\n\n\n\n\n",[118,130],"bc4d5cbb07ea54e254726eac1dd8a406b20f554937e81858ef7ca7bd36fe94d8","40971840-306b-11f1-9845-42dde27851f2","019d5a53-f7c7-761b-bd13-7ca550fc709b",["D",1775337262833],"\n\n\n \n \n Huddle\n \n \n\n\n

\n\n\n\n\n",[118,130],"df7ef472a49f7ca69f4e72222df60a70063ddd6e7c9c01d54c169561d12de735",["D",1775338544104],"legacyEnvVars","httpPrivacy","description","Huddle - real time messaging app","imageUrl","userId","019d5a69-b939-7028-8be1-a73263d842ba","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019d5a69-b939-7028-8be1-a870afc57084","tursoName","3c4dad32306e11f1b16042dde27851f2","tursoHostname","3c4dad32306e11f1b16042dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789451469231],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_184":180},"org",{"_11":12,"_178":-5,"_179":180,"_149":150,"_181":182,"_183":50},"branch","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNCdVVId3l0eTc4MnVGdnRjcGFVSmFGUjZUMiJ9","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_32":60,"_13":14,"_34":335,"_48":-5,"_144":50,"_51":52,"_145":52,"_146":147,"_148":-5,"_149":150,"_151":-5,"_152":50,"_153":-5,"_154":-5,"_155":22,"_55":156,"_157":158,"_159":160,"_161":336,"_163":-5,"_164":165,"_166":165,"_167":168,"_169":168,"_170":168,"_171":165,"_172":165,"_173":337,"_175":338,"_177":339,"_49":50},"tree",[257,260,264,268,269,270],"files",[257,258,259,260,261,262,263,264,265,266,267,268,269,270],"counts",{"_247":22,"_248":113,"_249":85,"_250":251,"_252":253},"contents",[212,213,214,215,216,217],"upstreamProject",{"_32":39,"_13":14,"_146":147,"_148":-5,"_51":52,"_173":210},"upstreamBranch",{"_32":33,"_34":208,"_36":209,"_13":16,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":-5,"_49":50,"_51":52,"_53":54,"_55":56,"_57":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1775336945513],["D",1775337262833],{"_11":54,"_184":211},"https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNCdVJNTzJrUnFwejB5Y0NlWDhjclIxOE1YTCJ9",{"_32":242,"_13":243,"_80":244,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":245,"_40":22,"_89":237,"_91":-5,"_66":50,"_93":-5,"_73":246},{"_32":239,"_13":118,"_80":111,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":240,"_40":22,"_89":237,"_91":-5,"_66":50,"_93":-5,"_73":241},{"_32":233,"_13":234,"_80":235,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":236,"_40":22,"_89":237,"_91":-5,"_66":50,"_93":-5,"_73":238},{"_32":227,"_13":228,"_80":229,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":230,"_40":22,"_89":224,"_91":231,"_66":50,"_93":-5,"_73":232},{"_32":220,"_13":221,"_80":222,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":223,"_40":22,"_89":224,"_91":225,"_66":50,"_93":-5,"_73":226},{"_32":79,"_13":74,"_80":81,"_82":-5,"_83":59,"_84":85,"_86":26,"_34":218,"_40":88,"_89":90,"_91":92,"_66":50,"_93":-5,"_73":219},["D",1775338571566],[74],"3c5ca9cc-306e-11f1-b160-42dde27851f2","cron-mentions.ts","019d5a6c-5c4d-7339-9acd-785590cad62e",["D",1775338544104],"interval","// Huddle — @mention email digest (runs every 6 hours)\nimport { getUnsentMentions, markMentionsSent } from \"./database/queries.ts\";\nimport { sendEmail, mentionEmailHtml } from \"./shared/email.ts\";\n\nexport default async function (_interval: Interval) {\n const mentions = await getUnsentMentions();\n if (!mentions.length) return;\n\n // Group by mentioned user\n const byUser = new Map }>();\n for (const m of mentions) {\n const uid = Number(m.mentioned_user_id);\n if (!byUser.has(uid)) {\n byUser.set(uid, { email: m.email as string, username: m.mentioned_username as string, mentions: [] });\n }\n byUser.get(uid)!.mentions.push({ sender_username: m.sender_username as string, room_name: m.room_name as string });\n }\n\n const sentIds: number[] = [];\n for (const [, data] of byUser) {\n const subject = `Huddle – You were mentioned ${data.mentions.length > 1 ? data.mentions.length + \" times\" : \"\"}`.trim();\n const html = mentionEmailHtml(data.mentions);\n const ok = await sendEmail(data.email, subject, html);\n if (ok) {\n const ids = mentions.filter((m) => m.email === data.email).map((m) => Number(m.id));\n sentIds.push(...ids);\n }\n }\n\n if (sentIds.length) await markMentionsSent(sentIds);\n console.log(`Mention digest: ${byUser.size} users, ${sentIds.length} mentions sent`);\n}\n",[221],"3c5ca2ec-306e-11f1-b160-42dde27851f2","cron-cleanup.ts","019d5a6c-5c4d-7339-9acd-7562a0bd91d2",["D",1775338544104],"// Huddle — blob cleanup (runs every 6 hours, removes chat file blobs older than 12h)\n// Profile avatars are NEVER deleted — they persist indefinitely\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport default async function (_interval: Interval) {\n const cutoff = new Date(Date.now() - 12 * 3600 * 1000).toISOString();\n\n // Remove file blobs from messages older than 12h (chat uploads only, NOT avatars)\n const expiredMsgs = await sqlite.execute({\n sql: `SELECT blob_key FROM messages WHERE blob_key IS NOT NULL AND created_at < ?`,\n args: [cutoff],\n });\n let deleted = 0;\n for (const row of expiredMsgs.rows) {\n if (row.blob_key) {\n try { await blob.delete(row.blob_key as string); deleted++; } catch {}\n }\n }\n\n console.log(`Blob cleanup: removed ${deleted} expired chat file blobs (avatars are permanent)`);\n}\n",[228],"3c5ca1a2-306e-11f1-b160-42dde27851f2","shared","019d5a6c-5c4d-7339-9acd-72b2d658d0f5",["D",1775338544104],"directory",[234],"3c5c849c-306e-11f1-b160-42dde27851f2",["D",1775338544104],[118],"3c59d06c-306e-11f1-b160-42dde27851f2","database","019d5a6c-5c4d-7339-9acd-52c25f9bfad1",["D",1775338544104],[243],"pulls","branches","forks","envVars",{"_254":22,"_256":22},"connections",{"_254":22,"_255":22},"count","unfilledCount","emptyCount",{"_32":242,"_13":243,"_80":244,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":332,"_40":22,"_89":237,"_91":-5,"_66":50,"_93":-5,"_94":333,"_73":334},{"_32":325,"_13":326,"_80":327,"_82":244,"_83":59,"_84":113,"_86":26,"_34":328,"_40":22,"_89":283,"_91":329,"_66":50,"_93":-5,"_94":330,"_73":331},{"_32":318,"_13":319,"_80":320,"_82":244,"_83":59,"_84":113,"_86":26,"_34":321,"_40":22,"_89":283,"_91":322,"_66":50,"_93":-5,"_94":323,"_73":324},{"_32":239,"_13":118,"_80":111,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":315,"_40":22,"_89":237,"_91":-5,"_66":50,"_93":-5,"_94":316,"_73":317},{"_32":308,"_13":309,"_80":310,"_82":111,"_83":59,"_84":113,"_86":26,"_34":311,"_40":22,"_89":114,"_91":312,"_66":50,"_93":-5,"_94":313,"_73":314},{"_32":129,"_13":130,"_80":131,"_82":111,"_83":59,"_84":58,"_86":26,"_34":132,"_40":133,"_89":114,"_91":134,"_66":50,"_93":-5,"_94":306,"_73":307},{"_32":108,"_13":109,"_80":110,"_82":111,"_83":59,"_84":100,"_86":26,"_34":112,"_40":113,"_89":114,"_91":115,"_66":50,"_93":-5,"_94":304,"_73":305},{"_32":233,"_13":234,"_80":235,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":301,"_40":22,"_89":237,"_91":-5,"_66":50,"_93":-5,"_94":302,"_73":303},{"_32":294,"_13":295,"_80":296,"_82":235,"_83":59,"_84":113,"_86":26,"_34":297,"_40":22,"_89":283,"_91":298,"_66":50,"_93":-5,"_94":299,"_73":300},{"_32":287,"_13":288,"_80":289,"_82":235,"_83":59,"_84":113,"_86":26,"_34":290,"_40":22,"_89":283,"_91":291,"_66":50,"_93":-5,"_94":292,"_73":293},{"_32":279,"_13":280,"_80":281,"_82":235,"_83":59,"_84":113,"_86":26,"_34":282,"_40":22,"_89":283,"_91":284,"_66":50,"_93":-5,"_94":285,"_73":286},{"_32":227,"_13":228,"_80":229,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":276,"_40":22,"_89":224,"_91":231,"_66":50,"_93":-5,"_94":277,"_73":278},{"_32":220,"_13":221,"_80":222,"_82":-5,"_83":59,"_84":113,"_86":26,"_34":273,"_40":22,"_89":224,"_91":225,"_66":50,"_93":-5,"_94":274,"_73":275},{"_32":79,"_13":74,"_80":81,"_82":-5,"_83":59,"_84":85,"_86":26,"_34":87,"_40":88,"_89":90,"_91":92,"_66":50,"_93":-5,"_94":271,"_73":272},[],[74],["D",1775338544104],[],[221],["D",1775338544104],[],[228],"3c5c9c48-306e-11f1-b160-42dde27851f2","types.ts","019d5a6c-5c4d-7339-9acd-6f58f0971062",["D",1775338544104],"script","export const ADMIN_USERNAME = \"mjk\";\nexport const ADMIN_PASSWORD = \"110908\";\nexport const MAX_FILE_SIZE = 200 * 1024; // 200 KB\nexport const MAX_AVATAR_SIZE = 100 * 1024; // 100 KB\nexport const MENTION_EMAIL_INTERVAL_HOURS = 6;\nexport const APP_NAME = \"Huddle\";\nexport const MISTRAL_API_KEY = \"NMJb1HJcdzM7GnzYxvXp3VDVC8L0PcFB\";\nexport const CODESTRAL_API_KEY = \"fMTrjftODu0xedkR1deQh0YyEJZPBLnJ\";\nexport const GROQ_API_KEY = \"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\";\nexport const GROQ_ADMIN_MODEL = \"meta-llama/llama-4-scout-17b-16e-instruct\";\nexport const RESEND_API_KEY = \"re_81SGe9Uh_MqSo2yX182iPDJkS3xVzeXZU\";\n",[],[234,280],"3c5c8b40-306e-11f1-b160-42dde27851f2","email.ts","019d5a6c-5c4d-7339-9acd-6b164a6b1c0e",["D",1775338544104],"import { RESEND_API_KEY, APP_NAME } from \"./types.ts\";\n\nconst FROM_EMAIL = `${APP_NAME} `;\n\nexport async function sendEmail(to: string, subject: string, html: string): Promise {\n if (!RESEND_API_KEY) {\n console.warn(\"RESEND_API_KEY not set, skipping email to\", to);\n return false;\n }\n try {\n const res = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${RESEND_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ from: FROM_EMAIL, to, subject, html }),\n });\n if (!res.ok) {\n const err = await res.text();\n console.error(\"Resend error:\", err);\n return false;\n }\n return true;\n } catch (e) {\n console.error(\"Email send failed:\", e);\n return false;\n }\n}\n\nexport function mentionEmailHtml(mentions: Array<{ sender_username: string; room_name: string }>): string {\n const items = mentions\n .map((m) => `

${m.sender_username} mentioned you in ${m.room_name}

`)\n .join(\"\");\n return `\n

Huddle — You were mentioned

You have new mentions in Huddle:

${items}\n

`;\n}\n\nexport function recoveryEmailHtml(password: string): string {\n return `\n

Huddle — Password Recovery

Your Huddle account password is:

${password}

If you did not request this, please change your password immediately after logging in.

`;\n}\n",[],[234,288],"3c5c8672-306e-11f1-b160-42dde27851f2","auth.ts","019d5a6c-5c4d-7339-9acd-667b5616a961",["D",1775338544104],"import bcrypt from \"npm:bcryptjs\";\n\nexport async function hashPassword(password: string): Promise {\n return bcrypt.hash(password, 10);\n}\n\nexport async function verifyPassword(password: string, hash: string): Promise {\n return bcrypt.compare(password, hash);\n}\n\nexport function generateToken(length = 32): string {\n const arr = new Uint8Array(length);\n crypto.getRandomValues(arr);\n return Array.from(arr).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n",[],[234,295],["D",1775338544104],[265,266,267],[234],[],[118,109],[],[118,130],"3c59d274-306e-11f1-b160-42dde27851f2","bookmarklet.html","019d5a6c-5c4d-7339-9acd-57a330a4cc28",["D",1775338544104],"\n\n\n \n \n Huddle Bookmarklet\n \n \n\n\n

Huddle Bookmarklet

Open Huddle as a floating widget on any webpage — without leaving the site.

\n\n

Desktop: Drag the bookmark below to your browser's bookmarks bar

Mobile: Copy the code below, add a new bookmark manually, and paste it as the URL

Visit any page and tap or click the bookmarklet — Huddle floats on top

\n\n

Drag to bookmarks bar

\n 🔖\n

Drag this link to your bookmarks bar

\n Loading…\n

\n\n

Or copy for mobile

Loading…

\n \n

\n\n

\n 📱\n On mobile: tap Copy above → open your browser bookmarks → create a new bookmark → paste as the URL. Then tap it on any page to launch Huddle.\n

\n\n

\n\n \n\n ← Back to Huddle\n

\n\n\n\n",[],[118,309],["D",1775338544104],[261,262,263],[118],"3c598c7e-306e-11f1-b160-42dde27851f2","queries.ts","019d5a6c-5c4d-7339-9acd-4c644be4688f",["D",1775338544104],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ---- Users ----\nexport async function createUser(username: string, email: string, passwordHash: string, passwordPlain: string) {\n const result = await sqlite.execute({\n sql: `INSERT INTO users (username, email, password_hash, password_plain) VALUES (?, ?, ?, ?)`,\n args: [username, email, passwordHash, passwordPlain],\n });\n return result.lastInsertRowid;\n}\n\nexport async function getUserByUsername(username: string) {\n const r = await sqlite.execute({\n sql: `SELECT * FROM users WHERE username = ? COLLATE NOCASE`,\n args: [username],\n });\n return r.rows[0] ?? null;\n}\n\nexport async function getUserByEmail(email: string) {\n const r = await sqlite.execute({\n sql: `SELECT * FROM users WHERE email = ? COLLATE NOCASE`,\n args: [email],\n });\n return r.rows[0] ?? null;\n}\n\nexport async function getUserById(id: number) {\n const r = await sqlite.execute({ sql: `SELECT * FROM users WHERE id = ?`, args: [id] });\n return r.rows[0] ?? null;\n}\n\nexport async function updateUserAvatar(userId: number, blobKey: string) {\n await sqlite.execute({ sql: `UPDATE users SET avatar_blob_key = ? WHERE id = ?`, args: [blobKey, userId] });\n}\n\nexport async function setGhostMode(userId: number, ghost: boolean) {\n await sqlite.execute({ sql: `UPDATE users SET ghost_mode = ? WHERE id = ?`, args: [ghost ? 1 : 0, userId] });\n}\n\nexport async function banUser(userId: number, expiresAt: string | null, message: string | null) {\n await sqlite.execute({\n sql: `UPDATE users SET is_banned = 1, ban_expires_at = ?, ban_message = ? WHERE id = ?`,\n args: [expiresAt, message, userId],\n });\n}\n\nexport async function unbanUser(userId: number) {\n await sqlite.execute({ sql: `UPDATE users SET is_banned = 0, ban_expires_at = NULL, ban_message = NULL WHERE id = ?`, args: [userId] });\n}\n\nexport async function muteUser(userId: number, expiresAt: string) {\n await sqlite.execute({\n sql: `UPDATE users SET is_muted = 1, mute_expires_at = ? WHERE id = ?`,\n args: [expiresAt, userId],\n });\n}\n\nexport async function unmuteUser(userId: number) {\n await sqlite.execute({ sql: `UPDATE users SET is_muted = 0, mute_expires_at = NULL WHERE id = ?`, args: [userId] });\n}\n\nexport async function getPublicUsers() {\n const r = await sqlite.execute(`SELECT id, username, avatar_blob_key, ghost_mode FROM users WHERE ghost_mode = 0 ORDER BY username ASC`);\n return r.rows;\n}\n\nexport async function getAllUsers() {\n const r = await sqlite.execute(`SELECT id, username, email, ghost_mode, is_banned, ban_expires_at, ban_message, is_muted, mute_expires_at, avatar_blob_key, created_at FROM users ORDER BY username ASC`);\n return r.rows;\n}\n\n// ---- Sessions ----\nexport async function createSession(sessionId: string, userId: number) {\n await sqlite.execute({ sql: `INSERT INTO sessions (id, user_id) VALUES (?, ?)`, args: [sessionId, userId] });\n}\n\nexport async function getSession(sessionId: string) {\n const r = await sqlite.execute({ sql: `SELECT * FROM sessions WHERE id = ?`, args: [sessionId] });\n return r.rows[0] ?? null;\n}\n\nexport async function deleteSession(sessionId: string) {\n await sqlite.execute({ sql: `DELETE FROM sessions WHERE id = ?`, args: [sessionId] });\n}\n\n// ---- API Tokens (for cross-origin bookmarklet) ----\nexport async function createApiToken(token: string, userId: number) {\n await sqlite.execute({ sql: `INSERT OR REPLACE INTO api_tokens (token, user_id) VALUES (?, ?)`, args: [token, userId] });\n}\n\nexport async function getApiToken(token: string) {\n const r = await sqlite.execute({ sql: `SELECT * FROM api_tokens WHERE token = ?`, args: [token] });\n return r.rows[0] ?? null;\n}\n\nexport async function deleteApiToken(token: string) {\n await sqlite.execute({ sql: `DELETE FROM api_tokens WHERE token = ?`, args: [token] });\n}\n\n// ---- Rooms ----\nexport async function createRoom(name: string, createdBy: number) {\n const r = await sqlite.execute({\n sql: `INSERT INTO rooms (name, type, created_by) VALUES (?, 'group', ?)`,\n args: [name, createdBy],\n });\n const roomId = Number(r.lastInsertRowid);\n await sqlite.execute({ sql: `INSERT INTO room_members (room_id, user_id, role) VALUES (?, ?, 'owner')`, args: [roomId, createdBy] });\n return roomId;\n}\n\nexport async function getRoomById(roomId: number) {\n const r = await sqlite.execute({ sql: `SELECT * FROM rooms WHERE id = ?`, args: [roomId] });\n return r.rows[0] ?? null;\n}\n\nexport async function deleteRoom(roomId: number) {\n await sqlite.execute({ sql: `DELETE FROM room_members WHERE room_id = ?`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM room_invites WHERE room_id = ?`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM reactions WHERE message_id IN (SELECT id FROM messages WHERE room_id = ?)`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM messages WHERE room_id = ?`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM typing WHERE room_id = ?`, args: [roomId] });\n await sqlite.execute({ sql: `DELETE FROM rooms WHERE id = ?`, args: [roomId] });\n}\n\nexport async function getRoomsForUser(userId: number) {\n const r = await sqlite.execute({\n sql: `SELECT r.* FROM rooms r\n LEFT JOIN room_members rm ON r.id = rm.room_id AND rm.user_id = ?\n WHERE r.type = 'world' OR rm.user_id = ?\n ORDER BY r.id ASC`,\n args: [userId, userId],\n });\n return r.rows;\n}\n\nexport async function getAllRooms() {\n const r = await sqlite.execute(`SELECT * FROM rooms ORDER BY id ASC`);\n return r.rows;\n}\n\nexport async function getRoomMembers(roomId: number) {\n const r = await sqlite.execute({\n sql: `SELECT u.id, u.username, u.avatar_blob_key, rm.role FROM users u\n JOIN room_members rm ON u.id = rm.user_id WHERE rm.room_id = ?\n ORDER BY rm.role DESC, u.username ASC`,\n args: [roomId],\n });\n return r.rows;\n}\n\nexport async function addRoomMember(roomId: number, userId: number, role = \"member\") {\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO room_members (room_id, user_id, role) VALUES (?, ?, ?)`,\n args: [roomId, userId, role],\n });\n}\n\nexport async function removeRoomMember(roomId: number, userId: number) {\n await sqlite.execute({ sql: `DELETE FROM room_members WHERE room_id = ? AND user_id = ?`, args: [roomId, userId] });\n}\n\nexport async function isRoomMember(roomId: number, userId: number): Promise {\n const r = await sqlite.execute({\n sql: `SELECT 1 FROM room_members WHERE room_id = ? AND user_id = ?`,\n args: [roomId, userId],\n });\n return r.rows.length > 0;\n}\n\nexport async function inviteToRoom(roomId: number, invitedUserId: number, invitedBy: number) {\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO room_invites (room_id, invited_user_id, invited_by) VALUES (?, ?, ?)`,\n args: [roomId, invitedUserId, invitedBy],\n });\n await addRoomMember(roomId, invitedUserId);\n}\n\n// ---- Messages ----\nexport async function createMessage(\n roomId: number,\n userId: number,\n content: string | null,\n blobKey?: string,\n blobName?: string,\n blobSize?: number,\n replyToId?: number,\n) {\n const r = await sqlite.execute({\n sql: `INSERT INTO messages (room_id, user_id, content, blob_key, blob_name, blob_size, reply_to_id) VALUES (?, ?, ?, ?, ?, ?, ?)`,\n args: [roomId, userId, content, blobKey ?? null, blobName ?? null, blobSize ?? null, replyToId ?? null],\n });\n // Prune to 450 messages per room\n await sqlite.execute({\n sql: `DELETE FROM messages WHERE room_id = ? AND id NOT IN (SELECT id FROM messages WHERE room_id = ? ORDER BY id DESC LIMIT 450)`,\n args: [roomId, roomId],\n });\n return r.lastInsertRowid;\n}\n\nexport async function editMessage(messageId: number, userId: number, content: string) {\n await sqlite.execute({\n sql: `UPDATE messages SET content = ?, edited_at = datetime('now') WHERE id = ? AND user_id = ?`,\n args: [content, messageId, userId],\n });\n}\n\nexport async function getMessageById(messageId: number) {\n const r = await sqlite.execute({\n sql: `SELECT m.*,\n CASE WHEN m.is_deleted = 1 THEN m.deleted_username ELSE u.username END AS username,\n CASE WHEN m.is_deleted = 1 THEN NULL ELSE u.avatar_blob_key END AS avatar_blob_key\n FROM messages m\n LEFT JOIN users u ON m.user_id = u.id\n WHERE m.id = ?`,\n args: [messageId],\n });\n return r.rows[0] ?? null;\n}\n\nexport async function getMessages(roomId: number, since?: number) {\n if (since) {\n const r = await sqlite.execute({\n sql: `SELECT m.*,\n CASE WHEN m.is_deleted = 1 THEN m.deleted_username ELSE u.username END AS username,\n CASE WHEN m.is_deleted = 1 THEN NULL ELSE u.avatar_blob_key END AS avatar_blob_key\n FROM messages m\n LEFT JOIN users u ON m.user_id = u.id\n WHERE m.room_id = ? AND m.id > ? ORDER BY m.id ASC`,\n args: [roomId, since],\n });\n return r.rows;\n }\n const r = await sqlite.execute({\n sql: `SELECT m.*,\n CASE WHEN m.is_deleted = 1 THEN m.deleted_username ELSE u.username END AS username,\n CASE WHEN m.is_deleted = 1 THEN NULL ELSE u.avatar_blob_key END AS avatar_blob_key\n FROM messages m\n LEFT JOIN users u ON m.user_id = u.id\n WHERE m.room_id = ? ORDER BY m.id ASC LIMIT 450`,\n args: [roomId],\n });\n return r.rows;\n}\n\nexport async function searchMessages(roomId: number, query: string) {\n const r = await sqlite.execute({\n sql: `SELECT m.*,\n CASE WHEN m.is_deleted = 1 THEN m.deleted_username ELSE u.username END AS username,\n CASE WHEN m.is_deleted = 1 THEN NULL ELSE u.avatar_blob_key END AS avatar_blob_key\n FROM messages m\n LEFT JOIN users u ON m.user_id = u.id\n WHERE m.room_id = ? AND m.content LIKE ? AND m.is_deleted = 0\n ORDER BY m.id DESC LIMIT 50`,\n args: [roomId, `%${query}%`],\n });\n return r.rows;\n}\n\n// Clear all messages in a room (admin only)\nexport async function clearRoom(roomId: number) {\n await sqlite.execute({\n sql: `DELETE FROM messages WHERE room_id = ?`,\n args: [roomId],\n });\n // Also wipe reactions for those messages (already gone, but clean up reactions table)\n await sqlite.execute({\n sql: `DELETE FROM reactions WHERE message_id NOT IN (SELECT id FROM messages)`,\n args: [],\n });\n}\n\n// Soft-delete a single message (admin moderation or owner)\nexport async function deleteMessage(messageId: number) {\n // Snapshot the username before soft-deleting (in case user still exists)\n const r = await sqlite.execute({\n sql: `SELECT m.*, u.username AS live_username FROM messages m LEFT JOIN users u ON m.user_id = u.id WHERE m.id = ?`,\n args: [messageId],\n });\n const msg = r.rows[0] as any;\n if (!msg) return;\n const username = msg.deleted_username ?? msg.live_username ?? \"unknown\";\n await sqlite.execute({\n sql: `UPDATE messages SET is_deleted = 1, deleted_username = ? WHERE id = ?`,\n args: [username, messageId],\n });\n}\n\n// ---- Reactions ----\nexport async function addReaction(messageId: number, userId: number, emoji: string) {\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO reactions (message_id, user_id, emoji) VALUES (?, ?, ?)`,\n args: [messageId, userId, emoji],\n });\n}\n\nexport async function removeReaction(messageId: number, userId: number, emoji: string) {\n await sqlite.execute({\n sql: `DELETE FROM reactions WHERE message_id = ? AND user_id = ? AND emoji = ?`,\n args: [messageId, userId, emoji],\n });\n}\n\nexport async function getReactionsForRoom(roomId: number) {\n const r = await sqlite.execute({\n sql: `SELECT r.message_id, r.user_id, r.emoji, u.username FROM reactions r JOIN users u ON r.user_id = u.id WHERE r.message_id IN (SELECT id FROM messages WHERE room_id = ?)`,\n args: [roomId],\n });\n return r.rows;\n}\n\n// ---- Typing indicators ----\nexport async function setTyping(roomId: number, userId: number, username: string) {\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO typing (room_id, user_id, username, updated_at) VALUES (?, ?, ?, datetime('now'))`,\n args: [roomId, userId, username],\n });\n}\n\nexport async function clearTyping(roomId: number, userId: number) {\n await sqlite.execute({\n sql: `DELETE FROM typing WHERE room_id = ? AND user_id = ?`,\n args: [roomId, userId],\n });\n}\n\nexport async function getTyping(roomId: number) {\n // Only return users who typed in last 4 seconds\n const r = await sqlite.execute({\n sql: `SELECT username FROM typing WHERE room_id = ? AND updated_at >= datetime('now', '-4 seconds')`,\n args: [roomId],\n });\n return r.rows.map((row: any) => row.username as string);\n}\n\n// ---- Block ----\nexport async function blockUser(userId: number, blockedUserId: number) {\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO blocked_users (user_id, blocked_user_id) VALUES (?, ?)`,\n args: [userId, blockedUserId],\n });\n}\n\nexport async function unblockUser(userId: number, blockedUserId: number) {\n await sqlite.execute({\n sql: `DELETE FROM blocked_users WHERE user_id = ? AND blocked_user_id = ?`,\n args: [userId, blockedUserId],\n });\n}\n\nexport async function getBlockedUsers(userId: number) {\n const r = await sqlite.execute({ sql: `SELECT blocked_user_id FROM blocked_users WHERE user_id = ?`, args: [userId] });\n return r.rows.map((row) => Number(row.blocked_user_id));\n}\n\n// ---- Mentions ----\nexport async function queueMention(mentionedUserId: number, senderUsername: string, roomName: string) {\n await sqlite.execute({\n sql: `INSERT INTO mention_queue (mentioned_user_id, sender_username, room_name) VALUES (?, ?, ?)`,\n args: [mentionedUserId, senderUsername, roomName],\n });\n}\n\nexport async function getUnsentMentions() {\n const r = await sqlite.execute(`SELECT mq.*, u.email, u.username as mentioned_username FROM mention_queue mq JOIN users u ON mq.mentioned_user_id = u.id WHERE mq.sent = 0`);\n return r.rows;\n}\n\nexport async function markMentionsSent(ids: number[]) {\n if (ids.length === 0) return;\n const placeholders = ids.map(() => \"?\").join(\",\");\n await sqlite.execute({ sql: `UPDATE mention_queue SET sent = 1 WHERE id IN (${placeholders})`, args: ids });\n}\n\nexport async function updateUserPassword(userId: number, passwordHash: string, passwordPlain: string) {\n await sqlite.execute({ sql: `UPDATE users SET password_hash = ?, password_plain = ? WHERE id = ?`, args: [passwordHash, passwordPlain, userId] });\n}\n\nexport async function deleteUser(userId: number) {\n // Remove all user data in order (FK-safe)\n await sqlite.execute({ sql: `DELETE FROM reactions WHERE user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM blocked_users WHERE user_id = ? OR blocked_user_id = ?`, args: [userId, userId] });\n await sqlite.execute({ sql: `DELETE FROM room_members WHERE user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM room_invites WHERE invited_user_id = ? OR invited_by = ?`, args: [userId, userId] });\n await sqlite.execute({ sql: `DELETE FROM typing WHERE user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM mention_queue WHERE mentioned_user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM sessions WHERE user_id = ?`, args: [userId] });\n await sqlite.execute({ sql: `DELETE FROM api_tokens WHERE user_id = ?`, args: [userId] });\n // Soft-delete messages: snapshot the username, mark is_deleted=1, then NULL out\n // user_id so the FK constraint doesn't block deleting the user row.\n const userRecord = await getUserById(userId);\n const oldUsername = userRecord ? String(userRecord.username) : \"deleted\";\n await sqlite.execute({\n sql: `UPDATE messages SET is_deleted = 1, deleted_username = ?, user_id = NULL WHERE user_id = ?`,\n args: [oldUsername, userId],\n });\n // Also NULL out reactions FK before deleting (reactions were already hard-deleted above,\n // but reply_to messages may still reference this user indirectly — nulling user_id covers it)\n await sqlite.execute({ sql: `DELETE FROM users WHERE id = ?`, args: [userId] });\n}\n",[],[243,319],"3c5947fa-306e-11f1-b160-42dde27851f2","migrations.ts","019d5a6c-5c4d-7339-9acd-4b6a86e47593",["D",1775338544104],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function runMigrations() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL UNIQUE COLLATE NOCASE,\n email TEXT NOT NULL UNIQUE COLLATE NOCASE,\n password_hash TEXT NOT NULL,\n password_plain TEXT,\n avatar_blob_key TEXT,\n ghost_mode INTEGER DEFAULT 0,\n is_banned INTEGER DEFAULT 0,\n ban_expires_at TEXT,\n ban_message TEXT,\n is_muted INTEGER DEFAULT 0,\n mute_expires_at TEXT,\n created_at TEXT DEFAULT (datetime('now'))\n )\n `);\n\n // Add columns that may not exist yet (safe migrations)\n try { await sqlite.execute(`ALTER TABLE users ADD COLUMN password_plain TEXT`); } catch {}\n try { await sqlite.execute(`ALTER TABLE users ADD COLUMN ban_message TEXT`); } catch {}\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS sessions (\n id TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS api_tokens (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS rooms (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n type TEXT NOT NULL DEFAULT 'group',\n created_by INTEGER,\n created_at TEXT DEFAULT (datetime('now'))\n )\n `);\n\n await sqlite.execute(`\n INSERT OR IGNORE INTO rooms (id, name, type) VALUES (1, 'World Chat', 'world')\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS room_members (\n room_id INTEGER NOT NULL,\n user_id INTEGER NOT NULL,\n role TEXT DEFAULT 'member',\n joined_at TEXT DEFAULT (datetime('now')),\n PRIMARY KEY (room_id, user_id),\n FOREIGN KEY (room_id) REFERENCES rooms(id),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS room_invites (\n room_id INTEGER NOT NULL,\n invited_user_id INTEGER NOT NULL,\n invited_by INTEGER NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n PRIMARY KEY (room_id, invited_user_id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS messages (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n room_id INTEGER NOT NULL,\n user_id INTEGER NOT NULL,\n content TEXT,\n blob_key TEXT,\n blob_name TEXT,\n blob_size INTEGER,\n reply_to_id INTEGER,\n edited_at TEXT,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (room_id) REFERENCES rooms(id),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n // Safe: add new message columns if they don't exist\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN reply_to_id INTEGER`); } catch {}\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN edited_at TEXT`); } catch {}\n // Soft-delete support: when a user is deleted their messages stay but show as [deleted]\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN is_deleted INTEGER DEFAULT 0`); } catch {}\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN deleted_username TEXT`); } catch {}\n\n // Allow user_id to be NULL on messages so we can soft-delete messages when a user is deleted\n // without violating the FK constraint. SQLite can't ALTER COLUMN, so we recreate the table.\n // We only do this if the column is still NOT NULL (check by trying to set a NULL — if it throws, migrate).\n try {\n // Check if user_id already allows NULL by looking at table info\n const info = await sqlite.execute(`PRAGMA table_info(messages)`);\n const userIdCol = (info.rows as any[]).find((r: any) => r.name === \"user_id\");\n if (userIdCol && userIdCol.notnull === 1) {\n // Need to recreate the table without the NOT NULL constraint and without the FK on user_id\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS messages_new (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n room_id INTEGER NOT NULL,\n user_id INTEGER,\n content TEXT,\n blob_key TEXT,\n blob_name TEXT,\n blob_size INTEGER,\n reply_to_id INTEGER,\n edited_at TEXT,\n is_deleted INTEGER DEFAULT 0,\n deleted_username TEXT,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (room_id) REFERENCES rooms(id)\n )\n `);\n await sqlite.execute(`INSERT INTO messages_new SELECT id, room_id, user_id, content, blob_key, blob_name, blob_size, reply_to_id, edited_at, is_deleted, deleted_username, created_at FROM messages`);\n await sqlite.execute(`DROP TABLE messages`);\n await sqlite.execute(`ALTER TABLE messages_new RENAME TO messages`);\n }\n } catch (e) {\n console.error(\"Migration: messages nullable user_id failed:\", e);\n }\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS blocked_users (\n user_id INTEGER NOT NULL,\n blocked_user_id INTEGER NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n PRIMARY KEY (user_id, blocked_user_id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS mention_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n mentioned_user_id INTEGER NOT NULL,\n sender_username TEXT NOT NULL,\n room_name TEXT NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n sent INTEGER DEFAULT 0\n )\n `);\n\n // Reactions: one row per user+message+emoji\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS reactions (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n message_id INTEGER NOT NULL,\n user_id INTEGER NOT NULL,\n emoji TEXT NOT NULL,\n created_at TEXT DEFAULT (datetime('now')),\n UNIQUE(message_id, user_id, emoji),\n FOREIGN KEY (message_id) REFERENCES messages(id),\n FOREIGN KEY (user_id) REFERENCES users(id)\n )\n `);\n\n // Typing indicators: ephemeral, TTL-based\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS typing (\n room_id INTEGER NOT NULL,\n user_id INTEGER NOT NULL,\n username TEXT NOT NULL,\n updated_at TEXT DEFAULT (datetime('now')),\n PRIMARY KEY (room_id, user_id)\n )\n `);\n}\n",[],[243,326],["D",1775338544104],[258,259],[243],["D",1775338544104],["D",1789451469231],{"_11":12,"_184":180},{"_11":12,"_178":-5,"_179":180,"_149":150,"_181":182,"_183":50},{"_40":58,"_13":16,"_32":59,"_38":60,"_42":33,"_44":41,"_61":52,"_62":39,"_63":56,"_57":14,"_53":12},"ctx",{"_173":-5,"_205":373,"_374":375,"_376":377,"_378":50,"_379":50,"_380":50,"_381":26,"_382":-5,"_383":-7,"_384":-7,"_385":22,"_386":50,"_387":50,"_388":-5,"_389":50,"_390":50,"_391":50,"_392":-5},"ENV",{"_344":345,"_346":347,"_348":16,"_349":350,"_351":352,"_353":354,"_355":356,"_357":358,"_359":360,"_361":362,"_363":364,"_365":366,"_367":368,"_369":370,"_371":372},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Compare

Mergetes1/mainintotest4/main

frontend/index.html+17-7

frontend/style.css+149-64

Hindex.ts+3-3