[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_185":186,"_187":188},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_104":85,"_27":105,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":122,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",5,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","interactions.ts","latestPath","fileId","c3c02790-5931-11f1-8c50-ee650bb23af1","name","fileType","http","content","// placeholder","import { Hono } from \"npm:hono@4.12.0\";\nimport { verifyDiscordSignature } from \"./lib/verify.ts\";\nimport {\n buildInviteUrl,\n PING_COMMANDS,\n registerCommands,\n setInteractionsEndpoint,\n} from \"./lib/discord.ts\";\n\nconst app = new Hono();\n\n// Discord interaction type constants\n// https://discord.com/developers/docs/interactions/receiving-and-responding#interaction-object-interaction-type\nconst PING = 1;\nconst APPLICATION_COMMAND = 2;\nconst PONG = 1;\nconst CHANNEL_MESSAGE_WITH_SOURCE = 4;\n\n// ─── Setup landing page ──────────────────────────────────────────────────────\n// Shows what env vars still need to be set and gives copy-pasteable curl\n// commands for the admin /setup endpoint. AGENTS.md drives this same flow\n// from Claude Code; the page exists for the manual path.\n\napp.get(\"/\", (c) => {\n const origin = new URL(c.req.url).origin;\n const interactionsUrl = `${origin}/interactions`;\n const setupUrl = `${origin}/setup`;\n const appId = Deno.env.get(\"DISCORD_APP_ID\");\n const publicKey = Deno.env.get(\"DISCORD_PUBLIC_KEY\");\n const botToken = Deno.env.get(\"DISCORD_BOT_TOKEN\");\n const inviteUrl = appId ? buildInviteUrl(appId) : null;\n const check = (v: string | undefined) => v ? \"✅\" : \"❌\";\n\n return c.html(/* html */ `\nDiscord /ping bot\n\n

Discord `/ping` bot

A minimal Discord bot on Val Town. Have Claude Code? Tell it \"set up this discord bot\" and let AGENTS.md drive — it handles every step below for you.

\n\n

Manual setup

Create the Discord app. Open Discord Developer Portal → New Application. Name it, accept terms, create.
Set 3 env vars in this val's environment variables:\n
- ${check(appId)} DISCORD_APP_ID — General Information → Application ID
- ${check(publicKey)} DISCORD_PUBLIC_KEY — General Information → Public Key
- ${check(botToken)} DISCORD_BOT_TOKEN — Bot tab → Reset Token (shown once, copy now)
\n
Run setup — registers the /ping command and tells Discord to send interactions here:\n
```
curl -X POST ${setupUrl} \\\\\n  -H \"Authorization: Bot <DISCORD_BOT_TOKEN>\"
```
\n
Invite the bot. ${\n inviteUrl\n ? `Open invite URL →`\n : \"(set DISCORD_APP_ID first)\"\n }
Try it. In any channel of the server you invited it to, type /ping. Bot replies Pong!

\n\n

Prefer to set the endpoint manually?

Skip step 3 and paste this URL into the portal at General Information → Interactions Endpoint URL:

${interactionsUrl}

Then register the slash command yourself by calling Discord's PUT /applications/{id}/commands API.

\n`);\n});\n\n// ─── Discord interactions webhook ────────────────────────────────────────────\n// Discord POSTs every interaction here. PING (type 1) is the endpoint-validation\n// handshake — we MUST reply PONG within a few seconds or Discord rejects the\n// endpoint URL. The ed25519 signature on the raw body proves the request came\n// from Discord (verified with DISCORD_PUBLIC_KEY).\n\napp.post(\"/interactions\", async (c) => {\n const publicKey = Deno.env.get(\"DISCORD_PUBLIC_KEY\");\n if (!publicKey) {\n console.error(\"[Interactions] DISCORD_PUBLIC_KEY not set\");\n return new Response(\"Bot not configured\", { status: 500 });\n }\n\n const signature = c.req.header(\"X-Signature-Ed25519\") ?? \"\";\n const timestamp = c.req.header(\"X-Signature-Timestamp\") ?? \"\";\n const body = await c.req.text();\n\n const valid = await verifyDiscordSignature({\n publicKey,\n signature,\n timestamp,\n body,\n });\n if (!valid) {\n return new Response(\"Invalid request signature\", { status: 401 });\n }\n\n const payload = JSON.parse(body);\n\n if (payload.type === PING) {\n console.log(\"[Interactions] PING → PONG\");\n return c.json({ type: PONG });\n }\n\n if (payload.type === APPLICATION_COMMAND) {\n const name = payload.data?.name;\n console.log(`[Interactions] /${name}`);\n if (name === \"ping\") {\n return c.json({\n type: CHANNEL_MESSAGE_WITH_SOURCE,\n data: { content: \"Pong!\" },\n });\n }\n return c.json({\n type: CHANNEL_MESSAGE_WITH_SOURCE,\n data: { content: `Unknown command: ${name}` },\n });\n }\n\n console.warn(`[Interactions] Unhandled type: ${payload.type}`);\n return c.json({ error: \"Unhandled interaction type\" }, 400);\n});\n\n// ─── Admin: one-shot setup ───────────────────────────────────────────────────\n// Registers slash commands AND sets Discord's interactions endpoint URL to\n// point at this val. Idempotent — safe to re-run. Gated by the bot token so\n// random callers can't make us hit Discord's API on their behalf.\n\napp.post(\"/setup\", async (c) => {\n const expectedToken = Deno.env.get(\"DISCORD_BOT_TOKEN\");\n if (!expectedToken) {\n return c.json({ ok: false, error: \"DISCORD_BOT_TOKEN not set\" }, 500);\n }\n const provided = (c.req.header(\"Authorization\") ?? \"\").replace(/^Bot\\s+/i, \"\");\n if (provided !== expectedToken) {\n return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n }\n\n const appId = Deno.env.get(\"DISCORD_APP_ID\");\n const publicKey = Deno.env.get(\"DISCORD_PUBLIC_KEY\");\n if (!appId) return c.json({ ok: false, error: \"DISCORD_APP_ID not set\" }, 500);\n if (!publicKey) {\n return c.json({\n ok: false,\n error:\n \"DISCORD_PUBLIC_KEY not set — Discord's endpoint validation PING will fail without it\",\n }, 500);\n }\n\n const interactionsUrl = `${new URL(c.req.url).origin}/interactions`;\n\n // 1) Register /ping\n const regRes = await registerCommands({\n appId,\n botToken: expectedToken,\n commands: PING_COMMANDS,\n });\n const regBody = await regRes.text();\n if (!regRes.ok) {\n return c.json({\n ok: false,\n step: \"register-commands\",\n status: regRes.status,\n detail: tryJson(regBody),\n }, 500);\n }\n\n // 2) Tell Discord to POST interactions here. Discord will PING this val\n // synchronously to validate; the call only returns 200 if our /interactions\n // handler correctly verified the signature and replied PONG.\n const epRes = await setInteractionsEndpoint({\n botToken: expectedToken,\n url: interactionsUrl,\n });\n const epBody = await epRes.text();\n if (!epRes.ok) {\n return c.json({\n ok: false,\n step: \"set-endpoint\",\n status: epRes.status,\n detail: tryJson(epBody),\n hint:\n \"If status is 400 with an endpoint validation error, DISCORD_PUBLIC_KEY is probably wrong — re-copy it from Discord's portal.\",\n }, 500);\n }\n\n return c.json({\n ok: true,\n registered: PING_COMMANDS.map((cmd) => cmd.name),\n interactionsUrl,\n inviteUrl: buildInviteUrl(appId),\n });\n});\n\nfunction tryJson(s: string): unknown {\n try {\n return JSON.parse(s);\n } catch {\n return s;\n }\n}\n\nexport default app.fetch;\n","createdAt",["D",1779820732351],"branchVersion","branchId","c3bd02b8-5931-11f1-8c50-ee650bb23af1","id","c3bc12b8-5931-11f1-8c50-ee650bb23af1","discord-bot",["D",1779820569734],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Discord /ping bot quickstart — interactions over HTTP","imageUrl","9319c175-2593-4f88-ba21-04f2ef7b1c28","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","d663a026-6449-42f6-9156-1d4a2d64d38c","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_103":99},"org",{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned",7,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","dcm31","handle","displayName","Charlie","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/3e904faa-3764-4629-c475-f561a49b0000/square512?exp=1789552799&sig=9e2f7c6ad81bfe0a417f4ee593a56f46019d3f18deb24441c667547de12b5000","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":181,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":182,"_79":183,"_81":184,"_83":25},"tree",[153,156],"files",[153,154,155,156],"counts",{"_143":61,"_144":133,"_145":133,"_146":147,"_148":149},"contents",[127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":136,"_32":137,"_30":138,"_130":-5,"_41":42,"_40":139,"_131":122,"_38":140,"_13":61,"_33":141,"_35":-5,"_24":25,"_134":-5,"_27":142},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":122,"_38":132,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_27":135},"24ad5082-5932-11f1-910a-ee650bb23af1","parentId","latest",["D",1779820732351],1,"label",[28],"f6b334e4-5931-11f1-a761-ee650bb23af1","lib","f6b33598-5931-11f1-a761-ee650bb23af1",2,["D",1779820655233],"directory",[137],"pulls","branches","forks","envVars",{"_150":61,"_152":61},"connections",{"_150":61,"_151":61},"count","unfilledCount","emptyCount",{"_43":136,"_32":137,"_30":138,"_130":-5,"_41":42,"_40":139,"_131":122,"_38":178,"_13":61,"_33":141,"_35":-5,"_24":25,"_134":-5,"_158":179,"_27":180},{"_43":170,"_32":171,"_30":172,"_130":138,"_41":42,"_40":173,"_131":122,"_38":174,"_13":61,"_33":166,"_35":175,"_24":25,"_134":-5,"_158":176,"_27":177},{"_43":161,"_32":162,"_30":163,"_130":138,"_41":42,"_40":164,"_131":122,"_38":165,"_13":61,"_33":166,"_35":167,"_24":25,"_134":-5,"_158":168,"_27":169},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":122,"_38":157,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_158":159,"_27":160},["D",1779820732351],"children",[],[28],"fe4864e0-5931-11f1-bec7-ee650bb23af1","verify.ts","fe48658a-5931-11f1-bec7-ee650bb23af1",3,["D",1779820667952],"script","// Verify Discord's ed25519 signature on incoming interaction webhooks.\n// Discord signs (timestamp + raw body) with the app's private key — we verify\n// with the app's public key (set as DISCORD_PUBLIC_KEY env var). Deno's Web\n// Crypto natively supports Ed25519, so no npm dependency needed.\n// https://discord.com/developers/docs/interactions/receiving-and-responding#security-and-authorization\n\nfunction hexToBytes(hex: string): Uint8Array {\n const bytes = new Uint8Array(hex.length / 2);\n for (let i = 0; i < bytes.length; i++) {\n bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n return bytes;\n}\n\nlet cachedKey: CryptoKey | null = null;\nlet cachedKeyHex: string | null = null;\n\nasync function getKey(publicKeyHex: string): Promise {\n if (cachedKey && cachedKeyHex === publicKeyHex) return cachedKey;\n const key = await crypto.subtle.importKey(\n \"raw\",\n hexToBytes(publicKeyHex),\n \"Ed25519\",\n false,\n [\"verify\"],\n );\n cachedKey = key;\n cachedKeyHex = publicKeyHex;\n return key;\n}\n\nexport async function verifyDiscordSignature(args: {\n publicKey: string;\n signature: string;\n timestamp: string;\n body: string;\n}): Promise {\n const { publicKey, signature, timestamp, body } = args;\n if (!signature || !timestamp) return false;\n try {\n const key = await getKey(publicKey);\n const message = new TextEncoder().encode(timestamp + body);\n return await crypto.subtle.verify(\n \"Ed25519\",\n key,\n hexToBytes(signature),\n message,\n );\n } catch {\n return false;\n }\n}\n",[],[137,162],"07e912ba-5932-11f1-acdb-ee650bb23af1","discord.ts","07e91378-5932-11f1-acdb-ee650bb23af1",4,["D",1779820684077],"// Thin wrappers around the Discord REST API calls we need for setup.\n// Docs: https://discord.com/developers/docs/reference\n\nconst API = \"https://discord.com/api/v10\";\n\nexport const PING_COMMANDS = [\n { name: \"ping\", description: \"Replies with pong\", type: 1 },\n];\n\n// Bulk-overwrite this app's global slash commands. Idempotent — safe to retry.\n// https://discord.com/developers/docs/interactions/application-commands#bulk-overwrite-global-application-commands\nexport async function registerCommands(args: {\n appId: string;\n botToken: string;\n commands: unknown[];\n}): Promise {\n return fetch(`${API}/applications/${args.appId}/commands`, {\n method: \"PUT\",\n headers: {\n \"Authorization\": `Bot ${args.botToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(args.commands),\n });\n}\n\n// Set the URL Discord POSTs interactions to. Discord PINGs the URL during this\n// call to validate the endpoint — the URL must be reachable AND respond to a\n// signed PING with PONG before this call returns success.\n// https://discord.com/developers/docs/resources/application#edit-current-application\nexport async function setInteractionsEndpoint(args: {\n botToken: string;\n url: string;\n}): Promise {\n return fetch(`${API}/applications/@me`, {\n method: \"PATCH\",\n headers: {\n \"Authorization\": `Bot ${args.botToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ interactions_endpoint_url: args.url }),\n });\n}\n\n// `applications.commands` is the minimum needed for slash commands; `bot` makes\n// the bot show as a server member. `permissions=0` requests no extra perms\n// beyond what slash commands grant.\nexport function buildInviteUrl(appId: string): string {\n const params = new URLSearchParams({\n client_id: appId,\n scope: \"applications.commands bot\",\n permissions: \"0\",\n });\n return `https://discord.com/oauth2/authorize?${params.toString()}`;\n}\n",[],[137,171],["D",1779820655233],[154,155],[137],["D",1779820569734],{"_95":94,"_103":99},{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"ctx",{"_77":-5,"_124":218,"_219":220,"_221":222,"_223":25,"_224":25,"_225":25,"_226":122,"_227":-5,"_228":-7,"_229":-7,"_230":61,"_231":25,"_232":25,"_233":-5,"_234":25,"_235":25,"_236":25,"_237":-5},"ENV",{"_189":190,"_191":192,"_193":85,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v5