[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_117":-5,"_20":118,"_22":119,"_120":121,"_122":123,"_25":124,"_24":-5,"_125":-5,"_126":-5,"_127":53,"_128":129,"_130":44,"_131":-5,"_132":-5,"_133":134},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","datacraftr","name","anthropic-proxy","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":95,"_96":97,"_98":99,"_100":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","e4e204ff-b2e7-4445-92c9-0fb175ad06b4","main.ts","fileId","0a2cf936-7d60-11f1-bb7e-1607ee4eb77e","parentId","branchId","eadede4f-870c-422c-b0ee-7e145d518103","branchVersion",12,"latest",true,"createdAt",["D",1783802026161],11,"fileType","http","content","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n// ─── Config ──────────────────────────────────────────────────────────────────\n\n// ✏️ Paste your system prompt here\nconst SYSTEM_PROMPT = \"You are a helpful assistant.\";\n\nconst MODEL = \"claude-haiku-4-5-20251001\";\nconst MAX_TOKENS = 1024;\nconst MAX_MESSAGES = 20;\nconst MAX_LOOP_ITERATIONS = 5; // cap on agent loop iterations\nconst RATE_LIMIT = 20; // requests per IP per hour\nconst RATE_LIMIT_WINDOW_MS = 3600_000; // 1 hour\n\nconst ALLOWED_ORIGINS = [\n \"http://localhost:8000\",\n \"https://datacraftr.github.io\",\n];\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\nfunction corsHeaders(origin: string | null) {\n const allowed = origin && ALLOWED_ORIGINS.includes(origin);\n return {\n \"Access-Control-Allow-Origin\": allowed ? origin! : \"\",\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"content-type\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\n\nfunction json(\n body: unknown,\n status: number,\n extra: Record = {},\n): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...extra },\n });\n}\n\n// ─── Rate limiter (blob-backed, 20 req / IP / hour) ──────────────────────────\n\nasync function checkRateLimit(ip: string): Promise {\n const key = `ratelimit:${ip}`;\n const now = Date.now();\n const timestamps = (await blob.getJSON(key)) ?? [];\n // Drop entries older than the window\n const recent = timestamps.filter((ts) => now - ts < RATE_LIMIT_WINDOW_MS);\n if (recent.length >= RATE_LIMIT) {\n await blob.setJSON(key, recent); // persist cleanup\n return false;\n }\n recent.push(now);\n await blob.setJSON(key, recent);\n return true;\n}\n\n// ─── Types ───────────────────────────────────────────────────────────────────\n\n// Content blocks used inside the agent loop. The client only ever sends\n// plain strings, but Anthropic's tool-use API requires structured blocks.\n\ntype ContentBlock =\n | { type: \"text\"; text: string }\n | { type: \"tool_use\"; id: string; name: string; input: Record }\n | { type: \"tool_result\"; tool_use_id: string; content: string };\n\ntype APIMessage = {\n role: \"user\" | \"assistant\";\n content: string | ContentBlock[];\n};\n\n// ─── Tool definition ─────────────────────────────────────────────────────────\n\nconst TOOLS = [\n {\n name: \"send_message_to_mikell\",\n description:\n \"Send a message to Mikell on behalf of a site visitor. Use this when a visitor asks you to relay information, pass along a note, or contact Mikell for them.\",\n input_schema: {\n type: \"object\" as const,\n properties: {\n name: {\n type: \"string\",\n description: \"The name of the person sending the message.\",\n },\n email: {\n type: \"string\",\n description: \"The email address to reply to.\",\n },\n message: {\n type: \"string\",\n description: \"The message content to send to Mikell.\",\n },\n },\n required: [\"name\", \"email\", \"message\"],\n },\n },\n];\n\n// ─── Tool execution ──────────────────────────────────────────────────────────\n\nasync function executeTool(\n name: string,\n input: Record,\n): Promise {\n if (name === \"send_message_to_mikell\") {\n // TODO: wire up real email delivery later\n console.log(\"send_message_to_mikell:\", input);\n return `Message received from ${input.name} (${input.email}). Mikell will get back to you soon.`;\n }\n return `Unknown tool: ${name}`;\n}\n\n// ─── Handler ─────────────────────────────────────────────────────────────────\n\nexport default async (req: Request): Promise => {\n const origin = req.headers.get(\"Origin\");\n const cors = corsHeaders(origin);\n\n // ── Guardrail 1: CORS preflight ──────────────────────────────────────────\n // Browsers send OPTIONS before cross-origin POSTs. Must come first,\n // must return 2xx, must carry the CORS headers.\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: cors });\n }\n\n // ── Guardrail 2: POST only ───────────────────────────────────────────────\n // No GET, no PUT, no DELETE — the only thing this endpoint does is\n // accept a chat message and forward it to Anthropic.\n if (req.method !== \"POST\") {\n return new Response(\"Method not allowed\", { status: 405 });\n }\n\n // ── Guardrail 3: Origin allowlist ────────────────────────────────────────\n // The URL will be visible in the page source. This check ensures only\n // your portfolio site (and localhost during dev) can call it.\n if (!origin || !ALLOWED_ORIGINS.includes(origin)) {\n return json({ error: \"Forbidden\" }, 403);\n }\n\n // ── Guardrail 4: Rate limiting by IP ─────────────────────────────────────\n // 20 requests per IP per hour, tracked in blob storage. Prevents\n // abuse even from someone who spoofs an allowed Origin header.\n const ip =\n req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ?? \"unknown\";\n if (!(await checkRateLimit(ip))) {\n return json(\n { error: \"Rate limit exceeded. Try again later.\" },\n 429,\n { ...cors, \"Retry-After\": \"3600\" },\n );\n }\n\n // ── Guardrail 5: Body must be exactly {\"messages\": [...]} ────────────────\n // The client cannot set model, max_tokens, system, tools, or any other\n // Anthropic parameter — those are all hardcoded below.\n let body: unknown;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"Invalid JSON\" }, 400, cors);\n }\n\n if (\n typeof body !== \"object\" || body === null || Array.isArray(body) ||\n Object.keys(body).length !== 1 || !(\"messages\" in body)\n ) {\n return json(\n { error: 'Body must be exactly {\"messages\": [...]}' },\n 400,\n cors,\n );\n }\n\n const messages = (body as { messages: unknown }).messages;\n\n // ── Guardrail 6: Validate messages array ─────────────────────────────────\n // Each message must have role \"user\" or \"assistant\" and string content.\n // Rejects tool messages, image blocks, or anything unexpected.\n if (!Array.isArray(messages) || messages.length === 0) {\n return json(\n { error: \"messages must be a non-empty array\" },\n 400,\n cors,\n );\n }\n\n // ── Guardrail 7: Cap conversation length ─────────────────────────────────\n // Prevents excessively long conversations from burning through your\n // token budget.\n if (messages.length > MAX_MESSAGES) {\n return json(\n { error: `Too many messages. Max ${MAX_MESSAGES}.` },\n 400,\n cors,\n );\n }\n\n for (let i = 0; i < messages.length; i++) {\n const msg = messages[i];\n if (\n typeof msg !== \"object\" || msg === null ||\n !(\"role\" in msg) || !(\"content\" in msg) ||\n (msg.role !== \"user\" && msg.role !== \"assistant\") ||\n typeof msg.content !== \"string\"\n ) {\n return json(\n {\n error:\n `Invalid message at index ${i}. Each message must have role \"user\" or \"assistant\" and string content.`,\n },\n 400,\n cors,\n );\n }\n }\n\n // ── Agent loop (server-controlled, max 5 iterations) ──────────────────────\n // Model, max_tokens, system prompt, and tools are all hardcoded here.\n // The client has no way to override them. On each iteration we call\n // the API; if Claude requests a tool (stop_reason \"tool_use\") we\n // execute it, append the results, and loop. If stop_reason is anything\n // else we extract the text and return it. The loop is capped so a\n // runaway agent can't burn through your token budget.\n const apiKey = Deno.env.get(\"ANTHROPIC_API_KEY\");\n if (!apiKey) {\n return json({ error: \"Server misconfiguration\" }, 500, cors);\n }\n\n // Working copy — the loop will append assistant turns and tool_result\n // messages to this array. Client messages (validated above) all have\n // string content, which is fine for the first call.\n const conversation: APIMessage[] = messages as APIMessage[];\n\n for (let iteration = 0; iteration < MAX_LOOP_ITERATIONS; iteration++) {\n const resp = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-api-key\": apiKey,\n \"anthropic-version\": \"2023-06-01\",\n },\n body: JSON.stringify({\n model: MODEL,\n max_tokens: MAX_TOKENS,\n system: SYSTEM_PROMPT,\n tools: TOOLS,\n messages: conversation,\n }),\n });\n\n if (!resp.ok) {\n const errText = await resp.text();\n console.error(\"Anthropic API error:\", resp.status, errText);\n return json(\n { error: \"The assistant is unavailable. Please try again later.\" },\n 502,\n cors,\n );\n }\n\n const data: {\n stop_reason: string;\n content: ContentBlock[];\n } = await resp.json();\n\n // ── If Claude didn't request a tool, extract text and return ──────────\n if (data.stop_reason !== \"tool_use\") {\n const text = data.content\n .filter((b) => b.type === \"text\")\n .map((b) => (b as { text: string }).text)\n .join(\"\") ?? \"\";\n\n return json({ text }, 200, cors);\n }\n\n // ── Tool requested: append the assistant's full response, then ────────\n // execute every tool_use block and collect results into a single\n // user message containing tool_result blocks.\n conversation.push({ role: \"assistant\", content: data.content });\n\n const toolResults: ContentBlock[] = [];\n for (const block of data.content) {\n if (block.type !== \"tool_use\") continue;\n const tu = block as {\n id: string;\n name: string;\n input: Record;\n };\n const result = await executeTool(tu.name, tu.input);\n toolResults.push({\n type: \"tool_result\",\n tool_use_id: tu.id,\n content: result,\n });\n }\n\n conversation.push({ role: \"user\", content: toolResults });\n }\n\n // ── Guardrail 8: Loop cap exhausted ──────────────────────────────────────\n // If we hit MAX_LOOP_ITERATIONS the agent kept requesting tools without\n // finishing. Return an error instead of looping forever.\n return json(\n { error: \"The assistant took too long to respond. Please try again.\" },\n 502,\n cors,\n );\n};\n","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1783802026161],"children",[],[35],"6a8d1392-98b6-48c7-9093-446719b2d079",["D",1783798682978],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Proxy endpoint that passes through requests to the Anthropic API","imageUrl","userId","ff7cbab6-a607-4ac0-a75e-a76a6337e00e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f52af-5965-7682-b9fa-54c06808c355","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_116":112},"org",{"_11":12,"_109":110,"_111":112,"_71":72,"_113":114,"_115":53},"branch",{"_17":42,"_13":16,"_33":40,"_101":61,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","mg5143","avatar","https://avatars.githubusercontent.com/u/205786349?v=4","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":150,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":151,"_96":152,"_98":153,"_100":53},[147],"files",[147],"counts",{"_137":78,"_138":139,"_140":78,"_31":141,"_142":143},[135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":136},[35],"pulls","branches",1,"forks",{"_144":139,"_146":78},"connections",{"_144":78,"_145":78},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":148,"_18":149},[],[35],["D",1783798682978],{"_11":12,"_116":112},{"_11":12,"_109":110,"_111":112,"_71":72,"_113":114,"_115":53},{"_17":42,"_13":16,"_33":40,"_101":61,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"ctx",{"_94":-5,"_132":187,"_188":189,"_190":191,"_192":53,"_193":53,"_194":53,"_195":44,"_196":-5,"_197":-7,"_198":-7,"_199":78,"_200":53,"_201":53,"_202":-5,"_203":53,"_204":53,"_205":53,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":16,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code