[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_159":160,"_161":162},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",3,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":37,"_35":36,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","bd80fc8c-a5db-11f1-bf30-1607ee4eb77e","name","fileType","script","content","/**\n * Catalunya Bank - Account Balance API\n * -------------------------------------\n * Backend for the Enterprise Bot AIDA voice agent demo.\n * Runs on Val Town (free tier). No server, no deploy pipeline, no cold starts.\n *\n * Endpoints\n * POST /verifytoken - authenticate account_number + pin, return a signed token\n * GET /getbalance - return the balance for a valid token\n * GET /health - liveness check\n * GET / - human-readable demo page with the test accounts\n *\n * Database: Val Town SQLite (Turso), private to this val, seeded on first request.\n *\n * Note on tokens: the original Railway version kept issued tokens in an in-memory\n * dict. That does not survive on serverless runtimes, where the worker can shut\n * down between two tool calls. Here the token is stateless and signed (HMAC-SHA256\n * over account number + expiry), so /getbalance can verify it without shared state.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ── Config ─────────────────────────────────────────────────────────────────────\n\n// Set TOKEN_SECRET in the val's Environment Variables for a real secret.\n// The fallback keeps the demo working with zero configuration.\nconst SECRET = Deno.env.get(\"TOKEN_SECRET\") ?? \"catalunya-bank-demo-secret\";\nconst TOKEN_TTL_MS = 5 * 60 * 1000; // 5 minutes is plenty for one phone call\n\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"*\",\n};\n\nconst json = (body: unknown, status = 200) =>\n Response.json(body, { status, headers: CORS });\n\n// ── Database ───────────────────────────────────────────────────────────────────\n\nconst SEED = [\n [\"112233\", \"4821\", \"Sophie Turner\", 3245.67],\n [\"445566\", \"7734\", \"James Harrington\", 18902.50],\n [\"778899\", \"2296\", \"Elena Vasquez\", 742.18],\n];\n\nlet ready: Promise | null = null;\n\nfunction initDb(): Promise {\n ready ??= (async () => {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS accounts (\n account_number TEXT PRIMARY KEY,\n pin TEXT NOT NULL,\n customer_name TEXT NOT NULL,\n balance REAL NOT NULL,\n currency TEXT NOT NULL DEFAULT 'EUR'\n )\n `);\n // INSERT OR IGNORE keeps this idempotent, so it is safe on every request.\n await sqlite.batch(\n SEED.map(([acc, pin, name, balance]) => ({\n sql:\n \"INSERT OR IGNORE INTO accounts (account_number, pin, customer_name, balance) VALUES (?, ?, ?, ?)\",\n args: [acc, pin, name, balance],\n })),\n );\n })();\n return ready;\n}\n\n// ── Signed tokens ──────────────────────────────────────────────────────────────\n\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n\nconst unb64url = (s: string) =>\n Uint8Array.from(\n atob(s.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n\nasync function key() {\n return crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"],\n );\n}\n\nasync function issueToken(accountNumber: string): Promise {\n const payload = `${accountNumber}.${Date.now() + TOKEN_TTL_MS}`;\n const sig = await crypto.subtle.sign(\n \"HMAC\",\n await key(),\n new TextEncoder().encode(payload),\n );\n return `${b64url(new TextEncoder().encode(payload))}.${\n b64url(new Uint8Array(sig))\n }`;\n}\n\n/** Returns the account number if the token is valid and unexpired, else null. */\nasync function readToken(token: string): Promise {\n const [payloadPart, sigPart] = (token ?? \"\").split(\".\");\n if (!payloadPart || !sigPart) return null;\n\n let payload: string;\n try {\n payload = new TextDecoder().decode(unb64url(payloadPart));\n } catch {\n return null;\n }\n\n const valid = await crypto.subtle.verify(\n \"HMAC\",\n await key(),\n unb64url(sigPart),\n new TextEncoder().encode(payload),\n );\n if (!valid) return null;\n\n const [accountNumber, expiry] = payload.split(\".\");\n if (Number(expiry) < Date.now()) return null;\n return accountNumber;\n}\n\n// ── Input cleaning ─────────────────────────────────────────────────────────────\n\n/**\n * Speech-to-text often returns \"112 233\" or \"one-one-two-two-three-three\".\n * Stripping everything but digits makes the demo far more forgiving over voice.\n */\nconst digits = (v: unknown) => String(v ?? \"\").replace(/\\D/g, \"\");\n\n// ── Routes ─────────────────────────────────────────────────────────────────────\n\nasync function verifyToken(req: Request): Promise {\n let body: Record = {};\n try {\n body = await req.json();\n } catch {\n // fall through to the authenticated:false path below\n }\n\n const accountNumber = digits(body.account_number);\n const pin = digits(body.pin);\n\n const result = await sqlite.execute({\n sql:\n \"SELECT account_number, customer_name FROM accounts WHERE account_number = ? AND pin = ?\",\n args: [accountNumber, pin],\n });\n const row = result.rows[0] as {\n account_number: string;\n customer_name: string;\n } | undefined;\n\n // Deliberately a 200 with authenticated:false, not an HTTP error, so the LLM\n // reads it as a normal result and handles the failure in natural language.\n if (!row) return json({ authenticated: false });\n\n const token = await issueToken(row.account_number);\n return json({\n authenticated: true,\n token,\n auth_token: token, // the AIDA prompt has referenced both names\n customer_name: row.customer_name,\n account_number: row.account_number,\n });\n}\n\nasync function getBalance(url: URL): Promise {\n const token = url.searchParams.get(\"token\") ?? \"\";\n const accountNumber = await readToken(token);\n\n if (!accountNumber) {\n return json(\n { error: \"Invalid or expired token. Please authenticate again.\" },\n 401,\n );\n }\n\n const result = await sqlite.execute({\n sql:\n \"SELECT balance, currency, customer_name FROM accounts WHERE account_number = ?\",\n args: [accountNumber],\n });\n const row = result.rows[0] as\n | { balance: number; currency: string; customer_name: string }\n | undefined;\n\n if (!row) return json({ error: \"Account not found.\" }, 404);\n\n return json({\n account_number: accountNumber,\n customer_name: row.customer_name,\n balance: row.balance,\n currency: row.currency,\n });\n}\n\nasync function homePage(url: URL): Promise {\n const { rows } = await sqlite.execute(\n \"SELECT account_number, pin, customer_name, balance, currency FROM accounts ORDER BY customer_name\",\n );\n\n const tableRows = (rows as any[]).map((r) => `\n \n ${r.account_number}\n ${r.pin}\n ${r.customer_name}\n ${r.currency} ${Number(r.balance).toFixed(2)}\n `).join(\"\");\n\n return new Response(\n `\n\n\nCatalunya Bank API\n\n

Catalunya Bank — Account Balance API

Backend for the Enterprise Bot AIDA voice agent demo.

\n\n

Test accounts

\n\n \n ${tableRows}\n

Account number	PIN	Customer	Balance

\n\n

Endpoints

\n POST ${url.origin}/verifytoken
\n Body: {\"account_number\": \"112233\", \"pin\": \"4821\"}\n

\n GET ${url.origin}/getbalance?token=<token>\n

\n\n

Demo data only. Every account, PIN and balance on this page is fictitious.

`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS } },\n );\n}\n\n// ── Entry point ────────────────────────────────────────────────────────────────\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") return new Response(null, { headers: CORS });\n\n await initDb();\n const url = new URL(req.url);\n\n if (url.pathname === \"/health\") return json({ status: \"ok\" });\n if (url.pathname === \"/verifytoken\" && req.method === \"POST\") {\n return verifyToken(req);\n }\n if (url.pathname === \"/getbalance\" && req.method === \"GET\") {\n return getBalance(url);\n }\n if (url.pathname === \"/\") return homePage(url);\n\n return json({ error: \"Not found\" }, 404);\n}","http","createdAt",["D",1788250047586],"branchVersion","branchId","d37bb31a-2b12-498b-a3bd-da015248c1af","id","9ff29040-0e2c-46c3-b408-dd41bcfb6c33","catalunya-bank-api",["D",1788249862063],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Demo bank API for an Enterprise Bot AIDA voice agent","imageUrl","837e8866-d64b-436f-b051-7cf2aa93c4c1","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05bfc-ef65-72dd-b1d4-9d976b6a7d1c","tursoName","9ff290400e2c46c3b408dd41bcfb6c33","tursoHostname","9ff290400e2c46c3b408dd41bcfb6c33-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789551045218],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":-5,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",4,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","enterprisebotpen","handle","displayName","EnterprisebotPE","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/a7996bf0-5972-4ceb-1568-8cd3cfdbd401/square512?exp=1789563599&sig=084f828e57de049710b0986614cd6f4c6b5da21d1e54e8f91ed13e9e43365f31","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":154,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":155,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":156,"_83":157,"_85":158,"_87":25},"tree",[149],"files",[149],"counts",{"_138":62,"_139":140,"_141":62,"_142":143,"_144":145},"contents",[130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":134,"_13":135,"_33":37,"_35":36,"_24":25,"_136":45,"_27":137},"1dbbe664-38ea-4a52-b1d3-ef3e3ff99f79","parentId","latest",["D",1788250047586],2,"label",[28],"pulls","branches",1,"forks","envVars",{"_146":62,"_148":62},"connections",{"_146":62,"_147":62},"count","unfilledCount","emptyCount",{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":150,"_13":135,"_33":37,"_35":36,"_24":25,"_136":45,"_151":152,"_27":153},["D",1788250047586],"children",[],[28],["D",1788249862063],["D",1789551045218],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":-5,"_104":105,"_106":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_127":192,"_193":194,"_195":196,"_197":25,"_198":25,"_199":25,"_200":58,"_201":-5,"_202":-7,"_203":-7,"_204":62,"_205":25,"_206":25,"_207":-5,"_208":25,"_209":25,"_210":25,"_211":-5},"ENV",{"_163":164,"_165":166,"_167":89,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3