[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_145":146,"_147":148},"routes/_app.x.$handle.$name",{"_16":17,"_20":21,"_85":67,"_86":87,"_65":-7,"_88":-5,"_13":89,"_90":91,"_11":92,"_93":94,"_95":96,"_97":-5,"_98":-5,"_99":-5,"_100":26,"_101":102,"_103":38,"_104":-5,"_105":-5,"_106":107},"routes/_app.x.$handle.$name.search.$(branch)",{"_11":12,"_13":14,"_15":-5,"_16":17},"files",[],"project",{"_18":19,"_20":21,"_22":23,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":50,"_52":53,"_54":53,"_55":53,"_56":50,"_57":50,"_58":59,"_60":61,"_62":63,"_64":26},"query","handle","datacraftr","id","6a8d1392-98b6-48c7-9093-446719b2d079","name","anthropic-proxy","createdAt",["D",1783798682978],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","Proxy endpoint that passes through requests to the Anthropic API","imageUrl","userId","ff7cbab6-a607-4ac0-a75e-a76a6337e00e","pinnedFileId","0a2cf936-7d60-11f1-bb7e-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f52af-5965-7682-b9fa-54c06808c355","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_16":17,"_84":80},"org",{"_16":17,"_77":78,"_79":80,"_33":34,"_81":82,"_83":26},"branch",{"_65":66,"_20":67,"_18":68,"_69":19,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":21,"_76":17},"isOwned","version",12,"main","eadede4f-870c-422c-b0ee-7e145d518103","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","mg5143","avatar","https://avatars.githubusercontent.com/u/205786349?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_18":19,"_20":21,"_22":141,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":50,"_52":53,"_54":53,"_55":53,"_56":50,"_57":50,"_58":142,"_60":143,"_62":144,"_64":26},"tree",[136],[136],"counts",{"_125":42,"_126":127,"_128":42,"_129":130,"_131":132},"contents",[108],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_18":109,"_20":110,"_111":36,"_112":-5,"_113":68,"_114":66,"_115":38,"_22":116,"_65":117,"_118":119,"_120":121,"_122":26,"_123":-5,"_86":124},"e4e204ff-b2e7-4445-92c9-0fb175ad06b4","main.ts","fileId","parentId","branchId","branchVersion","latest",["D",1783802026161],11,"fileType","http","content","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n// ─── Config ──────────────────────────────────────────────────────────────────\n\n// ✏️ Paste your system prompt here\nconst SYSTEM_PROMPT = \"You are a helpful assistant.\";\n\nconst MODEL = \"claude-haiku-4-5-20251001\";\nconst MAX_TOKENS = 1024;\nconst MAX_MESSAGES = 20;\nconst MAX_LOOP_ITERATIONS = 5; // cap on agent loop iterations\nconst RATE_LIMIT = 20; // requests per IP per hour\nconst RATE_LIMIT_WINDOW_MS = 3600_000; // 1 hour\n\nconst ALLOWED_ORIGINS = [\n \"http://localhost:8000\",\n \"https://datacraftr.github.io\",\n];\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\nfunction corsHeaders(origin: string | null) {\n const allowed = origin && ALLOWED_ORIGINS.includes(origin);\n return {\n \"Access-Control-Allow-Origin\": allowed ? origin! : \"\",\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"content-type\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\n\nfunction json(\n body: unknown,\n status: number,\n extra: Record = {},\n): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...extra },\n });\n}\n\n// ─── Rate limiter (blob-backed, 20 req / IP / hour) ──────────────────────────\n\nasync function checkRateLimit(ip: string): Promise {\n const key = `ratelimit:${ip}`;\n const now = Date.now();\n const timestamps = (await blob.getJSON(key)) ?? [];\n // Drop entries older than the window\n const recent = timestamps.filter((ts) => now - ts < RATE_LIMIT_WINDOW_MS);\n if (recent.length >= RATE_LIMIT) {\n await blob.setJSON(key, recent); // persist cleanup\n return false;\n }\n recent.push(now);\n await blob.setJSON(key, recent);\n return true;\n}\n\n// ─── Types ───────────────────────────────────────────────────────────────────\n\n// Content blocks used inside the agent loop. The client only ever sends\n// plain strings, but Anthropic's tool-use API requires structured blocks.\n\ntype ContentBlock =\n | { type: \"text\"; text: string }\n | { type: \"tool_use\"; id: string; name: string; input: Record }\n | { type: \"tool_result\"; tool_use_id: string; content: string };\n\ntype APIMessage = {\n role: \"user\" | \"assistant\";\n content: string | ContentBlock[];\n};\n\n// ─── Tool definition ─────────────────────────────────────────────────────────\n\nconst TOOLS = [\n {\n name: \"send_message_to_mikell\",\n description:\n \"Send a message to Mikell on behalf of a site visitor. Use this when a visitor asks you to relay information, pass along a note, or contact Mikell for them.\",\n input_schema: {\n type: \"object\" as const,\n properties: {\n name: {\n type: \"string\",\n description: \"The name of the person sending the message.\",\n },\n email: {\n type: \"string\",\n description: \"The email address to reply to.\",\n },\n message: {\n type: \"string\",\n description: \"The message content to send to Mikell.\",\n },\n },\n required: [\"name\", \"email\", \"message\"],\n },\n },\n];\n\n// ─── Tool execution ──────────────────────────────────────────────────────────\n\nasync function executeTool(\n name: string,\n input: Record,\n): Promise {\n if (name === \"send_message_to_mikell\") {\n // TODO: wire up real email delivery later\n console.log(\"send_message_to_mikell:\", input);\n return `Message received from ${input.name} (${input.email}). Mikell will get back to you soon.`;\n }\n return `Unknown tool: ${name}`;\n}\n\n// ─── Handler ─────────────────────────────────────────────────────────────────\n\nexport default async (req: Request): Promise => {\n const origin = req.headers.get(\"Origin\");\n const cors = corsHeaders(origin);\n\n // ── Guardrail 1: CORS preflight ──────────────────────────────────────────\n // Browsers send OPTIONS before cross-origin POSTs. Must come first,\n // must return 2xx, must carry the CORS headers.\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: cors });\n }\n\n // ── Guardrail 2: POST only ───────────────────────────────────────────────\n // No GET, no PUT, no DELETE — the only thing this endpoint does is\n // accept a chat message and forward it to Anthropic.\n if (req.method !== \"POST\") {\n return new Response(\"Method not allowed\", { status: 405 });\n }\n\n // ── Guardrail 3: Origin allowlist ────────────────────────────────────────\n // The URL will be visible in the page source. This check ensures only\n // your portfolio site (and localhost during dev) can call it.\n if (!origin || !ALLOWED_ORIGINS.includes(origin)) {\n return json({ error: \"Forbidden\" }, 403);\n }\n\n // ── Guardrail 4: Rate limiting by IP ─────────────────────────────────────\n // 20 requests per IP per hour, tracked in blob storage. Prevents\n // abuse even from someone who spoofs an allowed Origin header.\n const ip =\n req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ?? \"unknown\";\n if (!(await checkRateLimit(ip))) {\n return json(\n { error: \"Rate limit exceeded. Try again later.\" },\n 429,\n { ...cors, \"Retry-After\": \"3600\" },\n );\n }\n\n // ── Guardrail 5: Body must be exactly {\"messages\": [...]} ────────────────\n // The client cannot set model, max_tokens, system, tools, or any other\n // Anthropic parameter — those are all hardcoded below.\n let body: unknown;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"Invalid JSON\" }, 400, cors);\n }\n\n if (\n typeof body !== \"object\" || body === null || Array.isArray(body) ||\n Object.keys(body).length !== 1 || !(\"messages\" in body)\n ) {\n return json(\n { error: 'Body must be exactly {\"messages\": [...]}' },\n 400,\n cors,\n );\n }\n\n const messages = (body as { messages: unknown }).messages;\n\n // ── Guardrail 6: Validate messages array ─────────────────────────────────\n // Each message must have role \"user\" or \"assistant\" and string content.\n // Rejects tool messages, image blocks, or anything unexpected.\n if (!Array.isArray(messages) || messages.length === 0) {\n return json(\n { error: \"messages must be a non-empty array\" },\n 400,\n cors,\n );\n }\n\n // ── Guardrail 7: Cap conversation length ─────────────────────────────────\n // Prevents excessively long conversations from burning through your\n // token budget.\n if (messages.length > MAX_MESSAGES) {\n return json(\n { error: `Too many messages. Max ${MAX_MESSAGES}.` },\n 400,\n cors,\n );\n }\n\n for (let i = 0; i < messages.length; i++) {\n const msg = messages[i];\n if (\n typeof msg !== \"object\" || msg === null ||\n !(\"role\" in msg) || !(\"content\" in msg) ||\n (msg.role !== \"user\" && msg.role !== \"assistant\") ||\n typeof msg.content !== \"string\"\n ) {\n return json(\n {\n error:\n `Invalid message at index ${i}. Each message must have role \"user\" or \"assistant\" and string content.`,\n },\n 400,\n cors,\n );\n }\n }\n\n // ── Agent loop (server-controlled, max 5 iterations) ──────────────────────\n // Model, max_tokens, system prompt, and tools are all hardcoded here.\n // The client has no way to override them. On each iteration we call\n // the API; if Claude requests a tool (stop_reason \"tool_use\") we\n // execute it, append the results, and loop. If stop_reason is anything\n // else we extract the text and return it. The loop is capped so a\n // runaway agent can't burn through your token budget.\n const apiKey = Deno.env.get(\"ANTHROPIC_API_KEY\");\n if (!apiKey) {\n return json({ error: \"Server misconfiguration\" }, 500, cors);\n }\n\n // Working copy — the loop will append assistant turns and tool_result\n // messages to this array. Client messages (validated above) all have\n // string content, which is fine for the first call.\n const conversation: APIMessage[] = messages as APIMessage[];\n\n for (let iteration = 0; iteration < MAX_LOOP_ITERATIONS; iteration++) {\n const resp = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-api-key\": apiKey,\n \"anthropic-version\": \"2023-06-01\",\n },\n body: JSON.stringify({\n model: MODEL,\n max_tokens: MAX_TOKENS,\n system: SYSTEM_PROMPT,\n tools: TOOLS,\n messages: conversation,\n }),\n });\n\n if (!resp.ok) {\n const errText = await resp.text();\n console.error(\"Anthropic API error:\", resp.status, errText);\n return json(\n { error: \"The assistant is unavailable. Please try again later.\" },\n 502,\n cors,\n );\n }\n\n const data: {\n stop_reason: string;\n content: ContentBlock[];\n } = await resp.json();\n\n // ── If Claude didn't request a tool, extract text and return ──────────\n if (data.stop_reason !== \"tool_use\") {\n const text = data.content\n .filter((b) => b.type === \"text\")\n .map((b) => (b as { text: string }).text)\n .join(\"\") ?? \"\";\n\n return json({ text }, 200, cors);\n }\n\n // ── Tool requested: append the assistant's full response, then ────────\n // execute every tool_use block and collect results into a single\n // user message containing tool_result blocks.\n conversation.push({ role: \"assistant\", content: data.content });\n\n const toolResults: ContentBlock[] = [];\n for (const block of data.content) {\n if (block.type !== \"tool_use\") continue;\n const tu = block as {\n id: string;\n name: string;\n input: Record;\n };\n const result = await executeTool(tu.name, tu.input);\n toolResults.push({\n type: \"tool_result\",\n tool_use_id: tu.id,\n content: result,\n });\n }\n\n conversation.push({ role: \"user\", content: toolResults });\n }\n\n // ── Guardrail 8: Loop cap exhausted ──────────────────────────────────────\n // If we hit MAX_LOOP_ITERATIONS the agent kept requesting tools without\n // finishing. Return an error instead of looping forever.\n return json(\n { error: \"The assistant took too long to respond. Please try again.\" },\n 502,\n cors,\n );\n};\n","deleted","label",[110],"pulls","branches",1,"forks","envVars",{"_133":127,"_135":42},"connections",{"_133":42,"_134":42},"count","unfilledCount","emptyCount",{"_18":109,"_20":110,"_111":36,"_112":-5,"_113":68,"_114":66,"_115":38,"_22":137,"_65":117,"_118":119,"_120":121,"_122":26,"_123":-5,"_138":139,"_86":140},["D",1783802026161],"children",[],[110],["D",1783798682978],{"_16":17,"_84":80},{"_16":17,"_77":78,"_79":80,"_33":34,"_81":82,"_83":26},{"_65":66,"_20":67,"_18":68,"_69":19,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":21,"_76":17},"ctx",{"_58":-5,"_105":178,"_179":180,"_181":182,"_183":26,"_184":26,"_185":26,"_186":38,"_187":-5,"_188":-7,"_189":-7,"_190":42,"_191":26,"_192":26,"_193":-5,"_194":26,"_195":26,"_196":26,"_197":-5},"ENV",{"_149":150,"_151":152,"_153":67,"_154":155,"_156":157,"_158":159,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Search