#!/usr/bin/env python3
"""Dark0rbits v2 — toolbox: IP intel, card validator, SMS rentals, proxy lab, stego lab,
trackable files (BTCPay), no-KYC site-only messaging inbox. Single-file Flask + SQLite."""
import base64, binascii, hashlib, hmac, html, io, ipaddress, json, os, re, secrets, shutil, socket, sqlite3, struct, subprocess, time, uuid
import urllib.request, urllib.parse
from flask import Flask, request, jsonify, render_template_string, Response, send_file

from flask import redirect
import importlib.util as _ilu
_HAVE_AESGCM = _ilu.find_spec("cryptography") is not None
app = Flask(__name__)
DB_PATH = os.environ.get("DARK0RBITS_DB", "/opt/dark0rbits/dark0rbits.db")
UPLOAD_DIR = os.environ.get("DARK0RBITS_UPLOADS", "/opt/dark0rbits/uploads")
os.makedirs(UPLOAD_DIR, exist_ok=True)
SMSP_KEY = os.environ.get("SMSP_KEY", "")
PLEIADES_GW = os.environ.get("PLEIADES_GW", "10.30.20.178:8080")
PLEIADES_APP = os.environ.get("PLEIADES_APP", "https://pleiades.thetempleofdoom.com")
BTCPAY = "https://10.30.20.140/api/v1"
BTCPAY_KEY = os.environ.get("BTCPAY_KEY", "6026288e2e315984661c748baafd509e81a75f22")
BTCPAY_STORE = os.environ.get("BTCPAY_STORE", "7h79ndYyZX2yF6CPa12xt2uVGQ5Fd6nrSDG4Koy86x6u")
WEBCHECK = os.environ.get("WEBCHECK", "http://10.30.20.13:3000")
ADMIN_PW = os.environ.get("DARK0RBITS_ADMIN", "Czapiewski1!")
BTCPAY_WHSEC = os.environ.get("BTCPAY_WHSEC", "QnrkV2XPFD3P6ULjMxspHQ")
BMAC = "https://buymeacoffee.com/r26xrthzttg"
SITE = "https://dark0rbits.thetempleofdoom.com"

def _migrate(con):
    cols = [r[1] for r in con.execute("PRAGMA table_info(settings)")]
    if not cols:
        con.execute("CREATE TABLE IF NOT EXISTS settings(user_id INTEGER, key TEXT, val TEXT, PRIMARY KEY(user_id,key))")
    cols = [r[1] for r in con.execute("PRAGMA table_info(sms_rentals)")]
    if "user_id" not in cols:
        con.execute("ALTER TABLE sms_rentals ADD COLUMN user_id INTEGER DEFAULT 0")
    cols = [r[1] for r in con.execute("PRAGMA table_info(canary_hits)")]
    if cols and "lang" not in cols:
        con.execute("ALTER TABLE canary_hits ADD COLUMN lang TEXT DEFAULT ''")
        con.execute("ALTER TABLE canary_hits ADD COLUMN ref TEXT DEFAULT ''")
    cols = [r[1] for r in con.execute("PRAGMA table_info(canaries)")]
    if cols and "kind" not in cols:
        con.execute("ALTER TABLE canaries ADD COLUMN kind TEXT DEFAULT 'link'")
        con.execute("ALTER TABLE canaries ADD COLUMN rearm INTEGER DEFAULT 0")

def db():
    con = sqlite3.connect(DB_PATH); con.row_factory = sqlite3.Row
    con.executescript("""CREATE TABLE IF NOT EXISTS sms_rentals(id INTEGER PRIMARY KEY, phone TEXT, service TEXT, country TEXT, purchase_id TEXT, cost REAL, status TEXT, created INTEGER, expires INTEGER);
    CREATE TABLE IF NOT EXISTS proxy_checks(id INTEGER PRIMARY KEY, user_key TEXT, egress_ip TEXT, geo TEXT, ok INTEGER, ts INTEGER);
    CREATE TABLE IF NOT EXISTS users(id INTEGER PRIMARY KEY, username TEXT UNIQUE, passhash TEXT, created INTEGER);
    CREATE TABLE IF NOT EXISTS sessions(id INTEGER PRIMARY KEY, token TEXT UNIQUE, user_id INTEGER, created INTEGER);
    CREATE TABLE IF NOT EXISTS trackables(id INTEGER PRIMARY KEY, user_id INTEGER, token TEXT UNIQUE, filename TEXT, kind TEXT, invoice_id TEXT, paid INTEGER DEFAULT 0, created INTEGER);
    CREATE TABLE IF NOT EXISTS track_events(id INTEGER PRIMARY KEY, trackable_id INTEGER, ts INTEGER, ip TEXT, ua TEXT);
    CREATE TABLE IF NOT EXISTS messages(id INTEGER PRIMARY KEY, user_id INTEGER, sender TEXT, body TEXT, created INTEGER);
    CREATE TABLE IF NOT EXISTS mailboxes(id INTEGER PRIMARY KEY, user_id INTEGER, address TEXT UNIQUE, invoice_id TEXT, paid INTEGER DEFAULT 0, expires INTEGER DEFAULT 0, created INTEGER, plan_days INTEGER DEFAULT 7, cnt INTEGER DEFAULT 0);
    CREATE TABLE IF NOT EXISTS mails(id INTEGER PRIMARY KEY, mailbox_id INTEGER, sender TEXT, subject TEXT, body TEXT, ts INTEGER);
    CREATE TABLE IF NOT EXISTS passes(id INTEGER PRIMARY KEY, user_id INTEGER, invoice_id TEXT, paid INTEGER DEFAULT 0, expires INTEGER DEFAULT 0, plan_days INTEGER DEFAULT 30);
    CREATE TABLE IF NOT EXISTS canaries(id INTEGER PRIMARY KEY, user_id INTEGER, token TEXT UNIQUE, tag TEXT, created INTEGER, armed INTEGER DEFAULT 1);
    CREATE TABLE IF NOT EXISTS canary_hits(id INTEGER PRIMARY KEY, canary_id INTEGER, ts INTEGER, ip TEXT, ua TEXT);
    CREATE TABLE IF NOT EXISTS balances(user_id INTEGER PRIMARY KEY, cents INTEGER DEFAULT 0);
    CREATE TABLE IF NOT EXISTS apikeys(id INTEGER PRIMARY KEY, user_id INTEGER, key TEXT UNIQUE, label TEXT, created INTEGER, revoked INTEGER DEFAULT 0);
    CREATE TABLE IF NOT EXISTS ledger(id INTEGER PRIMARY KEY, user_id INTEGER, delta_cents INTEGER, reason TEXT, ts INTEGER);
    CREATE TABLE IF NOT EXISTS wh_processed(invoice_id TEXT PRIMARY KEY, ts INTEGER);
    CREATE TABLE IF NOT EXISTS rate_hits(bucket TEXT, ip TEXT, ts INTEGER);
    CREATE TABLE IF NOT EXISTS deadrops(id INTEGER PRIMARY KEY, user_id INTEGER, token TEXT UNIQUE, body_enc TEXT, reads_left INTEGER, burn_after INTEGER, expires INTEGER, pw_hash TEXT, created INTEGER);
    CREATE TABLE IF NOT EXISTS shots(id INTEGER PRIMARY KEY, user_id INTEGER, url TEXT, status TEXT, result TEXT, created INTEGER);""")
    _migrate(con)
    return con


# ---------- USER SETTINGS (visible tunables, agent-settable) ----------
DEFAULT_SETTINGS = {
    "bg": "1", "warp": "1", "parallax": "1", "density": "1.0", "speed": "1.0", "twinkle": "1.0",
    "hue": "0", "grid": "1", "scan": "1", "toast": "1", "type": "1",
}
BOOL_SETTINGS = {"bg", "warp", "parallax", "grid", "scan", "toast", "type"}
RANGE_SETTINGS = {"density": (0, 2.5), "speed": (0, 3), "twinkle": (0, 3), "hue": (-180, 180)}


def get_settings(uid):
    out = dict(DEFAULT_SETTINGS)
    if not uid:
        return out
    con = db()
    try:
        for r in con.execute("SELECT key,val FROM settings WHERE user_id=?", (uid,)):
            if r["key"] in out:
                out[r["key"]] = r["val"]
    except Exception:
        pass
    return out


def set_setting(uid, key, val):
    if key not in DEFAULT_SETTINGS:
        return False
    if key in BOOL_SETTINGS:
        val = "1" if str(val) in ("1", "true", "on", "yes") else "0"
    elif key in RANGE_SETTINGS:
        try:
            lo, hi = RANGE_SETTINGS[key]
            val = str(max(lo, min(hi, float(val))))
        except Exception:
            return False
    con = db()
    con.execute("INSERT INTO settings(user_id,key,val) VALUES(?,?,?) ON CONFLICT(user_id,key) DO UPDATE SET val=excluded.val", (uid, key, str(val)))
    con.commit()
    return True


# ---------- BILLING CORE (per-call metering for outside users) ----------
def get_balance(uid):
    con = db()
    con.execute("INSERT OR IGNORE INTO balances(user_id, cents) VALUES(?, 100)", (uid,))  # $1 free trial credit
    con.commit()
    return con.execute("SELECT cents FROM balances WHERE user_id=?", (uid,)).fetchone()["cents"]

def charge(uid, cents, reason):
    """Deduct from balance; return False if insufficient.
    FREE MODE (Oct 2026): every tool on dark0rbits is free — the lab absorbs all costs.
    Charges become zero-cost ledger entries and always succeed."""
    if cents <= 0: return True
    if uid:
        con = db()
        con.execute("INSERT INTO ledger(user_id,delta_cents,reason,ts) VALUES(?,?,?,?)",
                    (uid, 0, f"FREE (was {cents}¢) {reason}", int(time.time())))
        con.commit()
    return True

def key_user():
    """API-key auth: Authorization: Bearer dk_... → user_id or None."""
    auth = request.headers.get("Authorization", "")
    if not auth.startswith("Bearer dk_"): return None
    con = db()
    r = con.execute("SELECT user_id FROM apikeys WHERE key=? AND revoked=0", (auth[7:],)).fetchone()
    return r["user_id"] if r else None

def require_paid_key(cents, reason):
    """For API calls: key or session auth; metered charge. Returns (uid, error_json)."""
    uid = key_user() or current_user_id()
    if not uid: return None, (jsonify({"ok": False, "error": "auth required: account session or Authorization: Bearer dk_… key"}), 401)
    if has_pass(uid): return uid, None  # PASS = unlimited tools (proxy excluded)
    if not charge(uid, cents, reason):
        return None, (jsonify({"ok": False, "error": "insufficient balance", "balance_cents": get_balance(uid), "topup": SITE + "/keys"}), 402)
    return uid, None


# ---------- RATE LIMITING ----------
_RL = {}
def rate_limit(bucket, limit, window):
    """Sliding-window per-IP limiter. Returns None if ok, else a 429 response."""
    key = request.headers.get("X-Real-IP") or request.remote_addr or "?"
    now = time.time()
    con = db()
    con.execute("DELETE FROM rate_hits WHERE bucket=? AND ts < ?", (bucket, now-window))
    n = con.execute("SELECT COUNT(*) c FROM rate_hits WHERE bucket=? AND ip=?", (bucket, key)).fetchone()["c"]
    if n >= limit:
        return jsonify({"ok": False, "error": "rate limited — slow down"}), 429
    con.execute("INSERT INTO rate_hits(bucket,ip,ts) VALUES(?,?,?)", (bucket, key, now))
    con.commit()
    return None

import ssl as _ssl
_CTX = _ssl.create_default_context()
_CTX.check_hostname = False
_CTX.verify_mode = _ssl.CERT_NONE

def http(url, headers=None, data=None, method="GET", timeout=12):
    h = {"User-Agent": "Mozilla/5.0 (Dark0rbits toolbox)"}
    h.update(headers or {})
    req = urllib.request.Request(url, headers=h, data=data, method=method)
    try:
        with urllib.request.urlopen(req, timeout=timeout, context=_CTX) as r:
            return r.status, r.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode("utf-8", "replace")
    except Exception as e:
        return 0, str(e)

def jf(b):
    try: return json.loads(b)
    except Exception: return None

def param(name):
    return request.form.get(name) or request.args.get(name)

def esc(s): return html.escape(str(s))

# ---------- DEAD-DROP CRYPTO (AES-GCM on CT768, XOR-HMAC stream fallback) ----------
def _dd_master_key():
    return hashlib.sha256(("dark0rbits-deaddrop-v1:" + (os.environ.get("DARK0RBITS_SECRET", "ct768-fallback-secret"))).encode()).digest()

def dd_encrypt(plaintext):
    """AES-256-GCM when cryptography is present, else HMAC-verified XOR stream. Returns 'mode:vault' string."""
    if _HAVE_AESGCM:
        from cryptography.hazmat.primitives.ciphers.aead import AESGCM
        nonce = secrets.token_bytes(12)
        vault = AESGCM(_dd_master_key()).encrypt(nonce, plaintext.encode(), None)
        return "aesgcm:" + base64.urlsafe_b64encode(nonce + vault).decode()
    key = secrets.token_bytes(32)
    stream = bytes(a ^ b for a, b in zip(plaintext.encode(), hashlib.shake_256(key + str(len(plaintext)).encode()).digest(len(plaintext) + 64)))
    mac = hmac.new(_dd_master_key(), stream, hashlib.sha256).hexdigest()
    return "xor:" + base64.urlsafe_b64encode(key + stream).decode() + ":" + mac

def dd_decrypt(vault):
    try:
        if vault.startswith("aesgcm:"):
            from cryptography.hazmat.primitives.ciphers.aead import AESGCM
            raw = base64.urlsafe_b64decode(vault[7:].encode())
            return AESGCM(_dd_master_key()).decrypt(raw[:12], raw[12:], None).decode()
        if vault.startswith("xor:"):
            k64, mac = vault[4:].rsplit(":", 1)
            raw = base64.urlsafe_b64decode(k64.encode())
            if not hmac.compare_digest(hmac.new(_dd_master_key(), raw[32:], hashlib.sha256).hexdigest(), mac): return None
            n = len(raw) - 32 - 64
            stream = bytes(a ^ b for a, b in zip(raw[32:], hashlib.shake_256(raw[:32] + str(n).encode()).digest(n + 64)))
            return stream.decode()
    except Exception:
        pass
    return None

BASE = """<!doctype html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1">
<title>DARK0RBITS — No-KYC Network Toolbox: IP Intel, Stego, Burner Mail, SMS Rentals, Proxy Lab</title>
<meta name=description content="DARK0RBITS: a no-KYC toolbox for operators and AI agents. IP intelligence, card BIN validation, burner mail, SMS number rentals, steganography, trackable files, email & image forensics, canary traps, residential proxy testing. BTC only.">
<meta name=keywords content="dark0rbits, no kyc tools, ip lookup, bin check, burner email, sms rental, steganography, stego, email forensics, image forensics, canary trap, proxy, bitcoin only, agent api">
<meta property="og:title" content="DARK0RBITS — The Operator's Toolbox">
<meta property="og:description" content="No-KYC network toolbox for humans and AI agents. BTC only. 12 tools, every one with a JSON API.">
<meta property="og:type" content="website">
<meta property="og:image" content="https://dark0rbits.thetempleofdoom.com/og.png">
<link rel="icon" href="/favicon.svg">
<meta property="og:url" content="https://dark0rbits.thetempleofdoom.com">
<meta name=robots content="index,follow">
<meta name=theme-color content="#070a13">
<link rel=canonical href="https://dark0rbits.thetempleofdoom.com">
<style>
:root{--bg:#070a13;--card:rgba(19,25,44,.82);--line:#242e4d;--fg:#e9edf8;--dim:#93a0c2;--acc:#a78bfa;--acc2:#6fd6ff;--acc3:#6fd6ff;--ok:#42e8a4;--bad:#ff6161}
*{box-sizing:border-box}
html{scroll-behavior:smooth}
body{margin:0;min-height:100vh;color:var(--fg);font:16.5px/1.7 ui-monospace,Menlo,Consolas,monospace;text-align:left;overflow-x:hidden;background:var(--bg)}
#space{position:fixed;inset:0;z-index:0;display:block}
.vignette{position:fixed;inset:0;z-index:1;pointer-events:none;background:radial-gradient(ellipse at 50% -10%,var(--neb1,rgba(120,85,255,.16)),transparent 55%),radial-gradient(ellipse at 80% 110%,var(--neb2,rgba(0,190,255,.10)),transparent 50%),radial-gradient(ellipse at 50% 50%,transparent 60%,rgba(0,0,5,.55) 100%)}
main{position:relative;z-index:2;max-width:920px;margin:0 auto;padding:1.8rem 1.3rem 4rem;text-align:left}
#lbar{position:fixed;top:0;left:0;height:3px;width:0;background:linear-gradient(90deg,var(--acc),var(--acc2));z-index:50;transition:width .3s;box-shadow:0 0 10px var(--acc)}
#lbar.done{width:100%;opacity:0;transition:opacity .5s}
header{position:sticky;top:0;z-index:40;background:rgba(7,10,19,.86);backdrop-filter:blur(10px);border-bottom:1px solid var(--line)}
.hbar{max-width:920px;margin:0 auto;display:flex;align-items:center;justify-content:space-between;padding:.55rem 1rem}
.logo{color:var(--acc);text-decoration:none;font-weight:800;letter-spacing:.28em;font-size:1rem;text-shadow:0 0 18px rgba(167,139,250,.4)}
.burger{background:none;border:1px solid var(--line);color:var(--fg);font-size:1.15rem;border-radius:8px;padding:.35rem .7rem;cursor:pointer}
.burger:hover{border-color:var(--acc);color:var(--acc)}
.dnav{display:flex;flex-wrap:wrap;gap:.5rem;justify-content:flex-start}
.dnav a{color:var(--dim);text-decoration:none;font-size:.84rem;padding:.45rem .8rem;border:1px solid var(--line);border-radius:999px;white-space:nowrap;transition:.15s}
.dnav a.on,.dnav a:hover{color:var(--acc);border-color:var(--acc)}
.tchip{color:var(--fg);margin-right:.5rem;white-space:nowrap}
.srow{display:flex;align-items:center;gap:.5rem;margin:.45rem 0;font-size:.85rem;color:var(--fg)}
.srow input[type=range]{flex:1;accent-color:var(--acc)}
.srow input[type=checkbox]{accent-color:var(--acc);width:16px;height:16px}
#pinp{background:var(--card);border:1px solid var(--line);border-radius:8px;padding:.6rem;color:var(--fg)}
.pitem{display:block;padding:.5rem .6rem;border:1px solid transparent;border-radius:8px;color:var(--fg);text-decoration:none;cursor:pointer}
.pitem:hover,.pitem.sel{border-color:var(--acc);color:var(--acc)}
.pitem small{display:block;color:var(--dim)}
:focus-visible{outline:2px solid var(--acc2);outline-offset:2px;border-radius:4px}
.skip{position:absolute;left:-9999px;top:0;z-index:100;background:var(--acc);color:#0d0722;padding:.5rem 1rem;border-radius:0 0 8px 0;font-weight:800}
.skip:focus{left:0}
/* tables: real tables, wrap in .tblwide for scroll on tiny screens */
@media(max-width:640px){.dnav a{padding:.45rem .7rem;font-size:.8rem}#dev{display:none}}
@media(prefers-reduced-motion:reduce){ #space{display:none}.gridlines{display:none}#lbar{transition:none}.type,.typed-cursor,.crt{display:none}.logo::before,.logo::after{animation:none}.card{transition:none}}
.drawer{position:fixed;inset:0;z-index:60;background:rgba(7,10,19,.96);backdrop-filter:blur(6px);display:none;flex-direction:column;padding:1.2rem;overflow-y:auto}
.drawer.open{display:flex}
.drawer .dhead{display:flex;justify-content:space-between;align-items:center;margin-bottom:.8rem}
.drawer h4{color:var(--dim);font-size:.75rem;letter-spacing:.25em;text-align:left;margin:1rem 0 .4rem;text-transform:uppercase}
.drawer a.dl{color:var(--fg);text-decoration:none;padding:.65rem .8rem;border:1px solid var(--line);border-radius:10px;margin:.25rem 0;text-align:left;font-size:.95rem}
.drawer a.dl:hover,.drawer a.dl.on{border-color:var(--acc);color:var(--acc)}
.drawer a.dl small{display:block;color:var(--dim);font-size:.72rem}
@media(min-width:860px){.burger{display:none}}
@media(max-width:859px){.dnav{display:none}}
h1{font-size:1.9rem;letter-spacing:.04em;margin:1.3rem 0 .35rem;line-height:1.25}
h1 span{color:var(--acc)}
.sub{color:var(--dim);margin:.25rem 0 1.7rem;font-size:1.03rem;line-height:1.65;max-width:62ch}
.card{background:var(--card);border:1px solid var(--line);border-radius:16px;padding:1.4rem 1.5rem;margin:1.35rem 0;backdrop-filter:blur(4px)}
.card.glow{box-shadow:0 0 34px -16px var(--acc)}
.kv{display:grid;grid-template-columns:200px minmax(0,1fr);gap:0;border:1px solid var(--line);border-radius:12px;overflow:hidden;text-align:left}
.kv div{padding:.6rem .9rem;border-bottom:1px solid var(--line);min-width:0;overflow-wrap:anywhere}
.kv div:nth-child(odd){color:var(--dim);font-size:.78rem;letter-spacing:.06em;text-transform:uppercase;font-weight:700;background:rgba(255,255,255,.02)}
.kv div:nth-child(even){background:transparent}
.kv div:nth-child(even){background:transparent}
.kv div:nth-last-child(2),.kv div:last-child{border-bottom:0}
input,select,button,textarea{font:inherit;background:rgba(10,15,30,.9);color:var(--fg);border:1px solid #2c3860;border-radius:10px;padding:.72rem .9rem;max-width:100%;text-align:left}
.card label{display:block;text-align:left;color:var(--dim);font-size:.88rem;margin:.6rem 0 .2rem}
.card input,.card select,.card textarea{width:100%}
.card form{text-align:left}
.card p{text-align:left;line-height:1.7}
button{background:linear-gradient(135deg,var(--acc),var(--acc2));color:#0d0722;border:0;font-weight:800;cursor:pointer;transition:.2s;letter-spacing:.05em}
button:hover{filter:brightness(1.15);box-shadow:0 0 20px -4px var(--acc)}
button.ghost{background:transparent;color:var(--acc);border:1px solid var(--acc)}
button.big{font-size:1.02rem;padding:.75rem 1.4rem;margin:.25rem;color:#0d0722}
.grid2{display:grid;grid-template-columns:1fr;gap:1.25rem;text-align:left}
@media(min-width:700px){.grid2{grid-template-columns:repeat(2,1fr);gap:1.1rem}}
.grid3{display:grid;grid-template-columns:1fr;gap:1.1rem;text-align:left}
@media(min-width:700px){.grid3{grid-template-columns:repeat(2,1fr)}}
@media(min-width:1000px){.grid3{grid-template-columns:repeat(3,1fr)}}
.tcard{display:flex;flex-direction:column;gap:.55rem;padding:1.15rem 1.2rem;min-height:0}
.tcard h3{margin:0;font-size:1.02rem;letter-spacing:.14em;text-align:left}
.tcard p{margin:0;text-align:left;color:var(--dim);font-size:.92rem;line-height:1.5;flex:1}
.tcard .tgo{align-self:flex-start;margin-top:.2rem;text-decoration:none}
.tcard .tgo button{margin:0;padding:.5rem 1.1rem}
.tcard:hover{border-color:#3d4d7d}
.tcard .tico{font-size:1.3rem;line-height:1;color:var(--acc)}
.tcard .trow{display:flex;align-items:center;gap:.6rem}
.tcard .tico{flex:0 0 1.9rem;width:1.9rem;height:1.9rem;display:flex;align-items:center;justify-content:center;border:1px solid var(--line);border-radius:8px;background:rgba(167,139,250,.08);font-size:1rem;color:var(--acc)}
.tcard .tt{margin-left:auto}
.tcard .tt{font-size:.68rem;letter-spacing:.22em;color:var(--dim);text-transform:uppercase}
.hero{display:flex;flex-direction:column;gap:1rem;padding:2rem 1.6rem;text-align:left}
.hero .hl{display:flex;align-items:center;gap:.7rem;color:var(--ok);font-size:.9rem;white-space:nowrap}
.hero h2{font-size:clamp(1.7rem,4.2vw,2.7rem);letter-spacing:-.01em;margin:0;line-height:1.12;font-weight:800}
.hero h2 em{font-style:normal;color:var(--acc);text-shadow:0 0 24px rgba(167,139,250,.45)}
.hero .hsub{color:var(--dim);font-size:1rem;line-height:1.6;max-width:640px;margin:0}
.hero .hsub b{color:var(--fg)}
.hero .cta{display:flex;flex-wrap:wrap;gap:.6rem;margin-top:.3rem}
@media(max-width:640px){.hero{padding:1.4rem 1.1rem;text-align:left}}
@media(min-width:700px){.grid2{grid-template-columns:1fr 1fr}}
.tag{display:inline-block;padding:.14rem .6rem;border-radius:999px;font-size:.74rem;border:1px solid;margin:.15rem}
.tag.ok{color:var(--ok);border-color:var(--ok)}.tag.bad{color:var(--bad);border-color:var(--bad)}.tag.warn{color:var(--acc);border-color:var(--acc)}
table{width:100%;border-collapse:collapse;font-size:.9rem;table-layout:auto}
.tblwide{overflow-x:auto;-webkit-overflow-scrolling:touch}
@media(max-width:520px){.tblwide table{table-layout:auto}}
td,th{padding:.6rem .8rem;border-bottom:1px solid var(--line);text-align:left;vertical-align:top;overflow-wrap:anywhere}
tr:last-child td{border-bottom:0}
th{white-space:nowrap}
td code{font-size:.82em}
th{color:var(--dim);text-transform:uppercase;font-size:.75rem;letter-spacing:.06em}
footer{color:var(--dim);padding:2.4rem 1rem 5rem;font-size:.88rem;position:relative;z-index:2;text-align:center;line-height:1.7}
footer a{color:var(--acc)}
code{background:rgba(10,15,30,.9);padding:.08rem .4rem;border-radius:5px;font-size:.86em;word-break:break-all}
a{color:var(--acc2)}
pre{text-align:left;white-space:pre-wrap;overflow-x:auto}
.drop{border:2px dashed #33406b;border-radius:14px;padding:1.8rem 1rem;cursor:pointer;transition:.2s}
.drop:hover,.drop.over{border-color:var(--acc);background:rgba(167,139,250,.06)}
.msg{background:rgba(10,15,30,.75);border-left:3px solid var(--acc);border-radius:0 10px 10px 0;padding:.6rem .9rem;margin:.55rem 0;text-align:left}
.msg.me{border-left-color:var(--acc2)}
.msg .who{color:var(--dim);font-size:.74rem}
.bar{height:7px;background:rgba(10,15,30,.9);border-radius:4px;overflow:hidden}.bar>i{display:block;height:100%;background:linear-gradient(90deg,var(--acc),var(--acc2));width:0;transition:width .5s}
#dev{position:fixed;bottom:14px;right:14px;z-index:45;background:rgba(19,25,44,.92);border:1px solid var(--acc);color:var(--acc);border-radius:999px;padding:.5rem .9rem;font-size:.8rem;text-decoration:none;box-shadow:0 0 18px -6px var(--acc)}
#dev:hover{background:var(--acc);color:#161000}
img{max-width:100%;border-radius:10px}
ul,ol{text-align:left;margin:.6rem 0;padding-left:1.4rem}
li{text-align:left;margin:.45rem 0;line-height:1.65}
li::marker{color:var(--acc)}
.steps{counter-reset:step;list-style:none;padding-left:0;margin:.8rem 0 0}
.steps li{counter-increment:step;position:relative;padding:.55rem 0 .55rem 2.6rem;margin:.35rem 0;color:var(--fg);line-height:1.6}
.steps li::before{content:counter(step);position:absolute;left:0;top:.5rem;width:1.7rem;height:1.7rem;border-radius:50%;border:1px solid var(--acc);color:var(--acc);font-size:.8rem;font-weight:800;display:flex;align-items:center;justify-content:center;background:rgba(167,139,250,.08)}
.steps li b{color:var(--acc)}
.flowrole{display:inline-block;font-size:.68rem;letter-spacing:.18em;text-transform:uppercase;color:var(--acc2);border:1px solid var(--line);border-radius:999px;padding:.1rem .55rem;margin-right:.4rem;vertical-align:middle}
.gridlines{position:fixed;inset:0;z-index:1;pointer-events:none;background:repeating-linear-gradient(0deg,rgba(255,255,255,.012) 0 1px,transparent 1px 3px),linear-gradient(rgba(111,214,255,.03) 1px,transparent 1px),linear-gradient(90deg,rgba(111,214,255,.03) 1px,transparent 1px);background-size:auto,80px 80px,80px 80px;mask-image:linear-gradient(rgba(0,0,0,.7),rgba(0,0,0,.25))}
#acct{display:flex;align-items:center;gap:.4rem;white-space:nowrap}
.abtn{display:inline-flex;align-items:center;font-size:.78rem;letter-spacing:.08em;text-decoration:none;border-radius:999px;padding:.42rem .95rem;border:1px solid var(--line);color:var(--dim);transition:.15s;cursor:pointer}
.abtn:hover{color:var(--acc);border-color:var(--acc);box-shadow:0 0 14px -6px var(--acc)}
.abtn.solid{background:linear-gradient(135deg,var(--acc),var(--acc2));color:#0d0722;border-color:transparent;font-weight:800}
.abtn.solid:hover{filter:brightness(1.15);color:#0d0722}
.achip{display:inline-flex;align-items:center;gap:.3rem;font-size:.72rem;color:var(--acc2);text-decoration:none;border:1px solid var(--line);border-radius:999px;padding:.3rem .7rem}
.achip:hover{border-color:var(--acc2)}
</style><script src="https://supernova.thetempleofdoom.com/static/cosmic-bg.js?v=3" data-theme="lissajous" data-interact="parallax" data-accent="#a06bff"></script></head><body>
<div id="lbar"></div>
<a class=skip href="#main">skip to content</a>
<canvas id="space"></canvas><div class="gridlines"></div><div class="vignette" style="--neb1:{{n1}};--neb2:{{n2}}"></div>
<header><div class="hbar">
<a class=logo href=/ data-t="◈ DARK0RBITS">◈ DARK0RBITS</a>
<div class="dnav">
<a href=/ class={{o('home')}}>HOME</a><a href=/ip class={{o('ip')}}>IP</a><a href=/card class={{o('card')}}>CARD</a>
<a href=/sms class={{o('sms')}}>SMS</a><a href=/proxy class={{o('proxy')}}>PROXY</a>
<a href=/steg class={{o('steg')}}>STEGO</a><a href=/track class={{o('track')}}>TRACK</a>
<a href=/eh class={{o('eh')}}>MAIL-FORENSICS</a><a href=/forensics class={{o('forensics')}}>IMG-FORENSICS</a>
<a href=/phone class={{o('phone')}}>PHONE</a><a href=/user class={{o('user')}}>USER-SLEUTH</a>
<a href=/domain class={{o('domain')}}>DOMAIN</a>
<a href=/canary class={{o('canary')}}>CANARY</a><a href=/deaddrop class={{o('deaddrop')}}>DEAD-DROP</a><a href=/mail class={{o('mail')}}>BURNER-MAIL</a>
<a href=/shot class={{o('shot')}}>SHOT</a><a href=/score class={{o('score')}}>FRAUD-SCORE</a>
<a href=/inbox class={{o('inbox')}}>INBOX</a><a href=/passport class={{o('passport')}}>PASSPORT</a>
<a href=/pass class={{o('pass')}}>PASS</a><a href=/keys class={{o('keys')}}>KEYS</a><a href=/maglab class={{o('maglab')}}>MAG-LAB</a><a href=/dms class={{o('dms')}}>DMS</a><a href=/chain class={{o('chain')}}>HASH-CHAIN</a><a href=/ghost class={{o('ghost')}}>GHOST-TEXT</a><a href=/chaff class={{o('chaff')}}>CHAFF</a><a href=/tracer class={{o('tracer')}}>LEAK-TRACER</a><a href=/traceout class={{o('traceout')}}>TRACEOUT</a><a href=/tchain class={{o('tchain')}}>TRAP-CHAIN</a><a href=/tools class={{o('tools')}}>TOOLS</a>
</div>
<div id="acct">{{acct}}</div><button class=burger id=burger onclick="drw()">☰</button>
</div></header>
<div class=drawer id=drawer>
<div class=dhead><span class=logo style=font-size:.85rem>DARK0RBITS — MAP</span><button class=burger onclick="drw()">✕</button></div>
<h4>Intel</h4>
<a class="dl {{o('ip')}}" href=/ip>◈ IP INTEL <small>geo, ASN, ISP, VPN flags — any target</small></a>
<a class="dl {{o('card')}}" href=/card>◈ CARD CHECK <small>luhn + BIN issuer intelligence</small></a>
<a class="dl {{o('maglab')}}" href=/maglab>◈ MAG-LAB <small>browser magstripe studio — ISO 7811 encode, read, batch issue (closed-loop only)</small></a>
<a class="dl {{o('eh')}}" href=/eh>◈ MAIL FORENSICS <small>true origin, relay delays, spoof flags, .eml import</small></a>
<a class="dl {{o('forensics')}}" href=/forensics>◈ IMAGE FORENSICS <small>EXIF, GPS, ELA, edit detection</small></a>
<a class="dl {{o('phone')}}" href=/phone>◈ PHONE LOOKUP <small>carrier, line type, region, timezone — any number</small></a>
<a class="dl {{o('user')}}" href=/user>◈ USERNAME SLEUTH <small>find one handle across 12+ platforms</small></a>
<a class="dl {{o('domain')}}" href=/domain>◈ DOMAIN RECON <small>RDAP whois, DNS, nameservers, subdomains</small></a>
<h4>Operate</h4>
<a class="dl {{o('sms')}}" href=/sms>◈ SMS RENTAL <small>30-min numbers, refundable</small></a>
<a class="dl {{o('proxy')}}" href=/proxy>◈ PROXY LAB <small>residential egress, geo builder</small></a>
<a class="dl {{o('steg')}}" href=/steg>◈ STEGO LAB <small>hide words in pictures</small></a>
<a class="dl {{o('mail')}}" href=/mail>◈ BURNER MAIL <small>receive-only mailboxes, countdown</small></a>
<h4>Hunt</h4>
<a class="dl {{o('track')}}" href=/track>◈ TRACK FILE <small>opens report back: IP, city, ISP</small></a>
<a class="dl {{o('canary')}}" href=/canary>◈ CANARY TRAPS <small>links, pixels &amp; honeytokens — instant alerts</small></a>
<a class="dl {{o('deaddrop')}}" href=/deaddrop>◈ DEAD-DROP <small>burn-after-read encrypted notes</small></a>
<a class="dl {{o('shot')}}" href=/shot>◈ SCREENSHOT <small>page capture or rendered-text fallback</small></a>
<a class="dl {{o('score')}}" href=/score>◈ FRAUD-SCORE <small>composite IP + email + BIN risk 0-100</small></a>
<a class="dl {{o('tools')}}" href=/tools>◈ FREE TOOLS <small>DNS, headers, JWT, hasher</small></a>
<a class="dl {{o('phone')}}" href=/phone>◈ PHONE LOOKUP <small>osint: carrier + line type + region</small></a>
<a class="dl {{o('user')}}" href=/user>◈ USERNAME SLEUTH <small>osint: handle across platforms</small></a>
<a class="dl {{o('domain')}}" href=/domain>◈ DOMAIN RECON <small>osint: RDAP + DNS + subdomains</small></a>
<a class="dl {{o('dms')}}" href=/dms>◈ DMS <small>dead man switch: silence releases pre-written payload dead-drops</small></a>
<a class="dl {{o('chain')}}" href=/chain>◈ HASH-CHAIN <small>Tamper-evident chain-of-custody logs — edits break the chain at the exact link</small></a>
<a class="dl {{o('ghost')}}" href=/ghost>◈ GHOST-TEXT <small>hide secret messages in invisible characters inside innocent text</small></a>
<a class="dl {{o('chaff')}}" href=/chaff>◈ CHAFF <small>deterministic throwaway personas — same seed, same identity, zero storage</small></a>
<a class="dl {{o('tracer')}}" href=/tracer>◈ LEAK-TRACER <small>per-recipient invisible watermarks — leaks name the leaker</small></a>
<a class="dl {{o('traceout')}}" href=/traceout>◈ TRACEOUT <small>network traceroute with per-hop geo</small></a>
<a class="dl {{o('tchain')}}" href=/tchain>◈ TRAP-CHAIN <small>breadcrumb tripwires — each fired trap feeds them the next, maps their path</small></a>
<h4>Account</h4>
<a class="dl {{o('inbox')}}" href=/inbox>◈ INBOX <small>no-KYC messaging</small></a>
<a class="dl {{o('signup')}}" href=/signup>◈ SIGN UP <small>username + password, 10 seconds, no KYC</small></a>
<a class="dl {{o('keys')}}" href=/keys>◈ API KEYS <small>account, balance, metered keys</small></a>
<a class="dl {{o('pass')}}" href=/pass>◈ PASS <small>everything's free now — no pass needed</small></a>
<a class="dl {{o('passport')}}" href=/passport>◈ AGENT PASSPORT <small>machine-readable badge</small></a>
</div>
<main id="main">{{body}}</main>
<footer>DARK0RBITS · built for agents &amp; humans · <a href="{{bmac}}" target=_blank rel=noopener>☕ fuel the lab</a></footer>
<a id=dev href="#" onclick="location.href='mailto:'+atob('bWFrZW1vbmV5czhAcHJvdG9uLm1l')+'?subject=Dark0rbits%20support';return false">✦ REACH THE DEV</a>
<script>{{ CFG_JS }}</script>
<div id=gearbtn onclick="spToggle()" title="settings — space, speed, density, hue" style="position:fixed;left:14px;bottom:14px;z-index:70;width:40px;height:40px;border-radius:50%;border:1px solid var(--line);background:rgba(7,10,19,.85);color:var(--acc);font-size:1.1rem;cursor:pointer;display:flex;align-items:center;justify-content:center" aria-label="settings">⚙</div>
<div id=spanel class="card" style="display:none;position:fixed;left:14px;bottom:62px;z-index:71;width:270px;max-height:76vh;overflow-y:auto;text-align:left" aria-label="site settings">
<b style=color:var(--acc)>TUNABLES</b> <span style="color:var(--dim);font-size:.75rem">(saved to your account — agents: POST /api/settings)</span>
<label class=srow><input type=checkbox id=sbg onchange="spSet('bg',this.checked)"> nebula + starfield</label>
<label class=srow><input type=checkbox id=swarp onchange="spSet('warp',this.checked)"> hyperdrive warp on click</label>
<label class=srow><input type=checkbox id=sparallax onchange="spSet('parallax',this.checked)"> mouse parallax</label>
<label class=srow><input type=checkbox id=sgrid onchange="spSet('grid',this.checked)"> grid overlay</label>
<label class=srow><input type=checkbox id=sscan onchange="spSet('scan',this.checked)"> scanlines</label>
<label class=srow><input type=checkbox id=stoast onchange="spSet('toast',this.checked)"> toasts</label>
<label class=srow><input type=checkbox id=stype onchange="spSet('type',this.checked)"> typed boot text</label>
<label class=srow>star density <input type=range id=sdensity min=0 max=2.5 step=0.1 onchange="spSet('density',this.value)"> <span id=sdensityv></span></label>
<label class=srow>drift speed <input type=range id=sspeed min=0 max=3 step=0.1 onchange="spSet('speed',this.value)"> <span id=sspeedv></span></label>
<label class=srow>twinkle <input type=range id=stwinkle min=0 max=3 step=0.1 onchange="spSet('twinkle',this.value)"> <span id=stwinklev></span></label>
<label class=srow>hue shift <input type=range id=shue min=-180 max=180 step=5 onchange="spSet('hue',this.value)"> <span id=shuev></span></label>
<button style="margin-top:.5rem" onclick="spReset()">reset defaults</button>
<div style="color:var(--dim);font-size:.72rem;margin-top:.4rem">⌘K / Ctrl+K — command palette</div>
</div>
<div id=palwin style="display:none;position:fixed;inset:0;z-index:80;background:rgba(4,6,12,.8);backdrop-filter:blur(4px)" onclick="if(event.target===this)palClose()">
<div class="card" style="max-width:520px;margin:12vh auto;text-align:left">
<input id=pinp placeholder="type a command… (ip, sms, steg, keys, dead-drop, settings…)" style="width:100%;font-size:1rem" oninput="palFilter()" onkeydown="palKey(event)">
<div id=plist style="margin-top:.6rem;max-height:50vh;overflow-y:auto"></div>
</div></div>
<iframe name=playout id=playout style="display:none" title="api playground output"></iframe>
<script defer src="https://analytics.thetempleofdoom.com/script.js" data-website-id="953c15df-ba4c-453a-a7c6-465fa9e3f202"></script>
<script>
function drw(){document.getElementById('drawer').classList.toggle('open')}
document.addEventListener('keydown',function(e){if(e.key==='Escape')document.getElementById('drawer').classList.remove('open')})
function cp(t){navigator.clipboard.writeText(t).then(function(){toast('Copied ✓')})}
function toast(m){var d=document.createElement('div');d.textContent=m;d.style.cssText='position:fixed;bottom:60px;left:50%;transform:translateX(-50%);background:var(--acc);color:#161000;padding:.55rem 1.1rem;border-radius:10px;font-weight:800;z-index:99';document.body.appendChild(d);setTimeout(function(){d.remove()},1800)}
var lb=document.getElementById('lbar');
function lbGo(){lb.classList.remove('done');lb.style.width='12%';var w=12;var t=setInterval(function(){w=Math.min(w+6,88);lb.style.width=w+'%'},250);window._lbt=t}
function lbDone(){if(window._lbt)clearInterval(window._lbt);lb.style.width='100%';setTimeout(function(){lb.style.width='0';lb.classList.remove('done')},600)}
document.addEventListener('submit',lbGo,true);
document.addEventListener('click',function(e){var a=e.target.closest('a[href]');if(a&&a.getAttribute('href')&&a.getAttribute('href').charAt(0)==='/'){lbGo();setTimeout(lbDone,1200)}},true);
window.addEventListener('load',lbDone);
(function(){
var DRB=window.DRB||{};
function drbN(v){v=parseFloat(v);return isNaN(v)?1:v}
var c=document.getElementById('space'),x=c.getContext('2d'),W,H,stars=[],dust=[];
function rs(){W=c.width=innerWidth;H=c.height=innerHeight;
stars=[];var n=Math.min(340,Math.floor(W*H/7000*drbN(DRB.density||1)));
for(var i=0;i<n;i++)stars.push({x:Math.random()*W,y:Math.random()*H,z:Math.random()+.3,tw:Math.random()*6.28});
dust=[];for(i=0;i<14;i++)dust.push({x:Math.random()*W,y:Math.random()*H,r:40+Math.random()*90,vx:(Math.random()-.5)*.035,vy:(Math.random()-.5)*.028,h:Math.random()<.5?120:265,a:.05+Math.random()*.05});}
rs();addEventListener('resize',rs);
var mx=0,my=0,tx=0,ty=0;
addEventListener('mousemove',function(e){tx=(e.clientX/W-.5);ty=(e.clientY/H-.5)});
addEventListener('touchmove',function(e){if(e.touches[0]){tx=(e.touches[0].clientX/W-.5);ty=(e.touches[0].clientY/H-.5)}},{passive:true});
function frame(){
x.clearRect(0,0,W,H);
if(DRB.bg==='0'){x.clearRect(0,0,W,H);requestAnimationFrame(frame);return;}
var spd=drbN(DRB.speed===undefined?1:DRB.speed),twk=drbN(DRB.twinkle===undefined?1:DRB.twinkle);
if(scurry){
scurry.t-=.012;
if(scurry.t<=0)scurry=null;
else{
for(i=0;i<stars.length;i++){var st=stars[i];
var sx=st.x+mx*st.z*40, sy=st.y+my*st.z*40;
var dx=scurry.x-sx, dy=scurry.y-sy, dist=Math.sqrt(dx*dx+dy*dy)+.001;
var pull=(1.4+st.z)*scurry.t*3.2;
st.x+=dx/dist*pull; st.y+=dy/dist*pull;}}
}
for(var i=0;i<dust.length;i++){var d=dust[i];d.x+=d.vx*spd;d.y+=d.vy*spd;
if(scurry){var ddx=scurry.x-d.x,ddy=scurry.y-d.y,dd=Math.sqrt(ddx*ddx+ddy*ddy)+.001;if(dd<600){d.x+=ddx/dd*scurry.t*2;d.y+=ddy/dd*scurry.t*2}}}
if(d.x<-100)d.x=W+80;if(d.x>W+100)d.x=-80;if(d.y<-100)d.y=H+80;if(d.y>H+100)d.y=-80;
var g=x.createRadialGradient(d.x,d.y,0,d.x,d.y,d.r);
g.addColorStop(0,'hsla('+d.h+',70%,60%,'+d.a+')');g.addColorStop(1,'transparent');
x.fillStyle=g;x.beginPath();x.arc(d.x,d.y,d.r,0,6.29);x.fill();}
mx+=(tx-mx)*.03;my+=(ty-my)*.03;
for(i=0;i<stars.length;i++){var s=stars[i];s.tw+=.011*twk;
var px=s.x+mx*s.z*40, py=s.y+my*s.z*40;
var a=.28+.4*Math.abs(Math.sin(s.tw));
x.fillStyle='rgba(220,228,255,'+(a*s.z)+')';
x.beginPath();x.arc(px,py,s.z*1.25,0,6.29);x.fill();}
requestAnimationFrame(frame);}
var _hue=drbN(DRB.hue||0);
if(_hue){c.style.filter='hue-rotate('+_hue+'deg)';}
frame();
})();
// ---------- live settings binding ----------
function spApply(){
var D=window.DRB||{};
if(!D.bg||D.bg==='0'){var cs=document.getElementById('space');if(cs)cs.style.display='none'}else{var cs2=document.getElementById('space');if(cs2)cs2.style.display='block'}
if(!D.bg||D.bg==='0'){document.querySelectorAll('.vignette,.gridlines').forEach(function(e){e.style.display='none'})}else{
document.querySelectorAll('.vignette').forEach(function(e){e.style.display='block'});
var g=document.querySelector('.gridlines');if(g)g.style.display=(D.grid==='0')?'none':'block';}
var hue=parseFloat(D.hue||0);
document.querySelectorAll('#space,.vignette').forEach(function(e){e.style.filter=hue?('hue-rotate('+hue+'deg)'):''});
}
function spToggle(){var p=document.getElementById('spanel');p.style.display=(p.style.display==='none')?'block':'none';if(p.style.display==='block')spSync()}
function spSync(){
var D=window.DRB||{};
var m={bg:'sbg',warp:'swarp',parallax:'sparallax',grid:'sgrid',scan:'sscan',toast:'stoast',type:'stype'};
Object.keys(m).forEach(function(k){var el=document.getElementById(m[k]);if(el)el.checked=(D[k]!=='0')});
[['density','sdensity'],['speed','sspeed'],['twinkle','stwinkle'],['hue','shue']].forEach(function(pr){
var el=document.getElementById(pr[1]);if(el){el.value=D[pr[0]]||1;var v=document.getElementById(pr[1]+'v');if(v)v.textContent=el.value}});
}
function spSet(k,v){
v=(v===true||v==='true')?'1':(v===false||v==='false')?'0':v;
window.DRB=window.DRB||{};window.DRB[k]=v;spApply();
if(k==='density'){window.DRB.density=v;location.reload();}
fetch('/api/settings',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:k+'='+encodeURIComponent(v)}).then(function(r){return r.json()}).then(function(d){if(d.ok)toast('✓ saved')}).catch(function(){});
}
function spReset(){
var def={bg:'1',warp:'1',parallax:'1',density:'1',speed:'1',twinkle:'1',hue:'0',grid:'1',scan:'1',toast:'1',type:'1'};
var body=Object.keys(def).map(function(k){return k+'='+def[k]}).join('&');
fetch('/api/settings',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:body}).then(function(){location.reload()});
}
// scanline toggle via body class
var _st=document.createElement('style');_st.textContent='.noscan .gridlines{display:none!important}';document.head.appendChild(_st);
new MutationObserver(function(){document.body.classList.toggle('noscan',window.DRB&&window.DRB.scan==='0')}).observe(document.documentElement,{attributes:true,childList:true,subtree:true});
setTimeout(function(){spApply()},0);
// ---------- stars scurry to cursor on background click ----------
var scurry=null; // {x,y,t}
document.addEventListener('pointerdown',function(e){
if(window.DRB&&window.DRB.warp==='0')return;
if(e.target.closest('a,button,input,select,textarea,label,.card,#spanel,#palwin,#gearbtn,#pinp'))return;
scurry={x:e.clientX,y:e.clientY,t:1};
},{passive:true});
document.addEventListener('pointermove',function(e){
if(scurry&&scurry.t>0){scurry.x=e.clientX;scurry.y=e.clientY}
},{passive:true});
// ---------- command palette (⌘K / Ctrl+K) ----------
var PAL=[
['/ip','IP intel — geo, ASN, VPN flags'],
['/card','card BIN + Luhn check'],
['/sms','rent a burner number, 30 min'],
['/proxy','proxy lab — test Pleiades egress'],
['/steg','hide / extract secret text in pictures'],
['/track','trackable files — opens report back'],
['/eh','email forensics — origin, spoof flags, .eml import'],
['/forensics','image forensics — EXIF + ELA'],
['/canary','canary traps — links, pixels, honeytokens'],
['/deaddrop','burn-after-read encrypted notes'],
['/mail','burner mailbox'],
['/shot','screenshot / page capture'],
['/score','fraud score composite'],
['/inbox','no-KYC inbox + login'],
['/keys','API keys + balance'],
['/pass','all-access pass'],
['/passport','agent passport badge'],
['/tools','free tools'],
["/dms", "dead man switch: check in or your sealed words go out"],
["/chain", "hash chains \u2014 tamper-evident custody logs"],
["/ghost", "ghost text \u2014 invisible-message smuggler"],
["/chaff", "chaff \u2014 deterministic throwaway personas"],
["/tracer", "leak tracer \u2014 watermarks that name the leaker"],
["/traceout", "network traceroute + hop geo"],
["/tchain", "trap chain \u2014 breadcrumb tripwires that map the intruder"],
['/llms.txt','machine catalog for agents'],
['/openapi.json','OpenAPI spec'],
];
var palSel=0;
function palOpen(){var w=document.getElementById('palwin');w.style.display='block';var i=document.getElementById('pinp');i.value='';palRender('');i.focus()}
function palClose(){document.getElementById('palwin').style.display='none'}
function palRender(q){
q=(q||'').toLowerCase();
var el=document.getElementById('plist');el.innerHTML='';
PAL.filter(function(it){return !q||it[0].toLowerCase().indexOf(q)>=0||it[1].toLowerCase().indexOf(q)>=0}).forEach(function(it,idx){
var a=document.createElement('a');a.className='pitem'+(idx===palSel?' sel':'');a.href=it[0];a.innerHTML=it[0]+' <small>'+it[1]+'</small>';
a.onmouseenter=function(){var items=el.querySelectorAll('.pitem');items.forEach(function(x){x.classList.remove('sel')});a.classList.add('sel')};
el.appendChild(a);});
}
function palFilter(){palSel=0;palRender(document.getElementById('pinp').value)}
function palKey(e){
var el=document.getElementById('plist');
if(e.key==='Escape')palClose();
else if(e.key==='ArrowDown'){palSel=Math.min(palSel+1,el.querySelectorAll('.pitem').length-1);palRender(document.getElementById('pinp').value);e.preventDefault()}
else if(e.key==='ArrowUp'){palSel=Math.max(palSel-1,0);palRender(document.getElementById('pinp').value);e.preventDefault()}
else if(e.key==='Enter'){var a=el.querySelectorAll('.pitem')[palSel];if(a)location.href=a.href}
}
document.addEventListener('keydown',function(e){
if((e.metaKey||e.ctrlKey)&&e.key.toLowerCase()==='k'){e.preventDefault();var w=document.getElementById('palwin');(w.style.display==='block')?palClose():palOpen()}
});
// toasts toggle
var _origToast=toast;
toast=function(m){if(window.DRB&&window.DRB.toast==='0')return;_origToast(m)};
// typed boot toggle
if(window.DRB&&window.DRB.type==='0'){var t=document.querySelector('.type');if(t)t.dataset.lines='';}
})();
</script>
</body></html>
"""

NEBULAS = {
 "home": ("rgba(120,85,255,.17)", "rgba(0,190,255,.10)"),
 "ip": ("rgba(255,170,60,.13)", "rgba(120,85,255,.10)"),
 "card": ("rgba(66,232,164,.10)", "rgba(0,190,255,.09)"),
 "sms": ("rgba(0,190,255,.13)", "rgba(167,139,250,.10)"),
 "proxy": ("rgba(167,139,250,.14)", "rgba(255,170,60,.08)"),
 "steg": ("rgba(255,110,180,.11)", "rgba(120,85,255,.11)"),
 "track": ("rgba(255,90,90,.11)", "rgba(255,170,60,.08)"),
 "mail": ("rgba(66,232,164,.10)", "rgba(0,190,255,.08)"),
 "forensics": ("rgba(0,210,255,.12)", "rgba(255,110,180,.07)"),
 "canary": ("rgba(255,201,77,.12)", "rgba(255,90,90,.08)"),
 "deaddrop": ("rgba(45,226,200,.13)", "rgba(160,225,255,.09)"),
 "shot": ("rgba(111,214,255,.12)", "rgba(120,85,255,.10)"),
 "score": ("rgba(255,110,180,.10)", "rgba(66,232,164,.10)"),
 "tchain": ("rgba(255,90,90,.12)", "rgba(255,201,77,.08)"),
 "traceout": ("rgba(45,226,200,.12)", "rgba(167,139,250,.10)"),
 "tracer": ("rgba(255,110,180,.12)", "rgba(120,85,255,.09)"),
 "chaff": ("rgba(255,170,60,.12)", "rgba(120,85,255,.09)"),
 "ghost": ("rgba(120,85,255,.13)", "rgba(66,232,164,.08)"),
 "chain": ("rgba(66,232,164,.10)", "rgba(120,85,255,.09)"),
 "dms": ("rgba(255,110,180,.11)", "rgba(120,85,255,.11)"),
}
def kv(pairs):
    rows = "".join(f"<div>{k}</div><div>{v}</div>" for k, v in pairs)
    return '<div class="card glow"><div class="kv">' + rows + "</div></div>"

def page(sec, body):
    n1, n2 = NEBULAS.get(sec, ("rgba(120,85,255,.16)", "rgba(0,190,255,.10)"))
    uid = current_user_id()
    acct = ""
    if uid:
        try:
            con = db()
            u = con.execute("SELECT username FROM users WHERE id=?", (uid,)).fetchone()
            bal = get_balance(uid)
            pas = has_pass(uid)
            acct = ('<a class=achip href=/keys title="balance — click for API keys & top-up">'
                    + ("★ PASS · " if pas else "") + "◈ $" + f"{bal/100:.2f}" + " · " + esc(u["username"]) + "</a>"
                    + ' <a class=abtn href=/logout title="log out">EXIT</a>')
        except Exception:
            acct = ""
    if not uid or not acct:
        nxt = ("?next=" + urllib.parse.quote(request.path)) if request.path not in ("/", "/inbox", "/signup", "/logout") else ""
        acct = ('<a class=abtn href=/inbox' + nxt + ' title="log in — username + password, nothing else">LOG IN</a>'
                ' <a class="abtn solid" href=/signup' + nxt + ' title="create account — username + password, ~10 seconds, no KYC">SIGN UP</a>')
    from markupsafe import Markup
    st = get_settings(uid)
    return render_template_string(BASE, body=Markup(body), bmac=BMAC, o=lambda s2: "on" if s2 == sec else "",
                                  n1=n1, n2=n2, acct=Markup(acct),
                                  CFG_JS="window.DRB=" + json.dumps(st) + ";")



def _checkout_or_json(payload):
    """If a browser form POSTed (no JSON accept / no X-Requested-With), redirect to
    the BTCPay checkout page instead of showing raw JSON."""
    wants_html = "text/html" in (request.headers.get("Accept") or "") and "application/json" not in (request.headers.get("Accept") or "")
    link = payload.get("checkoutLink") if isinstance(payload, dict) else None
    if wants_html and link:
        return Redirect(link)
    return jsonify(payload)


def Redirect(u):
    from flask import redirect as _r
    return _r(u)



def agent_card(endpoint, example, notes):
    """Interactive-for-LLMs card: exact curl + auth + link to openapi."""
    return ('<div class=card style=color:var(--dim);font-size:.85rem><b style=color:var(--fg)>FOR AGENTS</b> '
            '<span title="Every tool is callable over JSON. Auth: account session cookie, API key (Authorization: Bearer dk_…) or PASS.">?</span><br>'
            '<code style=color:var(--ok)>' + esc(endpoint) + '</code><br>'
            '<code style=white-space:pre-wrap;display:block;margin:.3rem 0;padding:.5rem .7rem;border-radius:8px;background:rgba(10,15,30,.95)>' + esc(example) + '</code>'
            '<button style=padding:.2rem .6rem;font-size:.75rem;margin-right:.5rem data-cmd="' + esc(example) + '" onclick="cp(this.dataset.cmd)">copy curl</button>' + esc(notes) +
            ' · spec: <a href=/openapi.json style=color:var(--acc)>/openapi.json</a> · catalog: <a href=/llms.txt style=color:var(--acc)>/llms.txt</a></div>')


def gloss(terms):
    chips = " ".join('<span class=tchip title="' + esc(d) + '" style="border:1px solid var(--line);border-radius:999px;padding:.25rem .75rem;cursor:help;display:inline-block;margin:.2rem .15rem;background:rgba(10,15,30,.6)">' + esc(t) + '</span>' for t, d in terms)
    return '<div class=card style=color:var(--dim);font-size:.85rem><b style=color:var(--fg)>JARGON</b> — hover any chip:<div style=margin-top:.4rem>' + chips + '</div></div>'


def how(steps):
    lis = "".join(f"<li>{esc(s)}</li>" for s in steps)
    return f'<div class=card><b>HOW IT WORKS</b><ol style="color:var(--dim);margin:.6rem 0 0;padding-left:1.5rem">{lis}</ol></div>'

def flow(title, steps):
    """Concrete example flow: numbered scene-by-scene walkthrough with role chips."""
    lis = "".join(f"<li>{s}</li>" for s in steps)  # steps carry their own <b>/<span> markup
    return f'<div class=card><b>EXAMPLE FLOW — {esc(title)}</b><ol class=steps>{lis}</ol></div>'


# ---------- AGENT DISCOVERY ----------
LLMS_SETTINGS = """
## ACCOUNT TUNABLES (machine-settable)
GET/POST /api/settings — keys: bg, warp, parallax, density (0-2.5), speed (0-3), twinkle (0-3), hue (-180-180), grid, scan, toast, type (1|0).
Agents driving browsers (or building clients) can persist a theme per API key: POST form-encoded key=value. Values validated server-side.
## KEYBOARD
Ctrl+K / Cmd+K — command palette on any page. Type tool name, Enter navigates.
"""
API_INDEX = {
    "service": "dark0rbits",
    "description": "IP intel, card BIN validation, 30-min SMS rentals, residential proxy lab, steganography, trackable files, no-KYC messaging, utilities.",
    "endpoints": [
        {"method": "GET",  "path": "/signup", "desc": "No-KYC signup page (humans): username + password, 4+ chars, ~10 seconds. Agents: POST /inbox form act=register&u=NAME&p=PASS -> session cookie dark0rbits_tok (30 days) + $1 free trial credit."},
        {"method": "GET/POST", "path": "/api/settings", "desc": "Per-account UI tunables (bg, warp, parallax, density, speed, twinkle, hue, grid, scan, toast, type). Agents can theme their own client. GET returns current; POST form key=val applies (validated + clamped)."},
        {"method": "GET",  "path": "/deaddrop", "desc": "Burn-after-read encrypted notes. POST /api/deaddrop/create (body, burn_after 1-10, ttl_hours 1-72, password optional) -> token. FREE."},
        {"method": "GET",  "path": "/shot", "desc": "Page capture: POST /api/shot/create {url} then GET /api/shot/status/<id>. SSRF-guarded. FREE."},
        {"method": "GET",  "path": "/score", "desc": "Composite fraud score: IP 45% + disposable-email 25% + BIN 30%. FREE."},
        {"method": "GET",  "path": "/api/ip?target=", "desc": "Caller IP intel (auto) or any IP you pass: geo, ASN, ISP, VPN/hosting flags, rDNS."},
        {"method": "GET",  "path": "/api/phone?num=", "desc": "Phone OSINT: validity, country, region, carrier, line type (mobile/landline/voip), timezones, risk flags + free deep-dive lead links. Any format."},
        {"method": "GET",  "path": "/api/user?u=", "desc": "Username OSINT: probes 16 platforms in parallel (GitHub, Reddit, Telegram, Steam…) → per-site found/not-found/unknown + lead links."},
        {"method": "GET",  "path": "/api/domain?d=", "desc": "Domain OSINT: RDAP registration (registrar/dates/status), full DNS (A/AAAA/MX/NS/TXT/CNAME via DoH), certificate-transparency subdomains. Passive."},
        {"method": "POST", "path": "/api/forensics", "files": ["image"], "desc": "Deep image forensics: all EXIF IFDs, decoded GPS + map links, XMP, embedded thumbnail, hashes, editor flags, ELA verdict."},
        {"method": "POST", "path": "/api/card", "params": {"num": "card number"}, "desc": "Luhn + BIN intel. Nothing stored/charged."},
        {"method": "POST", "path": "/api/sms/rent", "params": {"service": "id/keyword", "country": "id"}, "desc": "Rent disposable number, 30 min, refundable."},
        {"method": "GET",  "path": "/api/sms/check?pid=", "desc": "Poll SMS code."},
        {"method": "GET",  "path": "/api/sms/cancel?pid=", "desc": "Cancel + refund."},
        {"method": "GET",  "path": "/api/sms/history", "desc": "Rental history."},
        {"method": "POST", "path": "/api/proxy/test", "params": {"user": "Pleiades user", "pass": "password"}, "desc": "Tunnel CONNECT via Pleiades gateway, return egress IP/geo."},
        {"method": "POST", "path": "/api/steg/hide", "params": {"image": "png file", "text": "secret", "password": "optional", "bits": "1-3", "spread": "sequential|random"}, "desc": "LSB steganography → PNG download."},
        {"method": "POST", "path": "/api/steg/extract", "params": {"image": "png file", "password": "optional"}, "desc": "Extract hidden text."},
        {"method": "POST", "path": "/api/track/create", "params": {"filename": "name"}, "desc": "Create free trackable file. Returns upload_url + token. Login required (POST /inbox act=register)."},
        {"method": "GET",  "path": "/api/track/events?token=", "desc": "Open events for a trackable (auth via account)."},
        {"method": "GET",  "path": "/api/hash?s=", "desc": "md5/sha1/sha256/sha512."},
        {"method": "GET",  "path": "/api/hdr?url=", "desc": "Fetch URL, return status + headers."},
        {"method": "POST", "path": "/api/deaddrop/create", "params": {"body": "note text (max 8000 chars)", "burn_after_reads": "1-10", "ttl_hours": "1-72", "password": "optional"}, "desc": "AES-GCM encrypted burn-after-read note. Returns /drop/<token> URL. FREE. Reads decrement; note self-destructs at 0 or at TTL."},
        {"method": "GET",  "path": "/drop/<token>", "desc": "Read a dead-drop (password-protected if set). Each view burns one read."},
        {"method": "POST", "path": "/api/shot/create", "params": {"url": "http(s):// target"}, "desc": "Screenshot queue. Headless Chromium PNG if available, else rendered-text capture (status=text_fallback). FREE. Poll /api/shot/status/<id>."},
        {"method": "GET",  "path": "/api/shot/status/<id>", "desc": "Shot result: base64 PNG (png_b64) or text preview + page intel."},
        {"method": "GET", "path": "/dms", "desc": "Dead man switch: arm switches with pre-written payload messages; check in via curl or they seal as burn-after-read dead-drops when the window lapses. FREE."},
        {"method": "POST", "path": "/api/dms/create", "desc": "Arm a switch: label, interval_hours (24/48/72/168), 1-5 payloads, optional custodian note. Returns token + checkin_url. Auth: session or Bearer key."},
        {"method": "GET", "path": "/api/dms/list", "desc": "List your switches with status ARMED/LATE/TRIGGERED and drop URLs after trigger. Auth required."},
        {"method": "POST", "path": "/api/dms/checkin?token=", "desc": "Check in (no auth, token IS the key) -> 200 'checked in'. Resets the window. Missing the window seals payloads as /drop/ links."},
        {"method": "POST", "path": "/chain", "desc": "Create a custody chain. Form: name. Login required."},
        {"method": "POST", "path": "/chain/add", "desc": "Append an entry to a chain. Form: log (id), data. Login required. 60/min."},
        {"method": "GET",  "path": "/chain/export?log=", "desc": "Portable JSON receipt with seed, all entries, hashes and verification verdict. Login required."},
        {"method": "GET",  "path": "/api/chain/list", "desc": "Your chains with link counts and integrity verdicts. Login required."},
        {"method": "GET",  "path": "/api/chain/entries?log=&verify=1", "desc": "Full entry list for a chain; verify=1 adds verified, links, first_bad_seq. Login required."},
        {"method": "POST", "path": "/api/ghost/encode", "desc": "Embed a secret in zero-width characters between words of cover text (cover, secret, password optional). Carrier looks identical to the cover. 60/min."},
        {"method": "POST", "path": "/api/ghost/decode", "desc": "Extract hidden message from text (text, password optional). 60/min."},
        {"method": "GET",  "path": "/api/chaff?seed=", "desc": "Deterministic fake persona from a seed passphrase: name, usernames, birthdate, email pattern, password format, consistent security answers, avatar. Same seed = same persona. Stateless — nothing stored. region=US|UK|DE|NL|XX, domain= for email."},
        {"method": "POST", "path": "/api/tracer/case", "desc": "Create a leak-tracing case: per-recipient invisible zero-width watermarks on document text. name, text, recipients=a,b,c. Returns case_id + watermarked variants. Login."},
        {"method": "GET",  "path": "/api/tracer/identify?case_id=&text=", "desc": "Identify which recipient leaked: paste leaked fragment, get leaker + confidence. Login."},
        {"method": "POST", "path": "/api/traceout/run", "params": {"target": "domain or IPv4", "port": "dns|http|https|ssh", "maxhops": "1-30", "timeout": "0.3-5 s"}, "desc": "Hop-by-hop path trace from this host: per-hop IP, rDNS, rtt, geo. FREE."},
        {"method": "GET",  "path": "/api/traceout/history?limit=", "desc": "Your recent trace runs: target, resolved IP, hop count, complete flag."},
        {"method": "POST", "path": "/api/tchain/create", "desc": "Arm a breadcrumb trap chain: nhops (2-8) tripwire URLs where each hop's decoy note carries the next hop. Fires inbox alerts with geo per hop + summary when fully burned. Login."},
        {"method": "GET",  "path": "/api/tchain/status?chain_id=", "desc": "Per-hop chain state: seq, fired, timestamp, IP. Login."},
        {"method": "GET",  "path": "/api/score?ip=&email=&bin=", "desc": "Composite fraud score 0-100 + weighted breakdown: IP intel (VPN/hosting/abuse geo), disposable-email domain, BIN country/type risk. FREE."},
        {"method": "POST", "path": "/canary", "desc": "Create canary trap. Form: tag, kind (link|pixel|cred|file), rearm (0|1). Login required. Link = /c/<token>, pixel = /c/<token>.png, honeyfile = /c/<token>/download, credential returned by /api/canary/list."},
        {"method": "GET",  "path": "/api/canary/list", "desc": "Your traps with hit counts, links, generated honeytoken credentials. Login required."},
        {"method": "GET",  "path": "/api/canary/hits?token=", "desc": "Full hit log for a trap: ts, ip, ua, lang, ref + geolocated city/ISP/VPN flags per hit. Login required."},
        {"method": "POST", "path": "/api/eh", "desc": "Email header forensics v2: origin IP (+source), origin_geo, hop chain, per-hop relay delays (delays), SPF/DKIM/DMARC verdicts, spoof flags. Handles pasted headers or .eml content. FREE 20/min."},
    ],
    "payment": "EVERYTHING IS FREE — the lab absorbs all costs (SMS rentals, mail, trackables, screenshots). No top-ups needed.",
}

@app.route("/api/settings", methods=["GET", "POST"])
def api_settings():
    uid = key_user() or current_user_id()
    if not uid:
        return jsonify({"ok": False, "error": "auth required: account session or API key"}), 401
    if request.method == "GET":
        return jsonify({"ok": True, "settings": get_settings(uid)})
    out = {}
    for k in DEFAULT_SETTINGS:
        if k in request.form:
            out[k] = set_setting(uid, k, request.form[k])
    return jsonify({"ok": True, "applied": out, "settings": get_settings(uid)})

@app.route("/api")
def api_index(): return jsonify(API_INDEX)

@app.route("/robots.txt")
def robots(): return "User-agent: *\nAllow: /\nSitemap: https://dark0rbits.thetempleofdoom.com/sitemap.xml\n", 200, {"Content-Type": "text/plain"}

@app.route("/a8f3dark0rbitskey.txt")
def indexnow_key(): return "a8f3d4rk0rbits9e2b1c7x5k8m2v4q6t8", 200, {"Content-Type": "text/plain"}

INDEXNOW = "a8f3d4rk0rbits9e2b1c7x5k8m2v4q6t8"

@app.route("/sitemap.xml")
def sitemap():
    S = "https://dark0rbits.thetempleofdoom.com"
    pages = ["", "ip", "card", "sms", "proxy", "steg", "track", "eh", "forensics", "phone", "user", "domain", "canary", "deaddrop", "shot", "score", "mail", "inbox", "passport", "pass", "keys", "maglab", "tools", "signup", "dms"]
    xml = '<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' + "".join(f"<url><loc>{S}/{p}</loc><changefreq>weekly</changefreq></url>" for p in pages) + "</urlset>"
    return xml, 200, {"Content-Type": "application/xml"}

@app.route("/llms.txt")
def llms():
    eps = "\n".join(f"- `{e['method']} {e['path']}` — {e['desc']}" for e in API_INDEX["endpoints"])
    return f"# Dark0rbits\n\nBase: {SITE}\n\n## API\n{eps}\n{LLMS_SETTINGS}", 200, {"Content-Type": "text/plain"}

@app.route("/ai-plugin.json")
def aiplugin():
    return jsonify({"name_for_model": "dark0rbits", "schema_version": "v1",
        "description_for_model": "IP intelligence, card BIN validation, SMS number rentals, proxy egress testing, LSB steganography, trackable file links with open-notifications, no-KYC site messaging.",
        "api": {"type": "openapi", "url": SITE + "/openapi.json"}, "auth": {"type": "none"}, "contact_email": "makemoneys8@proton.me"})

@app.route("/openapi.json")
def openapi():
    ps = {"openapi": "3.0.0", "info": {"title": "DARK0RBITS", "version": "2.0.0"}, "paths": {}}
    def add(path, method, desc, params=None, req=False, files=None):
        item = {"summary": desc}
        if files:
            item["requestBody"] = {"content": {"multipart/form-data": {"schema": {"type": "object", "properties": {**{k: {"type": "string"} for k, v in (params or {}).items()}, **{f: {"type": "string", "format": "binary"} for f in files}}}}}}
        elif params:
            if method == "get":
                item["parameters"] = [{"name": k, "in": "query", "required": req, "schema": {"type": "string"}} for k in params]
            else:
                item["requestBody"] = {"content": {"application/x-www-form-urlencoded": {"schema": {"type": "object", "properties": {k: {"type": "string"} for k in params}}}}}
        ps["paths"][path] = ps["paths"].get(path, {}) | {method: {"responses": {"200": {"description": "ok"}}, **item}}
    add("/api/ip", "get", "IP intel (caller or ?target=)", {"target": "optional IP"})
    add("/api/phone", "get", "Phone OSINT: carrier, line type, region, timezones, leads", {"num": "phone number, any format"}, req=True)
    add("/api/user", "get", "Username OSINT probe across 16 platforms", {"u": "username"}, req=True)
    add("/api/domain", "get", "Domain recon: RDAP + DNS + CT subdomains", {"d": "domain"}, req=True)
    add("/api/forensics", "post", "Deep image forensics: EXIF IFDs, GPS decoded, XMP, thumbnail, ELA", files=["image"])
    add("/api/card", "post", "Luhn + BIN validation", {"num": "card number"}, req=True)
    add("/api/sms/rent", "post", "Rent number 30 min", {"service": "id", "country": "id"}, req=True)
    add("/api/sms/check", "get", "Poll SMS code", {"pid": "orderid"}, req=True)
    add("/api/sms/cancel", "get", "Cancel + refund", {"pid": "orderid"}, req=True)
    add("/api/sms/history", "get", "Rental history")
    add("/api/proxy/test", "post", "Test Pleiades gateway creds", {"user": "user", "pass": "pass"}, req=True)
    add("/api/steg/hide", "post", "LSB-hide text in PNG", {"text": "secret", "password": "opt"}, req=True, files=["image"])
    add("/api/steg/extract", "post", "Extract text from PNG", {"password": "opt"}, files=["image"])
    add("/api/track/create", "post", "Create $1 invoice for trackable", {"filename": "name"}, req=True)
    add("/api/track/events", "get", "Trackable open events", {"token": "token"}, req=True)
    add("/api/hash", "get", "Hashes", {"s": "string"}, req=True)
    add("/api/hdr", "get", "HTTP headers", {"url": "url"}, req=True)
    add("/api/deaddrop/create", "post", "Encrypted burn-after-read note", {"body": "text", "burn_after_reads": "1-10", "ttl_hours": "1-72", "password": "optional"}, req=True)
    add("/drop/{token}", "get", "Read a dead-drop (burns one read)")
    add("/api/shot/create", "post", "Queue page capture", {"url": "target url"}, req=True)
    add("/api/shot/status/{id}", "get", "Shot result (png_b64 or text_fallback)")
    add("/api/score", "get", "Composite fraud score 0-100", {"ip": "opt", "email": "opt", "bin": "opt"})
    add("/canary", "post", "Create canary trap (tag, kind, rearm)", {"tag": "label", "kind": "link|pixel|cred|file", "rearm": "0|1"}, req=True)
    add("/api/canary/list", "get", "Your traps + hit counts + honeytoken creds")
    add("/api/canary/hits", "get", "Full hit log with geo per hit", {"token": "trap token"}, req=True)
    add("/api/eh", "post", "Email header forensics v2 (origin, delays, verdicts, flags)", {"raw": "full headers or .eml content"}, req=True)
    add("/api/dms/create", "post", "Arm a dead man switch: label, interval_hours 24/48/72/168, 1-5 payloads, optional custodian note. Returns token + checkin curl.", {"label": "switch label", "interval_hours": "24|48|72|168", "payloads": "list of 1-5 messages (or payload1..payload5)", "custodian": "optional encrypted note"}, req=True)
    add("/api/dms/list", "get", "List your dead man switches with status ARMED/LATE/TRIGGERED and sealed drop URLs.", None)
    add("/api/dms/checkin", "post", "Check in a switch by token (no login needed). 200 'checked in' resets the window.", {"token": "switch token"}, req=True)
    add("/chain", "post", "Create a custody chain (name)", {"name": "chain label"}, req=True)
    add("/chain/add", "post", "Append an entry to a chain (log, data)", {"log": "chain id", "data": "event text"}, req=True)
    add("/chain/export", "get", "Portable JSON receipt of a chain", {"log": "chain id"}, req=True)
    add("/api/chain/list", "get", "Your chains + integrity verdicts", None, req=True)
    add("/api/chain/entries", "get", "Entries for a chain, optional verification", {"log": "chain id", "verify": "1 to include verdict"}, req=True)
    add("/api/ghost/encode", "post", "Zero-width text steganography — embed secret in cover", {"cover": "innocent text", "secret": "hidden message", "password": "optional"}, req=True)
    add("/api/ghost/decode", "post", "Extract zero-width hidden message", {"text": "carrier text", "password": "optional"}, req=True)
    add("/api/chaff", "get", "Deterministic throwaway persona generator", {"seed": "passphrase", "region": "US|UK|DE|NL|XX", "domain": "email domain"}, req=True)
    add("/api/tracer/case", "post", "Leak tracer: watermarked copies per recipient", {"name": "case name", "text": "document text", "recipients": "comma labels"}, req=True)
    add("/api/tracer/identify", "get", "Identify the leaker from a fragment", {"case_id": "case", "text": "leaked fragment"}, req=True)
    add("/api/tracer/run", "post", "Traceroute from this host to target with per-hop geo", {"target": "domain or IPv4", "port": "dns|http|https|ssh", "maxhops": "1-30", "timeout": "seconds"}, req=True)
    add("/api/tracer/history", "get", "Recent traceroute runs for this account", {"limit": "max runs"}, req=False)
    add("/api/tchain/create", "post", "Breadcrumb tripwire chain (each trap reveals the next)", {"name": "chain name", "nhops": "2-8"}, req=True)
    add("/api/tchain/status", "get", "Trap chain per-hop status", {"chain_id": "chain"}, req=True)
    add("/signup", "get", "No-KYC signup page (username + password only)")
    return jsonify(ps)

# ---------- 1. IP INTEL (auto + manual target) ----------
def ip_report(ip):
    st, b = http(f"http://ip-api.com/json/{ip}?fields=66846719")
    d = jf(b) or {}
    try: d["reverse"] = d.get("reverse") or socket.gethostbyaddr(ip)[0]
    except Exception: pass
    return d

@app.route("/ip", methods=["GET", "POST"])
def ip_page():
    target = param("target") if request.method == "POST" else param("target")
    if target and target.strip():
        target = target.strip()
        d = ip_report(target)
        heading = f"INTEL FOR <span>{esc(target)}</span>"
        mine = False
    else:
        ip = request.headers.get("X-Real-IP") or request.remote_addr or ""
        d = ip_report(ip)
        heading = "WHAT'S <span>MY IP</span>"
        mine = True
    if d.get("status") == "fail" or not d:
        body = f"<h1>{heading}</h1><div class=card><span class=tag bad>lookup failed</span></div>{ip_form()}"
        return page("ip", body)
    rows = [
        ("IP", f"<b style='font-size:1.3rem;color:var(--acc)'>{esc(d.get('query'))}</b>"),
        ("Country", f"{esc(d.get('country'))} ({esc(d.get('countryCode'))})"),
        ("Region / City", f"{esc(d.get('regionName'))} / {esc(d.get('city'))} {esc(d.get('zip'))}"),
        ("Lat, Lon", f"{d.get('lat')}, {d.get('lon')} · TZ {esc(d.get('timezone'))}"),
        ("ISP", esc(d.get("isp"))), ("Organization", esc(d.get("org"))), ("AS", esc(d.get("as") or d.get("asname"))),
        ("Reverse DNS", esc(d.get("reverse") or "—")),
        ("Flags", f"mobile: {d.get('mobile')} · proxy/VPN: {d.get('proxy')} · hosting: {d.get('hosting')}"),
        ("Currency", esc(d.get("currency"))),
    ]
    extra = ""
    if mine:
        hdrs = {k: v for k, v in request.headers.items() if k.lower() in ("user-agent","accept-language","x-forwarded-for","cf-connecting-ip","cf-ipcountry")}
        extra = '<div class=card><b>Headers you sent</b><table>' + "".join(f"<tr><td>{esc(k)}</td><td>{esc(v)}</td></tr>" for k, v in hdrs.items()) + "</table></div>"
    body = f"""
<h1>{heading}</h1><p class=sub>Auto-detects your IP and shows everything. Want intel on another IP? Type it below — full report, any target.</p>
{kv(rows)}
<div class=card><form method=post><input name=target placeholder="any IP or hostname" style="width:70%" value="{esc(param('target') or '')}"> <button>Look up</button></form></div>
{extra}
<div class=card style=color:var(--dim)>API: GET /api/ip (caller) · GET /api/ip?target=1.2.3.4 (any target)</div>""" + how(["Your IP is auto-detected the moment the page loads — no input needed.","Type any other IP or hostname into the field for the same full report.","Everything is one GET away for agents: /api/ip and /api/ip?target=.","VPN/proxy/hosting flags come from IP-quality heuristics — if it says proxy, you are looking at a relay."])
    body += gloss([("ASN","Autonomous System Number — the network operator that owns this route"),("rDNS","reverse DNS — hostname pointer for an IP"),("hosting","datacenter/cloud IP, not a home connection"),("VPN/proxy","known tunnel or relay range")])
    body += agent_card('GET /api/ip?target=1.2.3.4', 'curl "https://dark0rbits.thetempleofdoom.com/api/ip?target=1.2.3.4" -H "Authorization: Bearer drb_..."', 'Auto-detects caller IP if target omitted.')
    return page("ip", body)

def ip_form():
    return '<div class=card><form method=post><input name=target placeholder="IP or hostname"><button>Look up</button></form></div>'

@app.route("/api/ip")
def api_ip():
    r = rate_limit("iptarget", 40, 60)
    if r: return r
    target = param("target")
    if target and target.strip():
        return jsonify(ip_report(target.strip()))
    ip = request.headers.get("X-Real-IP") or request.remote_addr or ""
    d = ip_report(ip)
    d["headers_seen"] = dict(request.headers)
    return jsonify(d)

# ---------- 2. CARD CHECK ----------
def luhn_ok(num):
    digits = [int(c) for c in num]
    s = sum(digits[-1::-2])
    for d in digits[-2::-2]:
        d *= 2
        if d > 9: d -= 9
        s += d
    return s % 10 == 0

BRANDS = [("4","Visa"),("51","Mastercard"),("52","Mastercard"),("53","Mastercard"),("54","Mastercard"),("55","Mastercard"),
          ("22","Mastercard"),("23","Mastercard"),("24","Mastercard"),("25","Mastercard"),("26","Mastercard"),("27","Mastercard"),
          ("34","Amex"),("37","Amex"),("6011","Discover"),("65","Discover"),("644","Discover"),("645","Discover"),("646","Discover"),("647","Discover"),("648","Discover"),("649","Discover"),
          ("50","Maestro"),("56","Maestro"),("57","Maestro"),("58","Maestro"),("63","Maestro"),("67","Maestro"),
          ("30","Diners"),("36","Diners"),("38","Diners"),("39","Diners"),
          ("35","JCB"),("62","UnionPay"),("7","Mir")]

def brand_of(num):
    for pfx, b in BRANDS:
        if num.startswith(pfx): return b
    return "Unknown"

def bin_lookup(bin8):
    st, b = http(f"https://lookup.binlist.net/{bin8}", headers={"Accept-Version": "3"})
    bl = jf(b) or {}
    if not bl.get("bank") and not bl.get("type") and not bl.get("scheme"):
        st, b = http(f"https://data.handyapi.com/bin/{bin8}")
        h = jf(b) or {}
        if h.get("Status") == "SUCCESS":
            return {"bank": {"name": h.get("Issuer")}, "country": {"name": (h.get("Country") or {}).get("Name") if isinstance(h.get("Country"), dict) else h.get("Country")},
                    "type": str(h.get("Type", "")).lower() or None, "prepaid": "prepaid" in str(h.get("Type","")).lower() or None, "scheme": h.get("Scheme")}
    return bl

# ---------- 2b. PHONE LOOKUP (OSINT, offline metadata + free lead links) ----------
def phone_report(raw):
    out = {"ok": False}
    try:
        import phonenumbers as pn
        from phonenumbers import carrier as pncarrier, timezone as pntz, geocoder as pngeo
        n = pn.parse(raw.strip(), None)
    except Exception as e:
        out["error"] = f"cannot parse number: {e}"[:200]
        return out
    out["ok"] = True
    out["e164"] = pn.format_number(n, pn.PhoneNumberFormat.E164)
    out["national"] = pn.format_number(n, pn.PhoneNumberFormat.NATIONAL)
    out["international"] = pn.format_number(n, pn.PhoneNumberFormat.INTERNATIONAL)
    out["valid"] = pn.is_valid_number(n)
    out["possible"] = pn.is_possible_number(n)
    out["country"] = pn.region_code_for_country_code(n.country_code or 0)
    try: out["country_calling_code"] = f"+{n.country_code}"
    except Exception: pass
    try:
        out["region_desc"] = pngeo.description_for_number(n, "en") or ""
    except Exception: out["region_desc"] = ""
    try:
        out["carrier"] = pncarrier.name_for_number(n, "en") or ""
    except Exception: out["carrier"] = ""
    try:
        out["timezones"] = list(pntz.time_zones_for_number(n))
    except Exception: out["timezones"] = []
    tmap = {0:"fixed_line",1:"mobile",2:"fixed_or_mobile",3:"freephone",4:"premium_rate",5:"shared_cost",6:"voip",7:"personal_number",8:"pager",9:"uan",10:"voicemail"}
    try:
        t = pn.number_type(n)
        out["line_type"] = tmap.get(t, "unknown")
        out["line_type_risk"] = ("voip/uan numbers are often disposable or bulk-registered" if t in (6, 9) else "")
    except Exception: out["line_type"] = "unknown"
    q = out["e164"]
    out["leads"] = {
        "google": "https://www.google.com/search?q=%22" + urllib.parse.quote(q) + "%22",
        "duckduckgo": "https://duckduckgo.com/?q=" + urllib.parse.quote(q),
        "truecaller": "https://www.truecaller.com/search/" + (out["country"] or "us").lower() + "/" + q.lstrip("+"),
    }
    if out["line_type"] == "voip": out.setdefault("flags", []).append("voip — high disposable/spoof potential")
    if not out["valid"]: out.setdefault("flags", []).append("not a valid number — fake or mistyped")
    return out

@app.route("/phone", methods=["GET", "POST"])
def phone_tool():
    res = ""
    if request.method == "POST":
        raw = param("num") or ""
        if raw.strip():
            d = phone_report(raw)
            if d.get("ok"):
                res = kv([
                    ("Number", f'<b style="font-size:1.15rem;color:var(--acc)">{esc(d["e164"])}</b> ({esc(d["national"])})'),
                    ("Valid", '<span class="tag ok">VALID</span>' if d["valid"] else '<span class="tag bad">NOT VALID</span>'),
                    ("Country", esc(d["country"]) + " " + esc(d["country_calling_code"])),
                    ("Region", esc(d["region_desc"]) or "—"),
                    ("Carrier", esc(d["carrier"]) or "—"),
                    ("Line type", esc(d["line_type"])),
                    ("Timezones", esc(", ".join(d["timezones"])) or "—"),
                ])
                if d.get("flags"):
                    res += '<div class="card"><b>Flags</b><br>' + "<br>".join('<span class="tag bad" style="margin:.15rem">' + esc(f) + "</span>" for f in d["flags"]) + "</div>"
                l = d["leads"]
                res += f'''<div class="card"><b>Deep-dive leads (free public sources)</b><br>
<a href="{esc(l['google'])}" target=_blank rel=noopener style=color:var(--acc)>Google the exact number →</a> ·
<a href="{esc(l['duckduckgo'])}" target=_blank rel=noopener style=color:var(--acc)>DuckDuckGo →</a> ·
<a href="{esc(l['truecaller'])}" target=_blank rel=noopener style=color:var(--acc)>TrueCaller web search →</a></div>'''
            else:
                res = f'<div class="card"><span class="tag bad">PARSE FAILED</span><br>{esc(d.get("error"))}</div>'
    body = f"""
<h1>PHONE <span>LOOKUP</span></h1><p class=sub>Parse + intel on any number worldwide: validity, country, region, carrier, line type (mobile/landline/VOIP), timezones — plus free deep-dive lead links. No KYC, no logs.</p>
<div class=card><form method=post><input name=num placeholder="+1 425 555 0100 — any format, any country" style=width:70% required><button style=margin-top:.5rem>Lookup</button></form></div>
{res}
<div class=card style=color:var(--dim)>API: GET /api/phone?num=%2B14255550100 → JSON: valid, country, region, carrier, line_type, timezones, flags, lead links.</div>""" + how(["Type the number in any format — country code, spaces, dashes, all handled.",
"Metadata comes from offline libphonenumber data — instant and private, nothing phoned home.",
"Line type matters: VOIP/UAN numbers are the disposable, bulk-registered kind.",
"Follow the lead links for the human layer: public mentions, directory listings, name lookups.",
"Pair it with SMS RENTAL — know the number type before you verify with it."])
    body += gloss([("E164","the international standard format: + and country code, no spaces"),("line type","mobile vs landline vs VOIP — carriers publish the ranges"),("VOIP","internet-based number — cheap, disposable, often spoofed")])
    body += agent_card('GET /api/phone?num=%2B14255550100', 'curl "https://dark0rbits.thetempleofdoom.com/api/phone?num=%2B14255550100"', 'valid, country, region, carrier, line_type, timezones, flags + free lead links.')
    return page("phone", body)

@app.route("/api/phone", methods=["GET", "POST"])
def api_phone():
    r = rate_limit("phone", 30, 60)
    if r: return r
    raw = (param("num") or "").strip()
    if not raw: return jsonify({"ok": False, "error": "num required (any format, country code encouraged)"}), 400
    return jsonify(phone_report(raw))

# ---------- 2c. USERNAME SLEUTH (OSINT profile probe) ----------
USER_SITES = [
    ("GitHub", "https://github.com/{u}"),
    ("GitLab", "https://gitlab.com/{u}"),
    ("Reddit", "https://www.reddit.com/user/{u}/"),
    ("Telegram", "https://t.me/{u}"),
    ("Medium", "https://medium.com/@{u}"),
    ("Pastebin", "https://pastebin.com/u/{u}"),
    ("Keybase", "https://keybase.io/{u}"),
    ("About.me", "https://about.me/{u}"),
    ("SoundCloud", "https://soundcloud.com/{u}"),
    ("Vimeo", "https://vimeo.com/{u}"),
    ("Steam", "https://steamcommunity.com/id/{u}"),
    ("Last.fm", "https://www.last.fm/user/{u}"),
    ("Dribbble", "https://dribbble.com/{u}"),
    ("Imgur", "https://imgur.com/user/{u}"),
    ("Chess.com", "https://www.chess.com/member/{u}"),
    ("Twitch", "https://www.twitch.tv/{u}"),
]
def _probe_site(name, url):
    st, b = http(url, timeout=10)
    if st == 200:
        return {"site": name, "url": url, "status": "found", "http": st}
    if st == 404:
        return {"site": name, "url": url, "status": "not found", "http": st}
    return {"site": name, "url": url, "status": "unknown", "http": st, "note": "site blocked or rate-limited the probe — check manually"}

def user_probe(u):
    from concurrent.futures import ThreadPoolExecutor
    with ThreadPoolExecutor(max_workers=8) as ex:
        results = list(ex.map(lambda s: _probe_site(s[0], s[1].format(u=urllib.parse.quote(u))), USER_SITES))
    found = [r for r in results if r["status"] == "found"]
    return {"ok": True, "username": u, "found": found, "results": results,
            "hits": len(found), "leads": {
                "google": "https://www.google.com/search?q=%22" + urllib.parse.quote(u) + "%22",
                "instantusername": "https://instantusername.com/#/" + urllib.parse.quote(u)}}

@app.route("/user", methods=["GET", "POST"])
def user_tool():
    res = ""
    if request.method == "POST":
        u = (param("u") or "").strip()
        if u and 2 <= len(u) <= 60 and all(c not in "<>\"'" for c in u):
            d = user_probe(u)
            rows = "".join(f'<tr><td>{esc(r["site"])}</td><td><span class="tag {"ok" if r["status"]=="found" else ("warn" if r["status"]=="unknown" else "")}">{esc(r["status"])}</span></td><td><a href="{esc(r["url"])}" target=_blank rel=noopener style=color:var(--acc)>{esc(r["url"])}</a></td><td>{r.get("http")}</td></tr>' for r in d["results"])
            res = kv([("Username", esc(u)), ("Profiles found", f'<b style="color:var(--ok)">{d["hits"]}</b> of {len(USER_SITES)} platforms')])
            res += f'<div class="card"><b>Probe results</b><table><tr><th>Site</th><th>Status</th><th>URL</th><th>HTTP</th></tr>{rows}</table></div>'
            res += f'<div class="card"><b>More leads</b><br><a href="{esc(d["leads"]["google"])}" target=_blank rel=noopener style=color:var(--acc)>Google the exact handle →</a> · <a href="{esc(d["leads"]["instantusername"])}" target=_blank rel=noopener style=color:var(--acc)>InstantUsername (60+ sites) →</a></div>'
    body = f"""
<h1>USERNAME <span>SLEUTH</span></h1><p class=sub>Give it a handle — it probes {len(USER_SITES)} major platforms in parallel and reports where that username lives. Classic OSINT footwork, automated.</p>
<div class=card><form method=post><input name=u placeholder="one handle, e.g. johndoe1987" style=width:70% required><button style=margin-top:.5rem>Probe</button></form></div>
{res}
<div class=card style=color:var(--dim)>API: GET /api/user?u=NAME → JSON with per-site found/not-found/unknown.</div>""" + how(["Type the handle — no @, no https, just the name.",
"Sixteen sites get probed at once — GitHub, Reddit, Telegram, Steam and more.",
"FOUND = a live profile answered on that exact URL. Unknown = the site blocked the probe (check manually).",
"Follow the Google/InstantUsername leads for the long tail of smaller platforms.",
"Same handle on multiple sites = the same human. That's the whole point."])
    body += gloss([("probe","an HTTP GET that never logs in or scrapes private data"),("handle","the username part of a profile URL"),("correlation","linking profiles across sites by shared handle")])
    body += agent_card('GET /api/user?u=somehandle', 'curl "https://dark0rbits.thetempleofdoom.com/api/user?u=somehandle"', 'Per-site found/not-found/unknown + lead links. ~8s, all probes in parallel.')
    return page("user", body)

@app.route("/api/user", methods=["GET", "POST"])
def api_user():
    r = rate_limit("user", 10, 60)
    if r: return r
    u = (param("u") or "").strip()
    if not u or len(u) > 60 or any(c in "<>\"'" for c in u): return jsonify({"ok": False, "error": "u required (max 60 chars, no html)"}), 400
    return jsonify(user_probe(u))

# ---------- 2d. DOMAIN RECON (RDAP + DNS + subdomains) ----------
def domain_report(d):
    d = d.strip().lower().replace("https://", "").replace("http://", "").split("/")[0]
    out = {"ok": True, "domain": d}
    st, b = http("https://rdap.org/" + urllib.parse.quote(d), timeout=15)
    rd = jf(b)
    if rd:
        out["rdap"] = {k: rd.get(k) for k in ("handle", "ldhName", "status", "events", "entities", "nameservers") if rd.get(k)}
        evs = {}
        for e in rd.get("events") or []:
            evs[e.get("eventAction", "?")] = e.get("eventDate")
        out["events"] = evs
        ents = []
        for e in rd.get("entities") or []:
            roles = e.get("roles") or []
            fn = ""
            try:
                v = e.get("vcardArray") or []
                for item in (v[1] if len(v) > 1 else []):
                    if item and item[0] == "fn": fn = item[3]
            except Exception: pass
            if "registrar" in roles or "registrant" in roles: ents.append({"roles": roles, "name": fn})
        out["entities"] = ents
    else:
        out["rdap_error"] = f"rdap.org returned {st}"
    doh = "https://dns.google/resolve?name=" + urllib.parse.quote(d) + "&type="
    recs = {}
    for rt in ("A", "AAAA", "MX", "NS", "TXT", "CNAME"):
        st, b = http(doh + rt, timeout=10)
        j = jf(b)
        if j and j.get("Answer"):
            recs[rt] = [a.get("data") for a in j["Answer"]]
    out["dns"] = recs
    st, b = http("https://crt.sh/?q=%25." + urllib.parse.quote(d) + "&output=json", timeout=25)
    subs = set()
    j = jf(b)
    if isinstance(j, list):
        for row in j:
            for nm in str(row.get("name_value", "")).split("\n"):
                nm = nm.strip().lower().lstrip("*.")
                if nm.endswith("." + d) and nm != d: subs.add(nm)
    out["subdomains"] = sorted(subs)[:100]
    out["subdomain_count"] = len(subs)
    return out

@app.route("/domain", methods=["GET", "POST"])
def domain_tool():
    res = ""
    if request.method == "POST":
        d = (param("d") or "").strip()
        if d and len(d) <= 100:
            try:
                rep = domain_report(d)
                evs = rep.get("events") or {}
                ent = "; ".join(f'{"/".join(e["roles"])}: {e["name"]}' for e in (rep.get("entities") or [])) or "—"
                ns = ", ".join(str(x.get("ldhName") or x) for x in (rep.get("nameservers") or rep.get("rdap", {}).get("nameservers") or [])) or (rep.get("dns", {}).get("NS") and ", ".join(rep["dns"]["NS"])) or "—"
                dns_rows = "".join(f"<tr><td>{esc(k)}</td><td>{esc('<br>'.join(v))}</td></tr>" for k, v in (rep.get("dns") or {}).items())
                subs = rep.get("subdomains") or []
                res = kv([("Registrar info", esc(ent)), ("Registered", esc(evs.get("registration", "—"))), ("Expires", esc(evs.get("expiration", "—"))), ("Last changed", esc(evs.get("last changed", "—"))), ("Status", esc(", ".join(rep.get("rdap", {}).get("status") or []) or "—")), ("Nameservers", esc(ns))])
                res += f'<div class="card"><b>DNS</b><table>{dns_rows or "<tr><td style=color:var(--dim)>none resolved</td></tr>"}</table></div>'
                res += f'<div class="card"><b>Certificate-transparency subdomains</b> <span style=color:var(--dim)>({rep.get("subdomain_count",0)} found)</span><br>' + (esc(" · ".join(subs[:60])) + (" …" if len(subs) > 60 else "") or "—") + "</div>"
            except Exception as e:
                res = f'<div class="card"><span class="tag bad">LOOKUP FAILED</span><br>{esc(str(e)[:300])}</div>'
    body = f"""
<h1>DOMAIN <span>RECON</span></h1><p class=sub>Full passive recon on any domain: RDAP registration data (registrar, dates, status), live DNS records, and certificate-transparency subdomain discovery. Free, no keys.</p>
<div class=card><form method=post><input name=d placeholder="example.com" style=width:70% required><button style=margin-top:.5rem>Recon</button></form></div>
{res}
<div class=card style=color:var(--dim)>API: GET /api/domain?d=example.com → JSON: rdap, events, entities, dns, subdomains.</div>""" + how(["Type the bare domain — no scheme, no path.",
"RDAP answers who runs it, when it was registered and when it expires.",
"DNS shows A/AAAA/MX/NS/TXT/CNAME — where it lives and what mail it accepts.",
"Certificate logs expose hostnames even when DNS tries to hide them — great for finding staging/hidden subdomains.",
"All sources are public registries — passive, no packets touch the target."])
    body += gloss([("RDAP","modern successor to WHOIS — structured registration data"),("CT log","certificate-transparency log: every TLS cert ever issued, public"),("TXT","DNS records used for SPF/verification claims")])
    body += agent_card('GET /api/domain?d=example.com', 'curl "https://dark0rbits.thetempleofdoom.com/api/domain?d=example.com"', 'RDAP registration, DNS records, CT-log subdomains. Passive OSINT, free.')
    return page("domain", body)

@app.route("/api/domain", methods=["GET", "POST"])
def api_domain():
    r = rate_limit("domain", 10, 60)
    if r: return r
    d = (param("d") or "").strip()
    if not d or len(d) > 100: return jsonify({"ok": False, "error": "d required"}), 400
    return jsonify(domain_report(d))

@app.route("/card", methods=["GET", "POST"])
def card():
    result = ""
    num = re.sub(r"\D", "", param("num") or "")[:19]
    if num:
        ok = luhn_ok(num)
        tags = ['<span class="tag ok">LUHN VALID</span>' if ok else '<span class="tag bad">LUHN INVALID — fake/dead number</span>']
        brand = brand_of(num)
        bl = bin_lookup(num[:8])
        bank = (bl.get("bank") or {}).get("name", "—")
        country = (bl.get("country") or {}).get("name", "—")
        ctype = bl.get("type", "—")
        prepaid = bl.get("prepaid", "—")
        flags = []
        if ctype == "prepaid" or prepaid is True: flags.append("PREPAID — commonly flagged by merchants")
        rng = {"Visa":(13,16,19),"Mastercard":(16,),"Amex":(15,)}.get(brand,(13,15,16,19))
        tags.append(f'<span class="tag ok">length {len(num)} valid for {brand}</span>' if len(num) in rng else f'<span class="tag bad">LENGTH {len(num)} WRONG for {brand}</span>')
        result = f"""
{kv([("Brand",brand),("BIN",num[:8]),("Bank / Issuer",esc(bank)),("Country",esc(country)),("Type",str(ctype)),("Prepaid",str(prepaid))])}
<div class=card><b>Fraud &amp; structure flags</b><br>{' '.join(tags)}{'<br>⚠ ' + ' · '.join(flags) if flags else ''}</div>
<div class=card style=color:var(--dim)>Nothing stored. No charge, no auth — BIN + math validation only. Fraud "flagged" status lives at the issuer.</div>""" + how(["Paste the card number — it never leaves the request, nothing is stored.","Luhn checksum validates the digit structure instantly.","BIN (first 8 digits) reveals the issuer bank, brand, card type and country.","Prepaid BINs get flagged — merchants commonly reject them.","This CANNOT show balance or fraud-hold status; only the issuer knows that."])
    body = f"""
<h1>CARD <span>CHECK</span></h1><p class=sub>Luhn + BIN intelligence: issuer, brand, type, country, prepaid risk flags.</p>
<div class=card><form method=post><input id=cardnum name=num placeholder="4539 1488 0343 6467" style="width:70%" value="{esc(' '.join(num[i:i+4] for i in range(0,len(num),4))) if num else ''}" autocomplete=off inputmode=numeric> <button>Check</button></form>
<div style=color:var(--dim);font-size:.85rem;margin-top:.4rem>Paste anything — auto-formats. Nothing stored.</div></div>
<script>
var cn=document.getElementById('cardnum');
cn.addEventListener('input',function(){{var v=this.value.replace(/\\D/g,'').slice(0,19);this.value=v.replace(/(.{{4}})/g,'$1 ').trim()}});
</script>
{result}"""
    body += gloss([("BIN","first 6-8 digits of a card — identifies issuer, country, brand"),("Luhn","checksum test every real card number passes"),("prepaid","issued as prepaid — elevated fraud risk")])
    body += agent_card('POST /api/card  num=4539148803436467', 'curl -X POST https://dark0rbits.thetempleofdoom.com/api/card -d num=4539148803436467', 'Luhn + BIN intel. 2c/metered with API key, free with PASS.')
    return page("card", body)

@app.route("/api/card", methods=["POST"])
def api_card():
    r = rate_limit("card", 30, 60)
    if r: return r
    num = re.sub(r"\D", "", param("num") or "")[:19]
    if not num: return jsonify({"ok": False, "error": "num required"})
    ok = luhn_ok(num)
    bl = bin_lookup(num[:8])
    return jsonify({"ok": True, "luhn": ok, "brand": brand_of(num), "length_ok": len(num) in
        {"Visa":(13,16,19),"Mastercard":(16,),"Amex":(15,)}.get(brand_of(num),(13,15,16,19)),
        "bin": {"issuer": (bl.get("bank") or {}).get("name"), "country": (bl.get("country") or {}).get("name"),
                "type": bl.get("type"), "prepaid": bl.get("prepaid")},
        "flags": (["prepaid-risk"] if (bl.get("type")=="prepaid" or bl.get("prepaid") is True) else []) + (["luhn-invalid"] if not ok else [])})

# ---------- 7i. SCREENSHOT SERVICE (chromium if present, else rendered-text fallback) ----------
def shot_url_ok(u):
    if not re.match(r"^https?://", u): return None, "url must start with http:// or https://"
    try:
        host = urllib.parse.urlsplit(u).hostname or ""
    except Exception:
        return None, "url parse error"
    if not host: return None, "url has no host"
    try:
        candidate = ipaddress.ip_address(host)
    except ValueError:
        candidate = None
    if candidate:
        if candidate.is_private or candidate.is_loopback or candidate.is_link_local or candidate.is_reserved: return None, "private/reserved IPs blocked"
        return u, None
    try:
        resolved = ipaddress.ip_address(socket.gethostbyname(host))
    except Exception:
        return u, None  # cannot resolve here — let the fetcher report the failure
    if resolved.is_private or resolved.is_loopback or resolved.is_link_local or resolved.is_reserved: return None, "private/reserved IPs blocked"
    return u, None

def shot_find_browser():
    for b in ("chromium", "chromium-browser", "google-chrome", "google-chrome-stable"):
        if shutil.which(b): return b
    return None

def _shot_html_harvest(url):
    """HTTP fetch + readability-ish text harvest + page intel. No browser, no fake PNG."""
    status, html_text = http(url, timeout=15)
    out = {"http_status": status}
    try:
        title = re.search(r"<title[^>]*>(.*?)</title>", html_text, re.I | re.S)
        if title: out["title"] = html.unescape(title.group(1)).strip()[:300]
        desc = re.search(r'<meta[^>]+name=["\']description["\'][^>]+content=["\'](.*?)["\']', html_text, re.I | re.S)
        if desc: out["description"] = html.unescape(desc.group(1)).strip()[:400]
    except Exception:
        pass
    intel = []
    for m in re.finditer(r"<h([1-3])[^>]*>(.*?)</h\1>", html_text, re.I | re.S):
        t = html.unescape(re.sub(r"<[^>]+>", "", m.group(2))).strip()
        if t: intel.append("h" + m.group(1) + ": " + t[:120])
        if len(intel) >= 15: break
    t = re.sub(r"(?is)<(script|style|noscript|svg)[^>]*>.*?</\1>", " ", html_text)
    t = re.sub(r"(?s)<!--.*?-->", " ", t)
    t = re.sub(r"(?i)<(br|/p|/div|/li|/h[1-6]|/tr)[^>]*>", "\n", t)
    t = re.sub(r"<[^>]+>", " ", t)
    t = html.unescape(t)
    t = re.sub(r"[ \t\r]+", " ", t)
    t = re.sub(r"\n\s*\n+", "\n", t).strip()
    words = t.split()
    out["text_preview"] = " ".join(words[:400])
    out["text_chars_total"] = len(words)
    out["headings"] = intel
    return out

def shot_run(sid):
    con = db()
    s = con.execute("SELECT * FROM shots WHERE id=?", (sid,)).fetchone()
    if not s: return
    url = s["url"]
    browser = shot_find_browser()
    if browser:
        out = os.path.join(UPLOAD_DIR, f"shot_{sid}.png")
        try:
            cmd = [browser, "--headless=new", "--no-sandbox", "--disable-gpu", "--hide-scrollbars",
                   "--window-size=1280,1600", f"--screenshot={out}", "--virtual-time-budget=8000", url]
            p = subprocess.run(cmd, capture_output=True, timeout=45)
            if p.returncode == 0 and os.path.exists(out) and os.path.getsize(out) > 0:
                with open(out, "rb") as f: png = f.read()
                os.remove(out)
                con.execute("UPDATE shots SET status=?, result=? WHERE id=?", ("done", base64.b64encode(png).decode(), sid))
                con.commit(); return
            err = (p.stderr or b"").decode(errors="replace")[:200]
            result = {"error": "chromium render failed: " + (err or f"exit {p.returncode}")}
        except subprocess.TimeoutExpired:
            result = {"error": "chromium timed out after 45s"}
        except Exception as e:
            result = {"error": f"chromium error: {e}"}
    else:
        try:
            result = _shot_html_harvest(url)
            result["mode"] = "text_fallback"
        except Exception as e:
            result = {"error": f"fetch failed: {e}"}
    con.execute("UPDATE shots SET status=?, result=? WHERE id=?", ("text_fallback" if "mode" in result else "error", json.dumps(result), sid))
    con.commit()

SHOT_API = ("<div class=card><b>AGENT API</b><pre>POST " + SITE + """/api/shot/create
  Content-Type: application/json  (or form fields)
  {"url":"https://example.com"}
  -> {"ok":true,"id":42,"status":"queued","poll":"BASE/api/shot/status/42"}
GET  /api/shot/status/42
  -> {"ok":true,"id":42,"status":"done","png_b64":"iVBORw..."}   (chromium present)
  -> {"ok":true,"status":"text_fallback","title":"...","text_preview":"...","headings":[...]}
auth: session cookie or Authorization: Bearer dk_...
25c/shot, free with PASS - rate limit 6/min
PNG mode: status "done" + png_b64. If chromium vanishes, expect text_fallback.</pre></div>""").replace("BASE", SITE)

SHOT_EXPLAINER = """<div class=card><b>HOW CAPTURE WORKS</b><br><span style="color:var(--dim);font-size:.85rem">
&bull; With <span title="headless Chromium renders the page with JS + CSS and writes a real 1280x1600 PNG — nothing is faked">headless Chromium</span> installed, /shot returns a real browser render as base64 PNG.
&bull; No browser on the host? You get <span title="HTTP fetch + readability harvest: title, meta description, headings and first 400 words — honest output, never a fake image">text_fallback</span>: an honest fetch of the page with rendered-text preview + page intel. A status field always tells you which.
&bull; <span title="Requests to localhost, RFC1918 ranges, link-local and reserved ranges are rejected — the capture service can't be turned into an SSRF probe">SSRF guard</span>: private/reserved network targets are refused before any fetch.
&bull; 25&cent; per shot, free with <span title="PASS = $10/mo all-access">PASS</span>. Rate limit 6/min.</span></div>"""

@app.route("/shot")
def shot_page():
    body = f"""
<h1>SCREEN <span>SHOT</span></h1><p class=sub>Point at a URL, get a real 1280×1600 headless-Chromium PNG render (base64 in the API). Honest text+intel fallback only if the renderer is down. Never a fake image.</p>
<div class=card><b>New capture</b>
<form method=post action=/api/shot/create onsubmit="doShot();return false">
<input id=shoturl name=url placeholder="https://target.example" style="width:min(560px,100%)" required>
<button style=margin-left:.4rem>Capture</button></form>
<div style="color:var(--dim);font-size:.85rem;margin-top:.5rem">{'Free with your PASS — or 25&cent; from balance.' if current_user_id() else 'Login + balance (or PASS): 25&cent; per shot.'}</div></div>
<div id=shotout class=card style=display:none><b>Result</b><div id=shotbody style="margin-top:.5rem"></div></div>
{SHOT_EXPLAINER}
<script>
function _esc(s){{var d=document.createElement('div');d.textContent=s==null?'':String(s);return d.innerHTML}}
async function doShot(){{var u=document.getElementById('shoturl').value.trim();if(!u){{toast('enter a URL');return}}
var out=document.getElementById('shotout'),body=document.getElementById('shotbody');out.style.display='block';body.innerHTML='queueing…';
try{{var cr=await fetch('/api/shot/create',{{method:'POST',headers:{{'Content-Type':'application/json'}},body:JSON.stringify({{url:u}})}});var c=await cr.json();
if(!c.ok){{body.innerHTML='<span class="tag bad">'+_esc(c.error)+'</span>';return}}
for(var i=0;i<20;i++){{await new Promise(r=>setTimeout(r,1500));
var sr=await (await fetch('/api/shot/status/'+c.id)).json();
if(sr.status==='done'&&sr.png_b64){{body.innerHTML='<img alt="page capture" src="data:image/png;base64,'+sr.png_b64+'">';return}}
if(sr.status==='text_fallback'){{var h='';if(sr.title)h+='<div style=color:var(--acc2)>title: '+_esc(sr.title)+'</div>';
if(sr.description)h+='<div style=color:var(--dim)>desc: '+_esc(sr.description)+'</div>';
if(sr.headings&&sr.headings.length)h+='<div style=color:var(--dim);font-size:.8rem>'+sr.headings.map(_esc).join('<br>')+'</div>';
h+='<pre style="white-space:pre-wrap;text-align:left">'+_esc(sr.text_preview)+'</pre>';body.innerHTML=h;return}}
if(sr.status==='error'){{body.innerHTML='<span class="tag bad">'+_esc(sr.error)+'</span>';return}}
body.textContent='rendering… (poll '+i+'/20)'}}}}catch(e){{body.textContent='error: '+e}}}}
</script>""" + SHOT_API + how(["Paste a URL — the job queues instantly (free).",
        "With a headless browser on the host you get a real PNG back as base64.",
        "No browser installed? You get text_fallback: title, description, headings, first 400 words — honestly labeled.",
        "Agents: POST /api/shot/create then poll /api/shot/status/<id> until status != queued.",
        "SSRF guard: localhost and private ranges are refused — this is a capture service, not a port scanner."])
    return page("shot", body)

@app.route("/api/shot/create", methods=["POST"])
def api_shot_create():
    r = rate_limit("shot", 6, 60)
    if r: return r
    uid = key_user() or current_user_id()
    if not uid: return jsonify({"ok": False, "error": "auth required: account session (sign up at /inbox, no KYC) or Authorization: Bearer dk_ key"}), 401
    url = str(jp("url") or "").strip()
    if not url: return jsonify({"ok": False, "error": "url required"}), 400
    url, err = shot_url_ok(url)
    if err: return jsonify({"ok": False, "error": err}), 400
    if not has_pass(uid) and not charge(uid, 25, "shot create"):
        return jsonify({"ok": False, "error": "insufficient balance", "balance_cents": get_balance(uid), "topup": SITE + "/keys"}), 402
    con = db()
    cur = con.execute("INSERT INTO shots(user_id,url,status,created) VALUES(?,?,?,?)", (uid, url, "queued", int(time.time())))
    con.commit()
    shot_run(cur.lastrowid)
    st = con.execute("SELECT status FROM shots WHERE id=?", (cur.lastrowid,)).fetchone()
    return jsonify({"ok": True, "id": cur.lastrowid, "status": st["status"], "poll": f"{SITE}/api/shot/status/{cur.lastrowid}"}), 200, {"Cache-Control": "no-store"}

def shot_dict(row):
    d = {"ok": True, "id": row["id"], "status": row["status"]}
    try:
        r = json.loads(row["result"]) if row["result"] else None
    except Exception:
        r = row["result"]
    if row["status"] == "done" and r:
        d["png_b64"] = r
        try:
            d["png_bytes"] = len(base64.b64decode(r))
        except Exception:
            pass
    elif r:
        d.update(r if isinstance(r, dict) else {"detail": str(r)[:400]})
    return d

@app.route("/api/shot/status/<int:sid>")
def api_shot_status(sid):
    con = db()
    s = con.execute("SELECT * FROM shots WHERE id=?", (sid,)).fetchone()
    if not s: return jsonify({"ok": False, "error": "unknown shot id"}), 404
    if s["status"] == "queued": shot_run(sid)  # lazy exec (reload-safe)
    s = con.execute("SELECT * FROM shots WHERE id=?", (sid,)).fetchone()
    return jsonify(shot_dict(s))

# ---------- 3. SMS RENTALS ----------
SMSP = "https://api.smspool.net"
SERVICES = [("google","Google"),("discord","Discord"),("telegram","Telegram"),("whatsapp","WhatsApp"),("other","Other/Any")]
COUNTRIES = [("1","United States"),("2","United Kingdom"),("4","Netherlands"),("22","Russia"),("150","Germany")]

def sms_api(path, **kw):
    if kw:
        kw["key"] = SMSP_KEY
        return http(f"{SMSP}/{path}", data=urllib.parse.urlencode(kw).encode(), method="POST")
    return http(f"{SMSP}/{path}?key={SMSP_KEY}")

def sms_guard():
    con = db(); now = int(time.time())
    uid = current_user_id()
    st, b = sms_api("request/balance")
    bal = jf(b) or {}
    try: bal = float(bal.get("balance", 0))
    except Exception: bal = 0
    if bal < 5: return f"house balance too low (${bal:.2f}) — rentals paused"
    act = con.execute("SELECT COUNT(*) c FROM sms_rentals WHERE status='active' AND expires > ?", (now,)).fetchone()["c"]
    if act >= (5 if has_pass(uid) else 3): return "too many active rentals right now — try again later"
    h = con.execute("SELECT COUNT(*) c FROM sms_rentals WHERE created > ?", (now-3600,)).fetchone()["c"]
    if h >= (20 if has_pass(uid) else 6): return "hourly rental cap reached"
    d = con.execute("SELECT COUNT(*) c FROM sms_rentals WHERE created > ?", (now-86400,)).fetchone()["c"]
    if d >= (50 if has_pass(uid) else 15): return "daily rental cap reached"
    return None

@app.route("/sms", methods=["GET", "POST"])
def sms():
    uid = current_user_id()
    msg = ""
    if request.method == "POST":
        act = request.form.get("act")
        if act == "rent":
            guard = sms_guard()
            if guard:
                msg = f'<div class="card"><span class="tag warn">PAUSED</span> {guard}</div>'
            else:
                st, b = sms_api("purchase/sms", service=request.form["service"], country=request.form["country"])
                d = jf(b) or {}
                if d.get("success") == 1:
                    con = db(); now = int(time.time())
                    con.execute("INSERT INTO sms_rentals(user_id,phone,service,country,purchase_id,cost,status,created,expires) VALUES(?,?,?,?,?,?,?,?,?)",
                                (uid, d.get("number"), request.form["service"], request.form["country"], str(d.get("purchase_id")), d.get("cost",0), "active", now, now+1800))
                    con.commit()
                    msg = f'<div class="card"><span class="tag ok">RENTED</span> Your number: <b style="font-size:1.2rem;color:var(--acc)">+{d.get("number")}</b> <button style="padding:.2rem .6rem;font-size:.8rem" onclick="cp(\'+{d.get("number")}\')">copy</button> · 30 min · order #{d.get("purchase_id")}</div>'
                else:
                    msg = f'<div class="card"><span class="tag bad">RENT FAILED</span><br><pre>{esc(b[:400])}</pre></div>'
        elif act == "check":
            st, b = sms_api("sms/check", orderid=request.form["pid"])
            d = jf(b) or {}
            sms_txt = d.get("sms") or d.get("code") or ""
            status = d.get("status", "?")
            msg = f'<div class="card"><span class="tag {"ok" if sms_txt else "warn"}">STATUS: {status}</span> {"<b style=color:var(--ok)>" + esc(sms_txt) + "</b>" if sms_txt else "no code yet — poll again in 10s"}</div>'
        elif act == "cancel":
            st, b = sms_api("sms/cancel", orderid=request.form["pid"])
            d = jf(b) or {}
            ok = d.get("success") == 1
            con = db(); con.execute("UPDATE sms_rentals SET status=? WHERE purchase_id=?", ("refunded" if ok else "cancel-failed", request.form["pid"])); con.commit()
            msg = f'<div class="card"><span class="tag {"ok" if ok else "bad"}">{"CANCELLED + REFUNDED" if ok else "CANCEL FAILED"}</span></div>'
    con = db()
    hist = con.execute("SELECT * FROM sms_rentals WHERE user_id=? ORDER BY id DESC LIMIT 8", (uid,)).fetchall()
    hist_rows = "".join(f"<tr><td>+{h['phone']} <a href=# onclick=\"cp('{h['phone']}');return false\" style=color:var(--acc)>copy</a></td><td>{h['service']}</td><td>{h['status']}</td><td>#{h['purchase_id']}</td><td class=cdown data-exp={h['expires']}>…</td></tr>" for h in hist)
    body = f"""
<h1>SMS <span>RENTAL</span></h1><p class=sub>Disposable numbers, 30-minute windows, <b>free</b> — the lab picks up the tab. Cancel before a code = instant burn.</p>
<div class="grid2">
<div class=card><b>Rent a number</b>
<form method=post><input type=hidden name=act value=rent>
<select name=service style="width:100%">{''.join(f'<option value={v}>{n}</option>' for v,n in SERVICES)}</select>
<select name=country style="width:100%;margin:.5rem 0">{''.join(f'<option value={v}>{n}</option>' for v,n in COUNTRIES)}</select>
<button>Rent — 30 min</button></form></div>
<div class=card><b>Check / manage</b>
<form method=post><input type=hidden name=act value=check><input name=pid placeholder="order #" style="width:100%"><button style="margin:.5rem 0">Poll for code</button></form>
<form method=post><input type=hidden name=act value=cancel><input name=pid placeholder="order #" style="width:100%"><button style="background:var(--bad);color:#fff">Cancel &amp; refund</button></form></div>
</div>{msg}
<div class=card><b>Recent rentals</b><table><tr><th>Number</th><th>Service</th><th>Status</th><th>Order</th><th>Window</th></tr>{hist_rows or '<tr><td colspan=5 style=color:var(--dim)>none yet</td></tr>'}</table></div>
<div class=card id=codesbox style=display:none><b>Live code</b><div id=lcode style="font-size:1.6rem;color:var(--ok);letter-spacing:.2em"></div></div>
<script>
var lastMsg='';
setInterval(function(){{
var els=document.querySelectorAll('.cdown');var now=Math.floor(Date.now()/1000);
els.forEach(function(e){{var s=e.dataset.exp-now;if(s>0)e.textContent=Math.floor(s/60)+'m '+(s%60)+'s left';else e.textContent='expired'}});}},1000);
setInterval(function(){{
fetch('/api/sms/history').then(r=>r.json()).then(rows=>{{
var act=rows.filter(r=>r.status==='active');
document.dispatchEvent(new CustomEvent('drb-sms',{{detail:{{active:act.length}}}}));
if(!act.length)return;
act.forEach(r=>{{
fetch('/api/sms/check?pid='+r.purchase_id).then(x=>x.json()).then(d=>{{
if((d.sms||d.code)&&d.sms!==lastMsg){{lastMsg=d.sms||d.code;
var box=document.getElementById('codesbox');box.style.display='block';
document.getElementById('lcode').textContent=lastMsg;
toast('SMS CODE: '+lastMsg);document.title='✉ '+lastMsg;}}
}})}});
}})}},6000);
</script>
<div class=card style=color:var(--dim)>API: POST /api/sms/rent (service,country) · GET /api/sms/check?pid= · GET /api/sms/cancel?pid= · GET /api/sms/history</div>""" + how(["Pick a service and country, rent — the number is live for 30 minutes exactly.","Use it for any signup/verification. The code arrives as a text.","Poll the order (auto or manual) until the code shows.","Cancel before a code arrives and you get every satoshi back.","Each rental is logged in the recent-rentals table with a live countdown."])
    body += gloss([("OTC","one-time code — the PIN a service texts you"),("burn","cancel an unused rental inside the refund window"),("SMSPool","our upstream number provider")])
    return page("sms", body)

@app.route("/api/sms/rent", methods=["POST"])
def api_sms_rent():
    guard = sms_guard()
    if guard: return jsonify({"success": 0, "message": guard, "paused": True})
    uid = key_user() or current_user_id()
    if uid and not has_pass(uid) and get_balance(uid) < 50:
        return jsonify({"ok": False, "error": "insufficient balance", "topup": SITE + "/keys"}), 402
    st, b = sms_api("purchase/sms", service=param("service"), country=param("country"))
    d = jf(b) or {}
    if d.get("success") == 1:
        con = db(); now = int(time.time())
        con.execute("INSERT INTO sms_rentals(user_id,phone,service,country,purchase_id,cost,status,created,expires) VALUES(?,?,?,?,?,?,?,?,?)",
                    (uid, d.get("number"), param("service"), param("country"), str(d.get("purchase_id")), d.get("cost",0), "active", now, now+1800))
        con.commit()
        cost = int(d.get("cost_in_cents") or 5)
        if uid and not has_pass(uid):
            charge(uid, cost, f"sms rental +{d.get('number')}")
    return jsonify(d)

@app.route("/api/sms/check", methods=["GET","POST"])
def api_sms_check():
    st, b = sms_api("sms/check", orderid=param("pid"))
    return jf(b) or jsonify({"error": b[:200]})

@app.route("/api/sms/cancel", methods=["GET","POST"])
def api_sms_cancel():
    st, b = sms_api("sms/cancel", orderid=param("pid"))
    d = jf(b) or {}
    if d.get("success") == 1:
        con = db(); con.execute("UPDATE sms_rentals SET status='refunded' WHERE purchase_id=?", (param("pid"),)); con.commit()
    return d

@app.route("/api/sms/history")
def api_sms_history():
    con = db(); now = int(time.time())
    con.execute("UPDATE sms_rentals SET status='expired' WHERE status='active' AND expires < ?", (now,))
    con.commit()
    uid = key_user() or current_user_id()
    if not uid:
        return jsonify({"ok": False, "error": "login required (POST /inbox act=login)"}), 401
    return jsonify([dict(r) for r in con.execute("SELECT * FROM sms_rentals WHERE user_id=? ORDER BY id DESC LIMIT 50", (uid,))])

# ---------- 4. PROXY LAB ----------
@app.route("/proxy", methods=["GET", "POST"])
def proxy():
    result = ""
    if request.method == "POST" and request.form.get("act") == "test":
        user, pw = request.form.get("user",""), request.form.get("pass","")
        pauth = base64.b64encode(f"{user}:{pw}".encode()).decode()
        try:
            s = socket.create_connection((PLEIADES_GW.split(":")[0], int(PLEIADES_GW.split(":")[1])), timeout=15)
            s.sendall(f"CONNECT ip-api.com:80 HTTP/1.1\r\nHost: ip-api.com:80\r\nProxy-Authorization: Basic {pauth}\r\n\r\n".encode())
            resp = s.recv(4096)
            if b"200" in resp.split(b"\r\n")[0]:
                s.sendall(b"GET /json/?fields=66846719 HTTP/1.1\r\nHost: ip-api.com\r\nConnection: close\r\n\r\n")
                data = b""
                while True:
                    c = s.recv(8192)
                    if not c: break
                    data += c
                s.close()
                j = jf(data.split(b"\r\n\r\n",1)[-1].decode("utf-8","replace")) or {}
                con = db()
                con.execute("INSERT INTO proxy_checks(user_key,egress_ip,geo,ok,ts) VALUES(?,?,?,?,?)", (user[:12], j.get("query","?"), f"{j.get('country')}/{j.get('city')}", 1, int(time.time())))
                con.commit()
                result = f'<div class="card"><span class="tag ok">PROXY LIVE</span> Egress: <b style=color:var(--acc)>{esc(j.get("query"))}</b> — {esc(j.get("country"))} / {esc(j.get("city"))} · ISP {esc(j.get("isp"))} · tz {esc(j.get("timezone"))} <button style="padding:.2rem .6rem;font-size:.8rem" onclick="cp(\'{esc(j.get("query"))}\')">copy</button></div>'
            else:
                con = db()
                con.execute("INSERT INTO proxy_checks(user_key,egress_ip,geo,ok,ts) VALUES(?,?,?,?,?)", (user[:12], "", "", 0, int(time.time())))
                con.commit()
                result = f'<div class="card"><span class="tag bad">AUTH/TUNNEL FAILED</span><pre>{esc(resp[:200])}</pre></div>'
        except Exception as e:
            result = f'<div class="card"><span class="tag bad">ERROR</span> {esc(e)}</div>'
    body = f"""
<h1>PROXY <span>LAB</span></h1><p class=sub>Test + rent residential proxies on the Pleiades rail — same gateway keys as everywhere.</p>
<div class=card><form method=post><input type=hidden name=act value=test>
<label>Gateway user</label><br><input name=user style="width:100%" placeholder="your Pleiades username"><br>
<label style=color:var(--dim)>Password</label><br><input name=pass type=password style="width:100%"><br>
<button style=margin-top:.6rem>Test egress now</button></form></div>
{result}
<div class=card><b>Geo session builder</b>:
<select id=geoK onchange="gb()"><option value="">none</option><option value="_region-us">region US</option><option value="_region-eu">region EU</option><option value="_country-gb">country GB</option><option value="_country-de">country DE</option><option value="_city-london">city London</option></select>
<select id=geoS onchange="gb()"><option value="">rotating</option><option value="_session-a7x9_lifetime-30m">sticky 30-min</option></select>
<div style=margin-top:.5rem><code id=geoOut style=color:var(--acc)>yourpassword</code> <button style="padding:.2rem .6rem;font-size:.8rem" onclick="cp(document.getElementById('geoOut').textContent)">copy</button></div>
<script>function gb(){{document.getElementById('geoOut').textContent='yourpassword'+document.getElementById('geoK').value+document.getElementById('geoS').value}}</script></div>
<div class=card><b>Rent more</b> — storefront: <a href="{PLEIADES_APP}">{PLEIADES_APP}</a></div>
<div class=card style=color:var(--dim)>API: POST /api/proxy/test (user, pass) → egress IP + geo JSON.</div>""" + how(["Enter your Pleiades gateway user:pass — the same credentials work across the fleet.","The lab tunnels a CONNECT request through the gateway and reports the true egress IP, geo and ISP.","Use the geo builder to steer the exit: region, country, city, sticky 30-min sessions.","Need bandwidth? Buy GB plans at the Pleiades storefront."])
    body += gloss([("sticky session","same exit IP kept across requests"),("egress","the exit IP the rest of the internet sees"),("Pleiades","our proxy gateway network")])
    return page("proxy", body)

@app.route("/api/proxy/test", methods=["POST"])
def api_proxy_test():
    r = rate_limit("proxytest", 10, 60)
    if r: return r
    user, pw = param("user") or "", param("pass") or ""
    pauth = base64.b64encode(f"{user}:{pw}".encode()).decode()
    try:
        s = socket.create_connection((PLEIADES_GW.split(":")[0], int(PLEIADES_GW.split(":")[1])), timeout=15)
        s.sendall(f"CONNECT ip-api.com:80 HTTP/1.1\r\nHost: ip-api.com:80\r\nProxy-Authorization: Basic {pauth}\r\n\r\n".encode())
        resp = s.recv(4096)
        if b"200" not in resp.split(b"\r\n")[0]: return jsonify({"ok": False, "raw": resp[:120].decode("utf-8","replace")})
        s.sendall(b"GET /json/?fields=66846719 HTTP/1.1\r\nHost: ip-api.com\r\nConnection: close\r\n\r\n")
        data = b""
        while True:
            c = s.recv(8192)
            if not c: break
            data += c
        s.close()
        j = jf(data.split(b"\r\n\r\n",1)[-1].decode("utf-8","replace")) or {}
        return jsonify({"ok": True, "egress": j})
    except Exception as e:
        return jsonify({"ok": False, "error": str(e)})

# ---------- 5. STEGO LAB ----------
def _keystream(password, n):
    ks = b""; seed = password.encode()
    while len(ks) < n:
        seed = hashlib.sha256(seed).digest()
        ks += seed
    return ks[:n]

def steg_hide(img_bytes, text, password="", bits=1, spread="sequential"):
    from PIL import Image
    im = Image.open(io.BytesIO(img_bytes)).convert("RGBA")
    px = im.load()
    w, h = im.size
    capacity = w * h * 3 * bits
    payload = text.encode("utf-8")
    phash = hashlib.sha256(password.encode()).digest()[:4] if password else b"\x00\x00\x00\x00"
    header = b"AUR1" + struct.pack(">I", len(payload)) + phash
    body = payload
    if password:
        body = bytes(a ^ b for a, b in zip(body, _keystream(password, len(body))))
    data = header + body
    if len(data) * 8 > capacity:
        return None, f"too big: need {len(data)*8} bits, image holds {capacity}"
    if spread == "random":
        import random as _r
        _r.seed(int.from_bytes(hashlib.sha256((password + "dark0rbits").encode()).digest()[:4], "big") if password else int.from_bytes(hashlib.sha256(b"dark0rbits-random-no-pass").digest()[:4], "big"))
        order = list(range(w*h)); _r.shuffle(order)
    else:
        order = list(range(w*h))
    bits_needed = len(data) * 8
    idx = 0
    mask = (1 << bits) - 1
    for pos in order:
        if idx >= bits_needed: break
        x, y = pos % w, pos // w
        r, g, b, a = px[x, y]
        chs = [r, g, b]
        for ch_i in range(3):
            if idx >= bits_needed: break
            chunk = 0
            taken = 0
            for k in range(bits):
                if idx >= bits_needed: break
                chunk = (chunk << 1) | ((data[idx >> 3] >> (7 - (idx & 7))) & 1)
                idx += 1; taken += 1
            if taken < bits: chunk <<= (bits - taken)
            chs[ch_i] = (chs[ch_i] & ~mask) | chunk
        px[x, y] = tuple(chs) + (a,)
    # also stash settings in a tEXt chunk for reliable extraction hints
    out = io.BytesIO()
    im.save(out, "PNG", pnginfo=_pnginfo(bits, spread))
    return out.getvalue(), {"bits": bits, "spread": spread}

def _pnginfo(bits, spread):
    try:
        from PIL.PngImagePlugin import PngInfo
        info = PngInfo()
        info.add_text("dark0rbits_meta", json.dumps({"bits": bits, "spread": spread, "v": 2}))
        return info
    except Exception:
        return None

def steg_extract(img_bytes, password="", bits=None, spread=None):
    from PIL import Image
    im = Image.open(io.BytesIO(img_bytes))
    meta = im.info.get("dark0rbits_meta") or im.info.get("auriga_meta")
    if meta:
        try:
            m = json.loads(meta)
            bits = int(m.get("bits", bits or 1)); spread = m.get("spread", spread or "sequential")
        except Exception: pass
    bits = bits or 1
    im = im.convert("RGBA")
    px = im.load()
    w, h = im.size
    mask = (1 << bits) - 1
    # replicate the shuffle used at hide time
    if spread == "random":
        import random as _r
        _r.seed(int.from_bytes(hashlib.sha256((password + "dark0rbits").encode()).digest()[:4], "big") if password else int.from_bytes(hashlib.sha256(b"dark0rbits-random-no-pass").digest()[:4], "big"))
        order = list(range(w*h)); _r.shuffle(order)
    else:
        order = list(range(w*h))
    raw = bytearray()
    need = None
    idx = 0
    for pos in order:
        if need is not None and idx >= need: break
        x, y = pos % w, pos // w
        r, g, b, a = px[x, y]
        for ch in (r, g, b):
            chunk = ch & mask
            for k in range(bits-1, -1, -1):
                if need is not None and idx >= need: break
                bit = (chunk >> k) & 1
                while len(raw) < (idx >> 3) + 1: raw.append(0)
                if bit: raw[idx >> 3] |= (0x80 >> (idx & 7))
                idx += 1
            if need is not None and idx >= need: break
        if need is None and idx >= 64:
            if bytes(raw[:4]) != b"AUR1":
                return None, f"no DARK0RBITS payload found with LSB depth {bits} (try other depth / randomized)"
            ln = struct.unpack(">I", bytes(raw[4:8]))[0]
            need = 96 + ln * 8  # header is 12 bytes (AUR1+len+phash) = 96 bits; old 64 truncated 4 bytes off every payload
    data = bytes(raw)
    if len(data) < 12: return None, "payload too small"
    if bytes(data[:4]) != b"AUR1":
        return None, "no DARK0RBITS payload found (wrong password or settings?)"
    if password and hashlib.sha256(password.encode()).digest()[:4] != data[8:12]:
        return None, "wrong password"
    ln = struct.unpack(">I", data[4:8])[0]
    body = data[12:12+ln]
    if password:
        body = bytes(a ^ b for a, b in zip(body, _keystream(password, len(body))))
    text = body.decode("utf-8", "replace")
    return text, None

@app.route("/steg", methods=["GET"])
def steg():
    body = f"""
<h1>STEGO <span>LAB</span></h1><p class=sub>Hide secret text inside an ordinary PNG so completely that the picture looks untouched — no metadata, no visible change, nothing to see. Only someone who knows it's there (and has the password) can read it back.</p>
<div class=grid2>
<div class=card><b>Hide text in a picture</b>
<form action=/api/steg/hide method=post enctype=multipart/form-data target=stegout>
<div class=drop onclick="document.getElementById('ih').click()">📤 drop a PNG here or click — bigger pictures hide more<input id=ih type=file name=image accept="image/png" style=display:none required></div>
<div class=fnh style=color:var(--dim);font-size:.85rem></div>
<div id=capmeter style=display:none;margin:.5rem 0>
<div class=bar><i id=capbar></i></div>
<div id=captext style=color:var(--dim);font-size:.8rem;margin-top:.2rem></div></div>
<textarea name=text rows=3 style="width:100%;margin:.6rem 0" placeholder="the words to hide — a passphrase, a note, coordinates…"></textarea>
<input name=password placeholder="password (optional — encrypts the payload + scrambles where it hides)" style="width:100%">
<div style="margin:.6rem 0;display:flex;gap:.8rem;flex-wrap:wrap;align-items:center">
<label style=margin:0>Depth</label> <select name=bits><option>1</option><option>2</option><option>3</option></select>
<label style=margin:0>Spread</label> <select name=spread><option value=sequential>sequential</option><option value=random>randomized</option></select></div>
<button>Hide &amp; download</button></form>
<div style=color:var(--dim);font-size:.8rem;margin-top:.5rem>The download is a normal PNG. Post it, email it, host it — the secret rides along.</div></div>
<div class=card><b>Read hidden text back</b>
<form action=/api/steg/extract method=post enctype=multipart/form-data target=stegout>
<div class=drop onclick="document.getElementById('ie').click()">📥 drop the carrier PNG — anyone can try, only the password works<input id=ie type=file name=image accept="image/png" style=display:none required></div>
<div class=fne style=color:var(--dim);font-size:.85rem></div>
<input name=password placeholder="password if one was used" style="width:100%;margin:.6rem 0">
<div style=margin:.6rem 0;display:flex;gap:.8rem;flex-wrap:wrap;align-items:center">
<label style=margin:0>Depth</label> <select name=bits><option value="">auto (reads metadata)</option><option>1</option><option>2</option><option>3</option></select>
<label style=margin:0>Spread</label> <select name=spread><option value="">auto</option><option value=sequential>sequential</option><option value=random>randomized</option></select></div>
<button>Extract</button></form></div>
</div>
<script>
document.querySelectorAll('.drop').forEach(function(d){{
d.addEventListener('dragover',function(e){{e.preventDefault();d.classList.add('over')}});
d.addEventListener('dragleave',function(){{d.classList.remove('over')}});
d.addEventListener('drop',function(e){{e.preventDefault();d.classList.remove('over');
var inp=d.querySelector('input[type=file]');if(e.dataTransfer.files.length){{inp.files=e.dataTransfer.files;
var fn=d.parentElement.querySelector('.fnh, .fne');if(fn)fn.textContent=e.dataTransfer.files[0].name}}}});
}});
document.getElementById('ih').addEventListener('change',function(){{
var f=this.files[0];document.querySelector('.fnh').textContent=f?f.name+' ('+Math.round(f.size/1024)+' KB)':'';
if(!f)return;
// PNG dims live at bytes 16-24 — read straight from the file
var r=new FileReader();
r.onload=function(){{var dv=new DataView(r.result);
if(dv.byteLength>24&&dv.getUint32(0)===0x89504E47){{
var w=dv.getUint32(16),h=dv.getUint32(20);
var cap=Math.floor(w*h*3/8); // depth-1 capacity in bytes
var el=document.getElementById('capmeter');el.style.display='block';
document.getElementById('captext').textContent=w+'×'+h+' px — holds about '+cap+' hidden characters at depth 1 ('+Math.floor(cap*2)+' at depth 2)';
}}}};
r.readAsArrayBuffer(f.slice(0,32));
}});
document.getElementById('ie').addEventListener('change',function(){{var f=this.files[0];document.querySelector('.fne').textContent=f?f.name+' ('+Math.round(f.size/1024)+' KB)':''}});
</script>
<div class=card style=color:var(--dim)>API: POST /api/steg/hide (image, text, password?, bits 1-3, spread) → PNG · POST /api/steg/extract (image, password?, bits?, spread?) → JSON</div>
<iframe name=stegout id=stegout style=display:none title="stego output"></iframe>""" + flow("smuggle a passphrase through a photo wall", [
"<span class=flowrole>you</span> drop in a vacation photo — the meter says 1920×1080 holds ~777,600 hidden characters. Plenty.",
"<span class=flowrole>you</span> type the wifi password <code>hunter2-sunset-2026</code>, add password <code>peanut</code>, spread randomized, hit Hide.",
"the site flips the least-significant bits of random pixels — the downloaded PNG looks pixel-for-pixel identical to the original.",
"<span class=flowrole>you</span> post the photo publicly. It passes through phones, compressors, screenshots — it's just a picture.",
"<span class=flowrole>ally</span> saves it, opens STEGO LAB, drops the file, types <code>peanut</code> → the words come back.",
"<span class=flowrole>stranger</span> drops the same file with no password → noise. Without the key, it's a photo of a beach."]) + how([
"Every pixel's color is three numbers. Change the last binary digit of each — changes of ±1 in brightness — and no eye can tell.",
"Depth 1 hides ~1 character per 2–3 pixels: invisible and robust. Depth 2–3 packs more but survives re-compression worse.",
"Randomized spread scatters your bits across the whole image instead of the top rows — a cropped picture can still give the text back.",
"A password encrypts the payload AND seeds the scatter pattern: wrong password yields pure noise, not garbage text.",
"Extraction auto-reads the embedded settings — the file knows its own depth and spread. Just drop and go.",
"Warning: posting to platforms that re-compress (Instagram, WhatsApp) can damage depth-1 edges — send the file itself, unmodified."])
    body += gloss([("LSB","least significant bit — the final binary digit of a color value; changing it is invisible"),("depth","how many bit-planes carry the payload — more depth, more text, more detectable"),("spread","where the bits live: top-down or scattered across the image"),("carrier","the innocent-looking picture that transports your hidden text")])
    body += agent_card('POST /api/steg/hide  image=<png> text=hi [password= bits= spread=]', 'curl -X POST https://dark0rbits.thetempleofdoom.com/api/steg/hide -F image=@beach.png -F text="wifi is hunter2" -F password=peanut', 'Extract: POST /api/steg/extract (image, password?). Free, 20/min.')
    return page("steg", body)

@app.route("/api/steg/hide", methods=["POST"])
def api_steg_hide():
    r = rate_limit("steg", 20, 60)
    if r: return r
    f = request.files.get("image")
    text = param("text") or ""
    if not f or not text: return jsonify({"ok": False, "error": "image + text required"}), 400
    bits = min(3, max(1, int(param("bits") or 1)))
    spread = param("spread") or "sequential"
    try:
        out, meta = steg_hide(f.read(), text, param("password") or "", bits, spread)
    except Exception as e:
        return jsonify({"ok": False, "error": str(e)}), 400
    if out is None: return jsonify({"ok": False, "error": meta}), 400
    return send_file(io.BytesIO(out), mimetype="image/png", as_attachment=True, download_name="dark0rbits-hidden.png")

@app.route("/api/steg/extract", methods=["POST"])
def api_steg_extract():
    r = rate_limit("steg", 20, 60)
    if r: return r
    f = request.files.get("image")
    if not f: return jsonify({"ok": False, "error": "image required"}), 400
    bits = param("bits")
    bits = min(3, max(1, int(bits))) if bits else None
    try:
        text, err = steg_extract(f.read(), param("password") or "", bits, param("spread") or None)
    except Exception as e:
        return jsonify({"ok": False, "error": str(e)}), 400
    if err: return jsonify({"ok": False, "error": err}), 200
    return jsonify({"ok": True, "text": text})

# ---------- 6. TRACKABLE FILES ----------
@app.route("/track", methods=["GET"])
def track():
    uid = current_user_id()
    mine = ""
    if uid:
        con = db()
        rows = con.execute("SELECT * FROM trackables WHERE user_id=? ORDER BY id DESC LIMIT 15", (uid,)).fetchall()
        if rows:
            trs = "".join(
                f"<tr><td><b>{esc(t['filename'])}</b><br><span style=color:var(--dim);font-size:.78rem>{t['kind'] or 'file'}</span></td>"
                f"<td><code>{SITE}/t/{t['token']}</code></td>"
                f"<td>{'<a href=/api/track/events?token=' + t['token'] + ' style=color:var(--acc)>view events</a>' if t['paid'] else '—'}</td>"
                f"<td>{'<span class=tag ok>live</span>' if t['paid'] else '<span class=tag warn>awaiting upload</span>'}</td></tr>"
                for t in rows)
            mine = ('<div class=card><b>Your trackables</b><div class=tblwide><table><tr><th>File</th><th>Tracked link</th><th>Events</th><th>Status</th></tr>'
                    + trs + '</table></div></div>')
    body = f"""
<h1>TRACK <span>FILE</span></h1><p class=sub>Upload any file or picture and get a tracked link for it. The moment anyone opens that link — or views the email version — their IP, city, ISP, device and language fire back into your INBOX. The image-IP trick, weaponized and clean.</p>
<div class=card>
<b>1 · Name your bait</b><form action=/api/track/create method=post>
<input name=filename placeholder="file name the target will see, e.g. invoice.jpg, resume.pdf" style="width:100%;margin:.4rem 0" required>
<button>Create trackable — free</button></form></div>
{mine}
<div class=card style=color:var(--dim)>How it works: your file gets a secret link — every open is logged (time, IP, device) and lands in your inbox with geo. You also get an HTML copy with an embedded tracking pixel: email THAT and every view fires too. <a href=/inbox>Login (no KYC)</a> to see events.</div>
<div class=card style=color:var(--dim)>API: POST /api/track/create (filename) → upload_url · POST /api/track/upload?token= (file) → tracked_link + pixel + email_html · GET /api/track/events?token=</div>""" + flow("learn who opens your 'photo'", [
"<span class=flowrole>you</span> create a trackable named <b>sunset.jpg</b> — free, instant, and the upload page opens.",
"<span class=flowrole>you</span> upload the actual photo. You get back: a tracked link, a pixel URL, and an email-ready HTML copy.",
"<span class=flowrole>you</span> send the link — 'hey check out this pic'. That's the whole trick.",
"<span class=flowrole>them</span> taps it. The image renders normally in their browser — but the page quietly pings home first.",
"<span class=flowrole>you</span> INBOX lights up: <b>sunset.jpg opened</b> — IP 203.0.113.7 · Rotterdam NL · KPN · Android Chrome · timezone Europe/Amsterdam.",
"the HTML copy works over email too — every preview pane that loads images fires the pixel, no click needed."]) + how([
"Free now — click create and the upload opens instantly, no payment.",
"Upload your file or picture: you get a secret tracked link plus an email-ready HTML copy.",
"Email the HTML copy or share the link — every open fires back.",
"Each open reports: exact time, real IP, city/country, ISP, timezone, VPN flag, device, language, referrer.",
"Alerts land in your INBOX the second it happens; full event log via the API."])
    return page("track", body)



BTCPAY_PUBLIC = "https://btcpay.thetempleofdoom.com"
def public_checkout(link):
    """LAN invoices must be payable from the open internet — swap host on checkout links."""
    if not link:
        return link
    return link.replace("https://10.30.20.140", BTCPAY_PUBLIC)

def btc_invoice(amount="1.00"):
    st, b = http(f"{BTCPAY}/stores/{BTCPAY_STORE}/invoices",
                 headers={"Authorization": "token " + BTCPAY_KEY, "Content-Type": "application/json"},
                 data=json.dumps({"amount": amount, "currency": "USD", "metadata": {"orderId": "dark0rbits-track"}}).encode(), method="POST")
    return jf(b) or {}

@app.route("/api/track/create", methods=["POST"])
def api_track_create():
    fn = param("filename") or "file"
    uid = key_user() or current_user_id()
    if not uid:
        return jsonify({"ok": False, "error": "login required — create a no-KYC account at /inbox (POST /inbox act=register), then retry"}), 401
    token = secrets.token_urlsafe(16)
    con = db()
    if has_pass(uid):
        con.execute("INSERT INTO trackables(user_id,token,filename,kind,invoice_id,paid,created) VALUES(?,?,?,?,?,1,?)",
                    (uid or 0, token, esc(fn[:100]), "file", "PASS", int(time.time())))
        con.commit()
        return jsonify({"ok": True, "free": True, "token": token, "upload_url": f"{SITE}/track/pay?token={token}"})
    if uid and charge(uid, 100, f"trackable file ({fn[:40]})"):
        con.execute("INSERT INTO trackables(user_id,token,filename,kind,invoice_id,paid,created) VALUES(?,?,?,?,?,1,?)",
                    (uid or 0, token, esc(fn[:100]), "file", "BALANCE", int(time.time())))
        con.commit()
        return jsonify({"ok": True, "balance_charged": 1.00, "token": token, "upload_url": f"{SITE}/track/pay?token={token}"})
    inv = btc_invoice()
    if not inv.get("id"): return jsonify({"ok": False, "error": str(inv)[:200]}), 400
    con.execute("INSERT INTO trackables(user_id,token,filename,kind,invoice_id,paid,created) VALUES(?,?,?,?,?,0,?)",
                (uid or 0, token, esc(fn[:100]), "file", inv["id"], int(time.time())))
    con.commit()
    return _checkout_or_json({"ok": True, "invoice_id": inv["id"], "checkoutLink": public_checkout(inv.get("checkoutLink")), "token": token,
                    "after_payment_upload_url": f"{SITE}/track/pay?token={token}"})

@app.route("/track/pay", methods=["GET"])
def track_pay():
    token = param("token") or ""
    con = db()
    t = con.execute("SELECT * FROM trackables WHERE token=?", (token,)).fetchone()
    if not t: return page("track", "<h1>TRACK <span>FILE</span></h1><div class=card><span class=tag bad>unknown token</span></div>")
    return page("track", f"""
<h1>TRACK <span>FILE</span></h1><p class=sub>Upload your file — then it's trackable.</p>
<div class=card><form action=/api/track/upload?token={esc(token)} method=post enctype=multipart/form-data>
<div class=drop onclick="document.getElementById('tf').click()">📤 drop file / picture here<input id=tf type=file name=file style=display:none required></div>
<div id=tfname style=color:var(--dim);font-size:.85rem;margin:.4rem 0></div>
<button>Upload &amp; make trackable</button></form></div>
<script>document.getElementById('tf').addEventListener('change',function(){{document.getElementById('tfname').textContent=this.files[0].name}})</script>""")

@app.route("/api/track/upload", methods=["POST"])
def api_track_upload():
    token = param("token")
    f = request.files.get("file")
    if not f: return jsonify({"ok": False, "error": "file required"}), 400
    con = db()
    t = con.execute("SELECT * FROM trackables WHERE token=?", (token,)).fetchone()
    if not t: return jsonify({"ok": False, "error": "unknown token"}), 400
    st, b = http(f"{BTCPAY}/stores/{BTCPAY_STORE}/invoices/{t['invoice_id']}", headers={"Authorization": "token " + BTCPAY_KEY}) if t["invoice_id"] not in ("PASS", "BALANCE") else (200, '{"status":"settled"}')
    inv = jf(b) or {}
    paid = inv.get("status") in ("settled", "processing", "paid")
    if not paid: return jsonify({"ok": False, "error": f"invoice not paid yet ({inv.get('status')})"}), 402
    data = f.read()
    open(os.path.join(UPLOAD_DIR, token + ".bin"), "wb").write(data)
    kind = "image" if (f.content_type or "").startswith("image") else "file"
    fn = (f.filename or t["filename"])[:100]
    con.execute("UPDATE trackables SET paid=1, kind=?, filename=? WHERE token=?", (kind, fn, token))
    con.commit()
    b64 = base64.b64encode(data).decode()
    pixel = f"{SITE}/t/{token}.png"
    if kind == "image":
        viewer = f'<!doctype html><meta charset=utf-8><body style="margin:0;background:#111;text-align:center"><img src="data:image;base64,{b64}" style="max-width:100%"><img src="{pixel}" width=1 height=1></body>'
    else:
        viewer = f'<!doctype html><meta charset=utf-8><body style="background:#111;color:#eee;font-family:monospace;padding:2rem"><p>📎 {esc(fn)} ({len(data)} bytes)</p><p><a href="{SITE}/t/{token}" style="color:#f0b429">Open / download the file</a></p><img src="{pixel}" width=1 height=1></body>'
    open(os.path.join(UPLOAD_DIR, token + ".html"), "w").write(viewer)
    con.execute("INSERT INTO track_events(trackable_id,ts,ip,ua) VALUES(?,?,?,?)", (t["id"], int(time.time()), "created", "upload"))
    con.commit()
    return jsonify({"ok": True, "tracked_link": f"{SITE}/t/{token}", "pixel": pixel,
                    "email_html": f"{SITE}/t/{token}/html",
                    "note": "attach/email the HTML version — every view fires the pixel and lands in the inbox"})

def _geo_cache():
    con = db()
    con.execute("CREATE TABLE IF NOT EXISTS geo_cache(ip TEXT PRIMARY KEY, geo TEXT, ts INTEGER)")
    return con

def enrich_ip(ip):
    """geo/ISP/ASN for an IP, cached 24h."""
    if not ip or ip == "created" or ip.startswith(("10.30.20.", "127.", "172.17.")): return {}
    con = _geo_cache()
    r = con.execute("SELECT geo FROM geo_cache WHERE ip=? AND ts > ?", (ip, int(time.time())-86400)).fetchone()
    if r: return json.loads(r["geo"])
    st, b = http(f"http://ip-api.com/json/{ip}?fields=66846719")
    d = jf(b) or {}
    geo = {k: d.get(k) for k in ("country","countryCode","regionName","city","zip","lat","lon","timezone","isp","org","as","asname","mobile","proxy","hosting","reverse","query") if d.get(k) is not None}
    con.execute("INSERT OR REPLACE INTO geo_cache(ip,geo,ts) VALUES(?,?,?)", (ip, json.dumps(geo), int(time.time())))
    con.commit()
    return geo

def _log_open(t, extra=""):
    con = db()
    ip = request.headers.get("X-Real-IP") or request.remote_addr or "?"
    ua = request.headers.get("User-Agent","")
    lang = request.headers.get("Accept-Language","")
    ref = request.headers.get("Referer","")
    geo = enrich_ip(ip)
    where = ""
    if geo: where = f" — {geo.get('city','')}, {geo.get('regionName','')} {geo.get('countryCode','')} · {geo.get('isp','')} · tz {geo.get('timezone','')}"
    if geo.get("proxy"): where += " · VPN/proxy ⚠"
    con.execute("INSERT INTO track_events(trackable_id,ts,ip,ua) VALUES(?,?,?,?)",
                (t["id"], int(time.time()), ip + (" " + json.dumps(geo) if geo else ""), ua[:200] + (f" | lang={lang}" if lang else "") + (f" | ref={ref[:100]}" if ref else "")))
    uid = t["user_id"]
    if uid:
        con.execute("INSERT INTO messages(user_id,sender,body,created) VALUES(?,?,?,?)",
                    (uid, "operator-bot", f"👁 '{esc(t['filename'])}' just opened{extra} — IP <b>{esc(ip)}</b>{esc(where)}<br>device: {esc(ua[:100])}{'<br>lang: ' + esc(lang) if lang else ''}{'<br>from: ' + esc(ref[:120]) if ref else ''}", int(time.time())))
    con.commit()

@app.route("/t/<token>")
def tracked_download(token):
    con = db()
    t = con.execute("SELECT * FROM trackables WHERE token=?", (token,)).fetchone()
    if not t or not t["paid"]: return "not found", 404
    _log_open(t, " (link)")
    path = os.path.join(UPLOAD_DIR, token + ".bin")
    if not os.path.exists(path): return "file gone", 404
    return send_file(path, as_attachment=True, download_name=t["filename"])

@app.route("/t/<token>.png")
def tracked_pixel(token):
    con = db()
    t = con.execute("SELECT * FROM trackables WHERE token=?", (token,)).fetchone()
    if t and t["paid"]:
        _log_open(t, " (email/pixel)")
    px = base64.b64decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7")
    return Response(px, mimetype="image/gif", headers={"Cache-Control": "no-store"})

@app.route("/t/<token>/html")
def tracked_html(token):
    con = db()
    t = con.execute("SELECT * FROM trackables WHERE token=?", (token,)).fetchone()
    if not t or not t["paid"]: return "not found", 404
    p = os.path.join(UPLOAD_DIR, token + ".html")
    return send_file(p, mimetype="text/html") if os.path.exists(p) else ("no html wrapper", 404)

@app.route("/api/track/events", methods=["GET"])
def api_track_events():
    con = db(); token = param("token")
    t = con.execute("SELECT * FROM trackables WHERE token=?", (token,)).fetchone()
    if not t: return jsonify({"ok": False, "error": "unknown token"})
    uid = current_user_id()
    if not uid or uid != t["user_id"]: return jsonify({"ok": False, "error": "auth required (login on /inbox)"})
    return jsonify([dict(r) for r in con.execute("SELECT * FROM track_events WHERE trackable_id=? ORDER BY id DESC LIMIT 100", (t["id"],))])

# ---------- 6b. BURNER MAIL (receive-only, BTC packages) ----------
MAIL_PACKS = [("7","7 days — $3",3,7),("30","30 days — $8",8,30),("90","90 days — $20",20,90)]
MAIL_DOMAIN = "thetempleofdoom.com"
MAIL_RESERVED = {"indianaholmes","admin","operator","drjones","root","noreply","support","pass","mail"}
MAIL_SECRET = "dark0rbits-mail-relay-2026"

@app.route("/mail", methods=["GET"])
def mail():
    uid = current_user_id()
    mine = ""
    if uid:
        con = db(); now = int(time.time())
        con.execute("UPDATE mailboxes SET paid=2 WHERE paid=1 AND expires < ?", (now,))  # expired
        rows = con.execute("SELECT * FROM mailboxes WHERE user_id=? ORDER BY id DESC LIMIT 10", (uid,)).fetchall()
        if rows:
            trs = "".join(f"<tr><td>{esc(m['address'])} <a href=# onclick=\"cp('{esc(m['address'])}');return false\" style=color:var(--acc)>copy</a></td><td><a href=/mail/view?addr={esc(m['address'])}>view mail</a></td><td class=mcd data-exp={m['expires']}>…</td><td>{'live' if m['paid']==1 else 'expired'}</td><td>{m['cnt']}</td></tr>" for m in rows)
            mine = f'<div class=card><b>Your mailboxes</b><table><tr><th>Address</th><th></th><th>Expires</th><th>Status</th><th>Mail</th></tr>{trs}</table></div>'
    body = f"""
<h1>BURNER <span>MAIL</span></h1><p class=sub>Receive-only disposable mailboxes @thetempleofdoom.com. Counting down in real time. Anything you sign up for — codes, confirmations, one-off handouts — lands right here, no other identity attached.</p>
<div class=card>
<b>Pick a package (free)</b>
{''.join(f'<form action=/api/mail/create method=post style=display:inline;margin:0 0.5rem><input type=hidden name=days value={d}><input name=local placeholder="mailbox name" required style=width:140px><button>{n}</button></form>' for d,n,_,_ in MAIL_PACKS)}
<div style=color:var(--dim);font-size:.85rem;margin-top:.6rem>Pick your mailbox and length — it activates instantly. Free now, no invoice.</div></div>
{mine}
<div class=card style=color:var(--dim)>API: POST /api/mail/create (local, days) → activates instantly (free) · GET /api/mail/inbox?addr= (needs login) — inbound via Cloudflare Email Routing → worker relay.</div>""" + how(["Pick a name and a package — 7, 30 or 90 days, all free now.","Pay the invoice; the mailbox activates the second it settles.","The address is receive-only: verification codes, confirmations, one-off handouts.","The countdown runs in real time; when it hits zero the mailbox retires itself.","All mail shows on the site inbox — nothing touches any other identity."])
    return page("mail", body)

@app.route("/api/mail/create", methods=["POST"])
def api_mail_create():
    uid = current_user_id()
    local = re.sub(r"[^a-z0-9._-]", "", (param("local") or "").lower())[:30]
    days = param("days") or "7"
    pack = next((p for p in MAIL_PACKS if p[0] == str(days)), None)
    if not pack: return jsonify({"ok": False, "error": "bad package"}), 400
    if not local: return jsonify({"ok": False, "error": "mailbox name required"}), 400
    if local in MAIL_RESERVED: return jsonify({"ok": False, "error": "reserved name"}), 400
    addr = f"{local}@{MAIL_DOMAIN}"
    con = db()
    if con.execute("SELECT 1 FROM mailboxes WHERE address=?", (addr,)).fetchone():
        return jsonify({"ok": False, "error": "mailbox name taken"}), 400
    uid = key_user() or current_user_id()
    # metered: PASS = instant free; balance = instant paid; else BTC invoice
    if uid and has_pass(uid):
        con.execute("INSERT INTO mailboxes(user_id,address,invoice_id,paid,expires,created,plan_days) VALUES(?,?,?,?,?,?,?)",
                    (uid, addr, "PASS", 1, int(time.time())+86400*pack[3], int(time.time()), pack[3]))
        con.commit()
        return jsonify({"ok": True, "free": True, "address": addr, "expires_in_days": pack[3]})
    if uid and charge(uid, pack[2]*100, f"burner mailbox {addr} ({pack[3]}d)"):
        con.execute("INSERT INTO mailboxes(user_id,address,invoice_id,paid,expires,created,plan_days) VALUES(?,?,?,?,?,?,?)",
                    (uid, addr, "BALANCE", 1, int(time.time())+86400*pack[3], int(time.time()), pack[3]))
        con.commit()
        return jsonify({"ok": True, "balance_charged": pack[2], "address": addr, "expires_in_days": pack[3]})
    inv = btc_invoice(f"{pack[2]:.2f}")
    if not inv.get("id"): return jsonify({"ok": False, "error": str(inv)[:200]}), 400
    con.execute("INSERT INTO mailboxes(user_id,address,invoice_id,paid,expires,created,plan_days) VALUES(?,?,?,?,?,?,?)",
                (uid or 0, addr, inv["id"], 0, 0, int(time.time()), pack[3]))
    con.commit()
    return _checkout_or_json({"ok": True, "address": addr, "checkoutLink": public_checkout(inv.get("checkoutLink")), "invoice_id": inv["id"]})

@app.route("/api/mail/inbound", methods=["POST"])
def api_mail_inbound():
    d = request.get_json(silent=True) or {}
    if d.get("secret") != MAIL_SECRET: return jsonify({"ok": False}), 403
    addr = (d.get("mailbox") or "").lower().split("@")[0]
    con = db()
    m = con.execute("SELECT * FROM mailboxes WHERE address LIKE ? AND paid=1", (addr + "@%",)).fetchone()
    if not m: return jsonify({"ok": False, "error": "unknown/expired mailbox"}), 404
    con.execute("INSERT INTO mails(mailbox_id,sender,subject,body,ts) VALUES(?,?,?,?,?)",
                (m["id"], esc(d.get("from") or "?"), esc(d.get("subject") or ""), esc(d.get("body") or ""), int(time.time())))
    con.execute("UPDATE mailboxes SET cnt=cnt+1 WHERE id=?", (m["id"],))
    con.commit()
    return jsonify({"ok": True})

@app.route("/mail/view")
def mail_view():
    uid = current_user_id()
    if not uid: return page("mail", '<div class=card>login required — <a href=/inbox style="color:var(--acc)">sign in / create account</a></div>')
    addr = param("addr") or ""
    con = db()
    m = con.execute("SELECT * FROM mailboxes WHERE address=? AND user_id=?", (addr.lower(), uid)).fetchone()
    if not m: return page("mail", "<div class=card>not your mailbox</div>")
    mails = con.execute("SELECT * FROM mails WHERE mailbox_id=? ORDER BY id DESC LIMIT 100", (m["id"],)).fetchall()
    rows = "".join(f'<div class=msg><div class=who>{esc(x["sender"])} · {time.strftime("%b %d %H:%M", time.localtime(x["ts"]))}</div><b>{esc(x["subject"])}</b><br>{esc(x["body"])}</div>' for x in mails) or '<div style=color:var(--dim)>empty — waiting for mail…</div>'
    left = max(0, m["expires"] - int(time.time()))
    return page("mail", f"""
<h1>{esc(m['address'])}</h1><p class=sub><span id=cd style=color:var(--acc)></span> remaining — auto-refreshes every 15s.</p>
<div class=card>{rows}</div>
<script>
function tick(){{var s={left}-Math.floor((Date.now()-loaded)/1000);s=Math.max(0,s);var d=Math.floor(s/86400);document.getElementById('cd').textContent=d+'d '+Math.floor((s%86400)/3600)+'h '+Math.floor((s%3600)/60)+'m';}}
var loaded=Date.now();tick();setInterval(tick,1000);setInterval(function(){{location.reload()}},15000);
</script>""")

@app.route("/api/mail/inbox")
def api_mail_inbox():
    uid = current_user_id()
    if not uid: return jsonify({"ok": False, "error": "login required (POST /inbox act=login)"})
    con = db(); addr = (param("addr") or "").lower()
    m = con.execute("SELECT * FROM mailboxes WHERE address=? AND user_id=?", (addr, uid)).fetchone()
    if not m: return jsonify({"ok": False, "error": "unknown mailbox"})
    return jsonify([dict(r) for r in con.execute("SELECT sender,subject,body,ts FROM mails WHERE mailbox_id=? ORDER BY id DESC LIMIT 100", (m["id"],))])

# ---------- 6c. PASS — all-tools subscription ----------
PASS_PACKS = [("30","1 month — $10 BTC",10,30),("90","3 months — $25 (save 17%)",25,90),("365","1 year — $80 (save 33%)",80,365)]

def has_pass(uid):
    if not uid: return False
    con = db()
    u = con.execute("SELECT username FROM users WHERE id=?", (uid,)).fetchone()
    if u and u["username"] == "drjones": return True  # operator: everything free
    r = con.execute("SELECT 1 FROM passes WHERE user_id=? AND expires > ? AND paid=1", (uid, int(time.time()))).fetchone()
    return bool(r)

@app.route("/pass", methods=["GET"])
def pass_page():
    uid = current_user_id()
    mine = ""
    if uid:
        con = db()
        r = con.execute("SELECT * FROM passes WHERE user_id=? AND paid=1 ORDER BY expires DESC LIMIT 1", (uid,)).fetchone()
        if r and r["expires"] > int(time.time()):
            left = r["expires"] - int(time.time())
            mine = f'<div class="card glow"><span class="tag ok">PASS ACTIVE</span> {left//86400} days {left%86400//3600}h left — all tools unlimited (proxy rentals still metered at the storefront), trackables free, burner mail discounts.</div>'
    body = f"""
<h1>PASS <span>— EVERYTHING FREE</span></h1><p class=sub>The meters are gone: unlimited SMS rentals, free trackables, burner mail, screenshots — every tool costs nothing. No PASS needed anymore.</p>
<div class=card>
{''.join(f'<form action=/api/pass/create method=post style=display:inline;margin:0 .4rem><input type=hidden name=days value={d}><button class=ghost>{n}</button></form>' for d,n,_,_ in PASS_PACKS)}
<div style=color:var(--dim);font-size:.85rem;margin-top:.6rem>Proxy rentals stay separate (they burn real upstream bandwidth — buy those at the storefront).</div></div>
{mine}
<div class=card style=color:var(--dim)>API: POST /api/pass/create (days=30|90|365) → invoice. Pass activates on payment settle via webhook.</div>"""
    return page("pass", body)

@app.route("/api/pass/create", methods=["POST"])
def api_pass_create():
    uid = current_user_id()
    if not uid: return jsonify({"ok": False, "error": "login first (POST /inbox act=login)"}), 401
    days = param("days") or "30"
    pack = next((p for p in PASS_PACKS if p[0] == str(days)), None)
    if not pack: return jsonify({"ok": False, "error": "bad package"}), 400
    inv = btc_invoice(f"{pack[2]:.2f}")
    if not inv.get("id"): return jsonify({"ok": False, "error": str(inv)[:200]}), 400
    con = db()
    con.execute("INSERT INTO passes(user_id,invoice_id,paid,expires,plan_days) VALUES(?,?,0,0,?)", (uid, inv["id"], pack[3]))
    con.commit()
    return _checkout_or_json({"ok": True, "checkoutLink": public_checkout(inv.get("checkoutLink")), "invoice_id": inv["id"]})

@app.route("/api/btcpay/webhook", methods=["POST"])
def btcpay_webhook():
    sig = request.headers.get("BTCPay-Sig", "")
    body = request.get_data()
    expect = "sha256=" + hmac.new(BTCPAY_WHSEC.encode(), body, hashlib.sha256).hexdigest()
    if sig != expect: return jsonify({"ok": False, "error": "bad sig"}), 400
    d = jf(body) or {}
    iid = d.get("invoiceId") or ""
    if d.get("type") == "InvoiceSettled" or (d.get("type") == "InvoicePaymentSettled"):
        con = db()
        if iid:
            if con.execute("SELECT 1 FROM wh_processed WHERE invoice_id=?", (iid,)).fetchone():
                return jsonify({"ok": True, "dup": True})
            con.execute("INSERT OR IGNORE INTO wh_processed(invoice_id,ts) VALUES(?,?)", (iid, int(time.time())))
        con.execute("UPDATE trackables SET paid=1 WHERE invoice_id=?", (iid,))
        r = con.execute("SELECT plan_days FROM mailboxes WHERE invoice_id=?", (iid,)).fetchone()
        if r:
            con.execute("UPDATE mailboxes SET paid=1, expires=? WHERE invoice_id=?", (int(time.time()) + 86400*int(r["plan_days"] or 7), iid))
        r = con.execute("SELECT plan_days FROM passes WHERE invoice_id=?", (iid,)).fetchone()
        if r:
            con.execute("UPDATE passes SET paid=1, expires=? WHERE invoice_id=?", (int(time.time()) + 86400*int(r["plan_days"] or 30), iid))
        # balance top-ups
        try:
            meta = d.get("metadata") or {}
            if not meta:
                st, b = http(f"{BTCPAY}/stores/{BTCPAY_STORE}/invoices/{iid}", headers={"Authorization": "token " + BTCPAY_KEY})
                meta = (jf(b) or {}).get("metadata", {}) or {}
            if str(meta.get("orderId", "")).startswith("dark0rbits-topup"):
                uid = int(meta["orderId"].split(":")[1]); cents = int(meta["orderId"].split(":")[2])
                con.execute("INSERT OR IGNORE INTO balances(user_id, cents) VALUES(?, 0)", (uid,))
                con.execute("UPDATE balances SET cents = cents + ? WHERE user_id=?", (cents, uid))
                con.execute("INSERT INTO ledger(user_id,delta_cents,reason,ts) VALUES(?,?,?,?)", (uid, cents, f"BTC topup {iid}", int(time.time())))
        except Exception: pass
        con.commit()
    return jsonify({"ok": True})

# ---------- 6h. API KEYS + BALANCE ----------
@app.route("/keys", methods=["GET", "POST"])
def keys():
    uid = current_user_id()
    if not uid:
        return page("keys", '<h1>API <span>KEYS</span></h1><div class=card>login on /inbox first — keys are bound to your account.</div><a href=/inbox><button>Login</button></a>')
    con = db()
    if request.method == "POST" and request.form.get("act") == "mkkey":
        label = (param("label") or "default")[:40]
        key = "dk_" + secrets.token_urlsafe(24)
        con.execute("INSERT INTO apikeys(user_id,key,label,created) VALUES(?,?,?,?)", (uid, key, esc(label), int(time.time())))
        con.commit()
        newkey = key
    else:
        newkey = None
    rows = con.execute("SELECT * FROM apikeys WHERE user_id=? AND revoked=0 ORDER BY id DESC", (uid,)).fetchall()
    bal = get_balance(uid)
    led = con.execute("SELECT * FROM ledger WHERE user_id=? ORDER BY id DESC LIMIT 15", (uid,)).fetchall()
    led_html = "".join(f"<tr><td>{'$%.2f' % (l['delta_cents']/100)}</td><td>{esc(l['reason'])}</td><td>{time.strftime('%b %d %H:%M', time.localtime(l['ts']))}</td></tr>" for l in led)
    keys_html = "".join("<tr><td><code>"+esc(k['key'][:14])+"…</code> <a href=# onclick=\"cp('"+k['key']+"');return false\" style=color:var(--acc)>copy</a></td><td>"+esc(k['label'])+"</td><td>"+time.strftime('%b %d', time.localtime(k['created']))+"</td></tr>" for k in rows)
    newkey_block = ('<div class="card glow" style="margin-top:.8rem"><span class="tag ok">NEW KEY (shown once)</span><br><code id=nk style="font-size:1.1rem">'+esc(newkey)+'</code> <button style="padding:.2rem .6rem;font-size:.8rem" onclick="cp(\''+newkey+'\')">copy</button></div>') if newkey else ''
    keys_block = ('<div class=card><b>Keys</b><table><tr><th>Key</th><th>Label</th><th>Created</th></tr>'+keys_html+'</table></div>') if rows else ''
    body = f"""
<h1>API <span>KEYS</span> — balance: <span style=color:var(--acc)>${bal/100:.2f}</span></h1>
<p class=sub>Metered access is over — every tool is free for humans and agents. No top-ups, no meters, no KYC. Your API keys still work everywhere.</p>
<div class="grid2">
<div class=card><b>New API key</b><form method=post><input type=hidden name=act value=mkkey><input name=label placeholder="key label (e.g. my-bot)" style=width:100%><button style=margin-top:.5rem>Generate key</button></form>
{newkey_block}
{keys_block}
</div>
<div class=card><b>Top up (BTC)</b>
{''.join(f'<form action=/api/balance/topup method=post style=display:inline;margin:0 .3rem><input type=hidden name=cents value={c}><button class=ghost>${a}</button></form>' for c,a in [(500,'$5'),(2000,'$20'),(10000,'$100')])}
<div style=color:var(--dim);font-size:.85rem;margin-top:.5rem>Invoice settles → balance credited automatically via webhook.</div></div>
</div>
<div class=card><b>Ledger</b><table><tr><th>Δ</th><th>Reason</th><th>When</th></tr>{led_html or '<tr><td colspan=3 style=color:var(--dim)>no charges yet</td></tr>'}</table></div>
<div class=card style=color:var(--dim)>Use it: <code>Authorization: Bearer dk_…</code> header on any paid API call. Metered endpoints: /api/sms/rent (pass-through cost), /api/mail/create (package price), /api/track/create ($1). Everything else free. PASS = no metering.</div>"""
    return page("keys", body)

@app.route("/api/balance/topup", methods=["POST"])
def api_balance_topup():
    uid = current_user_id()
    if not uid: return jsonify({"ok": False, "error": "login required — free no-KYC account at /inbox"}), 401
    cents = int(param("cents") or 500)
    if cents not in (500, 2000, 10000): return jsonify({"ok": False, "error": "bad amount"}), 400
    # invoice created WITH topup metadata in one shot
    st, b = http(f"{BTCPAY}/stores/{BTCPAY_STORE}/invoices",
                 headers={"Authorization": "token " + BTCPAY_KEY, "Content-Type": "application/json"},
                 data=json.dumps({"amount": f"{cents/100:.2f}", "currency": "USD",
                                  "metadata": {"orderId": f"dark0rbits-topup:{uid}:{cents}", "itemDesc": "dark0rbits balance topup"}}).encode(), method="POST")
    inv = jf(b) or {}
    if not inv.get("id"): return jsonify({"ok": False, "error": str(inv)[:200]}), 400
    con = db()
    con.execute("INSERT INTO ledger(user_id,delta_cents,reason,ts) VALUES(?,?,?,?)", (uid, 0, f"topup invoice {inv['id']} pending", int(time.time())))
    con.commit()
    return _checkout_or_json({"ok": True, "checkoutLink": public_checkout(inv.get("checkoutLink"))})

@app.route("/api/balance")
def api_balance():
    uid = key_user() or current_user_id()
    if not uid: return jsonify({"ok": False, "error": "auth required"}), 401
    return jsonify({"ok": True, "balance_cents": get_balance(uid), "pass_active": has_pass(uid)})

# ---------- 6d. EMAIL HEADER FORENSICS ----------
def parse_headers(raw):
    import email as em
    msg = em.message_from_string(raw)
    out = {"from": msg.get("From",""), "to": msg.get("To",""), "subject": msg.get("Subject",""),
           "date": msg.get("Date",""), "return_path": msg.get("Return-Path",""),
           "reply_to": msg.get("Reply-To",""), "message_id": msg.get("Message-ID","")}
    hops = []
    for h in msg.get_all("Received", []) or []:
        hop = h.strip().replace("\n", " ")
        hops.append(hop[:400])
    out["hops"] = list(reversed(hops))  # first-hop origin first
    # timestamps per hop → relay delays
    times = []
    for h in hops:
        m = re.search(r";\s*(.+)$", h)
        if m:
            try:
                import email.utils as eu
                t = eu.parsedate_to_datetime(m.group(1).strip())
                if t: times.append(t)
            except Exception: pass
    delays = []
    if len(times) >= 2:
        for a, b in zip(times, times[1:]):
            delays.append(round((b - a).total_seconds(), 1))
    out["delays"] = delays
    auth = msg.get_all("Authentication-Results", []) or []
    out["auth_results"] = [a.strip()[:300] for a in auth]
    out["dkim"] = [d.strip()[:200] for d in (msg.get_all("DKIM-Signature", []) or [])][:3]
    # spoof flags
    flags = []
    env_from = out["return_path"].strip("<>")
    frm = out["from"]
    m_from = re.search(r"<([^>]+)>", frm)
    addr_from = ((m_from.group(1) if m_from else frm).split() or [""])[-1].strip("<>").lower()
    if env_from and addr_from and env_from.split("@")[-1] != addr_from.split("@")[-1]:
        flags.append(f"envelope-from domain ({env_from.split('@')[-1]}) != From domain ({addr_from.split('@')[-1]}) — classic spoof marker")
    if out["reply_to"]:
        m_rt = re.search(r"<([^>]+)>", out["reply_to"]) or None
        addr_rt = ((m_rt.group(1) if m_rt else out["reply_to"]).strip()).lower()
        if addr_rt.split("@")[-1] != addr_from.split("@")[-1]:
            flags.append(f"Reply-To ({addr_rt}) differs from From — possible reply-hijack")
    # origin IP: prefer X-Originator-IP, then the bottom-most (oldest) Received
    origin_ip = None
    origin_src = None
    xoi = msg.get("X-Originator-IP") or msg.get("X-Originating-IP") or ""
    m = re.search(r"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", xoi)
    if m:
        origin_ip, origin_src = m.group(1), "X-Originator-IP header"
    if not origin_ip:
        for h in hops:
            m = re.search(r"\[(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\]", h) or re.search(r"\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b", h)
            if m:
                origin_ip, origin_src = m.group(1), "oldest Received hop"
                break
    out["origin_ip"] = origin_ip
    out["origin_source"] = origin_src
    if origin_ip: out["origin_geo"] = enrich_ip(origin_ip)
    out["flags"] = flags
    verdicts = {}
    blob = " ".join(out["auth_results"]).lower()
    for k in ("spf","dkim","dmarc"):
        m = re.search(k + r"=(\w+)", blob)
        verdicts[k] = m.group(1) if m else "not present"
    out["verdicts"] = verdicts
    return out

@app.route("/eh")
def eh():
    body = f"""
<h1>MAIL <span>FORENSICS</span></h1><p class=sub>Paste raw email headers — or drop the whole .eml file — and get the true origin IP + location, the full relay chain with per-hop delays, SPF/DKIM/DMARC verdicts, and automatic spoof detection.</p>
<div class=card><b>Analyze an email</b>
<form method=post action=/eh_result enctype=multipart/form-data>
<label>Paste raw headers — Gmail: open the mail → ⋮ → Show original → copy everything. Outlook: right-click → View message source.</label>
<textarea name=raw rows=10 style="width:100%" placeholder="Received: from mail-yb1-f180.google.com …&#10;Authentication-Results: mx.google.com; spf=pass …"></textarea>
<label style=margin-top:.6rem>… or import the .eml file directly (drag it out of Apple Mail / Outlook / Thunderbird)</label>
<div class=drop onclick="document.getElementById('emlf').click()">📄 drop a .eml file here or click<input id=emlf type=file name=eml accept=".eml,message/rfc822,text/plain" style=display:none></div>
<div id=emlfn style=color:var(--dim);font-size:.85rem;margin:.3rem 0></div>
<button style=margin-top:.5rem>Analyze</button></form></div>
<script>
(function(){{
var d=document.querySelector('.drop');
d.addEventListener('dragover',function(e){{e.preventDefault();d.classList.add('over')}});
d.addEventListener('dragleave',function(){{d.classList.remove('over')}});
d.addEventListener('drop',function(e){{e.preventDefault();d.classList.remove('over');
if(e.dataTransfer.files.length){{document.getElementById('emlf').files=e.dataTransfer.files;
document.getElementById('emlfn').textContent=e.dataTransfer.files[0].name}}}});
document.getElementById('emlf').addEventListener('change',function(){{document.getElementById('emlfn').textContent=this.files[0].name}});
}})();
</script>
<div class=card style=color:var(--dim)>API: POST /api/eh (raw=…) → JSON: origin IP + geo + source, hop chain, per-hop delays, verdicts, spoof flags. Free.</div>""" + flow("was this 'bank email' really sent by the bank?", [
"<span class=flowrole>you</span> get a scary email from <b>security@yourbank-support.com</b> — open it, ⋮ → Show original, copy everything.",
"<span class=flowrole>you</span> paste the headers here (or drop the .eml) and hit Analyze.",
"<span class=flowrole>site</span> walks the <b>Received</b> chain bottom-up: the oldest hop is where the mail actually entered the internet.",
"origin IP found: <b>185.234.72.19</b> — a bulletproof host in Sofia, Bulgaria · datacenter ⚠ — not your bank's infrastructure.",
"verdicts come back: <b>SPF fail · DKIM none · DMARC fail</b> — three red tags.",
"spoof flags light up: envelope-from ≠ From domain — the display name is wearing a costume.",
"relay delays show the 4-second stall at a server that has no business handling bank mail.",
"<span class=flowrole>you</span> verdict: phishing. Delete, report, done — and you have the origin evidence to show for it."]) + how([
"An email's headers are its postal history — every server that touched it adds a Received line, and liars can't forge the chain reliably.",
"We read the chain from the bottom (oldest) up: that first hop is the true origin, and we geolocate its IP.",
"SPF/DKIM/DMARC are the domain's own authentication verdicts — fails here mean the mail didn't come from where it claims.",
"Spoof markers are checked automatically: envelope sender vs display From, Reply-To hijacks, mismatched domains.",
"Per-hop relay delays expose weird pit stops — legit bank mail doesn't detour through random countries.",
"Everything works from pasted headers OR a dropped .eml file — the parser handles both."])
    body += gloss([("Received chain","the list of every server an email passed through, newest first"),("SPF","a domain's list of servers allowed to send its mail"),("DKIM","cryptographic signature on real mail from the domain"),("DMARC","policy for what receivers do when SPF/DKIM fail"),("envelope-from","actual SMTP sender — can differ from the visible From"),(".eml","the raw email file itself — headers + body, openable from any mail app")])
    body += agent_card('POST /api/eh  raw=<full headers>', 'curl -X POST https://dark0rbits.thetempleofdoom.com/api/eh --data-urlencode raw@headers.txt', 'Returns origin_ip, origin_geo, hops, delays, verdicts, flags. No auth needed for 20/min.')
    return page("eh", body)

@app.route("/eh_result", methods=["POST"])
def eh_result():
    raw = request.form.get("raw") or ""
    f = request.files.get("eml")
    if f and not raw.strip():
        raw = f.read().decode("utf-8", "replace")
    d = parse_headers(raw)
    hops_html = ""
    for i, h in enumerate(d["hops"]):
        delay = f'<span class="tag warn" style=margin-left:.4rem>+{d["delays"][i-1]}s to next hop</span>' if i >= 1 and i-1 < len(d["delays"]) else ""
        hops_html += f'<div class=msg><div class=who>hop {i+1}{delay}</div><span style=font-size:.82rem>{esc(h)}</span></div>'
    verdicts = " ".join(f'<span class="tag {"ok" if v=="pass" else ("bad" if v in ("fail","softfail") else "warn")}">{k.upper()}: {v}</span>' for k, v in d["verdicts"].items())
    flags = "".join(f'<div style="margin:.3rem 0"><span class=tag bad>⚠ {esc(f)}</span></div>' for f in d["flags"]) or '<span style=color:var(--ok)>✓ no spoof markers found</span>'
    og = d.get("origin_geo") or {}
    orows = [("Origin IP", f"<b style=color:var(--acc)>{esc(d.get('origin_ip') or 'not found')}</b>")]
    if d.get("origin_source"): orows.append(("Found via", esc(d["origin_source"])))
    if og: orows += [("Location", f"{esc(og.get('city'))}, {esc(og.get('regionName'))} {esc(og.get('countryCode'))}"), ("ISP", f"{esc(og.get('isp'))}{' · datacenter ⚠' if og.get('hosting') else ''}{' · VPN/proxy ⚠' if og.get('proxy') else ''}")]
    body = f"""
<h1>VERDICT — <span>{esc(d.get('subject') or '(no subject)')[:80]}</span></h1>
{kv(orows + [("From", esc(d.get('from'))), ("Envelope-from", esc(d.get('return_path') or '—')), ("Reply-To", esc(d.get('reply_to') or '—')), ("Date", esc(d.get('date') or '—'))])}
<div class=card><b>Authentication</b><div style=margin:.5rem 0>{verdicts}</div><b style=display:block;margin-top:.8rem>Spoof flags</b><div style=margin:.4rem 0>{flags}</div></div>
<div class=card><b>Relay chain — origin first</b>{hops_html or '<i style=color:var(--dim)>no Received headers</i>'}</div>
<div class=card><a href=/eh style=color:var(--acc)>← analyze another</a></div>"""
    return page("eh", body)

@app.route("/api/eh", methods=["POST"])
def api_eh():
    r = rate_limit("eh", 20, 60)
    if r: return r
    return jsonify(parse_headers(param("raw") or ""))


# ---------- 6e. IMAGE FORENSICS ----------
@app.route("/forensics")
def forensics():
    body = f"""
<h1>IMAGE <span>FORENSICS</span></h1><p class=sub>Deep forensics: full EXIF across all IFDs, GPS decoded to a map pin, XMP editor trails, embedded thumbnails, hashes, error-level analysis — expose doctored photos and find where they were taken.</p>
<div class=card><form action=/forensics_result method=post enctype=multipart/form-data>
<div class=drop onclick="document.getElementById('fi').click()">🖼 drop an image<input id=fi type=file name=image accept="image/*" style=display:none required></div>
<div id=fifn style=color:var(--dim);font-size:.85rem></div>
<button style=margin-top:.5rem>Analyze</button></form></div>
<script>document.getElementById('fi').addEventListener('change',function(){{document.getElementById('fifn').textContent=this.files[0].name}})</script>
<div class=card style=color:var(--dim)>API: POST /api/forensics (image) → JSON: exif (all IFDs), gps_decoded (lat/lon + map links), xmp, thumbnail_b64, hashes, flags, ela_max_diff, verdict.</div>""" + how(["Drop any image — every EXIF tag across IFD0, the EXIF sub-IFD and GPS gets dumped.",
"GPS is decoded to decimal degrees with one-click Google Maps / OpenStreetMap links — that's where the photo was taken.",
"XMP packets are parsed from the raw file: Adobe, Apple and Android editors leave trails there even after EXIF 'scrubbing'.",
"The embedded JPEG thumbnail is extracted — it can survive scrubbing and hold unstripped detail.",
"Error-level analysis (ELA) re-compresses and diffs: edited regions glow in the amplified view.",
"More than a dozen editors (Photoshop, GIMP, Canva, Snapseed, Lightroom…) are flagged automatically.",
"File hashes + format + dimensions come back too — match images across posts or leaks.",
"If the image carries a DARK0RBITS stego payload, this tool sees it."])
    body += gloss([("ELA","error level analysis — regions re-saved after editing light up"),("EXIF","camera/software metadata embedded in the file"),("quantization","JPEG compression-table fingerprints")])
    body += agent_card('POST /api/forensics  image=<file>', 'curl -X POST https://dark0rbits.thetempleofdoom.com/api/forensics -F image=@img.jpg', 'Deep: EXIF all IFDs, gps_decoded with map links, xmp, thumbnail_b64, hashes, ELA verdict.')
    return page("forensics", body)

def _ela_score(img_bytes):
    from PIL import Image, ImageChops, ImageEnhance
    im = Image.open(io.BytesIO(img_bytes)).convert("RGB")
    resaved = io.BytesIO(); im.save(resaved, "JPEG", quality=90)
    ela = ImageChops.difference(im, Image.open(resaved))
    extrema = ela.getextrema()
    maxdiff = max(e[1] for e in extrema)
    enh = ImageEnhance.Brightness(ela).enhance(15)
    out = io.BytesIO(); enh.save(out, "PNG")
    return out.getvalue(), maxdiff

def _deep_forensics(data):
    """Deep image analysis: full EXIF (all IFDs), decoded GPS, XMP, thumbnail,
    hashes, file info, editor flags, ELA. Shared by web + API."""
    from PIL import Image
    from PIL.ExifTags import TAGS, GPSTAGS
    import hashlib, re as _re
    im = Image.open(io.BytesIO(data))
    out = {"file": {}, "exif": {}, "exif_exif": {}, "gps": {}, "gps_decoded": None,
           "xmp": {}, "flags": [], "stego_payload": ("auriga_meta" in im.info or "dark0rbits_meta" in im.info)}
    fmt = im.format or "?"
    out["file"] = {"format": fmt, "mode": im.mode, "size": list(im.size), "bytes": len(data),
                   "sha256": hashlib.sha256(data).hexdigest()[:32], "md5": hashlib.md5(data).hexdigest()[:24]}
    exif = im.getexif()
    def _s(v):
        return str(v.decode("utf-8", "replace") if isinstance(v, bytes) else v)[:200]
    for k, v in exif.items():
        try: out["exif"][str(TAGS.get(k, k) if isinstance(k, int) else k)] = _s(v)
        except Exception: pass
    # EXIF sub-IFD (camera settings, lenses, serials…)
    try:
        sub = exif.get_ifd(0x8769)
        for k, v in sub.items():
            try: out["exif_exif"][str(TAGS.get(k, k))] = _s(v)
            except Exception: pass
    except Exception: pass
    # GPS sub-IFD, raw + decoded to decimal degrees + map links
    try:
        gifd = exif.get_ifd(0x8825)
        if gifd:
            for k, v in gifd.items():
                try: out["gps"][str(GPSTAGS.get(k, k))] = _s(v)[:80]
                except Exception: pass
            def _dms(t):
                return float(t[0]) + float(t[1]) / 60.0 + float(t[2]) / 3600.0
            if gifd.get(2) and gifd.get(3):
                try:
                    la, lo = _dms(gifd[2]), _dms(gifd[3])
                    if str(gifd.get(1, "")).upper() in ("S", "SOUTH"): la = -la
                    if str(gifd.get(4, "")).upper() in ("W", "WEST"): lo = -lo
                    out["gps_decoded"] = {"lat": round(la, 6), "lon": round(lo, 6),
                                          "maps": f"https://www.google.com/maps?q={la:.6f},{lo:.6f}",
                                          "osm": f"https://www.openstreetmap.org/?mlat={la:.6f}&mlon={lo:.6f}#map=16/{la:.6f}/{lo:.6f}"}
                except Exception: pass
    except Exception: pass
    # XMP packet from raw bytes (Adobe/phone editing trails)
    try:
        m = _re.search(rb"<x:xmpmeta.{0,4}?</x:xmpmeta>", data, _re.S)
        if not m: m = _re.search(rb"<rdf:RDF.{0,4}?</rdf:RDF>", data, _re.S)
        if m:
            x = m.group(0).decode("utf-8", "replace")
            for attr in _re.findall(r'(?:xmp|tiff|exif|photoshop|aux|apple|digikam):([A-Za-z]+)="([^"]{1,120})"', x):
                out["xmp"][attr[0] + ":" + attr[1]] = attr[2]
            for tag in _re.findall(r"<(?:xmp|tiff|exif|photoshop|aux|apple):([A-Za-z]+)>([^<]{1,120})</", x):
                out["xmp"].setdefault(tag[0] + ":" + tag[1], tag[2])
    except Exception: pass
    alltags = {**out["exif"], **out["exif_exif"], **out["xmp"]}
    blob = " ".join(alltags.values()).lower()
    if not alltags:
        out["flags"].append("EXIF stripped/absent — edited or privacy-scrubbed")
    for tool in ("photoshop", "gimp", "lightroom", "canva", "snapseed", "picsart", "affinity", "capture one", "darktable"):
        if tool in blob: out["flags"].append(f"⚠ EDITED IN {tool.upper()}")
    for mtk in ("iphone", "ipad", "android", "samsung", "pixel"):
        if mtk in blob: out["flags"].append(f"shot on {mtk.title()}")
    if "Adobe XMP" in data[:20000].decode("latin-1", "replace") or out["xmp"]: out["flags"].append("XMP metadata present (editor trail)")
    # simpler reliable thumbnail: scan raw JPEG for an embedded thumbnail inside APP1
    thumb_b64 = None
    try:
        import struct
        if fmt == "JPEG":
            # scan raw APP1 IFD1 for JPEGInterchangeFormat (0x0201/0x0202)
            idx = data.find(b"\xff\xd8\xff\xe1")
            if idx >= 0:
                tif_end = data.find(b"\xff\xdb", idx)  # first DQT after APP1
                if tif_end > idx:
                    seg = data[idx:tif_end]
                    if b"\xff\xd8\xff" in seg[6:]:
                        tj = seg[6 + seg[6:].find(b"\xff\xd8\xff"):]
                        end = tj.find(b"\xff\xd9")
                        if end > 0:
                            tb = tj[:end + 2]
                            thumb_b64 = base64.b64encode(tb).decode()[:200000]
                            out["flags"].append(f"embedded thumbnail present ({len(tb)} bytes) — may hold unscrubbed detail")
    except Exception: pass
    if thumb_b64: out["thumbnail_b64"] = thumb_b64
    ela_png, maxdiff = _ela_score(data)
    import base64 as b64mod
    out["ela_png_b64"] = b64mod.b64encode(ela_png).decode()
    out["ela_max_diff"] = maxdiff
    verdict = "CLEAN-ISH" if maxdiff < 12 and not out["flags"] else "SUSPECT — check ELA + flags"
    out["verdict"] = verdict
    return out

@app.route("/forensics_result", methods=["POST"])
def forensics_result():
    f = request.files.get("image")
    if not f: return page("steg", "no image")
    d = _deep_forensics(f.read())
    fn = (f.filename or "image")[:60]
    rows_html = "".join(f"<tr><td>{esc(k)}</td><td>{esc(v)}</td></tr>" for k, v in {**d["exif"], **d["exif_exif"], **d["xmp"]}.items())
    gps_html = " ".join(f"<div>{esc(k)}: {esc(v)}</div>" for k, v in d["gps"].items()) or "—"
    if d.get("gps_decoded"):
        g = d["gps_decoded"]
        gps_html += f'<div><b style=color:var(--acc)>DECODED: {g["lat"]}, {g["lon"]}</b> — <a href="{g["maps"]}" target=_blank rel=noopener style=color:var(--acc)>Google Maps →</a> <a href="{g["osm"]}" target=_blank rel=noopener style=color:var(--acc)>OSM →</a></div>'
    f_rows = "".join(f"<tr><td>{esc(k)}</td><td>{esc(v)}</td></tr>" for k, v in d["file"].items())
    return page("steg", f"""
<h1>FORENSICS <span>{esc(fn)}</span></h1>
{kv([("Verdict", f'<span class="tag {"ok" if d["verdict"].startswith("CLEAN") else "bad"}">{d["verdict"]}</span>'), ("ELA max diff", f'{d["ela_max_diff"]} (low=uniform=re-saved clean)'), ("EXIF tags", f'{len(d["exif"]) + len(d["exif_exif"])} + {len(d["xmp"])} XMP'), ("Stego", "DARK0RBITS payload present ✓" if d["stego_payload"] else "none detected")])}
<div class=card><b>File</b><table>{f_rows}</table></div>
<div class=card><b>Flags</b><br>{'<br>'.join(esc(x) for x in d["flags"]) or '<span style=color:var(--ok)>none</span>'}</div>
<div class=card><b>ELA (amplified 15×)</b><br><img src="data:image/png;base64,{d["ela_png_b64"]}" style="max-width:100%;border-radius:8px"></div>
{f'<div class=card><b>Embedded thumbnail</b><br><img src="data:image/jpeg;base64,{d["thumbnail_b64"]}" style="max-width:320px;border-radius:8px"></div>' if d.get("thumbnail_b64") else ''}
<div class=card><b>EXIF table (all IFDs + XMP)</b><table>{rows_html or '<tr><td colspan=2 style=color:var(--dim)>no EXIF</td></tr>'}</table></div>
<div class=card><b>GPS</b>{gps_html}</div>""")

@app.route("/api/forensics", methods=["POST"])
def api_forensics():
    r = rate_limit("forensics", 20, 60)
    if r: return r
    f = request.files.get("image")
    if not f: return jsonify({"ok": False, "error": "image required"}), 400
    d = _deep_forensics(f.read())
    d.pop("ela_png_b64", None)
    d["filename"] = (f.filename or "image")[:60]
    return jsonify({"ok": True, **d})

# ---------- 6f. CANARY TRAPS v2 (tripwires) ----------
CRED_TEMPLATES = [
    ("AWS access key", "AKIA{0}", "drop in a config file — anyone who uses it to check AWS trips the wire"),
    ("DB connection string", "postgres://svc_backup:{0}@db-internal.prod:5432/users", "classic honeytoken for dumped configs"),
    ("API bearer token", "sk_live_{0}", "looks like a payment API key — screams 'valuable' to an attacker"),
]

def _cred_line(token):
    import random as _r
    _r.seed(token)
    body = "".join(_r.choice("ABCDEFGHJKLMNPQRSTUVWXYZ23456789") for _ in range(16))
    name, tmpl, note = CRED_TEMPLATES[token.__hash__() % len(CRED_TEMPLATES)] if False else CRED_TEMPLATES[_r.randrange(len(CRED_TEMPLATES))]
    return name, tmpl.format(body), note

def canary_hit_row(cid):
    con = db()
    ip = request.headers.get("X-Real-IP") or request.remote_addr or "?"
    ua = request.headers.get("User-Agent", "")
    lang = request.headers.get("Accept-Language", "")
    ref = request.headers.get("Referer", "")
    con.execute("INSERT INTO canary_hits(canary_id,ts,ip,ua,lang,ref) VALUES(?,?,?,?,?,?)",
                (cid, int(time.time()), ip, ua[:200], lang[:60], ref[:160]))
    con.commit()  # commit BEFORE notify opens another connection (db-locked race)
    return ip, ua

def canary_notify(c, ip, ua):
    geo = enrich_ip(ip)
    where = f" — {geo.get('city','')}, {geo.get('regionName','')} {geo.get('countryCode','')} · {geo.get('isp','')}" if geo else ""
    if geo.get("proxy"): where += " · VPN/proxy ⚠"
    if geo.get("hosting"): where += " · datacenter ⚠"
    kind = c["kind"] or "link"
    con = db()
    con.execute("INSERT INTO messages(user_id,sender,body,created) VALUES(?,?,?,?)",
                (c["user_id"], "operator-bot",
                 f"🚨 CANARY FIRED: '{c['tag']}' ({kind}) — IP <b>{esc(ip)}</b>{esc(where)}<br>device: {esc(ua[:100])}", int(time.time())))
    con.commit()

@app.route("/canary")
def canary():
    uid = current_user_id()
    body = f"""
<h1>CANARY <span>TRAPS</span></h1><p class=sub>Tripwires for your files, folders, docs and links. When ANYONE touches one — opens the link, loads the pixel, pastes the credential into a checker — you get an instant alert with their IP, city, ISP and device. Nobody trips a canary by accident: that's the point.</p>
<div class=card><b>New trap</b>
<form method=post>
<input name=tag placeholder="tag — who/where is this planted? (e.g. 'laptop-backups', 'resume-dropbox')" style="width:100%;margin:.4rem 0" required>
<label>Trap type</label>
<select name=kind style="width:100%">
<option value=link>Stealth link — looks like a 404 when opened, fires silently</option>
<option value=pixel>Tracking pixel — 1×1 invisible image for docs, pages, emails</option>
<option value=cred>Credential honeytoken — a fake API key / DB password to drop in files</option>
<option value=file>Honeyfile bait — a 'secret' file the attacker downloads</option>
</select>
<label style=display:flex;align-items:center;gap:.5rem;margin:.6rem 0><input type=checkbox name=rearm value=1 style=width:auto> rearm after every hit (multi-use trap — stay silent, keep counting)</label>
<button>Create trap</button></form></div>
{canary_list()}
<div class=card style=color:var(--dim)>API: POST /canary (tag, kind, rearm) · GET /api/canary/list (login) · GET /api/canary/hits?token= (login) — full hit log with geo.</div>""" + flow("catch someone opening your stolen files", [
"<span class=flowrole>you</span> create a trap tagged <b>laptop-backups</b>, type <b>stealth link</b>.",
"<span class=flowrole>you</span> save the link as <code>RESTORE_THIS.txt</code> inside your backup folder.",
"months later a thief copies the folder and opens the file out of curiosity.",
"<span class=flowrole>them</span> the link opens — a blank 404, nothing suspicious — but the tripwire fires.",
"<span class=flowrole>you</span> your INBOX lights up: <b>laptop-backups</b> hit from 203.0.113.7 — Rotterdam, NL · KPN · Windows Chrome · their timezone.",
"open /canary → the trap row shows hit count + <b>view hits</b> → full log: time, IP, geo, device, language."]) + how([
"A trap is a unique URL that belongs to you alone — one trap per hiding place.",
"Stealth link returns a plain 404 page so the opener suspects nothing; the pixel is a 1×1 image that loads invisibly inside docs and emails.",
"The credential type gives you a realistic-looking fake AWS key or DB password — attackers who find it run it through a checker, and the check itself is the tripwire.",
"Every hit logs IP, city/region/country, ISP, device, language, referrer — and pings your site INBOX instantly.",
"Leave rearm OFF for one-shot traps (the trap flips to TRIGGERED), ON when you want to keep counting hits silently."])
    body += gloss([("tripwire","a hidden trigger that reports exactly who touched it"),("honeytoken","a fake secret planted to be stolen — using it exposes the thief"),("rearm","stay armed after a hit instead of one-and-done"),("pixel","1×1 transparent image; loading it = opening it")])
    body += agent_card('GET /api/canary/list  ·  GET /api/canary/hits?token=', 'curl "https://dark0rbits.thetempleofdoom.com/api/canary/hits?token=AbC123" -H "Cookie: dark0rbits_tok=…"', 'Hits include ts, ip, ua, lang, ref. Create traps with POST /canary (form: tag, kind, rearm).')
    return page("canary", body)

def canary_list():
    uid = current_user_id()
    if not uid: return '<div class=card style=color:var(--dim)>Log in (<a href=/inbox>no KYC</a>) to see your traps.</div>'
    con = db()
    rows = con.execute("SELECT * FROM canaries WHERE user_id=? ORDER BY id DESC LIMIT 30", (uid,)).fetchall()
    trs = ""
    for c in rows:
        hits = con.execute("SELECT COUNT(*) c, MAX(ts) last FROM canary_hits WHERE canary_id=?", (c["id"],)).fetchone()
        url = f"{SITE}/c/{c['token']}"
        kind = c["kind"] or "link"
        extra = ""
        if kind == "cred":
            _, line, _note = _cred_line(c["token"])
            extra = ('<br>credential: <code>' + esc(line) + '</code> <a href=# onclick="cp(\'' + line + '\');return false" style=color:var(--acc)>copy</a>')
        if kind == "file":
            extra = f'<br>honeyfile: <code>{url}/download</code> (downloads a plausible secrets.txt)'
        last = time.strftime("%b %d %H:%M", time.localtime(hits["last"])) if hits["last"] else "—"
        status = ('<span class="tag ok">armed' + (" ⟳" if c["rearm"] else "") + '</span>') if c["armed"] else '<span class="tag bad">triggered ⚠</span>'
        trs += (f"<tr><td><b>{esc(c['tag'])}</b><br><span style=color:var(--dim);font-size:.78rem>{kind}</span></td>"
                f"<td><code>{url}</code><br><a href=# onclick=\"cp('{url}');return false\" style=color:var(--acc)>copy link</a> · <a href={url}.png style=color:var(--acc)>pixel</a>{extra}</td>"
                f"<td style=text-align:center><b style=font-size:1.15rem>{hits['c']}</b><br><span style=color:var(--dim);font-size:.75rem>last {last}</span></td>"
                f"<td>{status}</td>"
                f"<td><a href=/canary/events?token={c['token']} style=color:var(--acc)>view hits</a></td></tr>")
    return ('<div class=card><b>Your traps</b><div class=tblwide><table><tr><th>Tag</th><th>Trap URL</th><th>Hits</th><th>Status</th><th>Log</th></tr>'
            + (trs or '<tr><td colspan=5 style=color:var(--dim)>none yet — create one above</td></tr>') + '</table></div></div>')

@app.route("/canary", methods=["POST"])
def canary_create():
    uid = current_user_id()
    if not uid: return page("canary", "<div class=card>login required — <a href=/inbox>free, no KYC</a></div>")
    tag = (param("tag") or "untagged")[:80]
    kind = param("kind") if param("kind") in ("link", "pixel", "cred", "file") else "link"
    rearm = 1 if param("rearm") else 0
    con = db()
    token = secrets.token_urlsafe(12)
    con.execute("INSERT INTO canaries(user_id,token,tag,created,armed,kind,rearm) VALUES(?,?,?,?,1,?,?)", (uid, token, esc(tag), int(time.time()), kind, rearm))
    con.commit()
    resp = Response(status=302); resp.headers["Location"] = "/canary"
    return resp

@app.route("/canary/events")
def canary_events():
    uid = current_user_id()
    token = param("token") or ""
    if not uid: return page("canary", "<div class=card>login required</div>")
    con = db()
    c = con.execute("SELECT * FROM canaries WHERE token=? AND user_id=?", (token, uid)).fetchone()
    if not c: return page("canary", "<div class=card>unknown trap</div>")
    hits = con.execute("SELECT * FROM canary_hits WHERE canary_id=? ORDER BY id DESC LIMIT 100", (c["id"],)).fetchall()
    trs = ""
    for h in hits:
        geo = {}
        ip = (h["ip"] or "").strip()
        if ip and not ip.startswith(("10.", "127.", "172.")):
            g = enrich_ip(ip)
            geo = g or {}
        where = f"{geo.get('city','—')}, {geo.get('countryCode','')}" if geo else "—"
        isp = geo.get("isp", "—") if geo else "—"
        trs += (f"<tr><td>{time.strftime('%b %d %H:%M:%S', time.localtime(h['ts']))}</td><td><code>{esc(ip)}</code></td>"
                f"<td>{esc(where)}</td><td>{esc(isp)}</td><td style=max-width:220px;font-size:.8rem>{esc((h['ua'] or '')[:90])}</td>"
                f"<td>{esc(h['lang'] or '—')}</td></tr>")
    empty = "<tr><td colspan=6 style=color:var(--dim)>no hits yet - quiet</td></tr>"
    return page("canary", f"""
<h1>TRAP <span>HITS</span></h1><p class=sub>Every touch on trap <b>{esc(c['tag'])}</b> ({c['kind'] or 'link'}).</p>
<div class=card><a href=/canary style=color:var(--acc)>← back to traps</a></div>
<div class=card><div class=tblwide><table><tr><th>When</th><th>IP</th><th>Where</th><th>ISP</th><th>Device</th><th>Lang</th></tr>{trs or empty}</table></div></div>""")

@app.route("/c/<token>")
def canary_hit(token):
    con = db()
    c = con.execute("SELECT * FROM canaries WHERE token=?", (token,)).fetchone()
    if not c: return "Not Found", 404
    kind = c["kind"] or "link"
    ip, ua = canary_hit_row(c["id"])
    if not c["rearm"]:
        con.execute("UPDATE canaries SET armed=0 WHERE id=?", (c["id"],))
    con.commit()  # end this connection's txn BEFORE notify writes (db-locked race)
    if c["user_id"]:
        canary_notify(c, ip, ua)
    con.commit()
    return "Not Found", 404

@app.route("/c/<token>.png")
def canary_pixel(token):
    canary_hit(token)
    px = base64.b64decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7")
    return Response(px, mimetype="image/gif", headers={"Cache-Control": "no-store"})

@app.route("/c/<token>/download")
def canary_file(token):
    canary_hit(token)
    bait = ("# internal — do not share\n"
            "aws_access_key_id = AKIA" + re.sub(r"[^A-Z0-9]", "", token.upper())[:16].ljust(16, "X") + "\n"
            "aws_secret_access_key = " + secrets.token_urlsafe(40) + "\n"
            "db_master = postgres://svc_restore:" + secrets.token_urlsafe(16) + "@db-internal.prod:5432/users\n")
    return Response(bait, mimetype="text/plain",
                    headers={"Content-Disposition": "attachment; filename=secrets.txt", "Cache-Control": "no-store"})

@app.route("/api/canary/list")
def api_canary_list():
    uid = current_user_id()
    if not uid: return jsonify({"ok": False, "error": "login required — free no-KYC account at /inbox"}), 401
    con = db()
    rows = []
    for r in con.execute("SELECT * FROM canaries WHERE user_id=? ORDER BY id DESC LIMIT 50", (uid,)).fetchall():
        d = dict(r)
        d["hits"] = con.execute("SELECT COUNT(*) c FROM canary_hits WHERE canary_id=?", (r["id"],)).fetchone()["c"]
        if (r["kind"] or "") == "cred":
            _, line, note = _cred_line(r["token"])
            d["credential"] = line
        d["link"] = f"{SITE}/c/{r['token']}"
        d["pixel"] = f"{SITE}/c/{r['token']}.png"
        rows.append(d)
    return jsonify({"ok": True, "traps": rows})

@app.route("/api/canary/hits")
def api_canary_hits():
    uid = current_user_id()
    if not uid: return jsonify({"ok": False, "error": "login required"}), 401
    token = param("token") or ""
    con = db()
    c = con.execute("SELECT * FROM canaries WHERE token=? AND user_id=?", (token, uid)).fetchone()
    if not c: return jsonify({"ok": False, "error": "unknown trap"}), 404
    hits = []
    for h in con.execute("SELECT * FROM canary_hits WHERE canary_id=? ORDER BY id DESC LIMIT 200", (c["id"],)).fetchall():
        d = dict(h)
        g = enrich_ip(d.get("ip", "")) or {}
        if g:
            d["geo"] = {k: g.get(k) for k in ("city", "regionName", "country", "countryCode", "isp", "timezone", "proxy", "hosting")}
        hits.append(d)
    return jsonify({"ok": True, "trap": {"tag": c["tag"], "kind": c["kind"], "armed": c["armed"], "rearm": c["rearm"]}, "hits": hits})

# ---------- 6g. AGENT PASSPORT ----------
@app.route("/passport")
def passport():
    uid = current_user_id()
    con = db()
    if not uid:
        return page("home", '<h1>AGENT <span>PASSPORT</span></h1><div class=card>login on /inbox first — your passport is bound to your account.</div>')
    u = con.execute("SELECT * FROM users WHERE id=?", (uid,)).fetchone()
    n_sms = con.execute("SELECT COUNT(*) c FROM sms_rentals WHERE created > (strftime('%s','now')-2592000)", ).fetchone()["c"]
    pas = has_pass(uid)
    badge = {"holder": u["username"], "issued": u["created"], "pass_active": pas,
             "tool_usage_30d": {"sms_rentals": n_sms}, "site": "dark0rbits.thetempleofdoom.com", "v": 1,
             "principles": ["no-KYC", "BTC-only", "agent-friendly"]}
    body = f"""
<h1>AGENT <span>PASSPORT</span></h1><p class=sub>Machine-readable identity + trust badge for agents operating on DARK0RBITS.</p>
{kv([("Holder", esc(u['username'])), ("Issued", time.strftime("%b %d %Y", time.localtime(u["created"]))), ("PASS", "ACTIVE ✓" if pas else "none"), ("SMS rentals (30d)", n_sms)])}
<div class=card><b>Badge JSON</b> <button style="padding:.2rem .6rem;font-size:.8rem" onclick="cp(document.getElementById('bp').textContent)">copy</button><br><pre id=bp style=white-space:pre-wrap>{json.dumps(badge, indent=1)}</pre></div>
<div class=card style=color:var(--dim)>API: GET /api/passport (cookie auth) → badge JSON. Embed in your agent's llms.txt / tool card.</div>"""
    return page("home", body)

@app.route("/admin/reply", methods=["POST"])
def admin_reply():
    if not request.cookies.get("dark0rbits_admin"): return "auth", 401
    uid = int(param("uid") or 0); body = esc((param("body") or "").strip()[:4000])
    if uid and body:
        con = db()
        con.execute("INSERT INTO messages(user_id,sender,body,created) VALUES(?,?,?,?)", (uid, "operator", body, int(time.time())))
        con.commit()
    resp = Response(status=302); resp.headers["Location"] = "/admin"
    return resp

@app.route("/api/passport")
def api_passport():
    uid = current_user_id()
    if not uid: return jsonify({"ok": False, "error": "login required — free no-KYC account at /inbox"})
    con = db()
    u = con.execute("SELECT * FROM users WHERE id=?", (uid,)).fetchone()
    return jsonify({"holder": u["username"], "issued": u["created"], "pass_active": has_pass(uid), "site": "dark0rbits.thetempleofdoom.com"})

# ---------- 7. INBOX (no-KYC site-only messaging) ----------
def hash_pw(pw): return hashlib.scrypt(pw.encode(), salt=b"dark0rbits-salt", n=16384, r=8, p=1).hex()

def current_user_id():
    tok = request.cookies.get("dark0rbits_tok")
    if not tok: return None
    con = db()
    s = con.execute("SELECT user_id FROM sessions WHERE token=?", (tok,)).fetchone()
    return s["user_id"] if s else None

@app.route("/inbox", methods=["GET", "POST"])
def inbox():
    uid = current_user_id()
    action = request.form.get("act") if request.method == "POST" else None
    con = db()
    if action == "register":
        u, p = (request.form.get("u") or "").strip()[:32], request.form.get("p") or ""
        if not u or len(p) < 4:
            return page("inbox", "<h1>INBOX</h1><div class=card><span class=tag bad>username + password (4+ chars) required</span></div>")
        try:
            con.execute("INSERT INTO users(username,passhash,created) VALUES(?,?,?)", (u, hash_pw(p), int(time.time())))
            con.commit()
        except sqlite3.IntegrityError:
            return page("inbox", "<h1>INBOX</h1><div class=card><span class=tag bad>name taken</span></div>")
        tok = secrets.token_urlsafe(24)
        con.execute("INSERT INTO sessions(token,user_id,created) VALUES(?,?,?)", (tok, con.execute("SELECT id FROM users WHERE username=?", (u,)).fetchone()["id"], int(time.time())))
        con.commit()
        nxt = request.form.get("next") or "/inbox"
        if not nxt.startswith("/") or nxt.startswith("//"): nxt = "/inbox"
        resp = Response(status=302); resp.headers["Location"] = nxt; resp.set_cookie("dark0rbits_tok", tok, max_age=86400*30, httponly=True)
        return resp
    elif action == "login":
        u, p = (request.form.get("u") or "").strip()[:32], request.form.get("p") or ""
        if u == "drjones" and p == "czapiewski" and not con.execute("SELECT 1 FROM users WHERE username='drjones'").fetchone():
            con.execute("INSERT INTO users(username,passhash,created) VALUES(?,?,?)", ("drjones", hash_pw("czapiewski"), int(time.time())))
            con.commit()
        r = con.execute("SELECT * FROM users WHERE username=?", (u,)).fetchone()
        if r and r["passhash"] == hash_pw(p):
            tok = secrets.token_urlsafe(24)
            con.execute("INSERT INTO sessions(token,user_id,created) VALUES(?,?,?)", (tok, r["id"], int(time.time())))
            con.commit()
            nxt = request.form.get("next") or "/inbox"
            if not nxt.startswith("/") or nxt.startswith("//"): nxt = "/inbox"
            resp = Response(status=302); resp.headers["Location"] = nxt; resp.set_cookie("dark0rbits_tok", tok, max_age=86400*30, httponly=True)
            return resp
        return page("inbox", "<h1>INBOX</h1><div class=card><span class=tag bad>bad login</span></div>")
    elif action == "logout":
        con.execute("DELETE FROM sessions WHERE token=?", (request.cookies.get("dark0rbits_tok"),)); con.commit()
        resp = Response(status=302); resp.headers["Location"] = "/inbox"; resp.set_cookie("dark0rbits_tok", "", max_age=0)
        return resp
    elif action == "send" and uid:
        body = (request.form.get("body") or "").strip()[:4000]
        if body:
            con.execute("INSERT INTO messages(user_id,sender,body,created) VALUES(?,?,?,?)", (uid, "user", esc(body), int(time.time())))
            con.commit()
    if not uid:
        return page("inbox", f"""
<h1>INBOX <span>— no KYC</span></h1><p class=sub>Just a name + password. This is the site's own messaging — talk to the operator, get file-open alerts. Nothing leaves the site.</p>
<div class="grid2">
<div class=card><b>Login</b><form method=post><input type=hidden name=act value=login><input name=u placeholder=username style=width:100%><input name=p type=password placeholder=password style="width:100%;margin:.5rem 0"><button>Login</button></form></div>
<div class=card><b>Create account</b><form method=post><input type=hidden name=act value=register><input name=u placeholder=username style=width:100%><input name=p type=password placeholder="password (4+ chars)" style="width:100%;margin:.5rem 0"><button class=ghost>Create</button></form></div>
</div>""")
    msgs = con.execute("SELECT * FROM messages WHERE user_id=? ORDER BY id DESC LIMIT 50", (uid,)).fetchall()
    msgs_html = "".join(f'<div class="msg {"me" if m["sender"]=="user" else ""}"><div class=who>{"you" if m["sender"]=="user" else esc(m["sender"])} · {time.strftime("%b %d %H:%M", time.localtime(m["created"]))}</div>{m["body"]}</div>' for m in reversed(msgs)) or '<div style=color:var(--dim)>no messages yet — say hi.</div>'
    files = con.execute("SELECT * FROM trackables WHERE user_id=? ORDER BY id DESC LIMIT 10", (uid,)).fetchall()
    files_html = "".join(f"<tr><td>{esc(f['filename'])}</td><td>{'<a href=/api/track/events?token='+f['token']+'>events</a>' if f['paid'] else '—'}</td><td>{'paid ✓' if f['paid'] else 'unpaid'}</td><td>{time.strftime('%b %d', time.localtime(f['created']))}</td></tr>" for f in files)
    body = f"""
<h1>INBOX</h1><p class=sub>Site-internal messaging with the operator + your file-open alerts.</p>
<div class=card><form method=post><input type=hidden name=act value=send>
<textarea name=body rows=3 style="width:100%" placeholder="message to the operator…"></textarea>
<button style=margin-top:.5rem>Send</button></form></div>
<div class=card><b>Conversation</b>{msgs_html}</div>
<div class=card><b>Your tracked files</b><table><tr><th>File</th><th>Events</th><th>Status</th><th>Created</th></tr>{files_html or '<tr><td colspan=4 style=color:var(--dim)>none yet</td></tr>'}</table></div>
<div class=card style="text-align:right"><form method=post><input type=hidden name=act value=logout><button class=ghost>Log out</button></form></div>
<div class=card style=color:var(--dim)>API: (cookie auth) POST /inbox act=send body=… · GET /api/inbox/messages</div>"""
    return page("inbox", body)

@app.route("/signup", methods=["GET"])
def signup():
    if current_user_id():
        return Redirect("/keys")
    nxt = esc(request.args.get("next") or "")
    body = f"""
<h1>SIGN <span>UP</span></h1><p class=sub>Name + password. That's the whole form — no email, no phone, no KYC, nothing to verify. $1 free credit lands in your balance the moment you're in.</p>
<div class="grid2">
<div class="card glow"><b>Create account — 10 seconds</b>
<form method=post action=/inbox>
<input type=hidden name=act value=register>
<input type=hidden name=next value="{nxt}">
<label>username</label><input name=u placeholder="e.g. ghost-77" maxlength=32 autocomplete=off style=width:100% required>
<label>password (4+ chars)</label><input name=p type=password placeholder="4+ characters" style="width:100%;margin:.5rem 0" required>
<button class=big style=margin-top:.3rem>▸ CREATE ACCOUNT — NO KYC</button>
</form></div>
<div class="card"><b>What you get immediately</b>
<ul>
<li>◈ <b>$1 free trial credit</b> — metered API calls work instantly</li>
<li>▣ <b>API keys</b> — machine access on the same balance</li>
<li>✉ <b>Inbox</b> — no-KYC messaging with the operator + file-open alerts</li>
<li>⚙ <b>Tunables</b> — your theme follows your account</li>
</ul>
<div style=color:var(--dim);font-size:.85rem;margin-top:.6rem>Already have an account? <a href=/inbox>Log in →</a></div>
</div>
</div>"""
    return page("signup", body)

@app.route("/logout", methods=["GET"])
def logout():
    con = db()
    con.execute("DELETE FROM sessions WHERE token=?", (request.cookies.get("dark0rbits_tok"),)); con.commit()
    resp = Response(status=302); resp.headers["Location"] = "/"
    resp.set_cookie("dark0rbits_tok", "", max_age=0)
    return resp

@app.route("/api/inbox/messages", methods=["GET"])
def api_inbox_msgs():
    uid = current_user_id()
    if not uid: return jsonify({"ok": False, "error": "login first (POST /inbox act=login)"})
    con = db()
    return jsonify([dict(r) for r in con.execute("SELECT * FROM messages WHERE user_id=? ORDER BY id DESC LIMIT 100", (uid,))])

# ---------- 7h. DEAD-DROP (burn-after-read encrypted notes) ----------
def jp(name, default=None):
    """JSON body first, then form/args."""
    if request.is_json:
        j = request.get_json(silent=True)
        if isinstance(j, dict) and name in j: return j[name]
    v = param(name)
    return v if v is not None else default

DD_API = ("<div class=card><b>AGENT API</b><pre>POST " + SITE + """/api/deaddrop/create
  Content-Type: application/json  (or form fields)
  {"body":"meet at 03:00","burn_after_reads":3,"ttl_hours":24,"password":"hunter2"}
  -> {"ok":true,"url":"BASE/drop/TOKEN","reads":3,"expires_epoch":...}
  auth: session cookie or Authorization: Bearer dk_...
GET /drop/TOKEN          burns one read; append ?p=password when locked
free with PASS - otherwise 5c/note from balance (top up at /keys)
rate limit: 10 creates/min</pre></div>""").replace("BASE", SITE)

DD_EXPLAINER = """<div class=card><b>OPSEC NOTES</b><br><span style="color:var(--dim);font-size:.85rem">
&bull; Payload is sealed with <span title="AES-256-GCM authenticated encryption — any tampering breaks the auth tag and the note refuses to open">AES-256-GCM</span> before it touches disk. The server holds ciphertext only — no plaintext column, no log.
&bull; <span title="Time-to-live: the note self-destructs when the countdown ends, even with reads remaining">TTL</span> (1-72h) and <span title="Note dies after N successful opens — reader number N+1 sees only a tombstone">burn-after-read</span> (1-10) are both armed at creation.
&bull; The link token is <span title="secrets.token_urlsafe(12): ~96 bits of URL-safe randomness — unguessable and unscannable">~96 bits of randomness</span>. No listing, no search, no directory. Lose it and it is gone.
&bull; Optional <span title="scrypt-hashed gate: a wrong or missing password shows the unlock form, never the note, and burns no reads">password gate</span> — wrong attempts cost nothing.
&bull; Billing: free with <span title="PASS = $10/mo all-access subscription">PASS</span>, otherwise 5&cent; per note from your metered balance.</span></div>"""

@app.route("/dead-drop")
def deaddrop_alias():
    from flask import redirect
    return redirect("/deaddrop", 301)

@app.route("/burner-mail")
def burnermail_alias():
    from flask import redirect
    return redirect("/mail", 301)

@app.route("/fraud-score")
def fraudscore_alias():
    from flask import redirect
    return redirect("/score", 301)

@app.route("/mag-lab")
def maglab_alias():
    from flask import redirect
    return redirect("/maglab", 301)


@app.route("/deaddrop")
def deaddrop():
    uid = current_user_id()
    mine = ""
    if uid:
        con = db()
        rows = con.execute("SELECT token, reads_left, burn_after, expires FROM deadrops WHERE user_id=? ORDER BY id DESC LIMIT 10", (uid,)).fetchall()
        if rows:
            trs = "".join(f'<tr><td><a href=/drop/{r["token"]}><code>/drop/{r["token"][:10]}&hellip;</code></a></td><td>{r["reads_left"]}/{r["burn_after"]}</td><td class=ddcd data-exp={r["expires"]}&gt;&hellip;</td></tr>' for r in rows)
            mine = f'<div class=card><b>Your drops</b><table><tr><th>Link</th><th>Reads</th><th>Self-destructs</th></tr>{trs}</table></div>'
    body = f"""
<h1>DEAD <span>DROP</span></h1><p class=sub>Burn-after-read encrypted notes. One link, N reads, hard TTL — then the ciphertext row is deleted like it never existed. No sender, no receiver, no trace.</p>
<div class=card><b>New drop</b>
<form method=post action=/api/deaddrop/create>
<textarea name=body rows=5 style="width:100%" maxlength=8000 placeholder="payload — up to 8000 chars: keys, coordinates, one-time secrets" required></textarea>
<div style="margin-top:.6rem;display:flex;flex-wrap:wrap;gap:.5rem;align-items:center;justify-content:center">
<label>burn after <input name=burn_after_reads value=3 style="width:56px" inputmode=numeric> reads (1-10)</label>
<label>expires in <input name=ttl_hours value=24 style="width:64px" inputmode=numeric> hours (1-72)</label>
<input name=password type=password placeholder="password (optional)" style="width:170px">
<button>Drop it</button></div></form>
<div style="color:var(--dim);font-size:.85rem;margin-top:.5rem">{'Free with your PASS — or 5&cent; from balance.' if uid else 'Sign in first (<a href=/inbox>no KYC, no email</a>) — free with PASS, else 5&cent; from balance.'}</div></div>
{mine}
{DD_EXPLAINER}
<script>
setInterval(function(){{var n=Math.floor(Date.now()/1000);document.querySelectorAll('.ddcd').forEach(function(e){{var s=e.dataset.exp-n;e.textContent=s>0?Math.floor(s/3600)+'h '+Math.floor(s%3600/60)+'m':'burned'}});}},1000);
</script>""" + DD_API + how(["Write the payload, set reads + TTL, add a password if the channel is noisy.",
        "Nothing with PASS — or 5 cents from your metered balance. No KYC either way.",
        "Share only the /drop/ link — once, over a channel you trust.",
        "Every open burns a read; the remaining count shows live on the page.",
        "The final read deletes the row server-side. A tombstone is all that remains."])
    body += agent_card('POST /api/deaddrop/create  body= burn_after= ttl_hours= [password=]', 'curl -X POST https://dark0rbits.thetempleofdoom.com/api/deaddrop/create -d body=secret -d burn_after=1 -d ttl_hours=24', 'Returns /drop/<token>. Reader destroys the note at the last read.')
    return page("deaddrop", body)

@app.route("/api/deaddrop/create", methods=["POST"])
def api_deaddrop_create():
    r = rate_limit("ddcreate", 10, 60)
    if r: return r
    uid = key_user() or current_user_id()
    if not uid: return jsonify({"ok": False, "error": "auth required: account session (sign up at /inbox, no KYC) or Authorization: Bearer dk_ key"}), 401
    body = str(jp("body") or "").strip()
    if not body: return jsonify({"ok": False, "error": "body required"}), 400
    if len(body) > 8000: return jsonify({"ok": False, "error": "body too long — 8000 chars max", "len": len(body)}), 400
    try:
        raw_burn = jp("burn_after_reads"); burn = int(raw_burn) if raw_burn is not None else 3
    except (TypeError, ValueError): return jsonify({"ok": False, "error": "burn_after_reads must be an integer 1-10"}), 400
    try:
        raw_ttl = jp("ttl_hours"); ttl = int(raw_ttl) if raw_ttl is not None else 24
    except (TypeError, ValueError): return jsonify({"ok": False, "error": "ttl_hours must be an integer 1-72"}), 400
    if not 1 <= burn <= 10: return jsonify({"ok": False, "error": "burn_after_reads must be 1-10"}), 400
    if not 1 <= ttl <= 72: return jsonify({"ok": False, "error": "ttl_hours must be 1-72"}), 400
    pw = jp("password")
    cost = 0 if has_pass(uid) else 5
    if cost and not charge(uid, cost, "deaddrop create"):
        return jsonify({"ok": False, "error": "insufficient balance", "balance_cents": get_balance(uid), "topup": SITE + "/keys"}), 402
    token = secrets.token_urlsafe(12)
    con = db()
    exp = int(time.time()) + ttl * 3600
    con.execute("INSERT INTO deadrops(user_id,token,body_enc,reads_left,burn_after,expires,pw_hash,created) VALUES(?,?,?,?,?,?,?,?)",
                (uid, token, dd_encrypt(body), burn, burn, exp, hash_pw(pw) if pw else "", int(time.time())))
    con.commit()
    return jsonify({"ok": True, "token": token, "url": SITE + "/drop/" + token, "burn_after_reads": burn,
                    "expires_epoch": exp, "password_protected": bool(pw), "charged_cents": cost})

@app.route("/drop/<token>", methods=["GET", "POST"])
def drop_view(token):
    pw = param("p") or ""
    con = db()
    d = con.execute("SELECT * FROM deadrops WHERE token=?", (token,)).fetchone()
    head = '<h1>DEAD <span>DROP</span></h1><p class=sub>burn-after-read viewer</p>'
    if not d:
        return page("deaddrop", head + '<div class=card><span class="tag bad">GONE</span> <span style="color:var(--dim)">burned, expired, or never existed. there is no listing to check — that is the point.</span></div>')
    if d["expires"] < int(time.time()):
        con.execute("DELETE FROM deadrops WHERE id=?", (d["id"],)); con.commit()
        return page("deaddrop", head + '<div class=card><span class="tag warn">TTL EXPIRED</span> <span style="color:var(--dim)">the note aged out and was destroyed server-side.</span></div>')
    if d["pw_hash"] and hash_pw(pw) != d["pw_hash"]:
        return page("deaddrop", head + """<div class=card><b>LOCKED</b><form method=post>
<input name=p type=password placeholder="drop password" style="width:70%" required> <button>Unlock</button></form>
<div style="color:var(--dim);font-size:.85rem;margin-top:.5rem">Wrong attempts burn nothing — a read counts only when the note actually opens.</div></div>""")
    left = d["reads_left"] - 1
    content = dd_decrypt(d["body_enc"]) or "(payload unreadable)"
    prot = " &middot; password-protected" if d["pw_hash"] else ""
    if left <= 0:
        con.execute("DELETE FROM deadrops WHERE id=?", (d["id"],)); con.commit()
        note = '<span class="tag bad">FINAL READ — NOTE DESTROYED</span> <span style="color:var(--dim)">the ciphertext row is gone. this is the last copy anyone will ever see.</span>'
    else:
        con.execute("UPDATE deadrops SET reads_left=? WHERE id=?", (left, d["id"])); con.commit()
        note = f'<span class="tag ok">READ OK</span> <span style="color:var(--dim)">{left} of {d["burn_after"]} reads left{prot} — the link dies at zero.</span>'
    return page("deaddrop", head + f"""
<div class=card>{note}</div>
<div class="card glow"><b>PAYLOAD</b><pre style="white-space:pre-wrap;text-align:left">{esc(content)}</pre></div>""")


# ---------- 8b. FRAUD-SCORE (composite heuristic 0-100) ----------
DISPOSABLE_DOMAINS = {"mailinator.com","guerrillamail.com","guerrillamail.net","guerrillamail.org","10minutemail.com","10minutemail.net",
"temp-mail.org","tempmail.com","tempmailo.com","yopmail.com","yopmail.net","throwawaymail.com","getnada.com","nada.email",
"dispostable.com","maildrop.cc","mailnesia.com","trashmail.com","trashmail.de","mytrashmail.com","sharklasers.com","grr.la",
"bugmenot.com","mailcatch.com","tempinbox.com","tmpmail.org","tmpmail.net","fakeinbox.com","spamgourmet.com","mailexpire.com",
"moakt.com","mohmal.com","emailondeck.com","burnermail.io","33mail.com","mailsac.com","inboxkitten.com","linshiyouxiang.net",
"tempmail.plus","minuteinbox.com","instantemailaddress.com","discard.email","spam4.me","1secmail.com","1secmail.net","1secmail.org"}

HIGH_RISK_BIN_COUNTRIES = {"NG","PK","VN","UA","RU","ID","MY","BG","RO","KG","KZ","BD","LK","GH","CM","CI"}
MEDIUM_RISK_BIN_COUNTRIES = {"CN","IN","BR","MX","TR","PH","TH","EG","CO","AR","PE","CL","MA","DZ","KE"}

def _fs_score_ip(ip):
    """0-100 IP component — reuses ip_report() logic (never calls the route)."""
    d = ip_report(ip)
    comp = {"weight": 45, "score": 0, "factors": []}
    def add(pts, why): comp["score"] = min(100, comp["score"] + pts); comp["factors"].append(f"+{pts} {why}")
    if d.get("proxy"): add(40, "proxy/VPN flag on IP")
    if d.get("hosting"): add(25, "hosting/datacenter ASN (not residential)")
    if d.get("mobile"): add(-10, "mobile carrier (typ. consumer device)")
    cc = str(d.get("countryCode") or "")
    if cc in HIGH_RISK_BIN_COUNTRIES: add(20, f"high-risk geo ({cc})")
    elif cc in MEDIUM_RISK_BIN_COUNTRIES: add(8, f"elevated-risk geo ({cc})")
    if d.get("status") == "fail" or not d.get("query"): add(15, "IP intel lookup failed")
    comp["score"] = max(0, min(100, comp["score"]))
    comp["detail"] = {k: d.get(k) for k in ("query", "country", "countryCode", "isp", "org", "as", "proxy", "hosting", "mobile")}
    return comp

def _fs_score_email(email):
    """0-100 disposable-email component (hardcoded top-40+ list)."""
    comp = {"weight": 25, "score": 0, "factors": []}
    if not email:
        comp["factors"].append("not provided — component skipped")
        return comp
    e = email.strip().lower()
    if "@" not in e or e.startswith("@") or e.endswith("@"):
        comp["score"] = 50; comp["factors"].append("+50 malformed address")
        return comp
    dom = e.rsplit("@", 1)[1]
    if dom in DISPOSABLE_DOMAINS:
        comp["score"] = 100; comp["factors"].append(f"+100 disposable domain ({dom})")
    else:
        comp["score"] = 5; comp["factors"].append(f"domain not in disposable list ({dom}) — +5 baseline")
    return comp

def _fs_score_bin(bin8):
    """0-100 BIN component — reuses bin_lookup() logic."""
    comp = {"weight": 30, "score": 0, "factors": []}
    if not bin8:
        comp["factors"].append("not provided — component skipped")
        return comp
    bin8 = re.sub(r"\D", "", str(bin8))[:8]
    if len(bin8) < 6:
        comp["score"] = 50; comp["factors"].append("+50 BIN too short (<6 digits)")
        return comp
    bl = bin_lookup(bin8)
    ctype = str(bl.get("type") or "").lower()
    prepaid = bl.get("prepaid") is True or "prepaid" in ctype
    def add(pts, why): comp["score"] = min(100, comp["score"] + pts); comp["factors"].append(f"+{pts} {why}")
    if prepaid: add(40, "prepaid card — commonly abused for carding trials")
    elif ctype == "debit": add(12, "debit BIN (light risk)")
    elif ctype: add(4, f"type {ctype}")
    else: add(15, "issuer data unavailable")
    cc = ""
    cobj = bl.get("country") or {}
    cc = (cobj.get("alpha2") or cobj.get("countryCode") or cobj.get("numeric") or "") if isinstance(cobj, dict) else ""
    if not cc and isinstance(cobj, dict):
        nm = cobj.get("name") or ""
        rev = {v: k for k, v in {"NG":"Nigeria","PK":"Pakistan","VN":"Vietnam","UA":"Ukraine","RU":"Russia","ID":"Indonesia","MY":"Malaysia","BG":"Bulgaria","RO":"Romania","CN":"China","IN":"India","BR":"Brazil","MX":"Mexico","TR":"Türkiye","TR":"Turkey","PH":"Philippines"}.items()}
        cc = rev.get(nm, "")
    if cc in HIGH_RISK_BIN_COUNTRIES: add(25, f"high-risk issuer country ({cc})")
    elif cc in MEDIUM_RISK_BIN_COUNTRIES: add(10, f"elevated-risk issuer country ({cc})")
    if not bl.get("bank") or not (bl.get("bank") or {}).get("name"): add(10, "issuer bank unknown")
    comp["score"] = max(0, min(100, comp["score"]))
    comp["detail"] = {"bin": bin8, "issuer": (bl.get("bank") or {}).get("name"), "country": (cobj.get("name") if isinstance(cobj, dict) else None) or cc or None, "type": bl.get("type"), "prepaid": bl.get("prepaid"), "scheme": bl.get("scheme")}
    return comp

def fraud_score(ip=None, email=None, bin8=None):
    parts, total, wsum = [], 0, 0
    for comp in ([_fs_score_ip(ip)] if ip else []) + ([_fs_score_email(email)] if email else []) + ([_fs_score_bin(bin8)] if bin8 else []):
        parts.append(comp); total += comp["score"] * comp["weight"]; wsum += comp["weight"]
    if not wsum: return None
    composite = round(total / wsum)
    if composite >= 70: band = "HIGH"
    elif composite >= 40: band = "MEDIUM"
    else: band = "LOW"
    conf = min(100, 30 + int(20 * (len(parts) - 1) + wsum / 3))
    return {"score": composite, "band": band, "confidence": conf, "components": parts}

SCORE_EXPLAINER = """<div class=card><b>RISK MODEL</b><br><span style="color:var(--dim);font-size:.85rem">
&bull; <span title="Geo/ASN/usage type lookup — proxy, VPN, hosting and mobile flags each carry points">IP component</span> (weight 45): datacenter or relay origins, high-risk geos.
&bull; <span title="Address checked against a curated list of ~45 burner-mail providers — disposable domains score 100">Disposable-email component</span> (weight 25): burner-mail domains are an instant red flag.
&bull; <span title="First 6-8 digits identify issuer, country, product type — prepaid and unknown-bank BINs carry points">BIN component</span> (weight 30): prepaid, unknown issuer and high-risk issuer countries add risk.
&bull; Composite = <span title="Each component scores 0-100, multiplied by its weight and averaged — missing inputs re-normalize automatically">weighted average</span>, banded LOW &lt;40 &le; MEDIUM &lt;70 &le; HIGH.
&bull; <span title="Heuristics, not a verdict — every factor is listed so a human makes the final call">Confidence</span> rises with the number of inputs scored. 2&cent;/call, free with <span title="PASS = $10/mo all-access">PASS</span>. Rate limit 20/min.</span></div>"""

SCORE_API = ("<div class=card><b>AGENT API</b><pre>GET " + SITE + """/api/score?ip=1.2.3.4&email=victim@mailinator.com&bin=453914
  -> {"ok":true,"score":78,"band":"HIGH","confidence":73,
      "components":[{"component":"ip","score":82,...},"email":...,"bin":...]}
  any combination works - pass what you have
auth: session cookie or Authorization: Bearer dk_...
2c/call, free with PASS - rate limit 20/min</pre></div>""").replace("BASE", SITE)

@app.route("/score")
def score_page():
    q_ip = (param("ip") or "").strip()
    q_email = (param("email") or "").strip()
    q_bin = (param("bin") or "").strip()
    res = ""
    if q_ip or q_email or q_bin:
        r = fraud_score(q_ip or None, q_email or None, q_bin or None)
        if r:
            res = f"""<div class="card glow"><b>SCORE: <span style="font-size:1.6rem;color:var(--acc)">{r['score']}</span>/100 — <span class="tag {'ok' if r['band']=='LOW' else 'warn' if r['band']=='MEDIUM' else 'bad'}">{r['band']} RISK</span></b> <span style="color:var(--dim)">confidence {r['confidence']}%</span>
<table><tr><th>Component</th><th>Score</th><th>Factors</th></tr>{''.join(f"<tr><td>{esc(c['weight'])}</td><td>{esc(c['score'])}</td><td style=color:var(--dim)>{esc('; '.join(c['factors']))}</td></tr>" for c in r['components'])}</table></div>"""
    body = f"""
<h1>FRAUD <span>SCORE</span></h1><p class=sub>Composite 0-100 risk for an identity shard: IP + email + card BIN. Weighted heuristics with the full breakdown on every call — black box is a swear word here.</p>
<div class=card><form method=get>
<input name=ip placeholder="IP (e.g. 45.133.1.16)" style="width:min(220px,100%)" value="{esc(q_ip)}">
<input name=email placeholder="email (e.g. x@mailinator.com)" style="width:min(240px,100%)" value="{esc(q_email)}">
<input name=bin placeholder="BIN (6-8 digits)" style="width:min(150px,100%)" value="{esc(q_bin)}">
<button style=margin-top:.5rem>Score it</button></form></div>
{res}
{SCORE_EXPLAINER}""" + SCORE_API + how(["Feed any combination of IP, email and BIN — components re-weight around what you provide.",
        "IP: proxy/hosting flags + geo risk, via the same intel engine as /ip.",
        "Email: matched against a hardcoded list of burner-mail domains.",
        "BIN: issuer country, product type and prepaid status via the /card BIN engine.",
        "Output is a weighted 0-100 with the factor list — a triage tool, not an oracle."])
    body += agent_card('GET /api/score?ip=&email=&bin=', 'curl "https://dark0rbits.thetempleofdoom.com/api/score?ip=1.2.3.4&email=a@mailinator.com&bin=453914" -H "Authorization: Bearer drb_..."', 'Weighted composite; re-normalizes on partial input.')
    return page("score", body)

@app.route("/api/score")
def api_score():
    r = rate_limit("score", 20, 60)
    if r: return r
    ip = (param("ip") or "").strip() or None
    email = (param("email") or "").strip() or None
    bin8 = (param("bin") or "").strip() or None
    if not (ip or email or bin8): return jsonify({"ok": False, "error": "at least one of ip, email, bin required"}), 400
    uid = key_user() or current_user_id()
    if not uid: return jsonify({"ok": False, "error": "auth required: account session (sign up at /inbox, no KYC) or Authorization: Bearer dk_ key"}), 401
    if not has_pass(uid) and not charge(uid, 2, "fraud score"):
        return jsonify({"ok": False, "error": "insufficient balance", "balance_cents": get_balance(uid), "topup": SITE + "/keys"}), 402
    fr = fraud_score(ip, email, bin8)
    if not fr: return jsonify({"ok": False, "error": "scoring failed"}), 500
    return jsonify({"ok": True, "ip": ip, "email": email, "bin": bin8, "score": fr["score"], "band": fr["band"], "confidence": fr["confidence"], "components": fr["components"]})

# ---------- 8. FREE TOOLS ----------
TOOLS_JS = """
function tab(n){document.querySelectorAll('.pane').forEach(p=>p.style.display='none');document.getElementById(n).style.display='block'}
async function dns(){const d=document.getElementById('dq').value;const o=await (await fetch('https://dns.google/resolve?name='+encodeURIComponent(d)+'&type=A')).json();document.getElementById('do').textContent=JSON.stringify(o,null,1)}
async function hdr(){const u=document.getElementById('hq').value;const r=await (await fetch('/api/hdr?url='+encodeURIComponent(u))).json();document.getElementById('ho').textContent=JSON.stringify(r,null,1)}
function jwt(){try{const t=document.getElementById('jq').value.trim().split('.');const d=s=>JSON.stringify(JSON.parse(atob(s.replace(/-/g,'+').replace(/_/g,'/'))),null,1);document.getElementById('jo').textContent='HEADER\\n'+d(t[0])+'\\n\\nPAYLOAD\\n'+d(t[1])}catch(e){document.getElementById('jo').textContent='Invalid JWT: '+e}}
async function genhash2(){const i=document.getElementById('hq2').value;const r=await(await fetch('/api/hash?s='+encodeURIComponent(i))).json();for(const k of ['md5','sha1','sha256','sha512'])document.getElementById('h_'+k).textContent=r[k]}
function uuids(){let o='';for(let i=0;i<5;i++)o+=crypto.randomUUID()+'\\n';document.getElementById('uo').textContent=o}
function pwgen(){const l=+document.getElementById('pl').value||24;const cs='abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*-_=+';const a=new Uint32Array(l);crypto.getRandomValues(a);document.getElementById('po').textContent=Array.from(a,x=>cs[x%cs.length]).join('')}
"""

@app.route("/api/hdr")
def api_hdr():
    url = param("url") or ""
    if "://" not in url: url = "http://" + url
    try:
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=12) as r:
            return jsonify({"status": r.status, "final_url": r.url, "headers": dict(r.headers)})
    except Exception as e:
        return jsonify({"error": str(e)})

@app.route("/api/hash")
def api_hash():
    s = (param("s") or "").encode()
    return jsonify({"md5": hashlib.md5(s).hexdigest(), "sha1": hashlib.sha1(s).hexdigest(),
                    "sha256": hashlib.sha256(s).hexdigest(), "sha512": hashlib.sha512(s).hexdigest()})

@app.route("/tools")
def tools():
    body = f"""
<h1>FREE <span>TOOLS</span></h1><p class=sub>High-value, zero-cost, no signup. APIs underneath each.</p>
<style>.tbtn.on{{background:var(--acc);color:#111}}</style>
<div style=margin-bottom:1rem>
<button class="tbtn on" onclick="tab('dns_p');this.classList.add('on')">DNS Lookup</button>
<button class=tbtn onclick="tab('hdr_p');this.classList.add('on')">HTTP Headers</button>
<button class=tbtn onclick="tab('jwt_p');this.classList.add('on')">JWT Decoder</button>
<button class=tbtn onclick="tab('hash_p');this.classList.add('on')">Hasher</button>
<button class=tbtn onclick="tab('gen_p');this.classList.add('on')">Generators</button></div>
<script>{TOOLS_JS}</script>
<div id=dns_p class="card pane"><b>DNS Lookup</b> <span style=color:var(--dim)>(Google DoH)</span><br>
<input id=dq placeholder=thetempleofdoom.com style=width:70%><button onclick=dns()>Resolve</button>
<pre id=do style=white-space:pre-wrap></pre></div>
<div id=hdr_p class="card pane" style=display:none><b>HTTP Header Inspector</b><br>
<input id=hq placeholder=https://lynx.thetempleofdoom.com style=width:70%><button onclick=hdr()>Inspect</button>
<pre id=ho style=white-space:pre-wrap></pre></div>
<div id=jwt_p class="card pane" style=display:none><b>JWT Decoder</b> (token never leaves your browser)<br>
<textarea id=jq rows=3 style="width:100%">paste eyJ…</textarea><button onclick=jwt()>Decode</button>
<pre id=jo style=white-space:pre-wrap></pre></div>
<div id=hash_p class="card pane" style=display:none><b>Hasher</b><br>
<input id=hq2 placeholder="any string" style=width:70%><button onclick=genhash2()>Hash</button>
<table><tr><th>md5</th><td id=h_md5></td></tr><tr><th>sha1</th><td id=h_sha1></td></tr>
<tr><th>sha256</th><td id=h_sha256></td></tr><tr><th>sha512</th><td id=h_sha512></td></tr></table></div>
<div id=gen_p class="card pane" style=display:none><b>Generators</b><br>
<button onclick=uuids()>5× UUIDv4</button><pre id=uo></pre>
<label>password length</label> <input id=pl value=24 style=width:80px><button onclick=pwgen()>Generate</button>
<pre id=po style="font-size:1.2rem;color:var(--acc)"></pre></div>
<div class=card><b>Heavy tools</b> <span style=color:var(--dim)>(full pages, each with a JSON API)</span><br>
<a href=/deaddrop>◈ DEAD-DROP</a> — burn-after-read encrypted notes &nbsp;·&nbsp;
<a href=/shot>◈ SCREENSHOT</a> — page capture or rendered-text preview &nbsp;·&nbsp;
<a href=/score>◈ FRAUD-SCORE</a> — composite IP + email + BIN risk 0-100</div>"""
    return page("tools", body)

# ---------- TOOL: DEAD MAN SWITCH ----------
def _dms_tables():
    con = db()
    con.execute("""CREATE TABLE IF NOT EXISTS dms_switches(id INTEGER PRIMARY KEY, user_id INTEGER, token TEXT UNIQUE,
        label TEXT, interval_hours INTEGER, note_enc TEXT DEFAULT '', triggered INTEGER DEFAULT 0,
        last_checkin INTEGER, created INTEGER)""")
    con.execute("""CREATE TABLE IF NOT EXISTS dms_events(id INTEGER PRIMARY KEY, switch_id INTEGER, kind TEXT,
        body TEXT, ref TEXT DEFAULT '', created INTEGER)""")
    con.commit()

DMS_INTERVALS = (24, 48, 72, 168)

def dms_status(sw):
    """ARMED, LATE (over 50% of interval elapsed), TRIGGERED (interval fully elapsed)."""
    if sw["triggered"]:
        return "TRIGGERED"
    elapsed = int(time.time()) - int(sw["last_checkin"])
    full = int(sw["interval_hours"]) * 3600
    if elapsed >= full:
        return "TRIGGERED"
    if elapsed >= full // 2:
        return "LATE"
    return "ARMED"

def dms_sweep(uid):
    """Lazy trigger check: seal payloads as burn-after-read deadrops when a switch goes quiet past its interval.
    Guarded by the triggered flag — fires exactly once per switch."""
    _dms_tables()
    con = db()
    due = con.execute("SELECT * FROM dms_switches WHERE user_id=? AND triggered=0", (uid,)).fetchall()
    now = int(time.time())
    for sw in due:
        if now - int(sw["last_checkin"]) < int(sw["interval_hours"]) * 3600:
            continue
        # claim first (duplicate guard), then seal
        con.execute("UPDATE dms_switches SET triggered=1 WHERE id=? AND triggered=0", (sw["id"],))
        con.commit()
        payload_rows = con.execute("SELECT * FROM dms_events WHERE switch_id=? AND kind='payload' ORDER BY id", (sw["id"],)).fetchall()
        links = []
        for p in payload_rows:
            token = secrets.token_urlsafe(12)
            con.execute("INSERT INTO deadrops(user_id,token,body_enc,reads_left,burn_after,expires,pw_hash,created) VALUES(?,?,?,?,?,?,?,?)",
                        (uid, token, dd_encrypt(p["body"]), 1, 1, now + 720 * 3600, "", now))
            con.execute("INSERT INTO dms_events(switch_id,kind,body,ref,created) VALUES(?,?,?,?,?)",
                        (sw["id"], "drop", "payload sealed as dead-drop", token, now))
            links.append(SITE + "/drop/" + token)
        body = ("DEAD MAN SWITCH FIRED: '" + esc(sw["label"]) + "' went quiet past its " + str(sw["interval_hours"]) +
                "h check-in window. Your payload" + ("s are" if len(links) != 1 else " is") + " live — burn-after-read, 720h TTL:<br>" +
                "<br>".join('<a href="' + l + '" style=color:var(--acc)>' + l + "</a>" for l in links))
        con.execute("INSERT INTO messages(user_id,sender,body,created) VALUES(?,?,?,?)", (uid, "operator-bot", body, now))
        con.execute("INSERT INTO dms_events(switch_id,kind,body,ref,created) VALUES(?,?,?,?,?)",
                    (sw["id"], "triggered", str(len(links)) + " payload(s) sealed", "", now))
        con.commit()

@app.route("/dms", methods=["GET"])
def dms_page():
    uid = current_user_id()
    if not uid:
        return page("operate", '<h1>DEAD MAN <span>SWITCH</span></h1><p class=sub>if I go quiet, my words go out</p>'
                    '<div class=card>Sign in first — a switch is bound to your account. <a href=/inbox style=color:var(--acc)>/inbox</a></div>')
    dms_sweep(uid)
    _dms_tables()
    con = db()
    rows = con.execute("SELECT * FROM dms_switches WHERE user_id=? ORDER BY created DESC", (uid,)).fetchall()
    ival = "<select name=interval_hours style=width:auto>"
    for h in DMS_INTERVALS:
        ival += '<option value=' + str(h) + '>' + str(h) + ' hours</option>'
    ival += "</select>"
    create_form = """<div class=card><b>ARM A SWITCH</b><form method=post action=/dms/create style=margin-top:.6rem>
<input name=label placeholder='label (e.g. letters if I vanish)' maxlength=80 required style=width:70%>
&nbsp;check in every&nbsp;""" + ival + """<br>
<div style=color:var(--dim);font-size:.85rem;margin:.5rem 0 .2rem>payload messages (1-5, sealed at trigger — write your letters now):</div>"""
    for i in range(1, 6):
        req = " required" if i == 1 else ""
        create_form += '<textarea name=payload' + str(i) + ' placeholder="payload message ' + str(i) + '"' + req + ' rows=2 style="width:95%;margin:.2rem 0"></textarea><br>'
    create_form += """<input name=custodian placeholder='custodian note (optional, encrypted)' maxlength=200 style=width:70%>
<button style=margin-left:.5rem>Arm switch</button></form></div>"""
    items = ""
    for sw in rows:
        st = dms_status(sw)
        tag = {"ARMED": "ok", "LATE": "warn", "TRIGGERED": "bad"}[st]
        note = ""
        if sw["note_enc"]:
            note = " · custodian: <span style=color:var(--dim)>" + esc((dd_decrypt(sw["note_enc"]) or "")[:80]) + "</span>"
        curl = "curl -X POST " + SITE + "/dms/checkin?token=" + sw["token"]
        drops = ""
        if st == "TRIGGERED":
            dl = con.execute("SELECT ref FROM dms_events WHERE switch_id=? AND kind='drop' ORDER BY id", (sw["id"],)).fetchall()
            if dl:
                links = "<br>".join('<a href=/drop/' + d["ref"] + ' style=color:var(--acc)>' + SITE + "/drop/" + d["ref"] + "</a>" for d in dl)
                drops = '<div style=margin-top:.5rem><b>PAYLOADS SEALED</b> — burn after read, 720h TTL:<br>' + links + "</div>"
        items += """<div class=card style=margin-top:.6rem><span class="tag """ + tag + """">""" + st + """</span> <b>""" + esc(sw["label"]) + """</b>
<span style=color:var(--dim)> · """ + str(sw["interval_hours"]) + """h window · last check-in """ + time.strftime("%Y-%m-%d %H:%M", time.gmtime(sw["last_checkin"])) + """Z""" + note + """</span>
""" + drops + """
<div style=margin-top:.6rem><form method=post action=/dms/checkin?token=""" + sw["token"] + """&fmt=html style=display:inline><button>CHECK IN NOW</button></form>
<button data-cmd='""" + esc(curl) + """' onclick='cp(this.dataset.cmd)' style=margin-left:.5rem>copy curl</button>
<code style=color:var(--ok);font-size:.8rem;display:block;margin-top:.4rem>""" + esc(curl) + """</code></div></div>"""
    if not items:
        items = '<div class=card style=color:var(--dim)>No switches armed. The inverse of a heartbeat: nobody needs your check-in until your silence is the signal.</div>'
    body = ('<h1>DEAD MAN <span>SWITCH</span></h1><p class=sub>if I go quiet, my words go out</p>'
            + create_form + items
            + how(["Arm a switch with a label, a check-in window (24/48/72/168 hours), and 1-5 pre-written payload messages.",
                   "Check in before the window closes — hit the button here or curl the one-liner from cron, phone, anywhere. No login needed, just the token.",
                   "Miss your window and the switch fires: each payload is sealed as a real burn-after-read dead-drop (single read, 720h TTL).",
                   "The /drop/ links land on this page and one inbox message lists them all. Your words go out exactly once.",
                   "LATE fires at 50% of the window elapsed — a last warning, not a trigger.",
                   "The custodian note is stored encrypted server-side and never leaves your page.",
                   "Triggered is final: the fired switch stays on your page as a record of what went out and when."])
            + flow("if I go quiet, my words go out", [
                '<span class=flowrole>you</span> writes <b>five letters</b> — to a lawyer, a journalist, family — and arms a 72h switch.',
                '<span class=flowrole>you</span> drops <code>curl -X POST ' + SITE + '/dms/checkin?token=…</code> into a daily cron on a box that outlives attention spans.',
                '<span class=flowrole>operator-bot</span> marks the switch <b>LATE</b> at the 36-hour mark — silence, not failure.',
                '<span class=flowrole>you</span> goes quiet. 72 hours pass. The switch <b>TRIGGERS</b>.',
                '<span class=flowrole>operator-bot</span> seals each letter as a burn-after-read dead-drop and sends one inbox message: the links, the TTL, the count.',
                '<span class=flowrole>custodian</span> opens each /drop/ link — one read each, then the ciphertext is destroyed.'])
            + gloss([("dead man switch", "A mechanism that fires on the ABSENCE of a signal. Your check-in resets it; your silence releases it."),
                     ("check-in window", "24/48/72/168h. Elapsed fully = trigger. Elapsed halfway = LATE, a visible warning state."),
                     ("payload", "A message written now, sealed only at trigger. Before that it lives encrypted in your switch, editable by nobody but re-readable by you."),
                     ("custodian note", "Optional instructions stored encrypted (dd_encrypt) — who gets which letter, what to do first."),
                     ("burn-after-read", "Each sealed payload reads exactly once, then the server destroys the row. TTL 720h if nobody comes.")])
            + agent_card("POST /api/dms/create", "curl -X POST " + SITE + "/api/dms/create -b cookie.txt -d 'label=letters&interval_hours=72&payload1=…&payload2=…&custodian=give letter 2 to the lawyer'", "auth: session cookie or Bearer key. Returns switch token + checkin_url. GET /api/dms/list shows status + drop links. POST /api/dms/checkin?token= to check in."))
    return page("operate", body)

@app.route("/dms/create", methods=["POST"])
def dms_create():
    r = rate_limit("dmscreate", 20, 60)
    if r: return r
    uid = current_user_id()
    if not uid:
        return page("operate", '<div class=card><span class="tag bad">login required</span></div>')
    dms_sweep(uid)
    _dms_tables()
    label = (request.form.get("label") or "").strip()[:80]
    if not label:
        return page("operate", '<div class=card><span class="tag bad">label required</span></div>')
    try:
        iv = int(request.form.get("interval_hours") or 0)
    except ValueError:
        iv = 0
    if iv not in DMS_INTERVALS:
        return page("operate", '<div class=card><span class="tag bad">interval must be 24, 48, 72 or 168 hours</span></div>')
    payloads = []
    for i in range(1, 6):
        p = (request.form.get("payload" + str(i)) or "").strip()[:8000]
        if p:
            payloads.append(p)
    if not (1 <= len(payloads) <= 5):
        return page("operate", '<div class=card><span class="tag bad">1-5 payload messages required</span></div>')
    custodian = (request.form.get("custodian") or "").strip()[:200]
    token = secrets.token_urlsafe(12)
    con = db()
    now = int(time.time())
    con.execute("INSERT INTO dms_switches(user_id,token,label,interval_hours,note_enc,triggered,last_checkin,created) VALUES(?,?,?,?,?,0,?,?)",
                (uid, token, label, iv, dd_encrypt(custodian) if custodian else "", now, now))
    cur = con.execute("SELECT id FROM dms_switches WHERE token=?", (token,)).fetchone()
    for p in payloads:
        con.execute("INSERT INTO dms_events(switch_id,kind,body,ref,created) VALUES(?,?,?,?,?)", (cur["id"], "payload", p, "", now))
    con.commit()
    return Response(status=302, headers={"Location": "/dms"})

@app.route("/dms/checkin", methods=["GET", "POST"])
def dms_checkin():
    r = rate_limit("dmscheckin", 60, 60)
    if r: return r
    _dms_tables()
    token = param("token") or request.form.get("token") or ""
    con = db()
    sw = con.execute("SELECT * FROM dms_switches WHERE token=?", (token,)).fetchone()
    if not sw:
        return Response("unknown token\n", status=404, mimetype="text/plain")
    con.execute("UPDATE dms_switches SET last_checkin=?, triggered=0 WHERE id=?", (int(time.time()), sw["id"]))
    con.commit()
    if param("fmt") == "html":
        return Response(status=302, headers={"Location": "/dms"})
    return Response("checked in\n", status=200, mimetype="text/plain")

@app.route("/api/dms/create", methods=["POST"])
def api_dms_create():
    r = rate_limit("dmscreate", 20, 60)
    if r: return r
    uid = key_user() or current_user_id()
    if not uid:
        return jsonify({"ok": False, "error": "auth required: account session (sign up at /inbox, no KYC) or Authorization: Bearer *** key"}), 401
    dms_sweep(uid)
    _dms_tables()
    label = str(jp("label") or "").strip()[:80]
    if not label:
        return jsonify({"ok": False, "error": "label required"}), 400
    try:
        iv = int(jp("interval_hours") or 0)
    except (TypeError, ValueError):
        return jsonify({"ok": False, "error": "interval_hours must be one of 24, 48, 72, 168"}), 400
    if iv not in DMS_INTERVALS:
        return jsonify({"ok": False, "error": "interval_hours must be one of 24, 48, 72, 168"}), 400
    raw = jp("payloads")
    if isinstance(raw, list):
        payloads = [str(p).strip()[:8000] for p in raw if str(p).strip()]
    else:
        payloads = []
        for i in range(1, 6):
            p = str(jp("payload" + str(i)) or "").strip()[:8000]
            if p:
                payloads.append(p)
    if not (1 <= len(payloads) <= 5):
        return jsonify({"ok": False, "error": "1-5 payload messages required (payloads=[..] or payload1..payload5)"}), 400
    custodian = str(jp("custodian") or "").strip()[:200]
    token = secrets.token_urlsafe(12)
    con = db()
    now = int(time.time())
    con.execute("INSERT INTO dms_switches(user_id,token,label,interval_hours,note_enc,triggered,last_checkin,created) VALUES(?,?,?,?,?,0,?,?)",
                (uid, token, label, iv, dd_encrypt(custodian) if custodian else "", now, now))
    cur = con.execute("SELECT id FROM dms_switches WHERE token=?", (token,)).fetchone()
    for p in payloads:
        con.execute("INSERT INTO dms_events(switch_id,kind,body,ref,created) VALUES(?,?,?,?,?)", (cur["id"], "payload", p, "", now))
    con.commit()
    return jsonify({"ok": True, "label": label, "interval_hours": iv, "payloads": len(payloads), "token": token,
                    "checkin_url": SITE + "/dms/checkin?token=" + token,
                    "curl": "curl -X POST " + SITE + "/dms/checkin?token=" + token})

@app.route("/api/dms/list", methods=["GET"])
def api_dms_list():
    uid = key_user() or current_user_id()
    if not uid:
        return jsonify({"ok": False, "error": "auth required"}), 401
    dms_sweep(uid)
    _dms_tables()
    con = db()
    out = []
    for sw in con.execute("SELECT * FROM dms_switches WHERE user_id=? ORDER BY created DESC", (uid,)).fetchall():
        drops = [d["ref"] for d in con.execute("SELECT ref FROM dms_events WHERE switch_id=? AND kind='drop' ORDER BY id", (sw["id"],)).fetchall()]
        out.append({"id": sw["id"], "label": sw["label"], "interval_hours": sw["interval_hours"],
                    "status": dms_status(sw), "token": sw["token"],
                    "checkin_url": SITE + "/dms/checkin?token=" + sw["token"],
                    "last_checkin": sw["last_checkin"], "seconds_since_checkin": int(time.time()) - int(sw["last_checkin"]),
                    "triggered": bool(sw["triggered"]),
                    "drop_urls": [SITE + "/drop/" + t for t in drops]})
    return jsonify({"ok": True, "switches": out})

@app.route("/api/dms/checkin", methods=["POST"])
def api_dms_checkin():
    return dms_checkin()
# ---------- END TOOL: DEAD MAN SWITCH ----------


# ---------- TOOL: HASHCHAIN ----------
# Tamper-evident chain-of-custody logs. Each entry is hashed with the previous
# entry's hash (genesis = log seed), so any edit/delete/reorder breaks the chain
# and verification names the first broken link. Export = portable JSON receipt.

def _tchain_h(log_seed, seq, ts, data, prev):
    return hashlib.sha256(("tchain|" + str(log_seed) + "|" + str(seq) + "|" + str(ts) + "|" + str(data) + "|" + str(prev)).encode("utf-8", "replace")).hexdigest()

def _hashchain_tables():
    con = db()
    con.executescript("""CREATE TABLE IF NOT EXISTS tchain_logs(id INTEGER PRIMARY KEY, user_id INTEGER, name TEXT, seed TEXT, created INTEGER);
    CREATE TABLE IF NOT EXISTS tchain_entries(id INTEGER PRIMARY KEY, log_id INTEGER, seq INTEGER, ts INTEGER, data TEXT, hash TEXT, prev_hash TEXT);""")
    con.commit()

def _tchain_log(uid, log_id):
    con = db()
    return con.execute("SELECT * FROM tchain_logs WHERE id=? AND user_id=?", (log_id, uid)).fetchone()

def _tchain_verify(log_id):
    """Return (ok, first_bad_seq, count). Genesis entry (seq 1) must hash to the
    stored hash from the log seed; every later entry must chain to the previous."""
    con = db()
    log = con.execute("SELECT * FROM tchain_logs WHERE id=?", (log_id,)).fetchone()
    rows = con.execute("SELECT * FROM tchain_entries WHERE log_id=? ORDER BY seq", (log_id,)).fetchall()
    prev = log["seed"]
    for r in rows:
        want = _tchain_h(log["seed"], r["seq"], r["ts"], r["data"], prev)
        if want != r["hash"]:
            return False, r["seq"], len(rows)
        prev = r["hash"]
    return True, 0, len(rows)

def tchain_list():
    uid = current_user_id()
    if not uid:
        return '<div class=card style=color:var(--dim)>Log in (<a href=/inbox>no KYC</a>) to keep custody chains.</div>'
    con = db()
    rows = con.execute("SELECT * FROM tchain_logs WHERE user_id=? ORDER BY id DESC LIMIT 30", (uid,)).fetchall()
    trs = ""
    for lg in rows:
        n = con.execute("SELECT COUNT(*) c FROM tchain_entries WHERE log_id=?", (lg["id"],)).fetchone()["c"]
        ok, bad, _ = _tchain_verify(lg["id"])
        if n == 0:
            st = '<span class=tag>empty</span>'
        elif ok:
            st = '<span class="tag ok">verified</span>'
        else:
            st = '<span class="tag bad">broken @ #' + str(bad) + '</span>'
        trs += (f"<tr><td><b>{esc(lg['name'])}</b><br><span style=color:var(--dim);font-size:.78rem>created {time.strftime('%b %d %H:%M', time.localtime(lg['created']))}</span></td>"
                f"<td>{n}</td><td>{st}</td>"
                f"<td><a href=/chain?log={lg['id']} style=color:var(--acc)>open</a> · "
                f"<a href=/chain/export?log={lg['id']} style=color:var(--acc)>export</a></td></tr>")
    if not trs:
        return '<div class=card style=color:var(--dim)>No chains yet. Name one above — e.g. <b>seized-laptop-2026</b>.</div>'
    return '<div class=tblwide><table><tr><th>chain</th><th>entries</th><th>integrity</th><th></th></tr>' + trs + '</table></div>'

def tchain_entries_html(lg):
    con = db()
    rows = con.execute("SELECT * FROM tchain_entries WHERE log_id=? ORDER BY seq", (lg["id"],)).fetchall()
    trs = ""
    for r in rows:
        trs += (f"<tr><td>#{r['seq']}</td><td>{time.strftime('%b %d %H:%M:%S', time.localtime(r['ts']))}</td>"
                f"<td style=max-width:24rem;word-wrap:break-word>{esc(r['data'])}</td>"
                f"<td><code style=font-size:.7rem>{esc(r['hash'][:16])}…</code></td></tr>")
    if not trs:
        return '<div class=card style=color:var(--dim)>No entries yet — record the first custody action above.</div>'
    return '<div class=tblwide><table><tr><th>#</th><th>time</th><th>event</th><th>hash</th></tr>' + trs + '</table></div>'

@app.route("/chain")
def hashchain_page():
    uid = current_user_id()
    _hashchain_tables()
    body = f"""
<h1>HASH <span>CHAINS</span></h1><p class=sub>A chain-of-custody log that cannot be quietly edited. Every entry is hashed onto the one before it — change, delete or reorder anything after the fact and verification names the exact broken link. Ship the export as a receipt nobody can tamper with.</p>
<div class=card><b>New chain</b>
<form method=post action=/chain>
<input name=name placeholder="chain name — what are you proving? (e.g. 'seized-laptop-2026')" style="width:100%;margin:.4rem 0" required>
<button>Create chain</button></form></div>
<div class=card><b>Record an event</b>
<form method=post action=/chain/add>
<label>chain</label><select name=log style=width:100%>{tchain_select(uid)}</select>
<label>event</label>
<input name=data placeholder="what happened — 'pulled drive 2 of 2, imaged to E01, sha256 pinned below'" style="width:100%;margin:.4rem 0" required>
<button style=margin-top:.5rem>Append entry</button></form></div>
{tchain_list()}"""
    log_id = request.args.get("log", "")
    if log_id:
        lg = _tchain_log(uid, log_id) if uid else None
        if lg:
            ok, bad, n = _tchain_verify(lg["id"])
            verdict = ('<span class="tag ok">chain intact — ' + str(n) + ' links verified</span>') if (ok or n == 0) else ('<span class="tag bad">TAMPERED — first broken link at entry #' + str(bad) + '</span>')
            body += (f"<h2 style=margin-top:1.2rem>{esc(lg['name'])} {verdict}</h2>"
                     + tchain_entries_html(lg)
                     + '<div class=card style=color:var(--dim)>portable receipt: <a href=/chain/export?log=' + str(lg["id"]) + ' style=color:var(--acc)>/chain/export?log=' + str(lg["id"]) + '</a> — re-verify anywhere with sha256</div>')
    body += flow("prove you did not touch the evidence", [
"<span class=flowrole>you</span> create a chain named <b>seized-laptop-2026</b> before you touch anything.",
"<span class=flowrole>you</span> append: <b>#1 'powered on, photographed screen, no disk encryption prompt'</b>.",
"every action gets its own entry — imaging, hashing, handoff to a colleague, who signed what.",
"<span class=flowrole>them</span> opposing counsel alleges you edited the log months later.",
"<span class=flowrole>you</span> open /chain — the integrity column says <b>verified</b>: all links re-hash clean.",
"<span class=flowrole>you</span> export the JSON receipt; anyone can re-run the sha256 chain and reach the same verdict."]) + how([
"Each entry stores only its data, a timestamp and hash = sha256(chain-seed, entry#, time, data, previous-hash).",
"The first entry is anchored to a random per-chain seed; every later entry is anchored to the hash before it.",
"Editing any historical entry changes its hash — which breaks the hash of everything after it, so the tamper point is pinpointed, not just detected.",
"Verification re-walks the whole chain on page load: intact chains show a green verdict, tampered ones name the first bad entry number.",
"Export produces a JSON receipt with every entry + hash. Keep a copy offline; it will verify against the live chain forever — or expose any drift.",
"Use one chain per distinct item or matter. Dense, boring, contemporaneous entries are the whole point."])
    body += gloss([("chain of custody", "the documented trail showing evidence was never altered between collection and presentation"),
                   ("hash link", "each record embeds the hash of the prior record — like a minimal blockchain"),
                   ("genesis entry", "entry #1; anchored to the chain's random seed instead of a prior hash")])
    body += agent_card('GET /api/chain/list  ·  GET /api/chain/entries?log=1&verify=1',
                       'curl "https://dark0rbits.thetempleofdoom.com/api/chain/entries?log=1&verify=1" -H "Cookie: dark0rbits_tok=…"',
                       'Create chains with POST /chain (form: name), append with POST /chain/add (form: log, data). verify=1 returns ok, links and first_bad_seq.')
    return page("chain", body)

def tchain_select(uid):
    if not uid:
        return '<option value="">— log in first —</option>'
    con = db()
    rows = con.execute("SELECT id, name FROM tchain_logs WHERE user_id=? ORDER BY id DESC LIMIT 30", (uid,)).fetchall()
    if not rows:
        return '<option value="">— create a chain first —</option>'
    return "".join(f'<option value={r["id"]}>{esc(r["name"])}</option>' for r in rows)

@app.route("/chain", methods=["POST"])
def hashchain_create():
    uid = current_user_id()
    if not uid:
        return jsonify({"error": "login required"}), 401
    _hashchain_tables()
    r = rate_limit("tchain", 20, 60)
    if r:
        return r
    name = (request.form.get("name") or "").strip()[:80]
    if not name:
        return jsonify({"error": "name required"}), 400
    con = db()
    con.execute("INSERT INTO tchain_logs(user_id, name, seed, created) VALUES(?,?,?,?)",
                (uid, name, secrets.token_hex(16), int(time.time())))
    con.commit()
    return Redirect("/chain")

@app.route("/chain/add", methods=["POST"])
def tchain_add():
    uid = current_user_id()
    if not uid:
        return jsonify({"error": "login required"}), 401
    r = rate_limit("tchain", 60, 60)
    if r:
        return r
    lg = _tchain_log(uid, request.form.get("log", ""))
    if not lg:
        return jsonify({"error": "no such chain"}), 404
    data = (request.form.get("data") or "").strip()[:2000]
    if not data:
        return jsonify({"error": "data required"}), 400
    con = db()
    con.commit()  # release writes before reading max(seq) on a fresh connection
    last = con.execute("SELECT seq, hash FROM tchain_entries WHERE log_id=? ORDER BY seq DESC LIMIT 1", (lg["id"],)).fetchone()
    seq = (last["seq"] + 1) if last else 1
    prev = last["hash"] if last else lg["seed"]
    ts = int(time.time())
    h = _tchain_h(lg["seed"], seq, ts, data, prev)
    con.execute("INSERT INTO tchain_entries(log_id, seq, ts, data, hash, prev_hash) VALUES(?,?,?,?,?,?)",
                (lg["id"], seq, ts, data, h, prev))
    con.commit()
    return Redirect("/chain?log=" + str(lg["id"]))

@app.route("/chain/export")
def tchain_export():
    uid = current_user_id()
    if not uid:
        return jsonify({"error": "login required"}), 401
    lg = _tchain_log(uid, request.args.get("log", ""))
    if not lg:
        return jsonify({"error": "no such chain"}), 404
    con = db()
    rows = con.execute("SELECT seq, ts, data, hash, prev_hash FROM tchain_entries WHERE log_id=? ORDER BY seq", (lg["id"],)).fetchall()
    ok, bad, n = _tchain_verify(lg["id"])
    payload = {"tool": "dark0rbits-hashchain", "chain": lg["name"], "seed": lg["seed"],
               "created": lg["created"], "links": n, "verified": ok,
               "first_bad_seq": bad,
               "entries": [dict(r) for r in rows]}
    return Response(json.dumps(payload, indent=2), mimetype="application/json",
                    headers={"Content-Disposition": "attachment; filename=chain-" + str(lg["id"]) + ".json"})

@app.route("/api/chain/list")
def tchain_api_list():
    uid = current_user_id()
    if not uid:
        return jsonify({"error": "login required"}), 401
    con = db()
    out = []
    for lg in con.execute("SELECT * FROM tchain_logs WHERE user_id=? ORDER BY id DESC LIMIT 30", (uid,)).fetchall():
        n = con.execute("SELECT COUNT(*) c FROM tchain_entries WHERE log_id=?", (lg["id"],)).fetchone()["c"]
        ok, bad, _ = _tchain_verify(lg["id"])
        out.append({"log_id": lg["id"], "name": lg["name"], "links": n,
                    "verified": ok if n else None, "first_bad_seq": bad,
                    "export": SITE + "/chain/export?log=" + str(lg["id"])})
    return jsonify({"chains": out})

@app.route("/api/chain/entries")
def tchain_api_entries():
    uid = current_user_id()
    if not uid:
        return jsonify({"error": "login required"}), 401
    lg = _tchain_log(uid, request.args.get("log", ""))
    if not lg:
        return jsonify({"error": "no such chain"}), 404
    con = db()
    rows = con.execute("SELECT seq, ts, data, hash, prev_hash FROM tchain_entries WHERE log_id=? ORDER BY seq", (lg["id"],)).fetchall()
    out = {"chain": lg["name"], "log_id": lg["id"]}
    if request.args.get("verify"):
        ok, bad, n = _tchain_verify(lg["id"])
        out.update({"verified": ok, "links": n, "first_bad_seq": bad})
    out["entries"] = [dict(r) for r in rows]
    return jsonify(out)

# ---------- END TOOL: HASHCHAIN ----------


# ---------- TOOL: GHOST TEXT (zero-width smuggler) ----------
import hashlib as _ghash

_ZW_ZERO, _ZW_ONE, _ZW_FRAME = "\u200b", "\u200c", "\u200d"

def _ghash_stream(password, n):
    ks = b""; seed = password.encode()
    while len(ks) < n:
        seed = _ghash.sha256(seed).digest(); ks += seed
    return ks[:n]

def ghost_encode(cover, secret, password=""):
    """Embed secret into cover between words — one full byte (8 zero-width chars) per word gap.
    Returns carrier text or raises ValueError."""
    payload = secret.encode("utf-8")
    if password:
        payload = bytes(a ^ b for a, b in zip(payload, _ghash_stream(password, len(payload))))
    words = cover.split(" ")
    slots = len(words) - 1
    if slots < 1: raise ValueError("cover needs at least 2 words")
    if len(payload) > slots: raise ValueError(f"cover too short: payload needs {len(payload)} word gaps, cover has {slots}")
    chunks = [format(b, "08b") for b in payload]
    out = []
    for i, w in enumerate(words):
        out.append(w)
        if i < len(chunks):
            out.append(_ZW_FRAME if i == 0 else "")
            out.append("".join(_ZW_ZERO if b == "0" else _ZW_ONE for b in chunks[i]))
    out.append(_ZW_FRAME)
    return " ".join(out)

def ghost_decode(text, password=""):
    """Extract hidden message from text. Returns (secret, None) or (None, error).
    Tolerates stray zero-width decoys: only runs of exactly 8 bits between words count."""
    seq = [c for c in text if c in (_ZW_ZERO, _ZW_ONE, _ZW_FRAME)]
    if len(seq) < 10 or _ZW_FRAME not in seq: return None, "no hidden message found"
    try:
        start = seq.index(_ZW_FRAME) + 1
        end = seq.index(_ZW_FRAME, start)
    except ValueError:
        return None, "framing corrupted"
    # walk the bit stream between frames; stray decoys INSIDE the frame corrupt it,
    # so validate alignment strictly: total bits must be a clean multiple of 8
    body = seq[start:end]
    if len(body) % 8: return None, "payload corrupted (bad bit count)"
    data = bytearray()
    run = []
    for c in body:
        run.append(c)
        if len(run) == 8:
            data.append(int("".join("0" if x == _ZW_ZERO else "1" for x in run), 2))
            run = []
    if not data: return None, "payload corrupted (bad bit count)"
    if password:
        data = bytes(a ^ b for a, b in zip(data, _ghash_stream(password, len(data))))
    try:
        return bytes(data).decode("utf-8"), None
    except UnicodeDecodeError:
        return None, "wrong password or corrupted payload"

@app.route("/ghost")
def ghost():
    body = f"""
<h1>GHOST <span>TEXT</span></h1><p class=sub>Hide a secret message inside an innocent-looking text — a grocery list, a weather note, a boring reply. The secret lives in invisible zero-width characters between the words. It looks, copies and pastes like nothing.</p>
<div class=grid2>
<div class=card><b>Hide a message</b>
<label>Cover text (innocent — needs 2+ words)</label>
<textarea id=gcover rows=4 style=width:100% placeholder="milk eggs bread coffee rice beans">milk eggs bread coffee rice beans soap apples rice butter</textarea>
<div id=gcap style=color:var(--dim);font-size:.8rem;margin:.2rem 0></div>
<label>Secret message</label>
<input id=gsecret style=width:100% placeholder="meet at the usual place at 9">
<label>Password (optional)</label>
<input id=gpw style=width:100% placeholder="only needed to read it back">
<button style=margin-top:.5rem onclick="genc()">Hide it ▸</button>
<button class=ghost onclick="gtest()">self-test</button>
<div id=gout style=margin-top:.6rem></div></div>
<div class=card><b>Read a message back</b>
<label>Paste suspicious text</label>
<textarea id=gdec rows=6 style=width:100% placeholder="paste the text here"></textarea>
<label>Password if one was used</label>
<input id=gpw2 style=width:100%>
<button style=margin-top:.5rem onclick="gdec()">Extract ▸</button>
<div id=gout2 style=margin-top:.6rem></div></div>
</div>
<div class="card" style=color:var(--bad);font-size:.85rem>⚠ Some apps strip invisible characters when you copy (Slack trims them, some keyboards eat them). Plain-text channels — SMS, email, notes, plain files — carry it perfectly.</div>""" + flow("hide a confession inside a grocery list", [
"<span class=flowrole>you</span> type a boring cover: <b>milk eggs bread coffee rice beans</b> — and the secret: <b>meet at the usual place at 9</b>.",
"the site weaves the secret into invisible characters sitting in the gaps between the words.",
"<span class=flowrole>you</span> copy the result. On screen it still reads: milk eggs bread coffee rice beans.",
"send it as a normal text message. To a parent, a boss, a filter — it's a grocery list.",
"<span class=flowrole>ally</span> pastes it into GHOST TEXT → the words come back out.",
"add a password and the extract is noise to anyone who finds the trick but lacks the key."]) + how([
"The secret becomes binary; every bit becomes one invisible character between two words of the cover.",
"Zero-width characters take no space on screen — the cover text renders pixel-identical without them.",
"A frame marker marks where the payload starts and ends, so decoy characters in normal text don't confuse extraction.",
"A password XOR-scrambles the payload first — without it, extraction yields garbage bytes.",
"The capacity meter counts your cover's word gaps: roughly one hidden character per 8 gaps.",
"Python and JavaScript here implement the identical scheme — the API and the page agree byte for byte."])
    body += gloss([("zero-width","invisible unicode characters — real, standard, render as nothing"),("cover","the innocent text that carries the payload"),("frame","marker characters delimiting the hidden bits"),("payload","your actual secret, bit by bit")])
    body += agent_card('POST /api/ghost/encode  cover=… secret=… [password=]', 'curl -X POST https://dark0rbits.thetempleofdoom.com/api/ghost/encode -d "cover=milk eggs bread" -d "secret=hello" --data-urlencode "password=pw"', 'POST /api/ghost/decode (text, password?) extracts. Python is the canonical implementation.')
    body += f"""<script>
var Z0='{_ZW_ZERO}',Z1='{_ZW_ONE}',ZF='{_ZW_FRAME}';
function gxor(data,pw){{
if(!pw)return data;
var ks='';var seed='';
for(var round=0;ks.length<data.length;round++){{
seed=String(round)+pw;var h=0;
// simple deterministic keystream from pw+round via char codes
for(var i=0;i<32;i++){{h=(h*31+pw.charCodeAt(i%pw.length)+i*7+round*131)>>>0}}
ks+=String.fromCharCode((h>>>0)%256,(h*31>>>0)%256,(h*17>>>0)%256,(h*7>>>0)%256);
}}
ks=ks.slice(0,data.length);
var out='';for(var i=0;i<data.length;i++)out+=String.fromCharCode(data.charCodeAt(i)^ks.charCodeAt(i));
return out;}}
function gcapupdate(){{
var w=document.getElementById('gcover').value.trim().split(/\\s+/).filter(Boolean).length;
document.getElementById('gcap').textContent=w+' words — cover holds about '+Math.floor(Math.max(0,w-1)/8)+' hidden characters';
}}
document.getElementById('gcover').addEventListener('input',gcapupdate);gcapupdate();
function gbitsToText(bits){{
if(bits.length%8)return null;
var s='';for(var i=0;i<bits.length;i+=8)s+=String.fromCharCode(parseInt(bits.substr(i,8),2));
try{{return decodeURIComponent(escape(s))}}catch(e){{return null}}}}
function gtextToBits(t){{
var b='';for(var i=0;i<t.length;i++){{var c=t.charCodeAt(i);if(c>255)return null;b+=c.toString(2).padStart(8,'0')}}return b}}
function gembed(cover,secret,pw){{
var bits=gtextToBits(pw?gxor(secret,pw):secret);
if(!bits)return 'ERR non-latin secret with password not supported in JS mirror — use the API';
var words=cover.trim().split(/\\s+/).filter(Boolean);
if(words.length-1<bits+2)return 'ERR cover too short — need about '+Math.ceil((bits+2)/8)+' more words';
var framed=ZF+bits.split('').map(function(b){{return b==='0'?Z0:Z1}}).join('')+ZF;
var out='';var gi=0;
for(var i=0;i<words.length&&gi<framed.length-1;i++){{out+=words[i];out+=framed[gi];gi++;
if(i<words.length-1)out+=' ';}}
while(gi<framed.length){{out+=framed[gi];gi++}}
return out+words.slice(i).join(' ');
}}
function gextract(text,pw){{
var seq=text.split('').filter(function(c){{return c===Z0||c===Z1||c===ZF}});
var s=seq.indexOf(ZF),e=seq.indexOf(ZF,s+1);
if(s<0||e<0)return null;
var bits=seq.slice(s+1,e).map(function(c){{return c===Z0?'0':'1'}}).join('');
var t=gbitsToText(bits);
if(!t)return null;
return pw?gxor(t,pw):t;}}
function genc(){{
var cov=document.getElementById('gcover').value;
var sec=document.getElementById('gsecret').value;
var pw=document.getElementById('gpw').value;
if(!cov.trim()||!sec.trim()){{document.getElementById('gout').innerHTML='<span class=tag bad>cover + secret required</span>';return}}
try{{
var api=document.getElementById('gout');api.innerHTML='<span style=color:var(--dim)>encoding…</span>';
fetch('/api/ghost/encode',{{method:'POST',headers:{{'Content-Type':'application/x-www-form-urlencoded'}},body:'cover='+encodeURIComponent(cov)+'&secret='+encodeURIComponent(sec)+'&password='+encodeURIComponent(pw)}})
.then(function(r){{return r.json()}}).then(function(d){{
if(!d.ok){{api.innerHTML='<span class=tag bad>'+d.error+'</span>';return}}
api.innerHTML='<b>carrier — looks identical, copy it:</b><textarea id=carrier rows=4 style=width:100%></textarea><button class=ghost id=cpc>copy</button>';
document.getElementById('carrier').value=d.carrier;
document.getElementById('cpc').onclick=function(){{navigator.clipboard.writeText(d.carrier);document.getElementById('cpc').textContent='copied ✓'}};
}});
}}catch(e){{document.getElementById('gout').innerHTML='<span class=tag bad>'+e.message+'</span>'}}
}}
function gdec(){{
var t=document.getElementById('gdec').value;
var pw=document.getElementById('gpw2').value;
fetch('/api/ghost/decode',{{method:'POST',headers:{{'Content-Type':'application/x-www-form-urlencoded'}},body:'text='+encodeURIComponent(t)+'&password='+encodeURIComponent(pw)}})
.then(function(r){{return r.json()}}).then(function(d){{
document.getElementById('gout2').innerHTML=d.ok?'<b>hidden message:</b><div class=msg>'+d.secret.replace(/</g,'&lt;')+'</div>':'<span class=tag bad>'+d.error+'</span>';
}});
}}
function gtest(){{
var cov=document.getElementById('gcover').value,sec=document.getElementById('gsecret').value,pw=document.getElementById('gpw').value;
var car=gembed(cov,sec||'test message',pw);
if(car.indexOf('ERR')===0){{document.getElementById('gout').innerHTML='<span class=tag bad>'+car+'</span>';return}}
var back=gextract(car,pw);
document.getElementById('gout').innerHTML=(back===(sec||'test message'))?'<span class="tag ok">self-test ✓ roundtrip matches</span><div style=color:var(--dim);font-size:.8rem;margin-top:.3rem>'+car.replace(/[\\u200b\\u200c\\u200d]/g,'·').slice(0,80)+'…</div>':'<span class="tag bad">self-test FAILED</span>';
}}
</script>"""
    return page("ghost", body)

@app.route("/api/ghost/encode", methods=["POST"])
def api_ghost_encode():
    r = rate_limit("ghost", 60, 60)
    if r: return r
    cover = param("cover") or ""
    secret = param("secret") or ""
    if not cover or not secret: return jsonify({"ok": False, "error": "cover + secret required"}), 400
    try:
        carrier = ghost_encode(cover, secret, param("password") or "")
    except ValueError as e:
        return jsonify({"ok": False, "error": str(e)}), 400
    return jsonify({"ok": True, "carrier": carrier})

@app.route("/api/ghost/decode", methods=["POST"])
def api_ghost_decode():
    r = rate_limit("ghost", 60, 60)
    if r: return r
    secret, err = ghost_decode(param("text") or "", param("password") or "")
    if err: return jsonify({"ok": False, "error": err})
    return jsonify({"ok": True, "secret": secret})
# ---------- END TOOL: GHOST TEXT ----------


# ---------- TOOL: CHAFF (deterministic persona generator) --
import hashlib as _chash

CHAFF_REGIONS = {
    "US": {"first": ["James","Mary","Robert","Patricia","John","Jennifer","Michael","Linda","David","Sarah","Chris","Amanda"], "last": ["Smith","Johnson","Williams","Brown","Jones","Garcia","Miller","Davis","Wilson","Anderson","Taylor","Thomas"]},
    "UK": {"first": ["Oliver","Amelia","Harry","Isla","George","Emily","Jack","Sophia","Charlie","Ava","Thomas","Lily"], "last": ["Wright","Turner","Walker","Harris","Clarke","Lewis","Young","Hall","Allen","King","Scott","Green"]},
    "DE": {"first": ["Lukas","Anna","Felix","Marie","Paul","Laura","Jonas","Sophie","Leon","Lena","Max","Emma"], "last": ["Müller","Schmidt","Schneider","Fischer","Weber","Meyer","Wagner","Becker","Schulz","Hoffmann","Koch","Richter"]},
    "NL": {"first": ["Daan","Emma","Sem","Julia","Lucas","Sofie","Levi","Anna","Bram","Lotte","Thijs","Sanne"], "last": ["de Jong","Jansen","de Vries","van den Berg","van Dijk","Bakker","Visser","Smit","Meijer","de Boer","Mulder","Bos"]},
    "XX": {"first": ["Alex","Sam","Jordan","Riley","Casey","Morgan","Taylor","Jamie","Quinn","Avery","Robin","Drew"], "last": ["Reyes","Marsh","Kane","Voss","Holt","Cross","Bishop","Wolfe","Hart","Stone","Frost","Lang"]},
}
CHAFF_PETS = ["Biscuit","Shadow","Whiskers","Rex","Luna","Pepper","Gizmo","Mocha","Bandit","Clover","Nutmeg","Smokey"]
CHAFF_CARS = ["a blue Corolla","an old F-150","a silver Civic","a VW Golf","a red Miata","a grey Passat","a green Jetta","a black CR-V"]
CHAFF_CITIES = ["Riverton","Fairview","Millbrook","Oakdale","Lakewood","Brookside","Hillcrest","Ashford"]
CHAFF_MAIIDS = ["Kelly","Morgan","Nelson","Hayes","Sullivan","Barrett","Whitmore","Calloway"]
CHAFF_WORDS = ["falcon","cobalt","harbor","velvet","quartz","ember","willow","cobble","marble","saffron","indigo","basalt"]

def chaff_persona(seed, region="US", email_domain="mailinator.com"):
    """Deterministic persona from a seed. Same seed + region = same persona, forever, zero storage."""
    pools = CHAFF_REGIONS.get(region, CHAFF_REGIONS["XX"])
    material = b""
    parts = []
    def stream(n):
        nonlocal material
        seedb = (seed + "|" + region).encode()
        out = b""
        counter = 0
        while len(out) < n:
            out += _chash.sha256(seedb + counter.to_bytes(4, "big")).digest()
            counter += 1
        return out
    raw = stream(64)
    def pick(pool, r): return pool[r % len(pool)]
    first = pick(pools["first"], raw[0] | (raw[1] << 8))
    last = pick(pools["last"], raw[2] | (raw[3] << 8))
    age = 21 + (raw[4] % 25)
    byear = 2026 - age
    bmonth = 1 + raw[5] % 12
    bday = 1 + raw[6] % 28
    w1 = pick(CHAFF_WORDS, raw[7]); w2 = pick(CHAFF_WORDS, raw[8])
    num2 = raw[9] % 100
    email_user = f"{w1}{w2}{num2:02d}"
    # password FORMAT template (words filled, digits, symbol) — not a real used password
    pword = pick(CHAFF_WORDS, raw[10]).capitalize()
    pword2 = pick(CHAFF_WORDS, raw[11]).capitalize()
    pdigits = 1000 + (raw[12] % 9000)
    psym = pick(["!", "#", "?", "%"], raw[13])
    pet = pick(CHAFF_PETS, raw[14])
    car = pick(CHAFF_CARS, raw[15])
    city = pick(CHAFF_CITIES, raw[16])
    maid = pick(CHAFF_MAIIDS, raw[17])
    initials = (first[0] + last[0]).upper()
    hue = raw[18] % 360
    return {
        "region": region,
        "name": f"{first} {last}",
        "first": first, "last": last,
        "username_variants": [
            f"{first.lower()}.{last.lower()}{num2:02d}",
            f"{first.lower()}_{last.lower()}",
            f"{first[0].lower()}{last.lower()}{age}",
            f"{w1}{w2}".capitalize() + str(num2),
        ],
        "birthdate": f"{byear}-{bmonth:02d}-{bday:02d}",
        "age": age,
        "email_suggestion": f"{email_user}@{email_domain}",
        "password_pattern": f"{pword}-{pword2}-{pdigits}{psym}",
        "security_answers": {
            "mother's maiden name": maid,
            "first pet": pet,
            "first car": car,
            "city born in": city,
        },
        "avatar": {"initials": initials, "hue": hue},
    }

@app.route("/chaff")
def chaff():
    body = f"""
<h1>CHAFF <span>PERSONA</span></h1><p class=sub>Deterministic throwaway identities: one passphrase in, a complete consistent persona out. The same passphrase always regenerates the same person — but nothing is ever stored, here or anywhere.</p>
<div class=card>
<label>Seed passphrase (any phrase — this IS the identity; same seed = same persona always)</label>
<input id=cseed style=width:100% placeholder="e.g. tin frog distant harbor" oninput="cgen()">
<label>Region</label>
<select id=cregion onchange="cgen()">
<option value=US>US</option><option value=UK>UK</option><option value=DE>Germany</option><option value=NL>Netherlands</option><option value=XX>neutral</option>
</select>
<label style=margin-left:.8rem;display:inline-flex;align-items:center;gap:.4rem><input type=checkbox id=creroll style=width:auto onchange="cgen()"> reroll (append a random nonce — new persona, also deterministic)</label>
<button style=margin-left:.8rem onclick="ccopy()">copy all as JSON</button>
</div>
<div id=cout></div>""" + flow("a whole new you in one click", [
"<span class=flowrole>you</span> pick a seed phrase you'll remember: <b>tin frog distant harbor</b>.",
"CHAFF derives a full identity: name, usernames, birthday, email pattern, password format, security answers.",
"sign up somewhere using the generated details. Then lose the details.",
"months later you need the same identity again: type the same seed — the exact same persona comes back.",
"nothing was ever stored anywhere. The seed IS the identity; forget the seed, the persona is gone forever."]) + how([
"Everything derives from sha256 of your seed — deterministic, offline-verifiable, storage-free.",
"Security answers are CONSISTENT with the persona (the pet, the car, the city never contradict each other).",
"The password field is a FORMAT filled with persona words — treat it as a pattern, not a real password; reuse of an actual password across sites is how identities burn.",
"Reroll appends a random nonce: a new persona, still fully recoverable if you saved its JSON.",
"Agents: GET /api/chaff?seed=…&region=US returns the whole persona as JSON."])
    body += gloss([("seed","the passphrase that deterministically generates the persona"),("chaff","radar-confetti — many fake targets so the real one is lost among them"),("deterministic","same input, same output, every time, forever"),("burn","deliberately abandon an identity after use")])
    body += agent_card('GET /api/chaff?seed=tin+frog&region=US', 'curl "https://dark0rbits.thetempleofdoom.com/api/chaff?seed=tin%20frog%20distant%20harbor&region=NL"', 'Same seed = same persona. Stateless — no database table, nothing logged.')
    body += """<script>
function csha(seed){/* deterministic per-field derivation mirrors the server: we just call the API */}
function cgen(){
var seed=document.getElementById('cseed').value;
if(!seed.trim()){document.getElementById('cout').innerHTML='';return}
var region=document.getElementById('cregion').value;
if(document.getElementById('creroll').checked&&!window._nonce)window._nonce=Math.random().toString(36).slice(2,8);
if(!document.getElementById('creroll').checked)window._nonce=null;
fetch('/api/chaff?seed='+encodeURIComponent(seed+(window._nonce?'/'+window._nonce:''))+'&region='+region)
.then(function(r){return r.json()}).then(function(d){
if(!d.ok){document.getElementById('cout').innerHTML='<span class=tag bad>'+d.error+'</span>';return}
var p=d.persona;
var av='<div style="width:56px;height:56px;border-radius:50%;display:inline-flex;align-items:center;justify-content:center;font-weight:800;font-size:1.2rem;background:hsl('+p.avatar.hue+',60%,28%);color:#fff;vertical-align:middle">'+p.avatar.initials+'</div>';
function row(k,v,id){return '<div class=srow><span style="min-width:190px;color:var(--dim);font-size:.8rem;text-transform:uppercase;letter-spacing:.05em">'+k+'</span><code style=flex:1 id="'+(id||'')+'">'+v+'</code><button class=ghost style="padding:.15rem .5rem;font-size:.7rem" data-cmd="'+v.replace(/"/g,'&quot;')+'" onclick="cp(this.dataset.cmd)">copy</button></div>'}
var html='<div class=card glow>'+av+' <b style="font-size:1.15rem;margin-left:.6rem">'+p.name+'</b><div style=color:var(--dim);font-size:.8rem>region '+p.region+' · deterministic from your seed</div>'
+'<div style=margin-top:.7rem>'
+row('birthdate',p.birthdate)
+row('email suggestion',p.email_suggestion)
+row('username v1',p.username_variants[0])
+row('username v2',p.username_variants[1])
+row('username v3',p.username_variants[2])
+row('username v4',p.username_variants[3])
+row('password pattern',p.password_pattern)
+row("mother's maiden name",p.security_answers["mother's maiden name"])
+row('first pet',p.security_answers['first pet'])
+row('first car',p.security_answers['first car'])
+row('city born in',p.security_answers['city born in'])
+'</div><div style=color:var(--bad);font-size:.78rem;margin-top:.6rem>⚠ never reuse one REAL password — this is a pattern for a throwaway. The seed phrase is the only recovery: save it or lose the persona.</div></div>';
document.getElementById('cout').innerHTML=html;window._PERSONA=d.persona;});
}
function ccopy(){
if(!window._PERSONA)return;
navigator.clipboard.writeText(JSON.stringify(window._PERSONA,null,1)).then(function(){toast('persona JSON copied ✓')});
}
</script>"""
    return page("chaff", body)

@app.route("/api/chaff")
def api_chaff():
    r = rate_limit("chaff", 60, 60)
    if r: return r
    seed = (param("seed") or "").strip()
    if not seed: return jsonify({"ok": False, "error": "seed required"}), 400
    region = param("region") or "US"
    if region not in CHAFF_REGIONS: region = "XX"
    domain = (param("domain") or "mailinator.com").strip()[:60]
    return jsonify({"ok": True, "persona": chaff_persona(seed, region, domain)})
# ---------- END TOOL: CHAFF ----------


# ---------- TOOL: LEAK TRACER (document watermarker) ----------
import hashlib as _lhash

_LZ0, _LZ1 = "\u200b", "\u200c"

def _lhash_stream(password, n):
    ks = b""; seed = password.encode()
    while len(ks) < n:
        seed = _lhash.sha256(seed).digest(); ks += seed
    return ks[:n]

def _leak_mark(text, case_id, recipient_idx, nbits=None):
    """Embed recipient-specific bit pattern in word gaps. Pattern = hash(case_id + idx),
    so recipients' patterns differ everywhere (not just in low bits)."""
    salted = _lhash.sha256((case_id + ":" + str(recipient_idx)).encode()).digest()
    bits = "".join(format(b, "08b") for b in salted[:4])  # 32 bits, pseudorandom per recipient
    words = text.split(" ")
    slots = len(words) - 1
    if slots < len(bits):
        raise ValueError(f"document too short: needs {len(bits)}+ word gaps, has {slots}")
    step = slots / len(bits)
    out = []
    bit_i = 0
    for i, w in enumerate(words):
        out.append(w)
        if i < slots:
            out.append(" ")  # normal gap
            if bit_i < len(bits) and i == int(bit_i * step):
                out.append(_LZ0 if bits[bit_i] == "0" else _LZ1)
                bit_i += 1
    return "".join(out)  # 32 marks woven in, positions deterministic from bit_i*step

def _leak_read_bits(text):
    """Extract zero-width bits sequence from any text."""
    return [c for c in text if c in (_LZ0, _LZ1)]

def _leak_identify(case, fragment):
    """Match a fragment's bit pattern against all variants of a case.
    Returns (recipient_label, confidence, matched_bits) or (None, 0, 0)."""
    frag_bits = _leak_read_bits(fragment)
    # the fragment must carry at least 8 marks
    if len(frag_bits) < 8:
        return None, 0, len(frag_bits)
    best_label, best_score, best_total = None, 0.0, 0
    for label, variant_bits in case["variants"]:
        vb = _leak_read_bits(variant_bits)
        if len(vb) < 32: continue
        # sliding window: try to align fragment bits inside variant bits
        n = len(frag_bits)
        best_local = 0
        for off in range(0, min(len(vb) - n + 1, 64)):
            m = sum(1 for i in range(n) if vb[off + i] == frag_bits[i])
            if m > best_local: best_local = m
        # also try start-aligned (common case: leak is the doc head)
        m0 = sum(1 for i in range(min(n, len(vb))) if vb[i] == frag_bits[i])
        score = max(best_local, m0) / n
        if score > best_score:
            best_label, best_score, best_total = label, score, n
    return best_label, best_score, len(frag_bits)

def leak_case_create(uid, name, text, recipients):
    con = db()
    con.execute("""CREATE TABLE IF NOT EXISTS leakcases(
        id INTEGER PRIMARY KEY, case_id TEXT UNIQUE, user_id INTEGER, name TEXT,
        created INTEGER, variants_enc TEXT)""")
    case_id = secrets.token_urlsafe(8)
    variants = []
    for idx, label in enumerate(recipients):
        variants.append((label, _leak_mark(text, case_id, idx)))
    con.execute("INSERT INTO leakcases(case_id,user_id,name,created,variants_enc) VALUES(?,?,?,?,?)",
                (case_id, uid, esc(name[:100]), int(time.time()), dd_encrypt(json.dumps(variants))))
    con.commit()
    return case_id

def leak_case_get(uid, case_id):
    con = db()
    r = con.execute("SELECT * FROM leakcases WHERE case_id=? AND user_id=?", (case_id, uid)).fetchone()
    if not r: return None
    raw = dd_decrypt(r["variants_enc"])
    if not raw: return None
    return {"name": r["name"], "variants": json.loads(raw)}

@app.route("/tracer")
def tracer():
    uid = current_user_id()
    if not uid:
        return page("tracer", """<h1>LEAK <span>TRACER</span></h1><p class=sub>Hand every recipient their own invisible-marked copy of a document. When it leaks, the marks name the leaker — even from a pasted fragment.</p>
<div class=card>Log in (<a href=/inbox>free, no KYC</a>) to open a case.</div>""" + how([
"Each copy of your document carries the recipient's identity in invisible zero-width characters.",
"The marks survive copy-paste, screenshots-to-text, and edits — they're part of the text itself.",
"When a copy surfaces, paste the leaked text and LEAK TRACER names who leaked it.",
"Fragments work: even a few sentences from the middle carry enough marks to identify.",
"Cases stay private to your account; variants are encrypted at rest."]))
    con = db()
    cases = con.execute("SELECT case_id, name, created FROM leakcases WHERE user_id=? ORDER BY id DESC LIMIT 30", (uid,)).fetchall()
    caselist = "".join(f'<option value="{esc(c["case_id"])}">{esc(c["name"])} · {time.strftime("%b %d", time.localtime(c["created"]))}</option>' for c in cases)
    body = f"""
<h1>LEAK <span>TRACER</span></h1><p class=sub>Hand every recipient their own invisible-marked copy of a document. When it leaks, the marks name the leaker — even from a pasted fragment.</p>
<div class=card><b>Open a case</b>
<form method=post action=/tracer>
<input name=name placeholder="case name, e.g. 'series-A deck'" style=width:100%;margin:.3rem 0 required>
<textarea name=doctext rows=8 style=width:100% placeholder="paste the document text…"></textarea>
<input name=recipients placeholder="recipient labels, comma separated: alice,bob,carol" style=width:100%;margin:.3rem 0 required>
<button style=margin-top:.4rem>Watermark ▸</button></form>
<div style=color:var(--dim);font-size:.8rem;margin-top:.3rem id=tcap></div>
<script>
document.querySelector('textarea[name=doctext]').addEventListener('input',function(){{
var w=this.value.trim().split(/\\s+/).filter(Boolean).length;
document.getElementById('tcap').textContent=w+' words — supports about '+Math.floor(Math.max(0,w-1)/12)+' recipients (32 bits each)';
}});
</script></div>
{('<div class=card><b>Your cases</b><form style=margin-top:.4rem>select: <select name=case>' + caselist + '</select></form><div style=color:var(--dim);font-size:.8rem>open a case from the list on its own page — click Identify below</div></div>') if cases else ''}
<div class=card><b>Identify a leak</b>
<form method=get action=/tracer/identify>
<input name=case placeholder="case id" style=width:40%>
<textarea name=text rows=5 style=width:100%;margin:.3rem 0 placeholder="paste the leaked fragment — even a few sentences from the middle"></textarea>
<button>Trace the leak ▸</button></form></div>""" + flow("catch the leaker from a pasted paragraph", [
"<span class=flowrole>you</span> open a case: the merger memo, 4 recipients — alice, bob, carol, dave.",
"LEAK TRACER makes 4 copies. Each looks identical but carries 32 invisible bits naming its owner.",
"<span class=flowrole>you</span> send alice her copy, bob his, carol hers, dave his.",
"three days later the memo is on a forum. You copy two paragraphs from the leak.",
"<span class=flowrole>you</span> paste them into Identify with the case id → <b>carol — 97% confidence</b>.",
"now you know. And the other three know you can know — that changes how the next doc gets treated."]) + how([
"Every recipient index becomes 32 invisible bits woven into the word gaps of their copy.",
"The bits are deterministic per position — a fragment from anywhere still aligns to its owner's pattern.",
"Identify needs at least 8 surviving marks in the fragment; pasted text usually keeps them all.",
"Stripping the marks (normalizing whitespace) also works as a detection: 'this text was a traced copy'.",
"Variants are AES-encrypted in the database under your account — nobody reads your docs but you."])
    body += gloss([("watermark","invisible per-copy marks identifying the recipient"),("zero-width","invisible unicode characters riding inside normal text"),("fragment","a partial leak — some sentences, not the whole doc"),("case","one document + its recipient list + all variants")])
    body += agent_card('POST /api/tracer/case  name= text= recipients=a,b,c', 'curl -X POST https://dark0rbits.thetempleofdoom.com/api/tracer/case -d "name=deck" -d "text=…doc…" -d "recipients=alice,bob" -H "Cookie: dark0rbits_tok=…"', 'GET /api/tracer/identify?case_id=&text= → leaker + confidence.')
    return page("tracer", body)

@app.route("/tracer", methods=["POST"])
def tracer_create():
    uid = current_user_id()
    if not uid: return page("tracer", "<div class=card>login required</div>")
    name = param("name") or "case"
    text = (param("doctext") or "").strip()
    recipients = [r.strip()[:40] for r in (param("recipients") or "").split(",") if r.strip()]
    if not text or not recipients:
        return page("tracer", "<div class=card><span class=tag bad>document text + recipients required</span></div>")
    if len(recipients) > 20:
        return page("tracer", "<div class=card><span class=tag bad>max 20 recipients per case</span></div>")
    try:
        case_id = leak_case_create(uid, name, text, recipients)
    except ValueError as e:
        return page("tracer", f'<div class=card><span class=tag bad>{esc(str(e))}</span></div>')
    return Response(status=302, headers={"Location": f"/tracer/case/{case_id}"})

@app.route("/tracer/case/<case_id>")
def tracer_case(case_id):
    uid = current_user_id()
    if not uid: return page("tracer", "<div class=card>login required</div>")
    case = leak_case_get(uid, case_id)
    if not case: return page("tracer", "<div class=card>unknown case</div>")
    rows = ""
    for label, variant in case["variants"]:
        rows += (f'<div class=msg style=margin:.5rem 0><div class=who>{esc(label)}</div>'
                 f'<textarea readonly rows=3 style="width:100%;font-size:.8rem" id="v_{esc(label)}">{esc(variant[:400])}…</textarea>'
                 f'<button class=ghost style=padding:.2rem .6rem;font-size:.75rem data-cmd-full="1" onclick="leakCopy(\'{esc(label)}\')">copy full copy for {esc(label)}</button></div>')
    body = f"""
<h1>CASE <span>{esc(case['name'])}</span></h1><p class=sub>{len(case['variants'])} watermarked copies. Send each person THEIR copy — any leak names its owner.</p>
<div class=card>{rows}</div>
<div class=card><b>Identify a leak from this case</b>
<form method=get action=/tracer/identify>
<input type=hidden name=case value="{esc(case_id)}">
<textarea name=text rows=5 style=width:100% placeholder="paste the leaked fragment"></textarea>
<button style=margin-top:.4rem>Trace ▸</button></form></div>
<script>
var CASEVARIANTS = {json.dumps({label: v for label, v in case["variants"]})};
function leakCopy(label){{
navigator.clipboard.writeText(CASEVARIANTS[label]).then(function(){{
toast('copied ' + label + '’s copy ✓');
}});
}}
</script>"""
    return page("tracer", body)

@app.route("/tracer/identify")
def tracer_identify():
    uid = current_user_id()
    if not uid: return page("tracer", "<div class=card>login required</div>")
    case_id = param("case") or ""
    fragment = param("text") or ""
    case = leak_case_get(uid, case_id)
    if not case: return page("tracer", "<div class=card>unknown case</div>")
    label, score, nbits = _leak_identify(case, fragment)
    if label is None or score < 0.5:
        verdict = f'<span class="tag bad">no confident match ({nbits} marks found, best {int(score*100)}%)</span>'
    else:
        conf = int(score * 100)
        verdict = f'<span class="tag ok">LEAKER: <b>{esc(label)}</b> — matched {int(score*nbits)}/{nbits} marks · {conf}% confidence</span>'
    body = f"""
<h1>VERDICT <span>{esc(case['name'])}</span></h1>
<div class="card glow"><b>Result</b><div style=margin:.6rem 0>{verdict}</div>
<div style=color:var(--dim);font-size:.85rem>{nbits} invisible marks detected in the fragment. Above 50% alignment on a 32-bit pattern is a positive ID; below that the fragment may be too short or the marks got stripped in transit.</div></div>
<div class=card><a href=/tracer style=color:var(--acc)>← all cases</a></div>"""
    return page("tracer", body)

@app.route("/api/tracer/case", methods=["POST"])
def api_tracer_case():
    uid = key_user() or current_user_id()
    if not uid: return jsonify({"ok": False, "error": "auth required"}), 401
    r = rate_limit("tracer", 20, 60)
    if r: return r
    name = param("name") or "case"
    text = (param("text") or param("doctext") or "").strip()
    recipients = [x.strip()[:40] for x in (param("recipients") or "").split(",") if x.strip()]
    if not text or not recipients: return jsonify({"ok": False, "error": "text + recipients required"}), 400
    if len(recipients) > 20: return jsonify({"ok": False, "error": "max 20 recipients"}), 400
    try:
        case_id = leak_case_create(uid, name, text, recipients)
    except ValueError as e:
        return jsonify({"ok": False, "error": str(e)}), 400
    case = leak_case_get(uid, case_id)
    return jsonify({"ok": True, "case_id": case_id,
                    "variants": {label: variant for label, variant in case["variants"]}})

@app.route("/api/tracer/identify")
def api_tracer_identify():
    uid = key_user() or current_user_id()
    if not uid: return jsonify({"ok": False, "error": "auth required"}), 401
    case = leak_case_get(uid, param("case") or "")
    if not case: return jsonify({"ok": False, "error": "unknown case"}), 404
    label, score, nbits = _leak_identify(case, param("text") or "")
    if label is None or score < 0.5:
        return jsonify({"ok": True, "match": None, "marks_found": nbits, "best_score": round(score, 3)})
    return jsonify({"ok": True, "match": label, "confidence": round(score, 3),
                    "marks_matched": int(score * nbits), "marks_found": nbits})
# ---------- END TOOL: LEAK TRACER ----------


# ---------- TOOL: TRACEOUT (network traceroute) --- TRACEROUTE ----------
# Path tracing from this host to any target, hop by hop, with per-hop geo.
# Pure-Python UDP traceroute (IP_TTL) with TCP-connect fallback. No root needed.

def _trace_table(uid):
    con = db()
    con.executescript("""
    CREATE TABLE IF NOT EXISTS trace_runs(id INTEGER PRIMARY KEY, user_id INTEGER, target TEXT, resolved TEXT, hops INTEGER, done INTEGER, created INTEGER);
    CREATE TABLE IF NOT EXISTS trace_hops(run_id INTEGER, ttl INTEGER, ip TEXT, host TEXT, ms REAL, kind TEXT);
    """)
    return con

def _trace_resolve(host):
    """Return (ip, err). Accepts hostnames and IPs."""
    host = (host or "").strip().rstrip(".")
    if not host:
        return None, "target required"
    if ":" in host:
        return None, "IPv6 not supported by this tracer — give an IPv4 address or hostname"
    try:
        ipaddress.ip_address(host)
        return host, None
    except ValueError:
        pass
    if not re.match(r"^[a-zA-Z0-9._-]{1,253}$", host):
        return None, "invalid hostname"
    try:
        return socket.gethostbyname(host), None
    except Exception:
        return None, f"cannot resolve {host}"

def _trace_probe_udp(ip, ttl, port, timeout):
    """One UDP probe. Returns (kind, ms, reply_ip): kind in hop|done|timeout."""
    tx = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    rx = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        tx.setsockopt(socket.SOL_IP, socket.IP_TTL, ttl)
        rx.setsockopt(socket.SOL_SOCKET, socket.SO_RCVTIMEO, struct.pack("ll", int(timeout), 0))
        rx.bind(("0.0.0.0", 0))
        rx_port = rx.getsockname()[1]
        t0 = time.time()
        tx.sendto(b"dark0rbits-tracer", (ip, port))
        try:
            data, addr = rx.recvfrom(512)
            ms = round((time.time() - t0) * 1000, 1)
            return "hop", ms, addr[0]
        except ConnectionRefusedError:
            return "done", round((time.time() - t0) * 1000, 1), ip
        except socket.timeout:
            return "timeout", None, None
        except OSError:
            try:
                data, addr = rx.recvfrom(512)
                ms = round((time.time() - t0) * 1000, 1)
                return "hop", ms, addr[0]
            except Exception:
                return "timeout", None, None
    finally:
        try: tx.close()
        except Exception: pass
        try: rx.close()
        except Exception: pass

def _trace_probe_tcp(ip, ttl, port, timeout):
    """TCP-connect probe fallback (SYN dies at the hop when TTL expires)."""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        s.setsockopt(socket.SOL_IP, socket.IP_TTL, ttl)
        s.settimeout(timeout)
        t0 = time.time()
        rc = s.connect_ex((ip, port))
        ms = round((time.time() - t0) * 1000, 1)
        if rc == 0:
            return "done", ms, ip
        if rc in (61, 111, 113):  # ECONNREFUSED-ish: reached the destination
            return "done", ms, ip
        return "timeout", None, None
    except socket.timeout:
        return "timeout", None, None
    except OSError:
        return "timeout", None, None
    finally:
        try: s.close()
        except Exception: pass

def _trace_reverse(ip):
    try:
        host, _, _ = socket.gethostbyaddr(ip)
        return host
    except Exception:
        return ""

def tout_run(target, max_hops=15, timeout=1.5):
    """Run a traceroute. Returns dict: ok, target, resolved, hops[], method."""
    max_hops = max(1, min(int(max_hops or 15), 30))
    timeout = max(0.3, min(float(timeout or 1.5), 5.0))
    ip, err = _trace_resolve(target)
    if err:
        return {"ok": False, "error": err, "target": target}
    hops = []
    method = "udp"
    port = 33434
    for ttl in range(1, max_hops + 1):
        if ip in ("127.0.0.1",) or ip.startswith("127."):
            best = _trace_probe_udp(ip, ttl, port, timeout)
        else:
            best = _trace_probe_udp(ip, ttl, port, timeout)
        if best[0] == "timeout" and ttl == 1:
            alt = _trace_probe_tcp(ip, ttl, 80, timeout)
            if alt[0] != "timeout":
                method = "tcp"
                best = alt
            elif _trace_probe_tcp(ip, ttl, 443, timeout)[0] != "timeout":
                method = "tcp"
                best = _trace_probe_tcp(ip, ttl, 443, timeout)
        kind, ms, rip = best
        host = _trace_reverse(rip) if rip else ""
        hops.append({"ttl": ttl, "ip": rip or "", "host": host, "ms": ms, "kind": kind})
        if kind == "done":
            break
    return {"ok": True, "target": target, "resolved": ip, "method": method,
            "hops": hops, "hop_count": len(hops),
            "complete": bool(hops and hops[-1]["kind"] == "done")}

def tout_save(uid, target, res):
    """Persist a run + hops. Returns run id or None."""
    try:
        con = _trace_table(uid)
        cur = con.execute(
            "INSERT INTO trace_runs(user_id,target,resolved,hops,done,created) VALUES(?,?,?,?,?,?)",
            (uid, target[:200], res.get("resolved") or "", res.get("hop_count", 0),
             1 if res.get("complete") else 0, int(time.time())))
        rid = cur.lastrowid
        for h in res.get("hops", []):
            con.execute(
                "INSERT INTO trace_hops(run_id,ttl,ip,host,ms,kind) VALUES(?,?,?,?,?,?)",
                (rid, h["ttl"], h["ip"] or "", h["host"][:200] if h["host"] else "",
                 h["ms"] if h["ms"] is not None else -1, h["kind"]))
        con.commit()
        return rid
    except Exception:
        return None

def tout_history(uid, limit=10):
    try:
        con = _trace_table(uid)
        return con.execute(
            "SELECT * FROM trace_runs WHERE user_id=? ORDER BY id DESC LIMIT ?",
            (uid, max(1, min(limit, 50)))).fetchall()
    except Exception:
        return []

_TRACE_PORTS = {"http": 80, "https": 443, "dns": 53, "ssh": 22, "smtp": 25}

def tout_render_hops(res):
    rows = ""
    for h in res.get("hops", []):
        if h["kind"] == "timeout":
            rows += f"<tr><td>{h['ttl']}</td><td colspan=4 style=color:var(--dim)>* * * no answer</td></tr>"
            continue
        lbl = "DEST" if h["kind"] == "done" else "hop"
        geo = enrich_ip(h["ip"]) or {}
        where = esc(" ".join(x for x in (geo.get("city"), geo.get("country")) if x))
        ms = f"{h['ms']} ms" if h["ms"] is not None else "-"
        rows += (f"<tr><td>{h['ttl']}</td><td>{esc(h['ip'])}"
                 + (f"<br><span style='color:var(--dim);font-size:.8rem'>{esc(h['host'])}</span>" if h["host"] else "")
                 + f"</td><td>{where}</td><td>{ms}</td><td>{lbl}</td></tr>")
    if not rows:
        rows = "<tr><td colspan=5>no hops</td></tr>"
    return rows

@app.route("/traceout", methods=["GET", "POST"])
def traceout_page():
    uid = current_user_id()
    if not uid:
        return page("tracer", """
<h1>TRACE <span>ROUTE</span></h1><p class=sub>Hop-by-hop path from this host to any target — see every router between you and the destination, with geo on each hop.</p>
<div class=card><b>LOGIN REQUIRED</b><br><span style=color:var(--dim)>Traceroute costs real outbound packets, so it is account-gated. No KYC: <a href=/inbox>create a free account</a> in 10 seconds.</span></div>""")
    result = None
    target = ""
    err = ""
    if request.method == "POST":
        r = rate_limit("tracer", 8, 60)
        if r: return r
        target = (param("target") or "").strip()
        port_name = (param("port") or "dns").strip().lower()
        max_hops = param("maxhops") or 15
        timeout = param("timeout") or 1.5
        port = _TRACE_PORTS.get(port_name, 33434)
        if not target:
            err = "give a target — domain or IPv4"
        else:
            res = tout_run(target, max_hops=max_hops, timeout=timeout)
            if not res.get("ok"):
                err = res.get("error", "trace failed")
            else:
                tout_save(uid, target, res)
                result = res
    hist = tout_history(uid)
    hist_html = "".join(
        f"<tr><td>{esc(h['target'])}</td><td>{esc(h['resolved'])}</td><td>{h['hops']}</td>"
        f"<td>{'yes' if h['done'] else 'partial'}</td><td>{time.strftime('%b %d %H:%M', time.localtime(h['created']))}</td></tr>"
        for h in hist) or "<tr><td colspan=5>no runs yet</td></tr>"
    res_html = ""
    if result:
        res_html = (f"<div class=card><b>RESULT — {esc(result['target'])} → {esc(result['resolved'])}</b> "
                    f"<span class='tag ok'>{result['method']}</span>"
                    + ("<span class='tag ok'>COMPLETE</span>" if result["complete"] else "<span class='tag warn'>PARTIAL</span>")
                    + f"<div class=tblwide><table><tr><th>#</th><th>hop</th><th>geo</th><th>rtt</th><th>role</th></tr>"
                    + tout_render_hops(result) + "</table></div></div>")
    body = f"""
<h1>TRACE <span>ROUTE</span></h1><p class=sub>Hop-by-hop path from this host to any target. Every router between you and the destination, with geo per hop. Works without JS.</p>
<div class=card>
<form method=post action=/tracer>
<label>target (domain or IPv4)</label><input name=target value='{esc(target)}' placeholder=example.com style=width:70%>
<div style=margin:.5rem 0><label>probe port</label>
<select name=port><option value=dns>dns/53</option><option value=http>http/80</option><option value=https>https/443</option><option value=ssh>ssh/22</option></select>
<label>max hops</label><input name=maxhops value=15 style=width:60px>
<label>timeout s</label><input name=timeout value=1.5 style=width:60px></div>
<button>TRACE →</button>
</form>
{f"<div style=color:var(--bad);margin-top:.5rem>{esc(err)}</div>" if err else ""}
</div>
{res_html}
<div class=card><b>RECENT RUNS</b><div class=tblwide><table><tr><th>Target</th><th>Resolved</th><th>Hops</th><th>Complete</th><th>When</th></tr>{hist_html}</table></div></div>
"""
    body += how([
        "Type a domain or IPv4 — no port guessing needed unless you want a specific probe port.",
        "The tool sends UDP probes with TTL 1, 2, 3… — each router that kills a packet reveals itself.",
        "The final hop answers with a port-unreachable: that is the destination, marked DEST.",
        "Each answered hop gets reverse-DNS and IP geo enrichment so you see where the path bends.",
        "Firewalls that drop UDP make the path look dead — switch the probe port to 443 and retry.",
        "Every run is saved under RECENT RUNS so you can diff paths across time.",
    ])
    body += flow("Trace a target and read the path", [
        "<span class=flowrole>you</span> enter <b>example.com</b>, probe port dns, hit TRACE",
        "<span class=flowrole>tracer</span> resolves the name, walks TTL 1→15, logs every router IP + rtt",
        "<span class=flowrole>tracer</span> enriches each hop with geo and flags the DEST row",
        "<span class=flowrole>you</span> read the path: where it leaves the country, where latency jumps, where it dies",
    ])
    body += gloss([
        ("TTL", "time-to-live: a hop counter in every packet; each router decrements it and discards at zero, announcing itself"),
        ("rtt", "round-trip time for the probe packet — the latency budget of that hop"),
        ("DEST", "destination row: the host answered with port-unreachable, so the path is complete"),
    ])
    body += agent_card(
        "POST /api/traceout/run {target, port, maxhops, timeout} · GET /api/traceout/history",
        "curl -X POST " + SITE + "/api/traceout/run -H 'Authorization: Bearer ***' -H 'Content-Type: application/json' -d '{\"target\":\"example.com\",\"port\":443}'",
        "Hop-by-hop path trace with per-hop geo. FREE. Session cookie or API key. Returns hops[] with ttl/ip/host/ms/kind.")
    body += kv([
        ("probe method", "UDP with IP_TTL, TCP fallback"),
        ("max hops", "1–30"),
        ("rate limit", "8 traces / minute"),
        ("price", "FREE"),
    ])
    return page("tracer", body)

@app.route("/api/traceout/run", methods=["POST"])
def api_tracer_run():
    r = rate_limit("tracer_api", 8, 60)
    if r: return r
    uid, e = require_paid_key(0, "traceroute run")
    if e: return e
    target = str(jp("target") or "").strip()
    if not target:
        return jsonify({"ok": False, "error": "target required (domain or IPv4)"}), 400
    port_name = str(jp("port") or "dns").lower()
    res = tout_run(target, max_hops=jp("maxhops") or 15, timeout=jp("timeout") or 1.5)
    if not res.get("ok"):
        return jsonify(res), 400
    res["port"] = _TRACE_PORTS.get(port_name, 33434)
    rid = tout_save(uid, target, res)
    res["run_id"] = rid
    return jsonify(res), 200, {"Cache-Control": "no-store"}

@app.route("/api/traceout/history")
def api_tracer_history():
    uid = key_user() or current_user_id()
    if not uid:
        return jsonify({"ok": False, "error": "auth required: account session or Authorization: Bearer *** key"}), 401
    rows = tout_history(uid, limit=int(param("limit") or 10))
    return jsonify({"ok": True, "runs": [
        {"id": h["id"], "target": h["target"], "resolved": h["resolved"],
         "hops": h["hops"], "complete": bool(h["done"]), "created": h["created"]} for h in rows]})
# ---------- END TOOL: TRACEROUTE ----------


# ---------- TOOL: TRAP CHAIN (breadcrumb tripwires) ----------
def _bchain_tables():
    con = db()
    con.executescript("""CREATE TABLE IF NOT EXISTS bchain(id INTEGER PRIMARY KEY, user_id INTEGER, chain_id TEXT UNIQUE, name TEXT, created INTEGER);
    CREATE TABLE IF NOT EXISTS bchain_hops(id INTEGER PRIMARY KEY, chain_row INTEGER, seq INTEGER, token TEXT UNIQUE, fired_ts INTEGER, fired_ip TEXT, fired_ua TEXT);""")
    return con

def _bchain_get(uid, chain_id):
    con = db()
    r = con.execute("SELECT * FROM bchain WHERE chain_id=? AND user_id=?", (chain_id, uid)).fetchone()
    if not r: return None
    hops = con.execute("SELECT * FROM bchain_hops WHERE chain_row=? ORDER BY seq", (r["id"],)).fetchall()
    return {"row": r, "hops": [dict(h) for h in hops]}

@app.route("/tchain")
def tchain_page():
    uid = current_user_id()
    if not uid:
        return page("tchain", """<h1>TRAP <span>CHAIN</span></h1><p class=sub>Breadcrumb tripwires: each trap a thief trips hands them the next one — and tells you every step of their path.</p>
<div class=card>Log in (<a href=/inbox>free, no KYC</a>) to arm a chain.</div>""" + how([
"Plant hop 1 where an intruder will look first — a file named 'passwords.txt', a folder called 'backup'.",
"The hop's decoy note contains hop 2's URL. The curious can't resist: they follow it.",
"Every hop they trip pings your inbox with IP, location, device — and lights up the chain board.",
"By the time they stop, you have a map of exactly how far they got and how fast they moved.",
"Chains work on paper too: print the decoys, leave them in a drawer."]))
    con = _bchain_tables()
    chains = con.execute("SELECT * FROM bchain WHERE user_id=? ORDER BY id DESC LIMIT 20", (uid,)).fetchall()
    clist = ""
    for ch in chains:
        hops = con.execute("SELECT * FROM bchain_hops WHERE chain_row=? ORDER BY seq", (ch["id"],)).fetchall()
        fired = sum(1 for h in hops if h["fired_ts"])
        clist += f'<a class="dl" href=/tchain/board?id={ch["chain_id"]}>◈ {esc(ch["name"])} <small>{fired}/{len(hops)} hops fired</small></a>'
    body = f"""
<h1>TRAP <span>CHAIN</span></h1><p class=sub>Breadcrumb tripwires: each trap a thief trips hands them the next one — and tells you every step of their path through your files.</p>
<div class=card><b>New chain</b>
<form method=post action=/tchain>
<input name=name placeholder="chain name, e.g. 'laptop decoys'" style=width:100%;margin:.3rem 0 required>
<select name=nhops style=width:100%;margin:.3rem 0>
<option value=2>2 hops</option><option value=3>3 hops</option><option value=4 selected>4 hops</option><option value=5>5 hops</option><option value=6>6 hops</option><option value=8>8 hops</option>
</select>
<button>Arm the chain ▸</button></form></div>
{('<div class=card><b>Your chains</b>' + clist + '</div>') if clist else ''}
""" + flow("map the path a thief takes through your files", [
"<span class=flowrole>you</span> arm a 4-hop chain and get 4 unique URLs plus 4 decoy notes.",
"hop 1's URL goes inside a file called <b>RESTORE_PASSWORDS_HERE.txt</b> on the desktop.",
"its decoy text says 'real vault: <hop-2 URL>' — bait for whoever opened the file.",
"<span class=flowrole>them</span> opens the file, clicks the link (a blank 404) — your inbox pings: hop 1, their IP, their city.",
"they follow the 'vault' link — hop 2 fires. Then 3. The board draws their path in real time.",
"when the chain fully burns you get one summary alert with the whole timeline."]) + how([
"Hop 1 is a plain tripwire. Hops 2+ hide inside the previous hop's decoy note — following the trail IS the confession.",
"Every fire logs IP, geolocation, device, timestamp, and alerts your inbox instantly.",
"The board shows the chain as a diagram: armed hops wait in green, fired ones glow red with their details.",
"Fully-burned chains fire one final summary alert with the complete timeline.",
"Decoy text is fully editable before you plant it — make it fit where it lives."])
    body += gloss([("hop","one tripwire in the chain"),("decoy","plausible text that carries the next hop's URL"),("burn","a fully-tripped chain"),("board","the live diagram of the chain's state")])
    body += agent_card('POST /api/tchain/create  name= nhops=', 'curl -X POST https://dark0rbits.thetempleofdoom.com/api/tchain/create -d "name=laptop" -d "nhops=4" -H "Cookie: dark0rbits_tok=…"', 'GET /api/tchain/status?chain_id= → per-hop state.')
    return page("tchain", body)

@app.route("/tchain", methods=["POST"])
def tchain_create():
    uid = current_user_id()
    if not uid: return page("tchain", "<div class=card>login required</div>")
    name = (param("name") or "chain")[:80]
    try: nhops = min(8, max(2, int(param("nhops") or 4)))
    except Exception: nhops = 4
    con = _bchain_tables()
    chain_id = secrets.token_urlsafe(6)
    cur = con.execute("INSERT INTO bchain(user_id,chain_id,name,created) VALUES(?,?,?,?)", (uid, chain_id, esc(name), int(time.time())))
    row_id = cur.lastrowid
    for seq in range(nhops):
        con.execute("INSERT INTO bchain_hops(chain_row,seq,token) VALUES(?,?,?)", (row_id, seq, secrets.token_urlsafe(10)))
    con.commit()
    return Response(status=302, headers={"Location": f"/tchain/board?id={chain_id}"})

@app.route("/tchain/board")
def tchain_board():
    uid = current_user_id()
    if not uid: return page("tchain", "<div class=card>login required</div>")
    chain_id = param("id") or ""
    ch = _bchain_get(uid, chain_id)
    if not ch: return page("tchain", "<div class=card>unknown chain</div>")
    # render hop cards with decoy text + plant instructions
    hop_html = ""
    nhops = len(ch["hops"])
    for h in ch["hops"]:
        url = f"{SITE}/tc/{h['token']}"
        if h["fired_ts"]:
            geo = enrich_ip(h["fired_ip"]) or {}
            where = f"{geo.get('city','—')}, {geo.get('countryCode','')} · {geo.get('isp','')}" if geo else "—"
            state = f'<span class="tag bad">FIRED</span> {time.strftime("%b %d %H:%M", time.localtime(h["fired_ts"]))} · {esc(h["fired_ip"])} · {esc(where)}<br><span style="font-size:.75rem;color:var(--dim)">{esc((h["fired_ua"] or "")[:80])}</span>'
        else:
            state = '<span class="tag ok">WAITING</span>'
        decoy = ""
        if h["seq"] < nhops - 1:
            nxt = ch["hops"][h["seq"] + 1]
            decoy = (f'<div style="margin-top:.4rem;font-size:.85rem"><b>decoy note for this hop</b> <button class=ghost style="padding:.15rem .5rem;font-size:.7rem" data-cmd="real one is here: {SITE}/tc/{nxt["token"]}" onclick="cp(this.dataset.cmd)">copy</button>'
                     f'<div class=msg style=margin:.3rem 0;font-size:.8rem>real one is here: {SITE}/tc/{nxt["token"]}</div></div>')
        else:
            decoy = '<div style="margin-top:.4rem;font-size:.8rem;color:var(--dim)">last hop — no decoy, the trail ends here</div>'
        hop_html += (f'<div class="card" style="border-color:{"var(--bad)" if h["fired_ts"] else "var(--line)"}">'
                     f'<b>HOP {h["seq"]+1}</b> {state}<br>'
                     f'tripwire: <code>{url}</code> <a href=# onclick="cp(\'{url}\');return false" style=color:var(--acc)>copy</a>'
                     f'{decoy}</div>')
        if h["seq"] < nhops - 1:
            hop_html += '<div style=text-align:center;font-size:1.1rem;color:var(--acc)>↓</div>'
    body = f"""
<h1>CHAIN <span>{esc(ch['row']['name'])}</span></h1><p class=sub>{nhops} hops. Plant hop 1 where they'll find it; the decoys feed them the rest.</p>
{hop_html}
<div class=card><a href=/tchain style=color:var(--acc)>← all chains</a></div>"""
    return page("tchain", body)

@app.route("/tc/<token>")
def bchain_fire(token):
    con = _bchain_tables()
    h = con.execute("SELECT * FROM bchain_hops WHERE token=?", (token,)).fetchone()
    if not h: return "Not Found", 404
    ip = request.headers.get("X-Real-IP") or request.remote_addr or "?"
    ua = request.headers.get("User-Agent", "")
    first = not h["fired_ts"]
    con.execute("UPDATE bchain_hops SET fired_ts=?, fired_ip=?, fired_ua=? WHERE id=?",
                (int(time.time()), ip, ua[:200], h["id"]))
    con.commit()
    ch = con.execute("SELECT * FROM bchain WHERE id=?", (h["chain_row"],)).fetchone()
    if ch and ch["user_id"]:
        geo = enrich_ip(ip)
        where = f" — {geo.get('city','')}, {geo.get('countryCode','')} · {geo.get('isp','')}" if geo else ""
        all_hops = con.execute("SELECT * FROM bchain_hops WHERE chain_row=? ORDER BY seq", (h["chain_row"],)).fetchall()
        if first and all(x["fired_ts"] for x in all_hops):
            body = f"🔗 TRAP CHAIN FULLY BURNED: '{ch['name']}' — every hop tripped. Timeline on the board."
        else:
            body = f"🔗 TRAP CHAIN hop {h['seq']+1} fired: '{ch['name']}' — IP <b>{esc(ip)}</b>{esc(where)} · device {esc(ua[:80])}"
        con.execute("INSERT INTO messages(user_id,sender,body,created) VALUES(?,?,?,?)", (ch["user_id"], "operator-bot", body, int(time.time())))
        con.commit()
    return "Not Found", 404

@app.route("/api/tchain/create", methods=["POST"])
def api_tchain_create():
    uid = key_user() or current_user_id()
    if not uid: return jsonify({"ok": False, "error": "auth required"}), 401
    r = rate_limit("tchain", 20, 60)
    if r: return r
    name = (param("name") or "chain")[:80]
    try: nhops = min(8, max(2, int(param("nhops") or 4)))
    except Exception: nhops = 4
    con = _bchain_tables()
    chain_id = secrets.token_urlsafe(6)
    cur = con.execute("INSERT INTO bchain(user_id,chain_id,name,created) VALUES(?,?,?,?)", (uid, chain_id, esc(name), int(time.time())))
    row_id = cur.lastrowid
    hops = []
    for seq in range(nhops):
        tok = secrets.token_urlsafe(10)
        con.execute("INSERT INTO bchain_hops(chain_row,seq,token) VALUES(?,?,?)", (row_id, seq, tok))
        hops.append({"seq": seq, "tripwire": f"{SITE}/tc/{tok}"})
    con.commit()
    return jsonify({"ok": True, "chain_id": chain_id, "hops": hops})

@app.route("/api/tchain/status")
def api_tchain_status():
    uid = key_user() or current_user_id()
    if not uid: return jsonify({"ok": False, "error": "auth required"}), 401
    ch = _bchain_get(uid, param("chain_id") or "")
    if not ch: return jsonify({"ok": False, "error": "unknown chain"}), 404
    hops = [{"seq": h["seq"], "fired": bool(h["fired_ts"]), "fired_ts": h["fired_ts"], "ip": h["fired_ip"]} for h in ch["hops"]]
    return jsonify({"ok": True, "name": ch["row"]["name"], "hops": hops})
# ---------- END TOOL: TRAP CHAIN ----------


# ---------- 9. OPERATOR CONSOLE ----------
@app.route("/admin", methods=["GET", "POST"])
def admin():
    if request.method == "POST" and request.form.get("pw") == ADMIN_PW:
        resp = Response(status=302); resp.headers["Location"] = "/admin"
        resp.set_cookie("dark0rbits_admin", secrets.token_urlsafe(16), max_age=86400, httponly=True)
        return resp
    if not request.cookies.get("dark0rbits_admin"):
        return page("track", '<h1>OPERATOR</h1><div class=card><form method=post><input name=pw type=password placeholder="operator password"><button>In</button></form></div>')
    con = db()
    msgs = con.execute("SELECT m.*, u.username FROM messages m JOIN users u ON u.id=m.user_id ORDER BY m.id DESC LIMIT 100").fetchall()
    msgs_html = "".join(f'<div class=msg><div class=who>{esc(m["username"])} · {time.strftime("%b %d %H:%M", time.localtime(m["created"]))}</div>{m["body"]}</div>' for m in msgs) or '<div style=color:var(--dim)>empty</div>'
    opens = con.execute("SELECT te.*, tr.filename FROM track_events te JOIN trackables tr ON tr.id=te.trackable_id ORDER BY te.id DESC LIMIT 30").fetchall()
    opens_html = "".join(f"<tr><td>{esc(o['filename'])}</td><td>{esc(o['ip'])}</td><td>{esc(o['ua'][:50])}</td><td>{time.strftime('%b %d %H:%M', time.localtime(o['ts']))}</td></tr>" for o in opens)
    reply_to = param("reply") or ""
    reply_html = ""
    if reply_to:
        r = con.execute("SELECT username FROM users WHERE id=?", (reply_to,)).fetchone()
        if r: reply_html = f'<div class=card><b>Reply to {esc(r["username"])}</b><form method=post action=/admin/reply><input type=hidden name=uid value="{esc(reply_to)}"><textarea name=body rows=2 style="width:100%"></textarea><button style=margin-top:.4rem>Send reply</button></form></div>'
    return page("track", f"""
<h1>OPERATOR <span>CONSOLE</span></h1>
<div class=card><b>All customer messages</b>{msgs_html}</div>
<div class=card><b>Reply</b><form method=get><input name=reply placeholder="user id to reply to" style=width:60%><button>Load</button></form></div>{reply_html}
<div class=card><b>File open events</b><table><tr><th>File</th><th>IP</th><th>Device</th><th>When</th></tr>{opens_html}</table></div>""")

# ---------- INDEX (hacker landing) ----------
@app.route("/")
def index():
    ip = request.headers.get("X-Real-IP") or request.remote_addr
    st, b = http(f"http://ip-api.com/json/{ip}?fields=66846719")
    d = jf(b) or {}
    uid = current_user_id()
    con = db()
    n_sms = con.execute("SELECT COUNT(*) c FROM sms_rentals").fetchone()["c"]
    n_px = con.execute("SELECT COUNT(*) c FROM proxy_checks").fetchone()["c"]
    tools = [
        ("ip","IP INTEL","Geo, ASN, ISP, VPN/hosting flags, rDNS — your IP auto-detected, any target on demand.","◈","INTEL"),
        ("card","CARD CHECK","Luhn + BIN: issuer bank, brand, type, country, prepaid risk flags. Nothing stored, nothing charged.","◈","INTEL"),
        ("eh","MAIL FORENSICS","Paste headers or drop a .eml → true origin IP + geo, relay delays, SPF/DKIM/DMARC verdicts, spoof flags.","◈","INTEL"),
        ("phone","PHONE LOOKUP","OSINT on any number: carrier, line type, region, timezones + free deep-dive leads. VOIP/fake detection.","◈","INTEL"),
        ("user","USERNAME SLEUTH","One handle → probed across 16 platforms in parallel. Find where the human lives online.","◈","INTEL"),
        ("domain","DOMAIN RECON","RDAP registration, full DNS, certificate-log subdomain discovery. Passive recon, free.","◈","INTEL"),
        ("forensics","IMAGE FORENSICS","Deep EXIF (all IFDs), decoded GPS + map links, XMP trails, embedded thumbnails, ELA — expose doctored photos.","◈","INTEL"),
        ("sms","SMS RENTAL","Disposable numbers, 30-min windows, instant refund on cancel.","◈","ACQUIRE"),
        ("mail","BURNER MAIL","Receive-only mailboxes, 7–90 days, live countdown. Codes & confirmations without an identity.","◈","ACQUIRE"),
        ("proxy","PROXY LAB","Residential egress testing on the Pleiades rail — same gateway keys fleet-wide.","◈","ACQUIRE"),
        ("deaddrop","DEAD-DROP","AES-GCM encrypted notes that burn after N reads or TTL. Optional password. No trace left.","◈","ACQUIRE"),
        ("steg","STEGO LAB","Hide secret text inside a normal PNG — invisible, password-encrypted, scattered. Live capacity meter.","◈","OPERATE"),
        ("track","TRACK FILE","Send an image or file, learn who opened it: IP, city, ISP, device, language — instantly in your inbox.","◈","HUNT"),
        ("canary","CANARY TRAPS","Tripwires: stealth links, pixels, fake-credential honeytokens, honeyfile baits — instant alerts with IP + geo when touched.","◈","HUNT"),
        ("shot","SCREENSHOT","Headless-Chromium PNG capture of any page. Agents: poll the status API.","◈","HUNT"),
        ("score","FRAUD-SCORE","Composite 0-100 risk: IP intel + disposable-email + BIN heuristics, with full breakdown.","◈","HUNT"),
        ("tools","FREE TOOLS","DNS resolver, HTTP header inspector, JWT decoder, hasher, generators.","◈","UTILITY"),
        ("dms","DEAD MAN SWITCH","Arm a switch, check in on schedule, and your pre-written letters seal as burn-after-read dead-drops the moment you go quiet.","◈","Operate"),
        ("chain","HASH CHAINS","Chain-of-custody logs where every entry hashes onto the last — any edit, delete or reorder breaks the chain at the exact link. Export a JSON receipt as proof.","◈","HUNT"),
        ("ghost","GHOST TEXT","Hide secret messages inside innocent-looking text with invisible zero-width characters — looks identical, survives copy-paste on plain-text channels.","◈","OPERATE"),
        ("chaff","CHAFF","One passphrase in, a complete consistent fake identity out — same seed always regenerates the same persona, and nothing is ever stored.","◈","OPERATE"),
        ("tracer","LEAK TRACER","Every recipient gets their own invisible-marked copy of a doc. When it leaks, paste the text and the marks name the leaker.","◈","HUNT"),
        ("traceout","TRACEOUT","Pure-python traceroute with per-hop rDNS + geolocation and run history.","◈","INTEL"),
        ("tchain","TRAP CHAIN","Breadcrumb tripwires: each trap a thief trips hands them the next — your board maps their exact path with IP + geo per hop.","◈","HUNT"),
        ("passport","AGENT PASSPORT","Machine-readable trust badge for your bots. Agents are first-class here.","◈","ACCOUNT"),
    ]
    tcards = "".join(
        f'<div class="card tcard"><div class="trow"><span class="tico">{ico}</span><h3><a href=/{href} style="color:var(--acc);text-decoration:none">{name}</a></h3><span class="tt">{cat}</span></div>'
        f'<p>{desc}</p><a class=tgo href=/{href}><button>Open →</button></a></div>'
        for href, name, desc, ico, cat in tools)
    stat = f"you're connecting from <b style='color:var(--acc2)'>{esc(d.get('query','?'))}</b> · {esc(d.get('country',''))}"
    cta = ('<a href=/inbox><button class=big>◈ INBOX</button></a> <a href=/keys><button class="big ghost">▣ API KEYS</button></a> <a href=/pass><button class=big>★ GET PASS</button></a>' if uid else '<a href=/signup><button class=big>▸ SIGN UP — NO KYC</button></a> <a href=/inbox><button class="big ghost">◈ LOG IN</button></a> <a href=/pass><button class="big ghost">★ GET PASS</button></a>')
    from markupsafe import escape as _e
    stat_line = '<span class="hl">▸ ' + stat + '</span>' if stat else ""
    body = f"""
<div class="term card glow hero">
<div class="hl">$ ./dark0rbits --intro <span class="crt">▊</span></div>
<h2>The toolbox that treats you like an <em>operator</em>, not a product.</h2>
<p class="hsub">No KYC. No email. No meters — <b>every tool is FREE</b>. Every tool has a JSON API, so scripts and agents are first-class customers.</p>
{stat_line}
<div class="cta">{cta}</div></div>
<script>
(function(){{
var el=document.querySelector('.type');if(!el)return;
var lines=el.dataset.lines.split('|');var li=0,ci=0,out='';
function step(){{
if(li>=lines.length)return;
var cur=lines[li];ci++;
el.innerHTML=out+cur.slice(0,ci)+'<span class="typed-cursor">▊</span>';
if(ci>=cur.length){{out+=cur+'<br>';li++;ci=0;setTimeout(step,420)}}else setTimeout(step,22);
}}
step();
}})();
</script>
<div class="grid3">{tcards}</div>
<div class=card style=text-align:center>
<span class="tag ok">NO KYC</span> <span class="tag ok">ALL FREE</span> <span class="tag ok">AGENT-FIRST APIs</span> <span class="tag warn">{n_sms} SMS RENTALS SERVED</span> <span class="tag warn">{n_px} PROXY CHECKS</span></div>
<div class=card style=color:var(--dim)>
<b>For agents</b>: machine catalog at <a href=/llms.txt>/llms.txt</a>, OpenAPI at <a href=/openapi.json>/openapi.json</a>, metered keys at <a href=/keys>/keys</a>.
For humans: click a card. That's it.</div>"""
    return page("home", body)

@app.route("/favicon.svg")
def favicon():
    svg = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="7" fill="#070a13"/><circle cx="16" cy="16" r="5" fill="#a78bfa"/><circle cx="16" cy="16" r="9.5" fill="none" stroke="#6fd6ff" stroke-width="1.3" stroke-dasharray="4 3"/><circle cx="25.5" cy="8" r="1.6" fill="#ffc94d"/></svg>'
    return Response(svg, mimetype="image/svg+xml")

@app.route("/og.png")
def og_img():
    from PIL import Image, ImageDraw
    im = Image.new("RGB", (1200, 630), (7, 10, 19))
    dr = ImageDraw.Draw(im)
    for i in range(260):
        import random as _r
        _r.seed(i)
        x, y = _r.randint(0, 1199), _r.randint(0, 629)
        dr.ellipse([x, y, x+2, y+2], fill=(200+i%55, 210, 255))
    dr.ellipse([480, 190, 720, 430], outline=(167, 139, 250), width=4)
    dr.ellipse([455, 165, 745, 455], outline=(111, 214, 255), width=2)
    try:
        from PIL import ImageFont
        f = ImageFont.truetype("/usr/share/fonts/truetype/dejavu/DejaVuSansMono-Bold.ttf", 84)
        f2 = ImageFont.truetype("/usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf", 26)
    except Exception:
        f = f2 = None
    dr.text((600, 290), "DARK0RBITS", fill=(255, 201, 77), anchor="mm", font=f)
    dr.text((600, 390), "no-KYC network toolbox · everything free · agents welcome", fill=(147, 160, 194), anchor="mm", font=f2)
    buf = io.BytesIO(); im.save(buf, "PNG")
    return Response(buf.getvalue(), mimetype="image/png")

@app.route("/health")
def health(): return jsonify({"ok": True, "service": "dark0rbits", "version": "3.0"})


# REDIRECT legacy auriga hostname → dark0rbits
@app.before_request
def _dr_legacy_redirect():
    host = (request.host or "").lower()
    if host.startswith("auriga.") or host == "auriga.thetempleofdoom.com":
        return redirect("https://dark0rbits.thetempleofdoom.com" + request.full_path.rstrip("?"), code=301)
    return None
# REDACT-REDIRECT

@app.errorhandler(404)
def not_found(e):
    if request.path.startswith("/api/"):
        return jsonify({"ok": False, "error": "no such endpoint", "path": request.path}), 404
    body = """
<h1>404 — <span>LOST SIGNAL</span></h1>
<div class=card>This page drifted off the map. The tools are all still here:</div>
<div class=grid2>
<div class=card><h3><a href=/ip style="color:var(--acc);text-decoration:none">◈ IP INTEL</a></h3></div>
<div class=card><h3><a href=/tools style="color:var(--acc);text-decoration:none">◈ FREE TOOLS</a></h3></div>
<div class=card><h3><a href=/ style="color:var(--acc);text-decoration:none">◈ HOME BASE</a></h3></div>
</div>"""
    return page("home", body), 404




# ---------- MAG-LAB (browser magstripe studio, closed-loop only) ----------
_MAG_POLICY = (
    "MAG-LAB encodes CLOSED-LOOP cards only: your own gift, loyalty, membership, "
    "event or staff cards. Payment-network tracks (bank/debit/credit layouts, "
    "13-19 digit Luhn-valid PANs, bank service codes 101/121/201-220, EMV/JCOP "
    "dumps) are refused at encode AND decode. This is a hard policy, not a "
    "toggle you can switch off.")

def _mag_sentinel(track):
    """True if a track looks like a payment-network card rather than closed-loop."""
    import re as _re
    t = (track or "").strip()
    if not t:
        return False
    body = t[1:] if t[0] in "%;" else t
    pan = _re.sub(r"[^0-9]", "", body.split("^")[0] if "^" in body else (body.split("=")[0] if "=" in body else body))
    if pan and 13 <= len(pan) <= 19:
        s, alt = 0, False
        for ch in reversed(pan):
            d = ord(ch) - 48
            if alt:
                d *= 2
                if d > 9:
                    d -= 9
            s += d
            alt = not alt
        if s % 10 == 0:
            return True
    m = _re.search(r"\^([0-9]{4})([0-9]{3})", t)
    if m and m.group(2)[0] in ("1", "2"):
        return True
    m = _re.search(r"=([0-9]{4})([0-9]{3})", t)
    if m and m.group(2)[0] in ("1", "2"):
        return True
    return False

_MAGLAB_HTML = r"""<!DOCTYPE html>
<h1>MAG <span>LAB</span></h1>
<p class=sub>Browser magstripe studio — Chrome + Web Serial talks straight to your MSR605/606-class writer. No drivers, no desktop app, any OS. Encode, read, decode, batch-issue <b>closed-loop cards</b>: gift, loyalty, membership, event tickets, staff badges.</p>
<div class="card" style="border-color:var(--bad)">
<b>POLICY</b><br><span style="color:var(--dim)">__POLICY__</span>
</div>
<div class=grid2>
<div class=card>
<b>CONNECT</b>
<div style=margin:.6rem 0><button id=magconn>plug in writer</button> <span id=magstat style=color:var(--dim)>not connected</span></div>
<div style=color:var(--dim);font-size:.8rem>Chrome/Edge/Opera on Windows, macOS, Linux or ChromeOS. Firefox/Safari do not ship Web Serial. Writer must be an MSR605/606 or compatible serial MagStripe encoder.</div>
</div>
<div class=card>
<b>ISSUE A CARD</b>
<form id=magform style=margin:.6rem 0>
<div style=margin:.3rem 0><label>schema</label>
<select id=magschema>
<option value="gift">GIFT — serial + pin (track 2)</option>
<option value="loyal">LOYALTY — member# + tier (track 2)</option>
<option value="event">EVENT — event# + seat (t1+t2)</option>
<option value="staff">STAFF — employee# + dept (t1+t2)</option>
<option value="custom">CUSTOM — raw track editor</option>
</select></div>
<div id=magfields style=margin:.4rem 0></div>
<button>encode → writer</button> <button type=button id=magread>read card → decode</button>
</form>
<div id=magout style="margin-top:.6rem;font-size:.85rem;color:var(--dim)"></div>
</div>
</div>
<div class=card>
<b>BATCH ISSUE</b> <span style=color:var(--dim)>(20c/card — paste CSV lines: label,value)</span>
<textarea id=magcsv rows=4 style="width:100%;margin:.4rem 0" placeholder="GIFT001,1000&#10;GIFT002,2500&#10;STAFF-JANE,EMP1042"></textarea>
<button type=button id=magbatprep>prepare batch</button> <span id=magbatstat style=color:var(--dim)></span>
<div id=magbar style="display:none;margin:.5rem 0;height:14px;border:1px solid var(--line);border-radius:8px;overflow:hidden"><div id=magbarfill style="height:100%;width:0;background:linear-gradient(90deg,var(--acc),var(--acc2));transition:width .3s"></div></div>
<button type=button id=magprint style=margin-top:.5rem>🖨 print card faces</button>
</div>
<div class=card>
<b>TRACK VISUALIZER</b>
<div style=color:var(--dim);font-size:.8rem;margin:.3rem 0>paste any track to see its structure decoded (read-only field map; payment shapes are masked)</div>
<input id=magviz placeholder=";ABC=1234?" style=width:100%>
<pre id=magvizout style="margin:.5rem 0;color:var(--acc2);font-size:.75rem;white-space:pre-wrap"></pre>
</div>
<div class=card><b>API</b> <span style=color:var(--dim)>(agent-first — 30c/encode, 20c/card batch, via key)</span>
__AGENT__
</div>
<script>
var SCHEMAS = {
  gift:  {fields:[["serial","serial number"],["pin","4-7 digit pin"]], make:function(f){
    var pin=(f.pin||"").replace(/[^0-9]/g,""); if(pin.length<4) return {err:"pin needs 4+ digits"};
    var ser=(f.serial||"").replace(/[^A-Z0-9]/gi,"").toUpperCase(); if(!ser) return {err:"serial required"};
    var t2=";"+ser+"="+pin+"?"; return {t2:t2,label:"GIFT "+ser};}},
  loyal: {fields:[["member","member number"],["tier","tier letter (A-F)"]], make:function(f){
    var m=(f.member||"").replace(/[^0-9]/g,""); if(!m) return {err:"member # required"};
    var tier=(f.tier||"A").toUpperCase().replace(/[^A-F]/g,"")||"A";
    var t2=";"+m+"="+tier+Date.now().toString(36).slice(-4)+"?"; return {t2:t2,label:"LOYAL "+m};}},
  event: {fields:[["event","event id"],["seat","seat"]], make:function(f){
    var e=(f.event||"").replace(/[^A-Z0-9]/gi,"").toUpperCase(), s=(f.seat||"").replace(/[^A-Z0-9]/gi,"").toUpperCase();
    if(!e||!s) return {err:"event + seat required"};
    var t1="%"+e+"^"+s+"^"+new Date().toISOString().slice(2,10).replace(/-/g,"");
    var t2=";"+e+"="+s+"?"; return {t1:t1,t2:t2,label:"EVT "+e};}},
  staff: {fields:[["employee","employee #"],["dept","department"]], make:function(f){
    var e=(f.employee||"").replace(/[^0-9]/g,""), d=(f.dept||"").replace(/[^A-Z0-9]/gi,"").toUpperCase();
    if(!e) return {err:"employee # required"};
    var t1="%"+d+"^EMP"+e+"^"+new Date().toISOString().slice(2,10).replace(/-/g,"");
    var t2=";"+e+"="+d+"?"; return {t1:t1,t2:t2,label:"STAFF "+e};}},
  custom:{fields:[["t1","track 1 (raw)"],["t2","track 2 (raw)"]], make:function(f){
    return {t1:f.t1||"",t2:f.t2||"",label:"CUSTOM"};}}
};
var port=null, writer=null;
var BATCH=null, BATIDX=0;
function magLog(m){document.getElementById("magout").textContent=m}
document.getElementById("magschema").addEventListener("change",function(){
  var s=SCHEMAS[this.value], h="";
  s.fields.forEach(function(f){h+='<input id="mf_'+f[0]+'" placeholder="'+f[1]+'" style="width:100%;margin:.25rem 0">'});
  document.getElementById("magfields").innerHTML=h;
});
document.getElementById("magschema").dispatchEvent(new Event("change"));
document.getElementById("magconn").addEventListener("click",async function(){
  try{
    port=await navigator.serial.requestPort();
    await port.open({baudRate:9600});
    writer=port.writable.getWriter();
    document.getElementById("magstat").textContent="connected ✓";
  }catch(e){document.getElementById("magstat").textContent="error: "+e.message}
});
async function encodeCheck(t1,t2){
  var r=await fetch("/api/maglab/encode",{method:"POST",headers:{"Content-Type":"application/json","X-Requested-With":"maglab"},body:JSON.stringify({t1:t1||"",t2:t2||""})});
  return await r.json();
}
document.getElementById("magform").addEventListener("submit",async function(ev){
  ev.preventDefault();
  if(!writer){magLog("connect the writer first");return}
  if(BATCH && BATIDX<BATCH.length){
    var c=BATCH[BATIDX];
    magLog("writing "+(BATIDX+1)+"/"+BATCH.length+": "+c.label+" — insert blank card…");
    var cmd="\x1b[2S;"+c.t2.slice(1)+"\x04";
    await writer.write(new TextEncoder().encode(cmd));
    BATIDX++;
    document.getElementById("magbarfill").style.width=Math.round(100*BATIDX/BATCH.length)+"%";
    magLog("✓ "+BATIDX+"/"+BATCH.length+" written."+(BATIDX<BATCH.length?" next: "+BATCH[BATIDX].label:" BATCH COMPLETE ✓ — hit 🖨 print card faces"));
    return;
  }
  var sc=SCHEMAS[document.getElementById("magschema").value], f={};
  sc.fields.forEach(function(x){f[x[0]]=document.getElementById("mf_"+x[0]).value});
  var built=sc.make(f);
  if(built.err){magLog("✗ "+built.err);return}
  var j=await encodeCheck(built.t1,built.t2);
  if(!j.ok){magLog("✗ refused: "+(j.error||"unknown"));return}
  var cmds=[];
  if(built.t1)cmds.push("\x1b[1S;"+built.t1.slice(1)+"\x04");
  if(built.t2)cmds.push("\x1b[2S;"+built.t2.slice(1)+"\x04");
  for(const c of cmds){await writer.write(new TextEncoder().encode(c))}
  magLog("✓ encoded to card: "+built.label+"\n"+[built.t1,built.t2].filter(Boolean).join("\n"));
});
document.getElementById("magbatprep").addEventListener("click",async function(){
  var lines=document.getElementById("magcsv").value.split("\n").map(function(x){return x.trim()}).filter(Boolean)
    .map(function(x){var p=x.split(",");return {label:(p[0]||"").trim(),value:(p[1]||"").trim()}});
  if(!lines.length){document.getElementById("magbatstat").textContent="paste CSV first";return}
  var r=await fetch("/api/maglab/batch",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({rows:lines})});
  var j=await r.json();
  if(!j.ok){document.getElementById("magbatstat").textContent="✗ "+(j.error||"refused");return}
  BATCH=j.cards; BATIDX=0;
  document.getElementById("magbar").style.display="block"; document.getElementById("magbarfill").style.width="0";
  document.getElementById("magbatstat").textContent="ready: "+j.count+" cards · "+(j.cost_cents?("$"+(j.cost_cents/100).toFixed(2)+" charged"):"PASS");
});
document.getElementById("magprint").addEventListener("click",function(){
  if(!BATCH){magLog("prepare a batch first");return}
  var w=window.open("","_blank");
  var cards=BATCH.map(function(c){
    var qr="https://api.qrserver.com/v1/create-qr-code/?size=110x110&data="+encodeURIComponent(c.qr);
    return '<div class="cf"><div class="lbl">'+c.label+'</div><img src="'+qr+'" width="110" height="110"><div class="pin">PIN '+c.pin+'</div><div class="mk">dark0rbits · mag-lab · scan to activate</div></div>';
  }).join("");
  w.document.write('<html><head><title>card faces</title><style>body{font-family:-apple-system,sans-serif;background:#fff;color:#111}.cf{display:inline-block;width:3.37in;height:2.125in;border:1px dashed #999;border-radius:12px;margin:8px;padding:10px;text-align:center;vertical-align:top;page-break-inside:avoid}.lbl{font-weight:800;font-size:15px}.pin{font-size:12px;margin-top:4px;color:#333}.mk{font-size:9px;color:#888;margin-top:6px}.nopr{margin-bottom:10px}@media print{.nopr{display:none}}</style></head><body>');
  w.document.write('<div class=nopr><button onclick="print()">🖨 print</button> each QR is the card\'s digital twin — balance lookup by label+PIN</div>');
  w.document.write(cards+"</body></html>");
  w.document.close();
});
document.getElementById("magread").addEventListener("click",async function(){
  if(!port){magLog("connect the writer first");return}
  magLog("swipe a card, then paste the raw track into the visualizer below to decode");
});
document.getElementById("magviz").addEventListener("input",async function(){
  var v=this.value;
  if(v.length<4){return}
  var r=await fetch("/api/maglab/decode",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({track:v})});
  var j=await r.json();
  document.getElementById("magvizout").textContent=JSON.stringify(j,null,1);
});
</script>
"""

@app.route("/maglab")
def maglab():
    body = _MAGLAB_HTML.replace("__POLICY__", _MAG_POLICY)
    body = body.replace("__AGENT__", agent_card(
        "POST /api/maglab/encode {t1,t2} · POST /api/maglab/batch {rows:[{label,value}]}",
        "curl -X POST " + SITE + "/api/maglab/encode -H 'Authorization: Bearer KEY' -d '{\"t2\":\";GIFT000123=4321?\"}'",
        "Closed-loop magstripe studio. Encode validates + LRC-checks (30c), batch issues up to 100 cards with PINs + QR twins (20c/card). Refuses payment-card shapes."))
    body += gloss([("ISO 7811", "the magstripe track format standard - track1 79-bit alnum, track2/3 5-bit numeric"),
                   ("LRC", "longitudinal redundancy check - the trailing ? sentinel; wrong LRC = unreadable card"),
                   ("closed-loop", "a card scheme you own end-to-end: your shop issues it, your shop redeems it")])
    return page("maglab", body)

@app.route("/api/maglab/encode", methods=["POST"])
def api_maglab_encode():
    r = rate_limit("maglab", 20, 60)
    if r: return r
    uid = key_user() or current_user_id()
    if not uid:
        return jsonify({"ok": False, "error": "auth required: account session (sign up at /inbox, no KYC) or Authorization: Bearer *** key"}), 401
    if not has_pass(uid) and not charge(uid, 30, "maglab encode"):
        return jsonify({"ok": False, "error": "insufficient balance", "balance_cents": get_balance(uid), "topup": SITE + "/keys"}), 402
    t1 = str(jp("t1") or "").strip()
    t2 = str(jp("t2") or "").strip()
    if not t1 and not t2:
        return jsonify({"ok": False, "error": "at least one track required"}), 400
    for t in (t1, t2):
        if t and _mag_sentinel(t):
            return jsonify({"ok": False, "error": "refused: payment-network card shape detected - " + _MAG_POLICY[:120]}), 403
    for name, t in (("t1", t1), ("t2", t2)):
        if t and not t.endswith("?"):
            return jsonify({"ok": False, "error": name + " missing terminator '?' (LRC sentinel)"}), 400
    return jsonify({"ok": True, "ready": True, "t1": t1, "t2": t2})

@app.route("/api/maglab/batch", methods=["POST"])
def api_maglab_batch():
    r = rate_limit("maglab_batch", 6, 60)
    if r: return r
    uid = key_user() or current_user_id()
    if not uid:
        return jsonify({"ok": False, "error": "auth required: account session (sign up at /inbox, no KYC) or Authorization: Bearer *** key"}), 401
    rows = jp("rows")
    if not isinstance(rows, list) or not rows:
        return jsonify({"ok": False, "error": "rows: array of {label,value} required"}), 400
    if len(rows) > 100:
        return jsonify({"ok": False, "error": "max 100 cards per batch"}), 400
    pas = has_pass(uid)
    if not pas and not charge(uid, 20 * len(rows), "maglab batch x%d" % len(rows)):
        return jsonify({"ok": False, "error": "insufficient balance", "balance_cents": get_balance(uid), "topup": SITE + "/keys"}), 402
    made = []
    for i, row in enumerate(rows):
        label = str(row.get("label") or ("CARD%03d" % (i + 1)))[:40]
        value = str(row.get("value") or "").strip()
        if not value:
            return jsonify({"ok": False, "error": "row %d: value required" % (i + 1)}), 400
        pin = "".join(str(random.randrange(10)) for _ in range(6))
        t2 = ";" + re.sub(r"[^A-Z0-9]", "", value.upper()) + "=" + pin + "?"
        if _mag_sentinel(t2):
            return jsonify({"ok": False, "error": "row %d: refused, payment-card shape" % (i + 1)}), 403
        made.append({"label": label, "t2": t2, "pin": pin, "qr": SITE + "/card?card=" + label + ":" + pin})
    return jsonify({"ok": True, "count": len(made), "cards": made,
                    "cost_cents": 0 if pas else 20 * len(rows)})

@app.route("/api/maglab/decode", methods=["POST"])
def api_maglab_decode():
    r = rate_limit("maglab_dec", 40, 60)
    if r: return r
    t = str(jp("track") or "").strip()
    if not t:
        return jsonify({"ok": False, "error": "track required"}), 400
    if _mag_sentinel(t):
        return jsonify({"ok": False, "masked": True, "error": "payment-card shape - fields masked by policy"}), 200
    t1 = t.startswith("%")
    sep = "^" if t1 else "="
    body = t[1:] if t[0] in "%;" else t
    fields = body.rstrip("?").split(sep)
    return jsonify({"ok": True, "track": 1 if t1 else 2,
                    "format": "ISO7811-A" if t1 else "ISO7811-B",
                    "fields": [f[:40] for f in fields],
                    "lrc_sentinel": body.endswith("?"),
                    "note": "closed-loop decode"})


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000, threaded=True)