[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_158":159,"_160":161},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_119":-5,"_20":120,"_22":121,"_122":123,"_124":125,"_26":126,"_24":127,"_128":-5,"_129":-5,"_130":56,"_131":132,"_133":53,"_134":-5,"_135":-5,"_136":137},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","enterprisebotpen","name","catalunya-bank-api","branchName","main","version","path","main.ts","project",{"_33":60,"_13":14,"_45":61,"_62":-5,"_63":56,"_64":65,"_66":65,"_67":68,"_69":-5,"_70":71,"_72":38,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":81,"_82":83,"_84":85,"_86":-5,"_87":88,"_89":88,"_90":91,"_92":91,"_93":91,"_94":88,"_95":88,"_96":97,"_98":99,"_100":101,"_102":56},"tree",[51],"file",{"_33":34,"_35":36,"_37":38,"_13":19,"_39":40,"_41":42,"_17":43,"_44":-5,"_45":46,"_47":48,"_49":14,"_18":50},"contents",[],"upstream","pull","ahead","behind","envVars","id","6219b370-3058-463d-9712-3aa263f6d281","branchId","d37bb31a-2b12-498b-a3bd-da015248c1af","fileId","bd80fc8c-a5db-11f1-bf30-1607ee4eb77e","content","/**\n * Catalunya Bank - Account Balance API\n * -------------------------------------\n * Backend for the Enterprise Bot AIDA voice agent demo.\n * Runs on Val Town (free tier). No server, no deploy pipeline, no cold starts.\n *\n * Endpoints\n * POST /verifytoken - authenticate account_number + pin, return a signed token\n * GET /getbalance - return the balance for a valid token\n * GET /health - liveness check\n * GET / - human-readable demo page with the test accounts\n *\n * Database: Val Town SQLite (Turso), private to this val, seeded on first request.\n *\n * Note on tokens: the original Railway version kept issued tokens in an in-memory\n * dict. That does not survive on serverless runtimes, where the worker can shut\n * down between two tool calls. Here the token is stateless and signed (HMAC-SHA256\n * over account number + expiry), so /getbalance can verify it without shared state.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ── Config ─────────────────────────────────────────────────────────────────────\n\n// Set TOKEN_SECRET in the val's Environment Variables for a real secret.\n// The fallback keeps the demo working with zero configuration.\nconst SECRET = Deno.env.get(\"TOKEN_SECRET\") ?? \"catalunya-bank-demo-secret\";\nconst TOKEN_TTL_MS = 5 * 60 * 1000; // 5 minutes is plenty for one phone call\n\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"*\",\n};\n\nconst json = (body: unknown, status = 200) =>\n Response.json(body, { status, headers: CORS });\n\n// ── Database ───────────────────────────────────────────────────────────────────\n\nconst SEED = [\n [\"112233\", \"4821\", \"Sophie Turner\", 3245.67],\n [\"445566\", \"7734\", \"James Harrington\", 18902.50],\n [\"778899\", \"2296\", \"Elena Vasquez\", 742.18],\n];\n\nlet ready: Promise | null = null;\n\nfunction initDb(): Promise {\n ready ??= (async () => {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS accounts (\n account_number TEXT PRIMARY KEY,\n pin TEXT NOT NULL,\n customer_name TEXT NOT NULL,\n balance REAL NOT NULL,\n currency TEXT NOT NULL DEFAULT 'EUR'\n )\n `);\n // INSERT OR IGNORE keeps this idempotent, so it is safe on every request.\n await sqlite.batch(\n SEED.map(([acc, pin, name, balance]) => ({\n sql:\n \"INSERT OR IGNORE INTO accounts (account_number, pin, customer_name, balance) VALUES (?, ?, ?, ?)\",\n args: [acc, pin, name, balance],\n })),\n );\n })();\n return ready;\n}\n\n// ── Signed tokens ──────────────────────────────────────────────────────────────\n\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n\nconst unb64url = (s: string) =>\n Uint8Array.from(\n atob(s.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n\nasync function key() {\n return crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"],\n );\n}\n\nasync function issueToken(accountNumber: string): Promise {\n const payload = `${accountNumber}.${Date.now() + TOKEN_TTL_MS}`;\n const sig = await crypto.subtle.sign(\n \"HMAC\",\n await key(),\n new TextEncoder().encode(payload),\n );\n return `${b64url(new TextEncoder().encode(payload))}.${\n b64url(new Uint8Array(sig))\n }`;\n}\n\n/** Returns the account number if the token is valid and unexpired, else null. */\nasync function readToken(token: string): Promise {\n const [payloadPart, sigPart] = (token ?? \"\").split(\".\");\n if (!payloadPart || !sigPart) return null;\n\n let payload: string;\n try {\n payload = new TextDecoder().decode(unb64url(payloadPart));\n } catch {\n return null;\n }\n\n const valid = await crypto.subtle.verify(\n \"HMAC\",\n await key(),\n unb64url(sigPart),\n new TextEncoder().encode(payload),\n );\n if (!valid) return null;\n\n const [accountNumber, expiry] = payload.split(\".\");\n if (Number(expiry) < Date.now()) return null;\n return accountNumber;\n}\n\n// ── Input cleaning ─────────────────────────────────────────────────────────────\n\n/**\n * Speech-to-text often returns \"112 233\" or \"one-one-two-two-three-three\".\n * Stripping everything but digits makes the demo far more forgiving over voice.\n */\nconst digits = (v: unknown) => String(v ?? \"\").replace(/\\D/g, \"\");\n\n// ── Routes ─────────────────────────────────────────────────────────────────────\n\n/**\n * Collects parameters from wherever the caller put them: JSON body, form body,\n * or query string. Voice platforms differ in how they map tool parameters onto\n * an HTTP request, and a demo should not fail because of that choice.\n */\nasync function readParams(\n req: Request,\n url: URL,\n): Promise> {\n const params: Record = Object.fromEntries(url.searchParams);\n\n if (req.method === \"GET\" || req.method === \"HEAD\") return params;\n\n const raw = await req.text();\n if (!raw) return params;\n\n try {\n Object.assign(params, JSON.parse(raw));\n } catch {\n // Not JSON. Try form encoding before giving up.\n try {\n Object.assign(params, Object.fromEntries(new URLSearchParams(raw)));\n } catch { /* leave params as they are */ }\n }\n return params;\n}\n\nasync function verifyToken(req: Request, url: URL): Promise {\n const body = await readParams(req, url);\n\n const accountNumber = digits(\n body.account_number ?? body.accountNumber ?? body.account,\n );\n const pin = digits(body.pin ?? body.PIN);\n\n // Shows up in the val's Logs tab, which is the fastest way to see what a\n // voice platform actually sent. The PIN itself is never logged.\n console.log(\n `verifytoken: keys=[${Object.keys(body).join(\", \")}] account=${\n accountNumber || \"(empty)\"\n } pin=${pin ? \"(supplied)\" : \"(empty)\"}`,\n );\n\n const result = await sqlite.execute({\n sql:\n \"SELECT account_number, customer_name FROM accounts WHERE account_number = ? AND pin = ?\",\n args: [accountNumber, pin],\n });\n const row = result.rows[0] as {\n account_number: string;\n customer_name: string;\n } | undefined;\n\n // Deliberately a 200 with authenticated:false, not an HTTP error, so the LLM\n // reads it as a normal result and handles the failure in natural language.\n if (!row) return json({ authenticated: false });\n\n const token = await issueToken(row.account_number);\n return json({\n authenticated: true,\n token,\n auth_token: token, // the AIDA prompt has referenced both names\n customer_name: row.customer_name,\n account_number: row.account_number,\n });\n}\n\nasync function getBalance(req: Request, url: URL): Promise {\n const params = await readParams(req, url);\n const token = String(params.token ?? params.auth_token ?? \"\");\n const accountNumber = await readToken(token);\n\n console.log(\n `getbalance: keys=[${Object.keys(params).join(\", \")}] token=${\n token ? \"(supplied)\" : \"(empty)\"\n } valid=${Boolean(accountNumber)}`,\n );\n\n if (!accountNumber) {\n return json(\n { error: \"Invalid or expired token. Please authenticate again.\" },\n 401,\n );\n }\n\n const result = await sqlite.execute({\n sql:\n \"SELECT balance, currency, customer_name FROM accounts WHERE account_number = ?\",\n args: [accountNumber],\n });\n const row = result.rows[0] as\n | { balance: number; currency: string; customer_name: string }\n | undefined;\n\n if (!row) return json({ error: \"Account not found.\" }, 404);\n\n return json({\n account_number: accountNumber,\n customer_name: row.customer_name,\n balance: row.balance,\n currency: row.currency,\n });\n}\n\nasync function homePage(url: URL): Promise {\n const { rows } = await sqlite.execute(\n \"SELECT account_number, pin, customer_name, balance, currency FROM accounts ORDER BY customer_name\",\n );\n\n const tableRows = (rows as any[]).map((r) => `\n \n ${r.account_number}\n ${r.pin}\n ${r.customer_name}\n ${r.currency} ${Number(r.balance).toFixed(2)}\n `).join(\"\");\n\n return new Response(\n `\n\n\nCatalunya Bank API\n\n

Catalunya Bank — Account Balance API

Backend for the Enterprise Bot AIDA voice agent demo.

\n\n

Test accounts

\n\n \n ${tableRows}\n

Account number	PIN	Customer	Balance

\n\n

Endpoints

\n POST ${url.origin}/verifytoken
\n Body: {\"account_number\": \"112233\", \"pin\": \"4821\"}\n

\n GET ${url.origin}/getbalance?token=<token>\n

\n\n

Demo data only. Every account, PIN and balance on this page is fictitious.

`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS } },\n );\n}\n\n// ── Entry point ────────────────────────────────────────────────────────────────\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") return new Response(null, { headers: CORS });\n\n await initDb();\n const url = new URL(req.url);\n\n if (url.pathname === \"/health\") return json({ status: \"ok\" });\n\n // Methods are deliberately permissive. If a platform sends the balance\n // lookup as a POST, or the verification as a GET, it still works.\n if (url.pathname === \"/verifytoken\") return verifyToken(req, url);\n if (url.pathname === \"/getbalance\") return getBalance(req, url);\n\n if (url.pathname === \"/\") return homePage(url);\n\n return json({ error: \"Not found\" }, 404);\n}","fileType","http",3,"parentId","createdAt",["D",1788254057337],"branchVersion",4,"label",[19],{"_33":34,"_13":19,"_37":38,"_44":-5,"_35":36,"_47":48,"_52":53,"_45":54,"_17":43,"_41":42,"_39":40,"_55":56,"_49":14,"_57":58,"_18":59},"latest",true,["D",1788254057337],"deleted",false,"children",[],[19],"9ff29040-0e2c-46c3-b408-dd41bcfb6c33",["D",1788249862063],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Demo bank API for an Enterprise Bot AIDA voice agent","imageUrl","userId","837e8866-d64b-436f-b051-7cf2aa93c4c1","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05bfc-ef65-72dd-b1d4-9d976b6a7d1c","tursoName","9ff290400e2c46c3b408dd41bcfb6c33","tursoHostname","9ff290400e2c46c3b408dd41bcfb6c33-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789464074488],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_118":114},"org",{"_11":12,"_111":112,"_113":114,"_70":-5,"_115":116,"_117":56},"branch",{"_17":48,"_13":16,"_33":36,"_103":60,"_104":-5,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":14,"_110":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","EnterprisebotPE","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/a7996bf0-5972-4ceb-1568-8cd3cfdbd401/square512?exp=1789538399&sig=9d96cd70e40739b6ce2f85c3c5e8ed8105d15ef7d50c535d7258fccea8001d32","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":60,"_13":14,"_45":153,"_62":-5,"_63":56,"_64":65,"_66":65,"_67":68,"_69":-5,"_70":71,"_72":38,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":81,"_82":83,"_84":154,"_86":-5,"_87":88,"_89":88,"_90":91,"_92":91,"_93":91,"_94":88,"_95":88,"_96":155,"_98":156,"_100":157,"_102":56},[150],"files",[150],"counts",{"_140":77,"_141":142,"_143":77,"_32":144,"_145":146},[],{"_33":34,"_13":19,"_37":38,"_44":-5,"_35":36,"_47":48,"_52":53,"_45":138,"_17":43,"_41":42,"_39":40,"_55":56,"_49":14,"_18":139},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1788254057337],[19],"pulls","branches",1,"forks",{"_147":77,"_149":77},"connections",{"_147":77,"_148":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":19,"_37":38,"_44":-5,"_35":36,"_47":48,"_52":53,"_45":54,"_17":43,"_41":42,"_39":40,"_55":56,"_49":14,"_57":151,"_18":152},[],[19],["D",1788249862063],["D",1789464074488],{"_11":12,"_118":114},{"_11":12,"_111":112,"_113":114,"_70":-5,"_115":116,"_117":56},{"_17":48,"_13":16,"_33":36,"_103":60,"_104":-5,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":14,"_110":12},"ctx",{"_96":-5,"_135":191,"_192":193,"_194":195,"_196":56,"_197":56,"_198":56,"_199":53,"_200":-5,"_201":-7,"_202":-7,"_203":77,"_204":56,"_205":56,"_206":-5,"_207":56,"_208":56,"_209":56,"_210":-5},"ENV",{"_162":163,"_164":165,"_166":16,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]