport async function searchMessages(roomId: number, query: string) {\n const r = await sqlite.execute({\n sql: `SELECT m.*,\n CASE WHEN m.is_deleted = 1 THEN m.deleted_username ELSE u.username END AS username,\n CASE WHEN m.is_deleted = 1 THEN NULL ELSE u.avatar_blob_key END AS avatar_blob_key\n FROM messages m\n LEFT JOIN users u ON m.user_id = u.id\n WHERE m.room_id = ? AND m.content LIKE ? AND m.is_deleted = 0\n ORDER BY m.id DESC LIMIT 50`,\n args: [roomId, `%${query}%`],\n });\n return r.rows;\n}\n\n// Clear all messages in a room (admin only)\nexport async function clearRoom(roomId: number) {\n await sqlite.execute({\n sql: `DELETE FROM messages WHERE room_id = ?`,\n args: [roomId],\n });\n // Also wipe reactions for those messages (already gone, but clean up reactions table)\n await sqlite.execute({\n sql: `DELETE FROM reactions WHERE message_id NOT IN (SELECT id FROM messages)`,\n args: [],\n });\n}\n\n// Soft-delete a single message (admin moderation or owner)\nexport async function deleteMessage(messageId: number) {\n // Snapshot the username before soft-deleting (in case user still exists)\n const r = await sqlite.execute({\n sql: `SELECT m.*, u.username AS live_username FROM messages m LEFT JOIN users u ON m.user_id = u.id WHERE m.id = ?`,\n args: [messageId],\n });\n const msg = r.rows[0] as any;\n if (!msg) return;\n const username = msg.deleted_username ?? msg.live_username ?? \"unknown\";\n await sqlite.execute({\n sql: `UPDATE messages SET is_deleted = 1, deleted_username = ? WHERE id = ?`,\n args: [username, messageId],\n });\n}\n\n// ---- Reactions ----\nexport async function addReaction(messageId: number, userId: number, emoji: string) {\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO reactions (message_id, user_id, emoji) VALUES (?, ?, ?)`,\n args: [messageId, userId, emoji],\n });\n}\n\nexport async function removeReaction(messageId: number, userId: number, emoji: string) {\n await sqlite.execute({\n sql: `DELETE FROM reactions WHERE message_id = ? AND user_id = ? AND emoji = ?`,\n args: [messageId, userId, emoji],\n });\n}\n\nexport async function getReactionsForRoom(roomId: number) {\n const r = await sqlite.execute({\n sql: `SELECT r.message_id, r.user_id, r.emoji, u.username FROM reactions r JOIN users u ON r.user_id = u.id WHERE r.message_id IN (SELECT id FROM messages WHERE room_id = ?)`,\n args: [roomId],\n });\n return r.rows;\n}\n\n// ---- Typing indicators ----\nexport async function setTyping(roomId: number, userId: number, username: string) {\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO typing (room_id, user_id, username, updated_at) VALUES (?, ?, ?, datetime('now'))`,\n args: [roomId, userId, username],\n });\n}\n\nexport async function clearTyping(roomId: number, userId: number) {\n await sqlite.execute({\n sql: `DELETE FROM typing WHERE room_id = ? AND user_id = ?`,\n args: [roomId, userId],\n });\n}\n\nexport async function getTyping(roomId: number) {\n // Only return users who typed in last 4 seconds\n const r = await sqlite.execute({\n sql: `SELECT username FROM typing WHERE room_id = ? AND updated_at >= datetime('now', '-4 seconds')`,\n args: [roomId],\n });\n return r.rows.map((row: any) => row.username as string);\n}\n\n// ---- Block ----\nexport async function blockUser(userId: number, blockedUserId: number) {\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO blocked_users (user_id, blocked_user_id) VALUES (?, ?)`,\n args: [userId, blockedUserId],\n });\n}\n\nexport async function unblockUser(userId: number, blockedUserId: number) {\n await sqlite.execute({\n sql: `DELETE FROM blocked_users WHERE user_id = ? AND blocked_user_id = ?`,\n args: [userId, blockedUserId],\n });\n}\n\nexport async function getBlockedUsers(userId: number) {\n const r = await sqlite.execute({ sql: `SELECT blocked_user_id FROM blocked_users WHERE user_id = ?`, args: [userId] });\n return r.rows.map((row) => Number(row.blocked_user_id));\n}\n\n// ---- Mentions ----\nexport async function queueMention(mentionedUserId: number, senderUsername: string, roomName: string) {\n await sqlite.execute({\n sql: `INSERT INTO mention_queue (mentioned_user_id, sender_username, room_name) VALUES (?, ?, ?)`,\n args: [mentionedUserId, senderUsername, roomName],\n });\n}\n\nexport async function getUnsentMentions() {\n const r = await sqlite.execute(`SELECT mq.*, u.email, u.username as mentioned_username FROM mention_queue mq JOIN users u ON mq.mentioned_user_id = u.id WHERE mq.sent = 0`);\n return r.rows;\n}\n\nexport async function markMentionsSent(ids: number[]) {\n if (ids.length === 0) return;\n const placeholders = ids.map(() => \"?\").join(\",\");\n await sqlite.execute({ sql: `UPDATE mention_queue SET sent = 1 WHERE id IN (${placeholders})`, args: ids });\n}\n\n// ---- ntfy push notifications ----\nexport async function setNtfyTopic(userId: number, topic: string) {\n await sqlite.execute({ sql: `UPDATE users SET ntfy_topic = ? WHERE id = ?`, args: [topic, userId] });\n}\n\nexport async function clearNtfyTopic(userId: number) {\n await sqlite.execute({ sql: `UPDATE users SET ntfy_topic = NULL WHERE id = ?`, args: [userId] });\n}\n\nexport async function getNtfyTopic(userId: number): Promise {\n const r = await sqlite.execute({ sql: `SELECT ntfy_topic FROM users WHERE id = ?`, args: [userId] });\n return (r.rows[0]?.ntfy_topic as string | null) ?? null;\n}\n\nexport async function updateUserPassword(userId: number, passwordHash: string, passwordPlain: string) {\n await sqlite.execute({ sql: `UPDATE users SET password_hash = ?, password_plain = ? WHERE id = ?`, args: [passwordHash, passwordPlain, userId] });\n}\n\nexport async function deleteUser(userId: number) {\n // Remove all user data in order (FK-safe)\n await sqlite.execute({ sql: `DELETE FROM reactions WHERE user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM blocked_users WHERE user_id = ? OR blocked_user_id = ?`, args: [userId, userId] });\n await sqlite.execute({ sql: `DELETE FROM room_members WHERE user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM room_invites WHERE invited_user_id = ? OR invited_by = ?`, args: [userId, userId] });\n await sqlite.execute({ sql: `DELETE FROM typing WHERE user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM mention_queue WHERE mentioned_user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM sessions WHERE user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM api_tokens WHERE user_id = ?`, args: [userId] });\n // Clear ntfy topic so no stale push URL remains\n await sqlite.execute({ sql: `UPDATE users SET ntfy_topic = NULL WHERE id = ?`, args: [userId] });\n // Soft-delete messages: snapshot the username, mark is_deleted=1, then NULL out\n // user_id so the FK constraint doesn't block deleting the user row.\n const userRecord = await getUserById(userId);\n const oldUsername = userRecord ? String(userRecord.username) : \"deleted\";\n await sqlite.execute({\n sql: `UPDATE messages SET is_deleted = 1, deleted_username = ?, user_id = NULL WHERE user_id = ?`,\n args: [oldUsername, userId],\n });\n // Also NULL out reactions FK before deleting (reactions were already hard-deleted above,\n // but reply_to messages may still reference this user indirectly — nulling user_id covers it)\n await sqlite.execute({ sql: `DELETE FROM users WHERE id = ?`, args: [userId] });\n}\n",[],[287,280],"database","0407ccd8-36e9-11f1-ac49-42b51c65c3df","migrations.ts","019d84e3-5738-70fa-8b1d-7ffff4eb1571",["D",1776050984651],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function runMigrations() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL UNIQUE COLLATE NOCASE,\n email TEXT NOT NULL UNIQUE COLLATE NOCASE,\n password_hash TEXT NOT NULL,\n password_plain TEXT,\n avatar_blob_key TEXT,\n ghost_mode INTEGER DEFAULT 0,\n is_banned INTEGER DEFAULT 0,\n ban_expires_at TEXT,\n ban_message TEXT,\n is_muted INTEGER DEFAULT 0,\n mute_expires_at TEXT,\n created_at TEXT DEFAULT (datetime('now'))\n )\n `);\n\n // Add columns that may not exist yet (safe migrations)\n try { await sqlite.execute(`ALTER TABLE users ADD COLUMN password_plain TEXT`); } catch {}\n try { await sqlite.execute(`ALTER TABLE users ADD COLUMN ban_message TEXT`); } catch {}\n try { await sqlite.execute(`ALTER TABLE users ADD COLUMN ntfy_topic TEXT`); } catch {}\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS sessions (\n id TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS api_tokens (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS rooms (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n type TEXT NOT NULL DEFAULT 'group',\n created_by INTEGER,\n created_at TEXT DEFAULT (datetime('now'))\n )\n `);\n\n await sqlite.execute(`\n INSERT OR IGNORE INTO rooms (id, name, type) VALUES (1, 'World Chat', 'world')\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS room_members (\n room_id INTEGER NOT NULL,\n user_id INTEGER NOT NULL,\n role TEXT DEFAULT 'member',\n joined_at TEXT DEFAULT (datetime('now')),\n PRIMARY KEY (room_id, user_id),\n FOREIGN KEY (room_id) REFERENCES rooms(id),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS room_invites (\n room_id INTEGER NOT NULL,\n invited_user_id INTEGER NOT NULL,\n invited_by INTEGER NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n PRIMARY KEY (room_id, invited_user_id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS messages (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n room_id INTEGER NOT NULL,\n user_id INTEGER NOT NULL,\n content TEXT,\n blob_key TEXT,\n blob_name TEXT,\n blob_size INTEGER,\n reply_to_id INTEGER,\n edited_at TEXT,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (room_id) REFERENCES rooms(id),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n // Safe: add new message columns if they don't exist\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN reply_to_id INTEGER`); } catch {}\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN edited_at TEXT`); } catch {}\n // Soft-delete support: when a user is deleted their messages stay but show as [deleted]\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN is_deleted INTEGER DEFAULT 0`); } catch {}\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN deleted_username TEXT`); } catch {}\n // Store original content before first edit\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN original_content TEXT`); } catch {}\n\n // Allow user_id to be NULL on messages so we can soft-delete messages when a user is deleted\n // without violating the FK constraint. SQLite can't ALTER COLUMN, so we recreate the table.\n // We only do this if the column is still NOT NULL (check by trying to set a NULL — if it throws, migrate).\n try {\n // Check if user_id already allows NULL by looking at table info\n const info = await sqlite.execute(`PRAGMA table_info(messages)`);\n const userIdCol = (info.rows as any[]).find((r: any) => r.name === \"user_id\");\n if (userIdCol && userIdCol.notnull === 1) {\n // Need to recreate the table without the NOT NULL constraint and without the FK on user_id\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS messages_new (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n room_id INTEGER NOT NULL,\n user_id INTEGER,\n content TEXT,\n blob_key TEXT,\n blob_name TEXT,\n blob_size INTEGER,\n reply_to_id INTEGER,\n edited_at TEXT,\n is_deleted INTEGER DEFAULT 0,\n deleted_username TEXT,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (room_id) REFERENCES rooms(id)\n )\n `);\n await sqlite.execute(`INSERT INTO messages_new SELECT id, room_id, user_id, content, blob_key, blob_name, blob_size, reply_to_id, edited_at, is_deleted, deleted_username, created_at FROM messages`);\n await sqlite.execute(`DROP TABLE messages`);\n await sqlite.execute(`ALTER TABLE messages_new RENAME TO messages`);\n }\n } catch (e) {\n console.error(\"Migration: messages nullable user_id failed:\", e);\n }\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS blocked_users (\n user_id INTEGER NOT NULL,\n blocked_user_id INTEGER NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n PRIMARY KEY (user_id, blocked_user_id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS mention_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n mentioned_user_id INTEGER NOT NULL,\n sender_username TEXT NOT NULL,\n room_name TEXT NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n sent INTEGER DEFAULT 0\n )\n `);\n\n // Reactions: one row per user+message+emoji\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS reactions (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n message_id INTEGER NOT NULL,\n user_id INTEGER NOT NULL,\n emoji TEXT NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n UNIQUE(message_id, user_id, emoji),\n FOREIGN KEY (message_id) REFERENCES messages(id),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n // Typing indicators: ephemeral, TTL-based\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS typing (\n room_id INTEGER NOT NULL,\n user_id INTEGER NOT NULL,\n username TEXT NOT NULL,\n updated_at TEXT DEFAULT (datetime('now')),\n PRIMARY KEY (room_id, user_id)\n )\n `);\n}\n",[],[287,289],"04084906-36e9-11f1-ac49-42b51c65c3df",["D",1776050984651],[210,211],[287],["D",1776050984651],["D",1789464074488],{"_11":12,"_145":80},{"_11":12,"_141":-5,"_79":80,"_31":78,"_142":143,"_144":30},{"_39":40,"_13":16,"_33":36,"_131":95,"_132":70,"_133":71,"_134":99,"_135":136,"_137":138,"_139":14,"_140":12},"ctx",{"_52":-5,"_166":337,"_338":339,"_340":341,"_342":30,"_343":30,"_344":30,"_345":24,"_346":-5,"_347":-7,"_348":-7,"_349":26,"_350":30,"_351":30,"_352":-5,"_353":30,"_354":30,"_355":30,"_356":-5},"ENV",{"_308":309,"_310":311,"_312":16,"_313":314,"_315":316,"_317":318,"_319":320,"_321":322,"_323":324,"_325":326,"_327":328,"_329":330,"_331":332,"_333":334,"_335":336},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · frontend