<?php

// === WEVAL SECRETS LOADER ===
$_WEVAL_SECRETS = [];
if (file_exists('/etc/weval/secrets.env')) {
    foreach (file('/etc/weval/secrets.env', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
        if (strpos($line, '#') === 0) continue;
        if (strpos($line, '=') !== false) {
            list($k, $v) = explode('=', $line, 2);
            $_WEVAL_SECRETS[trim($k)] = trim($v);
        }
    }
}
function weval_secret($key, $default='') {
    global $_WEVAL_SECRETS;
    return $_WEVAL_SECRETS[$key] ?? getenv($key) ?: $default;
}

header("Content-Type: application/json");
header("Access-Control-Allow-Origin: *");
$KEY=weval_secret('DROID_KEY','DROID2026');
if(($_POST["k"]??$_GET["k"]??"")!==$KEY){echo json_encode(["error"=>"Unauthorized"]);exit;}
$action=$_POST["action"]??$_GET["action"]??"chat";
$message=$_POST["message"]??"";
$session=$_POST["session"]??"default";