[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","edenmenberu","name","eden","path","main.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/edenmenberu/eden/code/main.ts","extension","id","bb4283b0-0e94-4ff5-943e-e46a1dd68969","fileId","2d58eaa0-9fbb-11f1-9056-1607ee4eb77e","parentId","branchId","97c8f8ac-91a0-48b3-967a-808ad734d441","branchVersion",66,"latest",true,"createdAt",["D",1789496869842],"version",65,"fileType","http","content","// ============================================================\n// 🔥 ROAST ME - Val.town Endpoint (FINAL PRODUCTION READY)\n// ============================================================\n// Required secrets: GROQ_API_KEY, HCAPTCHA_SECRET_KEY\n// Optional secret: DEV_MODE = \"true\"\n// ============================================================\n\n// ============================================================\n// CONFIGURATION\n// ============================================================\nconst CONFIG = {\n MAX_REQUEST_BODY: 5 * 1024 * 1024,\n MAX_IMAGE_BYTES: 4 * 1024 * 1024,\n DAILY_LIMIT: 5,\n BURST_LIMIT: 3,\n BURST_WINDOW: 5 * 60 * 1000,\n IP_DAILY_LIMIT: 50,\n IP_BURST_LIMIT: 10,\n REQUEST_TIMEOUT: 30000,\n GLOBAL_DAILY_LIMIT: 1000,\n ALLOWED_INTENSITIES: [\"Mild\", \"Medium\", \"Savage\"] as const,\n\n ALLOWED_ORIGINS: [\n \"https://your-frontend-domain.com\",\n \"https://your-frontend-domain.vercel.app\",\n \"http://localhost:3000\",\n \"https://codepen.io\",\n \"https://cdpn.io\",\n \"https://localhost\",\n \"http://localhost\",\n \"capacitor://localhost\",\n ],\n ALLOWED_ORIGIN_PATTERNS: [\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.dev$/i,\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.io$/i,\n ],\n SESSION_COOKIE_NAME: \"roast_session\",\n SESSION_LIFETIME: 86400,\n};\n\nconst DEV_MODE = Deno.env.get(\"DEV_MODE\") === \"true\";\n\n// ============================================================\n// CORS\n// ============================================================\nfunction isOriginAllowed(origin: string | null): boolean {\n if (DEV_MODE) return true;\n if (!origin) return false;\n if (CONFIG.ALLOWED_ORIGINS.includes(origin)) return true;\n return CONFIG.ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));\n}\n\nfunction getCorsHeaders(origin: string | null): Record {\n const isAllowed = isOriginAllowed(origin);\n\n if (!isAllowed || !origin) {\n return {\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n };\n }\n\n return {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n \"Access-Control-Allow-Credentials\": \"true\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\n\n// ============================================================\n// TRUSTED IP\n// ============================================================\nfunction getTrustedIP(req: Request): string {\n const cfConnectingIP = req.headers.get(\"cf-connecting-ip\");\n if (cfConnectingIP) return cfConnectingIP;\n\n const vercelForwarded = req.headers.get(\"x-vercel-forwarded-for\");\n if (vercelForwarded) return vercelForwarded.split(\",\")[0].trim();\n\n const flyClientIP = req.headers.get(\"fly-client-ip\");\n if (flyClientIP) return flyClientIP;\n\n const forwarded = req.headers.get(\"x-forwarded-for\");\n if (forwarded) {\n const via = req.headers.get(\"via\") || \"\";\n const host = req.headers.get(\"host\") || \"\";\n if (via.includes(\"cloudflare\") || host.includes(\"cloudflare\")) {\n return forwarded.split(\",\")[0].trim();\n }\n }\n\n return req.headers.get(\"x-real-ip\") || \"unknown\";\n}\n\n// ============================================================\n// SESSION\n// ============================================================\nfunction getOrCreateSession(\n req: Request,\n): { sessionId: string; isNew: boolean } {\n const cookieHeader = req.headers.get(\"cookie\") || \"\";\n const cookies = cookieHeader.split(\";\").reduce((acc, cookie) => {\n const [key, value] = cookie.trim().split(\"=\");\n if (key && value) acc[key] = value;\n return acc;\n }, {} as Record);\n\n let sessionId = cookies[CONFIG.SESSION_COOKIE_NAME];\n\n if (sessionId && /^[a-zA-Z0-9]{32,64}$/.test(sessionId)) {\n return { sessionId, isNew: false };\n }\n\n const timestamp = Date.now().toString(36);\n const random1 = Math.random().toString(36).substring(2, 15);\n const random2 = Math.random().toString(36).substring(2, 15);\n const random3 = Math.random().toString(36).substring(2, 15);\n\n const raw = `${timestamp}${random1}${random2}${random3}`;\n\n let hash = \"\";\n for (let i = 0; i < raw.length; i++) {\n const char = raw.charCodeAt(i);\n const hex = (char & 0xFF).toString(16).padStart(2, \"0\");\n hash += hex;\n }\n\n while (hash.length < 64) {\n hash += Math.random().toString(36).substring(2, 10);\n }\n sessionId = hash.substring(0, 64);\n\n return { sessionId, isNew: true };\n}\n\n// ============================================================\n// IN-MEMORY RATE LIMITING\n// ============================================================\ntype LimitBucket = { timestamps: number[] };\nconst rateLimitStore = new Map();\n\nlet lastCleanup = 0;\nfunction cleanupStoreIfNeeded() {\n const now = Date.now();\n if (now - lastCleanup < 10 * 60 * 1000) return;\n lastCleanup = now;\n const maxWindow = 24 * 60 * 60 * 1000;\n for (const [key, bucket] of rateLimitStore.entries()) {\n bucket.timestamps = bucket.timestamps.filter((t) => now - t < maxWindow);\n if (bucket.timestamps.length === 0) rateLimitStore.delete(key);\n }\n}\n\nfunction incrementAllLimits(\n userId: string,\n ip: string,\n): {\n success: boolean;\n dailyCount?: number;\n burstCount?: number;\n ipDailyCount?: number;\n ipBurstCount?: number;\n error?: string;\n errorType?: string;\n} {\n cleanupStoreIfNeeded();\n\n const now = Date.now();\n const limits = [\n {\n key: `daily:${userId}`,\n limit: CONFIG.DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"daily\",\n field: \"dailyCount\",\n },\n {\n key: `burst:${userId}`,\n limit: CONFIG.BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"burst\",\n field: \"burstCount\",\n },\n {\n key: `ip_daily:${ip}`,\n limit: CONFIG.IP_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"ip_daily\",\n field: \"ipDailyCount\",\n },\n {\n key: `ip_burst:${ip}`,\n limit: CONFIG.IP_BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"ip_burst\",\n field: \"ipBurstCount\",\n },\n {\n key: \"global\",\n limit: CONFIG.GLOBAL_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"global\",\n field: null as string | null,\n },\n ];\n\n const reads = limits.map((limit) => {\n const bucket = rateLimitStore.get(limit.key) || { timestamps: [] };\n const cutoff = now - limit.windowMs;\n const validTimestamps = bucket.timestamps.filter((t) => t > cutoff);\n return { ...limit, validTimestamps };\n });\n\n for (const read of reads) {\n if (read.validTimestamps.length >= read.limit) {\n return {\n success: false,\n error: `${read.name}_limit_exceeded`,\n errorType: read.name,\n };\n }\n }\n\n const result: any = { success: true };\n for (const read of reads) {\n const newTimestamps = [...read.validTimestamps, now].slice(-100);\n rateLimitStore.set(read.key, { timestamps: newTimestamps });\n if (read.field) {\n result[read.field] = newTimestamps.length;\n }\n }\n\n return result;\n}\n\n// ============================================================\n// CAPTCHA VALIDATION\n// ============================================================\nasync function validateCaptcha(\n token: string | undefined,\n ip: string,\n): Promise {\n if (DEV_MODE && (!token || token === \"dev-mode-skip\")) {\n console.warn(\"DEV_MODE: skipping real captcha check\");\n return true;\n }\n\n const secretKey = Deno.env.get(\"HCAPTCHA_SECRET_KEY\")?.trim();\n\n if (!secretKey) {\n console.error(\"HCAPTCHA_SECRET_KEY is required in production\");\n return false;\n }\n\n if (!token) return false;\n\n try {\n const response = await fetch(\n \"https://hcaptcha.com/siteverify\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n secret: secretKey,\n response: token,\n remoteip: ip,\n }),\n },\n );\n\n const data = await response.json();\n if (data.success !== true) {\n console.error(\"hCaptcha verification failed:\", JSON.stringify(data));\n }\n return data.success === true;\n } catch (error) {\n console.error(\"hCaptcha validation error:\", error);\n return false;\n }\n}\n\n// ============================================================\n// BODY READER\n// ============================================================\nasync function readBodyWithLimit(req: Request, maxSize: number): Promise {\n const reader = req.body?.getReader();\n if (!reader) {\n throw new Error(\"No request body\");\n }\n\n let received = 0;\n const chunks: Uint8Array[] = [];\n\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n received += value.length;\n if (received > maxSize) {\n reader.cancel();\n throw new Error(\"Request body too large\");\n }\n\n chunks.push(value);\n }\n } finally {\n reader.releaseLock();\n }\n\n const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);\n const buffer = new Uint8Array(totalLength);\n let offset = 0;\n for (const chunk of chunks) {\n buffer.set(chunk, offset);\n offset += chunk.length;\n }\n\n const text = new TextDecoder().decode(buffer);\n return JSON.parse(text);\n}\n\n// ============================================================\n// IMAGE VALIDATION\n// ============================================================\nfunction validateImage(base64Data: string): {\n valid: boolean;\n mimeType?: string;\n error?: string;\n} {\n const approxBytes = Math.floor((base64Data.length * 3) / 4);\n if (approxBytes > CONFIG.MAX_IMAGE_BYTES) {\n return { valid: false, error: \"Image too large\" };\n }\n if (approxBytes < 100) {\n return { valid: false, error: \"Image too small\" };\n }\n\n if (!/^[A-Za-z0-9+/]+=*$/.test(base64Data.slice(0, 200))) {\n return { valid: false, error: \"Invalid image format\" };\n }\n\n try {\n const binaryString = atob(base64Data.slice(0, 100));\n const bytes = new Uint8Array(binaryString.length);\n for (let i = 0; i < binaryString.length; i++) {\n bytes[i] = binaryString.charCodeAt(i);\n }\n\n const magic = Array.from(bytes.slice(0, 12))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n if (\n magic.startsWith(\"ffd8ffe0\") || magic.startsWith(\"ffd8ffe1\") ||\n magic.startsWith(\"ffd8ffe2\") || magic.startsWith(\"ffd8ffdb\") ||\n magic.startsWith(\"ffd8ffc0\") || magic.startsWith(\"ffd8ffc4\")\n ) {\n return { valid: true, mimeType: \"image/jpeg\" };\n }\n\n if (magic.startsWith(\"89504e470d0a1a0a\")) {\n return { valid: true, mimeType: \"image/png\" };\n }\n\n if (magic.startsWith(\"52494646\")) {\n const webpCheck = binaryString.slice(8, 12);\n if (webpCheck === \"WEBP\") {\n return { valid: true, mimeType: \"image/webp\" };\n }\n }\n\n return { valid: false, error: \"Unsupported image format\" };\n } catch {\n return { valid: false, error: \"Invalid image data\" };\n }\n}\n\n// ============================================================\n// REQUEST VALIDATION\n// ============================================================\nfunction validateRequest(body: any): {\n valid: boolean;\n action?: string;\n imageBase64?: string;\n intensity?: string;\n captchaToken?: string;\n reason?: string;\n roast?: string;\n reportType?: string;\n error?: string;\n reportedAt?: string;\n} {\n if (!body || typeof body !== \"object\") {\n return { valid: false, error: \"Invalid request\" };\n }\n\n const {\n action,\n imageBase64,\n intensity,\n captchaToken,\n reason,\n roast,\n reportType,\n error,\n reportedAt,\n } = body;\n\n if (action === \"report\") {\n const allowedReasons = [\n \"Offensive or inappropriate\",\n \"Harassment / bullying\",\n \"Hateful content\",\n \"Sexual or inappropriate content\",\n \"AI generated something unrelated\",\n \"AI generation failed\",\n \"Other\",\n ];\n\n const allowedReportTypes = [\"roast\", \"generation_failure\"];\n\n if (typeof reason !== \"string\" || !allowedReasons.includes(reason)) {\n return { valid: false, error: \"Invalid report reason\" };\n }\n\n const safeReportType =\n typeof reportType === \"string\" && allowedReportTypes.includes(reportType)\n ? reportType\n : \"roast\";\n\n if (reportedAt !== undefined) {\n if (typeof reportedAt !== \"string\" || Number.isNaN(Date.parse(reportedAt))) {\n return { valid: false, error: \"Invalid report timestamp\" };\n }\n }\n\n return {\n valid: true,\n action: \"report\",\n reason,\n reportType: safeReportType,\n roast: typeof roast === \"string\" ? roast.slice(0, 500) : \"\",\n error: typeof error === \"string\" ? error.slice(0, 500) : \"\",\n reportedAt: reportedAt || new Date().toISOString(),\n };\n }\n\n if (!imageBase64 || typeof imageBase64 !== \"string\") {\n return { valid: false, error: \"No image provided\" };\n }\n\n if (intensity && !CONFIG.ALLOWED_INTENSITIES.includes(intensity)) {\n return { valid: false, error: \"Invalid intensity level\" };\n }\n\n if (!DEV_MODE) {\n if (!captchaToken || typeof captchaToken !== \"string\") {\n return { valid: false, error: \"Verification token required\" };\n }\n }\n\n return {\n valid: true,\n action: \"roast\",\n imageBase64,\n intensity: intensity || \"Medium\",\n captchaToken,\n };\n}\n\n// ============================================================\n// GROQ RESPONSE VALIDATION\n// ============================================================\nfunction validateGroqResponse(data: any): { valid: boolean; content?: string } {\n try {\n if (!data || typeof data !== \"object\") return { valid: false };\n\n const choices = data.choices;\n if (!Array.isArray(choices) || choices.length === 0) {\n return { valid: false };\n }\n\n const message = choices[0]?.message;\n if (!message || typeof message !== \"object\") return { valid: false };\n\n const content = message.content;\n if (typeof content !== \"string\" || content.trim().length === 0) {\n return { valid: false };\n }\n\n return { valid: true, content: content.trim() };\n } catch {\n return { valid: false };\n }\n}\n\n// ============================================================\n// CONTENT MODERATION\n// ============================================================\nconst BLOCKED_WORDS = [\n \"stupid\", \"dumb\", \"ugly\", \"fat\", \"loser\", \"hate\", \"idiot\", \"moron\",\n \"retard\", \"worthless\", \"trash\", \"garbage\", \"pathetic\", \"disgusting\",\n \"kill\", \"die\", \"death\", \"suicide\", \"murder\", \"terrorist\", \"racist\",\n \"nazi\", \"pedophile\", \"rapist\", \"abuse\", \"trauma\", \"mental illness\",\n];\n\nconst FALLBACK_ROASTS = [\n \"You're too cool for a roast right now. Try again! 😎\",\n \"AI is speechless... but your outfit isn't! 😂\",\n \"You look like you'd survive a zombie apocalypse by being too fast! 🏃\",\n \"Your style is so unique, even AI can't roast it! ✨\",\n \"You're radiating main character energy! 🌟\",\n \"Looking sharp! Even AI can't find a flaw! 👔\",\n \"You're serving looks that AI can't compute! 💫\",\n \"Too stylish to roast! Save some for the rest of us! 🔥\",\n];\n\nfunction moderateContent(text: string): string {\n const lowerText = text.toLowerCase();\n const hasBlocked = BLOCKED_WORDS.some((word) => lowerText.includes(word));\n\n if (hasBlocked) {\n return FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n\n text = text.replace(/[^a-zA-Z0-9\\s.,!?'\"\\-()]/g, \"\");\n\n if (text.length > 300) {\n text = text.slice(0, 297) + \"...\";\n }\n\n return text;\n}\n\n// ============================================================\n// PROMPTS + SAFETY RULES\n// ============================================================\nconst INTENSITY_PROMPTS: Record = {\n Mild:\n \"Give a gentle, playful, and lighthearted roast. Keep it funny but nice. No harsh words. Focus on style, expression, or background. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Medium:\n \"Give a funny, sarcastic, and witty roast. Be humorous but not too harsh. Focus on outfit, expression, background, or pose. Keep it clever and creative. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Savage:\n \"Give a sharp, witty, and clever roast. Be bold and creative but keep it playful. Focus on style, pose, background, or expression. Make it funny and clever, not offensive. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n};\n\nconst SAFETY_RULES = [\n \"Never mention weight, body size, or physical appearance beyond clothing/style.\",\n \"Never mention race, ethnicity, religion, or nationality.\",\n \"Never use profanity, slurs, or offensive language.\",\n \"Never mention disabilities, health conditions, or mental health.\",\n \"Never make threats, insults, or personal attacks.\",\n \"Never mention age or make age-related insults.\",\n \"Keep roasts playful, creative, and focused on style/expression/background.\",\n \"Maximum 2 sentences per roast.\",\n];\n\nfunction buildPrompt(intensity: string): string {\n const basePrompt = INTENSITY_PROMPTS[intensity] || INTENSITY_PROMPTS.Medium;\n const safetyPrompt = `IMPORTANT SAFETY RULES (must follow all):\n${SAFETY_RULES.map((rule, i) => `${i + 1}. ${rule}`).join(\"\\n\")}\n\nNow give a ${intensity} roast based on the image:`;\n\n return `${safetyPrompt}\\n\\n${basePrompt}`;\n}\n\n// ============================================================\n// MAIN HANDLER\n// ============================================================\nexport async function server(req: Request): Promise {\n const origin = req.headers.get(\"origin\");\n const corsHeaders = getCorsHeaders(origin);\n\n if (!isOriginAllowed(origin)) {\n return new Response(\n JSON.stringify({\n error: \"Unauthorized origin\",\n receivedOrigin: origin,\n }),\n {\n status: 403,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: corsHeaders });\n }\n\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({ error: \"Method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n try {\n let body;\n try {\n body = await readBodyWithLimit(req, CONFIG.MAX_REQUEST_BODY);\n } catch (error) {\n if (error.message === \"Request body too large\") {\n return new Response(\n JSON.stringify({ error: \"Request too large\" }),\n {\n status: 413,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n throw error;\n }\n\n const validation = validateRequest(body);\n console.log(\"[ROAST ME] Request received:\", {\n action: body?.action || \"roast\",\n origin,\n });\n\n if (!validation.valid) {\n return new Response(\n JSON.stringify({ error: validation.error || \"Invalid request\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n if (validation.action === \"report\") {\n const { sessionId, isNew } = getOrCreateSession(req);\n\n const report = {\n sessionId,\n reportType: validation.reportType || \"roast\",\n reason: validation.reason,\n roast: validation.roast || \"\",\n error: validation.error || \"\",\n reportedAt: validation.reportedAt || new Date().toISOString(),\n receivedAt: new Date().toISOString(),\n };\n\n console.log(\n \"🔥 ROAST ME REPORT RECEIVED:\",\n JSON.stringify(report),\n );\n\n const reportHeaders: Record = {\n \"Content-Type\": \"application/json\",\n ...corsHeaders,\n };\n\n if (isNew) {\n reportHeaders[\"Set-Cookie\"] =\n `${CONFIG.SESSION_COOKIE_NAME}=${sessionId}; ` +\n `Path=/; HttpOnly; Secure; SameSite=Strict; ` +\n `Max-Age=${CONFIG.SESSION_LIFETIME}`;\n }\n\n return new Response(\n JSON.stringify({\n success: true,\n received: true,\n message: \"Report submitted\",\n }),\n {\n status: 200,\n headers: reportHeaders,\n },\n );\n }\n\n const imageValidation = validateImage(validation.imageBase64!);\n if (!imageValidation.valid) {\n return new Response(\n JSON.stringify({ error: imageValidation.error }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const trustedIP = getTrustedIP(req);\n const { sessionId, isNew } = getOrCreateSession(req);\n const userId = `${trustedIP}:${sessionId}`;\n\n const isCaptchaValid = await validateCaptcha(\n validation.captchaToken,\n trustedIP,\n );\n\n if (!isCaptchaValid) {\n return new Response(\n JSON.stringify({\n error: \"Verification failed. Please refresh and try again.\",\n refresh: true,\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const limitResult = incrementAllLimits(userId, trustedIP);\n\n if (!limitResult.success) {\n const errorMessages: Record = {\n \"daily_limit_exceeded\": \"Daily limit reached. Come back tomorrow!\",\n \"burst_limit_exceeded\": \"Too many requests. Please wait a few minutes.\",\n \"ip_daily_limit_exceeded\": \"Too many requests from this network today.\",\n \"ip_burst_limit_exceeded\":\n \"Too many requests from this network. Please wait.\",\n \"global_limit_exceeded\":\n \"Service temporarily unavailable. Please try later.\",\n };\n\n const errorMsg = errorMessages[limitResult.errorType || \"\"] ||\n \"Rate limit exceeded\";\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n remaining: 0,\n limit: CONFIG.DAILY_LIMIT,\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const groqKey = Deno.env.get(\"GROQ_API_KEY\");\n if (!groqKey) {\n console.error(\"GROQ_API_KEY not configured\");\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const prompt = buildPrompt(validation.intensity!);\n const temperature = validation.intensity === \"Mild\"\n ? 0.7\n : validation.intensity === \"Savage\"\n ? 0.95\n : 0.85;\n\n const mimeType = imageValidation.mimeType || \"image/jpeg\";\n const imageDataUrl = `data:${mimeType};base64,${validation.imageBase64}`;\n\n const controller = new AbortController();\n const timeoutId = setTimeout(\n () => controller.abort(),\n CONFIG.REQUEST_TIMEOUT,\n );\n\n let roastText: string;\n\n try {\n // ✅ CORRECTED MODEL NAME — qwen3.8-27b (not 3.6)\n // This is the vision-capable model available on Groq.\n const groqResponse = await fetch(\n \"https://api.groq.com/openai/v1/chat/completions\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${groqKey}`,\n },\n body: JSON.stringify({\n model: \"qwen/qwen3.8-27b\",\n messages: [\n {\n role: \"user\",\n content: [\n { type: \"text\", text: prompt },\n { type: \"image_url\", image_url: { url: imageDataUrl } },\n ],\n },\n ],\n max_tokens: 350,\n temperature: temperature,\n // Qwen reasoning model settings — disable internal reasoning\n // since we only need a short roast.\n reasoning_effort: \"none\",\n reasoning_format: \"hidden\",\n }),\n signal: controller.signal,\n },\n );\n\n clearTimeout(timeoutId);\n\n if (!groqResponse.ok) {\n let groqErrorBody = \"\";\n try {\n groqErrorBody = await groqResponse.text();\n } catch {\n // ignore\n }\n console.error(\n `Groq API error: ${groqResponse.status}`,\n groqErrorBody.slice(0, 1000),\n );\n\n if (groqResponse.status === 429) {\n return new Response(\n JSON.stringify({\n error: \"AI service is busy right now. Please wait a moment and try again.\",\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n return new Response(\n JSON.stringify({\n error: \"AI service temporarily unavailable\",\n groqStatus: groqResponse.status,\n groqError: groqErrorBody.slice(0, 300),\n }),\n {\n status: groqResponse.status >= 500 ? 503 : 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const data = await groqResponse.json();\n\n const validated = validateGroqResponse(data);\n if (!validated.valid) {\n console.error(\n \"Invalid Groq response structure. Raw response:\",\n JSON.stringify(data).slice(0, 1500),\n );\n return new Response(\n JSON.stringify({ error: \"Service error. Please try again.\" }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n roastText = validated.content || \"No roast generated.\";\n roastText = roastText.replace(/[\\s\\S]*?<\\/think>/gi, \"\").trim();\n roastText = roastText.replace(/^think\\b[\\s\\S]*?(?=\\n\\n|$)/i, \"\").trim();\n roastText = roastText.replace(/^[\"']|[\"']$/g, \"\");\n if (!roastText) {\n roastText = FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n roastText = moderateContent(roastText);\n } catch (fetchError: any) {\n clearTimeout(timeoutId);\n\n if (fetchError.name === \"AbortError\") {\n console.error(\"Groq API request timeout\");\n return new Response(\n JSON.stringify({\n error: \"AI service took too long. Please try again.\",\n }),\n {\n status: 504,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n console.error(\"Groq API request failed:\", fetchError.message);\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const responseHeaders: Record = {\n \"Content-Type\": \"application/json\",\n ...corsHeaders,\n };\n\n if (isNew) {\n responseHeaders[\"Set-Cookie\"] =\n `${CONFIG.SESSION_COOKIE_NAME}=${sessionId}; ` +\n `Path=/; ` +\n `HttpOnly; ` +\n `Secure; ` +\n `SameSite=Strict; ` +\n `Max-Age=${CONFIG.SESSION_LIFETIME}`;\n }\n\n const remaining = CONFIG.DAILY_LIMIT - (limitResult.dailyCount || 1);\n\n return new Response(\n JSON.stringify({\n roast: roastText,\n remaining: Math.max(0, remaining),\n limit: CONFIG.DAILY_LIMIT,\n used: limitResult.dailyCount || 1,\n intensity: validation.intensity,\n }),\n { headers: responseHeaders },\n );\n } catch (error: any) {\n console.error(\"Request error:\", {\n name: error.name || \"Unknown\",\n message: error.message?.slice(0, 100) || \"No message\",\n });\n\n let status = 400;\n let errorMsg = \"Something went wrong. Please try again.\";\n\n if (error.message?.includes(\"JSON\") || error.message?.includes(\"parse\")) {\n status = 400;\n errorMsg = \"Invalid request format.\";\n } else if (error.message?.includes(\"timeout\")) {\n status = 504;\n errorMsg = \"Request timed out. Please try again.\";\n } else {\n status = 500;\n errorMsg = \"Server error. Please try again later.\";\n }\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n roast: \"Oops! Something went wrong. Give it another try! 😅\",\n }),\n {\n status: status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...getCorsHeaders(origin),\n },\n },\n );\n }\n}","deleted",false,"label",[14],"2e53e9e5-d432-4222-a56b-0b8c952cf506",["D",1787576169085],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","334f0784-d0e9-4432-a964-faa31ca93082","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a033d5-1ff7-7536-80e1-e9c2c450fe63","tursoName","2e53e9e5d4324222a56b0b8c952cf506","tursoHostname","2e53e9e5d4324222a56b0b8c952cf506-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789501263826],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":100},"org",{"_9":10,"_97":98,"_99":100,"_55":56,"_101":102,"_103":42},"branch",{"_35":30,"_11":88,"_22":28,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":12,"_96":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Eden Menberu","avatar","https://lh3.googleusercontent.com/a/ACg8ocJi70p5tIzpbponvGByu7dYhpGy3Myl2QbLoLL9cEteAQBXhA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":88,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]