[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_162":163,"_164":165},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":53,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",50,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","2d58eaa0-9fbb-11f1-9056-1607ee4eb77e","name","fileType","http","content","// ============================================================\n// 🔥 ROAST ME - Val.town Endpoint (FINAL PRODUCTION READY)\n// ============================================================\n// Required secrets: GROQ_API_KEY, TURNSTILE_SECRET_KEY\n// Optional secret: DEV_MODE = \"true\" (allows ANY origin — for\n// testing on CodePen/localhost. Remove/unset before real launch.)\n// ============================================================\n\n// ============================================================\n// CONFIGURATION\n// ============================================================\nconst CONFIG = {\n MAX_REQUEST_BODY: 5 * 1024 * 1024, // 5MB total request size\n MAX_IMAGE_BYTES: 4 * 1024 * 1024, // 4MB decoded\n DAILY_LIMIT: 10,\n BURST_LIMIT: 3,\n BURST_WINDOW: 5 * 60 * 1000, // 5 minutes\n IP_DAILY_LIMIT: 50, // IP-based limit to prevent multi-account abuse\n IP_BURST_LIMIT: 10, // IP-based burst limit\n REQUEST_TIMEOUT: 15000, // 15 seconds\n GLOBAL_DAILY_LIMIT: 1000, // Global API usage cap\n ALLOWED_INTENSITIES: [\"Mild\", \"Medium\", \"Savage\"] as const,\n\n // ⚠️ UPDATE THIS when you have a real production domain.\n // Exact-match origins. CodePen's actual preview iframe uses a\n // random subdomain per session (e.g. es-d-XXXX.codepen.dev), so\n // that's matched separately below by pattern, not listed here.\n ALLOWED_ORIGINS: [\n \"https://your-frontend-domain.com\",\n \"https://your-frontend-domain.vercel.app\",\n \"http://localhost:3000\", // local dev\n \"https://codepen.io\",\n \"https://cdpn.io\",\n ],\n // Origins matched by pattern instead of exact string — for\n // platforms (like CodePen) that serve previews from a different\n // random subdomain every time.\n ALLOWED_ORIGIN_PATTERNS: [\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.dev$/i,\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.io$/i,\n ],\n SESSION_COOKIE_NAME: \"roast_session\",\n SESSION_LIFETIME: 86400, // 24 hours in seconds\n};\n\n// DEV_MODE: set this Val Town env var to \"true\" while testing on\n// CodePen so ANY origin is accepted. Delete/unset it before you\n// ship the real app — leaving it on defeats the whole point of\n// the origin allowlist.\nconst DEV_MODE = Deno.env.get(\"DEV_MODE\") === \"true\";\n\n// ============================================================\n// CORS WITH PROPER CREDENTIALS SUPPORT\n// ============================================================\nfunction isOriginAllowed(origin: string | null): boolean {\n if (DEV_MODE) return true;\n if (!origin) return false;\n if (CONFIG.ALLOWED_ORIGINS.includes(origin)) return true;\n return CONFIG.ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));\n}\n\nfunction getCorsHeaders(origin: string | null): Record {\n const isAllowed = isOriginAllowed(origin);\n\n if (!isAllowed || !origin) {\n return {\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n };\n }\n\n return {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n \"Access-Control-Allow-Credentials\": \"true\", // Required for cookies\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\n\n// ============================================================\n// REVISION 3: INDEPENDENT IP-BASED LIMITS\n// ============================================================\nfunction getTrustedIP(req: Request): string {\n const cfConnectingIP = req.headers.get(\"cf-connecting-ip\");\n if (cfConnectingIP) return cfConnectingIP;\n\n const vercelForwarded = req.headers.get(\"x-vercel-forwarded-for\");\n if (vercelForwarded) return vercelForwarded.split(\",\")[0].trim();\n\n const flyClientIP = req.headers.get(\"fly-client-ip\");\n if (flyClientIP) return flyClientIP;\n\n const forwarded = req.headers.get(\"x-forwarded-for\");\n if (forwarded) {\n const via = req.headers.get(\"via\") || \"\";\n const host = req.headers.get(\"host\") || \"\";\n if (via.includes(\"cloudflare\") || host.includes(\"cloudflare\")) {\n return forwarded.split(\",\")[0].trim();\n }\n }\n\n return req.headers.get(\"x-real-ip\") || \"unknown\";\n}\n\n// ============================================================\n// REVISION 1: FIX SESSION ID LENGTH\n// ============================================================\nfunction getOrCreateSession(\n req: Request,\n): { sessionId: string; isNew: boolean } {\n const cookieHeader = req.headers.get(\"cookie\") || \"\";\n const cookies = cookieHeader.split(\";\").reduce((acc, cookie) => {\n const [key, value] = cookie.trim().split(\"=\");\n if (key && value) acc[key] = value;\n return acc;\n }, {} as Record);\n\n let sessionId = cookies[CONFIG.SESSION_COOKIE_NAME];\n\n if (sessionId && /^[a-zA-Z0-9]{32,64}$/.test(sessionId)) {\n return { sessionId, isNew: false };\n }\n\n const timestamp = Date.now().toString(36);\n const random1 = Math.random().toString(36).substring(2, 15);\n const random2 = Math.random().toString(36).substring(2, 15);\n const random3 = Math.random().toString(36).substring(2, 15);\n\n const raw = `${timestamp}${random1}${random2}${random3}`;\n\n let hash = \"\";\n for (let i = 0; i < raw.length; i++) {\n const char = raw.charCodeAt(i);\n const hex = (char & 0xFF).toString(16).padStart(2, \"0\");\n hash += hex;\n }\n\n while (hash.length < 64) {\n hash += Math.random().toString(36).substring(2, 10);\n }\n sessionId = hash.substring(0, 64);\n\n return { sessionId, isNew: true };\n}\n\n// ============================================================\n// REVISION 6: IN-MEMORY RATE LIMITING (Deno.openKv is NOT\n// available on Val.town's runtime — it's a Deno Deploy-only API.\n// This uses a plain module-level Map instead. Trade-off: counts\n// reset if the val restarts/redeploys, and won't be shared across\n// multiple concurrent instances if Val.town ever scales this val\n// horizontally. For an app this size, that's an acceptable\n// trade-off for something that actually works without extra setup.\n// ============================================================\ntype LimitBucket = { timestamps: number[] };\nconst rateLimitStore = new Map();\n\n// Periodically clean out old entries so the Map doesn't grow forever.\n// Runs at most once per call, cheap no-op otherwise.\nlet lastCleanup = 0;\nfunction cleanupStoreIfNeeded() {\n const now = Date.now();\n if (now - lastCleanup < 10 * 60 * 1000) return; // at most every 10 min\n lastCleanup = now;\n const maxWindow = 24 * 60 * 60 * 1000;\n for (const [key, bucket] of rateLimitStore.entries()) {\n bucket.timestamps = bucket.timestamps.filter((t) => now - t < maxWindow);\n if (bucket.timestamps.length === 0) rateLimitStore.delete(key);\n }\n}\n\nfunction incrementAllLimits(\n userId: string,\n ip: string,\n): {\n success: boolean;\n dailyCount?: number;\n burstCount?: number;\n ipDailyCount?: number;\n ipBurstCount?: number;\n error?: string;\n errorType?: string;\n} {\n cleanupStoreIfNeeded();\n\n const now = Date.now();\n const limits = [\n {\n key: `daily:${userId}`,\n limit: CONFIG.DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"daily\",\n field: \"dailyCount\",\n },\n {\n key: `burst:${userId}`,\n limit: CONFIG.BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"burst\",\n field: \"burstCount\",\n },\n {\n key: `ip_daily:${ip}`,\n limit: CONFIG.IP_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"ip_daily\",\n field: \"ipDailyCount\",\n },\n {\n key: `ip_burst:${ip}`,\n limit: CONFIG.IP_BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"ip_burst\",\n field: \"ipBurstCount\",\n },\n {\n key: \"global\",\n limit: CONFIG.GLOBAL_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"global\",\n field: null as string | null,\n },\n ];\n\n // Read + filter each bucket first, check all limits before writing\n // anything, so a rejected request doesn't partially increment.\n const reads = limits.map((limit) => {\n const bucket = rateLimitStore.get(limit.key) || { timestamps: [] };\n const cutoff = now - limit.windowMs;\n const validTimestamps = bucket.timestamps.filter((t) => t > cutoff);\n return { ...limit, validTimestamps };\n });\n\n for (const read of reads) {\n if (read.validTimestamps.length >= read.limit) {\n return {\n success: false,\n error: `${read.name}_limit_exceeded`,\n errorType: read.name,\n };\n }\n }\n\n const result: any = { success: true };\n for (const read of reads) {\n const newTimestamps = [...read.validTimestamps, now].slice(-100);\n rateLimitStore.set(read.key, { timestamps: newTimestamps });\n if (read.field) {\n result[read.field] = newTimestamps.length;\n }\n }\n\n return result;\n}\n\n// ============================================================\n// REVISION 4: TURNSTILE VALIDATION (skipped automatically in DEV_MODE\n// if no token is sent, so you can test on CodePen without wiring up\n// Turnstile widget there. Still mandatory once DEV_MODE is off.)\n// ============================================================\nasync function validateTurnstile(\n token: string | undefined,\n ip: string,\n): Promise {\n // DEV_MODE: accept either no token, or the app's known dev\n // placeholder token ('dev-mode-skip'), without calling Cloudflare.\n if (DEV_MODE && (!token || token === \"dev-mode-skip\")) {\n console.warn(\"DEV_MODE: skipping real Turnstile check\");\n return true;\n }\n\n const secretKey = Deno.env.get(\"TURNSTILE_SECRET_KEY\");\n\n if (!secretKey) {\n console.error(\"TURNSTILE_SECRET_KEY is required in production\");\n return false;\n }\n\n if (!token) return false;\n\n try {\n const response = await fetch(\n \"https://challenges.cloudflare.com/turnstile/v0/siteverify\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n secret: secretKey,\n response: token,\n remoteip: ip,\n }),\n },\n );\n\n const data = await response.json();\n return data.success === true;\n } catch (error) {\n console.error(\"Turnstile validation error:\", error);\n return false;\n }\n}\n\n// ============================================================\n// STREAM-BASED REQUEST SIZE ENFORCEMENT\n// ============================================================\nasync function readBodyWithLimit(req: Request, maxSize: number): Promise {\n const reader = req.body?.getReader();\n if (!reader) {\n throw new Error(\"No request body\");\n }\n\n let received = 0;\n const chunks: Uint8Array[] = [];\n\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n received += value.length;\n if (received > maxSize) {\n reader.cancel();\n throw new Error(\"Request body too large\");\n }\n\n chunks.push(value);\n }\n } finally {\n reader.releaseLock();\n }\n\n const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);\n const buffer = new Uint8Array(totalLength);\n let offset = 0;\n for (const chunk of chunks) {\n buffer.set(chunk, offset);\n offset += chunk.length;\n }\n\n const text = new TextDecoder().decode(buffer);\n return JSON.parse(text);\n}\n\n// ============================================================\n// COMPLETE IMAGE VALIDATION\n// ============================================================\nfunction validateImage(base64Data: string): {\n valid: boolean;\n mimeType?: string;\n error?: string;\n} {\n const approxBytes = Math.floor((base64Data.length * 3) / 4);\n if (approxBytes > CONFIG.MAX_IMAGE_BYTES) {\n return { valid: false, error: \"Image too large\" };\n }\n if (approxBytes < 100) {\n return { valid: false, error: \"Image too small\" };\n }\n\n if (!/^[A-Za-z0-9+/]+=*$/.test(base64Data.slice(0, 200))) {\n return { valid: false, error: \"Invalid image format\" };\n }\n\n try {\n const binaryString = atob(base64Data.slice(0, 100));\n const bytes = new Uint8Array(binaryString.length);\n for (let i = 0; i < binaryString.length; i++) {\n bytes[i] = binaryString.charCodeAt(i);\n }\n\n const magic = Array.from(bytes.slice(0, 12))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n if (\n magic.startsWith(\"ffd8ffe0\") || magic.startsWith(\"ffd8ffe1\") ||\n magic.startsWith(\"ffd8ffe2\") || magic.startsWith(\"ffd8ffdb\") ||\n magic.startsWith(\"ffd8ffc0\") || magic.startsWith(\"ffd8ffc4\")\n ) {\n return { valid: true, mimeType: \"image/jpeg\" };\n }\n\n if (magic.startsWith(\"89504e470d0a1a0a\")) {\n return { valid: true, mimeType: \"image/png\" };\n }\n\n if (magic.startsWith(\"52494646\")) {\n const webpCheck = binaryString.slice(8, 12);\n if (webpCheck === \"WEBP\") {\n return { valid: true, mimeType: \"image/webp\" };\n }\n }\n\n return { valid: false, error: \"Unsupported image format\" };\n } catch {\n return { valid: false, error: \"Invalid image data\" };\n }\n}\n\n// ============================================================\n// STRICT SCHEMA VALIDATION\n// ============================================================\nfunction validateRequest(body: any): {\n valid: boolean;\n imageBase64?: string;\n intensity?: string;\n turnstileToken?: string;\n error?: string;\n} {\n if (!body || typeof body !== \"object\") {\n return { valid: false, error: \"Invalid request\" };\n }\n\n const { imageBase64, intensity, turnstileToken } = body;\n\n if (!imageBase64 || typeof imageBase64 !== \"string\") {\n return { valid: false, error: \"No image provided\" };\n }\n\n if (intensity && !CONFIG.ALLOWED_INTENSITIES.includes(intensity)) {\n return { valid: false, error: \"Invalid intensity level\" };\n }\n\n // Turnstile token is required unless DEV_MODE is on (see validateTurnstile)\n if (!DEV_MODE) {\n if (!turnstileToken || typeof turnstileToken !== \"string\") {\n return { valid: false, error: \"Verification token required\" };\n }\n }\n\n return {\n valid: true,\n imageBase64,\n intensity: intensity || \"Medium\",\n turnstileToken,\n };\n}\n\n// ============================================================\n// GROQ RESPONSE VALIDATION\n// ============================================================\nfunction validateGroqResponse(data: any): { valid: boolean; content?: string } {\n try {\n if (!data || typeof data !== \"object\") return { valid: false };\n\n const choices = data.choices;\n if (!Array.isArray(choices) || choices.length === 0) {\n return { valid: false };\n }\n\n const message = choices[0]?.message;\n if (!message || typeof message !== \"object\") return { valid: false };\n\n const content = message.content;\n if (typeof content !== \"string\" || content.trim().length === 0) {\n return { valid: false };\n }\n\n return { valid: true, content: content.trim() };\n } catch {\n return { valid: false };\n }\n}\n\n// ============================================================\n// POST-GENERATION CONTENT MODERATION\n// ============================================================\nconst BLOCKED_WORDS = [\n \"stupid\",\n \"dumb\",\n \"ugly\",\n \"fat\",\n \"loser\",\n \"hate\",\n \"idiot\",\n \"moron\",\n \"retard\",\n \"worthless\",\n \"trash\",\n \"garbage\",\n \"pathetic\",\n \"disgusting\",\n \"kill\",\n \"die\",\n \"death\",\n \"suicide\",\n \"murder\",\n \"terrorist\",\n \"racist\",\n \"nazi\",\n \"pedophile\",\n \"rapist\",\n \"abuse\",\n \"trauma\",\n \"mental illness\",\n];\n\nconst FALLBACK_ROASTS = [\n \"You're too cool for a roast right now. Try again! 😎\",\n \"AI is speechless... but your outfit isn't! 😂\",\n \"You look like you'd survive a zombie apocalypse by being too fast! 🏃\",\n \"Your style is so unique, even AI can't roast it! ✨\",\n \"You're radiating main character energy! 🌟\",\n \"Looking sharp! Even AI can't find a flaw! 👔\",\n \"You're serving looks that AI can't compute! 💫\",\n \"Too stylish to roast! Save some for the rest of us! 🔥\",\n];\n\nfunction moderateContent(text: string): string {\n const lowerText = text.toLowerCase();\n const hasBlocked = BLOCKED_WORDS.some((word) => lowerText.includes(word));\n\n if (hasBlocked) {\n return FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n\n text = text.replace(/[^a-zA-Z0-9\\s.,!?'\"\\-()]/g, \"\");\n\n if (text.length > 300) {\n text = text.slice(0, 297) + \"...\";\n }\n\n return text;\n}\n\n// ============================================================\n// SERVER-CONTROLLED PROMPTS + SAFETY RULES\n// ============================================================\nconst INTENSITY_PROMPTS: Record = {\n Mild:\n \"Give a gentle, playful, and lighthearted roast. Keep it funny but nice. No harsh words. Focus on style, expression, or background. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Medium:\n \"Give a funny, sarcastic, and witty roast. Be humorous but not too harsh. Focus on outfit, expression, background, or pose. Keep it clever and creative. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Savage:\n \"Give a sharp, witty, and clever roast. Be bold and creative but keep it playful. Focus on style, pose, background, or expression. Make it funny and clever, not offensive. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n};\n\nconst SAFETY_RULES = [\n \"Never mention weight, body size, or physical appearance beyond clothing/style.\",\n \"Never mention race, ethnicity, religion, or nationality.\",\n \"Never use profanity, slurs, or offensive language.\",\n \"Never mention disabilities, health conditions, or mental health.\",\n \"Never make threats, insults, or personal attacks.\",\n \"Never mention age or make age-related insults.\",\n \"Keep roasts playful, creative, and focused on style/expression/background.\",\n \"Maximum 2 sentences per roast.\",\n];\n\nfunction buildPrompt(intensity: string): string {\n const basePrompt = INTENSITY_PROMPTS[intensity] || INTENSITY_PROMPTS.Medium;\n const safetyPrompt = `IMPORTANT SAFETY RULES (must follow all):\n${SAFETY_RULES.map((rule, i) => `${i + 1}. ${rule}`).join(\"\\n\")}\n\nNow give a ${intensity} roast based on the image:`;\n\n return `${safetyPrompt}\\n\\n${basePrompt}`;\n}\n\n// ============================================================\n// MAIN HANDLER\n// ============================================================\nexport async function server(req: Request): Promise {\n const origin = req.headers.get(\"origin\");\n const corsHeaders = getCorsHeaders(origin);\n\n // Reject unapproved origins (skipped entirely in DEV_MODE)\n if (!isOriginAllowed(origin)) {\n // Note: since this origin is NOT allowed, getCorsHeaders() won't\n // include Access-Control-Allow-Origin here either — the browser\n // will still show a CORS-style error rather than surfacing this\n // JSON body. That's expected/correct: an origin we don't trust\n // shouldn't be told exactly why in a way it can act on. Use the\n // Val.town Logs panel to see this actual error during debugging\n // instead of the browser console.\n return new Response(\n JSON.stringify({\n error: \"Unauthorized origin\",\n receivedOrigin: origin,\n }),\n {\n status: 403,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: corsHeaders });\n }\n\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({ error: \"Method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n try {\n // ============================================================\n // 1. STREAM-BASED BODY SIZE ENFORCEMENT\n // ============================================================\n let body;\n try {\n body = await readBodyWithLimit(req, CONFIG.MAX_REQUEST_BODY);\n } catch (error) {\n if (error.message === \"Request body too large\") {\n return new Response(\n JSON.stringify({ error: \"Request too large\" }),\n {\n status: 413,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n throw error;\n }\n\n // ============================================================\n // 2. VALIDATE REQUEST SCHEMA\n // ============================================================\n const validation = validateRequest(body);\n if (!validation.valid) {\n return new Response(\n JSON.stringify({ error: validation.error }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 3. IMAGE VALIDATION\n // ============================================================\n const imageValidation = validateImage(validation.imageBase64!);\n if (!imageValidation.valid) {\n return new Response(\n JSON.stringify({ error: imageValidation.error }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 4. GET TRUSTED IP AND SESSION\n // ============================================================\n const trustedIP = getTrustedIP(req);\n const { sessionId, isNew } = getOrCreateSession(req);\n const userId = `${trustedIP}:${sessionId}`;\n\n // ============================================================\n // 5. TURNSTILE VALIDATION (auto-skipped in DEV_MODE w/o token)\n // ============================================================\n const isTurnstileValid = await validateTurnstile(\n validation.turnstileToken,\n trustedIP,\n );\n\n if (!isTurnstileValid) {\n return new Response(\n JSON.stringify({\n error: \"Verification failed. Please refresh and try again.\",\n refresh: true,\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 6. IN-MEMORY RATE LIMITING (no Deno.openKv — unsupported here)\n // ============================================================\n const limitResult = incrementAllLimits(userId, trustedIP);\n\n if (!limitResult.success) {\n const errorMessages: Record = {\n \"daily_limit_exceeded\": \"Daily limit reached. Come back tomorrow!\",\n \"burst_limit_exceeded\": \"Too many requests. Please wait a few minutes.\",\n \"ip_daily_limit_exceeded\": \"Too many requests from this network today.\",\n \"ip_burst_limit_exceeded\":\n \"Too many requests from this network. Please wait.\",\n \"global_limit_exceeded\":\n \"Service temporarily unavailable. Please try later.\",\n };\n\n const errorMsg = errorMessages[limitResult.errorType || \"\"] ||\n \"Rate limit exceeded\";\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n remaining: 0,\n limit: CONFIG.DAILY_LIMIT,\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 7. CALL GROQ API WITH TIMEOUT\n // ============================================================\n const groqKey = Deno.env.get(\"GROQ_API_KEY\");\n if (!groqKey) {\n console.error(\"GROQ_API_KEY not configured\");\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const prompt = buildPrompt(validation.intensity!);\n const temperature = validation.intensity === \"Mild\"\n ? 0.7\n : validation.intensity === \"Savage\"\n ? 0.95\n : 0.85;\n\n const mimeType = imageValidation.mimeType || \"image/jpeg\";\n const imageDataUrl = `data:${mimeType};base64,${validation.imageBase64}`;\n\n const controller = new AbortController();\n const timeoutId = setTimeout(\n () => controller.abort(),\n CONFIG.REQUEST_TIMEOUT,\n );\n\n let roastText: string;\n\n try {\n const groqResponse = await fetch(\n \"https://api.groq.com/openai/v1/chat/completions\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${groqKey}`,\n },\n body: JSON.stringify({\n model: \"qwen/qwen3.6-27b\",\n messages: [\n {\n role: \"user\",\n content: [\n { type: \"text\", text: prompt },\n { type: \"image_url\", image_url: { url: imageDataUrl } },\n ],\n },\n ],\n max_tokens: 100,\n temperature: temperature,\n // qwen3.6-27b is a reasoning model — without this it streams\n // its internal \"thinking\" as plain text into message.content\n // instead of just the final roast. \"hidden\" drops the\n // reasoning entirely and returns only the final answer.\n reasoning_format: \"hidden\",\n }),\n signal: controller.signal,\n },\n );\n\n clearTimeout(timeoutId);\n\n if (!groqResponse.ok) {\n let groqErrorBody = \"\";\n try {\n groqErrorBody = await groqResponse.text();\n } catch {\n // ignore\n }\n console.error(\n `Groq API error: ${groqResponse.status}`,\n groqErrorBody.slice(0, 1000),\n );\n\n // Groq's own rate limit (429) is different from our app being\n // broken — tell the user to wait rather than a generic error.\n if (groqResponse.status === 429) {\n return new Response(\n JSON.stringify({\n error:\n \"AI service is busy right now. Please wait a moment and try again.\",\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n return new Response(\n JSON.stringify({ error: \"AI service temporarily unavailable\" }),\n {\n status: groqResponse.status >= 500 ? 503 : 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const data = await groqResponse.json();\n\n const validated = validateGroqResponse(data);\n if (!validated.valid) {\n // Log the ACTUAL response body so we can see what shape Groq\n // sent back — \"invalid structure\" alone doesn't tell us why.\n console.error(\n \"Invalid Groq response structure. Raw response:\",\n JSON.stringify(data).slice(0, 1500),\n );\n return new Response(\n JSON.stringify({ error: \"Service error. Please try again.\" }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n roastText = validated.content || \"No roast generated.\";\n // Safety net: strip any reasoning trace that slips through\n // despite reasoning_format:\"hidden\" (e.g. ...\n // blocks, or a leading \"think ...\" preamble some models emit).\n roastText = roastText.replace(/[\\s\\S]*?<\\/think>/gi, \"\").trim();\n roastText = roastText.replace(/^think\\b[\\s\\S]*?(?=\\n\\n|$)/i, \"\").trim();\n roastText = roastText.replace(/^[\"']|[\"']$/g, \"\");\n if (!roastText) {\n roastText =\n FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n roastText = moderateContent(roastText);\n } catch (fetchError: any) {\n clearTimeout(timeoutId);\n\n if (fetchError.name === \"AbortError\") {\n console.error(\"Groq API request timeout\");\n return new Response(\n JSON.stringify({\n error: \"AI service took too long. Please try again.\",\n }),\n {\n status: 504,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n console.error(\"Groq API request failed:\", fetchError.message);\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 8. PROPER COOKIE/CORS CREDENTIALS SETUP\n // ============================================================\n const responseHeaders: Record = {\n \"Content-Type\": \"application/json\",\n ...corsHeaders,\n };\n\n if (isNew) {\n responseHeaders[\"Set-Cookie\"] =\n `${CONFIG.SESSION_COOKIE_NAME}=${sessionId}; ` +\n `Path=/; ` +\n `HttpOnly; ` +\n `Secure; ` +\n `SameSite=Strict; ` +\n `Max-Age=${CONFIG.SESSION_LIFETIME}`;\n }\n\n const remaining = CONFIG.DAILY_LIMIT - (limitResult.dailyCount || 1);\n\n return new Response(\n JSON.stringify({\n roast: roastText,\n remaining: Math.max(0, remaining),\n limit: CONFIG.DAILY_LIMIT,\n used: limitResult.dailyCount || 1,\n intensity: validation.intensity,\n }),\n { headers: responseHeaders },\n );\n } catch (error: any) {\n console.error(\"Request error:\", {\n name: error.name || \"Unknown\",\n message: error.message?.slice(0, 100) || \"No message\",\n });\n\n let status = 400;\n let errorMsg = \"Something went wrong. Please try again.\";\n\n if (error.message?.includes(\"JSON\") || error.message?.includes(\"parse\")) {\n status = 400;\n errorMsg = \"Invalid request format.\";\n } else if (error.message?.includes(\"timeout\")) {\n status = 504;\n errorMsg = \"Request timed out. Please try again.\";\n } else {\n status = 500;\n errorMsg = \"Server error. Please try again later.\";\n }\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n roast: \"Oops! Something went wrong. Give it another try! 😅\",\n }),\n {\n status: status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...getCorsHeaders(origin),\n },\n },\n );\n }\n}","// ============================================================\n// 🔥 ROAST ME - Val.town Endpoint (FINAL PRODUCTION READY)\n// ============================================================\n// Required secrets: GROQ_API_KEY, TURNSTILE_SECRET_KEY\n// Optional secret: DEV_MODE = \"true\" (allows ANY origin — for\n// testing on CodePen/localhost. Remove/unset before real launch.)\n// ============================================================\n\n// ============================================================\n// CONFIGURATION\n// ============================================================\nconst CONFIG = {\n MAX_REQUEST_BODY: 5 * 1024 * 1024, // 5MB total request size\n MAX_IMAGE_BYTES: 4 * 1024 * 1024, // 4MB decoded\n DAILY_LIMIT: 10,\n BURST_LIMIT: 3,\n BURST_WINDOW: 5 * 60 * 1000, // 5 minutes\n IP_DAILY_LIMIT: 50, // IP-based limit to prevent multi-account abuse\n IP_BURST_LIMIT: 10, // IP-based burst limit\n REQUEST_TIMEOUT: 15000, // 15 seconds\n GLOBAL_DAILY_LIMIT: 1000, // Global API usage cap\n ALLOWED_INTENSITIES: [\"Mild\", \"Medium\", \"Savage\"] as const,\n\n // ⚠️ UPDATE THIS when you have a real production domain.\n // Exact-match origins. CodePen's actual preview iframe uses a\n // random subdomain per session (e.g. es-d-XXXX.codepen.dev), so\n // that's matched separately below by pattern, not listed here.\n ALLOWED_ORIGINS: [\n \"https://your-frontend-domain.com\",\n \"https://your-frontend-domain.vercel.app\",\n \"http://localhost:3000\", // local dev\n \"https://codepen.io\",\n \"https://cdpn.io\",\n ],\n // Origins matched by pattern instead of exact string — for\n // platforms (like CodePen) that serve previews from a different\n // random subdomain every time.\n ALLOWED_ORIGIN_PATTERNS: [\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.dev$/i,\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.io$/i,\n ],\n SESSION_COOKIE_NAME: \"roast_session\",\n SESSION_LIFETIME: 86400, // 24 hours in seconds\n};\n\n// DEV_MODE: set this Val Town env var to \"true\" while testing on\n// CodePen so ANY origin is accepted. Delete/unset it before you\n// ship the real app — leaving it on defeats the whole point of\n// the origin allowlist.\nconst DEV_MODE = Deno.env.get(\"DEV_MODE\") === \"true\";\n\n// ============================================================\n// CORS WITH PROPER CREDENTIALS SUPPORT\n// ============================================================\nfunction isOriginAllowed(origin: string | null): boolean {\n if (DEV_MODE) return true;\n if (!origin) return false;\n if (CONFIG.ALLOWED_ORIGINS.includes(origin)) return true;\n return CONFIG.ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));\n}\n\nfunction getCorsHeaders(origin: string | null): Record {\n const isAllowed = isOriginAllowed(origin);\n\n if (!isAllowed || !origin) {\n return {\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n };\n }\n\n return {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n \"Access-Control-Allow-Credentials\": \"true\", // Required for cookies\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\n\n// ============================================================\n// REVISION 3: INDEPENDENT IP-BASED LIMITS\n// ============================================================\nfunction getTrustedIP(req: Request): string {\n const cfConnectingIP = req.headers.get(\"cf-connecting-ip\");\n if (cfConnectingIP) return cfConnectingIP;\n\n const vercelForwarded = req.headers.get(\"x-vercel-forwarded-for\");\n if (vercelForwarded) return vercelForwarded.split(\",\")[0].trim();\n\n const flyClientIP = req.headers.get(\"fly-client-ip\");\n if (flyClientIP) return flyClientIP;\n\n const forwarded = req.headers.get(\"x-forwarded-for\");\n if (forwarded) {\n const via = req.headers.get(\"via\") || \"\";\n const host = req.headers.get(\"host\") || \"\";\n if (via.includes(\"cloudflare\") || host.includes(\"cloudflare\")) {\n return forwarded.split(\",\")[0].trim();\n }\n }\n\n return req.headers.get(\"x-real-ip\") || \"unknown\";\n}\n\n// ============================================================\n// REVISION 1: FIX SESSION ID LENGTH\n// ============================================================\nfunction getOrCreateSession(\n req: Request,\n): { sessionId: string; isNew: boolean } {\n const cookieHeader = req.headers.get(\"cookie\") || \"\";\n const cookies = cookieHeader.split(\";\").reduce((acc, cookie) => {\n const [key, value] = cookie.trim().split(\"=\");\n if (key && value) acc[key] = value;\n return acc;\n }, {} as Record);\n\n let sessionId = cookies[CONFIG.SESSION_COOKIE_NAME];\n\n if (sessionId && /^[a-zA-Z0-9]{32,64}$/.test(sessionId)) {\n return { sessionId, isNew: false };\n }\n\n const timestamp = Date.now().toString(36);\n const random1 = Math.random().toString(36).substring(2, 15);\n const random2 = Math.random().toString(36).substring(2, 15);\n const random3 = Math.random().toString(36).substring(2, 15);\n\n const raw = `${timestamp}${random1}${random2}${random3}`;\n\n let hash = \"\";\n for (let i = 0; i < raw.length; i++) {\n const char = raw.charCodeAt(i);\n const hex = (char & 0xFF).toString(16).padStart(2, \"0\");\n hash += hex;\n }\n\n while (hash.length < 64) {\n hash += Math.random().toString(36).substring(2, 10);\n }\n sessionId = hash.substring(0, 64);\n\n return { sessionId, isNew: true };\n}\n\n// ============================================================\n// REVISION 6: IN-MEMORY RATE LIMITING (Deno.openKv is NOT\n// available on Val.town's runtime — it's a Deno Deploy-only API.\n// This uses a plain module-level Map instead. Trade-off: counts\n// reset if the val restarts/redeploys, and won't be shared across\n// multiple concurrent instances if Val.town ever scales this val\n// horizontally. For an app this size, that's an acceptable\n// trade-off for something that actually works without extra setup.\n// ============================================================\ntype LimitBucket = { timestamps: number[] };\nconst rateLimitStore = new Map();\n\n// Periodically clean out old entries so the Map doesn't grow forever.\n// Runs at most once per call, cheap no-op otherwise.\nlet lastCleanup = 0;\nfunction cleanupStoreIfNeeded() {\n const now = Date.now();\n if (now - lastCleanup < 10 * 60 * 1000) return; // at most every 10 min\n lastCleanup = now;\n const maxWindow = 24 * 60 * 60 * 1000;\n for (const [key, bucket] of rateLimitStore.entries()) {\n bucket.timestamps = bucket.timestamps.filter((t) => now - t < maxWindow);\n if (bucket.timestamps.length === 0) rateLimitStore.delete(key);\n }\n}\n\nfunction incrementAllLimits(\n userId: string,\n ip: string,\n): {\n success: boolean;\n dailyCount?: number;\n burstCount?: number;\n ipDailyCount?: number;\n ipBurstCount?: number;\n error?: string;\n errorType?: string;\n} {\n cleanupStoreIfNeeded();\n\n const now = Date.now();\n const limits = [\n {\n key: `daily:${userId}`,\n limit: CONFIG.DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"daily\",\n field: \"dailyCount\",\n },\n {\n key: `burst:${userId}`,\n limit: CONFIG.BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"burst\",\n field: \"burstCount\",\n },\n {\n key: `ip_daily:${ip}`,\n limit: CONFIG.IP_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"ip_daily\",\n field: \"ipDailyCount\",\n },\n {\n key: `ip_burst:${ip}`,\n limit: CONFIG.IP_BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"ip_burst\",\n field: \"ipBurstCount\",\n },\n {\n key: \"global\",\n limit: CONFIG.GLOBAL_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"global\",\n field: null as string | null,\n },\n ];\n\n // Read + filter each bucket first, check all limits before writing\n // anything, so a rejected request doesn't partially increment.\n const reads = limits.map((limit) => {\n const bucket = rateLimitStore.get(limit.key) || { timestamps: [] };\n const cutoff = now - limit.windowMs;\n const validTimestamps = bucket.timestamps.filter((t) => t > cutoff);\n return { ...limit, validTimestamps };\n });\n\n for (const read of reads) {\n if (read.validTimestamps.length >= read.limit) {\n return {\n success: false,\n error: `${read.name}_limit_exceeded`,\n errorType: read.name,\n };\n }\n }\n\n const result: any = { success: true };\n for (const read of reads) {\n const newTimestamps = [...read.validTimestamps, now].slice(-100);\n rateLimitStore.set(read.key, { timestamps: newTimestamps });\n if (read.field) {\n result[read.field] = newTimestamps.length;\n }\n }\n\n return result;\n}\n\n// ============================================================\n// REVISION 4: TURNSTILE VALIDATION (skipped automatically in DEV_MODE\n// if no token is sent, so you can test on CodePen without wiring up\n// Turnstile widget there. Still mandatory once DEV_MODE is off.)\n// ============================================================\nasync function validateTurnstile(\n token: string | undefined,\n ip: string,\n): Promise {\n // DEV_MODE: accept either no token, or the app's known dev\n // placeholder token ('dev-mode-skip'), without calling Cloudflare.\n if (DEV_MODE && (!token || token === \"dev-mode-skip\")) {\n console.warn(\"DEV_MODE: skipping real Turnstile check\");\n return true;\n }\n\n const secretKey = Deno.env.get(\"TURNSTILE_SECRET_KEY\");\n\n if (!secretKey) {\n console.error(\"TURNSTILE_SECRET_KEY is required in production\");\n return false;\n }\n\n if (!token) return false;\n\n try {\n const response = await fetch(\n \"https://challenges.cloudflare.com/turnstile/v0/siteverify\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n secret: secretKey,\n response: token,\n remoteip: ip,\n }),\n },\n );\n\n const data = await response.json();\n return data.success === true;\n } catch (error) {\n console.error(\"Turnstile validation error:\", error);\n return false;\n }\n}\n\n// ============================================================\n// STREAM-BASED REQUEST SIZE ENFORCEMENT\n// ============================================================\nasync function readBodyWithLimit(req: Request, maxSize: number): Promise {\n const reader = req.body?.getReader();\n if (!reader) {\n throw new Error(\"No request body\");\n }\n\n let received = 0;\n const chunks: Uint8Array[] = [];\n\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n received += value.length;\n if (received > maxSize) {\n reader.cancel();\n throw new Error(\"Request body too large\");\n }\n\n chunks.push(value);\n }\n } finally {\n reader.releaseLock();\n }\n\n const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);\n const buffer = new Uint8Array(totalLength);\n let offset = 0;\n for (const chunk of chunks) {\n buffer.set(chunk, offset);\n offset += chunk.length;\n }\n\n const text = new TextDecoder().decode(buffer);\n return JSON.parse(text);\n}\n\n// ============================================================\n// COMPLETE IMAGE VALIDATION\n// ============================================================\nfunction validateImage(base64Data: string): {\n valid: boolean;\n mimeType?: string;\n error?: string;\n} {\n const approxBytes = Math.floor((base64Data.length * 3) / 4);\n if (approxBytes > CONFIG.MAX_IMAGE_BYTES) {\n return { valid: false, error: \"Image too large\" };\n }\n if (approxBytes < 100) {\n return { valid: false, error: \"Image too small\" };\n }\n\n if (!/^[A-Za-z0-9+/]+=*$/.test(base64Data.slice(0, 200))) {\n return { valid: false, error: \"Invalid image format\" };\n }\n\n try {\n const binaryString = atob(base64Data.slice(0, 100));\n const bytes = new Uint8Array(binaryString.length);\n for (let i = 0; i < binaryString.length; i++) {\n bytes[i] = binaryString.charCodeAt(i);\n }\n\n const magic = Array.from(bytes.slice(0, 12))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n if (\n magic.startsWith(\"ffd8ffe0\") || magic.startsWith(\"ffd8ffe1\") ||\n magic.startsWith(\"ffd8ffe2\") || magic.startsWith(\"ffd8ffdb\") ||\n magic.startsWith(\"ffd8ffc0\") || magic.startsWith(\"ffd8ffc4\")\n ) {\n return { valid: true, mimeType: \"image/jpeg\" };\n }\n\n if (magic.startsWith(\"89504e470d0a1a0a\")) {\n return { valid: true, mimeType: \"image/png\" };\n }\n\n if (magic.startsWith(\"52494646\")) {\n const webpCheck = binaryString.slice(8, 12);\n if (webpCheck === \"WEBP\") {\n return { valid: true, mimeType: \"image/webp\" };\n }\n }\n\n return { valid: false, error: \"Unsupported image format\" };\n } catch {\n return { valid: false, error: \"Invalid image data\" };\n }\n}\n\n// ============================================================\n// STRICT SCHEMA VALIDATION\n// ============================================================\nfunction validateRequest(body: any): {\n valid: boolean;\n imageBase64?: string;\n intensity?: string;\n turnstileToken?: string;\n error?: string;\n} {\n if (!body || typeof body !== \"object\") {\n return { valid: false, error: \"Invalid request\" };\n }\n\n const { imageBase64, intensity, turnstileToken } = body;\n\n if (!imageBase64 || typeof imageBase64 !== \"string\") {\n return { valid: false, error: \"No image provided\" };\n }\n\n if (intensity && !CONFIG.ALLOWED_INTENSITIES.includes(intensity)) {\n return { valid: false, error: \"Invalid intensity level\" };\n }\n\n // Turnstile token is required unless DEV_MODE is on (see validateTurnstile)\n if (!DEV_MODE) {\n if (!turnstileToken || typeof turnstileToken !== \"string\") {\n return { valid: false, error: \"Verification token required\" };\n }\n }\n\n return {\n valid: true,\n imageBase64,\n intensity: intensity || \"Medium\",\n turnstileToken,\n };\n}\n\n// ============================================================\n// GROQ RESPONSE VALIDATION\n// ============================================================\nfunction validateGroqResponse(data: any): { valid: boolean; content?: string } {\n try {\n if (!data || typeof data !== \"object\") return { valid: false };\n\n const choices = data.choices;\n if (!Array.isArray(choices) || choices.length === 0) {\n return { valid: false };\n }\n\n const message = choices[0]?.message;\n if (!message || typeof message !== \"object\") return { valid: false };\n\n const content = message.content;\n if (typeof content !== \"string\" || content.trim().length === 0) {\n return { valid: false };\n }\n\n return { valid: true, content: content.trim() };\n } catch {\n return { valid: false };\n }\n}\n\n// ============================================================\n// POST-GENERATION CONTENT MODERATION\n// ============================================================\nconst BLOCKED_WORDS = [\n \"stupid\",\n \"dumb\",\n \"ugly\",\n \"fat\",\n \"loser\",\n \"hate\",\n \"idiot\",\n \"moron\",\n \"retard\",\n \"worthless\",\n \"trash\",\n \"garbage\",\n \"pathetic\",\n \"disgusting\",\n \"kill\",\n \"die\",\n \"death\",\n \"suicide\",\n \"murder\",\n \"terrorist\",\n \"racist\",\n \"nazi\",\n \"pedophile\",\n \"rapist\",\n \"abuse\",\n \"trauma\",\n \"mental illness\",\n];\n\nconst FALLBACK_ROASTS = [\n \"You're too cool for a roast right now. Try again! 😎\",\n \"AI is speechless... but your outfit isn't! 😂\",\n \"You look like you'd survive a zombie apocalypse by being too fast! 🏃\",\n \"Your style is so unique, even AI can't roast it! ✨\",\n \"You're radiating main character energy! 🌟\",\n \"Looking sharp! Even AI can't find a flaw! 👔\",\n \"You're serving looks that AI can't compute! 💫\",\n \"Too stylish to roast! Save some for the rest of us! 🔥\",\n];\n\nfunction moderateContent(text: string): string {\n const lowerText = text.toLowerCase();\n const hasBlocked = BLOCKED_WORDS.some((word) => lowerText.includes(word));\n\n if (hasBlocked) {\n return FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n\n text = text.replace(/[^a-zA-Z0-9\\s.,!?'\"\\-()]/g, \"\");\n\n if (text.length > 300) {\n text = text.slice(0, 297) + \"...\";\n }\n\n return text;\n}\n\n// ============================================================\n// SERVER-CONTROLLED PROMPTS + SAFETY RULES\n// ============================================================\nconst INTENSITY_PROMPTS: Record = {\n Mild:\n \"Give a gentle, playful, and lighthearted roast. Keep it funny but nice. No harsh words. Focus on style, expression, or background. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Medium:\n \"Give a funny, sarcastic, and witty roast. Be humorous but not too harsh. Focus on outfit, expression, background, or pose. Keep it clever and creative. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Savage:\n \"Give a sharp, witty, and clever roast. Be bold and creative but keep it playful. Focus on style, pose, background, or expression. Make it funny and clever, not offensive. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n};\n\nconst SAFETY_RULES = [\n \"Never mention weight, body size, or physical appearance beyond clothing/style.\",\n \"Never mention race, ethnicity, religion, or nationality.\",\n \"Never use profanity, slurs, or offensive language.\",\n \"Never mention disabilities, health conditions, or mental health.\",\n \"Never make threats, insults, or personal attacks.\",\n \"Never mention age or make age-related insults.\",\n \"Keep roasts playful, creative, and focused on style/expression/background.\",\n \"Maximum 2 sentences per roast.\",\n];\n\nfunction buildPrompt(intensity: string): string {\n const basePrompt = INTENSITY_PROMPTS[intensity] || INTENSITY_PROMPTS.Medium;\n const safetyPrompt = `IMPORTANT SAFETY RULES (must follow all):\n${SAFETY_RULES.map((rule, i) => `${i + 1}. ${rule}`).join(\"\\n\")}\n\nNow give a ${intensity} roast based on the image:`;\n\n return `${safetyPrompt}\\n\\n${basePrompt}`;\n}\n\n// ============================================================\n// MAIN HANDLER\n// ============================================================\nexport async function server(req: Request): Promise {\n const origin = req.headers.get(\"origin\");\n const corsHeaders = getCorsHeaders(origin);\n\n // Reject unapproved origins (skipped entirely in DEV_MODE)\n if (!isOriginAllowed(origin)) {\n // Note: since this origin is NOT allowed, getCorsHeaders() won't\n // include Access-Control-Allow-Origin here either — the browser\n // will still show a CORS-style error rather than surfacing this\n // JSON body. That's expected/correct: an origin we don't trust\n // shouldn't be told exactly why in a way it can act on. Use the\n // Val.town Logs panel to see this actual error during debugging\n // instead of the browser console.\n return new Response(\n JSON.stringify({\n error: \"Unauthorized origin\",\n receivedOrigin: origin,\n }),\n {\n status: 403,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: corsHeaders });\n }\n\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({ error: \"Method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n try {\n // ============================================================\n // 1. STREAM-BASED BODY SIZE ENFORCEMENT\n // ============================================================\n let body;\n try {\n body = await readBodyWithLimit(req, CONFIG.MAX_REQUEST_BODY);\n } catch (error) {\n if (error.message === \"Request body too large\") {\n return new Response(\n JSON.stringify({ error: \"Request too large\" }),\n {\n status: 413,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n throw error;\n }\n\n // ============================================================\n // 2. VALIDATE REQUEST SCHEMA\n // ============================================================\n const validation = validateRequest(body);\n if (!validation.valid) {\n return new Response(\n JSON.stringify({ error: validation.error }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 3. IMAGE VALIDATION\n // ============================================================\n const imageValidation = validateImage(validation.imageBase64!);\n if (!imageValidation.valid) {\n return new Response(\n JSON.stringify({ error: imageValidation.error }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 4. GET TRUSTED IP AND SESSION\n // ============================================================\n const trustedIP = getTrustedIP(req);\n const { sessionId, isNew } = getOrCreateSession(req);\n const userId = `${trustedIP}:${sessionId}`;\n\n // ============================================================\n // 5. TURNSTILE VALIDATION (auto-skipped in DEV_MODE w/o token)\n // ============================================================\n const isTurnstileValid = await validateTurnstile(\n validation.turnstileToken,\n trustedIP,\n );\n\n if (!isTurnstileValid) {\n return new Response(\n JSON.stringify({\n error: \"Verification failed. Please refresh and try again.\",\n refresh: true,\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 6. IN-MEMORY RATE LIMITING (no Deno.openKv — unsupported here)\n // ============================================================\n const limitResult = incrementAllLimits(userId, trustedIP);\n\n if (!limitResult.success) {\n const errorMessages: Record = {\n \"daily_limit_exceeded\": \"Daily limit reached. Come back tomorrow!\",\n \"burst_limit_exceeded\": \"Too many requests. Please wait a few minutes.\",\n \"ip_daily_limit_exceeded\": \"Too many requests from this network today.\",\n \"ip_burst_limit_exceeded\":\n \"Too many requests from this network. Please wait.\",\n \"global_limit_exceeded\":\n \"Service temporarily unavailable. Please try later.\",\n };\n\n const errorMsg = errorMessages[limitResult.errorType || \"\"] ||\n \"Rate limit exceeded\";\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n remaining: 0,\n limit: CONFIG.DAILY_LIMIT,\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 7. CALL GROQ API WITH TIMEOUT\n // ============================================================\n const groqKey = Deno.env.get(\"GROQ_API_KEY\");\n if (!groqKey) {\n console.error(\"GROQ_API_KEY not configured\");\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const prompt = buildPrompt(validation.intensity!);\n const temperature = validation.intensity === \"Mild\"\n ? 0.7\n : validation.intensity === \"Savage\"\n ? 0.95\n : 0.85;\n\n const mimeType = imageValidation.mimeType || \"image/jpeg\";\n const imageDataUrl = `data:${mimeType};base64,${validation.imageBase64}`;\n\n const controller = new AbortController();\n const timeoutId = setTimeout(\n () => controller.abort(),\n CONFIG.REQUEST_TIMEOUT,\n );\n\n let roastText: string;\n\n try {\n const groqResponse = await fetch(\n \"https://api.groq.com/openai/v1/chat/completions\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${groqKey}`,\n },\n body: JSON.stringify({\n model: \"qwen/qwen3.6-27b\",\n messages: [\n {\n role: \"user\",\n content: [\n { type: \"text\", text: prompt },\n { type: \"image_url\", image_url: { url: imageDataUrl } },\n ],\n },\n ],\n // Raised from 100: even with reasoning hidden from the\n // output, the model still SPENDS tokens on internal\n // reasoning before writing the answer. At 100 tokens the\n // entire budget was consumed by reasoning and the roast\n // came back empty (finish_reason: \"length\"). 100 tokens\n // is still plenty for a 1-2 sentence roast once reasoning\n // is disabled below, so this is just a safety margin.\n max_tokens: 300,\n temperature: temperature,\n // qwen3.6-27b is a reasoning model. reasoning_format\n // \"hidden\" only hides reasoning from the output — it does\n // NOT stop the model from spending tokens reasoning\n // internally. reasoning_effort \"none\" actually disables\n // reasoning for this task, which is what we want for a\n // short, low-stakes roast (no need to \"think\" at all).\n reasoning_effort: \"none\",\n reasoning_format: \"hidden\",\n }),\n signal: controller.signal,\n },\n );\n\n clearTimeout(timeoutId);\n\n if (!groqResponse.ok) {\n let groqErrorBody = \"\";\n try {\n groqErrorBody = await groqResponse.text();\n } catch {\n // ignore\n }\n console.error(\n `Groq API error: ${groqResponse.status}`,\n groqErrorBody.slice(0, 1000),\n );\n\n // Groq's own rate limit (429) is different from our app being\n // broken — tell the user to wait rather than a generic error.\n if (groqResponse.status === 429) {\n return new Response(\n JSON.stringify({\n error: \"AI service is busy right now. Please wait a moment and try again.\",\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n return new Response(\n JSON.stringify({ error: \"AI service temporarily unavailable\" }),\n {\n status: groqResponse.status >= 500 ? 503 : 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const data = await groqResponse.json();\n\n const validated = validateGroqResponse(data);\n if (!validated.valid) {\n // Log the ACTUAL response body so we can see what shape Groq\n // sent back — \"invalid structure\" alone doesn't tell us why.\n console.error(\n \"Invalid Groq response structure. Raw response:\",\n JSON.stringify(data).slice(0, 1500),\n );\n return new Response(\n JSON.stringify({ error: \"Service error. Please try again.\" }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n roastText = validated.content || \"No roast generated.\";\n // Safety net: strip any reasoning trace that slips through\n // despite reasoning_format:\"hidden\" (e.g. ...\n // blocks, or a leading \"think ...\" preamble some models emit).\n roastText = roastText.replace(/[\\s\\S]*?<\\/think>/gi, \"\").trim();\n roastText = roastText.replace(/^think\\b[\\s\\S]*?(?=\\n\\n|$)/i, \"\").trim();\n roastText = roastText.replace(/^[\"']|[\"']$/g, \"\");\n if (!roastText) {\n roastText = FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n roastText = moderateContent(roastText);\n } catch (fetchError: any) {\n clearTimeout(timeoutId);\n\n if (fetchError.name === \"AbortError\") {\n console.error(\"Groq API request timeout\");\n return new Response(\n JSON.stringify({\n error: \"AI service took too long. Please try again.\",\n }),\n {\n status: 504,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n console.error(\"Groq API request failed:\", fetchError.message);\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 8. PROPER COOKIE/CORS CREDENTIALS SETUP\n // ============================================================\n const responseHeaders: Record = {\n \"Content-Type\": \"application/json\",\n ...corsHeaders,\n };\n\n if (isNew) {\n responseHeaders[\"Set-Cookie\"] =\n `${CONFIG.SESSION_COOKIE_NAME}=${sessionId}; ` +\n `Path=/; ` +\n `HttpOnly; ` +\n `Secure; ` +\n `SameSite=Strict; ` +\n `Max-Age=${CONFIG.SESSION_LIFETIME}`;\n }\n\n const remaining = CONFIG.DAILY_LIMIT - (limitResult.dailyCount || 1);\n\n return new Response(\n JSON.stringify({\n roast: roastText,\n remaining: Math.max(0, remaining),\n limit: CONFIG.DAILY_LIMIT,\n used: limitResult.dailyCount || 1,\n intensity: validation.intensity,\n }),\n { headers: responseHeaders },\n );\n } catch (error: any) {\n console.error(\"Request error:\", {\n name: error.name || \"Unknown\",\n message: error.message?.slice(0, 100) || \"No message\",\n });\n\n let status = 400;\n let errorMsg = \"Something went wrong. Please try again.\";\n\n if (error.message?.includes(\"JSON\") || error.message?.includes(\"parse\")) {\n status = 400;\n errorMsg = \"Invalid request format.\";\n } else if (error.message?.includes(\"timeout\")) {\n status = 504;\n errorMsg = \"Request timed out. Please try again.\";\n } else {\n status = 500;\n errorMsg = \"Server error. Please try again later.\";\n }\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n roast: \"Oops! Something went wrong. Give it another try! 😅\",\n }),\n {\n status: status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...getCorsHeaders(origin),\n },\n },\n );\n }\n}","createdAt",["D",1787895946787],"branchVersion","branchId","97c8f8ac-91a0-48b3-967a-808ad734d441","id","2e53e9e5-d432-4222-a56b-0b8c952cf506","eden",["D",1787576169085],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","334f0784-d0e9-4432-a964-faa31ca93082","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a033d5-1ff7-7536-80e1-e9c2c450fe63","tursoName","2e53e9e5d4324222a56b0b8c952cf506","tursoHostname","2e53e9e5d4324222a56b0b8c952cf506-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789501263826],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",72,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","edenmenberu","handle","displayName","Eden Menberu","avatar","https://lh3.googleusercontent.com/a/ACg8ocJi70p5tIzpbponvGByu7dYhpGy3Myl2QbLoLL9cEteAQBXhA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":157,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":158,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":159,"_83":160,"_85":161,"_87":25},"tree",[152],"files",[152],"counts",{"_140":62,"_141":142,"_143":62,"_144":145,"_146":147},"contents",[132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[129],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":130,"_131":-5},"4035faae-c78d-4c9b-9486-c4a798ec8fb0","reporterId",{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":136,"_13":137,"_33":34,"_35":37,"_24":25,"_138":-5,"_27":139},"a47f3d1b-88ec-496f-be08-02bdbc7e3804","parentId","latest",["D",1787895946787],49,"label",[28],"pulls","branches",1,"forks","envVars",{"_148":150,"_151":62},"connections",{"_148":62,"_149":62},"count","unfilledCount",3,"emptyCount",{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":153,"_13":137,"_33":34,"_35":37,"_24":25,"_138":-5,"_154":155,"_27":156},["D",1787895946787],"children",[],[28],["D",1787576169085],["D",1789501263826],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_126":195,"_196":197,"_198":199,"_200":25,"_201":25,"_202":25,"_203":58,"_204":-5,"_205":-7,"_206":-7,"_207":62,"_208":25,"_209":25,"_210":-5,"_211":25,"_212":25,"_213":25,"_214":-5},"ENV",{"_166":167,"_168":169,"_170":89,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v50