[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_157":158,"_159":160},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_118":-5,"_20":119,"_22":120,"_121":122,"_123":124,"_25":125,"_24":-5,"_126":-5,"_127":-5,"_128":53,"_129":130,"_131":44,"_132":-5,"_133":-5,"_134":135},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","klhearn74","name","claudeproxy","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":81,"_82":83,"_84":85,"_86":-5,"_87":88,"_89":88,"_90":91,"_92":91,"_93":91,"_94":88,"_95":88,"_96":97,"_98":99,"_100":101,"_102":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","500d7d76-f747-41c7-b7ae-1bbe32513284","main.ts","fileId","d5ae17d6-64fe-11f1-a8a2-1607ee4eb77e","parentId","branchId","6699b953-0f3e-4421-800e-14fa2a44ff3b","branchVersion",15,"latest",true,"createdAt",["D",1784649488589],13,"fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n \n// One-time table setup — safe to run on every request, only creates the tables if missing.\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS redemption_codes (\n code TEXT PRIMARY KEY,\n credits INTEGER NOT NULL,\n used INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL,\n used_at TEXT\n)`);\n \nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS free_credit_claims (\n ip TEXT PRIMARY KEY,\n claimed_at TEXT NOT NULL\n)`);\n \nfunction getClientIp(req: Request): string {\n const fwd = req.headers.get(\"x-forwarded-for\");\n if (fwd) return fwd.split(\",\")[0].trim();\n return req.headers.get(\"x-real-ip\") || \"unknown\";\n}\n \nexport default async function handler(req: Request): Promise {\n const corsHeaders = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-ResumeFit-Key\",\n };\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders });\n }\n \n const url = new URL(req.url);\n const ADMIN_KEY = Deno.env.get(\"RESUMEFIT_ADMIN_KEY\") || \"\";\n // Shared secret that only resume-builder.html and the batch tester know.\n // This does NOT make the proxy uncrackable (it's visible to anyone who reads\n // the frontend's JS source) — it just blocks casual/automated discovery of\n // the bare proxy URL, which is the realistic risk at this stage.\n const REQUEST_KEY = Deno.env.get(\"RESUMEFIT_REQUEST_KEY\") || \"\";\n \n // ── ADMIN: generate a one-time support code (unchanged, own key) ─────\n if (req.method === \"GET\" && url.searchParams.get(\"admin_key\")) {\n if (!ADMIN_KEY || url.searchParams.get(\"admin_key\") !== ADMIN_KEY) {\n return new Response(JSON.stringify({ error: \"Invalid admin key.\" }), {\n status: 403, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n const credits = parseInt(url.searchParams.get(\"generate_code\") || \"0\");\n if (!credits || credits <= 0) {\n return new Response(JSON.stringify({ error: \"Add &generate_code=5 (or 10) to the URL.\" }), {\n status: 400, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n const code = \"SUPPORT-\" + crypto.randomUUID().slice(0, 8).toUpperCase();\n await sqlite.execute(\n \"INSERT INTO redemption_codes (code, credits, used, created_at) VALUES (?, ?, 0, ?)\",\n [code, credits, new Date().toISOString()]\n );\n return new Response(\n `\n

New one-time code generated

${code}

Grants ${credits} credits. Works exactly once. Give this to the customer — don't reuse it yourself.

\n `,\n { status: 200, headers: { ...corsHeaders, \"Content-Type\": \"text/html\" } }\n );\n }\n \n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ error: \"Use POST.\" }), {\n status: 405, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n \n // ── Request-secret gate — applies to EVERY POST action below ─────────\n // If RESUMEFIT_REQUEST_KEY isn't set as an env var yet, this check is\n // skipped (so nothing breaks mid-rollout) — but it should be set before\n // any public launch.\n if (REQUEST_KEY) {\n const provided = req.headers.get(\"x-resumefit-key\") || \"\";\n if (provided !== REQUEST_KEY) {\n return new Response(JSON.stringify({ error: \"Unauthorized.\" }), {\n status: 401, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n }\n \n const apiKey = Deno.env.get(\"ANTHROPIC_API_KEY\");\n if (!apiKey) {\n return new Response(JSON.stringify({ error: \"ANTHROPIC_API_KEY is not set\" }), {\n status: 500, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n \n try {\n const body = await req.json();\n \n // ── Redeem a one-time support code ──────────────────────────────────\n if (body.action === \"redeem_code\") {\n const code = String(body.code || \"\").trim().toUpperCase();\n if (!code) {\n return new Response(JSON.stringify({ success: false, error: \"Please enter a code.\" }), {\n status: 200, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n const rows = await sqlite.execute(\"SELECT credits, used FROM redemption_codes WHERE code = ?\", [code]);\n if (rows.rows.length === 0) {\n return new Response(JSON.stringify({ success: false, error: \"Invalid code. Please check and try again.\" }), {\n status: 200, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n const row: any = rows.rows[0];\n if (Number(row.used)) {\n return new Response(JSON.stringify({ success: false, error: \"This code has already been used.\" }), {\n status: 200, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n await sqlite.execute(\n \"UPDATE redemption_codes SET used = 1, used_at = ? WHERE code = ?\",\n [new Date().toISOString(), code]\n );\n return new Response(JSON.stringify({ success: true, credits: Number(row.credits) }), {\n status: 200, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n \n // ── Free-credit gate — one per network address ───────────────────────\n if (body.action === \"claim_free_credit\") {\n const ip = getClientIp(req);\n const existing = await sqlite.execute(\"SELECT ip FROM free_credit_claims WHERE ip = ?\", [ip]);\n if (existing.rows.length > 0) {\n return new Response(JSON.stringify({ granted: false }), {\n status: 200, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n await sqlite.execute(\n \"INSERT INTO free_credit_claims (ip, claimed_at) VALUES (?, ?)\",\n [ip, new Date().toISOString()]\n );\n return new Response(JSON.stringify({ granted: true }), {\n status: 200, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n \n // ── Page-fetch passthrough (unchanged) ────────────────────────────────\n if (body.fetch_url) {\n const pageRes = await fetch(body.fetch_url, {\n headers: { \"User-Agent\": \"Mozilla/5.0 (compatible; ResumeAI/1.0)\" }\n });\n const html = await pageRes.text();\n const text = html\n .replace(/]*>[\\s\\S]*?<\\/script>/gi, '')\n .replace(/]*>[\\s\\S]*?<\\/style>/gi, '')\n .replace(/<[^>]+>/g, ' ')\n .replace(/\\s+/g, ' ')\n .trim()\n .slice(0, 8000);\n return new Response(JSON.stringify({ text }), {\n status: 200, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n \n // ── Normal Anthropic API passthrough (unchanged) ──────────────────────\n const response = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-api-key\": apiKey,\n \"anthropic-version\": \"2023-06-01\",\n },\n body: JSON.stringify(body),\n });\n const data = await response.json();\n return new Response(JSON.stringify(data), {\n status: response.status,\n headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: String(err) }), {\n status: 500, headers: { ...corsHeaders, \"Content-Type\": \"application/json\" }\n });\n }\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1784649488589],"children",[],[35],"f9b2de14-9c17-4b0a-8886-7e38d782ead7",["D",1781118109437],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","217a39d1-8e1f-4084-a733-3accee59bd50","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019eb2e4-3d2f-70f8-bae7-009b433efbb0","tursoName","f9b2de149c174b0a88867e38d782ead7","tursoHostname","f9b2de149c174b0a88867e38d782ead7-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789515657103],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_117":19},"org",{"_11":12,"_112":19,"_113":19,"_70":71,"_114":115,"_116":53},"branch",{"_17":103,"_13":16,"_33":40,"_104":61,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":14,"_111":12},"isOwned",16,"projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":152,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":81,"_82":83,"_84":153,"_86":-5,"_87":88,"_89":88,"_90":91,"_92":91,"_93":91,"_94":88,"_95":88,"_96":154,"_98":155,"_100":156,"_102":53},[149],"files",[149],"counts",{"_138":77,"_139":140,"_141":77,"_31":142,"_143":144},[136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":137},[35],"pulls","branches",1,"forks",{"_145":147,"_148":77},"connections",{"_145":77,"_146":77},"count","unfilledCount",3,"emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":150,"_18":151},[],[35],["D",1781118109437],["D",1789515657103],{"_11":12,"_117":19},{"_11":12,"_112":19,"_113":19,"_70":71,"_114":115,"_116":53},{"_17":103,"_13":16,"_33":40,"_104":61,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":14,"_111":12},"ctx",{"_96":-5,"_133":190,"_191":192,"_193":194,"_195":53,"_196":53,"_197":53,"_198":44,"_199":-5,"_200":-7,"_201":-7,"_202":77,"_203":53,"_204":53,"_205":-5,"_206":53,"_207":53,"_208":53,"_209":-5},"ENV",{"_161":162,"_163":164,"_165":16,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code