[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_162":163,"_164":165},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":53,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",65,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","2d58eaa0-9fbb-11f1-9056-1607ee4eb77e","name","fileType","http","content","// ============================================================\n// 🔥 ROAST ME - Val.town Endpoint (FINAL PRODUCTION READY)\n// ============================================================\n// Required secrets: GROQ_API_KEY, HCAPTCHA_SECRET_KEY\n// Optional secret: DEV_MODE = \"true\" (allows ANY origin — for\n// testing on CodePen/localhost. Remove/unset before real launch.)\n// ============================================================\n\n// ============================================================\n// CONFIGURATION\n// ============================================================\nconst CONFIG = {\n MAX_REQUEST_BODY: 5 * 1024 * 1024, // 5MB total request size\n MAX_IMAGE_BYTES: 4 * 1024 * 1024, // 4MB decoded\n // Matches the client's monetization cap: 3 free + 2 ad-reward = 5 max\n // per user per day. Keeping these in sync means someone can't bypass\n // the client's ad-reward gate by calling this endpoint directly.\n DAILY_LIMIT: 5,\n BURST_LIMIT: 3,\n BURST_WINDOW: 5 * 60 * 1000, // 5 minutes\n IP_DAILY_LIMIT: 50, // IP-based limit to prevent multi-account abuse\n IP_BURST_LIMIT: 10, // IP-based burst limit\n REQUEST_TIMEOUT: 15000, // 15 seconds\n GLOBAL_DAILY_LIMIT: 1000, // Global API usage cap\n ALLOWED_INTENSITIES: [\"Mild\", \"Medium\", \"Savage\"] as const,\n\n // ⚠️ UPDATE THIS when you have a real production domain.\n // Exact-match origins. CodePen's actual preview iframe uses a\n // random subdomain per session (e.g. es-d-XXXX.codepen.dev), so\n // that's matched separately below by pattern, not listed here.\n ALLOWED_ORIGINS: [\n \"https://your-frontend-domain.com\",\n \"https://your-frontend-domain.vercel.app\",\n \"http://localhost:3000\", // local dev\n \"https://codepen.io\",\n \"https://cdpn.io\",\n // Capacitor Android WebView origin\n \"https://localhost\",\n \"http://localhost\",\n \"capacitor://localhost\",\n ],\n // Origins matched by pattern instead of exact string — for\n // platforms (like CodePen) that serve previews from a different\n // random subdomain every time.\n ALLOWED_ORIGIN_PATTERNS: [\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.dev$/i,\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.io$/i,\n ],\n SESSION_COOKIE_NAME: \"roast_session\",\n SESSION_LIFETIME: 86400, // 24 hours in seconds\n};\n\n// DEV_MODE: set this Val Town env var to \"true\" while testing on\n// CodePen so ANY origin is accepted. Delete/unset it before you\n// ship the real app — leaving it on defeats the whole point of\n// the origin allowlist.\nconst DEV_MODE = Deno.env.get(\"DEV_MODE\") === \"true\";\n\n// ============================================================\n// CORS WITH PROPER CREDENTIALS SUPPORT\n// ============================================================\nfunction isOriginAllowed(origin: string | null): boolean {\n if (DEV_MODE) return true;\n if (!origin) return false;\n if (CONFIG.ALLOWED_ORIGINS.includes(origin)) return true;\n return CONFIG.ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));\n}\n\nfunction getCorsHeaders(origin: string | null): Record {\n const isAllowed = isOriginAllowed(origin);\n\n if (!isAllowed || !origin) {\n return {\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n };\n }\n\n return {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n \"Access-Control-Allow-Credentials\": \"true\", // Required for cookies\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\n\n// ============================================================\n// REVISION 3: INDEPENDENT IP-BASED LIMITS\n// ============================================================\nfunction getTrustedIP(req: Request): string {\n const cfConnectingIP = req.headers.get(\"cf-connecting-ip\");\n if (cfConnectingIP) return cfConnectingIP;\n\n const vercelForwarded = req.headers.get(\"x-vercel-forwarded-for\");\n if (vercelForwarded) return vercelForwarded.split(\",\")[0].trim();\n\n const flyClientIP = req.headers.get(\"fly-client-ip\");\n if (flyClientIP) return flyClientIP;\n\n const forwarded = req.headers.get(\"x-forwarded-for\");\n if (forwarded) {\n const via = req.headers.get(\"via\") || \"\";\n const host = req.headers.get(\"host\") || \"\";\n if (via.includes(\"cloudflare\") || host.includes(\"cloudflare\")) {\n return forwarded.split(\",\")[0].trim();\n }\n }\n\n return req.headers.get(\"x-real-ip\") || \"unknown\";\n}\n\n// ============================================================\n// REVISION 1: FIX SESSION ID LENGTH\n// ============================================================\nfunction getOrCreateSession(\n req: Request,\n): { sessionId: string; isNew: boolean } {\n const cookieHeader = req.headers.get(\"cookie\") || \"\";\n const cookies = cookieHeader.split(\";\").reduce((acc, cookie) => {\n const [key, value] = cookie.trim().split(\"=\");\n if (key && value) acc[key] = value;\n return acc;\n }, {} as Record);\n\n let sessionId = cookies[CONFIG.SESSION_COOKIE_NAME];\n\n if (sessionId && /^[a-zA-Z0-9]{32,64}$/.test(sessionId)) {\n return { sessionId, isNew: false };\n }\n\n const timestamp = Date.now().toString(36);\n const random1 = Math.random().toString(36).substring(2, 15);\n const random2 = Math.random().toString(36).substring(2, 15);\n const random3 = Math.random().toString(36).substring(2, 15);\n\n const raw = `${timestamp}${random1}${random2}${random3}`;\n\n let hash = \"\";\n for (let i = 0; i < raw.length; i++) {\n const char = raw.charCodeAt(i);\n const hex = (char & 0xFF).toString(16).padStart(2, \"0\");\n hash += hex;\n }\n\n while (hash.length < 64) {\n hash += Math.random().toString(36).substring(2, 10);\n }\n sessionId = hash.substring(0, 64);\n\n return { sessionId, isNew: true };\n}\n\n// ============================================================\n// REVISION 6: IN-MEMORY RATE LIMITING (Deno.openKv is NOT\n// available on Val.town's runtime — it's a Deno Deploy-only API.\n// This uses a plain module-level Map instead. Trade-off: counts\n// reset if the val restarts/redeploys, and won't be shared across\n// multiple concurrent instances if Val.town ever scales this val\n// horizontally. For an app this size, that's an acceptable\n// trade-off for something that actually works without extra setup.\n// ============================================================\ntype LimitBucket = { timestamps: number[] };\nconst rateLimitStore = new Map();\n\n// Periodically clean out old entries so the Map doesn't grow forever.\n// Runs at most once per call, cheap no-op otherwise.\nlet lastCleanup = 0;\nfunction cleanupStoreIfNeeded() {\n const now = Date.now();\n if (now - lastCleanup < 10 * 60 * 1000) return; // at most every 10 min\n lastCleanup = now;\n const maxWindow = 24 * 60 * 60 * 1000;\n for (const [key, bucket] of rateLimitStore.entries()) {\n bucket.timestamps = bucket.timestamps.filter((t) => now - t < maxWindow);\n if (bucket.timestamps.length === 0) rateLimitStore.delete(key);\n }\n}\n\nfunction incrementAllLimits(\n userId: string,\n ip: string,\n): {\n success: boolean;\n dailyCount?: number;\n burstCount?: number;\n ipDailyCount?: number;\n ipBurstCount?: number;\n error?: string;\n errorType?: string;\n} {\n cleanupStoreIfNeeded();\n\n const now = Date.now();\n const limits = [\n {\n key: `daily:${userId}`,\n limit: CONFIG.DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"daily\",\n field: \"dailyCount\",\n },\n {\n key: `burst:${userId}`,\n limit: CONFIG.BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"burst\",\n field: \"burstCount\",\n },\n {\n key: `ip_daily:${ip}`,\n limit: CONFIG.IP_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"ip_daily\",\n field: \"ipDailyCount\",\n },\n {\n key: `ip_burst:${ip}`,\n limit: CONFIG.IP_BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"ip_burst\",\n field: \"ipBurstCount\",\n },\n {\n key: \"global\",\n limit: CONFIG.GLOBAL_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"global\",\n field: null as string | null,\n },\n ];\n\n // Read + filter each bucket first, check all limits before writing\n // anything, so a rejected request doesn't partially increment.\n const reads = limits.map((limit) => {\n const bucket = rateLimitStore.get(limit.key) || { timestamps: [] };\n const cutoff = now - limit.windowMs;\n const validTimestamps = bucket.timestamps.filter((t) => t > cutoff);\n return { ...limit, validTimestamps };\n });\n\n for (const read of reads) {\n if (read.validTimestamps.length >= read.limit) {\n return {\n success: false,\n error: `${read.name}_limit_exceeded`,\n errorType: read.name,\n };\n }\n }\n\n const result: any = { success: true };\n for (const read of reads) {\n const newTimestamps = [...read.validTimestamps, now].slice(-100);\n rateLimitStore.set(read.key, { timestamps: newTimestamps });\n if (read.field) {\n result[read.field] = newTimestamps.length;\n }\n }\n\n return result;\n}\n\n// ============================================================\n// CAPTCHA VALIDATION (hCaptcha) — skipped automatically in DEV_MODE\n// if no token is sent, so you can test on CodePen without wiring up\n// the widget there. Still mandatory once DEV_MODE is off.\n// ============================================================\nasync function validateCaptcha(\n token: string | undefined,\n ip: string,\n): Promise {\n // DEV_MODE: accept either no token, or the app's known dev\n // placeholder token ('dev-mode-skip'), without calling hCaptcha.\n if (DEV_MODE && (!token || token === \"dev-mode-skip\")) {\n console.warn(\"DEV_MODE: skipping real captcha check\");\n return true;\n }\n\n const secretKey = Deno.env.get(\"HCAPTCHA_SECRET_KEY\")?.trim();\n\n if (!secretKey) {\n console.error(\"HCAPTCHA_SECRET_KEY is required in production\");\n return false;\n }\n\n if (!token) return false;\n\n try {\n const response = await fetch(\n \"https://hcaptcha.com/siteverify\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n secret: secretKey,\n response: token,\n remoteip: ip,\n }),\n },\n );\n\n const data = await response.json();\n if (data.success !== true) {\n // Log the actual hCaptcha response — \"error-codes\" tells us\n // exactly why it was rejected (bad secret, expired/spent token,\n // hostname mismatch, etc.) instead of just a blind fail.\n console.error(\"hCaptcha verification failed:\", JSON.stringify(data));\n }\n return data.success === true;\n } catch (error) {\n console.error(\"hCaptcha validation error:\", error);\n return false;\n }\n}\n\n// ============================================================\n// STREAM-BASED REQUEST SIZE ENFORCEMENT\n// ============================================================\nasync function readBodyWithLimit(req: Request, maxSize: number): Promise {\n const reader = req.body?.getReader();\n if (!reader) {\n throw new Error(\"No request body\");\n }\n\n let received = 0;\n const chunks: Uint8Array[] = [];\n\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n received += value.length;\n if (received > maxSize) {\n reader.cancel();\n throw new Error(\"Request body too large\");\n }\n\n chunks.push(value);\n }\n } finally {\n reader.releaseLock();\n }\n\n const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);\n const buffer = new Uint8Array(totalLength);\n let offset = 0;\n for (const chunk of chunks) {\n buffer.set(chunk, offset);\n offset += chunk.length;\n }\n\n const text = new TextDecoder().decode(buffer);\n return JSON.parse(text);\n}\n\n// ============================================================\n// COMPLETE IMAGE VALIDATION\n// ============================================================\nfunction validateImage(base64Data: string): {\n valid: boolean;\n mimeType?: string;\n error?: string;\n} {\n const approxBytes = Math.floor((base64Data.length * 3) / 4);\n if (approxBytes > CONFIG.MAX_IMAGE_BYTES) {\n return { valid: false, error: \"Image too large\" };\n }\n if (approxBytes < 100) {\n return { valid: false, error: \"Image too small\" };\n }\n\n if (!/^[A-Za-z0-9+/]+=*$/.test(base64Data.slice(0, 200))) {\n return { valid: false, error: \"Invalid image format\" };\n }\n\n try {\n const binaryString = atob(base64Data.slice(0, 100));\n const bytes = new Uint8Array(binaryString.length);\n for (let i = 0; i < binaryString.length; i++) {\n bytes[i] = binaryString.charCodeAt(i);\n }\n\n const magic = Array.from(bytes.slice(0, 12))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n if (\n magic.startsWith(\"ffd8ffe0\") || magic.startsWith(\"ffd8ffe1\") ||\n magic.startsWith(\"ffd8ffe2\") || magic.startsWith(\"ffd8ffdb\") ||\n magic.startsWith(\"ffd8ffc0\") || magic.startsWith(\"ffd8ffc4\")\n ) {\n return { valid: true, mimeType: \"image/jpeg\" };\n }\n\n if (magic.startsWith(\"89504e470d0a1a0a\")) {\n return { valid: true, mimeType: \"image/png\" };\n }\n\n if (magic.startsWith(\"52494646\")) {\n const webpCheck = binaryString.slice(8, 12);\n if (webpCheck === \"WEBP\") {\n return { valid: true, mimeType: \"image/webp\" };\n }\n }\n\n return { valid: false, error: \"Unsupported image format\" };\n } catch {\n return { valid: false, error: \"Invalid image data\" };\n }\n}\n\n// ============================================================\n// STRICT SCHEMA VALIDATION\n// ============================================================\nfunction validateRequest(body: any): {\n valid: boolean;\n action?: string;\n imageBase64?: string;\n intensity?: string;\n captchaToken?: string;\n reason?: string;\n roast?: string;\n reportType?: string;\n error?: string;\n reportedAt?: string;\n} {\n if (!body || typeof body !== \"object\") {\n return { valid: false, error: \"Invalid request\" };\n }\n\n const {\n action,\n imageBase64,\n intensity,\n captchaToken,\n reason,\n roast,\n reportType,\n error,\n reportedAt,\n } = body;\n\n // REPORTS ARE COMPLETELY INDEPENDENT OF ROAST GENERATION.\n // They do not require an image, CAPTCHA, Groq, or roast quota.\n if (action === \"report\") {\n const allowedReasons = [\n \"Offensive or inappropriate\",\n \"Harassment / bullying\",\n \"Hateful content\",\n \"Sexual or inappropriate content\",\n \"AI generated something unrelated\",\n \"AI generation failed\",\n \"Other\",\n ];\n\n const allowedReportTypes = [\"roast\", \"generation_failure\"];\n\n if (typeof reason !== \"string\" || !allowedReasons.includes(reason)) {\n return { valid: false, error: \"Invalid report reason\" };\n }\n\n const safeReportType =\n typeof reportType === \"string\" && allowedReportTypes.includes(reportType)\n ? reportType\n : \"roast\";\n\n if (reportedAt !== undefined) {\n if (typeof reportedAt !== \"string\" || Number.isNaN(Date.parse(reportedAt))) {\n return { valid: false, error: \"Invalid report timestamp\" };\n }\n }\n\n return {\n valid: true,\n action: \"report\",\n reason,\n reportType: safeReportType,\n roast: typeof roast === \"string\" ? roast.slice(0, 500) : \"\",\n error: typeof error === \"string\" ? error.slice(0, 500) : \"\",\n reportedAt: reportedAt || new Date().toISOString(),\n };\n }\n\n if (!imageBase64 || typeof imageBase64 !== \"string\") {\n return { valid: false, error: \"No image provided\" };\n }\n\n if (intensity && !CONFIG.ALLOWED_INTENSITIES.includes(intensity)) {\n return { valid: false, error: \"Invalid intensity level\" };\n }\n\n if (!DEV_MODE) {\n if (!captchaToken || typeof captchaToken !== \"string\") {\n return { valid: false, error: \"Verification token required\" };\n }\n }\n\n return {\n valid: true,\n action: \"roast\",\n imageBase64,\n intensity: intensity || \"Medium\",\n captchaToken,\n };\n}\n\n// ============================================================\n// GROQ RESPONSE VALIDATION\n// ============================================================\nfunction validateGroqResponse(data: any): { valid: boolean; content?: string } {\n try {\n if (!data || typeof data !== \"object\") return { valid: false };\n\n const choices = data.choices;\n if (!Array.isArray(choices) || choices.length === 0) {\n return { valid: false };\n }\n\n const message = choices[0]?.message;\n if (!message || typeof message !== \"object\") return { valid: false };\n\n const content = message.content;\n if (typeof content !== \"string\" || content.trim().length === 0) {\n return { valid: false };\n }\n\n return { valid: true, content: content.trim() };\n } catch {\n return { valid: false };\n }\n}\n\n// ============================================================\n// POST-GENERATION CONTENT MODERATION\n// ============================================================\nconst BLOCKED_WORDS = [\n \"stupid\",\n \"dumb\",\n \"ugly\",\n \"fat\",\n \"loser\",\n \"hate\",\n \"idiot\",\n \"moron\",\n \"retard\",\n \"worthless\",\n \"trash\",\n \"garbage\",\n \"pathetic\",\n \"disgusting\",\n \"kill\",\n \"die\",\n \"death\",\n \"suicide\",\n \"murder\",\n \"terrorist\",\n \"racist\",\n \"nazi\",\n \"pedophile\",\n \"rapist\",\n \"abuse\",\n \"trauma\",\n \"mental illness\",\n];\n\nconst FALLBACK_ROASTS = [\n \"You're too cool for a roast right now. Try again! 😎\",\n \"AI is speechless... but your outfit isn't! 😂\",\n \"You look like you'd survive a zombie apocalypse by being too fast! 🏃\",\n \"Your style is so unique, even AI can't roast it! ✨\",\n \"You're radiating main character energy! 🌟\",\n \"Looking sharp! Even AI can't find a flaw! 👔\",\n \"You're serving looks that AI can't compute! 💫\",\n \"Too stylish to roast! Save some for the rest of us! 🔥\",\n];\n\nfunction moderateContent(text: string): string {\n const lowerText = text.toLowerCase();\n const hasBlocked = BLOCKED_WORDS.some((word) => lowerText.includes(word));\n\n if (hasBlocked) {\n return FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n\n text = text.replace(/[^a-zA-Z0-9\\s.,!?'\"\\-()]/g, \"\");\n\n if (text.length > 300) {\n text = text.slice(0, 297) + \"...\";\n }\n\n return text;\n}\n\n// ============================================================\n// SERVER-CONTROLLED PROMPTS + SAFETY RULES\n// ============================================================\nconst INTENSITY_PROMPTS: Record = {\n Mild:\n \"Give a gentle, playful, and lighthearted roast. Keep it funny but nice. No harsh words. Focus on style, expression, or background. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Medium:\n \"Give a funny, sarcastic, and witty roast. Be humorous but not too harsh. Focus on outfit, expression, background, or pose. Keep it clever and creative. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Savage:\n \"Give a sharp, witty, and clever roast. Be bold and creative but keep it playful. Focus on style, pose, background, or expression. Make it funny and clever, not offensive. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n};\n\nconst SAFETY_RULES = [\n \"Never mention weight, body size, or physical appearance beyond clothing/style.\",\n \"Never mention race, ethnicity, religion, or nationality.\",\n \"Never use profanity, slurs, or offensive language.\",\n \"Never mention disabilities, health conditions, or mental health.\",\n \"Never make threats, insults, or personal attacks.\",\n \"Never mention age or make age-related insults.\",\n \"Keep roasts playful, creative, and focused on style/expression/background.\",\n \"Maximum 2 sentences per roast.\",\n];\n\nfunction buildPrompt(intensity: string): string {\n const basePrompt = INTENSITY_PROMPTS[intensity] || INTENSITY_PROMPTS.Medium;\n const safetyPrompt = `IMPORTANT SAFETY RULES (must follow all):\n${SAFETY_RULES.map((rule, i) => `${i + 1}. ${rule}`).join(\"\\n\")}\n\nNow give a ${intensity} roast based on the image:`;\n\n return `${safetyPrompt}\\n\\n${basePrompt}`;\n}\n\n// ============================================================\n// MAIN HANDLER\n// ============================================================\nexport async function server(req: Request): Promise {\n const origin = req.headers.get(\"origin\");\n const corsHeaders = getCorsHeaders(origin);\n\n // Reject unapproved origins (skipped entirely in DEV_MODE)\n if (!isOriginAllowed(origin)) {\n // Note: since this origin is NOT allowed, getCorsHeaders() won't\n // include Access-Control-Allow-Origin here either — the browser\n // will still show a CORS-style error rather than surfacing this\n // JSON body. That's expected/correct: an origin we don't trust\n // shouldn't be told exactly why in a way it can act on. Use the\n // Val.town Logs panel to see this actual error during debugging\n // instead of the browser console.\n return new Response(\n JSON.stringify({\n error: \"Unauthorized origin\",\n receivedOrigin: origin,\n }),\n {\n status: 403,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: corsHeaders });\n }\n\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({ error: \"Method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n try {\n // ============================================================\n // 1. STREAM-BASED BODY SIZE ENFORCEMENT\n // ============================================================\n let body;\n try {\n body = await readBodyWithLimit(req, CONFIG.MAX_REQUEST_BODY);\n } catch (error) {\n if (error.message === \"Request body too large\") {\n return new Response(\n JSON.stringify({ error: \"Request too large\" }),\n {\n status: 413,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n throw error;\n }\n\n // ============================================================\n // 2. VALIDATE REQUEST SCHEMA\n // ============================================================\n const validation = validateRequest(body);\n console.log(\"[ROAST ME] Request received:\", {\n action: body?.action || \"roast\",\n origin,\n });\n\n if (!validation.valid) {\n return new Response(\n JSON.stringify({ error: validation.error || \"Invalid request\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 3. REPORT SUBMISSION\n // Reports bypass image validation, CAPTCHA, Groq, and roast quotas.\n // ============================================================\n // Reports are accepted by the backend and do not consume roast quota.\n // For durable storage, replace the log below with your database insert.\n // ============================================================\n if (validation.action === \"report\") {\n const { sessionId, isNew } = getOrCreateSession(req);\n\n const report = {\n sessionId,\n reportType: validation.reportType || \"roast\",\n reason: validation.reason,\n roast: validation.roast || \"\",\n error: validation.error || \"\",\n reportedAt: validation.reportedAt || new Date().toISOString(),\n receivedAt: new Date().toISOString(),\n };\n\n console.log(\n \"🔥 ROAST ME REPORT RECEIVED:\",\n JSON.stringify(report),\n );\n\n const reportHeaders: Record = {\n \"Content-Type\": \"application/json\",\n ...corsHeaders,\n };\n\n // Give the client a session cookie too, if it does not already have one.\n if (isNew) {\n reportHeaders[\"Set-Cookie\"] =\n `${CONFIG.SESSION_COOKIE_NAME}=${sessionId}; ` +\n `Path=/; HttpOnly; Secure; SameSite=Strict; ` +\n `Max-Age=${CONFIG.SESSION_LIFETIME}`;\n }\n\n return new Response(\n JSON.stringify({\n success: true,\n received: true,\n message: \"Report submitted\",\n }),\n {\n status: 200,\n headers: reportHeaders,\n },\n );\n }\n\n // ============================================================\n // 3. IMAGE VALIDATION\n // ============================================================\n const imageValidation = validateImage(validation.imageBase64!);\n if (!imageValidation.valid) {\n return new Response(\n JSON.stringify({ error: imageValidation.error }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 4. GET TRUSTED IP AND SESSION\n // ============================================================\n const trustedIP = getTrustedIP(req);\n const { sessionId, isNew } = getOrCreateSession(req);\n const userId = `${trustedIP}:${sessionId}`;\n\n // ============================================================\n // 5. CAPTCHA VALIDATION (auto-skipped in DEV_MODE w/o token)\n // ============================================================\n const isCaptchaValid = await validateCaptcha(\n validation.captchaToken,\n trustedIP,\n );\n\n if (!isCaptchaValid) {\n return new Response(\n JSON.stringify({\n error: \"Verification failed. Please refresh and try again.\",\n refresh: true,\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 6. IN-MEMORY RATE LIMITING (no Deno.openKv — unsupported here)\n // ============================================================\n const limitResult = incrementAllLimits(userId, trustedIP);\n\n if (!limitResult.success) {\n const errorMessages: Record = {\n \"daily_limit_exceeded\": \"Daily limit reached. Come back tomorrow!\",\n \"burst_limit_exceeded\": \"Too many requests. Please wait a few minutes.\",\n \"ip_daily_limit_exceeded\": \"Too many requests from this network today.\",\n \"ip_burst_limit_exceeded\":\n \"Too many requests from this network. Please wait.\",\n \"global_limit_exceeded\":\n \"Service temporarily unavailable. Please try later.\",\n };\n\n const errorMsg = errorMessages[limitResult.errorType || \"\"] ||\n \"Rate limit exceeded\";\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n remaining: 0,\n limit: CONFIG.DAILY_LIMIT,\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 7. CALL GROQ API WITH TIMEOUT\n // ============================================================\n const groqKey = Deno.env.get(\"GROQ_API_KEY\");\n if (!groqKey) {\n console.error(\"GROQ_API_KEY not configured\");\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const prompt = buildPrompt(validation.intensity!);\n const temperature = validation.intensity === \"Mild\"\n ? 0.7\n : validation.intensity === \"Savage\"\n ? 0.95\n : 0.85;\n\n const mimeType = imageValidation.mimeType || \"image/jpeg\";\n const imageDataUrl = `data:${mimeType};base64,${validation.imageBase64}`;\n\n const controller = new AbortController();\n const timeoutId = setTimeout(\n () => controller.abort(),\n CONFIG.REQUEST_TIMEOUT,\n );\n\n let roastText: string;\n\n try {\n const groqResponse = await fetch(\n \"https://api.groq.com/openai/v1/chat/completions\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${groqKey}`,\n },\n body: JSON.stringify({\n model: \"qwen/qwen3.6-27b\",\n messages: [\n {\n role: \"user\",\n content: [\n { type: \"text\", text: prompt },\n { type: \"image_url\", image_url: { url: imageDataUrl } },\n ],\n },\n ],\n // 350 tokens is comfortable headroom for a ~400-character\n // roast now that reasoning is disabled (reasoning_effort:\n // \"none\" below) — the full budget goes to the actual text.\n max_tokens: 350,\n temperature: temperature,\n // qwen3.6-27b is a reasoning model. reasoning_format\n // \"hidden\" only hides reasoning from the output — it does\n // NOT stop the model from spending tokens reasoning\n // internally. reasoning_effort \"none\" actually disables\n // reasoning for this task, which is what we want for a\n // short, low-stakes roast (no need to \"think\" at all).\n reasoning_effort: \"none\",\n reasoning_format: \"hidden\",\n }),\n signal: controller.signal,\n },\n );\n\n clearTimeout(timeoutId);\n\n if (!groqResponse.ok) {\n let groqErrorBody = \"\";\n try {\n groqErrorBody = await groqResponse.text();\n } catch {\n // ignore\n }\n console.error(\n `Groq API error: ${groqResponse.status}`,\n groqErrorBody.slice(0, 1000),\n );\n\n // Groq's own rate limit (429) is different from our app being\n // broken — tell the user to wait rather than a generic error.\n if (groqResponse.status === 429) {\n return new Response(\n JSON.stringify({\n error: \"AI service is busy right now. Please wait a moment and try again.\",\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n return new Response(\n JSON.stringify({ error: \"AI service temporarily unavailable\" }),\n {\n status: groqResponse.status >= 500 ? 503 : 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const data = await groqResponse.json();\n\n const validated = validateGroqResponse(data);\n if (!validated.valid) {\n // Log the ACTUAL response body so we can see what shape Groq\n // sent back — \"invalid structure\" alone doesn't tell us why.\n console.error(\n \"Invalid Groq response structure. Raw response:\",\n JSON.stringify(data).slice(0, 1500),\n );\n return new Response(\n JSON.stringify({ error: \"Service error. Please try again.\" }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n roastText = validated.content || \"No roast generated.\";\n // Safety net: strip any reasoning trace that slips through\n // despite reasoning_format:\"hidden\" (e.g. ...\n // blocks, or a leading \"think ...\" preamble some models emit).\n roastText = roastText.replace(/[\\s\\S]*?<\\/think>/gi, \"\").trim();\n roastText = roastText.replace(/^think\\b[\\s\\S]*?(?=\\n\\n|$)/i, \"\").trim();\n roastText = roastText.replace(/^[\"']|[\"']$/g, \"\");\n if (!roastText) {\n roastText = FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n roastText = moderateContent(roastText);\n } catch (fetchError: any) {\n clearTimeout(timeoutId);\n\n if (fetchError.name === \"AbortError\") {\n console.error(\"Groq API request timeout\");\n return new Response(\n JSON.stringify({\n error: \"AI service took too long. Please try again.\",\n }),\n {\n status: 504,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n console.error(\"Groq API request failed:\", fetchError.message);\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n // ============================================================\n // 8. PROPER COOKIE/CORS CREDENTIALS SETUP\n // ============================================================\n const responseHeaders: Record = {\n \"Content-Type\": \"application/json\",\n ...corsHeaders,\n };\n\n if (isNew) {\n responseHeaders[\"Set-Cookie\"] =\n `${CONFIG.SESSION_COOKIE_NAME}=${sessionId}; ` +\n `Path=/; ` +\n `HttpOnly; ` +\n `Secure; ` +\n `SameSite=Strict; ` +\n `Max-Age=${CONFIG.SESSION_LIFETIME}`;\n }\n\n const remaining = CONFIG.DAILY_LIMIT - (limitResult.dailyCount || 1);\n\n return new Response(\n JSON.stringify({\n roast: roastText,\n remaining: Math.max(0, remaining),\n limit: CONFIG.DAILY_LIMIT,\n used: limitResult.dailyCount || 1,\n intensity: validation.intensity,\n }),\n { headers: responseHeaders },\n );\n } catch (error: any) {\n console.error(\"Request error:\", {\n name: error.name || \"Unknown\",\n message: error.message?.slice(0, 100) || \"No message\",\n });\n\n let status = 400;\n let errorMsg = \"Something went wrong. Please try again.\";\n\n if (error.message?.includes(\"JSON\") || error.message?.includes(\"parse\")) {\n status = 400;\n errorMsg = \"Invalid request format.\";\n } else if (error.message?.includes(\"timeout\")) {\n status = 504;\n errorMsg = \"Request timed out. Please try again.\";\n } else {\n status = 500;\n errorMsg = \"Server error. Please try again later.\";\n }\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n roast: \"Oops! Something went wrong. Give it another try! 😅\",\n }),\n {\n status: status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...getCorsHeaders(origin),\n },\n },\n );\n }\n}","// ============================================================\n// 🔥 ROAST ME - Val.town Endpoint (FINAL PRODUCTION READY)\n// ============================================================\n// Required secrets: GROQ_API_KEY, HCAPTCHA_SECRET_KEY\n// Optional secret: DEV_MODE = \"true\" (allows ANY origin — for\n// testing on CodePen/localhost. Remove/unset before real launch.)\n// ============================================================\n\n// ============================================================\n// CONFIGURATION\n// ============================================================\nconst CONFIG = {\n MAX_REQUEST_BODY: 5 * 1024 * 1024, // 5MB total request size\n MAX_IMAGE_BYTES: 4 * 1024 * 1024, // 4MB decoded\n DAILY_LIMIT: 5,\n BURST_LIMIT: 3,\n BURST_WINDOW: 5 * 60 * 1000, // 5 minutes\n IP_DAILY_LIMIT: 50,\n IP_BURST_LIMIT: 10,\n REQUEST_TIMEOUT: 30000, // 30 seconds\n GLOBAL_DAILY_LIMIT: 1000,\n ALLOWED_INTENSITIES: [\"Mild\", \"Medium\", \"Savage\"] as const,\n\n // ⚠️ UPDATE THIS when you have a real production domain.\n ALLOWED_ORIGINS: [\n \"https://your-frontend-domain.com\",\n \"https://your-frontend-domain.vercel.app\",\n \"http://localhost:3000\",\n \"https://codepen.io\",\n \"https://cdpn.io\",\n // Capacitor Android WebView origin\n \"https://localhost\",\n \"http://localhost\",\n \"capacitor://localhost\",\n ],\n ALLOWED_ORIGIN_PATTERNS: [\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.dev$/i,\n /^https:\\/\\/[a-z0-9-]+\\.codepen\\.io$/i,\n ],\n SESSION_COOKIE_NAME: \"roast_session\",\n SESSION_LIFETIME: 86400, // 24 hours in seconds\n};\n\nconst DEV_MODE = Deno.env.get(\"DEV_MODE\") === \"true\";\n\n// ============================================================\n// CORS\n// ============================================================\nfunction isOriginAllowed(origin: string | null): boolean {\n if (DEV_MODE) return true;\n if (!origin) return false;\n if (CONFIG.ALLOWED_ORIGINS.includes(origin)) return true;\n return CONFIG.ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));\n}\n\nfunction getCorsHeaders(origin: string | null): Record {\n const isAllowed = isOriginAllowed(origin);\n\n if (!isAllowed || !origin) {\n return {\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n };\n }\n\n return {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Request-ID\",\n \"Access-Control-Allow-Credentials\": \"true\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\n\n// ============================================================\n// TRUSTED IP\n// ============================================================\nfunction getTrustedIP(req: Request): string {\n const cfConnectingIP = req.headers.get(\"cf-connecting-ip\");\n if (cfConnectingIP) return cfConnectingIP;\n\n const vercelForwarded = req.headers.get(\"x-vercel-forwarded-for\");\n if (vercelForwarded) return vercelForwarded.split(\",\")[0].trim();\n\n const flyClientIP = req.headers.get(\"fly-client-ip\");\n if (flyClientIP) return flyClientIP;\n\n const forwarded = req.headers.get(\"x-forwarded-for\");\n if (forwarded) {\n const via = req.headers.get(\"via\") || \"\";\n const host = req.headers.get(\"host\") || \"\";\n if (via.includes(\"cloudflare\") || host.includes(\"cloudflare\")) {\n return forwarded.split(\",\")[0].trim();\n }\n }\n\n return req.headers.get(\"x-real-ip\") || \"unknown\";\n}\n\n// ============================================================\n// SESSION\n// ============================================================\nfunction getOrCreateSession(\n req: Request,\n): { sessionId: string; isNew: boolean } {\n const cookieHeader = req.headers.get(\"cookie\") || \"\";\n const cookies = cookieHeader.split(\";\").reduce((acc, cookie) => {\n const [key, value] = cookie.trim().split(\"=\");\n if (key && value) acc[key] = value;\n return acc;\n }, {} as Record);\n\n let sessionId = cookies[CONFIG.SESSION_COOKIE_NAME];\n\n if (sessionId && /^[a-zA-Z0-9]{32,64}$/.test(sessionId)) {\n return { sessionId, isNew: false };\n }\n\n const timestamp = Date.now().toString(36);\n const random1 = Math.random().toString(36).substring(2, 15);\n const random2 = Math.random().toString(36).substring(2, 15);\n const random3 = Math.random().toString(36).substring(2, 15);\n\n const raw = `${timestamp}${random1}${random2}${random3}`;\n\n let hash = \"\";\n for (let i = 0; i < raw.length; i++) {\n const char = raw.charCodeAt(i);\n const hex = (char & 0xFF).toString(16).padStart(2, \"0\");\n hash += hex;\n }\n\n while (hash.length < 64) {\n hash += Math.random().toString(36).substring(2, 10);\n }\n sessionId = hash.substring(0, 64);\n\n return { sessionId, isNew: true };\n}\n\n// ============================================================\n// IN-MEMORY RATE LIMITING\n// ============================================================\ntype LimitBucket = { timestamps: number[] };\nconst rateLimitStore = new Map();\n\nlet lastCleanup = 0;\nfunction cleanupStoreIfNeeded() {\n const now = Date.now();\n if (now - lastCleanup < 10 * 60 * 1000) return;\n lastCleanup = now;\n const maxWindow = 24 * 60 * 60 * 1000;\n for (const [key, bucket] of rateLimitStore.entries()) {\n bucket.timestamps = bucket.timestamps.filter((t) => now - t < maxWindow);\n if (bucket.timestamps.length === 0) rateLimitStore.delete(key);\n }\n}\n\nfunction incrementAllLimits(\n userId: string,\n ip: string,\n): {\n success: boolean;\n dailyCount?: number;\n burstCount?: number;\n ipDailyCount?: number;\n ipBurstCount?: number;\n error?: string;\n errorType?: string;\n} {\n cleanupStoreIfNeeded();\n\n const now = Date.now();\n const limits = [\n {\n key: `daily:${userId}`,\n limit: CONFIG.DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"daily\",\n field: \"dailyCount\",\n },\n {\n key: `burst:${userId}`,\n limit: CONFIG.BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"burst\",\n field: \"burstCount\",\n },\n {\n key: `ip_daily:${ip}`,\n limit: CONFIG.IP_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"ip_daily\",\n field: \"ipDailyCount\",\n },\n {\n key: `ip_burst:${ip}`,\n limit: CONFIG.IP_BURST_LIMIT,\n windowMs: CONFIG.BURST_WINDOW,\n name: \"ip_burst\",\n field: \"ipBurstCount\",\n },\n {\n key: \"global\",\n limit: CONFIG.GLOBAL_DAILY_LIMIT,\n windowMs: 24 * 60 * 60 * 1000,\n name: \"global\",\n field: null as string | null,\n },\n ];\n\n const reads = limits.map((limit) => {\n const bucket = rateLimitStore.get(limit.key) || { timestamps: [] };\n const cutoff = now - limit.windowMs;\n const validTimestamps = bucket.timestamps.filter((t) => t > cutoff);\n return { ...limit, validTimestamps };\n });\n\n for (const read of reads) {\n if (read.validTimestamps.length >= read.limit) {\n return {\n success: false,\n error: `${read.name}_limit_exceeded`,\n errorType: read.name,\n };\n }\n }\n\n const result: any = { success: true };\n for (const read of reads) {\n const newTimestamps = [...read.validTimestamps, now].slice(-100);\n rateLimitStore.set(read.key, { timestamps: newTimestamps });\n if (read.field) {\n result[read.field] = newTimestamps.length;\n }\n }\n\n return result;\n}\n\n// ============================================================\n// CAPTCHA VALIDATION\n// ============================================================\nasync function validateCaptcha(\n token: string | undefined,\n ip: string,\n): Promise {\n if (DEV_MODE && (!token || token === \"dev-mode-skip\")) {\n console.warn(\"DEV_MODE: skipping real captcha check\");\n return true;\n }\n\n const secretKey = Deno.env.get(\"HCAPTCHA_SECRET_KEY\")?.trim();\n\n if (!secretKey) {\n console.error(\"HCAPTCHA_SECRET_KEY is required in production\");\n return false;\n }\n\n if (!token) return false;\n\n try {\n const response = await fetch(\n \"https://hcaptcha.com/siteverify\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n secret: secretKey,\n response: token,\n remoteip: ip,\n }),\n },\n );\n\n const data = await response.json();\n if (data.success !== true) {\n console.error(\"hCaptcha verification failed:\", JSON.stringify(data));\n }\n return data.success === true;\n } catch (error) {\n console.error(\"hCaptcha validation error:\", error);\n return false;\n }\n}\n\n// ============================================================\n// STREAM-BASED BODY READER\n// ============================================================\nasync function readBodyWithLimit(req: Request, maxSize: number): Promise {\n const reader = req.body?.getReader();\n if (!reader) {\n throw new Error(\"No request body\");\n }\n\n let received = 0;\n const chunks: Uint8Array[] = [];\n\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n received += value.length;\n if (received > maxSize) {\n reader.cancel();\n throw new Error(\"Request body too large\");\n }\n\n chunks.push(value);\n }\n } finally {\n reader.releaseLock();\n }\n\n const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);\n const buffer = new Uint8Array(totalLength);\n let offset = 0;\n for (const chunk of chunks) {\n buffer.set(chunk, offset);\n offset += chunk.length;\n }\n\n const text = new TextDecoder().decode(buffer);\n return JSON.parse(text);\n}\n\n// ============================================================\n// IMAGE VALIDATION\n// ============================================================\nfunction validateImage(base64Data: string): {\n valid: boolean;\n mimeType?: string;\n error?: string;\n} {\n const approxBytes = Math.floor((base64Data.length * 3) / 4);\n if (approxBytes > CONFIG.MAX_IMAGE_BYTES) {\n return { valid: false, error: \"Image too large\" };\n }\n if (approxBytes < 100) {\n return { valid: false, error: \"Image too small\" };\n }\n\n if (!/^[A-Za-z0-9+/]+=*$/.test(base64Data.slice(0, 200))) {\n return { valid: false, error: \"Invalid image format\" };\n }\n\n try {\n const binaryString = atob(base64Data.slice(0, 100));\n const bytes = new Uint8Array(binaryString.length);\n for (let i = 0; i < binaryString.length; i++) {\n bytes[i] = binaryString.charCodeAt(i);\n }\n\n const magic = Array.from(bytes.slice(0, 12))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n if (\n magic.startsWith(\"ffd8ffe0\") || magic.startsWith(\"ffd8ffe1\") ||\n magic.startsWith(\"ffd8ffe2\") || magic.startsWith(\"ffd8ffdb\") ||\n magic.startsWith(\"ffd8ffc0\") || magic.startsWith(\"ffd8ffc4\")\n ) {\n return { valid: true, mimeType: \"image/jpeg\" };\n }\n\n if (magic.startsWith(\"89504e470d0a1a0a\")) {\n return { valid: true, mimeType: \"image/png\" };\n }\n\n if (magic.startsWith(\"52494646\")) {\n const webpCheck = binaryString.slice(8, 12);\n if (webpCheck === \"WEBP\") {\n return { valid: true, mimeType: \"image/webp\" };\n }\n }\n\n return { valid: false, error: \"Unsupported image format\" };\n } catch {\n return { valid: false, error: \"Invalid image data\" };\n }\n}\n\n// ============================================================\n// REQUEST VALIDATION\n// ============================================================\nfunction validateRequest(body: any): {\n valid: boolean;\n action?: string;\n imageBase64?: string;\n intensity?: string;\n captchaToken?: string;\n reason?: string;\n roast?: string;\n reportType?: string;\n error?: string;\n reportedAt?: string;\n} {\n if (!body || typeof body !== \"object\") {\n return { valid: false, error: \"Invalid request\" };\n }\n\n const {\n action,\n imageBase64,\n intensity,\n captchaToken,\n reason,\n roast,\n reportType,\n error,\n reportedAt,\n } = body;\n\n if (action === \"report\") {\n const allowedReasons = [\n \"Offensive or inappropriate\",\n \"Harassment / bullying\",\n \"Hateful content\",\n \"Sexual or inappropriate content\",\n \"AI generated something unrelated\",\n \"AI generation failed\",\n \"Other\",\n ];\n\n const allowedReportTypes = [\"roast\", \"generation_failure\"];\n\n if (typeof reason !== \"string\" || !allowedReasons.includes(reason)) {\n return { valid: false, error: \"Invalid report reason\" };\n }\n\n const safeReportType =\n typeof reportType === \"string\" && allowedReportTypes.includes(reportType)\n ? reportType\n : \"roast\";\n\n if (reportedAt !== undefined) {\n if (typeof reportedAt !== \"string\" || Number.isNaN(Date.parse(reportedAt))) {\n return { valid: false, error: \"Invalid report timestamp\" };\n }\n }\n\n return {\n valid: true,\n action: \"report\",\n reason,\n reportType: safeReportType,\n roast: typeof roast === \"string\" ? roast.slice(0, 500) : \"\",\n error: typeof error === \"string\" ? error.slice(0, 500) : \"\",\n reportedAt: reportedAt || new Date().toISOString(),\n };\n }\n\n if (!imageBase64 || typeof imageBase64 !== \"string\") {\n return { valid: false, error: \"No image provided\" };\n }\n\n if (intensity && !CONFIG.ALLOWED_INTENSITIES.includes(intensity)) {\n return { valid: false, error: \"Invalid intensity level\" };\n }\n\n if (!DEV_MODE) {\n if (!captchaToken || typeof captchaToken !== \"string\") {\n return { valid: false, error: \"Verification token required\" };\n }\n }\n\n return {\n valid: true,\n action: \"roast\",\n imageBase64,\n intensity: intensity || \"Medium\",\n captchaToken,\n };\n}\n\n// ============================================================\n// GROQ RESPONSE VALIDATION\n// ============================================================\nfunction validateGroqResponse(data: any): { valid: boolean; content?: string } {\n try {\n if (!data || typeof data !== \"object\") return { valid: false };\n\n const choices = data.choices;\n if (!Array.isArray(choices) || choices.length === 0) {\n return { valid: false };\n }\n\n const message = choices[0]?.message;\n if (!message || typeof message !== \"object\") return { valid: false };\n\n const content = message.content;\n if (typeof content !== \"string\" || content.trim().length === 0) {\n return { valid: false };\n }\n\n return { valid: true, content: content.trim() };\n } catch {\n return { valid: false };\n }\n}\n\n// ============================================================\n// CONTENT MODERATION\n// ============================================================\nconst BLOCKED_WORDS = [\n \"stupid\",\n \"dumb\",\n \"ugly\",\n \"fat\",\n \"loser\",\n \"hate\",\n \"idiot\",\n \"moron\",\n \"retard\",\n \"worthless\",\n \"trash\",\n \"garbage\",\n \"pathetic\",\n \"disgusting\",\n \"kill\",\n \"die\",\n \"death\",\n \"suicide\",\n \"murder\",\n \"terrorist\",\n \"racist\",\n \"nazi\",\n \"pedophile\",\n \"rapist\",\n \"abuse\",\n \"trauma\",\n \"mental illness\",\n];\n\nconst FALLBACK_ROASTS = [\n \"You're too cool for a roast right now. Try again! 😎\",\n \"AI is speechless... but your outfit isn't! 😂\",\n \"You look like you'd survive a zombie apocalypse by being too fast! 🏃\",\n \"Your style is so unique, even AI can't roast it! ✨\",\n \"You're radiating main character energy! 🌟\",\n \"Looking sharp! Even AI can't find a flaw! 👔\",\n \"You're serving looks that AI can't compute! 💫\",\n \"Too stylish to roast! Save some for the rest of us! 🔥\",\n];\n\nfunction moderateContent(text: string): string {\n const lowerText = text.toLowerCase();\n const hasBlocked = BLOCKED_WORDS.some((word) => lowerText.includes(word));\n\n if (hasBlocked) {\n return FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n\n text = text.replace(/[^a-zA-Z0-9\\s.,!?'\"\\-()]/g, \"\");\n\n if (text.length > 300) {\n text = text.slice(0, 297) + \"...\";\n }\n\n return text;\n}\n\n// ============================================================\n// PROMPTS + SAFETY RULES\n// ============================================================\nconst INTENSITY_PROMPTS: Record = {\n Mild:\n \"Give a gentle, playful, and lighthearted roast. Keep it funny but nice. No harsh words. Focus on style, expression, or background. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Medium:\n \"Give a funny, sarcastic, and witty roast. Be humorous but not too harsh. Focus on outfit, expression, background, or pose. Keep it clever and creative. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n Savage:\n \"Give a sharp, witty, and clever roast. Be bold and creative but keep it playful. Focus on style, pose, background, or expression. Make it funny and clever, not offensive. Under 2 sentences. No profanity. No weight, race, religion, or disability mentions.\",\n};\n\nconst SAFETY_RULES = [\n \"Never mention weight, body size, or physical appearance beyond clothing/style.\",\n \"Never mention race, ethnicity, religion, or nationality.\",\n \"Never use profanity, slurs, or offensive language.\",\n \"Never mention disabilities, health conditions, or mental health.\",\n \"Never make threats, insults, or personal attacks.\",\n \"Never mention age or make age-related insults.\",\n \"Keep roasts playful, creative, and focused on style/expression/background.\",\n \"Maximum 2 sentences per roast.\",\n];\n\nfunction buildPrompt(intensity: string): string {\n const basePrompt = INTENSITY_PROMPTS[intensity] || INTENSITY_PROMPTS.Medium;\n const safetyPrompt = `IMPORTANT SAFETY RULES (must follow all):\n${SAFETY_RULES.map((rule, i) => `${i + 1}. ${rule}`).join(\"\\n\")}\n\nNow give a ${intensity} roast based on the image:`;\n\n return `${safetyPrompt}\\n\\n${basePrompt}`;\n}\n\n// ============================================================\n// MAIN HANDLER\n// ============================================================\nexport async function server(req: Request): Promise {\n const origin = req.headers.get(\"origin\");\n const corsHeaders = getCorsHeaders(origin);\n\n if (!isOriginAllowed(origin)) {\n return new Response(\n JSON.stringify({\n error: \"Unauthorized origin\",\n receivedOrigin: origin,\n }),\n {\n status: 403,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: corsHeaders });\n }\n\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({ error: \"Method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n try {\n let body;\n try {\n body = await readBodyWithLimit(req, CONFIG.MAX_REQUEST_BODY);\n } catch (error) {\n if (error.message === \"Request body too large\") {\n return new Response(\n JSON.stringify({ error: \"Request too large\" }),\n {\n status: 413,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n throw error;\n }\n\n const validation = validateRequest(body);\n console.log(\"[ROAST ME] Request received:\", {\n action: body?.action || \"roast\",\n origin,\n });\n\n if (!validation.valid) {\n return new Response(\n JSON.stringify({ error: validation.error || \"Invalid request\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n if (validation.action === \"report\") {\n const { sessionId, isNew } = getOrCreateSession(req);\n\n const report = {\n sessionId,\n reportType: validation.reportType || \"roast\",\n reason: validation.reason,\n roast: validation.roast || \"\",\n error: validation.error || \"\",\n reportedAt: validation.reportedAt || new Date().toISOString(),\n receivedAt: new Date().toISOString(),\n };\n\n console.log(\n \"🔥 ROAST ME REPORT RECEIVED:\",\n JSON.stringify(report),\n );\n\n const reportHeaders: Record = {\n \"Content-Type\": \"application/json\",\n ...corsHeaders,\n };\n\n if (isNew) {\n reportHeaders[\"Set-Cookie\"] =\n `${CONFIG.SESSION_COOKIE_NAME}=${sessionId}; ` +\n `Path=/; HttpOnly; Secure; SameSite=Strict; ` +\n `Max-Age=${CONFIG.SESSION_LIFETIME}`;\n }\n\n return new Response(\n JSON.stringify({\n success: true,\n received: true,\n message: \"Report submitted\",\n }),\n {\n status: 200,\n headers: reportHeaders,\n },\n );\n }\n\n const imageValidation = validateImage(validation.imageBase64!);\n if (!imageValidation.valid) {\n return new Response(\n JSON.stringify({ error: imageValidation.error }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const trustedIP = getTrustedIP(req);\n const { sessionId, isNew } = getOrCreateSession(req);\n const userId = `${trustedIP}:${sessionId}`;\n\n const isCaptchaValid = await validateCaptcha(\n validation.captchaToken,\n trustedIP,\n );\n\n if (!isCaptchaValid) {\n return new Response(\n JSON.stringify({\n error: \"Verification failed. Please refresh and try again.\",\n refresh: true,\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const limitResult = incrementAllLimits(userId, trustedIP);\n\n if (!limitResult.success) {\n const errorMessages: Record = {\n \"daily_limit_exceeded\": \"Daily limit reached. Come back tomorrow!\",\n \"burst_limit_exceeded\": \"Too many requests. Please wait a few minutes.\",\n \"ip_daily_limit_exceeded\": \"Too many requests from this network today.\",\n \"ip_burst_limit_exceeded\":\n \"Too many requests from this network. Please wait.\",\n \"global_limit_exceeded\":\n \"Service temporarily unavailable. Please try later.\",\n };\n\n const errorMsg = errorMessages[limitResult.errorType || \"\"] ||\n \"Rate limit exceeded\";\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n remaining: 0,\n limit: CONFIG.DAILY_LIMIT,\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const groqKey = Deno.env.get(\"GROQ_API_KEY\");\n if (!groqKey) {\n console.error(\"GROQ_API_KEY not configured\");\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const prompt = buildPrompt(validation.intensity!);\n const temperature = validation.intensity === \"Mild\"\n ? 0.7\n : validation.intensity === \"Savage\"\n ? 0.95\n : 0.85;\n\n const mimeType = imageValidation.mimeType || \"image/jpeg\";\n const imageDataUrl = `data:${mimeType};base64,${validation.imageBase64}`;\n\n const controller = new AbortController();\n const timeoutId = setTimeout(\n () => controller.abort(),\n CONFIG.REQUEST_TIMEOUT,\n );\n\n let roastText: string;\n\n try {\n // ✅ UPDATED: switched to Llama 4 Scout (vision-capable).\n // The previous model \"qwen/qwen3.6-27b\" no longer exists on Groq.\n const groqResponse = await fetch(\n \"https://api.groq.com/openai/v1/chat/completions\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${groqKey}`,\n },\n body: JSON.stringify({\n model: \"meta-llama/llama-4-scout-17b-16e-instruct\",\n messages: [\n {\n role: \"user\",\n content: [\n { type: \"text\", text: prompt },\n { type: \"image_url\", image_url: { url: imageDataUrl } },\n ],\n },\n ],\n max_tokens: 350,\n temperature: temperature,\n // NOTE: removed reasoning_effort / reasoning_format — those\n // were Qwen-specific and not valid for Llama 4.\n }),\n signal: controller.signal,\n },\n );\n\n clearTimeout(timeoutId);\n\n if (!groqResponse.ok) {\n let groqErrorBody = \"\";\n try {\n groqErrorBody = await groqResponse.text();\n } catch {\n // ignore\n }\n console.error(\n `Groq API error: ${groqResponse.status}`,\n groqErrorBody.slice(0, 1000),\n );\n\n if (groqResponse.status === 429) {\n return new Response(\n JSON.stringify({\n error: \"AI service is busy right now. Please wait a moment and try again.\",\n }),\n {\n status: 429,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n return new Response(\n JSON.stringify({\n error: \"AI service temporarily unavailable\",\n groqStatus: groqResponse.status,\n groqError: groqErrorBody.slice(0, 300),\n }),\n {\n status: groqResponse.status >= 500 ? 503 : 400,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const data = await groqResponse.json();\n\n const validated = validateGroqResponse(data);\n if (!validated.valid) {\n console.error(\n \"Invalid Groq response structure. Raw response:\",\n JSON.stringify(data).slice(0, 1500),\n );\n return new Response(\n JSON.stringify({ error: \"Service error. Please try again.\" }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n roastText = validated.content || \"No roast generated.\";\n roastText = roastText.replace(/[\\s\\S]*?<\\/think>/gi, \"\").trim();\n roastText = roastText.replace(/^think\\b[\\s\\S]*?(?=\\n\\n|$)/i, \"\").trim();\n roastText = roastText.replace(/^[\"']|[\"']$/g, \"\");\n if (!roastText) {\n roastText = FALLBACK_ROASTS[Math.floor(Math.random() * FALLBACK_ROASTS.length)];\n }\n roastText = moderateContent(roastText);\n } catch (fetchError: any) {\n clearTimeout(timeoutId);\n\n if (fetchError.name === \"AbortError\") {\n console.error(\"Groq API request timeout\");\n return new Response(\n JSON.stringify({\n error: \"AI service took too long. Please try again.\",\n }),\n {\n status: 504,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n console.error(\"Groq API request failed:\", fetchError.message);\n return new Response(\n JSON.stringify({ error: \"Service temporarily unavailable\" }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders },\n },\n );\n }\n\n const responseHeaders: Record = {\n \"Content-Type\": \"application/json\",\n ...corsHeaders,\n };\n\n if (isNew) {\n responseHeaders[\"Set-Cookie\"] =\n `${CONFIG.SESSION_COOKIE_NAME}=${sessionId}; ` +\n `Path=/; ` +\n `HttpOnly; ` +\n `Secure; ` +\n `SameSite=Strict; ` +\n `Max-Age=${CONFIG.SESSION_LIFETIME}`;\n }\n\n const remaining = CONFIG.DAILY_LIMIT - (limitResult.dailyCount || 1);\n\n return new Response(\n JSON.stringify({\n roast: roastText,\n remaining: Math.max(0, remaining),\n limit: CONFIG.DAILY_LIMIT,\n used: limitResult.dailyCount || 1,\n intensity: validation.intensity,\n }),\n { headers: responseHeaders },\n );\n } catch (error: any) {\n console.error(\"Request error:\", {\n name: error.name || \"Unknown\",\n message: error.message?.slice(0, 100) || \"No message\",\n });\n\n let status = 400;\n let errorMsg = \"Something went wrong. Please try again.\";\n\n if (error.message?.includes(\"JSON\") || error.message?.includes(\"parse\")) {\n status = 400;\n errorMsg = \"Invalid request format.\";\n } else if (error.message?.includes(\"timeout\")) {\n status = 504;\n errorMsg = \"Request timed out. Please try again.\";\n } else {\n status = 500;\n errorMsg = \"Server error. Please try again later.\";\n }\n\n return new Response(\n JSON.stringify({\n error: errorMsg,\n roast: \"Oops! Something went wrong. Give it another try! 😅\",\n }),\n {\n status: status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...getCorsHeaders(origin),\n },\n },\n );\n }\n}","createdAt",["D",1789492756356],"branchVersion","branchId","97c8f8ac-91a0-48b3-967a-808ad734d441","id","2e53e9e5-d432-4222-a56b-0b8c952cf506","eden",["D",1787576169085],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","334f0784-d0e9-4432-a964-faa31ca93082","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a033d5-1ff7-7536-80e1-e9c2c450fe63","tursoName","2e53e9e5d4324222a56b0b8c952cf506","tursoHostname","2e53e9e5d4324222a56b0b8c952cf506-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789501263826],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",66,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","edenmenberu","handle","displayName","Eden Menberu","avatar","https://lh3.googleusercontent.com/a/ACg8ocJi70p5tIzpbponvGByu7dYhpGy3Myl2QbLoLL9cEteAQBXhA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":157,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":158,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":159,"_83":160,"_85":161,"_87":25},"tree",[152],"files",[152],"counts",{"_140":62,"_141":142,"_143":62,"_144":145,"_146":147},"contents",[132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[129],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":130,"_131":-5},"4035faae-c78d-4c9b-9486-c4a798ec8fb0","reporterId",{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":136,"_13":137,"_33":34,"_35":37,"_24":25,"_138":-5,"_27":139},"79fdb264-d209-473f-b9a5-acabea8b8d34","parentId","latest",["D",1789492756356],64,"label",[28],"pulls","branches",1,"forks","envVars",{"_148":150,"_151":62},"connections",{"_148":62,"_149":62},"count","unfilledCount",3,"emptyCount",{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":153,"_13":137,"_33":34,"_35":37,"_24":25,"_138":-5,"_154":155,"_27":156},["D",1789492756356],"children",[],[28],["D",1787576169085],["D",1789501263826],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_126":195,"_196":197,"_198":199,"_200":25,"_201":25,"_202":25,"_203":58,"_204":-5,"_205":-7,"_206":-7,"_207":62,"_208":25,"_209":25,"_210":-5,"_211":25,"_212":25,"_213":25,"_214":-5},"ENV",{"_166":167,"_168":169,"_170":89,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v65