[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","enterprisebotpen","name","catalunya-bank-api","path","main.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":12,"_13":44},"permalink","https://www.val.town/x/enterprisebotpen/catalunya-bank-api/code/main.ts","extension","id","6219b370-3058-463d-9712-3aa263f6d281","fileId","bd80fc8c-a5db-11f1-bf30-1607ee4eb77e","parentId","branchId","d37bb31a-2b12-498b-a3bd-da015248c1af","branchVersion",4,"latest",true,"createdAt",["D",1788254057337],"version",3,"fileType","http","content","/**\n * Catalunya Bank - Account Balance API\n * -------------------------------------\n * Backend for the Enterprise Bot AIDA voice agent demo.\n * Runs on Val Town (free tier). No server, no deploy pipeline, no cold starts.\n *\n * Endpoints\n * POST /verifytoken - authenticate account_number + pin, return a signed token\n * GET /getbalance - return the balance for a valid token\n * GET /health - liveness check\n * GET / - human-readable demo page with the test accounts\n *\n * Database: Val Town SQLite (Turso), private to this val, seeded on first request.\n *\n * Note on tokens: the original Railway version kept issued tokens in an in-memory\n * dict. That does not survive on serverless runtimes, where the worker can shut\n * down between two tool calls. Here the token is stateless and signed (HMAC-SHA256\n * over account number + expiry), so /getbalance can verify it without shared state.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ── Config ─────────────────────────────────────────────────────────────────────\n\n// Set TOKEN_SECRET in the val's Environment Variables for a real secret.\n// The fallback keeps the demo working with zero configuration.\nconst SECRET = Deno.env.get(\"TOKEN_SECRET\") ?? \"catalunya-bank-demo-secret\";\nconst TOKEN_TTL_MS = 5 * 60 * 1000; // 5 minutes is plenty for one phone call\n\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"*\",\n};\n\nconst json = (body: unknown, status = 200) =>\n Response.json(body, { status, headers: CORS });\n\n// ── Database ───────────────────────────────────────────────────────────────────\n\nconst SEED = [\n [\"112233\", \"4821\", \"Sophie Turner\", 3245.67],\n [\"445566\", \"7734\", \"James Harrington\", 18902.50],\n [\"778899\", \"2296\", \"Elena Vasquez\", 742.18],\n];\n\nlet ready: Promise | null = null;\n\nfunction initDb(): Promise {\n ready ??= (async () => {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS accounts (\n account_number TEXT PRIMARY KEY,\n pin TEXT NOT NULL,\n customer_name TEXT NOT NULL,\n balance REAL NOT NULL,\n currency TEXT NOT NULL DEFAULT 'EUR'\n )\n `);\n // INSERT OR IGNORE keeps this idempotent, so it is safe on every request.\n await sqlite.batch(\n SEED.map(([acc, pin, name, balance]) => ({\n sql:\n \"INSERT OR IGNORE INTO accounts (account_number, pin, customer_name, balance) VALUES (?, ?, ?, ?)\",\n args: [acc, pin, name, balance],\n })),\n );\n })();\n return ready;\n}\n\n// ── Signed tokens ──────────────────────────────────────────────────────────────\n\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n\nconst unb64url = (s: string) =>\n Uint8Array.from(\n atob(s.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n\nasync function key() {\n return crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"],\n );\n}\n\nasync function issueToken(accountNumber: string): Promise {\n const payload = `${accountNumber}.${Date.now() + TOKEN_TTL_MS}`;\n const sig = await crypto.subtle.sign(\n \"HMAC\",\n await key(),\n new TextEncoder().encode(payload),\n );\n return `${b64url(new TextEncoder().encode(payload))}.${\n b64url(new Uint8Array(sig))\n }`;\n}\n\n/** Returns the account number if the token is valid and unexpired, else null. */\nasync function readToken(token: string): Promise {\n const [payloadPart, sigPart] = (token ?? \"\").split(\".\");\n if (!payloadPart || !sigPart) return null;\n\n let payload: string;\n try {\n payload = new TextDecoder().decode(unb64url(payloadPart));\n } catch {\n return null;\n }\n\n const valid = await crypto.subtle.verify(\n \"HMAC\",\n await key(),\n unb64url(sigPart),\n new TextEncoder().encode(payload),\n );\n if (!valid) return null;\n\n const [accountNumber, expiry] = payload.split(\".\");\n if (Number(expiry) < Date.now()) return null;\n return accountNumber;\n}\n\n// ── Input cleaning ─────────────────────────────────────────────────────────────\n\n/**\n * Speech-to-text often returns \"112 233\" or \"one-one-two-two-three-three\".\n * Stripping everything but digits makes the demo far more forgiving over voice.\n */\nconst digits = (v: unknown) => String(v ?? \"\").replace(/\\D/g, \"\");\n\n// ── Routes ─────────────────────────────────────────────────────────────────────\n\n/**\n * Collects parameters from wherever the caller put them: JSON body, form body,\n * or query string. Voice platforms differ in how they map tool parameters onto\n * an HTTP request, and a demo should not fail because of that choice.\n */\nasync function readParams(\n req: Request,\n url: URL,\n): Promise> {\n const params: Record = Object.fromEntries(url.searchParams);\n\n if (req.method === \"GET\" || req.method === \"HEAD\") return params;\n\n const raw = await req.text();\n if (!raw) return params;\n\n try {\n Object.assign(params, JSON.parse(raw));\n } catch {\n // Not JSON. Try form encoding before giving up.\n try {\n Object.assign(params, Object.fromEntries(new URLSearchParams(raw)));\n } catch { /* leave params as they are */ }\n }\n return params;\n}\n\nasync function verifyToken(req: Request, url: URL): Promise {\n const body = await readParams(req, url);\n\n const accountNumber = digits(\n body.account_number ?? body.accountNumber ?? body.account,\n );\n const pin = digits(body.pin ?? body.PIN);\n\n // Shows up in the val's Logs tab, which is the fastest way to see what a\n // voice platform actually sent. The PIN itself is never logged.\n console.log(\n `verifytoken: keys=[${Object.keys(body).join(\", \")}] account=${\n accountNumber || \"(empty)\"\n } pin=${pin ? \"(supplied)\" : \"(empty)\"}`,\n );\n\n const result = await sqlite.execute({\n sql:\n \"SELECT account_number, customer_name FROM accounts WHERE account_number = ? AND pin = ?\",\n args: [accountNumber, pin],\n });\n const row = result.rows[0] as {\n account_number: string;\n customer_name: string;\n } | undefined;\n\n // Deliberately a 200 with authenticated:false, not an HTTP error, so the LLM\n // reads it as a normal result and handles the failure in natural language.\n if (!row) return json({ authenticated: false });\n\n const token = await issueToken(row.account_number);\n return json({\n authenticated: true,\n token,\n auth_token: token, // the AIDA prompt has referenced both names\n customer_name: row.customer_name,\n account_number: row.account_number,\n });\n}\n\nasync function getBalance(req: Request, url: URL): Promise {\n const params = await readParams(req, url);\n const token = String(params.token ?? params.auth_token ?? \"\");\n const accountNumber = await readToken(token);\n\n console.log(\n `getbalance: keys=[${Object.keys(params).join(\", \")}] token=${\n token ? \"(supplied)\" : \"(empty)\"\n } valid=${Boolean(accountNumber)}`,\n );\n\n if (!accountNumber) {\n return json(\n { error: \"Invalid or expired token. Please authenticate again.\" },\n 401,\n );\n }\n\n const result = await sqlite.execute({\n sql:\n \"SELECT balance, currency, customer_name FROM accounts WHERE account_number = ?\",\n args: [accountNumber],\n });\n const row = result.rows[0] as\n | { balance: number; currency: string; customer_name: string }\n | undefined;\n\n if (!row) return json({ error: \"Account not found.\" }, 404);\n\n return json({\n account_number: accountNumber,\n customer_name: row.customer_name,\n balance: row.balance,\n currency: row.currency,\n });\n}\n\nasync function homePage(url: URL): Promise {\n const { rows } = await sqlite.execute(\n \"SELECT account_number, pin, customer_name, balance, currency FROM accounts ORDER BY customer_name\",\n );\n\n const tableRows = (rows as any[]).map((r) => `\n \n ${r.account_number}\n ${r.pin}\n ${r.customer_name}\n ${r.currency} ${Number(r.balance).toFixed(2)}\n `).join(\"\");\n\n return new Response(\n `\n\n\nCatalunya Bank API\n\n

Catalunya Bank — Account Balance API

Backend for the Enterprise Bot AIDA voice agent demo.

\n\n

Test accounts

\n\n \n ${tableRows}\n

Account number	PIN	Customer	Balance

\n\n

Endpoints

\n POST ${url.origin}/verifytoken
\n Body: {\"account_number\": \"112233\", \"pin\": \"4821\"}\n

\n GET ${url.origin}/getbalance?token=<token>\n

\n\n

Demo data only. Every account, PIN and balance on this page is fictitious.

`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS } },\n );\n}\n\n// ── Entry point ────────────────────────────────────────────────────────────────\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") return new Response(null, { headers: CORS });\n\n await initDb();\n const url = new URL(req.url);\n\n if (url.pathname === \"/health\") return json({ status: \"ok\" });\n\n // Methods are deliberately permissive. If a platform sends the balance\n // lookup as a POST, or the verification as a GET, it still works.\n if (url.pathname === \"/verifytoken\") return verifyToken(req, url);\n if (url.pathname === \"/getbalance\") return getBalance(req, url);\n\n if (url.pathname === \"/\") return homePage(url);\n\n return json({ error: \"Not found\" }, 404);\n}","deleted",false,"label",[14],"9ff29040-0e2c-46c3-b408-dd41bcfb6c33",["D",1788249862063],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Demo bank API for an Enterprise Bot AIDA voice agent","imageUrl","userId","837e8866-d64b-436f-b051-7cf2aa93c4c1","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05bfc-ef65-72dd-b1d4-9d976b6a7d1c","tursoName","9ff290400e2c46c3b408dd41bcfb6c33","tursoHostname","9ff290400e2c46c3b408dd41bcfb6c33-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789464074488],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":100},"org",{"_9":10,"_97":98,"_99":100,"_55":-5,"_101":102,"_103":42},"branch",{"_35":30,"_11":88,"_22":28,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":12,"_96":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","EnterprisebotPE","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/a7996bf0-5972-4ceb-1568-8cd3cfdbd401/square512?exp=1789552799&sig=7a02d3dd46f3521d631478ea79f311a706820d32b2b5e657a5993cd807395cf3","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":88,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]