[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_151":152,"_153":154},"routes/_app.x.$handle.$name",{"_94":93,"_32":45,"_102":84,"_27":96,"_13":14,"_103":-5,"_11":104,"_105":106,"_107":108,"_109":110,"_111":112,"_20":-5,"_113":-5,"_114":-5,"_115":25,"_116":117,"_118":57,"_119":-5,"_120":-5,"_121":122},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":31,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",3,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":37,"_35":36,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","e62c4744-8444-11f1-bef2-1607ee4eb77e","name","fileType","script","content","/**\n * html-to-pdf — reusable HTML→PDF renderer for the myPKA team\n * ---------------------------------------------------------------------------\n * Platform : Val Town (Deno runtime, HTTP val)\n * Author : Mack (Automation Specialist) · 2026-07-20\n *\n * WHY A REMOTE BROWSER, NOT jsPDF\n * Val Town is serverless Deno — it cannot launch a local Chromium binary, so\n * Puppeteer/Playwright \"launch()\" does not work here. jsPDF DOES run natively\n * but only *draws* primitives (text/lines) — it cannot render arbitrary\n * HTML/CSS (web fonts, gradients, SVG, flex/grid). Our inputs are\n * design-system-faithful HTML (infographics, one-pagers, eBooks,\n * certificates), so we need a REAL browser. The working pattern on Val Town\n * is puppeteer-core connecting to a hosted browser (Browserless) over a\n * WebSocket, then page.setContent() + page.pdf(). Full CSS fidelity, zero\n * Chromium ops on our side.\n *\n * SECRETS (Val Town → Settings → Environment Variables — NEVER hardcode):\n * BROWSERLESS_TOKEN required — token from browserless.io (free tier ok)\n * RENDER_SECRET required — shared secret callers send as Bearer auth\n * BROWSERLESS_REGION optional — \"production-sfo\" (default) | \"production-lon\"\n *\n * HOW TO CALL (see README.md for full examples)\n * POST https://-html_to_pdf.web.val.run\n * Header: Authorization: Bearer \n * Body (JSON):\n * { \"html\": \"…\", \"filename\": \"one-pager.pdf\",\n * \"options\": { \"format\": \"A4\", \"landscape\": false,\n * \"printBackground\": true, \"margin\": {...},\n * \"scale\": 1, \"width\": \"8.5in\", \"height\": \"11in\",\n * \"preferCSSPageSize\": true, \"pageRanges\": \"1-2\" } }\n * → 200 application/pdf (the file) | 4xx/5xx application/json (error)\n * GET same URL → JSON health + usage note (no auth needed)\n */\n\nimport puppeteer from \"npm:puppeteer-core@23.11.1\";\n\n// ── config ────────────────────────────────────────────────────────────────\nconst MAX_HTML_BYTES = 6_000_000; // reject absurd payloads early (~6 MB)\nconst NAV_TIMEOUT_MS = 45_000; // setContent + fonts/images settle budget\nconst CONNECT_ATTEMPTS = 3; // remote-browser connect retries\nconst SERVICE = \"html-to-pdf\";\n\n// structured, secret-free logging (critical rule #6)\nfunction log(event: string, fields: Record = {}) {\n console.log(\n JSON.stringify({\n service: SERVICE,\n event,\n ts: new Date().toISOString(),\n ...fields,\n }),\n );\n}\n\n// fail fast + loud on missing env (critical rule #5)\nfunction requireEnv(name: string): string {\n const v = Deno.env.get(name);\n if (!v || !v.trim()) throw new Error(`Missing required env var: ${name}`);\n return v.trim();\n}\n\n// constant-time-ish compare so we don't leak the secret via timing\nfunction safeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\nfunction json(body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body, null, 2), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\" },\n });\n}\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\n// connect to the hosted browser with exponential backoff (critical rule #4)\nasync function connectBrowser() {\n const token = requireEnv(\"BROWSERLESS_TOKEN\");\n const region = Deno.env.get(\"BROWSERLESS_REGION\")?.trim() || \"production-sfo\";\n const endpoint = `wss://${region}.browserless.io?token=${token}`;\n let lastErr: unknown;\n for (let attempt = 1; attempt <= CONNECT_ATTEMPTS; attempt++) {\n try {\n return await puppeteer.connect({ browserWSEndpoint: endpoint });\n } catch (err) {\n lastErr = err;\n log(\"connect_retry\", {\n attempt,\n message: String((err as Error)?.message ?? err),\n });\n if (attempt < CONNECT_ATTEMPTS) await sleep(400 * 2 ** (attempt - 1)); // 400ms, 800ms\n }\n }\n throw new Error(\n `Could not reach remote browser after ${CONNECT_ATTEMPTS} attempts: ${\n String((lastErr as Error)?.message ?? lastErr)\n }`,\n );\n}\n\n// whitelist + coerce caller-supplied pdf options (never trust raw input)\nfunction buildPdfOptions(raw: unknown): Record {\n const o = (raw && typeof raw === \"object\" ? raw : {}) as Record<\n string,\n unknown\n >;\n const opts: Record = {\n printBackground: o.printBackground === undefined\n ? true\n : Boolean(o.printBackground),\n preferCSSPageSize: o.preferCSSPageSize === undefined\n ? true\n : Boolean(o.preferCSSPageSize),\n };\n // Page size: either a named format OR explicit width/height (for certificates,\n // social tiles, custom eBook trims). Explicit dimensions win when present.\n if (typeof o.width === \"string\" && typeof o.height === \"string\") {\n opts.width = o.width;\n opts.height = o.height;\n } else {\n const allowed = [\n \"Letter\",\n \"Legal\",\n \"Tabloid\",\n \"Ledger\",\n \"A0\",\n \"A1\",\n \"A2\",\n \"A3\",\n \"A4\",\n \"A5\",\n \"A6\",\n ];\n opts.format = allowed.includes(String(o.format)) ? o.format : \"A4\";\n }\n if (o.landscape !== undefined) opts.landscape = Boolean(o.landscape);\n if (typeof o.scale === \"number\" && o.scale >= 0.1 && o.scale <= 2) {\n opts.scale = o.scale;\n }\n if (typeof o.pageRanges === \"string\") opts.pageRanges = o.pageRanges;\n if (o.margin && typeof o.margin === \"object\") {\n const m = o.margin as Record;\n const pick = (\n k: string,\n ) => (typeof m[k] === \"string\" || typeof m[k] === \"number\"\n ? m[k]\n : undefined);\n opts.margin = {\n top: pick(\"top\"),\n right: pick(\"right\"),\n bottom: pick(\"bottom\"),\n left: pick(\"left\"),\n };\n }\n return opts;\n}\n\nasync function render(\n html: string,\n pdfOptions: Record,\n): Promise {\n const browser = await connectBrowser();\n try {\n const page = await browser.newPage();\n page.setDefaultNavigationTimeout(NAV_TIMEOUT_MS);\n // networkidle0 lets web fonts / images / SVG data-URIs finish loading so the\n // PDF matches the design system (Tan Aegean, gradients, velvet grain, etc.).\n await page.setContent(html, {\n waitUntil: \"networkidle0\",\n timeout: NAV_TIMEOUT_MS,\n });\n // Belt-and-suspenders: block on font readiness before snapshotting.\n await page.evaluateHandle(\"document.fonts && document.fonts.ready\").catch(\n () => {},\n );\n const pdf = await page.pdf(pdfOptions);\n await page.close().catch(() => {});\n return pdf as Uint8Array;\n } finally {\n // Always release the remote session, even on error (graceful shutdown).\n await browser.close().catch((e) =>\n log(\"browser_close_failed\", { message: String(e) })\n );\n }\n}\n\n// ── entrypoint ──────────────────────────────────────────────────────────────\nexport default async function (req: Request): Promise {\n const started = Date.now();\n\n // Health / usage note — safe to expose, no secrets, no auth.\n if (req.method === \"GET\" || req.method === \"HEAD\") {\n let envOk = true;\n try {\n requireEnv(\"BROWSERLESS_TOKEN\");\n requireEnv(\"RENDER_SECRET\");\n } catch {\n envOk = false;\n }\n return json({\n service: SERVICE,\n status: envOk\n ? \"ready\"\n : \"misconfigured — set BROWSERLESS_TOKEN and RENDER_SECRET\",\n how_to_call: {\n method: \"POST\",\n auth: \"Authorization: Bearer \",\n body: {\n html: \"\",\n filename: \"\",\n options: \"\",\n },\n returns: \"200 application/pdf, or JSON error\",\n },\n });\n }\n\n if (req.method !== \"POST\") {\n return json({ error: \"method_not_allowed\", allowed: [\"GET\", \"POST\"] }, 405);\n }\n\n // Auth gate — validate env, then the caller's bearer token.\n let secret: string;\n try {\n requireEnv(\"BROWSERLESS_TOKEN\");\n secret = requireEnv(\"RENDER_SECRET\");\n } catch (e) {\n log(\"misconfigured\", { message: String((e as Error).message) });\n return json({\n error: \"server_misconfigured\",\n detail: String((e as Error).message),\n }, 500);\n }\n const auth = req.headers.get(\"authorization\") ?? \"\";\n const bearer = auth.startsWith(\"Bearer \") ? auth.slice(7) : \"\";\n if (!bearer || !safeEqual(bearer, secret)) {\n log(\"unauthorized\", { hasHeader: Boolean(auth) });\n return json({\n error: \"unauthorized\",\n detail: \"Send Authorization: Bearer \",\n }, 401);\n }\n\n // Parse + validate body.\n let payload: { html?: unknown; filename?: unknown; options?: unknown };\n try {\n payload = await req.json();\n } catch {\n return json({\n error: \"bad_request\",\n detail: \"Body must be JSON: { html, filename?, options? }\",\n }, 400);\n }\n const html = payload?.html;\n if (typeof html !== \"string\" || html.trim().length === 0) {\n return json({\n error: \"bad_request\",\n detail: \"'html' is required and must be a non-empty string\",\n }, 400);\n }\n const htmlBytes = new TextEncoder().encode(html).length;\n if (htmlBytes > MAX_HTML_BYTES) {\n return json({\n error: \"payload_too_large\",\n detail: `HTML is ${htmlBytes} bytes; limit ${MAX_HTML_BYTES}`,\n }, 413);\n }\n const filename =\n typeof payload.filename === \"string\" && payload.filename.trim()\n ? payload.filename.trim().replace(/[^\\w.\\-]+/g, \"_\")\n : \"document.pdf\";\n const pdfOptions = buildPdfOptions(payload.options);\n\n // Render.\n try {\n const pdf = await render(html, pdfOptions);\n log(\"rendered\", {\n htmlBytes,\n pdfBytes: pdf.length,\n ms: Date.now() - started,\n filename,\n });\n return new Response(pdf, {\n status: 200,\n headers: {\n \"content-type\": \"application/pdf\",\n \"content-disposition\": `attachment; filename=\"${filename}\"`,\n \"content-length\": String(pdf.length),\n \"x-render-ms\": String(Date.now() - started),\n },\n });\n } catch (err) {\n const message = String((err as Error)?.message ?? err);\n log(\"render_failed\", { htmlBytes, ms: Date.now() - started, message });\n return json({ error: \"render_failed\", detail: message }, 502);\n }\n}","http","createdAt",["D",1784557860785],"branchVersion","branchId","376db8b9-f0e3-4561-bc6b-ee539c42cc2b","id","118d3da4-be0a-491c-ac6a-acab21129786","html_to_pdf",["D",1784556687922],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f2c4304f-fbd3-402f-a3a7-afe74ea61388","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f2ef6-b874-7055-929b-2625fd8497ac","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_94":93,"_101":96},"org",{"_94":93,"_95":96,"_97":96,"_18":54,"_98":99,"_100":25},"branch",{"_13":14,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","contextandnuance","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":147,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":31,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":148,"_79":149,"_81":150,"_83":25},"tree",[142],"files",[142],"counts",{"_131":61,"_132":133,"_134":61,"_135":136,"_137":138},"contents",[123],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":124,"_32":28,"_30":31,"_125":-5,"_41":42,"_40":14,"_126":57,"_38":127,"_13":128,"_33":37,"_35":36,"_24":25,"_129":-5,"_27":130},"cb2378e2-150c-45c3-9b99-5489c0bf0959","parentId","latest",["D",1784557860785],2,"label",[28],"pulls","branches",1,"forks","envVars",{"_139":128,"_141":61},"connections",{"_139":61,"_140":61},"count","unfilledCount","emptyCount",{"_43":124,"_32":28,"_30":31,"_125":-5,"_41":42,"_40":14,"_126":57,"_38":143,"_13":128,"_33":37,"_35":36,"_24":25,"_129":-5,"_144":145,"_27":146},["D",1784557860785],"children",[],[28],["D",1784556687922],{"_94":93,"_101":96},{"_94":93,"_95":96,"_97":96,"_18":54,"_98":99,"_100":25},{"_13":14,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"ctx",{"_77":-5,"_120":184,"_185":186,"_187":188,"_189":25,"_190":25,"_191":25,"_192":57,"_193":-5,"_194":-7,"_195":-7,"_196":61,"_197":25,"_198":25,"_199":-5,"_200":25,"_201":25,"_202":25,"_203":-5},"ENV",{"_155":156,"_157":158,"_159":84,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3