Create app.py

app.py

@@ -0,0 +1,852 @@
+# ─────────────────────────────────────────────────────────────
+# 0. HfFolder shim (must be first executable code)
+# ─────────────────────────────────────────────────────────────
+import huggingface_hub
+if not hasattr(huggingface_hub, "HfFolder"):
+    class _HfFolder:
+        @staticmethod
+        def get_token(): return huggingface_hub.get_token()
+        @staticmethod
+        def save_token(token): huggingface_hub.login(token)
+        @staticmethod
+        def delete_token(): huggingface_hub.logout()
+    huggingface_hub.HfFolder = _HfFolder
+
+# ─────────────────────────────────────────────────────────────
+# 1. Imports
+# ─────────────────────────────────────────────────────────────
+import os
+import re
+import time
+import html
+import json
+import asyncio
+import logging
+import threading
+from typing import Optional
+
+import httpx
+from fastapi import Request
+from fastapi.responses import JSONResponse
+from starlette.routing import Route as StarletteRoute
+import gradio as gr
+import spaces
+
+# ─────────────────────────────────────────────────────────────
+# 2. Config
+# ─────────────────────────────────────────────────────────────
+BOT_TOKEN      = os.environ["BOT_TOKEN"]
+WEBHOOK_SECRET = os.environ.get("WEBHOOK_SECRET", "1221")
+SPACE_URL      = os.environ["SPACE_URL"].rstrip("/")
+TELEGRAM_PROXY = os.environ.get("TELEGRAM_PROXY", "").rstrip("/")
+
+ADMIN_IDS      = [int(x) for x in os.environ.get("ADMIN_IDS", "").split(",") if x.strip().isdigit()]
+AUTH_ENABLED   = len(ADMIN_IDS) > 0
+
+TG_API = (TELEGRAM_PROXY + "/bot" + BOT_TOKEN) if TELEGRAM_PROXY \
+         else f"https://api.telegram.org/bot{BOT_TOKEN}"
+
+RATE_LIMIT_SEC   = 5
+PAGE_SIZE        = 4
+QUERY_TIMEOUT    = 90          # outer cap for whole search
+HTTP_TIMEOUT     = httpx.Timeout(60.0, connect=15.0)
+CACHE_TTL        = 300         # 5 minutes
+ADMIN_STATE_TTL  = 180         # admin input states expire after 3 min
+TELEGRAM_MAX_MSG = 4000        # 4096 limit, leave headroom
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
+log = logging.getLogger("bot")
+
+# ─────────────────────────────────────────────────────────────
+# 3. HTTP clients (one AsyncClient per running event loop)
+# ─────────────────────────────────────────────────────────────
+_api_clients: dict[int, httpx.AsyncClient] = {}
+_clients_lock = threading.Lock()
+
+
+async def _get_api_client() -> httpx.AsyncClient:
+    loop = asyncio.get_running_loop()
+    key = id(loop)
+    client = _api_clients.get(key)
+    if client is None or client.is_closed:
+        client = httpx.AsyncClient(timeout=HTTP_TIMEOUT, follow_redirects=True)
+        with _clients_lock:
+            _api_clients[key] = client
+    return client
+
+
+# ─────────────────────────────────────────────────────────────
+# 4. Result cache (per phone number, 5-min TTL)
+# ─────────────────────────────────────────────────────────────
+_cache: dict[str, tuple[float, list]] = {}
+_cache_lock = threading.Lock()
+
+
+def _cache_get(number: str) -> Optional[list]:
+    with _cache_lock:
+        entry = _cache.get(number)
+        if entry is None:
+            return None
+        ts, data = entry
+        if time.time() - ts > CACHE_TTL:
+            _cache.pop(number, None)
+            return None
+        return data
+
+
+def _cache_set(number: str, data: list):
+    with _cache_lock:
+        _cache[number] = (time.time(), data)
+        # opportunistic cleanup
+        if len(_cache) > 500:
+            now = time.time()
+            for k in list(_cache.keys()):
+                if now - _cache[k][0] > CACHE_TTL:
+                    _cache.pop(k, None)
+
+
+# ─────────────────────────────────────────────────────────────
+# 5. External data sources
+# ─────────────────────────────────────────────────────────────
+def _clean(v):
+    if v is None:
+        return None
+    s = str(v).strip()
+    if s in ("", "null", "N/A", "None", "-"):
+        return None
+    return s
+
+
+async def _q_cr850(client, number):
+    url = f"https://sauravsingh2111-850crfastsearch.hf.space/search/{number}"
+    try:
+        r = await client.get(url, timeout=40.0)
+        if r.status_code != 200:
+            return []
+        data = r.json()
+        if not data.get("success") or not data.get("results"):
+            return []
+        out = []
+        for item in data["results"]:
+            addr = item.get("address") or {}
+            full = None
+            if isinstance(addr, dict):
+                full = addr.get("full_address")
+                if full:
+                    full = full.lstrip(", ").strip()
+            out.append({
+                "source": "850CR Fast",
+                "fields": {
+                    "Name":     _clean(item.get("name")),
+                    "Father":   _clean(item.get("father_name")),
+                    "Address":  _clean(full),
+                    "Alternate": _clean(item.get("alternate_number")),
+                    "Circle":   _clean(item.get("circle")),
+                    "Operator": _clean(item.get("operator")),
+                    "State":    _clean(item.get("state")),
+                    "Email":    _clean(item.get("email")),
+                },
+            })
+        return out
+    except Exception as e:
+        log.warning("cr850 failed: %s", e)
+        return []
+
+
+async def _q_inddata(client, number):
+    url = "https://tfqdeadlo-inddataapi.hf.space/search"
+    try:
+        r = await client.get(url, params={"mobile": number}, timeout=30.0)
+        if r.status_code != 200:
+            return []
+        data = r.json()
+        rows = data.get("data") if isinstance(data, dict) else None
+        if not isinstance(rows, list):
+            return []
+        out = []
+        for item in rows:
+            out.append({
+                "source": "IndData 1.4B",
+                "fields": {
+                    "Mobile":  _clean(item.get("mobile")),
+                    "Name":    _clean(item.get("name")),
+                    "Father":  _clean(item.get("fname")),
+                    "Address": _clean(item.get("address")),
+                    "Email":   _clean(item.get("email")),
+                    "ID":      _clean(item.get("id")),
+                },
+            })
+        return out
+    except Exception as e:
+        log.warning("inddata failed: %s", e)
+        return []
+
+
+async def _q_hiteck_main(client, number):
+    url = "https://hiteckgroup-hiteckgroup.hf.space/search"
+    try:
+        r = await client.get(url, params={"mobile": number}, timeout=30.0)
+        if r.status_code != 200:
+            return []
+        data = r.json()
+        rows = data.get("data") if isinstance(data, dict) else None
+        if not isinstance(rows, list):
+            return []
+        out = []
+        for item in rows:
+            addr = item.get("address")
+            if addr:
+                addr = addr.replace("!", ", ")
+            out.append({
+                "source": "HiTeck 1.78B",
+                "fields": {
+                    "Mobile":    _clean(item.get("mobile")),
+                    "Name":      _clean(item.get("name")),
+                    "Father":    _clean(item.get("fname")),
+                    "Address":   _clean(addr),
+                    "Alternate": _clean(item.get("alt")),
+                    "Circle":    _clean(item.get("circle")),
+                    "Email":     _clean(item.get("email")),
+                },
+            })
+        return out
+    except Exception as e:
+        log.warning("hiteck_main failed: %s", e)
+        return []
+
+
+async def _q_hiteck_big(client, number):
+    url = "https://hiteckgroup-hiteckgroupp.hf.space/search"
+    try:
+        r = await client.get(url, params={"q": number}, timeout=35.0)
+        if r.status_code != 200:
+            return []
+        data = r.json()
+        rows = data.get("results") if isinstance(data, dict) else None
+        if not isinstance(rows, list):
+            return []
+        out = []
+        for item in rows:
+            out.append({
+                "source": "HiTeck 5B",
+                "fields": {
+                    "Name":     _clean(item.get("name")),
+                    "Father":   _clean(item.get("fathersName")),
+                    "Phone":    _clean(item.get("phoneNumber")),
+                    "Aadhaar":  _clean(item.get("aadharNumber")),
+                    "Other":    _clean(item.get("otherNumber")),
+                    "Address":  _clean(item.get("address")),
+                    "District": _clean(item.get("district")),
+                    "State":    _clean(item.get("state")),
+                    "Town":     _clean(item.get("town")),
+                    "Pincode":  _clean(item.get("pincode")),
+                    "Source":   _clean(item.get("source")),
+                },
+            })
+        return out
+    except Exception as e:
+        log.warning("hiteck_big failed: %s", e)
+        return []
+
+
+# ─────────────────────────────────────────────────────────────
+# 5b. Per-API safety wrapper
+# ─────────────────────────────────────────────────────────────
+async def _safe(fn, client, number, timeout: float, label: str) -> list[dict]:
+    t0 = time.time()
+    try:
+        res = await asyncio.wait_for(fn(client, number), timeout=timeout)
+        log.info("%s → %d records in %.2fs", label, len(res), time.time() - t0)
+        return res
+    except asyncio.TimeoutError:
+        log.warning("%s → TIMEOUT after %.1fs", label, timeout)
+        return []
+    except Exception as e:
+        log.warning("%s → ERROR after %.2fs: %s", label, time.time() - t0, e)
+        return []
+
+
+# ─────────────────────────────────────────────────────────────
+# 5c. De-duplication
+# ─────────────────────────────────────────────────────────────
+def _norm(s) -> str:
+    if not s:
+        return ""
+    return re.sub(r"\s+", " ", str(s).strip().lower())
+
+
+def _dedup_key(rec: dict):
+    """Use name+father+address when available — safer than name+father alone."""
+    f = rec.get("fields", {})
+    name   = _norm(f.get("Name"))
+    father = _norm(f.get("Father"))
+    addr   = _norm(f.get("Address"))
+    addr_n = re.sub(r"[^a-z0-9]+", " ", addr).strip()
+
+    if name and addr_n:
+        return ("na", name, addr_n)
+    if name and father:
+        return ("nf", name, father)
+    if addr_n:
+        return ("a", addr_n)
+    return None
+
+
+def _dedup(records: list[dict]) -> list[dict]:
+    seen: dict = {}
+    result: list[dict] = []
+    for rec in records:
+        key = _dedup_key(rec)
+        if key is None:
+            result.append(rec)
+            continue
+        idx = seen.get(key)
+        if idx is None:
+            seen[key] = len(result)
+            result.append(rec)
+        else:
+            existing = result[idx]
+            if len(rec.get("fields", {})) > len(existing.get("fields", {})):
+                result[idx] = rec
+    return result
+
+
+# ─────────────────────────────────────────────────────────────
+# 5d. Search (cached)
+# ─────────────────────────────────────────────────────────────
+async def search_phone(number: str) -> list[dict]:
+    cached = _cache_get(number)
+    if cached is not None:
+        log.info("Cache HIT for %s (%d records)", number, len(cached))
+        return cached
+
+    client = await _get_api_client()
+    t0 = time.time()
+
+    chunks = await asyncio.gather(
+        _safe(_q_cr850,       client, number, 40, "850CR"),
+        _safe(_q_inddata,     client, number, 30, "IndData"),
+        _safe(_q_hiteck_main, client, number, 30, "HiTeck1.78B"),
+        _safe(_q_hiteck_big,  client, number, 35, "HiTeck5B"),
+    )
+
+    merged: list[dict] = []
+    for chunk in chunks:
+        merged.extend(chunk)
+
+    before = len(merged)
+    deduped = _dedup(merged)
+    log.info("Search %s: %d raw → %d unique in %.2fs",
+             number, before, len(deduped), time.time() - t0)
+
+    _cache_set(number, deduped)
+    return deduped
+
+
+# ─────────────────────────────────────────────────────────────
+# 6. Telegram API helpers
+# ─────────────────────────────────────────────────────────────
+async def tg(method: str, **payload):
+    client = await _get_api_client()
+    url = f"{TG_API}/{method}"
+    r = await client.post(url, json=payload)
+    if r.status_code >= 400:
+        log.warning("Telegram %s failed: %s %s", method, r.status_code, r.text[:200])
+    try:
+        return r.json()
+    except Exception:
+        return {}
+
+
+async def send(chat_id: int, text: str, **kw):
+    """Send a message, splitting if it exceeds Telegram's limit."""
+    kw.setdefault("parse_mode", "HTML")
+    kw.setdefault("disable_web_page_preview", True)
+    try:
+        if len(text) <= TELEGRAM_MAX_MSG:
+            return await tg("sendMessage", chat_id=chat_id, text=text, **kw)
+        # Split on double-newline boundaries
+        chunks = _split_message(text, TELEGRAM_MAX_MSG)
+        result = None
+        for i, chunk in enumerate(chunks):
+            # Only include reply_markup on the LAST chunk
+            kw_chunk = dict(kw)
+            if i < len(chunks) - 1:
+                kw_chunk.pop("reply_markup", None)
+            result = await tg("sendMessage", chat_id=chat_id, text=chunk, **kw_chunk)
+        return result
+    except Exception:
+        log.exception("send failed")
+        return {}
+
+
+async def edit(chat_id: int, message_id: int, text: str, **kw):
+    kw.setdefault("parse_mode", "HTML")
+    kw.setdefault("disable_web_page_preview", True)
+    # Telegram's editMessageText also has a 4096 limit; if too long, we fall back to send.
+    if len(text) > TELEGRAM_MAX_MSG:
+        try:
+            await tg("deleteMessage", chat_id=chat_id, message_id=message_id)
+        except Exception:
+            pass
+        return await send(chat_id, text, **kw)
+    try:
+        return await tg("editMessageText", chat_id=chat_id, message_id=message_id, text=text, **kw)
+    except Exception:
+        log.exception("edit failed")
+        return {}
+
+
+async def answer_callback(callback_id: str, **kw):
+    try:
+        return await tg("answerCallbackQuery", callback_query_id=callback_id, **kw)
+    except Exception:
+        log.exception("answer_callback failed")
+        return {}
+
+
+def _split_message(text: str, limit: int) -> list[str]:
+    """Split by double-newline boundaries; fall back to hard cut if needed."""
+    parts = text.split("\n\n")
+    chunks: list[str] = []
+    cur = ""
+    for p in parts:
+        candidate = (cur + "\n\n" + p) if cur else p
+        if len(candidate) <= limit:
+            cur = candidate
+        else:
+            if cur:
+                chunks.append(cur)
+            # if a single part is too big, hard-split it
+            while len(p) > limit:
+                chunks.append(p[:limit])
+                p = p[limit:]
+            cur = p
+    if cur:
+        chunks.append(cur)
+    return chunks
+
+
+# ─────────────────────────────────────────────────────────────
+# 7. Formatting
+# ─────────────────────────────────────────────────────────────
+def _esc(v) -> str:
+    if v is None:
+        return ""
+    return html.escape(str(v))
+
+
+def render_record(rec: dict) -> str:
+    src = _esc(rec.get("source", "Unknown"))
+    fields = rec.get("fields", {})
+    lines = [f"🗂 <b>{src}</b>"]
+    for k, v in fields.items():
+        if v is None or v == "":
+            continue
+        # Truncate very long fields to keep messages sane
+        val = str(v)
+        if len(val) > 300:
+            val = val[:297] + "..."
+        lines.append(f"• <b>{_esc(k)}:</b> {_esc(val)}")
+    if len(lines) == 1:
+        lines.append("• <i>no data</i>")
+    return "\n".join(lines)
+
+
+def render_page(number: str, records: list[dict], page: int) -> str:
+    total = len(records)
+    start = page * PAGE_SIZE
+    chunk = records[start:start + PAGE_SIZE]
+    if not chunk:
+        return "No more results."
+    pages = (total - 1) // PAGE_SIZE + 1
+    header = (
+        f"🔎 <b>Results for</b> <code>{_esc(number)}</code>  —  "
+        f"page {page + 1}/{pages}  ({total} record{'s' if total != 1 else ''})\n\n"
+    )
+    body = "\n\n━━━━━━━━━━━━━━━━━━\n\n".join(render_record(r) for r in chunk)
+    return header + body
+
+
+def pagination_kb(number: str, page: int, total: int):
+    nav = []
+    if page > 0:
+        nav.append({"text": "◀ Prev", "callback_data": f"pg|{number}|{page - 1}"})
+    if (page + 1) * PAGE_SIZE < total:
+        nav.append({"text": "Next ▶", "callback_data": f"pg|{number}|{page + 1}"})
+    return {"inline_keyboard": [nav]} if nav else None
+
+
+# ─────────────────────────────────────────────────────────────
+# 8. Per-user state
+# ─────────────────────────────────────────────────────────────
+_last_search: dict[int, float] = {}
+_search_lock = threading.Lock()
+
+_admin_states: dict[int, tuple[str, float]] = {}   # user_id -> (state, set_at)
+_authorized_users: set[int] = set()
+_custom_apis: list[str] = []
+_admin_lock = threading.Lock()
+
+
+def _admin_state_get(user_id: int) -> Optional[str]:
+    with _admin_lock:
+        entry = _admin_states.get(user_id)
+        if entry is None:
+            return None
+        state, set_at = entry
+        if time.time() - set_at > ADMIN_STATE_TTL:
+            _admin_states.pop(user_id, None)
+            return None
+        return state
+
+
+def _admin_state_set(user_id: int, state: str):
+    with _admin_lock:
+        _admin_states[user_id] = (state, time.time())
+
+
+def _admin_state_clear(user_id: int):
+    with _admin_lock:
+        _admin_states.pop(user_id, None)
+
+
+# ─────────────────────────────────────────────────────────────
+# 9. Admin helpers
+# ─────────────────────────────────────────────────────────────
+def _is_admin(user_id: int) -> bool:
+    return user_id in ADMIN_IDS
+
+
+def _is_authorized(user_id: int) -> bool:
+    if not AUTH_ENABLED:
+        return True
+    with _admin_lock:
+        return user_id in _authorized_users or _is_admin(user_id)
+
+
+def _admin_menu_kb():
+    return {
+        "inline_keyboard": [
+            [{"text": "➕ Add User", "callback_data": "admin|add_user"}],
+            [{"text": "➖ Remove User", "callback_data": "admin|remove_user"}],
+            [{"text": "📋 List Users", "callback_data": "admin|list_users"}],
+            [{"text": "🔌 Add API", "callback_data": "admin|add_api"}],
+            [{"text": "🗑 Clear APIs", "callback_data": "admin|clear_apis"}],
+            [{"text": "📋 List APIs", "callback_data": "admin|list_apis"}],
+        ]
+    }
+
+
+# ─────────────────────────────────────────────────────────────
+# 10. Message handlers
+# ─────────────────────────────────────────────────────────────
+async def handle_message(update: dict):
+    msg = update.get("message") or update.get("edited_message")
+    if not msg:
+        return
+
+    chat_id = msg["chat"]["id"]
+    sender = msg.get("from") or {}
+    user_id = sender.get("id")
+    if user_id is None:
+        # Channel post or other anonymous source — ignore
+        return
+
+    # Non-text messages — polite nudge, no crash
+    if "text" not in msg:
+        await send(chat_id, "❗ Please send a <b>text message</b> with a 10‑digit number.")
+        return
+
+    text = (msg.get("text") or "").strip()
+    log.info("MSG from %s: %r", user_id, text[:100])
+
+    # ── Admin input capture (with expiry) ──
+    state = _admin_state_get(user_id)
+    if state and _is_admin(user_id):
+        if state == "await_user_id":
+            if text.isdigit():
+                with _admin_lock:
+                    _authorized_users.add(int(text))
+                _admin_state_clear(user_id)
+                await send(chat_id, f"✅ User <code>{text}</code> authorized.")
+            else:
+                await send(chat_id, "❗ Send a numeric Telegram user ID (or /cancel).")
+            return
+        if state == "await_api_url":
+            if text.startswith("http"):
+                with _admin_lock:
+                    _custom_apis.append(text.rstrip("/"))
+                _admin_state_clear(user_id)
+                await send(chat_id, f"✅ API added: <code>{_esc(text)}</code>")
+            else:
+                await send(chat_id, "❗ Send a valid http(s) URL (or /cancel).")
+            return
+
+    # ── Commands ──
+    if text.startswith("/"):
+        cmd = text.split()[0].lower()
+
+        if cmd == "/start":
+            await send(
+                chat_id,
+                "👋 <b>Welcome!</b>\n\n"
+                "Send me a <b>10‑digit mobile number</b> and I'll search across multiple databases.\n\n"
+                "Commands:\n"
+                "/start — this message\n"
+                "/status — bot health\n"
+                "/myid — show your Telegram user ID\n"
+                "/cancel — cancel current input",
+            )
+            return
+
+        if cmd == "/myid":
+            await send(chat_id, f"🆔 Your Telegram user ID: <code>{user_id}</code>")
+            return
+
+        if cmd == "/cancel":
+            _admin_state_clear(user_id)
+            await send(chat_id, "✅ Cancelled.")
+            return
+
+        if cmd == "/status":
+            with _cache_lock:
+                cache_size = len(_cache)
+            await send(
+                chat_id,
+                "✅ <b>Bot alive</b>\n"
+                f"🗂 Sources: 4 (dedup ON)\n"
+                f"💾 Cache entries: {cache_size}\n"
+                f"⏱ Rate limit: {RATE_LIMIT_SEC}s\n"
+                f"📄 Page size: {PAGE_SIZE}",
+            )
+            return
+
+        if cmd == "/nemesis":
+            if not _is_admin(user_id):
+                await send(chat_id, "⛔ Unauthorized.")
+                return
+            await send(chat_id, "🛡 <b>Admin Panel</b>\nChoose an action:", reply_markup=_admin_menu_kb())
+            return
+
+        return
+
+    # ── Auth gate ──
+    if not _is_authorized(user_id):
+        await send(chat_id, "⛔ You are not authorized to use this bot.")
+        return
+
+    # ── Validate number ──
+    if not (text.isdigit() and len(text) == 10):
+        await send(chat_id, "❗ Please send a <b>10‑digit mobile number</b> only.")
+        return
+
+    # ── Rate limit ──
+    now = time.time()
+    with _search_lock:
+        last = _last_search.get(user_id, 0)
+        if now - last < RATE_LIMIT_SEC:
+            wait = int(RATE_LIMIT_SEC - (now - last)) + 1
+            await send(chat_id, f"⏳ Please wait <b>{wait}s</b> before searching again.")
+            return
+        _last_search[user_id] = now
+        # opportunistic cleanup of stale rate-limit entries
+        if len(_last_search) > 1000:
+            cutoff = now - 3600
+            for k in list(_last_search.keys()):
+                if _last_search[k] < cutoff:
+                    _last_search.pop(k, None)
+
+    await send(chat_id, f"🔍 <b>Searching</b> <code>{_esc(text)}</code> across 4 databases …")
+
+    try:
+        records = await asyncio.wait_for(search_phone(text), timeout=QUERY_TIMEOUT)
+    except asyncio.TimeoutError:
+        await send(chat_id, "⏰ Search timed out. Try again in a moment.")
+        return
+    except Exception:
+        log.exception("search_phone unexpected error")
+        await send(chat_id, "⚠️ Unexpected error during search.")
+        return
+
+    if not records:
+        await send(chat_id, f"❌ No records found for <code>{_esc(text)}</code>.")
+        return
+
+    kb = pagination_kb(text, 0, len(records))
+    await send(chat_id, render_page(text, records, 0), reply_markup=kb)
+
+
+async def handle_callback(update: dict):
+    cb = update.get("callback_query")
+    if not cb:
+        return
+    data = cb.get("data") or ""
+    chat_id = cb["message"]["chat"]["id"]
+    user_id = (cb.get("from") or {}).get("id")
+    message_id = cb["message"]["message_id"]
+
+    await answer_callback(cb["id"])
+
+    if user_id is None:
+        return
+
+    if data.startswith("admin|"):
+        if not _is_admin(user_id):
+            await edit(chat_id, message_id, "⛔ Unauthorized.")
+            return
+        action = data.split("|", 1)[1]
+
+        if action == "add_user":
+            _admin_state_set(user_id, "await_user_id")
+            await edit(chat_id, message_id, "Send the Telegram user ID to authorize (or /cancel):")
+            return
+
+        if action == "remove_user":
+            with _admin_lock:
+                users = sorted(_authorized_users)
+            if not users:
+                await edit(chat_id, message_id, "No authorized users.", reply_markup=_admin_menu_kb())
+            else:
+                txt = "Authorized users:\n" + "\n".join(f"<code>{u}</code>" for u in users)
+                await edit(chat_id, message_id, txt, reply_markup=_admin_menu_kb())
+            return
+
+        if action == "list_users":
+            with _admin_lock:
+                users = sorted(_authorized_users)
+            txt = "Authorized users:\n" + ("\n".join(f"<code>{u}</code>" for u in users) if users else "—")
+            await edit(chat_id, message_id, txt, reply_markup=_admin_menu_kb())
+            return
+
+        if action == "add_api":
+            _admin_state_set(user_id, "await_api_url")
+            await edit(chat_id, message_id, "Send the API base URL to add (or /cancel):")
+            return
+
+        if action == "clear_apis":
+            with _admin_lock:
+                _custom_apis.clear()
+            await edit(chat_id, message_id, "✅ All custom APIs cleared.", reply_markup=_admin_menu_kb())
+            return
+
+        if action == "list_apis":
+            with _admin_lock:
+                apis = list(_custom_apis)
+            txt = "Custom APIs:\n" + ("\n".join(f"<code>{_esc(a)}</code>" for a in apis) if apis else "—")
+            await edit(chat_id, message_id, txt, reply_markup=_admin_menu_kb())
+            return
+
+        return
+
+    # ── Pagination ──
+    if not data.startswith("pg|"):
+        return
+
+    try:
+        _, number, page_s = data.split("|", 2)
+        page = int(page_s)
+    except Exception:
+        return
+
+    try:
+        records = await asyncio.wait_for(search_phone(number), timeout=QUERY_TIMEOUT)
+    except Exception:
+        log.exception("callback search failed")
+        await edit(chat_id, message_id, "⚠️ Could not load that page. Try again.")
+        return
+
+    if not records:
+        await edit(chat_id, message_id, "❌ No records found.")
+        return
+
+    kb = pagination_kb(number, page, len(records))
+    await edit(chat_id, message_id, render_page(number, records, page), reply_markup=kb)
+
+
+# ─────────────────────────────────────────────────────────────
+# 11. FastAPI routes
+# ──────────��──────────────────────────────────────────────────
+async def webhook_handler(request: Request):
+    # Always return 200 to Telegram — bad secret means we just ignore the payload.
+    if request.headers.get("x-telegram-bot-api-secret-token") != WEBHOOK_SECRET:
+        log.warning("Bad webhook secret — ignoring")
+        return JSONResponse({"ok": True})
+
+    try:
+        update = await request.json()
+    except Exception:
+        return JSONResponse({"ok": True})
+
+    try:
+        if "message" in update or "edited_message" in update:
+            await handle_message(update)
+        elif "callback_query" in update:
+            await handle_callback(update)
+    except Exception:
+        log.exception("Handler error")
+
+    return JSONResponse({"ok": True})
+
+
+async def health_handler(request: Request):
+    with _cache_lock:
+        cache_size = len(_cache)
+    return JSONResponse({
+        "status": "ok",
+        "time": time.time(),
+        "cache_entries": cache_size,
+    })
+
+
+# ─────────────────────────────────────────────────────────────
+# 12. Gradio UI (ZeroGPU registration)
+# ─────────────────────────────────────────────────────────────
+@spaces.GPU(duration=10)
+def _zerogpu_register():
+    return "gpu-ready"
+
+
+with gr.Blocks(title="Phone Lookup Bot") as demo:
+    gr.Markdown("## Phone Lookup Bot\nTelegram webhook endpoint is live.")
+    _btn = gr.Button("init-gpu", visible=False)
+    _btn.click(fn=_zerogpu_register, inputs=None, outputs=None)
+
+
+# ─────────────────────────────────────────────────────────────
+# 13. Launch + inject routes
+# ─────────────────────────────────────────────────────────────
+demo.launch(
+    server_name="0.0.0.0",
+    server_port=7860,
+    share=False,
+    ssr_mode=False,
+    prevent_thread_lock=True,
+)
+
+live_app = demo.app
+live_app.router.routes.insert(0, StarletteRoute("/webhook", webhook_handler, methods=["POST"]))
+live_app.router.routes.insert(0, StarletteRoute("/health", health_handler, methods=["GET"]))
+live_app.build_middleware_stack()
+
+
+# ─────────────────────────────────────────────────────────────
+# 14. setWebhook (sync — own thread)
+# ─────────────────────────────────────────────────────────────
+def _set_webhook_sync():
+    time.sleep(3)
+    try:
+        with httpx.Client(timeout=15.0) as c:
+            r = c.post(f"{TG_API}/setWebhook", json={
+                "url": f"{SPACE_URL}/webhook",
+                "secret_token": WEBHOOK_SECRET,
+                "allowed_updates": ["message", "edited_message", "callback_query"],
+            })
+            log.info("setWebhook → %s", r.text)
+    except Exception:
+        log.exception("setWebhook failed")
+
+
+threading.Thread(target=_set_webhook_sync, daemon=True).start()
+
+demo.block_thread()