kcg-code 0.0.0-stage → 0.2.0

package/src/lib/api.ts

@@ -0,0 +1,306 @@
+/**
+ * Helper fetch API KCG Code (task 24).
+ *
+ * - Kesalahan HTTP dilempar sebagai `ApiError` dengan `status` dan `code`
+ *   (dari body `{ error }`) agar komponen menampilkan pesan yang tepat.
+ */
+
+/** Error hasil permintaan API dengan status HTTP dan kode domain. */
+export class ApiError extends Error {
+  readonly status: number;
+  readonly code: string;
+  /** Body JSON respons error (detail tambahan, mis. daftar item penghalang). */
+  readonly body: Record<string, unknown> | null;
+
+  constructor(
+    status: number,
+    code: string,
+    message: string,
+    body?: Record<string, unknown> | null,
+  ) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+    this.body = body ?? null;
+  }
+}
+
+/**
+ * Dipanggil saat server membalas 401 `AUTH_REQUIRED` (sesi habis / terkunci
+ * otomatis / dicabut) — lock screen dipasang oleh `lib/auth.ts`.
+ */
+let onAuthRequired: (() => void) | null = null;
+export function setAuthRequiredHandler(fn: (() => void) | null): void {
+  onAuthRequired = fn;
+}
+
+/** Pemetaan kode error domain -> pesan ramah pengguna (design.md — Error Handling). */
+export function apiErrorMessage(code: string): string {
+  // Kode dari server headless opencode membawa detail status, mis.
+  // "OC_LIST_MODELS_FAILED(500)" -> cocokkan berdasarkan prefiks.
+  if (code.startsWith("OC_LIST_MODELS_FAILED")) {
+    return "Failed to load the model list from the opencode server.";
+  }
+  if (code.startsWith("OC_CREATE_SESSION_FAILED")) {
+    return "Failed to create the session on the opencode server.";
+  }
+  if (code.startsWith("OC_DELETE_SESSION_FAILED")) {
+    return "Failed to delete the session on the opencode server.";
+  }
+  if (code.startsWith("SKILLS_SEARCH_FAILED") || code.startsWith("SKILLS_AUDIT_FAILED")) {
+    return "Couldn't reach skills.sh. Check your connection and try again.";
+  }
+  if (code.startsWith("SERVER_START_FAILED")) {
+    return "Failed to start the opencode server for this project.";
+  }
+
+  switch (code) {
+    case "NAME_REQUIRED":
+      return "Project name is required.";
+    case "NAME_TAKEN":
+      return "That project name is already in use.";
+    case "PATH_TAKEN":
+      return "That path is already used by another project.";
+    case "PATH_OUTSIDE_SANDBOX":
+      return "The path is outside the Sandbox root.";
+    case "INVALID_PATH_CHARS":
+      return "The path contains invalid characters.";
+    case "PROJECT_NOT_FOUND":
+      return "Project not found.";
+    case "PROJECT_DIR_NOT_FOUND":
+      return "The project directory was not found on the server.";
+    case "PROJECT_HAS_SESSIONS":
+      return "The project still has sessions. Delete them first.";
+    case "UNSUPPORTED_AGENT_TYPE":
+      return "This CLI_Agent type is not supported.";
+    case "SESSION_NOT_FOUND":
+      return "Session not found.";
+    case "SESSION_NOT_RUNNING":
+      return "The session is not running.";
+    case "SESSION_ALREADY_RUNNING":
+      return "The session is already running.";
+    case "MODEL_NOT_FOUND":
+      return "The model is not available on this project's opencode server.";
+    case "INVALID_INSTRUCTIONS":
+      return "Instructions must be text.";
+    case "INSTRUCTIONS_TOO_LONG":
+      return "Instructions are too long (max 20,000 characters).";
+    case "INVALID_SKILL_QUERY":
+      return "Type at least 2 characters to search.";
+    case "INVALID_SKILL_ID":
+      return "That skill identifier is not valid.";
+    case "SKILLS_RATE_LIMITED":
+      return "skills.sh is rate limiting requests. Wait a moment and try again.";
+    case "SKILL_INSTALL_IN_PROGRESS":
+      return "Another skill is being installed in this project. Try again when it finishes.";
+    case "SKILL_INSTALL_FAILED":
+      return "Failed to install the skill. See the output for details.";
+    case "SKILL_INSTALL_CANCELLED":
+      return "Installation was cancelled.";
+    case "SKILL_INSTALL_TIMEOUT":
+      return "Installation timed out and was stopped.";
+    case "INSTALL_JOB_NOT_RUNNING":
+      return "That installation has already finished.";
+    case "INSTALL_JOB_LOST":
+      return "The server restarted before the installation finished.";
+    case "INSTALL_JOB_NOT_FOUND":
+      return "That installation is no longer available.";
+    case "AUTH_REQUIRED":
+      return "Your session is locked. Unlock to continue.";
+    case "AUTH_INVALID":
+      return "Incorrect PIN or password.";
+    case "CURRENT_SECRET_INVALID":
+      return "Your current PIN or password is incorrect.";
+    case "AUTH_RATE_LIMITED":
+      return "Too many attempts. Wait a moment and try again.";
+    case "AUTH_NOT_CONFIGURED":
+      return "No lock has been set up yet.";
+    case "WORKSPACE_PATH_REQUIRED":
+      return "Enter a folder path.";
+    case "WORKSPACE_PATH_INVALID":
+      return "That path isn't valid.";
+    case "WORKSPACE_PATH_NOT_ABSOLUTE":
+      return "Use a full path, like ~/code or /srv/projects.";
+    case "WORKSPACE_NOT_FOUND":
+      return 'That folder doesn\'t exist. Tick "Create the folder" to make it.';
+    case "WORKSPACE_PARENT_NOT_FOUND":
+      return "The folder above it doesn't exist. Only the last folder can be created.";
+    case "WORKSPACE_NOT_DIRECTORY":
+      return "That path is a file, not a folder.";
+    case "WORKSPACE_TOO_BROAD":
+      return "That folder is too broad. Pick a dedicated folder, not your home or a system folder.";
+    case "WORKSPACE_CONTAINS_APP_DATA":
+      return "That folder overlaps KCG Code's own data. Pick a different folder.";
+    case "WORKSPACE_NOT_WRITABLE":
+      return "KCG Code can't write to that folder. Check its permissions.";
+    case "WORKSPACE_PROJECTS_OUTSIDE":
+      return "Some projects are outside the new folder. Remove them or pick a folder that contains them:";
+    case "WORKSPACE_CREATE_FAILED":
+      return "Couldn't create the folder.";
+    case "WORKSPACE_CONFIG_UNREADABLE":
+    case "WORKSPACE_CONFIG_WRITE_FAILED":
+      return "Couldn't save the config file. Check its permissions.";
+    case "PASSKEY_INVALID":
+      return "That passkey wasn't accepted. Try again or use your PIN or password.";
+    case "PASSKEY_NONE":
+      return "No passkey is set up for this address yet.";
+    case "PASSKEY_UNSUPPORTED_ORIGIN":
+      return "Passkeys need a secure address (https or localhost).";
+    case "PASSKEY_CHALLENGE_INVALID":
+      return "The passkey request expired. Try again.";
+    case "PASSKEY_VERIFY_FAILED":
+      return "Couldn't verify the passkey. Try again.";
+    case "PASSKEY_ALREADY_REGISTERED":
+      return "This passkey is already added.";
+    case "PASSKEY_LIMIT":
+      return "You've reached the maximum of 20 passkeys. Remove one first.";
+    case "PASSKEY_LOCK_REQUIRED":
+      return "Set up a PIN or password before adding a passkey.";
+    case "PASSKEY_NAME_INVALID":
+      return "Passkey names must be 1–60 characters.";
+    case "PASSKEY_NOT_FOUND":
+      return "That passkey no longer exists.";
+    case "PIN_DIGITS_ONLY":
+      return "PIN can only contain numbers.";
+    case "PIN_LENGTH":
+      return "PIN must be 6–12 digits.";
+    case "PIN_TOO_SIMPLE":
+      return "That PIN is too easy to guess. Avoid repeated or sequential digits.";
+    case "PASSWORD_TOO_SHORT":
+      return "Password must be at least 8 characters.";
+    case "PASSWORD_TOO_LONG":
+      return "Password must be at most 128 characters.";
+    case "NICKNAME_TOO_LONG":
+      return "Nickname must be at most 40 characters.";
+    case "NICKNAME_INVALID":
+      return "Nickname contains invalid characters.";
+    case "AVATAR_PRESET_INVALID":
+      return "That avatar isn't available.";
+    case "AVATAR_TOO_LARGE":
+      return "The photo exceeds the 2 MB limit.";
+    case "ORIGIN_FORBIDDEN":
+      return "Request blocked: it didn't come from this app.";
+    case "INVALID_JSON":
+      return "The request JSON format is invalid.";
+    case "UNSUPPORTED_IMAGE_MIME":
+      return "Unsupported image format. Use PNG, JPEG, GIF, or WebP.";
+    case "IMAGE_TOO_LARGE":
+      return "The image exceeds the 20 MiB limit.";
+    case "FILE_TOO_LARGE":
+      return "The file exceeds the 20 MiB limit.";
+    case "EMPTY_UPLOAD":
+      return "The file is empty.";
+    case "ATTACHMENT_NOT_FOUND":
+      return "The attachment was not found (it may have been deleted).";
+    case "TUNNEL_LOCK_REQUIRED":
+      return "Set an app lock before turning on remote access.";
+    case "TUNNEL_NOT_CONFIGURED":
+      return "Remote access isn't configured. Set KCG_TUNNEL_API_URL and restart kcgcode.";
+    case "TUNNEL_SIGNED_OUT":
+      return "Connect this machine first.";
+    case "TUNNEL_PAIRING_EXPIRED":
+      return "The code expired before it was approved. Connect again.";
+    case "TUNNEL_PAIRING_DENIED":
+      return "The request was denied on the sign-in page.";
+    case "TUNNEL_DEVICE_REVOKED":
+      return "This machine was disconnected from your account. Connect again.";
+    case "TUNNEL_RATE_LIMITED":
+      return "Too many attempts. Wait a few minutes and try again.";
+    case "TUNNEL_API_UNREACHABLE":
+      return "Couldn't reach the remote access service. Check your connection.";
+    case "TUNNEL_AUTH_FAILED":
+      return "The tunnel server rejected this device. Try rotating the secret.";
+    case "TUNNEL_PROXY_FAILED":
+      return "The tunnel server couldn't publish your address. See the log for details.";
+    case "FRPC_UNSUPPORTED_PLATFORM":
+      return "Remote access isn't supported on this OS or CPU yet.";
+    case "LHR_SSH_MISSING":
+      return "localhost.run needs the ssh command, which wasn't found on this computer.";
+    case "LHR_START_FAILED":
+      return "Couldn't start the connection to localhost.run.";
+    case "LHR_DENIED":
+      return "localhost.run refused the connection. Try again in a moment.";
+    case "INVALID_PROVIDER":
+      return "Unknown remote access option.";
+    case "FRPC_DOWNLOAD_FAILED":
+    case "FRPC_NOT_FOUND":
+      return "Couldn't install the tunnel client (frpc). See the log for details.";
+    case "FRPC_CHECKSUM_MISMATCH":
+      return "The downloaded tunnel client failed verification and was discarded.";
+    case "FRPC_START_FAILED":
+      return "Couldn't start the tunnel client. See the log for details.";
+    default:
+      return `Something went wrong (${code}).`;
+  }
+}
+
+/**
+ * `fetch` dengan header otentikasi & penanganan error terstruktur.
+ * Melempar `ApiError` untuk status selain 2xx.
+ */
+export async function apiFetch(path: string, init: RequestInit = {}): Promise<Response> {
+  const headers = new Headers(init.headers);
+  // FormData/Blob: browser yang menetapkan content-type (+ boundary multipart).
+  const browserTyped =
+    init.body instanceof FormData ||
+    init.body instanceof Blob ||
+    init.body instanceof URLSearchParams;
+  if (init.body != null && !browserTyped && !headers.has("content-type")) {
+    headers.set("content-type", "application/json");
+  }
+  const res = await fetch(path, { ...init, headers });
+  if (!res.ok) {
+    let code = `HTTP_${res.status}`;
+    let body: Record<string, unknown> | null = null;
+    try {
+      const parsed = (await res.json()) as unknown;
+      if (parsed && typeof parsed === "object") {
+        body = parsed as Record<string, unknown>;
+        if (typeof body.error === "string" && body.error !== "") code = body.error;
+      }
+    } catch {
+      // body bukan JSON — pakai kode HTTP default.
+    }
+    if (res.status === 401 && code === "AUTH_REQUIRED") onAuthRequired?.();
+    throw new ApiError(res.status, code, apiErrorMessage(code), body);
+  }
+  return res;
+}
+
+/**
+ * Upload satu file (jenis apa pun) ke endpoint lampiran Session.
+ * `fetch` multipart mengelola boundary-nya sendiri, jadi content-type TIDAK
+ * di-set manual.
+ */
+export async function apiUploadFile(
+  path: string,
+  file: File,
+): Promise<{ id: string; filename: string; mime: string; size: number }> {
+  const body = new FormData();
+  body.append("file", file);
+  const res = await fetch(path, { method: "POST", body });
+  if (!res.ok) {
+    let code = `HTTP_${res.status}`;
+    try {
+      const parsed = (await res.json()) as { error?: string };
+      if (typeof parsed.error === "string" && parsed.error !== "") code = parsed.error;
+    } catch {
+      // body bukan JSON — pakai kode HTTP default.
+    }
+    if (res.status === 401 && code === "AUTH_REQUIRED") onAuthRequired?.();
+    throw new ApiError(res.status, code, apiErrorMessage(code));
+  }
+  const parsed = (await res.json()) as {
+    upload?: { id: string; filename: string; mime: string; size: number };
+  };
+  if (typeof parsed.upload?.id !== "string") {
+    throw new ApiError(res.status, "INVALID_UPLOAD_RESPONSE", "Invalid upload response.");
+  }
+  return parsed.upload;
+}
+
+/** URL HTTP untuk memuat gambar lampiran di `<img>`. */
+export function attachmentUrl(sessionId: string, attachmentId: string): string {
+  return `/api/uploads/${encodeURIComponent(sessionId)}/${encodeURIComponent(attachmentId)}`;
+}

package/src/lib/attachments.ts

@@ -0,0 +1,203 @@
+/**
+ * Jenis lampiran upload — logika murni, dipakai server (routing ke model)
+ * maupun browser (thumbnail vs kartu file).
+ *
+ * Provider AI yang dibungkus opencode hanya menerima part `file` bermime
+ * `image/*` (format umum), `application/pdf`, dan `text/plain`. Mime lain
+ * (mis. `text/csv`, `application/json`) memicu error "functionality not
+ * supported" dan — karena part tersimpan di riwayat — merusak seluruh turn
+ * berikutnya. Karena itu:
+ * - gambar umum & PDF dikirim apa adanya,
+ * - file teks/kode dikirim ulang sebagai `text/plain` (opencode membacanya
+ *   lewat tool Read, sama seperti `@file`),
+ * - file biner lain TIDAK dikirim sebagai part; model hanya diberi tahu
+ *   path-nya agar bisa memakai tool bila perlu.
+ */
+
+/** Batas ukuran upload (byte) — mengikuti limit attachment opencode (20 MiB). */
+export const MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+
+/** Gambar yang bisa dipratinjau browser & diterima provider sebagai gambar. */
+const PREVIEWABLE_IMAGE_MIME = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
+
+/** Ekstensi file teks/kode yang aman dibaca sebagai teks. */
+const TEXT_EXTENSIONS = new Set([
+  "txt",
+  "md",
+  "markdown",
+  "mdx",
+  "rst",
+  "log",
+  "csv",
+  "tsv",
+  "json",
+  "jsonc",
+  "json5",
+  "ndjson",
+  "yaml",
+  "yml",
+  "toml",
+  "ini",
+  "cfg",
+  "conf",
+  "env",
+  "xml",
+  "html",
+  "htm",
+  "css",
+  "scss",
+  "sass",
+  "less",
+  "svg",
+  "js",
+  "mjs",
+  "cjs",
+  "jsx",
+  "ts",
+  "mts",
+  "cts",
+  "tsx",
+  "vue",
+  "svelte",
+  "astro",
+  "py",
+  "rb",
+  "php",
+  "java",
+  "kt",
+  "kts",
+  "scala",
+  "go",
+  "rs",
+  "c",
+  "h",
+  "cc",
+  "cpp",
+  "hpp",
+  "cs",
+  "swift",
+  "m",
+  "dart",
+  "lua",
+  "pl",
+  "r",
+  "jl",
+  "ex",
+  "exs",
+  "erl",
+  "hs",
+  "clj",
+  "sql",
+  "graphql",
+  "gql",
+  "proto",
+  "sh",
+  "bash",
+  "zsh",
+  "fish",
+  "ps1",
+  "bat",
+  "dockerfile",
+  "makefile",
+  "gradle",
+  "tf",
+  "hcl",
+  "nix",
+  "lock",
+  "diff",
+  "patch",
+  "tex",
+  "bib",
+  "srt",
+  "vtt",
+]);
+
+/** Nama file tanpa ekstensi yang umum berisi teks. */
+const TEXT_BASENAMES = new Set(["dockerfile", "makefile", "readme", "license", "gemfile"]);
+
+export type AttachmentKind = "image" | "pdf" | "text" | "binary";
+
+/** Ekstensi huruf kecil (tanpa titik), "" bila tidak ada. */
+export function fileExtension(filename: string): string {
+  const base = filename.split(/[\\/]/).pop() ?? "";
+  const dot = base.lastIndexOf(".");
+  return dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
+}
+
+function isTextMime(mime: string): boolean {
+  return (
+    mime.startsWith("text/") ||
+    mime === "application/json" ||
+    mime === "application/xml" ||
+    mime === "application/javascript" ||
+    mime === "application/x-sh" ||
+    mime === "application/sql" ||
+    mime === "application/yaml" ||
+    mime === "application/toml" ||
+    mime.endsWith("+json") ||
+    mime.endsWith("+xml")
+  );
+}
+
+/** Gambar yang boleh ditampilkan inline di browser (thumbnail / bubble). */
+export function isPreviewableImage(mime: string): boolean {
+  return PREVIEWABLE_IMAGE_MIME.has(mime);
+}
+
+/**
+ * Golongkan lampiran. Ekstensi dicek lebih dulu untuk file kode karena
+ * browser sering salah menebak mime-nya (mis. `.ts` jadi `video/mp2t`,
+ * `.rs` kosong).
+ */
+export function attachmentKind(mime: string, filename: string): AttachmentKind {
+  const m = mime.toLowerCase();
+  if (isPreviewableImage(m)) return "image";
+  if (m === "application/pdf") return "pdf";
+  const ext = fileExtension(filename);
+  const base = (filename.split(/[\\/]/).pop() ?? "").toLowerCase();
+  if (TEXT_EXTENSIONS.has(ext) || (ext === "" && TEXT_BASENAMES.has(base))) return "text";
+  if (isTextMime(m)) return "text";
+  return "binary";
+}
+
+/**
+ * Mime part `file` yang dikirim ke model, atau null bila file tidak boleh
+ * dikirim sebagai part (biner) — cukup dirujuk lewat path.
+ */
+export function modelFacingMime(mime: string, filename: string): string | null {
+  switch (attachmentKind(mime, filename)) {
+    case "image":
+      return mime.toLowerCase();
+    case "pdf":
+      return "application/pdf";
+    case "text":
+      return "text/plain";
+    default:
+      return null;
+  }
+}
+
+/**
+ * Mime yang disimpan server: hanya bentuk `type/subtype` sederhana yang
+ * diterima (header Content-Type tidak boleh bisa disuntik); lainnya jadi
+ * `application/octet-stream`.
+ */
+export function normalizeMime(mime: string): string {
+  const m = mime.trim().toLowerCase();
+  return /^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,127}$/.test(m)
+    ? m
+    : "application/octet-stream";
+}
+
+/** Ukuran file ramah baca (mis. "1.2 MB"). */
+export function formatBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`;
+  const units = ["KB", "MB", "GB"];
+  let v = bytes / 1024;
+  let i = 0;
+  while (v >= 1024 && i < units.length - 1) {
+    v /= 1024;
+    i++;
+  }
+  return `${v < 10 ? v.toFixed(1) : Math.round(v)} ${units[i]}`;
+}

package/src/lib/auth.ts

@@ -0,0 +1,92 @@
+/**
+ * Store global kunci aplikasi (FE): status dari server + pemicu lock screen.
+ *
+ * - `refreshAuth()` memuat `GET /api/auth/status` (publik).
+ * - 401 `AUTH_REQUIRED` dari API mana pun -> `markLocked()` (lock screen
+ *   muncul tanpa reload; data di belakangnya tidak lagi bisa dimuat).
+ * - `lockNow()` = tombol Lock: hapus sesi di server lalu tampilkan lock screen.
+ * - Kunci otomatis ditegakkan SERVER (sesi idle kedaluwarsa); klien hanya
+ *   mengetahuinya lebih cepat lewat timer idle lokal + heartbeat.
+ */
+import { useSyncExternalStore } from "react";
+import { apiFetch, setAuthRequiredHandler } from "@/lib/api";
+import type { AuthStatus } from "@/server/services/auth";
+
+export type AuthState =
+  | { phase: "loading" }
+  /** Server tak terjangkau saat memuat status pertama kali. */
+  | { phase: "error" }
+  | { phase: "ready"; status: AuthStatus };
+
+let state: AuthState = { phase: "loading" };
+const listeners = new Set<() => void>();
+
+function set(next: AuthState): void {
+  state = next;
+  for (const l of listeners) l();
+}
+
+export async function refreshAuth(): Promise<AuthStatus | null> {
+  try {
+    const res = await fetch("/api/auth/status", { cache: "no-store" });
+    if (!res.ok) throw new Error(String(res.status));
+    const status = (await res.json()) as AuthStatus;
+    // Status sama persis -> jangan picu render ulang (heartbeat berkala).
+    if (state.phase !== "ready" || JSON.stringify(state.status) !== JSON.stringify(status)) {
+      set({ phase: "ready", status });
+    }
+    return status;
+  } catch {
+    if (state.phase === "loading") set({ phase: "error" });
+    return null;
+  }
+}
+
+/** Server menolak sesi (401) -> kunci UI segera, lalu sinkronkan status. */
+export function markLocked(): void {
+  if (state.phase === "ready" && state.status.protected && state.status.authenticated) {
+    set({ phase: "ready", status: { ...state.status, authenticated: false } });
+  }
+  void refreshAuth();
+}
+
+/** Tombol Lock: akhiri sesi perangkat ini. */
+export async function lockNow(): Promise<void> {
+  try {
+    await apiFetch("/api/auth/logout", { method: "POST" });
+  } catch {
+    // Sesi mungkin sudah tidak berlaku — tetap tampilkan lock screen.
+  }
+  markLocked();
+}
+
+setAuthRequiredHandler(markLocked);
+
+function subscribe(l: () => void): () => void {
+  listeners.add(l);
+  return () => listeners.delete(l);
+}
+
+function snapshot(): AuthState {
+  return state;
+}
+
+export function useAuth(): AuthState {
+  return useSyncExternalStore(subscribe, snapshot, snapshot);
+}
+
+/** Label jenis kunci untuk UI. */
+export function lockLabel(kind: "pin" | "password"): string {
+  return kind === "pin" ? "PIN" : "password";
+}
+
+/** Inisial nickname untuk avatar pengganti ("Irsyad Ibad" -> "II"). */
+export function initialsOf(nickname: string | null): string {
+  if (!nickname) return "";
+  const words = nickname.trim().split(/\s+/).filter(Boolean);
+  const letters = words.length > 1 ? [words[0], words[words.length - 1]] : [words[0]];
+  return letters
+    .map((w) => [...(w ?? "")][0] ?? "")
+    .join("")
+    .toUpperCase();
+}

package/src/lib/avatar-presets.ts

@@ -0,0 +1,31 @@
+/**
+ * Katalog avatar bawaan (preset). Dibagi server & FE:
+ * - Server hanya memvalidasi id (`isAvatarPresetId`) — tidak mengimpor ikon.
+ * - FE memetakan id -> ikon lucide + warna di `components/auth/avatar-icons.tsx`.
+ *
+ * Menambah preset: tambahkan id di sini DAN pemetaannya di FE (dijaga test).
+ */
+export const AVATAR_PRESET_IDS = [
+  "cat",
+  "dog",
+  "rabbit",
+  "panda",
+  "bird",
+  "fish",
+  "turtle",
+  "squirrel",
+  "rocket",
+  "bot",
+  "ghost",
+  "gamepad",
+  "flower",
+  "leaf",
+  "mountain",
+  "coffee",
+] as const;
+
+export type AvatarPresetId = (typeof AVATAR_PRESET_IDS)[number];
+
+export function isAvatarPresetId(v: unknown): v is AvatarPresetId {
+  return typeof v === "string" && (AVATAR_PRESET_IDS as readonly string[]).includes(v);
+}