[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_179":180,"_181":182},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_136":-5,"_20":137,"_22":138,"_139":140,"_141":142,"_26":143,"_24":144,"_145":-5,"_146":-5,"_147":65,"_148":149,"_150":59,"_151":-5,"_152":-5,"_153":154},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","maxstaley","name","RotOverUnder","branchName","main","version","path","cors-proxy.ts.ts","project",{"_33":81,"_13":14,"_45":82,"_83":-5,"_84":65,"_85":86,"_87":86,"_88":89,"_90":-5,"_91":92,"_93":71,"_94":59,"_95":-5,"_96":-5,"_97":98,"_99":100,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":106,"_107":106,"_108":109,"_110":109,"_111":109,"_112":106,"_113":106,"_114":115,"_116":117,"_118":119,"_120":65},"tree",[51,52,53],"file",{"_33":34,"_35":36,"_37":38,"_13":19,"_39":40,"_41":42,"_17":43,"_44":-5,"_45":46,"_47":48,"_49":-5,"_18":50},"contents",[],"upstream","pull","ahead","behind","envVars","id","1638696e-1f87-4fd1-a62f-b795c7883e5d","branchId","87d2290e-f3dd-47cc-9fdb-608732da11e3","fileId","84b6db3a-ad27-11f1-89aa-1607ee4eb77e","content","// RotoWire CORS proxy -- lets the Yardage Props widget's live data fetches\n// (fetchJSON/fetchText, see RW_PROXY in the widget source) work when the\n// widget is hosted off rotowire.com (e.g. this Val Town project), since\n// rotowire.com's own endpoints send no Access-Control-Allow-Origin header\n// (confirmed live) and browsers silently block the cross-origin fetch\n// without this. Fetching server-side here isn't subject to CORS at all\n// (CORS is a browser-enforced rule between browser and server, not a\n// server-to-server restriction), so this just re-serves RotoWire's response\n// with permissive CORS headers added -- same data, same shape, nothing\n// transformed.\n//\n// Usage from the widget: fetch(`${RW_PROXY}?path=${encodeURIComponent(pathAndQuery)}`)\n// where pathAndQuery is exactly what would normally follow rotowire.com,\n// e.g. \"/football/tables/projections-ceil-floor-weekly.php?pos=WR&week=1&ceilFloor=C\".\n//\n// Locked to RotoWire's own data-table/betting paths only (see ALLOWED_PREFIXES)\n// so this can't be abused as a general-purpose open proxy.\n\nconst CORS_HEADERS: Record = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"*\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\nconst ALLOWED_PREFIXES = [\n \"/betting/nfl/\",\n \"/football/tables/\",\n];\n\nfunction jsonError(status: number, message: string): Response {\n return new Response(JSON.stringify({ error: message }), {\n status,\n headers: {\n ...CORS_HEADERS,\n \"content-type\": \"application/json; charset=utf-8\",\n },\n });\n}\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS_HEADERS });\n }\n\n if (req.method !== \"GET\") {\n return jsonError(405, \"only GET is supported\");\n }\n\n const reqUrl = new URL(req.url);\n const path = reqUrl.searchParams.get(\"path\");\n\n if (!path || !path.startsWith(\"/\")) {\n return jsonError(\n 400,\n \"missing or invalid 'path' query param -- must be a path like /football/tables/....php?...\",\n );\n }\n\n if (!ALLOWED_PREFIXES.some((p) => path.startsWith(p))) {\n return jsonError(\n 403,\n \"path not allowed -- this proxy only forwards RotoWire's football data-table and betting endpoints\",\n );\n }\n\n const target = \"https://www.rotowire.com\" + path;\n\n let upstream: Response;\n try {\n upstream = await fetch(target, {\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (compatible; RotoWireYardagePropsProxy/1.0; +https://www.rotowire.com)\",\n },\n });\n } catch (e) {\n return jsonError(502, \"upstream fetch failed: \" + String(e));\n }\n\n const body = await upstream.text();\n const contentType = upstream.headers.get(\"content-type\") ||\n \"text/plain; charset=utf-8\";\n\n return new Response(body, {\n status: upstream.status,\n headers: {\n ...CORS_HEADERS,\n \"content-type\": contentType,\n },\n });\n}","fileType","http",3,"parentId","createdAt",["D",1789054509087],"branchVersion",13,"label",[19],{"_33":34,"_13":19,"_37":38,"_44":-5,"_35":36,"_47":48,"_58":59,"_45":78,"_17":43,"_41":42,"_39":40,"_64":65,"_49":-5,"_66":79,"_18":80},{"_33":69,"_13":70,"_37":71,"_44":-5,"_35":36,"_47":72,"_58":59,"_45":73,"_17":74,"_41":42,"_39":75,"_64":65,"_49":-5,"_66":76,"_18":77},{"_33":54,"_13":55,"_37":56,"_44":-5,"_35":36,"_47":57,"_58":59,"_45":60,"_17":61,"_41":62,"_39":63,"_64":65,"_49":-5,"_66":67,"_18":68},"63b6f448-405d-4dec-aa07-39ce9a6cb650","main.ts","d5f2580a-ad20-11f1-a28b-1607ee4eb77e",2,"latest",true,["D",1789049532924],1,"script","// RotoWire Patriots vs. Seahawks Prop Bets -- standalone hosted page\n// Served as-is so the CMS can embed it via a plain