@7ots/cli 0.1.6 → 0.1.8

package/llms.txt

@@ -1,7 +1,7 @@
 # 7ots
 
 > An ot is the user's personal AI companion with its own face, personality and voice. It lives on their desktop as a pet
-> (`npx @7ots/cli pet`), watches over their coding agent (Claude Code / Codex hooks), sets reminders, watches prices and
+> (`npx @7ots/cli pet`), watches over their coding agent (Claude Code hooks + bash/zsh hooks), sets reminders, watches prices and
 > processes, can see the screen if allowed, joins apuchat video calls and can work as an Orquesta assistant inside a project.
 > Every ot's identity (face, personality, voice, meet avatar) is reproducible from a short seed. 7ots integrates apuchat,
 > apumail and voice providers; it does not host audio or mail.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7ots/cli",
-  "version": "0.1.6",
-  "description": "7ots.com — open-source embeddable web agent: it sees the page, speaks and acts for your visitor. Web Component + self-hosted Node proxy, Claude/OpenAI, 2D/3D avatar with voice, i18n, backoffice — plus a CLI with reproducible identities, a desktop pet and apuchat meet.",
+  "version": "0.1.8",
+  "description": "7ots.com — your AI companion with a face of its own: a desktop pet that watches over your coding agent (Claude Code and shell hooks), a personal assistant (reminders, alerts, notes, opens sites, sees your screen if allowed) and a reproducible identity (face, personality, voice) for any agent — in apuchat meet calls, Orquesta projects or your own server.",
   "homepage": "https://7ots.com",
   "repository": {
     "type": "git",
@@ -45,22 +45,25 @@
     "node": ">=20"
   },
   "keywords": [
+    "ai-companion",
+    "desktop-pet",
+    "tamagotchi",
+    "personal-assistant",
+    "agent-identity",
     "ai-agent",
-    "web-component",
-    "assistant",
-    "talkinghead",
-    "three.js",
+    "claude-code",
+    "coding-agent",
+    "hooks",
+    "reminders",
+    "avatar",
+    "voice",
+    "meet",
+    "orquesta",
+    "prowl",
     "mcp",
     "claude",
     "openai",
-    "chatbot",
-    "avatar",
-    "i18n",
-    "proactive",
-    "cli",
-    "pet",
-    "tamagotchi",
-    "claude-code"
+    "cli"
   ],
   "dependencies": {
     "@anthropic-ai/sdk": "^0.129.0",

package/server/channels/agent.mjs

@@ -65,7 +65,7 @@ function systemFor(channel, { lang, identity = getIdentity, instructions = () =>
  * @param {{ llm?: {step: Function}, brain?: Function, identity?: () => object, instructions?: () => string }} deps
  *   instructions: instrucciones fijas del servidor (defecto SERVER_INSTRUCTIONS)
  */
-export function createServerAgent({ llm, brain = null, identity = getIdentity, instructions }) {
+export function createServerAgent({ llm, brain = null, identity = getIdentity, instructions, onTurn = null }) {
   if (!llm && !brain) throw new Error('createServerAgent necesita llm o brain');
   /** clave de contacto → { messages: Neutral[], at } */
   const memory = new Map();
@@ -121,6 +121,12 @@ export function createServerAgent({ llm, brain = null, identity = getIdentity, i
     final = clean(final);
     // Se recuerda solo lo conversacional (sin pasos de herramientas ni razonamiento).
     remember(key, [...history, turn[0], ...(final ? [{ role: 'assistant', content: final }] : [])]);
+    // correo y DMs quedan apuntados (las llamadas no: sus turnos son voz y avisos internos)
+    if (onTurn && channel !== 'voice') {
+      try {
+        onTurn({ key, channel, user: text, reply: final });
+      } catch {}
+    }
     return final;
   }
 

package/server/channels/index.mjs

@@ -20,9 +20,10 @@ import { apuchatConfigFromEnv, apuchatConfigured, createApuchatChannel } from '.
  * @param {Function} [deps.log]
  * @param {(ctx: { channel: 'dm'|'email', from: string, verified?: boolean }) => ({ tools: object[], run: Function }|null)} [deps.tools]
  *   extra server tools for one conversation (DMs and mails, never voice calls), decided per sender
+ * @param {(t: { key: string, channel: 'email'|'dm', user: string, reply: string }) => void} [deps.onTurn]  each answered mail / DM
  */
-export function startAgentChannels({ llm, brain, identity = getIdentity, instructions, config = {}, log = (...a) => console.log('[7ots]', ...a), tools = null }) {
-  const agent = createServerAgent({ llm, brain, identity, instructions });
+export function startAgentChannels({ llm, brain, identity = getIdentity, instructions, config = {}, log = (...a) => console.log('[7ots]', ...a), tools = null, onTurn = null }) {
+  const agent = createServerAgent({ llm, brain, identity, instructions, onTurn });
   const persona = () => personaOf(identity);
   const mailCfg = config.apumail === false ? null : { ...apumailConfigFromEnv(), ...(config.apumail || {}) };
   const chatCfg = config.apuchat === false ? null : { ...apuchatConfigFromEnv(), ...(config.apuchat || {}) };

package/server/platform/connect.mjs

@@ -35,6 +35,7 @@ import {
 } from './apuchat.mjs';
 import {
   askOt, authorizeUrl, cancelTask, disconnect, exchangeCode, listProjects, manageUrl, orquestaAccountView, orquestaUrl, otsOrquesta, parseAllow, projectUrl, saveKey, taskStatus,
+  registerOts,
 } from './orquesta.mjs';
 
 const penv = process.env;
@@ -235,7 +236,9 @@ export function createConnect({ send, readJson, originOf, save }) {
       }
       if (body.daily !== undefined) settings.ORQUESTA_DAILY = String(Math.min(200, Math.max(1, Math.floor(Number(body.daily)) || 20)));
       if (settings.ORQUESTA_TASKS && !settings.ORQUESTA_PROJECT) return send(res, 400, { error: t('platform.orquesta.pickProject') });
-      return send(res, 200, orquestaView(account, await save(ots, { settings })));
+      const saved = await save(ots, { settings });
+      registerOts(account.id, { force: true }).catch(() => null); // seeds the link in Orquesta for a first project
+      return send(res, 200, orquestaView(account, saved));
     }
     if (sub === '/orquesta/ask' && req.method === 'POST') {
       const { message, history } = await readJson(req, 128 * 1024);

package/server/platform/db.mjs

@@ -17,7 +17,8 @@
  *   sites          sites/APIs/MCPs enrolled in Prowl.world so ots know how to use them (sites.mjs)
  *   devices        computers signed in with `7ots login` (the desktop pet): a bearer token, hashed
  *   ots_vms        the machine where an ot's assistant worker runs (one per ot; vm.mjs, docs/VM-PLAN.md):
- *                  provider 'byo' (the owner's own server, enrolled by hand) or 'orquesta' (paid by 7ots, Phase 1)
+ *                  provider 'byo' (the owner's own server, enrolled by hand), 'orquesta' (in the account's Orquesta
+ *                  child org, paid through Orquesta's checkout) or 'orquesta_user' (in the owner's own Orquesta org)
  *   vm_jobs        work the desktop sends to that VM, and how it ended
  *   vm_job_events  what the worker reported while doing it (seq per job, for long-polls)
  */
@@ -197,6 +198,9 @@ CREATE TABLE IF NOT EXISTS vm_job_events (
 
 let db = null;
 
+/** Carpeta de datos de la plataforma (junto a PLATFORM_DB): ahí van también los archivos subidos. */
+export const dataDir = () => (process.env.PLATFORM_DB === ':memory:' ? resolve(ROOT, 'data') : dirname(resolve(ROOT, process.env.PLATFORM_DB || join('data', 'platform.db'))));
+
 /** Abre (y crea si hace falta) la base de datos. Idempotente. */
 export function openDb(path = process.env.PLATFORM_DB) {
   if (db) return db;
@@ -208,6 +212,15 @@ export function openDb(path = process.env.PLATFORM_DB) {
   migrateLookPrints(db);
   // VMs paid by 7ots (provider 'orquesta') are opt-in per account; your own server never needs it (vm.mjs).
   if (!db.prepare('PRAGMA table_info(accounts)').all().some((c) => c.name === 'vm_enabled')) db.exec('ALTER TABLE accounts ADD COLUMN vm_enabled INTEGER NOT NULL DEFAULT 0');
+  // VMs created through Orquesta: its last-seen VM status, when it was checked and the monthly price it quoted.
+  const vmCols = db.prepare('PRAGMA table_info(ots_vms)').all().map((c) => c.name);
+  if (!vmCols.includes('orq_status')) db.exec("ALTER TABLE ots_vms ADD COLUMN orq_status TEXT NOT NULL DEFAULT ''");
+  if (!vmCols.includes('orq_checked_at')) db.exec('ALTER TABLE ots_vms ADD COLUMN orq_checked_at INTEGER');
+  if (!vmCols.includes('price_cents')) db.exec('ALTER TABLE ots_vms ADD COLUMN price_cents INTEGER');
+  // One Orquesta child org per 7ots account (partner orgs): the account's org id, and the org each VM lives in
+  // ('' = the partner's own org, VMs made before child orgs). Provider 'orquesta_user' VMs live in the owner's org.
+  if (!db.prepare('PRAGMA table_info(accounts)').all().some((c) => c.name === 'orq_org_id')) db.exec("ALTER TABLE accounts ADD COLUMN orq_org_id TEXT NOT NULL DEFAULT ''");
+  if (!vmCols.includes('orq_org_id')) db.exec("ALTER TABLE ots_vms ADD COLUMN orq_org_id TEXT NOT NULL DEFAULT ''");
   return db;
 }
 

package/server/platform/device.mjs

@@ -10,6 +10,14 @@
  *   GET  /api/device/me                → { account, ots: [summary] }  (Authorization: Bearer)
  *   GET  /api/device/ots/:id           → { ots: summary, identity }   (the owner's full identity)
  *   DELETE /api/device/token           → signs this computer out
+ *   GET  /api/device/ots/:id/orquesta  → { connected, project, projectName, projects }
+ *   POST /api/device/ots/:id/orquesta/tasks { text, projectId? } · GET …/tasks/:tid
+ *        The desktop ot uses the account's Orquesta connection through here: the Orquesta token
+ *        stays sealed on 7ots.com and never reaches the computer. The device is the owner's (it
+ *        was approved from the dashboard), so it may pick any project the connection can reach.
+ *   GET  /api/device/ots/:id/inbox     → { apuchat, email, conversations: [{ channel, who, at, messages }] }
+ *        what people wrote to the ot on apuchat and email lately, and what it answered (read only;
+ *        the channels' keys stay on 7ots.com)
  *
  * From the dashboard (session cookie, X-7ots-Admin: 1, same origin; see routes.mjs):
  *   GET  /api/platform/device/:code    → { name, expiresIn }  what is asking
@@ -21,9 +29,13 @@
  */
 
 import { defineIdentity } from '../../src/identity/schema.js';
-import { getDb } from './db.mjs';
+import { createHash } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { dataDir, getDb } from './db.mjs';
 import { newId, sha256, token } from './crypto.mjs';
-import { getOwnOts, listOts, publicAccount } from './store.mjs';
+import { getConversation, getOwnOts, listConversations, listOts, publicAccount } from './store.mjs';
+import { listProjects, orquestaAccountView, otsOrquesta, runTask, taskStatus } from './orquesta.mjs';
 
 const CODE_TTL = 10 * 60_000;
 const PREFIX = '7d_'; // so a leaked token is recognizable
@@ -52,7 +64,11 @@ export function listDevices(accountId) {
 /**
  * @param {{ send: Function, readJson: Function, base: (req) => string, rateLimit: (req) => boolean, summary: (ots) => object }} deps
  */
-export function createDevice({ send, readJson, base, rateLimit, summary }) {
+/** What the pet and 7ots.com keep in sync (the look goes only as look.character). */
+const SYNCED = ['name', 'role', 'tagline', 'bio', 'language', 'languages', 'personality'];
+const MAX_MODEL = 60 * 1024 * 1024;
+
+export function createDevice({ send, readJson, base, rateLimit, summary, save }) {
   /** Public half (/api/device/*). @returns {Promise<boolean>} */
   async function api(req, res, path) {
     res.setHeader('Cache-Control', 'no-store');
@@ -87,12 +103,93 @@ export function createDevice({ send, readJson, base, rateLimit, summary }) {
       if (m && req.method === 'GET') {
         const ots = getOwnOts(account.id, m[1]);
         if (!ots) return send(res, 404, { error: 'not found' }), true;
-        return send(res, 200, { ots: summary(ots), identity: defineIdentity(ots.identity) }), true;
+        return send(res, 200, { ots: summary(ots), identity: defineIdentity(ots.identity), updatedAt: ots.updatedAt }), true;
+      }
+      // sync with the desktop pet: the same look, personality and character sheet on both sides
+      const sm = /^\/ots\/([a-z0-9_]{4,40})\/identity$/.exec(path);
+      if (sm && req.method === 'PUT') {
+        const ots = getOwnOts(account.id, sm[1]);
+        if (!ots) return send(res, 404, { error: 'not found' }), true;
+        const inc = (await readJson(req, 512 * 1024))?.identity;
+        if (!inc || typeof inc !== 'object') return send(res, 400, { error: 'identity' }), true;
+        const patch = Object.fromEntries(SYNCED.filter((k) => k in inc).map((k) => [k, inc[k]]));
+        if (inc.look?.character) patch.look = { character: inc.look.character }; // the rest of the look (image, avatar) is the web's
+        try {
+          const next = await save(ots, { identity: defineIdentity(patch, ots.identity) });
+          return send(res, 200, { identity: defineIdentity(next.identity), updatedAt: next.updatedAt }), true;
+        } catch (e) {
+          return send(res, e.status || 500, { error: e.message }), true;
+        }
+      }
+      // a full-body model (.glb/.vrm) of a mod: content-addressed, served at /mods/<sha16>.<ext> like on the pet
+      const fm = /^\/ots\/([a-z0-9_]{4,40})\/files$/.exec(path);
+      if (fm && req.method === 'POST') {
+        if (!getOwnOts(account.id, fm[1])) return send(res, 404, { error: 'not found' }), true;
+        const ext = new URL(req.url, 'http://x').searchParams.get('ext');
+        if (!['glb', 'vrm'].includes(ext)) return send(res, 400, { error: 'ext' }), true;
+        const chunks = [];
+        let size = 0;
+        for await (const c of req) {
+          size += c.length;
+          if (size > MAX_MODEL) return send(res, 413, { error: 'too big' }), true;
+          chunks.push(c);
+        }
+        const buf = Buffer.concat(chunks);
+        if (buf.length < 20 || buf.toString('latin1', 0, 4) !== 'glTF') return send(res, 400, { error: 'not a glTF binary' }), true;
+        const h = createHash('sha256').update(buf).digest('hex').slice(0, 16);
+        mkdirSync(join(dataDir(), 'mods'), { recursive: true });
+        writeFileSync(join(dataDir(), 'mods', `${h}.${ext}`), buf);
+        return send(res, 200, { url: `/mods/${h}.${ext}` }), true;
+      }
+      const im = /^\/ots\/([a-z0-9_]{4,40})\/inbox$/.exec(path);
+      if (im && req.method === 'GET') {
+        const ots = getOwnOts(account.id, im[1]);
+        if (!ots) return send(res, 404, { error: 'not found' }), true;
+        const conversations = listConversations(ots.id, { limit: 60 })
+          .filter((c) => c.channel === 'apuchat' || c.channel === 'apumail')
+          .slice(0, 10)
+          .map((c) => ({ channel: c.channel, who: c.visitor, at: c.updatedAt, messages: (getConversation(ots.id, c.id)?.messages || []).slice(-6).map((m) => ({ role: m.role, text: m.content.slice(0, 1200), at: m.at })) }));
+        const s = ots.settings;
+        return send(res, 200, { apuchat: s.APUCHAT_AGENT_CALLSIGN || null, email: s.APUMAIL_AGENT_INBOX || null, conversations }), true;
+      }
+      const om = /^\/ots\/([a-z0-9_]{4,40})\/orquesta(\/tasks(?:\/([A-Za-z0-9_-]{4,100}))?)?$/.exec(path);
+      if (om) {
+        const ots = getOwnOts(account.id, om[1]);
+        if (!ots) return send(res, 404, { error: 'not found' }), true;
+        return orquesta(req, res, account, ots, !!om[2], om[3]);
       }
     }
     return false;
   }
 
+  /** The ot's Orquesta, used by the desktop ot with the account's connection. */
+  async function orquesta(req, res, account, ots, tasks, tid) {
+    const view = orquestaAccountView(account.id);
+    if (!tasks && req.method === 'GET') {
+      const cfg = otsOrquesta(ots);
+      let projects = [];
+      let error = view.error;
+      if (view.connected) projects = await listProjects(account.id).catch((e) => ((error = e.message), []));
+      return send(res, 200, { connected: view.connected, error, project: cfg.project, projectName: cfg.projectName, projects }), true;
+    }
+    if (!view.connected) return send(res, 409, { error: 'Orquesta is not connected on 7ots.com' }), true;
+    if (tasks && !tid && req.method === 'POST') {
+      const { text, projectId } = await readJson(req, 64 * 1024);
+      let project = otsOrquesta(ots).project;
+      if (projectId) {
+        const p = (await listProjects(account.id)).find((x) => x.id === String(projectId));
+        if (!p) return send(res, 404, { error: 'that project is not shared with 7ots' }), true;
+        project = p.id;
+      }
+      if (!project) return send(res, 400, { error: 'pick a project' }), true;
+      // the owner, from their own computer: tasks on for this one, the chosen project
+      const out = await runTask({ ...ots, settings: { ...ots.settings, ORQUESTA_TASKS: '1', ORQUESTA_PROJECT: project } }, { task: text, who: `owner ${account.email || account.id}`, channel: 'desktop' });
+      return send(res, out.ok === false && !out.id ? 400 : 200, out), true;
+    }
+    if (tid && req.method === 'GET') return send(res, 200, await taskStatus(ots, tid)), true;
+    return send(res, 405, { error: 'method' }), true;
+  }
+
   /** Dashboard half, already behind the session + same-origin checks. @returns {boolean} */
   async function dashboard(req, res, account, path) {
     const m = /^\/device\/([A-Za-z0-9]{8,40})$/.exec(path);

package/server/platform/mods.mjs

@@ -0,0 +1,222 @@
+/**
+ * Community mods: looks that people share for any ot (src/character/mods.js), with installs,
+ * 1–5 star ratings (one per account, only after installing) and reports.
+ *
+ * New mods wait for an admin (PLATFORM_ADMINS: emails, comma separated) unless an admin uploads
+ * them. A mod reported by MOD_REPORTS_HIDE accounts (default 3) is hidden until reviewed.
+ *
+ * Public (any origin):
+ *   GET  /api/mods[?sort=top|new|popular&q=…]   → { mods: [view] }   approved only
+ *   GET  /api/mods/:id                          → { mod: view }
+ * Signed in, from the dashboard (/api/platform/mods/*, session) or the pet (/api/device/mods/*, bearer):
+ *   GET    /mods/mine            → { mods: [view], admin, pending: [view] (admins) }
+ *   POST   /mods                 { mod }  → publish or update one of yours (by its id)
+ *   POST   /mods/files?ext=glb|vrm  raw body (≤ 20 MB) → { url: '/mods/<sha16>.<ext>' }
+ *   POST   /mods/:id/install     → { mod: view }   (counts once per account)
+ *   POST   /mods/:id/rate        { stars: 1..5 }
+ *   POST   /mods/:id/report      { reason }
+ *   POST   /mods/:id/review      { status: approved|rejected|hidden }   (admins)
+ *   DELETE /mods/:id             (its author or an admin)
+ */
+
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { normalizeMod } from '../../src/character/mods.js';
+import { dataDir, getDb } from './db.mjs';
+
+const MAX_FILE = 20 * 1024 * 1024;
+const MAX_MOD_JSON = 2 * 1024 * 1024;
+const STATUSES = ['pending', 'approved', 'rejected', 'hidden'];
+const MODEL = /^\/mods\/([a-f0-9]{16})\.(glb|vrm)$/;
+
+let ready = false;
+function db() {
+  const d = getDb();
+  if (!ready) {
+    d.exec(`
+CREATE TABLE IF NOT EXISTS community_mods (
+  id TEXT PRIMARY KEY,
+  account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+  author TEXT NOT NULL DEFAULT '',
+  mod TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  installs INTEGER NOT NULL DEFAULT 0,
+  stars_sum INTEGER NOT NULL DEFAULT 0,
+  stars_n INTEGER NOT NULL DEFAULT 0,
+  reports INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS community_mods_status ON community_mods(status, created_at DESC);
+CREATE TABLE IF NOT EXISTS mod_installs (mod_id TEXT NOT NULL REFERENCES community_mods(id) ON DELETE CASCADE, account_id TEXT NOT NULL, at INTEGER NOT NULL, PRIMARY KEY (mod_id, account_id));
+CREATE TABLE IF NOT EXISTS mod_ratings (mod_id TEXT NOT NULL REFERENCES community_mods(id) ON DELETE CASCADE, account_id TEXT NOT NULL, stars INTEGER NOT NULL, at INTEGER NOT NULL, PRIMARY KEY (mod_id, account_id));
+CREATE TABLE IF NOT EXISTS mod_reports (mod_id TEXT NOT NULL REFERENCES community_mods(id) ON DELETE CASCADE, account_id TEXT NOT NULL, reason TEXT NOT NULL DEFAULT '', at INTEGER NOT NULL, PRIMARY KEY (mod_id, account_id));
+`);
+    ready = true;
+  }
+  return d;
+}
+
+export const isModAdmin = (account) =>
+  !!account?.email && String(process.env.PLATFORM_ADMINS || '').toLowerCase().split(/[\s,]+/).filter(Boolean).includes(account.email.toLowerCase());
+
+const authorOf = (a) => String(a.name || (a.email || '').split('@')[0] || 'anon').slice(0, 40);
+
+function view(row, me) {
+  if (!row) return null;
+  const v = {
+    id: row.id,
+    mod: JSON.parse(row.mod),
+    author: row.author,
+    status: row.status,
+    installs: row.installs,
+    rating: row.stars_n ? Math.round((row.stars_sum / row.stars_n) * 10) / 10 : null,
+    ratings: row.stars_n,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+  if (me) {
+    const d = db();
+    v.mine = row.account_id === me.id;
+    v.installed = !!d.prepare('SELECT 1 FROM mod_installs WHERE mod_id = ? AND account_id = ?').get(row.id, me.id);
+    v.myStars = d.prepare('SELECT stars FROM mod_ratings WHERE mod_id = ? AND account_id = ?').get(row.id, me.id)?.stars || null;
+    v.reported = !!d.prepare('SELECT 1 FROM mod_reports WHERE mod_id = ? AND account_id = ?').get(row.id, me.id);
+  }
+  return v;
+}
+
+const ORDER = {
+  // Bayesian average: a single 5★ does not beat many 4.5★
+  top: '(stars_sum + 3.0 * 2) / (stars_n + 2) DESC, installs DESC, created_at DESC',
+  new: 'created_at DESC',
+  popular: 'installs DESC, stars_n DESC, created_at DESC',
+};
+
+export function listMods({ sort = 'top', q = '', limit = 60 } = {}) {
+  const like = `%${String(q).toLowerCase().replace(/[%_]/g, '').slice(0, 40)}%`;
+  return db()
+    .prepare(`SELECT * FROM community_mods WHERE status = 'approved' AND (lower(id) LIKE ? OR lower(mod) LIKE ? OR lower(author) LIKE ?) ORDER BY ${ORDER[sort] || ORDER.top} LIMIT ?`)
+    .all(like, like, like, Math.min(100, Math.max(1, Number(limit) || 60)));
+}
+
+/** A model a mod points at must already be on 7ots.com (uploaded first through /mods/files). */
+function modelsMissing(mod) {
+  const urls = [mod.model?.url].filter((u) => MODEL.test(u || ''));
+  return urls.filter((u) => !existsSync(join(dataDir(), 'mods', u.slice('/mods/'.length))));
+}
+
+export function createMods({ send, readJson }) {
+  /** Public half. @returns {Promise<boolean>} */
+  async function publicApi(req, res, path) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    if (req.method === 'OPTIONS') return send(res, 204), true;
+    if (req.method !== 'GET') return false;
+    if (path === '' || path === '/') {
+      const u = new URL(req.url, 'http://x');
+      return send(res, 200, { mods: listMods({ sort: u.searchParams.get('sort'), q: u.searchParams.get('q') || '', limit: u.searchParams.get('limit') }).map((r) => view(r)) }), true;
+    }
+    const m = /^\/([a-z0-9-]{1,32})$/.exec(path);
+    if (m) {
+      const row = db().prepare("SELECT * FROM community_mods WHERE id = ? AND status = 'approved'").get(m[1]);
+      return row ? send(res, 200, { mod: view(row) }) : send(res, 404, { error: 'not found' }), true;
+    }
+    return false;
+  }
+
+  /** Signed-in half (account from the session or a device). path is after /mods. @returns {Promise<boolean>} */
+  async function accountApi(req, res, account, path) {
+    const d = db();
+    const admin = isModAdmin(account);
+    const now = Date.now();
+    if (path === '' && req.method === 'GET') {
+      const u = new URL(req.url, 'http://x');
+      return send(res, 200, { mods: listMods({ sort: u.searchParams.get('sort'), q: u.searchParams.get('q') || '' }).map((r) => view(r, account)) }), true;
+    }
+    if (path === '/mine' && req.method === 'GET') {
+      const mine = d.prepare('SELECT * FROM community_mods WHERE account_id = ? ORDER BY updated_at DESC').all(account.id).map((r) => view(r, account));
+      const pending = admin ? d.prepare("SELECT * FROM community_mods WHERE status IN ('pending', 'hidden') ORDER BY reports DESC, created_at").all().map((r) => ({ ...view(r, account), reports: r.reports })) : [];
+      return send(res, 200, { mods: mine, admin, pending }), true;
+    }
+    if (path === '/files' && req.method === 'POST') {
+      const ext = new URL(req.url, 'http://x').searchParams.get('ext');
+      if (!['glb', 'vrm'].includes(ext)) return send(res, 400, { error: 'ext' }), true;
+      const chunks = [];
+      let size = 0;
+      for await (const c of req) {
+        size += c.length;
+        if (size > MAX_FILE) return send(res, 413, { error: 'max 20 MB' }), true;
+        chunks.push(c);
+      }
+      const buf = Buffer.concat(chunks);
+      if (buf.length < 20 || buf.toString('latin1', 0, 4) !== 'glTF') return send(res, 400, { error: 'not a glTF binary (.glb/.vrm)' }), true;
+      const h = createHash('sha256').update(buf).digest('hex').slice(0, 16);
+      mkdirSync(join(dataDir(), 'mods'), { recursive: true });
+      writeFileSync(join(dataDir(), 'mods', `${h}.${ext}`), buf);
+      return send(res, 200, { url: `/mods/${h}.${ext}` }), true;
+    }
+    if (path === '' && req.method === 'POST') {
+      const body = await readJson(req, MAX_MOD_JSON + 4096);
+      const mod = normalizeMod(body?.mod);
+      if (!mod) return send(res, 400, { error: 'mod' }), true;
+      if (!mod.model && !mod.parts.length && !Object.keys(mod.character).length) return send(res, 400, { error: 'empty mod' }), true;
+      const missing = modelsMissing(mod);
+      if (missing.length) return send(res, 409, { error: 'upload the model first', missing }), true;
+      const prev = d.prepare('SELECT account_id FROM community_mods WHERE id = ?').get(mod.id);
+      if (prev && prev.account_id !== account.id) return send(res, 409, { error: 'id taken' }), true;
+      const json = JSON.stringify({ ...mod, by: mod.by || authorOf(account) });
+      if (prev) d.prepare("UPDATE community_mods SET mod = ?, status = ?, updated_at = ? WHERE id = ?").run(json, admin ? 'approved' : 'pending', now, mod.id);
+      else d.prepare('INSERT INTO community_mods (id, account_id, author, mod, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)').run(mod.id, account.id, authorOf(account), json, admin ? 'approved' : 'pending', now, now);
+      return send(res, prev ? 200 : 201, { mod: view(d.prepare('SELECT * FROM community_mods WHERE id = ?').get(mod.id), account) }), true;
+    }
+    const m = /^\/([a-z0-9-]{1,32})(\/(install|rate|report|review))?$/.exec(path);
+    if (!m) return false;
+    const row = d.prepare('SELECT * FROM community_mods WHERE id = ?').get(m[1]);
+    // authors and admins see their mod whatever its status; everyone else only approved ones
+    if (!row || (row.status !== 'approved' && row.account_id !== account.id && !admin)) return send(res, 404, { error: 'not found' }), true;
+    const action = m[3];
+    if (!action && req.method === 'GET') return send(res, 200, { mod: view(row, account) }), true;
+    if (!action && req.method === 'DELETE') {
+      if (row.account_id !== account.id && !admin) return send(res, 403, { error: 'not yours' }), true;
+      d.prepare('DELETE FROM community_mods WHERE id = ?').run(row.id);
+      return send(res, 200, { ok: true }), true;
+    }
+    if (req.method !== 'POST') return send(res, 405, { error: 'method' }), true;
+    if (action === 'install') {
+      const r = d.prepare('INSERT OR IGNORE INTO mod_installs (mod_id, account_id, at) VALUES (?, ?, ?)').run(row.id, account.id, now);
+      if (r.changes) d.prepare('UPDATE community_mods SET installs = installs + 1 WHERE id = ?').run(row.id);
+      return send(res, 200, { mod: view(d.prepare('SELECT * FROM community_mods WHERE id = ?').get(row.id), account) }), true;
+    }
+    if (action === 'rate') {
+      const stars = Math.round(Number((await readJson(req, 1024))?.stars));
+      if (!(stars >= 1 && stars <= 5)) return send(res, 400, { error: 'stars 1-5' }), true;
+      if (row.account_id === account.id) return send(res, 403, { error: 'own mod' }), true;
+      if (!d.prepare('SELECT 1 FROM mod_installs WHERE mod_id = ? AND account_id = ?').get(row.id, account.id)) return send(res, 403, { error: 'install it first' }), true;
+      const old = d.prepare('SELECT stars FROM mod_ratings WHERE mod_id = ? AND account_id = ?').get(row.id, account.id);
+      d.prepare('INSERT INTO mod_ratings (mod_id, account_id, stars, at) VALUES (?, ?, ?, ?) ON CONFLICT(mod_id, account_id) DO UPDATE SET stars = excluded.stars, at = excluded.at').run(row.id, account.id, stars, now);
+      d.prepare('UPDATE community_mods SET stars_sum = stars_sum + ?, stars_n = stars_n + ? WHERE id = ?').run(stars - (old?.stars || 0), old ? 0 : 1, row.id);
+      return send(res, 200, { mod: view(d.prepare('SELECT * FROM community_mods WHERE id = ?').get(row.id), account) }), true;
+    }
+    if (action === 'report') {
+      const reason = String((await readJson(req, 4096))?.reason || '').replace(/[\u0000-\u001f]/g, ' ').trim().slice(0, 300);
+      const r = d.prepare('INSERT OR IGNORE INTO mod_reports (mod_id, account_id, reason, at) VALUES (?, ?, ?, ?)').run(row.id, account.id, reason, now);
+      if (r.changes) {
+        d.prepare('UPDATE community_mods SET reports = reports + 1 WHERE id = ?').run(row.id);
+        const hide = Number(process.env.MOD_REPORTS_HIDE || 3);
+        d.prepare("UPDATE community_mods SET status = 'hidden' WHERE id = ? AND status = 'approved' AND reports >= ?").run(row.id, hide);
+      }
+      return send(res, 200, { ok: true }), true;
+    }
+    if (action === 'review') {
+      if (!admin) return send(res, 403, { error: 'admins only' }), true;
+      const status = (await readJson(req, 1024))?.status;
+      if (!STATUSES.includes(status)) return send(res, 400, { error: 'status' }), true;
+      d.prepare('UPDATE community_mods SET status = ?, reports = CASE WHEN ? = \'approved\' THEN 0 ELSE reports END, updated_at = ? WHERE id = ?').run(status, status, now, row.id);
+      if (status === 'approved') d.prepare('DELETE FROM mod_reports WHERE mod_id = ?').run(row.id);
+      return send(res, 200, { mod: view(d.prepare('SELECT * FROM community_mods WHERE id = ?').get(row.id), account) }), true;
+    }
+    return false;
+  }
+
+  return { publicApi, accountApi };
+}