Lumi/knowledge/core/lumi-core.md

id	title	scope	status	priority	visibility	category	tags	generated	editable
core.lumi	lumi-bot	core	active	20	user	Core	core, routes, commands, settings	true	false

lumi-bot

Lumi is the core web UI and bot runtime.

Runtime

Package: lumi-bot Version: 0.2.25

Routes

• POST /api/diagnostics/v1/run
• GET /api/events
• POST /api/destructive-confirmations
• GET /api/users/search
• GET /api/placeholders/catalog
• POST /api/placeholders/preview
• GET /api/feedback/similar
• POST /api/feedback/:id/support
• POST /api/feedback
• GET /api/feedback/notifications
• GET /
• GET /api/assistant-panels
• GET /setup
• GET /setup/discord
• POST /setup/discord/verify
• POST /setup/discord/cancel
• GET /setup/twitch
• POST /setup/twitch/verify
• POST /setup/twitch/cancel
• GET /setup/youtube
• POST /setup/youtube/connect
• POST /setup/youtube/verify
• POST /setup/youtube/cancel
• GET /auth/discord
• GET /auth/discord/callback
• GET /auth/localhost
• POST /auth/localhost
• POST /auth/logout
• GET /auth/twitch
• GET /auth/twitch/login
• GET /admin/twitch-events/connect
• GET /auth/twitch/callback
• GET /auth/youtube
• GET /auth/youtube/login
• GET /auth/youtube/callback
• GET /profile
• POST /profile/unlink/:provider
• POST /profile/username
• GET /feedback
• POST /feedback/:id/comment
• POST /feedback/:id/support
• GET /feedback/:id/screenshot
• GET /feedback/:id/attachments/:attachmentId
• GET /health
• GET /commands
• GET /leaderboards
• GET /stats
• GET /stats/:username
• GET /pages/:slug
• GET /moderator
• GET /admin
• GET /api/admin/dashboard-metrics
• GET /admin/settings
• POST /admin/settings
• POST /admin/settings/nav-icons
• POST /admin/settings/nav-icons/reset
• GET /admin/navigation
• POST /admin/navigation
• POST /admin/navigation/reset
• GET /admin/discord-wizard
• POST /admin/discord-wizard/verify
• POST /admin/discord-wizard/cancel
• GET /admin/twitch-wizard
• POST /admin/twitch-wizard/verify
• POST /admin/twitch-wizard/cancel
• GET /admin/youtube-wizard
• POST /admin/youtube-wizard/connect
• POST /admin/youtube-wizard/verify
• POST /admin/youtube-wizard/cancel
• GET /admin/theming
• POST /admin/theming/select
• POST /admin/theming/duplicate
• POST /admin/theming/custom/:id/save
• POST /admin/theming/custom/:id/rename
• POST /admin/theming/custom/:id/delete
• POST /admin/theming
• GET /admin/diagnostics
• POST /admin/diagnostics/run
• POST /admin/diagnostics/access/renew
• POST /admin/diagnostics/access/revoke
• GET /admin/logs
• POST /admin/logs/retention
• GET /admin/logs/download
• GET /admin/feedback
• POST /admin/feedback/export
• POST /admin/feedback/:id/export
• POST /admin/feedback/:id/create-okf-correction
• POST /admin/feedback/:id/merge
• POST /admin/feedback/:id/unmerge
• POST /admin/feedback/:id
• POST /admin/feedback/:id/finalize
• POST /admin/feedback/:id/reopen
• POST /admin/feedback/:id/delete
• POST /admin/feedback/:id/cleanup
• GET /admin/privileges
• GET /admin/commands
• GET /admin/command-policies
• POST /admin/command-policies/groups
• POST /admin/command-policies/groups/:id
• POST /admin/command-policies/groups/:id/delete
• POST /admin/command-policies/commands
• POST /admin/command-policies/command
• POST /admin/commands
• POST /admin/commands/:id/toggle
• POST /admin/commands/:id/delete
• POST /admin/commands/:id/update
• POST /admin/commands/:id/preview
• GET /admin/pages
• GET /admin/users
• POST /admin/users/:id/username
• POST /admin/pages
• POST /admin/pages/:id/toggle
• POST /admin/pages/:id/delete
• POST /admin/pages/:id/update
• GET /admin/plugins
• POST /admin/plugins/:id/toggle
• POST /admin/plugins/:id/uninstall
• POST /admin/plugins/upload
• POST /admin/plugins/install
• POST /admin/plugins/create
• POST /admin/plugins/:id/update
• GET /admin/updates/events
• GET /admin/updates/status
• GET /admin/updates/recovery
• POST /admin/updates/recovery/clear-marker
• POST /admin/updates/recovery/retry-normal-startup
• GET /admin/updates
• POST /admin/updates/snapshots/settings
• POST /admin/updates/core/check
• POST /admin/updates/core/apply
• POST /admin/updates/core/revert
• POST /admin/updates/bot
• POST /admin/updates/core/zip
• POST /admin/updates/plugin
• POST /admin/updates/plugins/:id/check
• POST /admin/updates/plugins/:id/apply
• POST /admin/updates/plugins/:id/revert
• POST /admin/updates/plugins/:id/disable
• POST /admin/updates/plugins/:id/zip
• POST /admin/update
• POST /admin/check-update
• POST /admin/restart
• GET /media/:token/:filename
• GET /internal/media/:id/:filename
• GET /admin/resources
• GET /api/admin/resources
• GET /admin/resources/:id/raw/:filename
• GET /admin/resources/:id/download/:filename
• POST /admin/resources/upload
• POST /admin/resources/settings
• POST /admin/resources/:id/rename
• POST /admin/resources/:id/access
• POST /admin/resources/:id/revoke
• POST /admin/resources/:id/delete
• GET /overlay-web/:ticket
• POST ${basePath}/obs-bridge
• GET ${basePath}/module-health
• GET ${basePath}/state
• GET ${basePath}/events
• GET /overlay-chat/:ticket/state
• GET /overlay-chat/:ticket/events
• GET /overlay-chat/:ticket
• GET /admin/overlays/:id/modules/:moduleId/web-preview/:ticket
• GET /admin/overlays
• POST /admin/overlays
• POST /admin/overlays/reorder
• GET /admin/overlays/:id
• GET /admin/overlays/:id/preview-window
• POST /admin/overlays/:id
• POST /admin/overlays/:id/duplicate
• POST /admin/overlays/:id/delete
• POST /admin/overlays/:id/token/revoke
• POST /admin/overlays/:id/active-scene
• POST /admin/overlays/:id/scenes
• POST /admin/overlays/:id/scenes/reorder
• POST /admin/overlays/:id/scenes/:sceneId
• POST /admin/overlays/:id/scenes/:sceneId/duplicate
• POST /admin/overlays/:id/scenes/:sceneId/delete
• POST /admin/overlays/:id/scenes/:sceneId/token/revoke
• POST /admin/overlays/:id/scenes/:sceneId/modules
• POST /admin/overlays/:id/scenes/:sceneId/modules/reorder
• POST /admin/overlays/:id/modules/:moduleId
• POST /admin/overlays/:id/modules/:moduleId/duplicate
• POST /admin/overlays/:id/modules/:moduleId/delete
• POST /admin/overlays/:id/event-hooks
• POST /admin/overlays/:id/event-hooks/:hookId
• POST /admin/overlays/:id/event-hooks/:hookId/test
• POST /admin/overlays/:id/event-hooks/:hookId/delete
• POST /api/admin/overlays/:id/modules/:moduleId/transform
• POST /api/admin/overlays/:id/modules/:moduleId/preview
• POST /api/admin/overlays/:id/modules/:moduleId/refresh
• GET /api/admin/overlays/:id/modules/:moduleId/health
• POST /admin/overlays/:id/obs
• GET /api/admin/overlays/:id/obs/status
• POST /api/admin/overlays/:id/obs/test
• POST /api/admin/overlays/:id/obs/scene
• POST /api/admin/overlays/:id/obs/import

Route Reference

POST /api/diagnostics/v1/run

• Purpose: Provides api diagnostics v1 run data as JSON.
• Inputs: body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: JSON response
• Access: API route; access requirements were not fully detected by static analysis.
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

GET /api/events

• Purpose: Streams live WebUI event notifications to the browser.
• Inputs: No request parameters detected by static analysis.
• Response format: streaming event response
• Access: logged-in session required or used
• Side effects: publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. API consumers should expect JSON unless the response format says otherwise.

POST /api/destructive-confirmations

• Purpose: Provides api destructive confirmations data as JSON.
• Inputs: body: action
• Response format: JSON response
• Access: logged-in session required or used
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

GET /api/users/search

• Purpose: Searches known linked Lumi users for shared user-lookup fields.
• Inputs: query: limit, q
• Response format: JSON response
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. API consumers should expect JSON unless the response format says otherwise.

GET /api/placeholders/catalog

• Purpose: Returns placeholder suggestions available to the current user and field policy.
• Inputs: query: field_id, output_audience
• Response format: JSON response
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

POST /api/placeholders/preview

• Purpose: Previews placeholder rendering for a submitted template without saving it.
• Inputs: body: field_id, output_audience, template
• Response format: JSON response
• Access: logged-in session required or used
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

GET /api/feedback/similar

• Purpose: Provides api feedback similar data as JSON.
• Inputs: query: limit
• Response format: JSON response
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

POST /api/feedback/:id/support

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id
• Response format: JSON response
• Access: logged-in session required or used
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

POST /api/feedback

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: file upload: multipart form file data; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: API response; exact schema was not detected statically.
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

GET /api/feedback/notifications

• Purpose: Provides api feedback notifications data as JSON.
• Inputs: No request parameters detected by static analysis.
• Response format: JSON response
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. API consumers should expect JSON unless the response format says otherwise.

GET /

• Purpose: Renders the requested WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page.

GET /api/assistant-panels

• Purpose: Provides api assistant panels data as JSON.
• Inputs: No request parameters detected by static analysis.
• Response format: JSON response
• Access: logged-in session required or used; mount-level canAccess predicate applies
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

GET /setup

• Purpose: Guides first-time platform setup and verification.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /setup/discord

• Purpose: Guides first-time platform setup and verification.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /setup/discord/verify

• Purpose: Guides first-time platform setup and verification.
• Inputs: body: discord_admin_role_id, discord_bot_token, discord_client_id, discord_client_secret, discord_guild_id, discord_mod_role_id, discord_redirect_uri
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /setup/discord/cancel

• Purpose: Guides first-time platform setup and verification.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /setup/twitch

• Purpose: Guides first-time platform setup and verification.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /setup/twitch/verify

• Purpose: Guides first-time platform setup and verification.
• Inputs: body: twitch_bot_oauth, twitch_bot_username, twitch_channels, twitch_client_id, twitch_client_secret, twitch_redirect_uri
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /setup/twitch/cancel

• Purpose: Guides first-time platform setup and verification.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /setup/youtube

• Purpose: Guides first-time platform setup and verification.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /setup/youtube/connect

• Purpose: Guides first-time platform setup and verification.
• Inputs: body: youtube_client_id, youtube_client_secret, youtube_redirect_uri
• Response format: HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /setup/youtube/verify

• Purpose: Guides first-time platform setup and verification.
• Inputs: body: youtube_client_id, youtube_client_secret, youtube_redirect_uri
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /setup/youtube/cancel

• Purpose: Guides first-time platform setup and verification.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /auth/discord

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /auth/discord/callback

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: query: full query object is passed to a helper; exact fields are defined by the matching view/service
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page.

GET /auth/localhost

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /auth/localhost

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: body: password, username
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /auth/logout

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /auth/twitch

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /auth/twitch/login

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/twitch-events/connect

• Purpose: Handles admin twitch events connect.
• Inputs: query: return
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /auth/twitch/callback

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: query: full query object is passed to a helper; exact fields are defined by the matching view/service
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state; writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page.

GET /auth/youtube

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /auth/youtube/login

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /auth/youtube/callback

• Purpose: Starts, completes, or cancels a platform authentication/linking flow.
• Inputs: query: full query object is passed to a helper; exact fields are defined by the matching view/service
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state; writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page.

GET /profile

• Purpose: Renders the profile WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /profile/unlink/:provider

• Purpose: Processes the profile unlink provider action and stores or applies submitted form data.
• Inputs: path params: provider
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state; writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /profile/username

• Purpose: Processes the profile username action and stores or applies submitted form data.
• Inputs: body: internal_username
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /feedback

• Purpose: Renders the feedback WebUI page.
• Inputs: query: id
• Response format: HTML page rendered from an EJS view
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /feedback/:id/comment

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: comment
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /feedback/:id/support

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id
• Response format: HTTP redirect after handling the request
• Access: logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /feedback/:id/screenshot

• Purpose: Handles feedback id screenshot.
• Inputs: path params: id
• Response format: static file response
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /feedback/:id/attachments/:attachmentId

• Purpose: Handles feedback id attachments attachmentId.
• Inputs: path params: attachmentId, id
• Response format: file download
• Access: admin access expected; logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /health

• Purpose: Returns runtime health information.
• Inputs: No request parameters detected by static analysis.
• Response format: JSON response
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /commands

• Purpose: Displays configured bot commands.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected; logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /leaderboards

• Purpose: Displays leaderboard data.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /stats

• Purpose: Displays user or community statistics.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /stats/:username

• Purpose: Displays user or community statistics.
• Inputs: path params: username
• Response format: HTML page rendered from an EJS view
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /pages/:slug

• Purpose: Renders the pages slug WebUI page.
• Inputs: path params: slug
• Response format: HTML page rendered from an EJS view
• Access: logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /moderator

• Purpose: Renders the moderator WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: moderator access may be required
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin

• Purpose: Renders the admin WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /api/admin/dashboard-metrics

• Purpose: Provides api admin dashboard metrics data as JSON.
• Inputs: query: scope
• Response format: JSON response
• Access: admin access expected
• Side effects: writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

GET /admin/settings

• Purpose: Renders the core settings page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected; logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/settings

• Purpose: Saves core settings from the admin settings form.
• Inputs: body: localhost_login_password, localhost_login_username
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Input length or numeric bounds are enforced by helper functions in the handler. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/settings/nav-icons

• Purpose: Saves core settings from the admin settings form.
• Inputs: body: item_id; file upload: multipart form file data
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/settings/nav-icons/reset

• Purpose: Saves core settings from the admin settings form.
• Inputs: body: item_id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/navigation

• Purpose: Renders the admin navigation WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected; logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/navigation

• Purpose: Processes the admin navigation action and stores or applies submitted form data.
• Inputs: body: nav_enabled, nav_include_unassigned, nav_sections, nav_unassigned_icon, nav_unassigned_id, nav_unassigned_label
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/navigation/reset

• Purpose: Processes the admin navigation reset action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/discord-wizard

• Purpose: Renders the admin discord wizard WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/discord-wizard/verify

• Purpose: Renders the admin discord wizard verify WebUI page.
• Inputs: body: discord_admin_role_id, discord_bot_token, discord_client_id, discord_client_secret, discord_guild_id, discord_mod_role_id, discord_redirect_uri
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/discord-wizard/cancel

• Purpose: Processes the admin discord wizard cancel action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/twitch-wizard

• Purpose: Renders the admin twitch wizard WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/twitch-wizard/verify

• Purpose: Renders the admin twitch wizard verify WebUI page.
• Inputs: body: twitch_bot_oauth, twitch_bot_username, twitch_channels, twitch_client_id, twitch_client_secret, twitch_redirect_uri
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/twitch-wizard/cancel

• Purpose: Processes the admin twitch wizard cancel action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/youtube-wizard

• Purpose: Renders the admin youtube wizard WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/youtube-wizard/connect

• Purpose: Processes the admin youtube wizard connect action and stores or applies submitted form data.
• Inputs: body: youtube_client_id, youtube_client_secret, youtube_redirect_uri
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/youtube-wizard/verify

• Purpose: Renders the admin youtube wizard verify WebUI page.
• Inputs: body: youtube_client_id, youtube_client_secret, youtube_redirect_uri
• Response format: HTML page rendered from an EJS view; HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/youtube-wizard/cancel

• Purpose: Processes the admin youtube wizard cancel action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/theming

• Purpose: Renders the admin theming WebUI page.
• Inputs: query: edit
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/theming/select

• Purpose: Processes the admin theming select action and stores or applies submitted form data.
• Inputs: body: theme_id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/theming/duplicate

• Purpose: Processes the admin theming duplicate action and stores or applies submitted form data.
• Inputs: body: name, theme_id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/theming/custom/:id/save

• Purpose: Processes the admin theming custom id save action and stores or applies submitted form data.
• Inputs: path params: id; body: apply
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/theming/custom/:id/rename

• Purpose: Processes the admin theming custom id rename action and stores or applies submitted form data.
• Inputs: path params: id; body: name
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/theming/custom/:id/delete

• Purpose: Processes the admin theming custom id delete action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/theming

• Purpose: Processes the admin theming action and stores or applies submitted form data.
• Inputs: body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/diagnostics

• Purpose: Handles admin diagnostics.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML or data response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/diagnostics/run

• Purpose: Processes the admin diagnostics run action and stores or applies submitted form data.
• Inputs: body: check
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected; logged-in session required or used
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/diagnostics/access/renew

• Purpose: Processes the admin diagnostics access renew action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/diagnostics/access/revoke

• Purpose: Processes the admin diagnostics access revoke action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/logs

• Purpose: Displays, downloads, or manages application logs.
• Inputs: query: category, level, limit, q, range, source
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/logs/retention

• Purpose: Displays, downloads, or manages application logs.
• Inputs: body: max_age_days, max_entries
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/logs/download

• Purpose: Displays, downloads, or manages application logs.
• Inputs: query: category, format, level, limit, q, range, source
• Response format: plain or HTML response
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/feedback

• Purpose: Renders the admin feedback WebUI page.
• Inputs: query: area, category, date_from, date_to, needs_action, plugin, route, scope, severity, sort, status, submitter, target
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/feedback/export

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: JSON response
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id/export

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: JSON response
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id/create-okf-correction

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: status_note
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id/merge

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: target_feedback_id
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id/unmerge

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id/finalize

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: status_note
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id/reopen

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: status_note
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id/delete

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/feedback/:id/cleanup

• Purpose: Creates, updates, comments on, exports, or manages feedback records depending on the action path.
• Inputs: path params: id; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: HTTP redirect after handling the request
• Access: admin access expected; logged-in session required or used
• Side effects: writes or mutates server-side state; writes files
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/privileges

• Purpose: Renders the admin privileges WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/commands

• Purpose: Displays configured bot commands.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected; logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/command-policies

• Purpose: Renders the admin command policies WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/command-policies/groups

• Purpose: Processes the admin command policies groups action and stores or applies submitted form data.
• Inputs: body: description, name
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/command-policies/groups/:id

• Purpose: Processes the admin command policies groups id action and stores or applies submitted form data.
• Inputs: path params: id; body: description, name
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/command-policies/groups/:id/delete

• Purpose: Processes the admin command policies groups id delete action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/command-policies/commands

• Purpose: Creates, updates, previews, toggles, or deletes custom commands.
• Inputs: body: ${prefix}group_ids, ${prefix}key, command_count
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/command-policies/command

• Purpose: Processes the admin command policies command action and stores or applies submitted form data.
• Inputs: body: command_key, group_ids
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/commands

• Purpose: Creates, updates, previews, toggles, or deletes custom commands.
• Inputs: body: code, conditional_fuzzy, description, language, mode, response, trigger
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected; logged-in session required or used
• Side effects: writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Input length or numeric bounds are enforced by helper functions in the handler. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/commands/:id/toggle

• Purpose: Creates, updates, previews, toggles, or deletes custom commands.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/commands/:id/delete

• Purpose: Creates, updates, previews, toggles, or deletes custom commands.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/commands/:id/update

• Purpose: Creates, updates, previews, toggles, or deletes custom commands.
• Inputs: path params: id; body: code, conditional_fuzzy, description, language, mode, response, trigger
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected; logged-in session required or used
• Side effects: writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Input length or numeric bounds are enforced by helper functions in the handler. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/commands/:id/preview

• Purpose: Creates, updates, previews, toggles, or deletes custom commands.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/pages

• Purpose: Renders the admin pages WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/users

• Purpose: Renders the admin users WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected; logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/users/:id/username

• Purpose: Processes the admin users id username action and stores or applies submitted form data.
• Inputs: path params: id; body: internal_username
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/pages

• Purpose: Processes the admin pages action and stores or applies submitted form data.
• Inputs: body: content, content_css, format, nav_label, role, show_in_nav, slug, title
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/pages/:id/toggle

• Purpose: Processes the admin pages id toggle action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/pages/:id/delete

• Purpose: Processes the admin pages id delete action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/pages/:id/update

• Purpose: Processes the admin pages id update action and stores or applies submitted form data.
• Inputs: path params: id; body: content, content_css, format, nav_label, role, show_in_nav, slug, title
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes database state when the called service mutates data
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/plugins

• Purpose: Manages installed plugins, plugin uploads, installs, updates, or plugin enablement.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/plugins/:id/toggle

• Purpose: Manages installed plugins, plugin uploads, installs, updates, or plugin enablement.
• Inputs: path params: id; body: enabled
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/plugins/:id/uninstall

• Purpose: Manages installed plugins, plugin uploads, installs, updates, or plugin enablement.
• Inputs: path params: id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/plugins/upload

• Purpose: Manages installed plugins, plugin uploads, installs, updates, or plugin enablement.
• Inputs: file upload: multipart form file data
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/plugins/install

• Purpose: Manages installed plugins, plugin uploads, installs, updates, or plugin enablement.
• Inputs: body: url
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/plugins/create

• Purpose: Manages installed plugins, plugin uploads, installs, updates, or plugin enablement.
• Inputs: body: description, id, name
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/plugins/:id/update

• Purpose: Manages installed plugins, plugin uploads, installs, updates, or plugin enablement.
• Inputs: path params: id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/updates/events

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: No request parameters detected by static analysis.
• Response format: streaming event response
• Access: admin access expected
• Side effects: publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/updates/status

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: No request parameters detected by static analysis.
• Response format: JSON response
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page.

GET /admin/updates/recovery

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: No request parameters detected by static analysis.
• Response format: JSON response
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/updates/recovery/clear-marker

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: No request parameters detected by static analysis.
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/recovery/retry-normal-startup

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: No request parameters detected by static analysis.
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/updates

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page.

POST /admin/updates/snapshots/settings

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: body: max_age_days, max_per_target
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/core/check

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: No request parameters detected by static analysis.
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/core/apply

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: body: version
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/core/revert

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: body: snapshot_id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/bot

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: body: patch_mode; file upload: multipart form file data
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/core/zip

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: body: patch_mode, rollback_safe; file upload: multipart form file data
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/plugin

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: file upload: multipart form file data
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/plugins/:id/check

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/plugins/:id/apply

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: path params: id; body: version
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/plugins/:id/revert

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: path params: id; body: snapshot_id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/plugins/:id/disable

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/updates/plugins/:id/zip

• Purpose: Checks, applies, reverts, or reports update state for core or plugin updates.
• Inputs: path params: id; body: rollback_safe; file upload: multipart form file data
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; writes files
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/update

• Purpose: Processes the admin update action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state; publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/check-update

• Purpose: Processes the admin check update action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/restart

• Purpose: Processes the admin restart action and stores or applies submitted form data.
• Inputs: No request parameters detected by static analysis.
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state; may restart or stop runtime processes
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /media/:token/:filename

• Purpose: Handles media token filename.
• Inputs: path params: filename, token; query: download
• Response format: HTML or data response; exact format was not detected statically.
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /internal/media/:id/:filename

• Purpose: Handles internal media id filename.
• Inputs: path params: filename, id; query: download, expires, sig
• Response format: HTML or data response; exact format was not detected statically.
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/resources

• Purpose: Renders the admin resources WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /api/admin/resources

• Purpose: Provides api admin resources data as JSON.
• Inputs: query: full query object is passed to a helper; exact fields are defined by the matching view/service
• Response format: JSON response
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. API consumers should expect JSON unless the response format says otherwise.

GET /admin/resources/:id/raw/:filename

• Purpose: Handles admin resources id raw filename.
• Inputs: path params: filename, id; query: download
• Response format: HTML or data response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/resources/:id/download/:filename

• Purpose: Handles admin resources id download filename.
• Inputs: path params: filename, id
• Response format: HTML or data response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/resources/upload

• Purpose: Processes the admin resources upload action and stores or applies submitted form data.
• Inputs: body: access_level; file upload: multipart form file data
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected; logged-in session required or used
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/resources/settings

• Purpose: Processes the admin resources settings action and stores or applies submitted form data.
• Inputs: body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/resources/:id/rename

• Purpose: Processes the admin resources id rename action and stores or applies submitted form data.
• Inputs: path params: id; body: display_name
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/resources/:id/access

• Purpose: Processes the admin resources id access action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/resources/:id/revoke

• Purpose: Processes the admin resources id revoke action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/resources/:id/delete

• Purpose: Processes the admin resources id delete action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /overlay-web/:ticket

• Purpose: Handles overlay web ticket.
• Inputs: path params: ticket
• Response format: HTML or data response; exact format was not detected statically.
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page.

POST ${basePath}/obs-bridge

• Purpose: Provides ${basePath} obs bridge data as JSON.
• Inputs: body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: JSON response
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET ${basePath}/module-health

• Purpose: Provides ${basePath} module health data as JSON.
• Inputs: query: module_id
• Response format: JSON response
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET ${basePath}/state

• Purpose: Provides ${basePath} state data as JSON.
• Inputs: No request parameters detected by static analysis.
• Response format: JSON response
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET ${basePath}/events

• Purpose: Handles ${basePath} events.
• Inputs: No request parameters detected by static analysis.
• Response format: streaming event response
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /overlay-chat/:ticket/state

• Purpose: Provides overlay chat ticket state data as JSON.
• Inputs: path params: ticket
• Response format: JSON response
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /overlay-chat/:ticket/events

• Purpose: Handles overlay chat ticket events.
• Inputs: path params: ticket
• Response format: streaming event response
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: publishes or streams live WebUI events
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /overlay-chat/:ticket

• Purpose: Renders the overlay chat ticket WebUI page.
• Inputs: path params: ticket
• Response format: HTML page rendered from an EJS view
• Access: No explicit access guard detected in the route handler; check surrounding router/mount middleware.
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/overlays/:id/modules/:moduleId/web-preview/:ticket

• Purpose: Handles admin overlays id modules moduleId web preview ticket.
• Inputs: path params: id, moduleId, ticket
• Response format: HTML or data response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page.

GET /admin/overlays

• Purpose: Renders the admin overlays WebUI page.
• Inputs: No request parameters detected by static analysis.
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/overlays

• Purpose: Processes the admin overlays action and stores or applies submitted form data.
• Inputs: body: description, name, scene_name
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/reorder

• Purpose: Processes the admin overlays reorder action and stores or applies submitted form data.
• Inputs: body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /admin/overlays/:id

• Purpose: Renders the admin overlays id WebUI page.
• Inputs: path params: id
• Response format: HTML page rendered from an EJS view
• Access: admin access expected; logged-in session required or used
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

GET /admin/overlays/:id/preview-window

• Purpose: Renders the admin overlays id preview window WebUI page.
• Inputs: path params: id
• Response format: HTML page rendered from an EJS view
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations.

POST /admin/overlays/:id

• Purpose: Processes the admin overlays id action and stores or applies submitted form data.
• Inputs: path params: id; body: canvas_height, canvas_width, description, name
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/duplicate

• Purpose: Processes the admin overlays id duplicate action and stores or applies submitted form data.
• Inputs: path params: id; body: name
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/delete

• Purpose: Processes the admin overlays id delete action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/token/revoke

• Purpose: Processes the admin overlays id token revoke action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/active-scene

• Purpose: Processes the admin overlays id active scene action and stores or applies submitted form data.
• Inputs: path params: id; body: scene_id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/scenes

• Purpose: Processes the admin overlays id scenes action and stores or applies submitted form data.
• Inputs: path params: id; body: name, obs_scene_name
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/scenes/reorder

• Purpose: Processes the admin overlays id scenes reorder action and stores or applies submitted form data.
• Inputs: path params: id; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/scenes/:sceneId

• Purpose: Processes the admin overlays id scenes sceneId action and stores or applies submitted form data.
• Inputs: path params: id, sceneId; body: name, obs_scene_name
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/scenes/:sceneId/duplicate

• Purpose: Processes the admin overlays id scenes sceneId duplicate action and stores or applies submitted form data.
• Inputs: path params: id, sceneId; body: name
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/scenes/:sceneId/delete

• Purpose: Processes the admin overlays id scenes sceneId delete action and stores or applies submitted form data.
• Inputs: path params: id, sceneId
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/scenes/:sceneId/token/revoke

• Purpose: Processes the admin overlays id scenes sceneId token revoke action and stores or applies submitted form data.
• Inputs: path params: id, sceneId
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/scenes/:sceneId/modules

• Purpose: Processes the admin overlays id scenes sceneId modules action and stores or applies submitted form data.
• Inputs: path params: id, sceneId; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/scenes/:sceneId/modules/reorder

• Purpose: Processes the admin overlays id scenes sceneId modules reorder action and stores or applies submitted form data.
• Inputs: path params: id, sceneId; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/modules/:moduleId

• Purpose: Processes the admin overlays id modules moduleId action and stores or applies submitted form data.
• Inputs: path params: id, moduleId; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/modules/:moduleId/duplicate

• Purpose: Processes the admin overlays id modules moduleId duplicate action and stores or applies submitted form data.
• Inputs: path params: id, moduleId; body: name
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/modules/:moduleId/delete

• Purpose: Processes the admin overlays id modules moduleId delete action and stores or applies submitted form data.
• Inputs: path params: id, moduleId
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/event-hooks

• Purpose: Processes the admin overlays id event hooks action and stores or applies submitted form data.
• Inputs: path params: id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/event-hooks/:hookId

• Purpose: Processes the admin overlays id event hooks hookId action and stores or applies submitted form data.
• Inputs: path params: hookId, id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/event-hooks/:hookId/test

• Purpose: Processes the admin overlays id event hooks hookId test action and stores or applies submitted form data.
• Inputs: path params: hookId, id
• Response format: HTTP redirect after handling the request
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /admin/overlays/:id/event-hooks/:hookId/delete

• Purpose: Processes the admin overlays id event hooks hookId delete action and stores or applies submitted form data.
• Inputs: path params: hookId, id
• Response format: Form/action response; exact format was not detected statically.
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Most non-API POST routes are browser form submissions and usually redirect after completion.

POST /api/admin/overlays/:id/modules/:moduleId/transform

• Purpose: Provides api admin overlays id modules moduleId transform data as JSON.
• Inputs: path params: id, moduleId; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: JSON response
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

POST /api/admin/overlays/:id/modules/:moduleId/preview

• Purpose: Provides api admin overlays id modules moduleId preview data as JSON.
• Inputs: path params: id, moduleId; body: full submitted body is passed to a helper; exact fields are defined by the matching form/service
• Response format: JSON response
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Input length or numeric bounds are enforced by helper functions in the handler. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

POST /api/admin/overlays/:id/modules/:moduleId/refresh

• Purpose: Provides api admin overlays id modules moduleId refresh data as JSON.
• Inputs: path params: id, moduleId
• Response format: JSON response
• Access: admin access expected
• Side effects: Action route; side effects were not detected statically.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

GET /api/admin/overlays/:id/modules/:moduleId/health

• Purpose: Returns runtime health information.
• Inputs: path params: id, moduleId
• Response format: JSON response
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. API consumers should expect JSON unless the response format says otherwise.

POST /admin/overlays/:id/obs

• Purpose: Provides admin overlays id obs data as JSON.
• Inputs: path params: id; body: endpoint, password, provider, sync_direction
• Response format: JSON response; HTTP redirect after handling the request
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. Most non-API POST routes are browser form submissions and usually redirect after completion.

GET /api/admin/overlays/:id/obs/status

• Purpose: Provides api admin overlays id obs status data as JSON.
• Inputs: path params: id
• Response format: JSON response
• Access: admin access expected
• Side effects: Usually read-only.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. API consumers should expect JSON unless the response format says otherwise.

POST /api/admin/overlays/:id/obs/test

• Purpose: Provides api admin overlays id obs test data as JSON.
• Inputs: path params: id; body: endpoint, password, provider
• Response format: JSON response
• Access: admin access expected
• Side effects: Consumes submitted data; state mutation happens in called helpers if present.
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

POST /api/admin/overlays/:id/obs/scene

• Purpose: Provides api admin overlays id obs scene data as JSON.
• Inputs: path params: id; body: scene_name
• Response format: JSON response
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

POST /api/admin/overlays/:id/obs/import

• Purpose: Provides api admin overlays id obs import data as JSON.
• Inputs: path params: id
• Response format: JSON response
• Access: admin access expected
• Side effects: writes or mutates server-side state
• Limits/notes: Generated from static route source analysis; confirm exact behavior in the handler before changing integrations. Errors are caught and usually returned as a flash message, JSON error, or error page. API consumers should expect JSON unless the response format says otherwise.

README Summary

Lumi Bot

Discord bot + WebUI with role-based access, plugin management, and self-update support.

Quick start

Requires Node.js 18+ on Windows or Linux.

1. Install dependencies:

   npm install
   

   Do not use --ignore-scripts: Lumi uses the native better-sqlite3 module, which must download or build a binary for your Node.js version. If Node was upgraded after installation, run npm rebuild better-sqlite3 or remove node_modules and run npm install again. Linux source builds may also need