build(nix): fix binding link path — LDC_LIB is full .so path

binding.gyp appended '/libdatachannel.so.0.24.0' to LDC_LIB; nixpkgs output
layout is <out>/lib/libdatachannel.so.0.24.1. Make LDC_LIB the complete
library path (env or default) and drop the append.

.env.example

@@ -39,7 +39,7 @@ AUDIO_CHANNELS=2                        # Number of audio channels (default: 2)
 AVATAR_SIZE=64                          # User avatar size in pixels (default: 64)
 
 # === Webserver ===
-WEBSERVER_PORT=3001                     # Backend HTTP/WS server port (default: 3001)
+WEBSERVER_PORT=4001                     # Backend HTTP/WS server port (default: 4001)
 
 # === Connection ===
 VOICE_CONNECTION_TIMEOUT_MS=15000       # Voice connection timeout in ms (default: 15000)
@@ -55,7 +55,7 @@ VERBOSE=false                           # Enable verbose/debug logging (default:
 
 # === Database (PostgreSQL) ===
 # Option 1: Connection string (overrides individual params)
-# DATABASE_URL=postgresql://user:password@localhost:5432/discord_bot
+DATABASE_URL=postgresql://asephs:***@100.121.180.82:6432/dcbot
 
 # Option 2: Individual connection parameters
 POSTGRES_HOST=localhost                 # PostgreSQL host (default: localhost)
@@ -67,11 +67,11 @@ POSTGRES_POOL_MIN=2                     # Minimum pool connections (default: 2)
 POSTGRES_POOL_MAX=10                    # Maximum pool connections (default: 10)
 
 # === Redis ===
-REDIS_URL=redis://localhost:6379        # Redis connection string (default: redis://localhost:6379)
+REDIS_URL=redis://100.121.180.82:6379        # Redis connection string (default: redis://localhost:6379)
 
 # === Voice PCM WebSocket (direct gateway→backend, bypasses Redis) ===
 VOICE_PCM_WS_ENABLED=true               # Use direct WS for PCM audio (default: true)
-BACKEND_WS_URL=ws://backend:3000/ws     # Backend WebSocket URL for gateway PCM streaming
+BACKEND_WS_URL=ws://backend:4001/ws     # Backend WebSocket URL for gateway PCM streaming
 BACKEND_WS_TOKEN=                       # REQUIRED if VOICE_PCM_WS_ENABLED=true. Internal shared secret
 
 # === Attachments ===
@@ -90,7 +90,7 @@ AI_LLM_MODEL=text                       # LLM text model name (default: text)
 # AI_LLM_VISION_MODEL=                   # Vision model for image analysis (falls back to AI_LLM_MODEL)
 # AI_LLM_EMBEDDING_MODEL=                # Embedding model for semantic moderation cache (optional; enables near-duplicate text reuse to save LLM calls)
 # AI_LLM_EMBEDDING_MIN_SIMILARITY=0.97   # Min cosine similarity to reuse a cached verdict (default: 0.97)
-# QDRANT_URL=http://100.121.180.82:6333/ # Qdrant vector store for embeddings (semantic cache); when set, vectors are stored/searched in Qdrant instead of Postgres
+QDRANT_URL=http://100.121.180.82:6333        # Qdrant vector store for embeddings (semantic cache); when set, vectors are stored/searched in Qdrant instead of Postgres
 # QDRANT_COLLECTION=gmw_text_moderation  # Qdrant collection name (default: gmw_text_moderation)
 # QDRANT_API_KEY=                        # Qdrant API key (optional)
 AI_LLM_MAX_CONCURRENT=5                 # Max concurrent LLM API calls (default: 5)

.env.test.example

@@ -2,5 +2,5 @@ NODE_ENV=test
 # Use a separate database/data area for tests. It may be on the same PostgreSQL host,
 # but the database name must clearly be a test database so destructive test setup
 # cannot touch production data.
-TEST_DATABASE_URL=postgres://root:root@100.108.1.124:5432/hub_test
-DATABASE_URL=postgres://root:root@100.108.1.124:5432/hub_test
+TEST_DATABASE_URL=postgres://root:root@100.121.180.82:6432/hub_test
+DATABASE_URL=postgres://root:root@100.121.180.82:6432/hub_test

.github/workflows/deploy.yml

@@ -11,6 +11,7 @@ concurrency:
 
 permissions:
   contents: read
+  id-token: write
 
 env:
   VPS_HOST: ${{ secrets.VPS_HOST }}
@@ -66,7 +67,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        service: [backend, discord-gateway, proxy]
+        service: [backend, discord-gateway, proxy, frontend]
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -81,9 +82,24 @@ jobs:
           extra-conf: |
             sandbox = false
             accept-flake-config = true
+            # Attic binary cache as substituter on the runner: lets CI pull the
+            # prebuilt attic client (and any cached deps/builds) over HTTPS,
+            # no SSH round-trip needed. extra-substituters (NOT
+            # extra-trusted-substituters) is required — Determinate Nix never
+            # merges trusted-* substituters for nix-store CLI clients.
+            extra-substituters = https://attic.asepharyana.my.id/gmw
+            extra-trusted-public-keys = gmw:Fq2Anzuhkb+T/hftWnPcveHSi21/RzIgIOeG8pCJa88=
+            # NOTE: nix-installer-action unconditionally injects
+            # 'build-provenance-tags' into /etc/nix/nix.conf (a Determinate
+            # Nix-only setting). With determinate:false the runner's upstream
+            # nix warns 'unknown setting build-provenance-tags' on every
+            # invocation — benign, cosmetic. Switching determinate:true would
+            # silence it but changes the runner's nix flavor.
 
       - name: Cache Nix
         uses: DeterminateSystems/magic-nix-cache-action@v14
+        with:
+          use-flakehub: false
 
       - name: Build ${{ matrix.service }}
         id: build
@@ -104,17 +120,141 @@ jobs:
           ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
           ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
 
+      # Push build result to Attic binary cache (attic.asepharyana.my.id) so
+      # the VPS can substitute it instead of a single-stream `nix copy ssh://`.
+      #
+      # Fast path: push DIRECTLY from the runner to the public attic endpoint
+      # (validated 2026-08-10: token auth over public HTTPS works without
+      # Tailscale). This skips the ~794MB closure SSH copy to the VPS that
+      # used to take 25+ minutes per new store path.
+      #
+      # The attic client is NOT in nixpkgs anymore and has no prebuilt
+      # releases, so we pull the same prebuilt closure the VPS uses
+      # (/nix/store/fygyy3yk4rqdknxkiwkqambpnhyax0k4-attic-0.1.0, ~52MB).
+      # The closure itself lives in the attic cache (pushed once from the
+      # VPS), so the runner bootstraps it over HTTPS via the configured
+      # extra-substituters — no SSH round-trip. If that fails we fall back
+      # to `nix copy --from ssh://`, then the old VPS-hop flow (SSH copy to
+      # VPS, then attic push from the VPS over Tailscale) so the deploy step
+      # always has a working closure path.
+      - name: Push to Attic cache
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          if [ -z "$ATTIC_TOKEN" ]; then
+            echo "ATTIC_TOKEN not set; skipping attic push"
+            exit 0
+          fi
+          STORE_PATH="${{ steps.build.outputs.store-path }}"
+          ATTIC_DIR="/nix/store/fygyy3yk4rqdknxkiwkqambpnhyax0k4-attic-0.1.0"
+          ATTIC_BIN="$ATTIC_DIR/bin/attic"
+
+          attic_push_vps_hop() {
+            echo "Fallback: VPS-hop attic push"
+            # Copy closure to VPS (fast if attic already has it via substitute)
+            ssh "$VPS_USER@$VPS_HOST" "sudo /nix/var/nix/profiles/default/bin/nix-store --realise '$STORE_PATH'" 2>/dev/null \
+              || nix copy --to "ssh://$VPS_USER@$VPS_HOST" "$STORE_PATH"
+            # Push from VPS → Attic over Tailscale.
+            # --ignore-upstream-cache-filter is REQUIRED: without it, attic skips
+            # writing the narinfo to gmw when chunks exist in the upstream
+            # cache.nixos.org — leaving the path 404 on gmw so the VPS deploy's
+            # nix-store --realise can't find it and falls back to ssh copy.
+            # sudo: attic must read root's config (~/.config/attic), which has
+            # the imrnes-ts server → Tailscale. Non-root users' configs only
+            # have the public `pub` server → "Server imrnes-ts does not exist".
+            ssh "$VPS_USER@$VPS_HOST" "sudo $ATTIC_BIN push imrnes-ts:gmw '$STORE_PATH' --jobs 4 --ignore-upstream-cache-filter" \
+              || echo "attic push failed (non-fatal; ssh copy fallback below)"
+          }
+
+          # ── Get an attic client on the runner ────────────────────────────
+          # Order: PATH → pull the prebuilt closure from the attic cache
+          # itself (extra-substituters configured in Install Nix step, HTTPS
+          # only, no SSH) → pull over ssh from the VPS → VPS-hop.
+          # The attic client closure is stored in the attic cache (pushed
+          # once from the VPS), so the fast path never depends on SSH.
+          ATTIC_BIN=""
+          if command -v attic >/dev/null 2>&1; then
+            ATTIC_BIN="$(command -v attic)"
+          elif nix-store --realise "$ATTIC_DIR" 2>/tmp/attic-bootstrap.err; then
+            echo "✅ Pulled attic client from attic cache (HTTPS substituter)"
+            ATTIC_BIN="$ATTIC_DIR/bin/attic"
+          elif nix copy --from "ssh://$VPS_USER@$VPS_HOST" "$ATTIC_DIR" 2>>/tmp/attic-bootstrap.err; then
+            echo "✅ Pulled attic client from VPS over ssh"
+            ATTIC_BIN="$ATTIC_DIR/bin/attic"
+          else
+            echo "attic client unavailable on runner; using VPS-hop flow"
+            echo "--- bootstrap errors (stderr) ---"
+            tail -5 /tmp/attic-bootstrap.err 2>/dev/null || true
+            attic_push_vps_hop
+            exit 0
+          fi
+
+          # ── Direct push: runner → attic public endpoint ──────────────────
+          # --ignore-upstream-cache-filter forces the narinfo write even when
+          # the path's chunks already exist in upstream cache.nixos.org (which
+          # attic would otherwise skip, leaving the path 404 on the gmw cache).
+          mkdir -p "$HOME/.config/attic"
+          cat > "$HOME/.config/attic/config.toml" <<EOF
+          default-server = "pub"
+
+          [servers.pub]
+          endpoint = "https://attic.asepharyana.my.id"
+          token = "$ATTIC_TOKEN"
+          EOF
+          # Retry the direct push — a transient 502 (e.g. atticd restart,
+          # Traefik blip) must not abort the whole closure upload. attic push
+          # is idempotent, so re-running only uploads what's still missing.
+          push_ok=""
+          for attempt in 1 2 3; do
+            if "$ATTIC_BIN" push pub:gmw "$STORE_PATH" --jobs 4 --ignore-upstream-cache-filter; then
+              echo "✅ Pushed $STORE_PATH to attic directly from runner"
+              push_ok=1
+              break
+            fi
+            echo "⚠️ Direct attic push attempt $attempt/3 failed; retrying in 10s..."
+            sleep 10
+          done
+          if [ -z "$push_ok" ]; then
+            echo "Direct attic push failed after 3 attempts; using VPS-hop flow"
+            attic_push_vps_hop
+          fi
+
       # NOTE: env files /etc/gmw/backend.env & /etc/gmw/discord-gateway.env are
       # managed MANUALLY on the VPS (source of truth). CI only builds & deploys.
       - name: Deploy ${{ matrix.service }} to VPS
         run: |
           STORE_PATH="${{ steps.build.outputs.store-path }}"
           echo "=== Copying ${{ matrix.service }}: $STORE_PATH ==="
+          if [ -n "${{ secrets.ATTIC_TOKEN }}" ] && ssh "$VPS_USER@$VPS_HOST" "sudo /nix/var/nix/profiles/default/bin/nix-store --realise '$STORE_PATH'" 2>/dev/null; then
+            echo "Substituted ${{ matrix.service }} from Attic cache"
+          else
+            echo "Attic substitute failed; falling back to ssh copy"
             nix copy --to "ssh://$VPS_USER@$VPS_HOST" "$STORE_PATH"
+          fi
 
           echo "=== Updating profile ==="
           ssh "$VPS_USER@$VPS_HOST" "sudo /nix/var/nix/profiles/default/bin/nix-env --profile /nix/var/nix/profiles/gmw-${{ matrix.service }} --set '$STORE_PATH'"
 
-          echo "=== Restarting service ==="
-          ssh "$VPS_USER@$VPS_HOST" "sudo systemctl daemon-reload && sudo systemctl restart gmw-${{ matrix.service }} && sleep 3 && sudo systemctl is-active gmw-${{ matrix.service }}"
+          echo "=== Restarting service ===\n"
+                    ssh "$VPS_USER@$VPS_HOST" \
+                      "sudo systemctl daemon-reload && sudo systemctl restart gmw-${{ matrix.service }} && for i in \$(seq 1 15); do state=\$(sudo systemctl is-active gmw-${{ matrix.service }} 2>/dev/null || echo inactive); [ \"\$state\" = \"active\" ] && break; sleep 2; done; echo \"final-state=\$state\"; [ \"\$state\" = \"active\" ]" 
                     echo "✅ gmw-${{ matrix.service }} deployed"
+
+  cleanup:
+    # Bersihkan sampah Nix di VPS SETELAH semua deploy selesai: hapus generasi
+    # profile lama + nix store gc. Profil yang sedang dipakai tidak disentuh.
+    needs: build-and-deploy
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Nix GC on VPS
+        env:
+          VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+          ssh "$VPS_USER@$VPS_HOST" "sudo /usr/local/bin/nix-gc-vps.sh" || echo "⚠️ Nix GC gagal (non-fatal)"

.gitignore

@@ -12,7 +12,7 @@ worktrees/
 .worktrees/
 services/frontend/frontend/dist/
 target/
-
+nix/
 # Gitea CI runner logs
 .gitea/workflows/*.log
 

README.md

@@ -1,118 +0,0 @@
-# Bete — Discord Moderation Dashboard
-
-Bot monitoring Discord yang merekam voice channel, menangkap pesan teks, menyimpan attachment, menjalankan analisis AI opsional, dan menyediakan dashboard web real-time.
-
-**Stack utama:** Node.js (Express 5), pnpm, TypeScript, React 19 (Next.js 16), Tailwind v4, shadcn/ui, Drizzle ORM, PostgreSQL, WebSocket, Redis pub/sub.
-
-## Prasyarat
-
-- Node.js 22+
-- pnpm 11.x
-- FFmpeg di `PATH` (untuk audio muxing dan playback media)
-- `yt-dlp` di `PATH` (untuk resolve audio YouTube/Spotify)
-- Bun (untuk frontend dev — opsional, bisa pake pnpm)
-- PostgreSQL 15+
-
-## Setup
-
-```bash
-pnpm install
-cp .env.example .env
-# Edit .env sesuai konfigurasi server
-```
-
-## Menjalankan
-
-```bash
-# Backend (port 3001)
-pnpm run dev:backend
-
-# Discord Gateway (capture messages, voice, dll)
-pnpm run dev:discord-gateway
-
-# Frontend (port 3000)
-pnpm run dev:web
-```
-
-## Build
-
-```bash
-pnpm run build:backend
-pnpm run build:discord-gateway
-pnpm run build:web        # next build — static export ke out/
-pnpm run build             # build semua service
-```
-
-## Deploy
-
-```bash
-./deploy.sh                # Build + deploy semua service ke VPS
-./deploy.sh --frontend     # Frontend only
-./deploy.sh --backend      # Backend only
-./deploy.sh --no-build     # Skip build, copy files aja
-```
-
-## Service Architecture
-
-```
-Discord
-   |
-   v
-discord-gateway ←→ Redis ←→ backend (Express 5) ←→ frontend (Next.js)
-   |               pub/sub       |                        |
-   |                             +— REST API (/api/*)     |
-   |                             +— WebSocket (/ws)       |
-   +— message capture            +— AI moderation         |
-   +— voice recording             +— dashboard data        +— dashboard UI
-   +— attachment upload                                    +— real-time updates
-```
-
-## Fitur
-
-- **Message capture**: Capture pesan baru, edit, dan delete dari Discord
-- **Voice recording**: Rekam voice channel ke segmen OGG per user, streaming PCM real-time ke WebSocket
-- **Attachment upload**: Download + upload attachment ke external storage
-- **AI moderation**: Analisis pesan opsional via LLM, auto-delete, queue management
-- **Dashboard**: Messages feed, AI analysis review, voice connection, music player, recordings, user/channel stats
-- **Media playback**: Playback dari URL, file lokal, YouTube, Spotify
-- **WebSocket**: Real-time event streaming untuk semua aktivitas
-- **Public API**: Semua endpoint REST dan WebSocket dapat diakses tanpa autentikasi
-
-## Struktur Proyek
-
-```
-services/
-├── backend/                # Express 5 REST API + WebSocket server
-│   ├── src/modules/        # Feature modules (messages, voice, media, dll)
-│   └── src/http/           # Express app setup, middleware
-├── discord-gateway/        # Discord client, voice recording, AI analysis
-│   ├── src/modules/        # message-capture, voice-recording, ai-moderation
-│   └── src/shared/         # Config, database, Discord client
-└── frontend/               # Next.js 16 dashboard (static export)
-    ├── src/app/            # Pages (login, dashboard tabs)
-    ├── src/features/       # Feature components (dashboard, live, messages)
-    └── src/lib/            # API client, WebSocket, types
-packages/
-└── shared/                 # Shared types, errors, logger, utilities
-```
-
-## Database
-
-PostgreSQL via Drizzle ORM. Migrasi:
-
-```bash
-pnpm run db:generate   # Generate migration
-pnpm run db:migrate    # Apply migration
-pnpm run db:studio     # Drizzle Studio
-```
-
-## WebSocket Events
-
-Backend broadcast event berikut ke frontend via WebSocket:
-
-- `message_created`, `message_updated`, `message_deleted`, `message_analyzed`
-- `attachment_created`, `attachment_uploaded`
-- `voice_recording_started`, `voice_recording_stopped`, `voice_recording_uploaded`
-- `voice_active_user`, `voice_pcm_data`
-- `media_state`
-- `reaction_*`, `thread_*`, `presence_updated`, `guild_member_*`

flake.nix

@@ -11,6 +11,24 @@
       let
         pkgs = import nixpkgs { inherit system; };
 
+        # libdatachannel for the GoLive N-API binding. nixpkgs 0.24.1 is built
+        # against this host's glibc and ships both lib + dev headers, so the
+        # binding links cleanly inside the Nix sandbox (no manual cmake build).
+        libdatachannel = pkgs.libdatachannel;
+
+        # Source filter: `path:` literals do NOT respect .gitignore by default,
+        # so a dirty local out/ (stale chunks from previous builds) leaks into
+        # the sandbox. Filter out build artifacts explicitly.
+        filterSource = { dir, ignore }: builtins.path {
+          path = dir;
+          name = "source";
+          filter = (path: type: let base = baseNameOf path; in !(builtins.elem base ignore));
+        };
+        frontendSrc = filterSource {
+          dir = ./services/frontend;
+          ignore = [ "out" ".next" "node_modules" "pnpm-lock.yaml" ];
+        };
+
         # OpenSSL headers (.dev output) + STATIC libs (pkgsStatic.openssl.out —
         # node-datachannel's CMakeLists sets OPENSSL_USE_STATIC_LIBS=TRUE, and
         # the default `pkgs.openssl` resolves to `bin` which has no lib/) merged
@@ -46,6 +64,36 @@
           pnpm rebuild 2>&1 || true
         '';
 
+        # Shrink the shipped node_modules to production deps only. The full
+        # install's .pnpm virtual store carries dev-only packages (biome,
+        # typescript, esbuild, drizzle-kit, vitest, ... ~150MB+) that are never
+        # needed at runtime, so we delete every .pnpm dir that is not part of
+        # the resolved production graph (`pnpm list --prod`).
+        #
+        # NOTE: do NOT use `pnpm install --prod` here — it collapses the
+        # public-hoist dir (.pnpm/node_modules) that runtime peer resolution
+        # relies on (e.g. @lng2004/node-datachannel and @seydx/node-av-linux-x64
+        # are only reachable through it), silently breaking voice/screenshare.
+        # Instead we keep the full install's symlink layout and only prune
+        # orphaned package dirs + broken symlinks.
+        # Must run AFTER tsc (typescript is a devDep) and after native builds.
+        pruneProd = ''
+          echo "=== Pruning devDependencies (production-only node_modules) ==="
+          pnpm list --prod --depth 999 --parseable 2>/dev/null \
+            | grep -o '\.pnpm/[^/]*' | sort -u > $TMPDIR/prod-pnms.txt
+          ( cd node_modules/.pnpm \
+              && for d in */; do \
+                   d="''${d%/}"; \
+                   [ "$d" = "node_modules" ] && continue; \
+                   grep -qF ".pnpm/$d" $TMPDIR/prod-pnms.txt || rm -rf "$d"; \
+                 done ) || true
+          # Drop symlinks whose .pnpm target was pruned (top-level, scoped dirs,
+          # hoist, .bin — any depth). Mirrors stdenv's noBrokenSymlinks check,
+          # which would otherwise fail the fixupPhase.
+          find node_modules -type l ! -exec test -e {} \; -delete 2>/dev/null || true
+          du -sh node_modules
+        '';
+
         # ---- Backend ----
         backend = pkgs.stdenv.mkDerivation {
           pname = "gmw-backend";
@@ -84,7 +132,7 @@
               console.log('Fixed ' + count + ' files');
             "
             echo "=== Build complete ==="
-          '';
+          '' + pruneProd;
 
           installPhase = ''
             mkdir -p $out/lib/gmw-backend
@@ -119,6 +167,7 @@ WRAPPER
             pkgs.pkg-config
             pkgs.openssl
             pkgs.openssl.dev
+            libdatachannel.dev # rtc/rtc.hpp headers for the GoLive binding
             pkgs.git # libdatachannel FetchContent clones from GitHub
             pkgs.cacert
           ];
@@ -137,27 +186,34 @@ WRAPPER
             # pnpm rebuild aborts on the first failing package and runs scripts
             # from the wrong cwd — build each native dep explicitly with its own
             # install script. Each failure is tolerated (|| true); the packages
-            # that matter (opus, datachannel, node-av) are verified at runtime.
+            # that matter (opus) are verified at runtime.
             for pkg in \
-              node_modules/.pnpm/@discordjs+opus@*/node_modules/@discordjs/opus \
-              node_modules/.pnpm/@lng2004+node-datachannel@*/node_modules/@lng2004/node-datachannel \
-              node_modules/.pnpm/zeromq@*/node_modules/zeromq
+              node_modules/.pnpm/@discordjs+opus@*/node_modules/@discordjs/opus
             do
               if [ -d "$pkg" ]; then
                 echo "--- native build: $pkg ---"
                 (cd "$pkg" && npm run install 2>&1 || true)
-                # node-datachannel's `prebuild -r napi` CLI is broken (TypeError:
-                # expected first argument to be an array) — the install fallback
-                # populates devDeps incl. cmake-js; build directly via cmake-js.
-                if [ "$(basename "$pkg")" = "node-datachannel" ]; then
-                  echo "--- datachannel cmake-js compile ---"
-                  # Nix splits OpenSSL headers/libs across outputs — merge them
-                  # (opensslDevEnv) so FindOpenSSL finds both include + libcrypto.
-                  (cd "$pkg" && OPENSSL_ROOT_DIR="${opensslDevEnv}" npm run compile 2>&1 || true)
-                fi
               fi
             done
-            echo "=== Compiling TypeScript ==="
+            echo "=== Building libdatachannel-min N-API binding ==="
+            # The GoLive screen-share stack uses a minimal N-API binding
+            # (native/libdatachannel-min) over nixpkgs libdatachannel.
+            (
+              cd native/libdatachannel-min
+              # binding.gyp resolves include/lib from env (LDC_INCLUDE = .dev
+              # include root, LDC_LIB = lib output dir, NAPI_INCLUDE =
+              # node-addon-api include root).
+              NAPI_INCLUDE=$(find ../../node_modules/.pnpm -maxdepth 3 \
+                -type d -path "*node_modules/node-addon-api" | head -1)
+              echo "NAPI_INCLUDE=$NAPI_INCLUDE"
+              LDC_INCLUDE=${libdatachannel.dev} LDC_LIB=${libdatachannel.out}/lib/libdatachannel.so.0.24.1 \
+                NAPI_INCLUDE=$NAPI_INCLUDE \
+                npx node-gyp rebuild 2>&1 || true
+              ls -la build/Release/datachannel_min.node 2>/dev/null \
+                && echo "libdatachannel-min binding OK: $(stat -c%s build/Release/datachannel_min.node) bytes" \
+                || echo "WARN: libdatachannel-min binding build FAILED (screen share disabled)"
+            )
+            echo "=== Compiling TypeScript ===="
             npx tsc 2>&1
             echo "=== Fixing @/ path aliases to relative paths ==="
             node -e "
@@ -185,12 +241,28 @@ WRAPPER
               console.log('Fixed ' + count + ' files');
             "
             echo "=== Build complete ==="
-          '';
+          '' + pruneProd;
 
           installPhase = ''
             mkdir -p $out/lib/gmw-discord-gateway
             cp -r dist node_modules package.json tsconfig.json $out/lib/gmw-discord-gateway/
 
+            # GoLive native binding — loadNative resolves it relative to
+            # dist/goLive/native.js, i.e. <root>/native/libdatachannel-min/
+            # build/Release/datachannel_min.node; libdatachannel .so must sit
+            # next to it and be on LD_LIBRARY_PATH at runtime.
+            mkdir -p $out/lib/gmw-discord-gateway/native/libdatachannel-min/build/Release
+            cp native/libdatachannel-min/build/Release/datachannel_min.node \
+              $out/lib/gmw-discord-gateway/native/libdatachannel-min/build/Release/ 2>/dev/null || true
+            mkdir -p $out/lib/gmw-discord-gateway/native/libdatachannel-min/build/ldc
+            cp -rL native/libdatachannel-min/build/ldc/libdatachannel.so* \
+              $out/lib/gmw-discord-gateway/native/libdatachannel-min/build/ldc/ 2>/dev/null || true
+            # If the binding failed to build, screen share is simply disabled —
+            # the gateway itself must still start.
+            if [ ! -f $out/lib/gmw-discord-gateway/native/libdatachannel-min/build/Release/datachannel_min.node ]; then
+              echo "WARN: datachannel_min.node missing — GoLive screen share disabled in this build"
+            fi
+
             # Also include drizzle migrations if they exist
             cp -r drizzle $out/lib/gmw-discord-gateway/ 2>/dev/null || true
 
@@ -199,6 +271,7 @@ WRAPPER
 #!${pkgs.runtimeShell}
 cd $out/lib/gmw-discord-gateway
 export PATH=${pkgs.ffmpeg-headless}/bin:${pkgs.yt-dlp}/bin:\$PATH
+export LD_LIBRARY_PATH=${libdatachannel.out}/lib:\$LD_LIBRARY_PATH
 exec ${nodejs}/bin/node dist/index.js
 WRAPPER
             chmod +x $out/bin/gmw-discord-gateway
@@ -210,39 +283,57 @@ WRAPPER
           };
         };
 
-        # ---- Frontend (Next.js static export) ----
+        # ---- Frontend (Next.js SSR standalone) ----
         frontend = pkgs.stdenv.mkDerivation {
           pname = "gmw-frontend";
           version = "1.0.0";
 
-          src = ./services/frontend;
+          src = frontendSrc;
 
           nativeBuildInputs = [ nodejs pnpm pkgs.gnumake pkgs.gcc pkgs.cacert ];
 
           buildPhase = pnpmInstall + ''
-            echo "=== Building Next.js static export ==="
-            # Build args are provided as env vars
+            echo "=== Building Next.js SSR (standalone) ==="
             export NEXT_TELEMETRY_DISABLED=1
+            export GMW_BACKEND_URL=http://127.0.0.1:4001
             npx next build 2>&1
           '';
 
           installPhase = ''
-            mkdir -p $out/share/gmw-frontend
-            cp -r out $out/share/gmw-frontend/out 2>/dev/null || \
-            cp -r dist $out/share/gmw-frontend/dist 2>/dev/null || \
-            cp -r .next $out/share/gmw-frontend/.next 2>/dev/null || true
+            echo "=== Packaging standalone server ==="
+            mkdir -p $out/lib/gmw-frontend/standalone
+            # The standalone server bundles its own minimal node_modules but
+            # needs the build assets + public copied INSIDE its tree.
+            cp -r .next/standalone/. $out/lib/gmw-frontend/standalone/
+            mkdir -p $out/lib/gmw-frontend/standalone/.next
+            cp -r .next/static $out/lib/gmw-frontend/standalone/.next/static
+            cp -r public $out/lib/gmw-frontend/standalone/public 2>/dev/null || true
 
-            # Copy node_modules for standalone mode if it exists
-            cp -r node_modules $out/share/gmw-frontend/ 2>/dev/null || true
+            # Remove dangling symlinks left by pnpm's hoisted .pnpm layout
+            # (e.g. node_modules/.pnpm/node_modules/...). The standalone server
+            # never resolves those at runtime — it bundles its own node_modules
+            # — and they trip stdenv's noBrokenSymlinks check.
+            find $out/lib/gmw-frontend/standalone -type l \
+              ! -exec test -e {} \; -delete 2>/dev/null || true
+
+            mkdir -p $out/bin
+            cat > $out/bin/gmw-frontend << WRAPPER
+#!${pkgs.runtimeShell}
+cd $out/lib/gmw-frontend/standalone
+export PORT=''${GMW_FRONTEND_PORT:-4017}
+export HOSTNAME=127.0.0.1
+exec ${nodejs}/bin/node server.js
+WRAPPER
+            chmod +x $out/bin/gmw-frontend
           '';
 
           meta = {
-            description = "GMW Frontend — Next.js static dashboard";
+            description = "GMW Frontend — Next.js SSR dashboard";
             platforms = pkgs.lib.platforms.linux;
           };
         };
 
-        # ---- Proxy (nginx serving frontend) ----
+        # ---- Proxy (nginx: / -> Next SSR, /api + /ws -> backend) ----
         proxy = pkgs.stdenv.mkDerivation {
           pname = "gmw-proxy";
           version = "1.0.0";
@@ -257,9 +348,8 @@ WRAPPER
             mkdir -p $out/bin $out/etc $out/share
 
             # Substitute placeholders in nginx template
-            sed \
-              -e "s|@NGINX_MIME@|${pkgs.nginx}/conf/mime.types|g" \
-              -e "s|@FRONTEND_ROOT@|${frontend}/share/gmw-frontend/out|g" \
+            sed -e "s|@NGINX_MIME@|${pkgs.nginx}/conf/mime.types|g" \
+                -e "s|@NEXT_PORT@|4017|g" \
                 ${./infra/nix/nginx.conf.template} \
                 > $out/etc/nginx.conf
 
@@ -271,7 +361,7 @@ WRAPPER
           '';
 
           meta = {
-            description = "GMW Proxy — nginx serving frontend";
+            description = "GMW Proxy — nginx -> Next.js + backend";
             platforms = pkgs.lib.platforms.linux;
           };
         };

infra/docker/Dockerfile.backend

@@ -33,9 +33,9 @@ COPY --from=builder --chown=node:node /build/node_modules ./node_modules
 COPY --from=builder --chown=node:node /build/package.json ./
 
 USER node
-EXPOSE 3000
+EXPOSE 4001
 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:3000/api/health',r=>process.exit(r.statusCode===200?0:1))"
+  CMD node -e "require('http').get('http://localhost:4001/api/health',r=>process.exit(r.statusCode===200?0:1))"
 
 CMD ["node", "dist/index.js"]

infra/docker/docker-compose.yml

@@ -33,9 +33,9 @@ services:
       - .env
     environment:
       NODE_ENV: production
-      WEBSERVER_PORT: 3000
+      WEBSERVER_PORT: 4001
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
+      test: ["CMD", "wget", "-qO-", "http://localhost:4001/api/health"]
       interval: 30s
       timeout: 10s
       start_period: 15s

infra/nix/nginx.conf.template

@@ -11,28 +11,44 @@ http {
     ''      close;
   }
 
+  # Next.js standalone SSR server (backend-fetching on every render).
+  # Not for hand-editing: @NEXT_PORT@ is substituted at build time.
+  upstream gmw_next {
+    server 127.0.0.1:@NEXT_PORT@;
+    keepalive 16;
+  }
+
+  upstream gmw_backend {
+    server 127.0.0.1:4001;
+    keepalive 16;
+  }
+
   server {
-    listen 8080;
+    listen 4009;
     server_name _;
 
     # Use relative redirects (Location: /dashboard/) instead of absolute
-    # URLs that leak the internal listen port (8080) through Traefik.
+    # URLs that leak the internal listen port (4009) through the reverse proxy.
     absolute_redirect off;
 
     gzip on;
     gzip_types text/plain text/css application/json application/javascript application/wasm image/svg+xml;
     gzip_min_length 256;
 
+    # ── Backend REST ───────────────────────────────────────────────
     location ^~ /api {
-      proxy_pass http://127.0.0.1:3001$uri$is_args$args;
+      proxy_pass http://gmw_backend$uri$is_args$args;
+      proxy_http_version 1.1;
+      proxy_set_header Connection "";   # keepalive to backend
       proxy_set_header Host              $host;
       proxy_set_header X-Real-IP         $remote_addr;
       proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
     }
 
+    # ── Backend WebSocket (realtime shared state + voice PCM) ──────
     location ^~ /ws {
-      proxy_pass http://127.0.0.1:3001$uri$is_args$args;
+      proxy_pass http://gmw_backend$uri$is_args$args;
       proxy_http_version 1.1;
       proxy_set_header Upgrade              $http_upgrade;
       proxy_set_header Connection           $connection_upgrade;
@@ -45,16 +61,30 @@ http {
       proxy_send_timeout 86400s;
     }
 
-    location /assets/ {
-      root @FRONTEND_ROOT@;
+    # ── Next.js build assets — immutable, edge/shareable ───────────
+    location ^~ /_next/static/ {
+      proxy_pass http://gmw_next$uri$is_args$args;
+      proxy_http_version 1.1;
+      proxy_set_header Host              $host;
+      proxy_set_header X-Real-IP         $remote_addr;
+      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
       expires 1y;
       add_header Cache-Control "public, immutable";
     }
 
+    # ── Everything else → Next.js server (SSR) ──
     location / {
-      root @FRONTEND_ROOT@;
-      index index.html;
-      try_files $uri $uri/ /index.html;
+      proxy_pass http://gmw_next$uri$is_args$args;
+      proxy_http_version 1.1;
+      proxy_set_header Connection "";
+      proxy_set_header Host              $host;
+      proxy_set_header X-Real-IP         $remote_addr;
+      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Next-Prefetch  $http_x_next_prefetch;
+      proxy_buffering off;
+      proxy_read_timeout 30s;
     }
   }
 }

scripts/fix-missing-tables.sql

@@ -1,5 +1,5 @@
 -- Fix: missing messages and attachments tables on VPS
--- Run: PGPASSWORD=hunterz psql -h 100.108.1.124 -U asephs -d hub -f scripts/fix-missing-tables.sql
+-- Run: PGPASSWORD=hunterz psql -h 100.121.180.82 -U asephs -d hub -f scripts/fix-missing-tables.sql
 
 BEGIN;
 

services/backend/ARCHITECTURE.md

@@ -225,21 +225,21 @@ All config via environment variables (`.env`), validated with Zod in `shared/con
 
 ```env
 # Server
-WEBSERVER_PORT=3001
+WEBSERVER_PORT=4001
 NODE_ENV=development
 LOG_LEVEL=info
 
 # Database
-DATABASE_URL=postgresql://user:pass@localhost:5432/discord_moderation
+DATABASE_URL=postgresql://asephs:***@100.121.180.82:6432/discord_moderation
 # OR
-DATABASE_HOST=localhost
-DATABASE_PORT=5432
+DATABASE_HOST=100.121.180.82
+DATABASE_PORT=6432
 DATABASE_NAME=discord_moderation
 DATABASE_USER=postgres
 DATABASE_PASSWORD=secret
 
 # Redis (optional, for pub/sub)
-REDIS_URL=redis://localhost:6379
+REDIS_URL=redis://100.121.180.82:6379
 
 # Discord
 MONITOR_GUILD_ID=123456789
@@ -263,7 +263,7 @@ Use Vitest with mocked database and services.
 2. **Implement repository queries** for each module using Drizzle ORM
 3. **Add WebSocket server** in `src/ws/server.ts` with Redis pub/sub listener
 4. **Create Discord Gateway service** in `services/discord-gateway/` (separate microservice)
-5. **Add Docker & CI/CD** for multi-service deployment
+5. **Add Nix & CI/CD** for multi-service deployment (flake.nix + GitHub Actions → nix copy → systemd)
 6. **Write integration tests** for full request flow
 
 ## Circular Dependency Check

services/backend/src/e2e.test.ts

@@ -1,10 +1,10 @@
 /**
  * E2E API tests — runs against a running backend instance.
- * Usage: API_BASE=http://localhost:3001 vitest run
+ * Usage: API_BASE=http://localhost:4001 vitest run
  */
 import { describe, expect, it } from "vitest";
 
-const BASE = process.env.API_BASE ?? "http://localhost:3001/api";
+const BASE = process.env.API_BASE ?? "http://localhost:4001/api";
 
 async function api(path: string, init?: RequestInit) {
   const res = await fetch(`${BASE}${path}`, {

services/backend/src/http/app.ts

@@ -13,6 +13,7 @@ import { createDashboardRouter } from "../modules/dashboard/index.js";
 import { createHealthRouter } from "../modules/health/index.js";
 import { createMediaRouter } from "../modules/media/index.js";
 import { createMessagesRouter } from "../modules/messages/index.js";
+import { createModerationRouter } from "../modules/moderation/index.js";
 import { createRecordingsRouter } from "../modules/recordings/index.js";
 import { createUiStateRouter } from "../modules/ui-state/index.js";
 import { createVoiceRouter } from "../modules/voice/index.js";
@@ -69,6 +70,7 @@ export function createHttpApp(): Express {
   app.use("/api", createUiStateRouter());
   app.use("/api", createMediaRouter());
   app.use("/api", createVoiceRouter());
+  app.use("/api", createModerationRouter());
 
   // 404 handler
   app.use((_req: Request, res: Response) => {

services/backend/src/index.ts

@@ -24,6 +24,15 @@ async function main() {
 async function shutdown(signal: string) {
   logger.info({ signal }, "Shutting down gracefully");
 
+  // Failsafe: graceful shutdown must never hang the process forever.
+  // httpServer.close() waits for ALL open connections (including lingering
+  // WebSocket/keep-alive sockets), so on a stuck connection the process would
+  // otherwise sit zombie and systemd (Restart=always) can never revive it.
+  const forceExitTimer = setTimeout(() => {
+    logger.error({ signal }, "Graceful shutdown timed out; forcing exit");
+    process.exit(1);
+  }, 10_000);
+
   try {
     // 1. Stop accepting new HTTP connections
     if (httpServer) {
@@ -54,9 +63,11 @@ async function shutdown(signal: string) {
     );
 
     logger.info("Graceful shutdown completed");
+    clearTimeout(forceExitTimer);
     process.exit(0);
   } catch (err) {
     logger.error({ err }, "Error during graceful shutdown");
+    clearTimeout(forceExitTimer);
     process.exit(1);
   }
 }

services/backend/src/modules/chatbot/chatbot.controller.ts

@@ -9,6 +9,18 @@ interface AuthenticatedRequest extends Request {
   userId?: string;
 }
 
+/**
+ * Resolve the actor id for a request. Frontend (no-login) sends a per-device
+ * UUID via X-User-Id so chat history stays isolated per visitor; a registered
+ * auth middleware userId takes precedence when present.
+ */
+function resolveUserId(req: Request): string {
+  const authId = (req as AuthenticatedRequest).userId;
+  if (authId) return authId;
+  const header = (req.headers["x-user-id"] as string | undefined)?.trim();
+  return header || "anonymous";
+}
+
 export const handleChatbotChat = asyncHandler(
   async (req: Request, res: Response) => {
     const { message, context } = req.body as {
@@ -24,8 +36,8 @@ export const handleChatbotChat = asyncHandler(
       });
     }
 
-    // Get user ID from auth middleware (if available)
-    const userId = (req as AuthenticatedRequest).userId || "anonymous";
+    // Get user ID from X-User-Id header (no-login device uuid) or auth
+    const userId = resolveUserId(req);
 
     logger.debug(
       { userId, messageLength: message.length, context },
@@ -59,7 +71,7 @@ export const handleChatbotChat = asyncHandler(
 
 export const getChatbotHistory = asyncHandler(
   async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId || "anonymous";
+    const userId = resolveUserId(req);
     const limit = Math.min(parseInt(req.query.limit as string, 10) || 50, 100);
 
     const history = await chatbotService.getChatHistory(userId, limit);
@@ -73,7 +85,7 @@ export const getChatbotHistory = asyncHandler(
 
 export const clearChatbotHistory = asyncHandler(
   async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId || "anonymous";
+    const userId = resolveUserId(req);
 
     await chatbotService.clearChatHistory(userId);
 

services/backend/src/modules/chatbot/chatbot.service.ts

@@ -6,6 +6,7 @@ import type {
   SaveConversationInput,
 } from "./chatbot.repository.js";
 import { chatbotRepository } from "./chatbot.repository.js";
+import { executeTool, tools } from "./chatbot.tools.js";
 
 const logger = createChildLogger("chatbot.service");
 
@@ -118,41 +119,104 @@ Gaya ngobrol:
     try {
       const { default: axios } = await import("axios");
 
-      // Gateway tidak handle role system — gabung konteks ke user message
+      // Gateway tidak handle role system — gabung konteks ke user message.
+      // The system section stays visible to the model as the first user turn.
       const contextPrefixed = `${systemPrompt}\n\nPertanyaan user: ${userMessage}`;
 
-      const messages: Array<{ role: "user" | "assistant"; content: string }> = [
-        ...history,
-        { role: "user", content: contextPrefixed },
-      ];
+      // Seed conversation: prior turns + current question.
+      const messages: Array<
+        | { role: "user" | "assistant"; content: string }
+        | {
+            role: "assistant";
+            content: string | null;
+            tool_calls: Array<{
+              id: string;
+              type: "function";
+              function: { name: string; arguments: string };
+            }>;
+          }
+        | { role: "tool"; tool_call_id: string; content: string }
+      > = [...history, { role: "user", content: contextPrefixed }];
 
+      // ── Agentic tool loop ─────────────────────────────────────────
+      const MAX_TOOL_ROUNDS = 4;
+      for (let round = 0; round <= MAX_TOOL_ROUNDS; round += 1) {
         const response = await axios.post(
           `${baseUrl}/chat/completions`,
           {
             model,
             messages,
-          max_tokens: 500,
+            tools,
+            tool_choice: "auto",
+            max_tokens: 600,
             temperature: 0.4,
+            stream: true,
           },
           {
             headers: {
               Authorization: `Bearer ${apiKey}`,
               "Content-Type": "application/json",
             },
-          timeout: 30_000,
+            timeout: 45_000,
+            // 9router returns SSE even without stream:true; force stream:true
+            // in the body and read the raw SSE text.
+            responseType: "text",
           },
         );
 
-      const result = response.data as {
-        choices?: Array<{ message?: { content?: string } }>;
-      };
-      const content = result?.choices?.[0]?.message?.content?.trim();
+        // Parse SSE `data:` lines → content + tool_calls.
+        const { content, toolCalls } = this.parseSse(response.data as string);
 
-      if (content) {
-        return content;
+        logger.debug(
+          {
+            round,
+            hasToolCalls: toolCalls.length > 0,
+            toolNames: toolCalls.map((t) => t.name),
+          },
+          "LLM round parsed",
+        );
+
+        if (toolCalls.length > 0) {
+          // Execute each tool, append tool results, continue loop.
+          for (const tc of toolCalls) {
+            messages.push({
+              role: "assistant",
+              content: null,
+              tool_calls: [
+                {
+                  id: tc.id,
+                  type: "function",
+                  function: { name: tc.name, arguments: tc.arguments },
+                },
+              ],
+            });
+            let result = "";
+            try {
+              result = await executeTool(tc.name, tc.args);
+            } catch (e) {
+              result = `Tool error: ${(e as Error).message}`;
+            }
+            messages.push({
+              role: "tool",
+              tool_call_id: tc.id,
+              content: result,
+            });
+          }
+          if (round === MAX_TOOL_ROUNDS) {
+            logger.warn("Hit max tool rounds; returning what we have");
+          }
+          continue;
         }
 
-      logger.warn({ response: result }, "LLM returned empty response");
+        if (content?.trim()) {
+          return content.trim();
+        }
+
+        logger.warn("LLM returned empty response (no tools, no content)");
+        return this.fallbackResponse(userMessage);
+      }
+
+      logger.warn("Tool loop exhausted without final content");
       return this.fallbackResponse(userMessage);
     } catch (error) {
       logger.warn({ error }, "LLM call failed, using fallback response");
@@ -160,6 +224,93 @@ Gaya ngobrol:
     }
   }
 
+  /**
+   * Parse an SSE stream body into accumulated content + any tool_calls.
+   * 9router (and most OpenAI-compatible routers) emit `data: {json}` lines
+   * even when stream is only implied; we must collect deltas manually.
+   */
+  private parseSse(body: string): {
+    content: string;
+    toolCalls: Array<{
+      id: string;
+      name: string;
+      arguments: string;
+      args: Record<string, unknown>;
+    }>;
+  } {
+    const contentParts: string[] = [];
+    const toolById = new Map<
+      string,
+      { id: string; name: string; arguments: string }
+    >();
+
+    const lines = body.split("\n");
+    for (const rawLine of lines) {
+      const line = rawLine.trim();
+      if (!line.startsWith("data:")) continue;
+      const payload = line.slice(5).trim();
+      if (!payload || payload === "[DONE]") continue;
+      try {
+        const json = JSON.parse(payload) as {
+          choices?: Array<{
+            delta?: {
+              content?: string;
+              tool_calls?: Array<{
+                id?: string;
+                index?: number;
+                type?: string;
+                function?: { name?: string; arguments?: string };
+              }>;
+            };
+            finish_reason?: string | null;
+          }>;
+        };
+        const delta = json.choices?.[0]?.delta;
+        if (!delta) continue;
+        if (delta.content) contentParts.push(delta.content);
+        if (delta.tool_calls) {
+          for (const tc of delta.tool_calls) {
+            const idx = String(tc.index ?? 0);
+            const cur = toolById.get(idx) ?? {
+              id: tc.id ?? "",
+              name: "",
+              arguments: "",
+            };
+            // Keep the first non-empty id for this call index.
+            if (tc.id && !cur.id) cur.id = tc.id;
+            if (tc.function?.name) cur.name += tc.function.name;
+            if (tc.function?.arguments) cur.arguments += tc.function.arguments;
+            toolById.set(idx, cur);
+          }
+        }
+      } catch {
+        // Skip malformed lines (keepalives, etc.)
+      }
+    }
+
+    // Build a de-duplicated id for any call the stream never assigned one.
+    let fallbackId = 0;
+    const toolCalls = Array.from(toolById.values()).map((tc) => {
+      const id = tc.id || `tool_${fallbackId++}_${Date.now()}`;
+      return {
+        id,
+        name: tc.name,
+        arguments: tc.arguments,
+        args: this.safeJsonParse(tc.arguments),
+      };
+    });
+
+    return { content: contentParts.join(""), toolCalls };
+  }
+
+  private safeJsonParse(s: string): Record<string, unknown> {
+    try {
+      return JSON.parse(s) as Record<string, unknown>;
+    } catch {
+      return {};
+    }
+  }
+
   private fallbackResponse(input: string): string {
     const lower = input.toLowerCase();
 

services/backend/src/modules/chatbot/chatbot.tools.ts

@@ -0,0 +1,232 @@
+import { sql } from "drizzle-orm";
+import { getDatabase } from "../../shared/database/index.js";
+
+/**
+ * Tools the chatbot LLM can call. Definitions describe the schema to the
+ * model; the executor implements each one against the real database.
+ * This turns the chatbot from "blind stats guesser" into an agent that
+ * pulls real, current server data on demand.
+ */
+
+export type ToolResult = string;
+
+/** JSON schema for a tool definition (OpenAI function-calling format). */
+export interface ToolDef {
+  type: "function";
+  function: {
+    name: string;
+    description: string;
+    parameters: {
+      type: "object";
+      properties: Record<string, unknown>;
+      required?: string[];
+    };
+  };
+}
+
+export const tools: ToolDef[] = [
+  {
+    type: "function",
+    function: {
+      name: "get_server_stats",
+      description:
+        "Ambil statistik ringkas server/guild saat ini: total pesan, user aktif, jumlah pesan flagged, dan jumlah warning. Panggil ini untuk menjawab pertanyaan umum tentang kondisi server. Opsional fill guild_id untuk scope ke guild tertentu, channel_id untuk scope ke channel.",
+      parameters: {
+        type: "object",
+        properties: {
+          guildId: {
+            type: "string",
+            description: "ID guild/server (opsional). Kosongkan = semua data.",
+          },
+          channelId: {
+            type: "string",
+            description: "ID channel (opsional).",
+          },
+        },
+      },
+    },
+  },
+  {
+    type: "function",
+    function: {
+      name: "get_top_channels",
+      description:
+        "Ambil daftar channel paling aktif (jumlah pesan terbanyak) di server. Panggil buat jawab 'channel mana paling ramai' atau aktivitas per-channel.",
+      parameters: {
+        type: "object",
+        properties: {
+          guildId: {
+            type: "string",
+            description: "ID server (opsional).",
+          },
+          limit: {
+            type: "number",
+            description: "Jumlah channel teratas (default 5, max 10).",
+          },
+        },
+      },
+    },
+  },
+  {
+    type: "function",
+    function: {
+      name: "get_recent_activity",
+      description:
+        "Ambil aktivitas/pesan terbaru di server: siapa yang baru ngomong, di channel mana, jam berapa. Panggil buat jawaban soal 'lagi ngapain' / aktivitas terbaru di server.",
+      parameters: {
+        type: "object",
+        properties: {
+          guildId: {
+            type: "string",
+            description: "ID server (opsional).",
+          },
+          limit: {
+            type: "number",
+            description: "Jumlah pesan terakhir (default 5).",
+          },
+        },
+      },
+    },
+  },
+  {
+    type: "function",
+    function: {
+      name: "get_top_flagged",
+      description:
+        "Ambil pesan yang paling sering di-flag atau kena warning. Panggil buat jawab soal pesan bermasalah / moderator.",
+      parameters: {
+        type: "object",
+        properties: {
+          guildId: {
+            type: "string",
+            description: "ID server (opsional).",
+          },
+          limit: {
+            type: "number",
+            description: "Jumlah pesan (default 5).",
+          },
+        },
+      },
+    },
+  },
+];
+
+/** Executes a tool call against the real DB and returns a readable result. */
+export async function executeTool(
+  name: string,
+  args: Record<string, unknown>,
+): Promise<string> {
+  const guildId =
+    typeof args.guildId === "string" && args.guildId ? args.guildId : undefined;
+  const channelId =
+    typeof args.channelId === "string" && args.channelId
+      ? args.channelId
+      : undefined;
+  const limitRaw =
+    typeof args.limit === "number" ? args.limit : Number(args.limit) || 5;
+  const limit = Math.min(Math.max(1, Math.round(limitRaw)), 10);
+
+  try {
+    switch (name) {
+      case "get_server_stats":
+        return await serverStats(guildId, channelId);
+      case "get_top_channels":
+        return await topChannels(guildId, limit);
+      case "get_recent_activity":
+        return await recentActivity(guildId, limit);
+      case "get_top_flagged":
+        return await topFlagged(guildId, limit);
+      default:
+        return `Unknown tool: ${name}`;
+    }
+  } catch (error) {
+    // Best-effort: if a tool fails, return readable error instead of crashing
+    return `Terjadi kesalahan saat ambil data: ${(error as Error).message ?? "unknown"}`;
+  }
+}
+
+// ── Tool executors ──────────────────────────────────────────
+
+async function serverStats(
+  guildId?: string,
+  channelId?: string,
+): Promise<string> {
+  const db = getDatabase();
+  const conditions: string[] = [];
+  if (guildId) conditions.push(`guild_id = '${guildId}'`);
+  if (channelId) conditions.push(`channel_id = '${channelId}'`);
+  const cond = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+
+  const result = await db.execute(
+    sql.raw(
+      `SELECT COUNT(*)::int AS total_messages,
+              COUNT(DISTINCT user_id)::int AS active_users,
+              COUNT(*) FILTER (WHERE ai_status = 'flagged')::int AS flagged,
+              COUNT(*) FILTER (WHERE ai_status = 'warn')::int AS warned
+       FROM messages ${cond}`,
+    ),
+  );
+  const rows =
+    (result as unknown as { rows: Record<string, unknown>[] }).rows ?? [];
+  const r = rows[0] ?? {};
+  return JSON.stringify({
+    total_messages: r.total_messages ?? 0,
+    active_users: r.active_users ?? 0,
+    flagged: r.flagged ?? 0,
+    warned: r.warned ?? 0,
+  });
+}
+
+async function topChannels(guildId?: string, limit = 5): Promise<string> {
+  const db = getDatabase();
+  const conditions: string[] = [];
+  if (guildId) conditions.push(`guild_id = '${guildId}'`);
+  const cond = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+
+  const result = await db.execute(
+    sql.raw(
+      `SELECT channel_id,
+              COUNT(*)::int AS count
+       FROM messages ${cond}
+       GROUP BY channel_id
+       ORDER BY count DESC
+       LIMIT ${limit}`,
+    ),
+  );
+  const rows = (result as unknown as { rows: unknown[] }).rows ?? [];
+  return JSON.stringify(rows.slice(0, limit));
+}
+
+async function recentActivity(guildId?: string, limit = 5): Promise<string> {
+  const db = getDatabase();
+  const conditions: string[] = [];
+  if (guildId) conditions.push(`guild_id = '${guildId}'`);
+  const cond = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+
+  const result = await db.execute(
+    sql.raw(
+      `SELECT username, content, channel_id, created_at
+       FROM messages ${cond}
+       ORDER BY created_at DESC
+       LIMIT ${limit}`,
+    ),
+  );
+  return JSON.stringify((result as unknown as { rows: unknown[] }).rows ?? []);
+}
+
+async function topFlagged(guildId?: string, limit = 5): Promise<string> {
+  const db = getDatabase();
+  const conditions = ["ai_status IN ('flagged', 'warn')"];
+  if (guildId) conditions.push(`guild_id = '${guildId}'`);
+  const cond = `WHERE ${conditions.join(" AND ")}`;
+
+  const result = await db.execute(
+    sql.raw(
+      `SELECT username, content, channel_id, ai_status, created_at
+       FROM messages ${cond}
+       ORDER BY created_at DESC
+       LIMIT ${limit}`,
+    ),
+  );
+  return JSON.stringify((result as unknown as { rows: unknown[] }).rows ?? []);
+}

services/backend/src/modules/dashboard/dashboard.repository.ts

@@ -331,6 +331,100 @@ export class DashboardRepository {
     };
   }
 
+  async getTopReactions(limit: number) {
+    const db = getDatabase();
+    const cap = Math.min(Math.max(limit || 20, 1), 50);
+
+    // Top messages by net reactions (adds minus removes), joined to message content
+    const result = await db.execute(sql`
+      SELECT
+        m.id AS message_id,
+        m.content,
+        m.username,
+        m.channel_id,
+        m.created_at,
+        COALESCE(NULLIF((m.metadata::jsonb -> 'channel' ->> 'channelName'), ''), m.channel_id) AS channel_name,
+        r.reaction_count::int
+      FROM (
+        SELECT message_id,
+               (COUNT(*) FILTER (WHERE reaction_type = 'add')
+                - COUNT(*) FILTER (WHERE reaction_type = 'remove'))::int AS reaction_count
+        FROM message_reactions
+        GROUP BY message_id
+      ) r
+      JOIN messages m ON m.id = r.message_id
+      WHERE r.reaction_count > 0
+      ORDER BY r.reaction_count DESC
+      LIMIT ${cap}
+    `);
+
+    const rows = (result.rows as Record<string, unknown>[]) || [];
+
+    if (rows.length === 0) return [];
+
+    // Top emoji per message (adds only) for the breakdown
+    const ids = rows.map((r) => String(r.message_id));
+    const emojiResult = await db.execute(sql`
+      SELECT message_id, emoji, COUNT(*)::int AS c
+      FROM message_reactions
+      WHERE reaction_type = 'add' AND message_id IN (${sql.join(ids, sql`, `)})
+      GROUP BY message_id, emoji
+      ORDER BY message_id, c DESC
+    `);
+
+    const emojiByMessage = new Map<
+      string,
+      Array<{ emoji: string; count: number }>
+    >();
+    for (const e of emojiResult.rows as Record<string, unknown>[]) {
+      const mid = String(e.message_id);
+      const list = emojiByMessage.get(mid) ?? [];
+      list.push({ emoji: String(e.emoji), count: Number(e.c) });
+      emojiByMessage.set(mid, list);
+    }
+
+    return rows.map((r) => ({
+      message_id: String(r.message_id),
+      content: r.content ? String(r.content) : "",
+      username: r.username ? String(r.username) : null,
+      channel_id: String(r.channel_id),
+      channel_name: r.channel_name ? String(r.channel_name) : null,
+      created_at: r.created_at ? Number(r.created_at) : null,
+      reaction_count: Number(r.reaction_count),
+      top_emojis: (emojiByMessage.get(String(r.message_id)) ?? []).slice(0, 3),
+    }));
+  }
+
+  async getTopReactors(limit: number) {
+    const db = getDatabase();
+    const cap = Math.min(Math.max(limit || 20, 1), 50);
+
+    // Top users by net reactions given (adds minus removes)
+    const result = await db.execute(sql`
+      SELECT
+        user_id,
+        username,
+        (COUNT(*) FILTER (WHERE reaction_type = 'add')
+         - COUNT(*) FILTER (WHERE reaction_type = 'remove'))::int AS net_count,
+        COUNT(*) FILTER (WHERE reaction_type = 'add')::int AS adds_count,
+        COUNT(DISTINCT message_id)::int AS messages_reacted,
+        COUNT(DISTINCT emoji)::int AS emojis_used
+      FROM message_reactions
+      GROUP BY user_id, username
+      ORDER BY net_count DESC
+      LIMIT ${cap}
+    `);
+
+    return ((result.rows as Record<string, unknown>[]) || []).map((r) => ({
+      user_id: String(r.user_id),
+      username: String(r.username ?? "unknown"),
+      net_count: Number(r.net_count),
+      adds_count: Number(r.adds_count),
+      messages_reacted: Number(r.messages_reacted),
+      emojis_used: Number(r.emojis_used),
+    }));
+  }
+
   async getUserDetail(userId: string) {
     const db = getDatabase();
 

services/backend/src/modules/dashboard/dashboard.routes.ts

@@ -87,5 +87,25 @@ export function createDashboardRouter(): Router {
     }),
   );
 
+  // GET /api/dashboard/reactions — top reacted messages
+  router.get(
+    "/dashboard/reactions",
+    asyncHandler(async (req: Request, res: Response) => {
+      const limit = Number(req.query.limit) || 20;
+      const reactions = await dashboardService.getTopReactions(limit);
+      res.json(reactions);
+    }),
+  );
+
+  // GET /api/dashboard/reactors — top users by reactions given
+  router.get(
+    "/dashboard/reactors",
+    asyncHandler(async (req: Request, res: Response) => {
+      const limit = Number(req.query.limit) || 20;
+      const reactors = await dashboardService.getTopReactors(limit);
+      res.json(reactors);
+    }),
+  );
+
   return router;
 }

services/backend/src/modules/dashboard/dashboard.service.ts

@@ -43,6 +43,16 @@ export class DashboardService {
     logger.debug({ channelId }, "Fetching channel detail");
     return dashboardRepository.getChannelDetail(channelId);
   }
+
+  async getTopReactions(limit: number) {
+    logger.debug({ limit }, "Fetching top reactions");
+    return dashboardRepository.getTopReactions(limit);
+  }
+
+  async getTopReactors(limit: number) {
+    logger.debug({ limit }, "Fetching top reactors");
+    return dashboardRepository.getTopReactors(limit);
+  }
 }
 
 export const dashboardService = new DashboardService();

services/backend/src/modules/media/media.routes.ts

@@ -2,8 +2,8 @@ import type { Request, Response, Router } from "express";
 import express from "express";
 import { createChildLogger } from "@/shared/logger/index";
 import { asyncHandler, validateBody } from "../../shared/middlewares/index.js";
-import { mediaQueueSchema, mediaVolumeSchema } from "./media.schema.js";
-import { getStatus, queue, setVolume, skip, stop } from "./media.service.js";
+import { mediaLoopSchema, mediaQueueSchema } from "./media.schema.js";
+import { getStatus, queue, setLoop, skip, stop } from "./media.service.js";
 
 const logger = createChildLogger("media.routes");
 
@@ -55,14 +55,14 @@ export function createMediaRouter(): Router {
     }),
   );
 
-  // POST /api/media/volume
+  // POST /api/media/loop
   router.post(
-    "/media/volume",
-    validateBody(mediaVolumeSchema),
+    "/media/loop",
+    validateBody(mediaLoopSchema),
     asyncHandler(async (req: Request, res: Response) => {
-      const { volume } = req.body as { volume: number };
-      logger.debug({ volume }, "Media volume requested");
-      const state = await setVolume(volume);
+      const { loop } = req.body as { loop: boolean };
+      logger.debug({ loop }, "Media loop requested");
+      const state = await setLoop(loop);
       res.json(state);
     }),
   );

services/backend/src/modules/media/media.schema.ts

@@ -5,9 +5,9 @@ export const mediaQueueSchema = z.object({
   mode: z.enum(["music", "screen"]).default("music"),
 });
 
-export const mediaVolumeSchema = z.object({
-  volume: z.number().min(0).max(1).default(1.0),
+export const mediaLoopSchema = z.object({
+  loop: z.boolean().default(false),
 });
 
 export type MediaQueueInput = z.infer<typeof mediaQueueSchema>;
-export type MediaVolumeInput = z.infer<typeof mediaVolumeSchema>;
+export type MediaLoopInput = z.infer<typeof mediaLoopSchema>;

services/backend/src/modules/media/media.service.ts

@@ -3,10 +3,10 @@ import {
   tryCommandThenFallback,
 } from "../../shared/commandHelper.js";
 import {
+  COMMAND_MEDIA_LOOP,
   COMMAND_MEDIA_QUEUE,
   COMMAND_MEDIA_SKIP,
   COMMAND_MEDIA_STOP,
-  COMMAND_MEDIA_VOLUME,
   MEDIA_STATUS_KEY,
 } from "../../shared/index.js";
 import { publishCommand, readRedisStatus } from "../../shared/redis/index.js";
@@ -28,7 +28,10 @@ export interface MediaItem {
 
 export interface MediaState {
   playing: boolean;
+  /** null/absent when idle; "music" | "screen" while a track is active. */
+  activeMode?: "music" | "screen" | null;
   musicVolume: number;
+  loop: boolean;
   current: MediaItem | null;
   queue: MediaItem[];
 }
@@ -41,7 +44,9 @@ const DEFAULT_COMMAND_TIMEOUT_MS = 5000;
 
 const DEFAULT_STATE: MediaState = {
   playing: false,
-  musicVolume: 1.0,
+  activeMode: null,
+  musicVolume: 0.3,
+  loop: false,
   current: null,
   queue: [],
 };
@@ -56,9 +61,14 @@ function normalizeMediaState(raw: Record<string, unknown>): MediaState {
     rawPlaying === true ||
     rawPlaying === "playing" ||
     rawPlaying === "buffering";
+  const mode = raw.activeMode;
+  const activeMode: "music" | "screen" | null =
+    mode === "music" || mode === "screen" ? mode : null;
   return {
     playing,
-    musicVolume: Number(raw.musicVolume ?? 1.0),
+    activeMode,
+    musicVolume: Number(raw.musicVolume ?? 0.3),
+    loop: Boolean(raw.loop ?? false),
     current: (raw.current as MediaItem | null) ?? null,
     queue: (raw.queue as MediaItem[]) ?? [],
   };
@@ -99,7 +109,9 @@ export async function queue(
     () =>
       publishCommand<MediaState>(
         COMMAND_MEDIA_QUEUE,
-        { source, mode },
+        // NOTE: gateway MediaHandler reads `payload.url` (not `source`) —
+        // keep the field name aligned or playback silently no-ops.
+        { url: source, mode },
         DEFAULT_COMMAND_TIMEOUT_MS,
       ),
     () => readStatusFallback(),
@@ -142,18 +154,18 @@ export async function stop(): Promise<MediaState> {
 }
 
 /**
- * Set volume via Redis command to discord-gateway.
+ * Toggle loop mode (replay current track on natural end) via Redis command.
  */
-export async function setVolume(volume: number): Promise<MediaState> {
-  logger.info({ volume }, "setVolume called");
+export async function setLoop(loop: boolean): Promise<MediaState> {
+  logger.info({ loop }, "setLoop called");
   return tryCommandThenFallback(
     () =>
       publishCommand<MediaState>(
-        COMMAND_MEDIA_VOLUME,
-        { volume },
+        COMMAND_MEDIA_LOOP,
+        { loop },
         DEFAULT_COMMAND_TIMEOUT_MS,
       ),
     () => readStatusFallback(),
-    "setVolume",
+    "setLoop",
   );
 }

services/backend/src/modules/messages/messages.repository.ts

@@ -6,10 +6,10 @@ import {
   isNull,
   like,
   lt,
-  ne,
   notInArray,
   or,
   type SQL,
+  sql,
 } from "drizzle-orm";
 import { config } from "../../shared/config/index.js";
 import { getDatabase } from "../../shared/database/index.js";
@@ -115,6 +115,27 @@ export class MessagesRepository {
     return mapMessageRow(row as Record<string, unknown>);
   }
 
+  /**
+   * Edit history for a message: previous content snapshots (newest first).
+   * Stored in message_edits by the gateway's message-capture module.
+   */
+  async getEditHistory(
+    messageId: string,
+  ): Promise<Array<{ old_content: string; edited_at: number }>> {
+    const db = getDatabase();
+    const result = await db.execute(sql`
+      SELECT old_content, edited_at
+      FROM message_edits
+      WHERE message_id = ${messageId}
+      ORDER BY edited_at DESC
+      LIMIT 50
+    `);
+    return ((result.rows as Record<string, unknown>[]) || []).map((r) => ({
+      old_content: String(r.old_content ?? ""),
+      edited_at: Number(r.edited_at ?? 0),
+    }));
+  }
+
   async findByChannel(
     channelId: string,
     query: MessageQuery,
@@ -223,58 +244,6 @@ export class MessagesRepository {
     return mapMessageRow(row as Record<string, unknown>);
   }
 
-  /**
-   * Bulk-reset ai_status from 'error' to 'pending' so the DG recovery worker
-   * picks them up on its next poll cycle.
-   *
-   * Accepts optional scope filters (guildId, channelId) or a list of explicit
-   * message IDs. Returns the count of rows that were actually updated.
-   */
-  async reanalyzeErrorBatch(opts: {
-    guildId?: string;
-    channelId?: string;
-    messageIds?: string[];
-  }): Promise<number> {
-    const db = getDatabase();
-    const conditions: SQL[] = [eq(pgMessagesTable.ai_status, "error")];
-
-    if (opts.messageIds && opts.messageIds.length > 0) {
-      conditions.push(inArray(pgMessagesTable.id, opts.messageIds));
-    }
-    if (opts.guildId) {
-      conditions.push(eq(pgMessagesTable.guild_id, opts.guildId));
-    }
-    if (opts.channelId) {
-      conditions.push(eq(pgMessagesTable.channel_id, opts.channelId));
-    }
-
-    const result = await db
-      .update(pgMessagesTable)
-      .set({ ai_status: "pending" })
-      .where(and(...conditions));
-
-    const count = result.rowCount ?? 0;
-    logger.info({ count, ...opts }, "Batch reanalyze triggered");
-    return count;
-  }
-
-  /**
-   * Mark a single message for re-analysis by resetting ai_status to 'pending'.
-   * Skips messages already in 'pending' state to avoid write amplification.
-   */
-  async markForReanalysis(id: string): Promise<void> {
-    const db = getDatabase();
-    await db
-      .update(pgMessagesTable)
-      .set({ ai_status: "pending" })
-      .where(
-        and(
-          eq(pgMessagesTable.id, id),
-          ne(pgMessagesTable.ai_status, "pending"),
-        ),
-      );
-  }
-
   /**
    * Retrieve messages flagged for review (ai_status IN ('warn', 'flagged')).
    * Optionally filtered by channelId, with configurable limit.

services/backend/src/modules/messages/messages.routes.ts

@@ -1,7 +1,7 @@
 import type { Request, Response, Router } from "express";
 import express from "express";
 import { createChildLogger } from "@/shared/logger/index";
-import { asyncHandler, validateBody } from "../../shared/middlewares/index.js";
+import { asyncHandler } from "../../shared/middlewares/index.js";
 import {
   handleGetAttachmentsByChannel,
   handleGetImageMessages,
@@ -9,27 +9,10 @@ import {
   handleGetMessagesByChannel,
   handleListMessages,
 } from "./messages.controller.js";
-import { reanalyzeBatchSchema } from "./messages.schema.js";
 import { messagesService } from "./messages.service.js";
 
 const logger = createChildLogger("messages.routes");
 
-/**
- * Per-message in-flight guard for the single reanalyze endpoint.
- * Prevents concurrent spam-clicks from issuing duplicate UPDATE + recovery
- * worker triggers for the same message.
- */
-const reanalyzeInFlight = new Set<string>();
-
-/**
- * Per-scope in-flight guard for the batch reanalyze endpoint.
- * Scope key = "guildId:channelId" (empty string used for undefined parts).
- * Two concurrent batch-reanalyze requests for the same scope are rejected
- * with 409 so the recovery worker is not triggered multiple times for the
- * same set of error messages.
- */
-const reanalyzeBatchInFlight = new Set<string>();
-
 export function createMessagesRouter(): Router {
   const router = express.Router();
 
@@ -51,74 +34,6 @@ export function createMessagesRouter(): Router {
   // (uses /detail/ prefix to avoid collision with :channelId route above)
   router.get("/messages/detail/:id", handleGetMessageById);
 
-  // POST /api/messages/reanalyze-batch — Bulk retry all errored messages
-  // MUST be registered BEFORE /messages/:id/reanalyze so "reanalyze-batch"
-  // is not captured as an :id param.
-  router.post(
-    "/messages/reanalyze-batch",
-    validateBody(reanalyzeBatchSchema),
-    asyncHandler(async (req: Request, res: Response) => {
-      const { guildId, channelId, messageIds } = req.body as {
-        guildId?: string;
-        channelId?: string;
-        messageIds?: string[];
-      };
-
-      // Idempotency guard: one concurrent batch-reanalyze per scope.
-      // Prevents two admin sessions clicking simultaneously from each
-      // triggering the recovery worker for the same set of messages.
-      const scopeKey = `${guildId ?? ""}:${channelId ?? ""}`;
-      if (reanalyzeBatchInFlight.has(scopeKey)) {
-        res
-          .status(409)
-          .json({ error: "REANALYZE_BATCH_IN_PROGRESS", scope: scopeKey });
-        return;
-      }
-
-      reanalyzeBatchInFlight.add(scopeKey);
-      let count = 0;
-      try {
-        count = await messagesService.reanalyzeErrorBatch({
-          guildId,
-          channelId,
-          messageIds,
-        });
-      } finally {
-        reanalyzeBatchInFlight.delete(scopeKey);
-      }
-
-      logger.info({ count, guildId, channelId }, "Batch reanalyze completed");
-      res.status(200).json({ ok: true, count });
-    }),
-  );
-
-  // POST /api/messages/:id/reanalyze - Mark single message for re-analysis
-  router.post(
-    "/messages/:id/reanalyze",
-    asyncHandler(async (req: Request, res: Response) => {
-      const id = String(req.params.id ?? "");
-      if (!id) {
-        res.status(400).json({ error: "MISSING_ID" });
-        return;
-      }
-
-      // Idempotency guard: reject concurrent duplicate requests for the same ID.
-      if (reanalyzeInFlight.has(id)) {
-        res.status(409).json({ error: "REANALYZE_IN_PROGRESS", messageId: id });
-        return;
-      }
-
-      reanalyzeInFlight.add(id);
-      try {
-        await messagesService.markForReanalysis(id);
-      } finally {
-        reanalyzeInFlight.delete(id);
-      }
-
-      res.status(200).json({ ok: true });
-    }),
-  );
-
   // GET /api/review - Get flagged/warned messages for review
   router.get(
     "/review",

services/backend/src/modules/messages/messages.schema.ts

@@ -38,13 +38,6 @@ export const messageUpdateSchema = z.object({
   aiConfidence: z.number().optional(),
 });
 
-export const reanalyzeBatchSchema = z.object({
-  guildId: z.string().optional(),
-  channelId: z.string().optional(),
-  messageIds: z.array(z.string()).optional(),
-});
-
 export type MessageQuery = z.infer<typeof messageQuerySchema>;
 export type MessageCreate = z.infer<typeof messageCreateSchema>;
 export type MessageUpdate = z.infer<typeof messageUpdateSchema>;
-export type ReanalyzeBatchInput = z.infer<typeof reanalyzeBatchSchema>;

services/backend/src/modules/messages/messages.service.ts

@@ -34,7 +34,12 @@ export class MessagesService {
       throw new NotFoundError(`Message with ID ${id} not found`);
     }
 
-    return message;
+    const editHistory = await messagesRepository.getEditHistory(id);
+    return {
+      ...message,
+      edit_count: editHistory.length,
+      edit_history: editHistory,
+    };
   }
 
   async getAttachmentsByChannel(channelId: string, query: MessageQuery) {
@@ -58,15 +63,6 @@ export class MessagesService {
     return messagesRepository.getImageMessages(guildId, limit);
   }
 
-  async markForReanalysis(id: string): Promise<void> {
-    if (!id) {
-      throw new ValidationError("message ID is required");
-    }
-
-    logger.debug({ id }, "Marking message for re-analysis");
-    await messagesRepository.markForReanalysis(id);
-  }
-
   async getReviewMessages(
     channelId?: string,
     limit?: number,
@@ -74,25 +70,6 @@ export class MessagesService {
     logger.debug({ channelId, limit }, "Getting review messages");
     return messagesRepository.getReviewMessages(channelId, limit);
   }
-
-  async reanalyzeErrorBatch(opts: {
-    guildId?: string;
-    channelId?: string;
-    messageIds?: string[];
-  }) {
-    if (
-      !opts.guildId &&
-      !opts.channelId &&
-      (!opts.messageIds || opts.messageIds.length === 0)
-    ) {
-      throw new ValidationError(
-        "At least one of guildId, channelId, or messageIds[] is required",
-      );
-    }
-
-    logger.info(opts, "Batch reanalyzing errored messages");
-    return messagesRepository.reanalyzeErrorBatch(opts);
-  }
 }
 
 export const messagesService = new MessagesService();

services/backend/src/modules/moderation/index.ts

@@ -0,0 +1 @@
+export { createModerationRouter } from "./moderation.routes.js";

services/backend/src/modules/moderation/moderation.repository.ts

@@ -0,0 +1,141 @@
+import { sql } from "drizzle-orm";
+import { getDatabase } from "../../shared/database/index.js";
+
+export interface ListModerationQuery {
+  status?: string;
+  actionType?: string;
+  limit?: number;
+  cursor?: number;
+}
+
+const ACTION_TYPES = [
+  "delete_message",
+  "mute_user",
+  "warn_user",
+  "kick_user",
+  "ban_user",
+] as const;
+const STATUSES = ["pending", "executed", "failed"] as const;
+
+export class ModerationRepository {
+  async getStats() {
+    const db = getDatabase();
+    const result = await db.execute(sql`
+      SELECT action_type, status, COUNT(*)::int AS c
+      FROM moderation_actions
+      GROUP BY action_type, status
+    `);
+
+    const rows = (result.rows as Record<string, unknown>[]) || [];
+    let executed = 0;
+    let failed = 0;
+    let pending = 0;
+
+    const byAction: Record<
+      string,
+      { executed: number; failed: number; pending: number }
+    > = {};
+
+    for (const r of rows) {
+      const actionType = String(r.action_type ?? "unknown");
+      const status = String(r.status ?? "unknown");
+      const count = Number(r.c ?? 0);
+      byAction[actionType] ??= { executed: 0, failed: 0, pending: 0 };
+      if (status === "executed") {
+        executed += count;
+        byAction[actionType].executed += count;
+      } else if (status === "failed") {
+        failed += count;
+        byAction[actionType].failed += count;
+      } else {
+        pending += count;
+        byAction[actionType].pending += count;
+      }
+    }
+
+    const total = executed + failed + pending;
+
+    return {
+      total,
+      executed,
+      failed,
+      pending,
+      failed_rate: total > 0 ? Number(((failed / total) * 100).toFixed(1)) : 0,
+      by_action: byAction,
+    };
+  }
+
+  async listActions(query: ListModerationQuery) {
+    const db = getDatabase();
+    const limit = Math.min(Math.max(query.limit ?? 50, 1), 200);
+    const conditions: string[] = [];
+
+    if (
+      query.status &&
+      (STATUSES as readonly string[]).includes(query.status)
+    ) {
+      conditions.push(`a.status = '${query.status}'`);
+    }
+    if (
+      query.actionType &&
+      (ACTION_TYPES as readonly string[]).includes(query.actionType)
+    ) {
+      conditions.push(`a.action_type = '${query.actionType}'`);
+    }
+    if (query.cursor) {
+      conditions.push(`a.created_at < ${Number(query.cursor)}`);
+    }
+
+    const whereClause =
+      conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+
+    const result = await db.execute(
+      sql.raw(`
+      SELECT
+        a.id,
+        a.message_id,
+        a.user_id,
+        a.guild_id,
+        a.action_type,
+        a.reason,
+        a.executed_by,
+        a.status,
+        a.error,
+        a.created_at,
+        a.executed_at,
+        m.username,
+        LEFT(m.content, 300) AS content
+      FROM moderation_actions a
+      LEFT JOIN messages m ON m.id = a.message_id
+      ${whereClause}
+      ORDER BY a.created_at DESC
+      LIMIT ${limit + 1}
+    `),
+    );
+
+    const rows = (result.rows as Record<string, unknown>[]) || [];
+    const data = rows.slice(0, limit).map((r) => ({
+      id: String(r.id ?? ""),
+      message_id: r.message_id ? String(r.message_id) : null,
+      user_id: r.user_id ? String(r.user_id) : null,
+      guild_id: String(r.guild_id ?? ""),
+      action_type: String(r.action_type ?? "unknown"),
+      reason: r.reason ? String(r.reason) : null,
+      executed_by: r.executed_by ? String(r.executed_by) : null,
+      status: String(r.status ?? "unknown"),
+      error: r.error ? String(r.error) : null,
+      created_at: r.created_at ? Number(r.created_at) : null,
+      executed_at: r.executed_at ? Number(r.executed_at) : null,
+      username: r.username ? String(r.username) : null,
+      content: r.content ? String(r.content) : null,
+    }));
+
+    const lastRow = rows[limit - 1] as Record<string, unknown> | undefined;
+    const nextCursor =
+      rows.length > limit ? String(lastRow?.created_at ?? "") : null;
+
+    return { data, nextCursor };
+  }
+}
+
+export const moderationRepository = new ModerationRepository();

services/backend/src/modules/moderation/moderation.routes.ts

@@ -0,0 +1,43 @@
+import type { Request, Response, Router } from "express";
+import express from "express";
+import { createChildLogger } from "../../shared/logger/index.js";
+import { asyncHandler } from "../../shared/middlewares/index.js";
+import { moderationService } from "./moderation.service.js";
+
+const logger = createChildLogger("moderation.routes");
+
+export function createModerationRouter(): Router {
+  const router = express.Router();
+
+  // GET /api/moderation/stats — moderation action summary
+  router.get(
+    "/moderation/stats",
+    asyncHandler(async (_req: Request, res: Response) => {
+      const stats = await moderationService.getStats();
+      res.json(stats);
+    }),
+  );
+
+  // GET /api/moderation/actions — paginated moderation action log
+  router.get(
+    "/moderation/actions",
+    asyncHandler(async (req: Request, res: Response) => {
+      const limit = Number(req.query.limit) || 50;
+      const status = req.query.status as string | undefined;
+      const actionType = req.query.actionType as string | undefined;
+      const cursor = req.query.cursor as string | undefined;
+
+      const result = await moderationService.listActions({
+        limit,
+        status,
+        actionType,
+        cursor: cursor ? Number(cursor) : undefined,
+      });
+
+      logger.debug({ count: result.data.length }, "Moderation actions listed");
+      res.json(result);
+    }),
+  );
+
+  return router;
+}

services/backend/src/modules/moderation/moderation.service.ts

@@ -0,0 +1,21 @@
+import { createChildLogger } from "../../shared/logger/index.js";
+import {
+  type ListModerationQuery,
+  moderationRepository,
+} from "./moderation.repository.js";
+
+const logger = createChildLogger("moderation.service");
+
+export class ModerationService {
+  async getStats() {
+    logger.debug("Fetching moderation stats");
+    return moderationRepository.getStats();
+  }
+
+  async listActions(query: ListModerationQuery) {
+    logger.debug({ query }, "Listing moderation actions");
+    return moderationRepository.listActions(query);
+  }
+}
+
+export const moderationService = new ModerationService();

services/backend/src/modules/recordings/recordings.service.ts

@@ -20,7 +20,6 @@ export interface RecordingRow {
   upload_error: string | null;
   created_at: number;
   uploaded_at: number | null;
-  duration_bytes: number;
 }
 
 export interface PaginatedRecordings {
@@ -69,7 +68,6 @@ export class RecordingsService {
         upload_error: pgVoiceRecordingsTable.upload_error,
         created_at: pgVoiceRecordingsTable.created_at,
         uploaded_at: pgVoiceRecordingsTable.uploaded_at,
-        duration_bytes: pgVoiceRecordingsTable.size_bytes,
       })
       .from(pgVoiceRecordingsTable)
       .where(where)

services/backend/src/modules/voice/live-speaker.ts

@@ -0,0 +1,83 @@
+/**
+ * Authoritative live-voice store.
+ *
+ * Single source of truth for who is present / speaking in voice. The backend
+ * WebSocket server is the one relay every frontend client connects to, so it
+ * is the correct place to aggregate the gateway's `voice_active_user` deltas
+ * into a shared snapshot. A late-joining browser must be able to see the same
+ * state as everyone else — this store makes that possible (seeded into the WS
+ * initial states and served via GET /api/voice/status).
+ */
+
+export interface LiveSpeaker {
+  userId: string;
+  username: string;
+  avatar?: string | null;
+  speaking: boolean;
+  /** Epoch ms of the most recent activity (start OR end of speech). */
+  lastActiveAt: number;
+}
+
+const speakers = new Map<string, LiveSpeaker>();
+
+const MAX_SPEAKERS = 200;
+
+/**
+ * Record a voice_active_user event. `speaking: true` upserts the speaker as
+ * active; `speaking: false` marks them inactive while keeping them for the
+ * activity timeline.
+ */
+/**
+ * recordSpeaker(data) — apply a `voice_active_user` event. `speaking: true`
+ * upserts the speaker as ACTIVE; `speaking: false` marks them inactive while
+ * keeping them for the activity timeline.
+ */
+export function recordSpeaker(data: {
+  userId: string;
+  username?: string;
+  avatar?: string | null;
+  speaking: boolean;
+}): void {
+  const { userId, speaking } = data;
+  const existing = speakers.get(userId);
+  const speaker: LiveSpeaker = {
+    userId,
+    username: data.username ?? existing?.username ?? "Unknown",
+    avatar: data.avatar ?? existing?.avatar ?? null,
+    speaking,
+    lastActiveAt: Date.now(),
+  };
+
+  if (speakers.size >= MAX_SPEAKERS && !existing) {
+    // Drop the least-recently-active non-speaking speaker to stay bounded.
+    let oldestId: string | null = null;
+    let oldestTs = Infinity;
+    for (const [id, s] of speakers) {
+      if (!s.speaking && s.lastActiveAt < oldestTs) {
+        oldestTs = s.lastActiveAt;
+        oldestId = id;
+      }
+    }
+    if (oldestId) speakers.delete(oldestId);
+    else return;
+  }
+
+  speakers.set(userId, speaker);
+}
+
+/** All known speakers, most recently active first. */
+export function getActiveSpeakers(): LiveSpeaker[] {
+  return [...speakers.values()].sort((a, b) => b.lastActiveAt - a.lastActiveAt);
+}
+
+/** Only speakers currently flagged as speaking. */
+export function getSpeakingSpeakers(): LiveSpeaker[] {
+  return [...speakers.values()]
+    .filter((s) => s.speaking)
+    .sort((a, b) => b.lastActiveAt - a.lastActiveAt);
+}
+
+/** Drop all tracked speakers (used on backend restart). */
+export function resetLiveSpeakers(): void {
+  speakers.clear();
+}

services/backend/src/modules/voice/voice.service.ts

@@ -15,6 +15,7 @@ import {
   VOICE_STATUS_KEY,
 } from "../../shared/index.js";
 import { publishCommand, readRedisStatus } from "../../shared/redis/index.js";
+import { getActiveSpeakers, type LiveSpeaker } from "./live-speaker.js";
 
 const logger = createChildLogger("voice.service");
 
@@ -28,6 +29,8 @@ export interface Channel {
   id: string;
   name: string;
   type: "voice" | "text";
+  /** Whether the selfbot account can actually join this voice channel. */
+  joinable?: boolean;
 }
 
 export interface GuildVoiceEntry {
@@ -43,6 +46,12 @@ export interface VoiceStatus {
   activeChannelId: string | null;
   activeChannelName: string | null;
   connections: GuildVoiceEntry[];
+  /**
+   * Authoritative shared voice snapshot — who is present / speaking right
+   * now, aggregated server-side from the gateway's `voice_active_user`
+   * deltas. All browsers converge on this same list.
+   */
+  activeSpeakers: LiveSpeaker[];
 }
 
 export const DEFAULT_VOICE_STATUS: VoiceStatus = {
@@ -51,8 +60,16 @@ export const DEFAULT_VOICE_STATUS: VoiceStatus = {
   activeChannelId: null,
   activeChannelName: null,
   connections: [],
+  activeSpeakers: [],
 };
 
+/** Attach the live speaker snapshot to any voice status payload. */
+function withActiveSpeakers<T extends Partial<VoiceStatus>>(
+  status: T,
+): T & { activeSpeakers: LiveSpeaker[] } {
+  return { ...status, activeSpeakers: getActiveSpeakers() };
+}
+
 /**
  * Wraps tryCommandThenFallback with a cleaner signature for use within this module.
  * Attempts a Redis command first; on failure, falls back to the provided function.
@@ -66,8 +83,10 @@ async function withFallback<T>(
 }
 
 function readVoiceStatusFallback(): Promise<VoiceStatus> {
-  return readRedisStatus(VOICE_STATUS_KEY).then(
-    (cached) => (cached as unknown as VoiceStatus) ?? DEFAULT_VOICE_STATUS,
+  return readRedisStatus(VOICE_STATUS_KEY).then((cached) =>
+    withActiveSpeakers(
+      (cached as unknown as VoiceStatus) ?? DEFAULT_VOICE_STATUS,
+    ),
   );
 }
 
@@ -137,7 +156,9 @@ export async function getVoiceChannels(guildId: string): Promise<Channel[]> {
 export async function getVoiceStatus(): Promise<VoiceStatus> {
   logger.debug("getVoiceStatus called");
   const cached = await readRedisStatus(VOICE_STATUS_KEY);
-  return (cached as unknown as VoiceStatus) ?? DEFAULT_VOICE_STATUS;
+  return withActiveSpeakers(
+    (cached as unknown as VoiceStatus) ?? DEFAULT_VOICE_STATUS,
+  );
 }
 
 /**

services/backend/src/shared/redis-channels.ts

@@ -62,6 +62,7 @@ export const COMMAND_MEDIA_QUEUE = "media:queue";
 export const COMMAND_MEDIA_SKIP = "media:skip";
 export const COMMAND_MEDIA_STOP = "media:stop";
 export const COMMAND_MEDIA_VOLUME = "media:volume";
+export const COMMAND_MEDIA_LOOP = "media:loop";
 export const COMMAND_MODERATION_ACTION = "moderation:action";
 export const DISCORD_VOICE_ANALYZED = "discord:voice:analyzed";
 

services/backend/src/ws/redis-bridge.ts

@@ -1,7 +1,9 @@
 import Redis from "ioredis";
+import { recordSpeaker } from "../modules/voice/live-speaker.js";
 import { config } from "../shared/config/index.js";
 import {
   DISCORD_CHANNEL_TO_WS_EVENT,
+  DISCORD_VOICE_ACTIVE_USER,
   DISCORD_VOICE_PCM,
 } from "../shared/index.js";
 import { createChildLogger } from "../shared/logger/index.js";
@@ -62,6 +64,26 @@ function handleSubscriptionMessage(channel: string, message: string): void {
     }
   }
 
+  // Aggregate live-voice state authoritatively BEFORE broadcasting.
+  // Every browser hears the same `voice_active_user` deltas, so the backend
+  // can maintain the single shared snapshot for late-joining clients.
+  if (channel === DISCORD_VOICE_ACTIVE_USER) {
+    const speaker = data as {
+      userId?: string;
+      username?: string;
+      avatar?: string | null;
+      speaking?: boolean;
+    };
+    if (speaker?.userId) {
+      recordSpeaker({
+        userId: speaker.userId,
+        username: speaker.username,
+        avatar: speaker.avatar,
+        speaking: Boolean(speaker.speaking),
+      });
+    }
+  }
+
   logger.debug({ channel, eventType }, "Broadcasting Redis event");
   broadcastEvent(eventType, data);
 }

services/backend/src/ws/server.ts

@@ -66,6 +66,22 @@ async function sendInitialStates(ws: WebSocket): Promise<void> {
   } catch (err) {
     logger.warn({ err }, "Failed to send initial media_state");
   }
+
+  // Send initial live-voice snapshot (shared authoritative state — a browser
+  // joining mid-call sees the same speakers as everyone else, not an empty DB).
+  try {
+    const { getActiveSpeakers } = await import(
+      "../modules/voice/live-speaker.js"
+    );
+    ws.send(
+      JSON.stringify({
+        type: "voice_state",
+        state: { activeSpeakers: getActiveSpeakers() },
+      }),
+    );
+  } catch (err) {
+    logger.warn({ err }, "Failed to send initial voice_state");
+  }
 }
 
 export function closeWebSocketServer(): void {

services/discord-gateway/README.md

@@ -243,10 +243,10 @@ On SIGINT/SIGTERM/uncaughtException/unhandledRejection:
    - Connect to Backend HTTP API
    - Subscribe to WebSocket events
 
-3. **Docker & CI/CD**
-   - Dockerfile for Discord Gateway
-   - Docker Compose for multi-service setup
-   - GitHub Actions for build/deploy
+3. **Nix & CI/CD**
+   - flake.nix package for Discord Gateway
+   - systemd services (gmw-backend, gmw-discord-gateway)
+   - GitHub Actions for build/deploy (nix copy → systemctl restart)
 
 4. **Documentation**
    - API documentation

services/discord-gateway/drizzle.config.ts

@@ -7,6 +7,6 @@ export default defineConfig({
   dbCredentials: {
     url:
       process.env.DATABASE_URL ||
-      "postgresql://postgres:postgres@localhost:5432/bete",
+      "postgresql://asephs:***@100.121.180.82:6432/dcbot",
   },
 });

services/discord-gateway/native/libdatachannel-min/.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+build/
+package-lock.json

services/discord-gateway/native/libdatachannel-min/binding.cpp

@@ -0,0 +1,526 @@
+// libdatachannel-min — minimal N-API binding to libdatachannel.
+// Exposes ONLY what GMW GoLive needs:
+//   PeerConnection (offer/answer, ICE, SDP), DataChannel (signaling),
+//   Track send (added in media phase).
+// Built against libdatachannel 0.24.0 (built from source in /tmp/ldc-build).
+
+#include <napi.h>
+#include <rtc/rtc.hpp>
+
+#include <functional>
+#include <memory>
+#include <string>
+#include <variant>
+
+using namespace Napi;
+
+namespace {
+
+std::string stateToString(rtc::PeerConnection::State s) {
+  switch (s) {
+    case rtc::PeerConnection::State::New: return "new";
+    case rtc::PeerConnection::State::Connecting: return "connecting";
+    case rtc::PeerConnection::State::Connected: return "connected";
+    case rtc::PeerConnection::State::Disconnected: return "disconnected";
+    case rtc::PeerConnection::State::Failed: return "failed";
+    case rtc::PeerConnection::State::Closed: return "closed";
+    default: return "unknown";
+  }
+}
+
+std::string binaryToString(const rtc::binary& data) {
+  // rtc::binary is std::vector<std::byte> in libdatachannel >= 0.21
+  std::string msg(data.size(), '\0');
+  for (size_t i = 0; i < data.size(); i++) {
+    msg[i] = static_cast<char>(data[i]);
+  }
+  return msg;
+}
+
+// Holds a Napi::Promise::Deferred so it can be moved into TSFN lambdas
+// without invalid copies (node-addon-api 8.x Deferred is not movable).
+struct DeferredHolder {
+  Promise::Deferred deferred;
+  explicit DeferredHolder(Promise::Deferred d) : deferred(d) {}
+};
+
+class DataChannelWrap : public Napi::ObjectWrap<DataChannelWrap> {
+ public:
+  static Function Init(Napi::Env env) {
+    Function func = DefineClass(env, "DataChannel", {
+      InstanceMethod("send", &DataChannelWrap::Send),
+      InstanceMethod("isOpen", &DataChannelWrap::IsOpen),
+      InstanceMethod("close", &DataChannelWrap::Close),
+      InstanceMethod("onMessage", &DataChannelWrap::OnMessage),
+      InstanceMethod("onOpen", &DataChannelWrap::OnOpen),
+    });
+    dcConstructor = Napi::Persistent(func);
+    return func;
+  }
+
+  // Create a JS wrapper (calls the JS constructor, returns instance).
+  static Object NewInstance(Napi::Env env) {
+    return dcConstructor.New({});
+  }
+
+  DataChannelWrap(const Napi::CallbackInfo& info)
+      : Napi::ObjectWrap<DataChannelWrap>(info) {}
+
+  void Init(std::shared_ptr<rtc::DataChannel> dc) {
+    dc_ = dc;
+    dc_->onMessage([this](rtc::message_variant data) {
+      std::string msg;
+      if (std::holds_alternative<rtc::binary>(data)) {
+        msg = binaryToString(std::get<rtc::binary>(data));
+      } else {
+        msg = std::get<std::string>(data);
+      }
+      if (msgCb_) {
+        msgCb_->BlockingCall([msg](Napi::Env env, Function cb) {
+          cb.Call({String::New(env, msg)});
+        });
+      }
+    });
+    dc_->onOpen([this]() {
+      if (openCb_) {
+        openCb_->BlockingCall([](Napi::Env env, Function cb) {
+          cb.Call({});
+        });
+      }
+    });
+  }
+
+ private:
+  static FunctionReference dcConstructor;
+  std::shared_ptr<rtc::DataChannel> dc_;
+  std::shared_ptr<ThreadSafeFunction> msgCb_;
+  std::shared_ptr<ThreadSafeFunction> openCb_;
+
+  void Send(const Napi::CallbackInfo& info) {
+    std::string msg = info[0].As<String>().Utf8Value();
+    if (dc_) dc_->send(msg);
+  }
+
+  Napi::Value IsOpen(const Napi::CallbackInfo& info) {
+    bool open = dc_ && dc_->isOpen();
+    return Boolean::New(info.Env(), open);
+  }
+
+  void Close(const Napi::CallbackInfo& info) {
+    if (dc_) dc_->close();
+  }
+
+  void OnMessage(const Napi::CallbackInfo& info) {
+    Function cb = info[0].As<Function>();
+    msgCb_ = std::make_shared<ThreadSafeFunction>(
+        ThreadSafeFunction::New(info.Env(), cb, "dc-message", 0, 1));
+  }
+
+  void OnOpen(const Napi::CallbackInfo& info) {
+    Function cb = info[0].As<Function>();
+    openCb_ = std::make_shared<ThreadSafeFunction>(
+        ThreadSafeFunction::New(info.Env(), cb, "dc-open", 0, 1));
+  }
+};
+
+class TrackWrap : public Napi::ObjectWrap<TrackWrap> {
+ public:
+  static Function Init(Napi::Env env) {
+    Function func = DefineClass(env, "Track", {
+      InstanceMethod("send", &TrackWrap::Send),
+      InstanceMethod("isOpen", &TrackWrap::IsOpen),
+      InstanceMethod("close", &TrackWrap::Close),
+      InstanceMethod("setPacketizer", &TrackWrap::SetPacketizer),
+      InstanceMethod("sendFrame", &TrackWrap::SendFrame),
+      InstanceMethod("addTimestamp", &TrackWrap::AddTimestamp),
+    });
+    trackConstructor = Napi::Persistent(func);
+    return func;
+  }
+
+  static Object NewInstance(Napi::Env env) {
+    return trackConstructor.New({});
+  }
+
+  TrackWrap(const Napi::CallbackInfo& info)
+      : Napi::ObjectWrap<TrackWrap>(info) {}
+
+  void Init(std::shared_ptr<rtc::Track> track, Napi::Env env) {
+    track_ = track;
+    (void)env;
+  }
+
+ private:
+  static FunctionReference trackConstructor;
+  std::shared_ptr<rtc::Track> track_;
+  std::shared_ptr<rtc::RtpPacketizationConfig> rtpConfig_;
+
+  void Send(const Napi::CallbackInfo& info) {
+    Buffer<uint8_t> buf = info[0].As<Buffer<uint8_t>>();
+    if (!track_) return;
+    rtc::binary data(buf.Length());
+    for (size_t i = 0; i < buf.Length(); i++) data[i] = (std::byte)buf[i];
+    try {
+      track_->send(data);
+    } catch (const std::exception& e) {
+      fprintf(stderr, "[binding] track.send THREW: %s\n", e.what());
+    }
+  }
+
+  // setPacketizer(kind, ssrc, payloadType, clockRate, playoutDelayId,
+  //               playoutDelayMin, playoutDelayMax)
+  // kind: "audio" | "h264" | "h265" | "av1"
+  // Builds the media-handler chain (packetizer → RTCP SR → NACK → pacing for
+  // video) exactly like @dank074's WebRtcWrapper does via node-datachannel.
+  void SetPacketizer(const Napi::CallbackInfo& info) {
+    Napi::Env env = info.Env();
+    if (!track_) throw Error::New(env, "track closed");
+    std::string kind = info[0].As<String>().Utf8Value();
+    uint32_t ssrc = info[1].As<Number>().Uint32Value();
+    uint8_t pt = (uint8_t)info[2].As<Number>().Uint32Value();
+    uint32_t clockRate = info[3].As<Number>().Uint32Value();
+    uint8_t playoutDelayId = (uint8_t)info[4].As<Number>().Uint32Value();
+    uint16_t playoutDelayMin = (uint16_t)info[5].As<Number>().Uint32Value();
+    uint16_t playoutDelayMax = (uint16_t)info[6].As<Number>().Uint32Value();
+    try {
+      auto cfg = std::make_shared<rtc::RtpPacketizationConfig>(
+          ssrc, "", pt, clockRate);
+      cfg->playoutDelayId = playoutDelayId;
+      cfg->playoutDelayMin = playoutDelayMin;
+      cfg->playoutDelayMax = playoutDelayMax;
+      std::shared_ptr<rtc::MediaHandler> handler;
+      if (kind == "audio") {
+        handler = std::make_shared<rtc::OpusRtpPacketizer>(cfg);
+      } else if (kind == "h264") {
+        handler = std::make_shared<rtc::H264RtpPacketizer>(
+            rtc::NalUnit::Separator::StartSequence, cfg);
+      } else if (kind == "h265") {
+        handler = std::make_shared<rtc::H265RtpPacketizer>(
+            rtc::NalUnit::Separator::StartSequence, cfg);
+      } else if (kind == "av1") {
+        handler = std::make_shared<rtc::AV1RtpPacketizer>(
+            rtc::AV1RtpPacketizer::Packetization::Obu, cfg);
+      } else {
+        throw std::runtime_error("unknown packetizer kind: " + kind);
+      }
+      handler->addToChain(std::make_shared<rtc::RtcpSrReporter>(cfg));
+      handler->addToChain(std::make_shared<rtc::RtcpNackResponder>());
+      if (kind != "audio") {
+        handler->addToChain(std::make_shared<rtc::PacingHandler>(
+            25.0 * 1000 * 1000, std::chrono::milliseconds(1)));
+      }
+      track_->setMediaHandler(handler);
+      rtpConfig_ = cfg;
+    } catch (const std::exception& e) {
+      fprintf(stderr, "[binding] setPacketizer THREW: %s\n", e.what());
+      throw Error::New(env, e.what());
+    }
+  }
+
+  // sendFrame(buffer) — sends an ENCODED frame (AnnexB H264 / raw opus /
+  // OBU AV1). The media-handler chain packetizes it into RTP.
+  void SendFrame(const Napi::CallbackInfo& info) {
+    Buffer<uint8_t> buf = info[0].As<Buffer<uint8_t>>();
+    if (!track_) return;
+    rtc::binary data(buf.Length());
+    for (size_t i = 0; i < buf.Length(); i++) data[i] = (std::byte)buf[i];
+    try {
+      track_->send(data);
+    } catch (const std::exception& e) {
+      fprintf(stderr, "[binding] track.sendFrame THREW: %s\n", e.what());
+    }
+  }
+
+  // addTimestamp(delta) — advances the packetizer RTP timestamp by delta
+  // (clock-rate units). Called by JS after each frame, matching the
+  // node-datachannel contract (WebRtcWrapper does the same increment).
+  void AddTimestamp(const Napi::CallbackInfo& info) {
+    uint32_t delta = info[0].As<Number>().Uint32Value();
+    if (rtpConfig_) rtpConfig_->timestamp += delta;
+  }
+
+  Napi::Value IsOpen(const Napi::CallbackInfo& info) {
+    bool open = track_ && track_->isOpen();
+    return Boolean::New(info.Env(), open);
+  }
+
+  void Close(const Napi::CallbackInfo& info) {
+    if (track_) track_->close();
+  }
+
+  void OnStateChange(const Napi::CallbackInfo& info) {
+    // libdatachannel Track has no state-change callback; kept for API parity.
+    (void)info;
+  }
+};
+class PeerConnectionWrap : public Napi::ObjectWrap<PeerConnectionWrap> {
+ public:
+  static Function Init(Napi::Env env) {
+    Function func = DefineClass(env, "PeerConnection", {
+      InstanceMethod("state", &PeerConnectionWrap::State),
+      InstanceMethod("createOffer", &PeerConnectionWrap::CreateOffer),
+      InstanceMethod("createAnswer", &PeerConnectionWrap::CreateAnswer),
+      InstanceMethod("setRemoteDescription",
+                     &PeerConnectionWrap::SetRemoteDescription),
+      InstanceMethod("close", &PeerConnectionWrap::Close),
+      InstanceMethod("onStateChange", &PeerConnectionWrap::OnStateChange),
+      InstanceMethod("createDataChannel", &PeerConnectionWrap::CreateDataChannel),
+      InstanceMethod("onDataChannel", &PeerConnectionWrap::OnDataChannel),
+      InstanceMethod("addTrack", &PeerConnectionWrap::AddTrack),
+    });
+    return func;
+  }
+
+  PeerConnectionWrap(const Napi::CallbackInfo& info)
+      : Napi::ObjectWrap<PeerConnectionWrap>(info) {
+    Napi::Env env = info.Env();
+    if (!info[0].IsObject()) {
+      throw TypeError::New(env, "config object required");
+    }
+    Object config = info[0].As<Object>();
+    rtc::Configuration rtcConfig;
+    if (config.Has("iceServers")) {
+      Array servers = config.Get("iceServers").As<Array>();
+      for (uint32_t i = 0; i < servers.Length(); i++) {
+        std::string url = servers.Get(i).As<String>().Utf8Value();
+        rtcConfig.iceServers.emplace_back(url);
+      }
+    }
+    pc_ = std::make_shared<rtc::PeerConnection>(rtcConfig);
+
+    // IMPORTANT: register description/gathering callbacks HERE (constructor),
+    // BEFORE any createDataChannel call. libdatachannel only fires
+    // onLocalDescription for negotiations that start AFTER the callback is
+    // registered — if createDataChannel runs first, the offer callback never
+    // fires (verified in C++ spike: test3 vs test2).
+    pc_->onLocalDescription([this](rtc::Description desc) {
+      latestLocalDesc_ = std::string(desc);
+      fprintf(stderr, "[binding] trickle desc, %zu bytes\n",
+              latestLocalDesc_.size());
+    });
+    pc_->onGatheringStateChange([this](rtc::PeerConnection::GatheringState gs) {
+      fprintf(stderr, "[binding] gathering state: %d\n", (int)gs);
+      if (gs == rtc::PeerConnection::GatheringState::Complete) {
+        // Use the getter — it returns the FULL SDP including candidates after
+        // gathering (trickle callbacks only carry the initial fragment).
+        auto ld = pc_->localDescription();
+        if (ld) {
+          latestLocalDesc_ = std::string(*ld);
+          fprintf(stderr, "[binding] final desc, %zu bytes\n",
+                  latestLocalDesc_.size());
+        }
+        resolvePendingLocalDesc_();
+      }
+    });
+  }
+
+ private:
+  std::shared_ptr<rtc::PeerConnection> pc_;
+  std::shared_ptr<ThreadSafeFunction> stateCb_;
+  std::shared_ptr<ThreadSafeFunction> dcCb_;
+  std::string latestLocalDesc_;
+  std::shared_ptr<DeferredHolder> pendingDescDeferred_;
+  std::shared_ptr<ThreadSafeFunction> pendingDescTsfn_;
+
+  void resolvePendingLocalDesc_() {
+    if (!pendingDescDeferred_ || !pendingDescTsfn_) return;
+    auto holder = pendingDescDeferred_;
+    auto tsfn = pendingDescTsfn_;
+    pendingDescDeferred_.reset();
+    pendingDescTsfn_.reset();
+    std::string sdp = latestLocalDesc_;
+    tsfn->BlockingCall([sdp, holder](Napi::Env e, Function) {
+      holder->deferred.Resolve(String::New(e, sdp));
+    });
+  }
+
+  Napi::Value State(const Napi::CallbackInfo& info) {
+    return String::New(info.Env(),
+                       pc_ ? stateToString(pc_->state()) : "closed");
+  }
+
+  // createOffer() -> Promise<string> — sets local description, waits for
+  // ICE gathering to complete (so candidates are in the SDP), resolves SDP.
+  Napi::Value CreateOffer(const Napi::CallbackInfo& info) {
+    Napi::Env env = info.Env();
+    auto holder = std::make_shared<DeferredHolder>(Promise::Deferred::New(env));
+    if (!pc_) {
+      holder->deferred.Reject(Error::New(env, "peer closed").Value());
+      return holder->deferred.Promise();
+    }
+    // createDataChannel already triggers negotiation in libdatachannel 0.24 —
+    // if gathering already completed, resolve immediately from the cached SDP.
+    if (!latestLocalDesc_.empty()) {
+      auto tsfn = std::make_shared<ThreadSafeFunction>(ThreadSafeFunction::New(
+          env, Function::New(env, [](const CallbackInfo&) {}), "desc", 0, 1));
+      std::string sdp = latestLocalDesc_;
+      tsfn->BlockingCall([sdp, holder](Napi::Env e, Function) {
+        holder->deferred.Resolve(String::New(e, sdp));
+      });
+      return holder->deferred.Promise();
+    }
+    if (pendingDescDeferred_) {
+      pendingDescDeferred_->deferred.Reject(
+          Error::New(env, "previous negotiation still pending").Value());
+    }
+    pendingDescDeferred_ = holder;
+    pendingDescTsfn_ = std::make_shared<ThreadSafeFunction>(
+        ThreadSafeFunction::New(env, Function::New(env, [](const CallbackInfo&) {}),
+                                "desc", 0, 1));
+    fprintf(stderr, "[binding] calling setLocalDescription(Offer)\n");
+    try {
+      pc_->setLocalDescription(rtc::Description::Type::Offer);
+      fprintf(stderr, "[binding] setLocalDescription returned OK\n");
+    } catch (const std::exception& e) {
+      pendingDescDeferred_.reset();
+      fprintf(stderr, "[binding] setLocalDescription THREW: %s\n", e.what());
+      throw Error::New(env, e.what());
+    }
+    return holder->deferred.Promise();
+  }
+
+  // createAnswer(offerSdp: string) -> Promise<string>
+  Napi::Value CreateAnswer(const Napi::CallbackInfo& info) {
+    Napi::Env env = info.Env();
+    std::string offer = info[0].As<String>().Utf8Value();
+    auto holder = std::make_shared<DeferredHolder>(Promise::Deferred::New(env));
+    if (!pc_) {
+      holder->deferred.Reject(Error::New(env, "peer closed").Value());
+      return holder->deferred.Promise();
+    }
+    if (pendingDescDeferred_) {
+      pendingDescDeferred_->deferred.Reject(
+          Error::New(env, "previous negotiation still pending").Value());
+    }
+    pendingDescDeferred_ = holder;
+    pendingDescTsfn_ = std::make_shared<ThreadSafeFunction>(
+        ThreadSafeFunction::New(env, Function::New(env, [](const CallbackInfo&) {}),
+                                "desc", 0, 1));
+    try {
+      pc_->setRemoteDescription(
+          rtc::Description(offer, rtc::Description::Type::Offer));
+      fprintf(stderr, "[binding] answer: setRemoteDescription OK\n");
+      // libdatachannel 0.24 AUTO-GENERATES the answer when a remote offer is
+      // applied (verified in C++ spike test8/9: B desc type=Answer fires
+      // immediately with a=setup:active). Calling setLocalDescription() again
+      // would OVERWRITE it with a role=actpass SDP, which A rejects with
+      // "Illegal role actpass in remote answer description". So we do NOT call
+      // setLocalDescription here — we just wait for gathering complete and
+      // resolve with the auto-generated answer. This also matches @dank074's
+      // Discord voice flow.
+    } catch (const std::exception& e) {
+      pendingDescDeferred_.reset();
+      fprintf(stderr, "[binding] answer THREW: %s\n", e.what());
+      holder->deferred.Reject(Error::New(env, e.what()).Value());
+    }
+    return holder->deferred.Promise();
+  }
+
+  void SetRemoteDescription(const Napi::CallbackInfo& info) {
+    std::string sdp = info[0].As<String>().Utf8Value();
+    std::string type = info[1].As<String>().Utf8Value();
+    rtc::Description::Type t = (type == "answer")
+                                   ? rtc::Description::Type::Answer
+                                   : rtc::Description::Type::Offer;
+    if (pc_) pc_->setRemoteDescription(rtc::Description(sdp, t));
+  }
+
+  void Close(const Napi::CallbackInfo& info) {
+    if (pc_) pc_->close();
+  }
+
+  void OnStateChange(const Napi::CallbackInfo& info) {
+    Function cb = info[0].As<Function>();
+    stateCb_ = std::make_shared<ThreadSafeFunction>(
+        ThreadSafeFunction::New(info.Env(), cb, "pc-state", 0, 1));
+    std::shared_ptr<rtc::PeerConnection> pc = pc_;
+    pc->onStateChange([this](rtc::PeerConnection::State state) {
+      if (stateCb_) {
+        std::string s = stateToString(state);
+        stateCb_->BlockingCall([s](Napi::Env env, Function cb) {
+          cb.Call({String::New(env, s)});
+        });
+      }
+    });
+  }
+
+  Napi::Value CreateDataChannel(const Napi::CallbackInfo& info) {
+    Napi::Env env = info.Env();
+    std::string label = info[0].As<String>().Utf8Value();
+    fprintf(stderr, "[binding] createDataChannel(%s)\n", label.c_str());
+    auto dc = pc_->createDataChannel(label);
+    Object obj = DataChannelWrap::NewInstance(env);
+    DataChannelWrap::Unwrap(obj)->Init(dc);
+    return obj;
+  }
+
+  Napi::Value AddTrack(const Napi::CallbackInfo& info) {
+    Napi::Env env = info.Env();
+    std::string mid = info[0].As<String>().Utf8Value();
+    std::string kind = info[1].As<String>().Utf8Value();
+    if (!pc_) throw Error::New(env, "peer closed");
+    fprintf(stderr, "[binding] addTrack(%s, %s) start\n", mid.c_str(), kind.c_str());
+    try {
+      std::shared_ptr<rtc::Track> track;
+      if (kind == "audio") {
+      // Opus payload type 120 (matches @dank074 CodecPayloadType.opus)
+      auto desc = rtc::Description::Audio(mid);
+      desc.addOpusCodec(120);
+      track = pc_->addTrack(desc);
+      } else {
+      // All video codecs with their payload types, matching WebRtcWrapper:
+      // H264 101/102, H265 103/104, VP8 105/106, VP9 107/108, AV1 109/110
+      auto desc = rtc::Description::Video(mid);
+      desc.addH264Codec(101);
+      desc.addRtxCodec(102, 101, 90000);
+      desc.addH265Codec(103);
+      desc.addRtxCodec(104, 103, 90000);
+      desc.addVP8Codec(105);
+      desc.addRtxCodec(106, 105, 90000);
+      desc.addVP9Codec(107);
+      desc.addRtxCodec(108, 107, 90000);
+      desc.addAV1Codec(109);
+      desc.addRtxCodec(110, 109, 90000);
+      track = pc_->addTrack(desc);
+    }
+      Object obj = TrackWrap::NewInstance(env);
+      TrackWrap::Unwrap(obj)->Init(track, env);
+      return obj;
+    } catch (const std::exception& e) {
+      fprintf(stderr, "[binding] addTrack THREW: %s\n", e.what());
+      throw Error::New(env, e.what());
+    }
+  }
+
+  void OnDataChannel(const Napi::CallbackInfo& info) {
+    Function cb = info[0].As<Function>();
+    dcCb_ = std::make_shared<ThreadSafeFunction>(
+        ThreadSafeFunction::New(info.Env(), cb, "dc", 0, 1));
+    std::shared_ptr<rtc::PeerConnection> pc = pc_;
+    pc->onDataChannel([this](std::shared_ptr<rtc::DataChannel> dc) {
+      if (dcCb_) {
+        auto dcPtr = dc;
+        dcCb_->BlockingCall([dcPtr](Napi::Env env, Function cb) {
+          Object obj = DataChannelWrap::NewInstance(env);
+          DataChannelWrap::Unwrap(obj)->Init(dcPtr);
+          cb.Call({obj});
+        });
+      }
+    });
+  }
+};
+
+Object InitAll(Napi::Env env, Object exports) {
+  exports.Set("PeerConnection", PeerConnectionWrap::Init(env));
+  exports.Set("DataChannel", DataChannelWrap::Init(env));
+  exports.Set("Track", TrackWrap::Init(env));
+  return exports;
+}
+
+NODE_API_MODULE(libdatachannel_min, InitAll)
+
+// Definition for the static constructor references.
+FunctionReference DataChannelWrap::dcConstructor;
+FunctionReference TrackWrap::trackConstructor;
+
+}  // namespace

services/discord-gateway/native/libdatachannel-min/binding.gyp

@@ -0,0 +1,21 @@
+{
+  "targets": [
+    {
+      "target_name": "libdatachannel_min",
+      "sources": ["binding.cpp"],
+      "include_dirs": [
+        "<!(node -e \"console.log(process.env.NAPI_INCLUDE || (() => { try { return require('node-addon-api').include; } catch { return '/nonexistent'; } })())\")",
+        "<!(node -e \"const s=process.env.LDC_INCLUDE||'/nix/store/39a85gpfjqy3h3k8jwrwh7m9yc3inqw7-source';console.log(s+'/include')\")"
+      ],
+      "libraries": [
+        "<!(node -e \"console.log(process.env.LDC_LIB || '/tmp/ldc-build/libdatachannel.so.0.24.0')\")"
+      ],
+      "cflags": ["-std=c++17", "-fexceptions"],
+      "cflags_cc": ["-std=c++17", "-fexceptions"],
+      "defines": ["NAPI_CPP_EXCEPTIONS"],
+      "conditions": [
+        ["OS=='linux'", { "cflags": ["-fvisibility=hidden"] }]
+      ]
+    }
+  ]
+}

services/discord-gateway/native/libdatachannel-min/index.js

@@ -0,0 +1,3 @@
+// libdatachannel-min — JS entry.
+const native = require("./build/Release/datachannel_min.node");
+module.exports = native;

services/discord-gateway/native/libdatachannel-min/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "libdatachannel-min",
+  "version": "0.1.0",
+  "description": "Minimal N-API binding to libdatachannel — PeerConnection, DataChannel, ICE, SDP (+ media tracks for GoLive)",
+  "main": "index.js",
+  "gypfile": true,
+  "scripts": {
+    "build": "node-gyp rebuild",
+    "test": "node test-handshake.js"
+  },
+  "dependencies": {
+    "node-addon-api": "^8.3.0"
+  },
+  "devDependencies": {
+    "node-gyp": "^11.5.0"
+  }
+}

services/discord-gateway/native/libdatachannel-min/test-handshake.js

@@ -0,0 +1,82 @@
+// Phase 0 spike: prove the minimal binding can do a full WebRTC handshake
+// (offer/answer + ICE + DataChannel) between two local PeerConnections.
+"use strict";
+const { PeerConnection } = require("./build/Release/datachannel_min.node");
+
+function log(...args) {
+  console.log("[spike]", ...args);
+}
+
+async function main() {
+  const pcA = new PeerConnection({ iceServers: [] });
+  const pcB = new PeerConnection({ iceServers: [] });
+
+  const stateLog = [];
+  pcA.onStateChange((s) => {
+    stateLog.push(`A:${s}`);
+    log("A state:", s);
+  });
+  pcB.onStateChange((s) => {
+    stateLog.push(`B:${s}`);
+    log("B state:", s);
+  });
+
+  // B waits for incoming DataChannel
+  const received = new Promise((resolve) => {
+    pcB.onDataChannel((dc) => {
+      log("B got incoming DataChannel");
+      dc.onOpen(() => log("B DataChannel open"));
+      dc.onMessage((msg) => {
+        log("B received message:", msg);
+        dc.send("pong from B");
+        resolve(msg);
+      });
+    });
+  });
+
+  // A creates an outgoing DataChannel
+  const dcA = pcA.createDataChannel("test");
+  dcA.onOpen(() => {
+    log("A DataChannel open — sending hello");
+    dcA.send("hello from A");
+  });
+  dcA.onMessage((msg) => {
+    log("A received reply:", msg);
+  });
+
+  // Offer/answer dance
+  log("A createOffer...");
+  const offer = await pcA.createOffer();
+  log("Offer SDP bytes:", offer.length);
+  log("B createAnswer...");
+  const answer = await pcB.createAnswer(offer);
+  log("Answer SDP bytes:", answer.length);
+  const setupMatch = answer.match(/a=setup:(\S+)/);
+  log("Answer setup role:", setupMatch ? setupMatch[1] : "NONE");
+  pcA.setRemoteDescription(answer, "answer");
+
+  // Wait for message roundtrip
+  const msg = await Promise.race([
+    received,
+    new Promise((_, rej) => setTimeout(() => rej(new Error("TIMEOUT waiting for datachannel message")), 15000)),
+  ]);
+
+  log("ROUNDTRIP OK — B got:", msg);
+  log("States:", stateLog.join(" | "));
+
+  const aState = pcA.state();
+  const bState = pcB.state();
+  log("Final states — A:", aState, "B:", bState);
+
+  pcA.close();
+  pcB.close();
+
+  if (msg !== "hello from A") throw new Error("wrong message");
+  if (aState !== "connected" && aState !== "disconnected") throw new Error("A not connected: " + aState);
+  log("SPIKE PASSED ✅");
+}
+
+main().catch((e) => {
+  console.error("SPIKE FAILED:", e.message);
+  process.exit(1);
+});

services/discord-gateway/native/libdatachannel-min/test-packetizer.js

@@ -0,0 +1,80 @@
+// Verify setPacketizer + sendFrame: two peers connect, audio+video tracks
+// packetize real encoded frames (opus + AnnexB H264), RTP flows without crash.
+"use strict";
+const { PeerConnection } = require("./build/Release/datachannel_min.node");
+
+function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
+
+async function main() {
+  const pcA = new PeerConnection({ iceServers: [] });
+  const pcB = new PeerConnection({ iceServers: [] });
+
+  const aAudio = pcA.addTrack("0", "audio");
+  const aVideo = pcA.addTrack("1", "video");
+  pcB.addTrack("0", "audio");
+  pcB.addTrack("1", "video");
+
+  let states = { a: "", b: "" };
+  pcA.onStateChange((s) => (states.a = s));
+  pcB.onStateChange((s) => (states.b = s));
+
+  // A: offer (createDataChannel not needed — tracks trigger negotiation)
+  const offer = await pcA.createOffer();
+  pcB.setRemoteDescription(offer, "offer");
+  const answer = await pcB.createAnswer(offer);
+  pcA.setRemoteDescription(answer, "answer");
+
+  // Wait for connected
+  for (let i = 0; i < 50; i++) {
+    if (states.a === "connected" && states.b === "connected") break;
+    await sleep(100);
+  }
+  console.log("[pkt] states:", states.a, states.b);
+  if (states.a !== "connected" || states.b !== "connected") {
+    console.log("PKT TEST FAILED: not connected");
+    process.exit(1);
+  }
+
+  // Setup packetizers on A (sender)
+  aAudio.setPacketizer("audio", 1234, 120, 48000, 5, 0, 1);
+  aVideo.setPacketizer("h264", 5678, 101, 90000, 5, 0, 10);
+
+  // Fake opus frame (20ms @48kHz stereo — payload can be any bytes)
+  const opusFrame = Buffer.alloc(160);
+  for (let i = 0; i < 160; i++) opusFrame[i] = i & 0xff;
+
+  // Fake AnnexB H264 frame: SPS + PPS + IDR slice
+  const sps = Buffer.from([0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0xc0, 0x1e, 0xd9, 0x01, 0x40, 0x7e]);
+  const pps = Buffer.from([0x00, 0x00, 0x00, 0x01, 0x68, 0xce, 0x3c, 0x80]);
+  const idr = Buffer.from([0x00, 0x00, 0x00, 0x01, 0x65, 0x88, 0x84, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07]);
+  const h264Frame = Buffer.concat([sps, pps, idr]);
+
+  // Send 10 audio frames (20ms each) + 3 video frames (33ms each)
+  for (let i = 0; i < 10; i++) {
+    aAudio.sendFrame(opusFrame);
+    aAudio.addTimestamp(960); // 20ms @ 48kHz
+  }
+  for (let i = 0; i < 3; i++) {
+    aVideo.sendFrame(h264Frame);
+    aVideo.addTimestamp(3000); // 33ms @ 90kHz
+  }
+
+  await sleep(500);
+  console.log("[pkt] after send: states:", states.a, states.b);
+  console.log("[pkt] audio track open:", aAudio.isOpen(), "| video track open:", aVideo.isOpen());
+  const ok = states.a === "connected" && aAudio.isOpen() && aVideo.isOpen();
+  console.log(ok ? "PKT TEST PASSED" : "PKT TEST FAILED");
+  pcA.close();
+  pcB.close();
+  process.exit(ok ? 0 : 1);
+}
+
+main().catch((e) => {
+  console.error("[pkt] FAILED:", e.message);
+  process.exit(1);
+});
+
+setTimeout(() => {
+  console.error("[pkt] TIMEOUT");
+  process.exit(1);
+}, 25000);

services/discord-gateway/native/libdatachannel-min/test-track.js

@@ -0,0 +1,33 @@
+// Verify addTrack produces SDP with audio+video media sections.
+"use strict";
+const { PeerConnection } = require("./build/Release/datachannel_min.node");
+
+const pc = new PeerConnection({ iceServers: [] });
+const audioTrack = pc.addTrack("0", "audio");
+const videoTrack = pc.addTrack("1", "video");
+
+pc.onStateChange((s) => console.log("[test-track] state:", s));
+
+pc.createOffer().then((sdp) => {
+  const hasAudio = /^m=audio\s/m.test(sdp);
+  const hasVideo = /^m=video\s/m.test(sdp);
+  const audioPts = sdp.match(/a=rtpmap:(\d+) opus/g) || [];
+  const videoPts = sdp.match(/a=rtpmap:(\d+) H264/g) || [];
+  console.log("[test-track] SDP bytes:", sdp.length);
+  console.log("[test-track] m=audio:", hasAudio, "| m=video:", hasVideo);
+  console.log("[test-track] opus pt:", audioPts, "| H264 pt:", videoPts);
+  console.log("[test-track] audio track send ok:", typeof audioTrack.send === "function");
+  console.log("[test-track] video track send ok:", typeof videoTrack.send === "function");
+  const ok = hasAudio && hasVideo && audioPts.length > 0 && videoPts.length > 0;
+  console.log(ok ? "TRACK TEST PASSED" : "TRACK TEST FAILED");
+  pc.close();
+  process.exit(ok ? 0 : 1);
+}).catch((e) => {
+  console.error("[test-track] FAILED:", e.message);
+  process.exit(1);
+});
+
+setTimeout(() => {
+  console.error("[test-track] TIMEOUT");
+  process.exit(1);
+}, 20000);

services/discord-gateway/package.json

@@ -7,11 +7,8 @@
   "pnpm": {
     "onlyBuiltDependencies": [
       "@discordjs/opus",
-      "@lng2004/node-datachannel",
       "esbuild",
-      "node-av",
-      "sharp",
-      "zeromq"
+      "sharp"
     ]
   },
   "scripts": {
@@ -24,7 +21,6 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@dank074/discord-video-stream": "6.0.0",
     "@discordjs/opus": "^0.10.0",
     "@discordjs/voice": "^0.19.2",
     "@snazzah/davey": "^0.1.11",

services/discord-gateway/pnpm-workspace.yaml

@@ -3,6 +3,7 @@ allowBuilds:
   "@lng2004/node-datachannel": true
   esbuild: true
   node-av: true
+  sharp: true
   zeromq: true
 # pnpm 11 requires build-script approvals here (the legacy `pnpm` field in
 # package.json is ignored). Native voice deps need their postinstall build.