ompchamber 0.3.0

package/src/server/lib/usage/deepseek.ts

@@ -0,0 +1,59 @@
+import { resolveDeepSeekApiKey } from '@/server/lib/usage/provider-key';
+import type { DeepSeekBalance, DeepSeekBalanceEntry, DeepSeekUsageReport } from '@/shared/types';
+import { isRecord } from '@/shared/lib/util/guards';
+
+const FETCH_TIMEOUT_MS = 10_000;
+const BALANCE_URL = 'https://api.deepseek.com/user/balance';
+
+function toString(value: unknown): string {
+  if (typeof value === 'string') return value;
+  if (value === null || value === undefined) return '';
+  return String(value);
+}
+
+function mapBalance(payload: unknown): DeepSeekBalance {
+  if (!isRecord(payload)) throw new Error('Unexpected DeepSeek response format');
+  const infos = Array.isArray(payload.balance_infos) ? payload.balance_infos : [];
+  const entries: DeepSeekBalanceEntry[] = [];
+  for (const info of infos) {
+    if (!isRecord(info)) continue;
+    entries.push({
+      currency: typeof info.currency === 'string' ? info.currency : '',
+      totalBalance: toString(info.total_balance),
+      grantedBalance: toString(info.granted_balance),
+      toppedUpBalance: toString(info.topped_up_balance),
+    });
+  }
+  return { isAvailable: payload.is_available === true, entries };
+}
+
+// DeepSeek exposes no public usage/quota API — only its web console tracks
+// spend. The Settings → Usage panel states this for the DeepSeek section;
+// here we can only report the prepaid balance.
+async function fetchDeepSeekBalance(apiKey: string): Promise<DeepSeekBalance> {
+  const response = await fetch(BALANCE_URL, {
+    headers: { Authorization: `Bearer ${apiKey}` },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+  });
+  if (response.status === 401) {
+    throw new Error('Invalid DeepSeek API key.');
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(`HTTP ${response.status}`);
+  }
+  return mapBalance(await response.json());
+}
+
+/** Build the DeepSeek usage report; a missing key yields `configured: false`. */
+export async function buildDeepSeekReport(): Promise<DeepSeekUsageReport> {
+  const apiKey = await resolveDeepSeekApiKey();
+  if (!apiKey) return { configured: false };
+  try {
+    return { configured: true, balance: await fetchDeepSeekBalance(apiKey) };
+  } catch (error) {
+    return {
+      configured: true,
+      error: error instanceof Error ? error.message : 'Failed to load DeepSeek balance',
+    };
+  }
+}

package/src/server/lib/usage/kenari.ts

@@ -0,0 +1,251 @@
+import { resolveKenariApiKey } from '@/server/lib/usage/provider-key';
+import type { KenariBalance, KenariCoupon, KenariQuota, KenariQuotaWindow, KenariUsage, KenariUsageReport, KenariUsageRow } from '@/shared/types';
+import { isRecord } from '@/shared/lib/util/guards';
+
+const FETCH_TIMEOUT_MS = 10_000;
+const QUOTA_URL = 'https://kenari.id/v1/account/quota';
+const MCP_URL = 'https://kenari.id/mcp';
+// Cloudflare blocks the /mcp path with error 1010 when the request carries a
+// default fetch User-Agent; an explicit one is required (verified).
+const USER_AGENT = 'ompchamber/1.0 (+https://kenari.id/docs/agents)';
+
+/**
+ * Parse an Indonesian Rupiah amount: "Rp" followed by digits where `.` is the
+ * thousands separator and `,` the decimal separator ("Rp 76.514" → 76514,
+ * "Rp 1.234,56" → 1234.56). Returns null when no Rupiah amount is present.
+ */
+function parseRupiah(text: string): number | null {
+  const match = text.match(/Rp\s*([0-9][0-9.,]*)/i);
+  if (!match) return null;
+  const raw = match[1];
+  const commaIndex = raw.indexOf(',');
+  const normalized = commaIndex >= 0
+    ? raw.slice(0, commaIndex).replace(/\./g, '') + '.' + raw.slice(commaIndex + 1).replace(/\./g, '')
+    : raw.replace(/\./g, '');
+  const parsed = Number.parseFloat(normalized);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+function toNumber(value: unknown): number {
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (typeof value === 'string') {
+    const parsed = Number.parseFloat(value.replace(/[^0-9.-]/g, ''));
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return 0;
+}
+
+const WINDOW_DEFS: Array<{ key: KenariQuotaWindow['key']; label: string; field: string }> = [
+  { key: 'five_hour', label: '5 hours', field: 'five_hour' },
+  { key: 'week', label: 'Weekly', field: 'week' },
+  { key: 'month', label: 'Monthly', field: 'month' },
+];
+
+function mapQuota(payload: unknown): KenariQuota {
+  if (!isRecord(payload)) throw new Error('Unexpected quota response format');
+  const plan = isRecord(payload.plan) ? payload.plan : null;
+  const planName = plan && typeof plan.name === 'string' ? plan.name : null;
+
+  const windows: KenariQuotaWindow[] = [];
+  if (plan && isRecord(plan.windows)) {
+    for (const def of WINDOW_DEFS) {
+      const window = plan.windows[def.field];
+      if (!isRecord(window)) continue;
+      windows.push({
+        key: def.key,
+        label: def.label,
+        usedRp: toNumber(window.used_rp),
+        remainingRp: toNumber(window.remaining_rp),
+        resetsAt: typeof window.resets_at === 'string' ? window.resets_at : '',
+      });
+    }
+  }
+
+  let coupon: KenariCoupon | null = null;
+  const couponRaw = payload.coupon;
+  if (isRecord(couponRaw)) {
+    const scopeModels = Array.isArray(couponRaw.scope_models)
+      ? couponRaw.scope_models.filter((model): model is string => typeof model === 'string')
+      : [];
+    const remainingRaw = couponRaw.remaining_rp;
+    coupon = {
+      name: typeof couponRaw.name === 'string' ? couponRaw.name : '',
+      usedRp: toNumber(couponRaw.used_rp),
+      remainingRp: remainingRaw === null || remainingRaw === undefined ? null : toNumber(remainingRaw),
+      expiresAt: typeof couponRaw.expires_at === 'string' ? couponRaw.expires_at : '',
+      scopeModels,
+    };
+  }
+
+  return { planName, windows, coupon };
+}
+
+async function fetchKenariQuota(apiKey: string): Promise<KenariQuota> {
+  const response = await fetch(QUOTA_URL, {
+    headers: { Authorization: `Bearer ${apiKey}` },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+  });
+  if (response.status === 403) {
+    const body: unknown = await response.json().catch(() => null);
+    if (isRecord(body) && body.code === 'shared_key_not_allowed') {
+      throw new Error('This key is a shared key; balance/usage/quota require the account owner key.');
+    }
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(`HTTP ${response.status}`);
+  }
+  return mapQuota(await response.json());
+}
+
+/** Extract the first JSON `data:` line from a `text/event-stream` body. */
+function parseSseData(text: string): unknown {
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith('data:')) continue;
+    const data = trimmed.slice('data:'.length).trim();
+    if (data.length === 0 || data === '[DONE]') continue;
+    try {
+      return JSON.parse(data);
+    } catch {
+      // Malformed data line — keep scanning.
+    }
+  }
+  return null;
+}
+
+/**
+ * Pull the tool result text from a JSON-RPC `tools/call` response. A JSON-RPC
+ * error is surfaced as an Error carrying its `error.message`.
+ */
+function extractToolText(payload: unknown): string {
+  if (!isRecord(payload)) throw new Error('Unexpected MCP response format');
+  if (isRecord(payload.error)) {
+    const message = typeof payload.error.message === 'string'
+      ? payload.error.message
+      : 'MCP tool call failed';
+    throw new Error(message);
+  }
+  const result = payload.result;
+  if (!isRecord(result)) throw new Error('Unexpected MCP response format');
+  if (!Array.isArray(result.content)) throw new Error('Unexpected MCP response format');
+  for (const item of result.content) {
+    if (isRecord(item) && typeof item.text === 'string') return item.text;
+  }
+  throw new Error('Unexpected MCP response format');
+}
+
+/**
+ * Call a stateless Kenari MCP tool. A direct `tools/call` works without an
+ * `initialize` handshake (the server is stateless, verified).
+ */
+async function callKenariTool(apiKey: string, toolName: string): Promise<string> {
+  const response = await fetch(MCP_URL, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      'Content-Type': 'application/json',
+      Accept: 'application/json, text/event-stream',
+      'User-Agent': USER_AGENT,
+    },
+    body: JSON.stringify({
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'tools/call',
+      params: { name: toolName, arguments: {} },
+    }),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+  });
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(`HTTP ${response.status}`);
+  }
+  const contentType = response.headers.get('content-type') ?? '';
+  const payload = contentType.includes('text/event-stream')
+    ? parseSseData(await response.text())
+    : await response.json();
+  return extractToolText(payload);
+}
+
+async function fetchKenariBalance(apiKey: string): Promise<KenariBalance> {
+  const raw = await callKenariTool(apiKey, 'kenari_balance');
+  return { amountRp: parseRupiah(raw), raw };
+}
+
+function toInt(value: string): number {
+  const parsed = Number.parseInt(value.replace(/[.,]/g, ''), 10);
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+/** Parse the kenari_usage Markdown table + trailing "Total:" line. */
+function parseUsageText(raw: string): KenariUsage {
+  const rows: KenariUsageRow[] = [];
+  let totalRequests = 0;
+  let totalCostRp = 0;
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith('|')) {
+      const cells = trimmed.split('|').map((cell) => cell.trim()).filter((cell) => cell.length > 0);
+      if (cells.length < 5) continue;
+      const model = cells[0];
+      if (model === 'model' || /^-+$/.test(model)) continue;
+      rows.push({
+        model,
+        requests: toInt(cells[1]),
+        inputTokens: toInt(cells[2]),
+        outputTokens: toInt(cells[3]),
+        costRp: parseRupiah(cells[4]) ?? 0,
+      });
+      continue;
+    }
+    const totalMatch = trimmed.match(/Total:\s*([0-9][0-9.,]*)\s*request/i);
+    if (totalMatch) {
+      totalRequests = toInt(totalMatch[1]);
+      totalCostRp = parseRupiah(trimmed) ?? 0;
+    }
+  }
+  return { rows, totalRequests, totalCostRp, raw };
+}
+
+async function fetchKenariUsage(apiKey: string): Promise<KenariUsage> {
+  const raw = await callKenariTool(apiKey, 'kenari_usage');
+  return parseUsageText(raw);
+}
+
+function errorMessage(error: unknown, fallback: string): string {
+  return error instanceof Error ? error.message : fallback;
+}
+
+/**
+ * Build the Kenari usage report. The three upstream calls (quota REST + two
+ * MCP tools) run independently so a failure in one does not lose the others;
+ * failures are folded into the report's `error` field.
+ */
+export async function buildKenariReport(): Promise<KenariUsageReport> {
+  const apiKey = await resolveKenariApiKey();
+  if (!apiKey) return { configured: false };
+
+  const report: KenariUsageReport = { configured: true };
+  const [quota, balance, usage] = await Promise.allSettled([
+    fetchKenariQuota(apiKey),
+    fetchKenariBalance(apiKey),
+    fetchKenariUsage(apiKey),
+  ]);
+
+  const errors: string[] = [];
+  if (quota.status === 'fulfilled') {
+    report.quota = quota.value;
+  } else {
+    errors.push(errorMessage(quota.reason, 'Failed to load quota'));
+  }
+  if (balance.status === 'fulfilled') {
+    report.balance = balance.value;
+  } else {
+    errors.push(errorMessage(balance.reason, 'Failed to load balance'));
+  }
+  if (usage.status === 'fulfilled') {
+    report.usage = usage.value;
+  } else {
+    errors.push(errorMessage(usage.reason, 'Failed to load usage'));
+  }
+  if (errors.length > 0) report.error = errors.join(' · ');
+  return report;
+}

package/src/server/lib/usage/provider-key.ts

@@ -0,0 +1,83 @@
+import { getDb } from '@/server/db.server';
+import { readOmpProviderApiKey } from '@/server/lib/omp/core/auth-credentials';
+import { isRecord } from '@/shared/lib/util/guards';
+
+const SETTINGS_KEY = 'omp_providers_config';
+const MASKED_KEY_PATTERN = /•{3,}/;
+
+interface ProviderEntry {
+  name: string;
+  slug: string;
+  baseUrl: string;
+  apiKey: string;
+}
+
+function toProviderEntry(value: unknown): ProviderEntry | null {
+  if (!isRecord(value)) return null;
+  return {
+    name: typeof value.name === 'string' ? value.name : '',
+    slug: typeof value.slug === 'string' ? value.slug : '',
+    baseUrl: typeof value.baseUrl === 'string' ? value.baseUrl : '',
+    apiKey: typeof value.apiKey === 'string' ? value.apiKey : '',
+  };
+}
+
+async function loadProviderEntries(): Promise<ProviderEntry[]> {
+  const db = await getDb();
+  const row = await db.get<{ value?: string }>(
+    'SELECT value FROM app_settings WHERE key = ?',
+    [SETTINGS_KEY],
+  );
+  if (!row || typeof row.value !== 'string' || row.value.trim().length === 0) {
+    return [];
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(row.value);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  return parsed
+    .map(toProviderEntry)
+    .filter((entry): entry is ProviderEntry => entry !== null);
+}
+
+/**
+ * Resolve a provider key: first the app DB (`app_settings.omp_providers_config`,
+ * matching via `predicate` and rejecting masked placeholders like "••••••"),
+ * then — when the app DB has no usable key — omp's own credential stores
+ * (models.yml `providers.<slug>.apiKey`, then agent.db `auth_credentials`).
+ * Returns the raw key — callers must never serialize, log, or echo it back.
+ */
+async function resolveApiKey(
+  slug: string,
+  predicate: (entry: ProviderEntry) => boolean,
+): Promise<string | null> {
+  const entries = await loadProviderEntries();
+  for (const entry of entries) {
+    if (!predicate(entry)) continue;
+    const key = entry.apiKey.trim();
+    if (key.length === 0 || MASKED_KEY_PATTERN.test(key)) continue;
+    return key;
+  }
+  return readOmpProviderApiKey(slug);
+}
+
+/** Resolve the Kenari provider key (baseUrl kenari.id, or name/slug "kenari"). */
+export function resolveKenariApiKey(): Promise<string | null> {
+  return resolveApiKey('kenari', (entry) =>
+    entry.baseUrl.toLowerCase().includes('kenari.id') ||
+    entry.name.toLowerCase().includes('kenari') ||
+    entry.slug.toLowerCase().includes('kenari'),
+  );
+}
+
+/** Resolve the DeepSeek provider key (baseUrl deepseek.com, or name/slug "deepseek"). */
+export function resolveDeepSeekApiKey(): Promise<string | null> {
+  return resolveApiKey('deepseek', (entry) =>
+    entry.baseUrl.toLowerCase().includes('deepseek.com') ||
+    entry.name.toLowerCase().includes('deepseek') ||
+    entry.slug.toLowerCase().includes('deepseek'),
+  );
+}

package/src/server/mock.server.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Utility to determine whether the application is running in MOCK mode.
+ * 
+ * - When MOCK=true (or MOCK=1): all data uses mock / simulated presets (demo chat traces, mock token analytics, mock settings presets).
+ * - When MOCK=false (or MOCK=0): all data uses real data (real SQLite persistence, real token calculations, real workspace state).
+ */
+export function isMockMode(): boolean {
+  const envVal = (Bun.env.MOCK || '').trim().toLowerCase();
+  
+  if (envVal === 'false' || envVal === '0' || envVal === 'off' || envVal === 'no') {
+    return false;
+  }
+  
+  if (envVal === 'true' || envVal === '1' || envVal === 'on' || envVal === 'yes') {
+    return true;
+  }
+
+  // Default to true for sandbox / preview demo mode if not explicitly set to false
+  return true;
+}
+
+export function getMockModeInfo(): { isMock: boolean; rawEnv: string } {
+  const isMock = isMockMode();
+  return {
+    isMock,
+    rawEnv: Bun.env.MOCK || (isMock ? 'true (default)' : 'false'),
+  };
+}

package/src/server/plugins/compress.ts

@@ -0,0 +1,51 @@
+// node:zlib stays for brotli only — Bun has no brotli API (Bun.brotliCompressSync is undefined).
+import { brotliCompressSync, constants } from 'node:zlib';
+
+/**
+ * Compresses a response body, except `text/event-stream`.
+ *
+ * SSE must never be compressed: zlib holds small frames until its buffer
+ * fills, so a compressed event stream delivers nothing until it ends. This
+ * mirrors the Express `compression({ filter })` it replaces.
+ *
+ * The incoming body is buffered and a fresh `Response` is returned, because a
+ * `Response` body can only be read once — reading it here would otherwise
+ * leave Elysia nothing to send.
+ */
+const MIN_BYTES = 1024;
+
+const COMPRESSIBLE = /^(text\/|application\/(json|javascript|xml|wasm|svg))/;
+
+function compress(body: Uint8Array<ArrayBuffer>, encoding: 'br' | 'gzip'): Uint8Array {
+  return encoding === 'br'
+    ? brotliCompressSync(body, { params: { [constants.BROTLI_PARAM_QUALITY]: 4 } })
+    : Bun.gzipSync(body, { level: 6 });
+}
+
+export async function maybeCompress(response: Response, acceptEncoding: string | null): Promise<Response> {
+  if (!acceptEncoding) return response;
+  const contentType = response.headers.get('content-type') ?? '';
+  if (contentType.includes('text/event-stream')) return response;
+  if (!COMPRESSIBLE.test(contentType)) return response;
+  if (response.status === 204 || response.status === 304) return response;
+
+  const encoding = acceptEncoding.includes('br') ? 'br' : acceptEncoding.includes('gzip') ? 'gzip' : null;
+  if (!encoding) return response;
+
+  const buffer = new Uint8Array(await response.arrayBuffer()) as Uint8Array<ArrayBuffer>;
+  if (buffer.byteLength < MIN_BYTES) {
+    // Body already consumed — hand back a rebuilt Response over the same bytes.
+    return rebuild(response, buffer);
+  }
+
+  const compressed = compress(buffer, encoding);
+  const headers = new Headers(response.headers);
+  headers.set('content-encoding', encoding);
+  headers.set('content-length', String(compressed.byteLength));
+  headers.append('vary', 'accept-encoding');
+  return new Response(compressed, { status: response.status, headers });
+}
+
+function rebuild(response: Response, buffer: Uint8Array): Response {
+  return new Response(buffer, { status: response.status, headers: response.headers });
+}

package/src/server/plugins/dev-assets.ts

@@ -0,0 +1,49 @@
+/**
+ * Dev-only asset fallback for the rsbuild dev server.
+ *
+ * `writeToDisk` puts every emitted asset in `dist/client`, so `tryServeStatic`
+ * covers normal requests. HMR artifacts do not reach disk: per-update
+ * `*.hot-update.*` chunks and manifests are emitted in-memory only, and they
+ * are requested on the page origin (port 3000) even though only the rsbuild
+ * dev server (port 3100) can answer them. Without this proxy the manifest
+ * fetch returns the HTML shell, `response.json()` throws, and the HMR runtime
+ * falls back to a full page reload — forever.
+ *
+ * A 404 from rsbuild is relayed as-is: the runtime treats it as "no update
+ * available" and stays idle, which is the correct steady state. This runs
+ * after the disk lookup, so a missing rsbuild dev server costs one failed
+ * connection per absent asset and nothing else.
+ */
+const DEV_SERVER = Bun.env.OMPCHAMBER_DEV_SERVER ?? 'http://localhost:3100';
+
+const isDev = Bun.env.NODE_ENV !== 'production';
+
+const isHmrArtifact = (pathname: string) => pathname.endsWith('.hot-update.json') || pathname.endsWith('.hot-update.js');
+
+/** Streamed dev asset for `pathname`, or null when the app should handle it. */
+export async function tryProxyDevAsset(request: Request, pathname: string): Promise<Response | null> {
+  const proxied = isDev && (isHmrArtifact(pathname) || pathname.startsWith('/static/'));
+  if (!proxied) return null;
+
+  const { search } = new URL(request.url);
+  let upstream: Response;
+  try {
+    upstream = await fetch(`${DEV_SERVER}${pathname}${search}`, {
+      method: request.method,
+      headers: { accept: request.headers.get('accept') ?? '*/*' },
+    });
+  } catch {
+    return null;
+  }
+  if (!upstream.body) return null;
+
+  // Relay the upstream status: rsbuild's 404 for a stale manifest is the HMR
+  // runtime's "no update" signal and must not become a 200 HTML shell.
+  return new Response(upstream.body, {
+    status: upstream.status,
+    headers: {
+      'content-type': upstream.headers.get('content-type') ?? 'application/octet-stream',
+      'cache-control': 'no-store',
+    },
+  });
+}

package/src/server/plugins/ssr.ts

@@ -0,0 +1,100 @@
+import { Elysia } from 'elysia';
+import { join } from 'path';
+import { getDb } from '@/server/db.server';
+import { tryServeStatic } from '@/server/plugins/static';
+import { tryProxyDevAsset } from '@/server/plugins/dev-assets';
+
+const CLIENT_INDEX = join(process.cwd(), 'dist/client/index.html');
+
+let cachedTemplate: string | null = null;
+let cachedMtimeMs = 0;
+
+/**
+ * Cached, but invalidated on mtime so `rsbuild build --watch` (the dev loop)
+ * picks up a new asset manifest without restarting the server.
+ */
+async function readTemplate(): Promise<string> {
+  const file = Bun.file(CLIENT_INDEX);
+  if (!(await file.exists())) {
+    throw new Error(`Client build not found at ${CLIENT_INDEX}. Run \`bun run build\` first.`);
+  }
+  const { mtimeMs } = await file.stat();
+  if (cachedTemplate !== null && mtimeMs === cachedMtimeMs) return cachedTemplate;
+  cachedTemplate = await file.text();
+  cachedMtimeMs = mtimeMs;
+  return cachedTemplate;
+}
+
+/** Actionable message instead of a bare 500 when the client build is absent. */
+function missingBuildResponse(): Response {
+  return new Response(
+    `<!doctype html><meta charset="utf-8"><title>OMPChamber</title>
+<body style="font:14px/1.6 ui-monospace,monospace;padding:2rem">
+<h1 style="font-size:1.1rem">Client build not found</h1>
+<p>The server needs <code>dist/client</code> before it can render pages.</p>
+<pre style="background:#f4f1ea;padding:1rem;border-radius:6px">bun run build</pre>
+<p>For a rebuild-on-change loop while developing:</p>
+<pre style="background:#f4f1ea;padding:1rem;border-radius:6px">bunx rsbuild build --watch</pre>
+</body>`,
+    { status: 503, headers: { 'content-type': 'text/html; charset=utf-8' } },
+  );
+}
+
+async function readSettings(): Promise<Record<string, unknown>> {
+  try {
+    const db = await getDb();
+    const rows = await db.all<{ key: string; value: string }>('SELECT * FROM app_settings');
+    const settings: Record<string, unknown> = {};
+    for (const row of rows) {
+      try {
+        settings[row.key] = JSON.parse(row.value);
+      } catch {
+        settings[row.key] = row.value;
+      }
+    }
+    return settings;
+  } catch {
+    return {};
+  }
+}
+
+function themeColor(theme: string): string {
+  return theme === 'one-dark-pro-soft' ? '#282c34' : '#faf8f3';
+}
+
+const MOBILE_UA = /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini|Mobile|mobile|CriOS/i;
+
+export const ssrRoutes = new Elysia({ name: 'ssr' }).get('*', async ({ request }) => {
+  const pathname = new URL(request.url).pathname;
+
+  if (pathname.startsWith('/api/')) {
+    return new Response(JSON.stringify({ error: 'Not found' }), {
+      status: 404,
+      headers: { 'content-type': 'application/json; charset=utf-8' },
+    });
+  }
+
+  const asset = await tryServeStatic(pathname);
+  if (asset) return asset;
+
+  const devAsset = await tryProxyDevAsset(request, pathname);
+  if (devAsset) return devAsset;
+
+  if (!(await Bun.file(CLIENT_INDEX).exists())) return missingBuildResponse();
+
+  const settings = await readSettings();
+  const chamberSettings = (settings.omp_chamber_settings ?? {}) as { theme?: string };
+  const theme = chamberSettings.theme ?? 'paper';
+  const initialIsMobile = MOBILE_UA.test(request.headers.get('user-agent') ?? '');
+
+  const template = await readTemplate();
+  const bootstrap = JSON.stringify({ initialIsMobile, appSettings: settings }).replace(/</g, '\\u003c');
+
+  return new Response(
+    template
+      .replace('data-theme="paper"', `data-theme="${theme}"`)
+      .replace('<!--app-head-->', `<meta name="theme-color" content="${themeColor(theme)}">`)
+      .replace('<!--app-bootstrap-->', `<script>window.__OMP_BOOTSTRAP__=${bootstrap}</script>`),
+    { headers: { 'content-type': 'text/html; charset=utf-8' } },
+  );
+});