[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_168":169,"_170":171},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_61":137,"_16":-7,"_138":-5,"_17":139,"_140":141,"_28":142,"_21":143,"_23":144,"_145":-5,"_146":-5,"_147":-5,"_148":35,"_149":150,"_151":38,"_152":-5,"_153":-5,"_154":155},"routes/_app.x.$handle.$name._index",{"_11":12,"_13":14,"_15":-7,"_16":-7,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-7,"_26":-5,"_27":-5,"_28":29,"_30":31,"_32":-5,"_33":-5,"_34":35,"_36":35,"_37":38},"handle","enterprisebotpen","name","catalunya-bank-api","branchName","version","project",{"_39":78,"_13":14,"_50":79,"_80":-5,"_81":35,"_82":83,"_84":83,"_85":86,"_87":-5,"_88":89,"_90":43,"_91":38,"_92":-5,"_93":-5,"_94":67,"_95":96,"_97":98,"_99":100,"_101":102,"_103":-5,"_104":105,"_106":105,"_107":108,"_109":108,"_110":108,"_111":105,"_112":105,"_113":114,"_115":116,"_117":118,"_119":35},"tags",[],"counts",{"_66":67,"_68":69,"_70":67,"_71":72,"_73":74},"contents",[63],"readme","upstream","pull","files",[31],"preview",{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":51,"_16":52,"_53":54,"_55":56,"_57":35,"_58":14,"_59":60,"_61":62},"ahead","behind","showHomeCustomizationHint",false,"showHTTPPreviewSettingsHint","hasHTTPFiles",true,"id","6219b370-3058-463d-9712-3aa263f6d281","main.ts","fileId","bd80fc8c-a5db-11f1-bf30-1607ee4eb77e","parentId","branchId","d37bb31a-2b12-498b-a3bd-da015248c1af","branchVersion",4,"latest","createdAt",["D",1788254057337],3,"fileType","http","content","/**\n * Catalunya Bank - Account Balance API\n * -------------------------------------\n * Backend for the Enterprise Bot AIDA voice agent demo.\n * Runs on Val Town (free tier). No server, no deploy pipeline, no cold starts.\n *\n * Endpoints\n * POST /verifytoken - authenticate account_number + pin, return a signed token\n * GET /getbalance - return the balance for a valid token\n * GET /health - liveness check\n * GET / - human-readable demo page with the test accounts\n *\n * Database: Val Town SQLite (Turso), private to this val, seeded on first request.\n *\n * Note on tokens: the original Railway version kept issued tokens in an in-memory\n * dict. That does not survive on serverless runtimes, where the worker can shut\n * down between two tool calls. Here the token is stateless and signed (HMAC-SHA256\n * over account number + expiry), so /getbalance can verify it without shared state.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ── Config ─────────────────────────────────────────────────────────────────────\n\n// Set TOKEN_SECRET in the val's Environment Variables for a real secret.\n// The fallback keeps the demo working with zero configuration.\nconst SECRET = Deno.env.get(\"TOKEN_SECRET\") ?? \"catalunya-bank-demo-secret\";\nconst TOKEN_TTL_MS = 5 * 60 * 1000; // 5 minutes is plenty for one phone call\n\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"*\",\n};\n\nconst json = (body: unknown, status = 200) =>\n Response.json(body, { status, headers: CORS });\n\n// ── Database ───────────────────────────────────────────────────────────────────\n\nconst SEED = [\n [\"112233\", \"4821\", \"Sophie Turner\", 3245.67],\n [\"445566\", \"7734\", \"James Harrington\", 18902.50],\n [\"778899\", \"2296\", \"Elena Vasquez\", 742.18],\n];\n\nlet ready: Promise | null = null;\n\nfunction initDb(): Promise {\n ready ??= (async () => {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS accounts (\n account_number TEXT PRIMARY KEY,\n pin TEXT NOT NULL,\n customer_name TEXT NOT NULL,\n balance REAL NOT NULL,\n currency TEXT NOT NULL DEFAULT 'EUR'\n )\n `);\n // INSERT OR IGNORE keeps this idempotent, so it is safe on every request.\n await sqlite.batch(\n SEED.map(([acc, pin, name, balance]) => ({\n sql:\n \"INSERT OR IGNORE INTO accounts (account_number, pin, customer_name, balance) VALUES (?, ?, ?, ?)\",\n args: [acc, pin, name, balance],\n })),\n );\n })();\n return ready;\n}\n\n// ── Signed tokens ──────────────────────────────────────────────────────────────\n\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n\nconst unb64url = (s: string) =>\n Uint8Array.from(\n atob(s.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n\nasync function key() {\n return crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"],\n );\n}\n\nasync function issueToken(accountNumber: string): Promise {\n const payload = `${accountNumber}.${Date.now() + TOKEN_TTL_MS}`;\n const sig = await crypto.subtle.sign(\n \"HMAC\",\n await key(),\n new TextEncoder().encode(payload),\n );\n return `${b64url(new TextEncoder().encode(payload))}.${\n b64url(new Uint8Array(sig))\n }`;\n}\n\n/** Returns the account number if the token is valid and unexpired, else null. */\nasync function readToken(token: string): Promise {\n const [payloadPart, sigPart] = (token ?? \"\").split(\".\");\n if (!payloadPart || !sigPart) return null;\n\n let payload: string;\n try {\n payload = new TextDecoder().decode(unb64url(payloadPart));\n } catch {\n return null;\n }\n\n const valid = await crypto.subtle.verify(\n \"HMAC\",\n await key(),\n unb64url(sigPart),\n new TextEncoder().encode(payload),\n );\n if (!valid) return null;\n\n const [accountNumber, expiry] = payload.split(\".\");\n if (Number(expiry) < Date.now()) return null;\n return accountNumber;\n}\n\n// ── Input cleaning ─────────────────────────────────────────────────────────────\n\n/**\n * Speech-to-text often returns \"112 233\" or \"one-one-two-two-three-three\".\n * Stripping everything but digits makes the demo far more forgiving over voice.\n */\nconst digits = (v: unknown) => String(v ?? \"\").replace(/\\D/g, \"\");\n\n// ── Routes ─────────────────────────────────────────────────────────────────────\n\n/**\n * Collects parameters from wherever the caller put them: JSON body, form body,\n * or query string. Voice platforms differ in how they map tool parameters onto\n * an HTTP request, and a demo should not fail because of that choice.\n */\nasync function readParams(\n req: Request,\n url: URL,\n): Promise> {\n const params: Record = Object.fromEntries(url.searchParams);\n\n if (req.method === \"GET\" || req.method === \"HEAD\") return params;\n\n const raw = await req.text();\n if (!raw) return params;\n\n try {\n Object.assign(params, JSON.parse(raw));\n } catch {\n // Not JSON. Try form encoding before giving up.\n try {\n Object.assign(params, Object.fromEntries(new URLSearchParams(raw)));\n } catch { /* leave params as they are */ }\n }\n return params;\n}\n\nasync function verifyToken(req: Request, url: URL): Promise {\n const body = await readParams(req, url);\n\n const accountNumber = digits(\n body.account_number ?? body.accountNumber ?? body.account,\n );\n const pin = digits(body.pin ?? body.PIN);\n\n // Shows up in the val's Logs tab, which is the fastest way to see what a\n // voice platform actually sent. The PIN itself is never logged.\n console.log(\n `verifytoken: keys=[${Object.keys(body).join(\", \")}] account=${\n accountNumber || \"(empty)\"\n } pin=${pin ? \"(supplied)\" : \"(empty)\"}`,\n );\n\n const result = await sqlite.execute({\n sql:\n \"SELECT account_number, customer_name FROM accounts WHERE account_number = ? AND pin = ?\",\n args: [accountNumber, pin],\n });\n const row = result.rows[0] as {\n account_number: string;\n customer_name: string;\n } | undefined;\n\n // Deliberately a 200 with authenticated:false, not an HTTP error, so the LLM\n // reads it as a normal result and handles the failure in natural language.\n if (!row) return json({ authenticated: false });\n\n const token = await issueToken(row.account_number);\n return json({\n authenticated: true,\n token,\n auth_token: token, // the AIDA prompt has referenced both names\n customer_name: row.customer_name,\n account_number: row.account_number,\n });\n}\n\nasync function getBalance(req: Request, url: URL): Promise {\n const params = await readParams(req, url);\n const token = String(params.token ?? params.auth_token ?? \"\");\n const accountNumber = await readToken(token);\n\n console.log(\n `getbalance: keys=[${Object.keys(params).join(\", \")}] token=${\n token ? \"(supplied)\" : \"(empty)\"\n } valid=${Boolean(accountNumber)}`,\n );\n\n if (!accountNumber) {\n return json(\n { error: \"Invalid or expired token. Please authenticate again.\" },\n 401,\n );\n }\n\n const result = await sqlite.execute({\n sql:\n \"SELECT balance, currency, customer_name FROM accounts WHERE account_number = ?\",\n args: [accountNumber],\n });\n const row = result.rows[0] as\n | { balance: number; currency: string; customer_name: string }\n | undefined;\n\n if (!row) return json({ error: \"Account not found.\" }, 404);\n\n return json({\n account_number: accountNumber,\n customer_name: row.customer_name,\n balance: row.balance,\n currency: row.currency,\n });\n}\n\nasync function homePage(url: URL): Promise {\n const { rows } = await sqlite.execute(\n \"SELECT account_number, pin, customer_name, balance, currency FROM accounts ORDER BY customer_name\",\n );\n\n const tableRows = (rows as any[]).map((r) => `\n \n ${r.account_number}\n ${r.pin}\n ${r.customer_name}\n ${r.currency} ${Number(r.balance).toFixed(2)}\n `).join(\"\");\n\n return new Response(\n `\n\n\nCatalunya Bank API\n\n

Catalunya Bank — Account Balance API

Backend for the Enterprise Bot AIDA voice agent demo.

\n\n

Test accounts

\n\n \n ${tableRows}\n

Account number	PIN	Customer	Balance

\n\n

Endpoints

\n POST ${url.origin}/verifytoken
\n Body: {\"account_number\": \"112233\", \"pin\": \"4821\"}\n

\n GET ${url.origin}/getbalance?token=<token>\n

\n\n

Demo data only. Every account, PIN and balance on this page is fictitious.

`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS } },\n );\n}\n\n// ── Entry point ────────────────────────────────────────────────────────────────\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") return new Response(null, { headers: CORS });\n\n await initDb();\n const url = new URL(req.url);\n\n if (url.pathname === \"/health\") return json({ status: \"ok\" });\n\n // Methods are deliberately permissive. If a platform sends the balance\n // lookup as a POST, or the verification as a GET, it still works.\n if (url.pathname === \"/verifytoken\") return verifyToken(req, url);\n if (url.pathname === \"/getbalance\") return getBalance(req, url);\n\n if (url.pathname === \"/\") return homePage(url);\n\n return json({ error: \"Not found\" }, 404);\n}","deleted","label","children",[],"path",[41],{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":64,"_16":52,"_53":54,"_55":56,"_57":35,"_58":14,"_61":65},["D",1788254057337],[41],"pulls",0,"branches",1,"forks","envVars",{"_75":67,"_77":67},"connections",{"_75":67,"_76":67},"count","unfilledCount","emptyCount","9ff29040-0e2c-46c3-b408-dd41bcfb6c33",["D",1788249862063],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Demo bank API for an Enterprise Bot AIDA voice agent","imageUrl","userId","837e8866-d64b-436f-b051-7cf2aa93c4c1","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a05bfc-ef65-72dd-b1d4-9d976b6a7d1c","tursoName","9ff290400e2c46c3b408dd41bcfb6c33","tursoHostname","9ff290400e2c46c3b408dd41bcfb6c33-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789464074488],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_136":132},"org",{"_11":12,"_129":130,"_131":132,"_88":-5,"_133":134,"_135":35},"branch",{"_16":48,"_13":120,"_39":46,"_121":78,"_122":-5,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":14,"_128":12},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","EnterprisebotPE","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/a7996bf0-5972-4ceb-1568-8cd3cfdbd401/square512?exp=1789531199&sig=a49462a3c8201f5466a5e5dadc73b3a465f32c239e6145fb6467a8f5f05acd66","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_39":78,"_13":14,"_50":163,"_80":-5,"_81":35,"_82":83,"_84":83,"_85":86,"_87":-5,"_88":89,"_90":43,"_91":38,"_92":-5,"_93":-5,"_94":67,"_95":96,"_97":98,"_99":100,"_101":164,"_103":-5,"_104":105,"_106":105,"_107":108,"_109":108,"_110":108,"_111":105,"_112":105,"_113":165,"_115":166,"_117":167,"_119":35},"tree",[160],[160],{"_66":67,"_68":69,"_70":67,"_71":158,"_73":159},[156],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":64,"_16":52,"_53":54,"_55":56,"_57":35,"_58":14,"_61":157},[41],{"_75":67,"_77":67},{"_75":67,"_76":67},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":51,"_16":52,"_53":54,"_55":56,"_57":35,"_58":14,"_59":161,"_61":162},[],[41],["D",1788249862063],["D",1789464074488],{"_11":12,"_136":132},{"_11":12,"_129":130,"_131":132,"_88":-5,"_133":134,"_135":35},{"_16":48,"_13":120,"_39":46,"_121":78,"_122":-5,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":14,"_128":12},"ctx",{"_113":-5,"_153":201,"_202":203,"_204":205,"_206":35,"_207":35,"_208":35,"_209":38,"_210":-5,"_211":-7,"_212":-7,"_213":67,"_214":35,"_215":35,"_216":-5,"_217":35,"_218":35,"_219":35,"_220":-5},"ENV",{"_172":173,"_174":175,"_176":120,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]