[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_164":165,"_166":167},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_105":85,"_27":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":119,"_120":25,"_121":122,"_123":124,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",19,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","019de0ba-e526-721c-bd4f-691ed348fdcd","name","fileType","http","content","// shopper-bot.ts — Tutorial 4: verify and sign responses.\nimport {\n InMemoryNonceCache,\n sign,\n signResponse,\n verify,\n verifyResponse,\n} from \"https://esm.sh/ed-sig-http@0.2\";\nimport type { PublicKeyResolver } from \"https://esm.sh/ed-sig-http@0.2\";\n\nconst MANIFEST_JSON = `{\n \"moltweb_version\": \"0.4\",\n \"identity\": \"moltweb:shopper-bot-2-12\",\n \"public_key\": \"z6MkekxV2y27WKFcpheP3GkfDx3M1Mgpos434AsMQ24zzj1J\",\n \"endpoint\": \"https://nt5k--019de0bae526721cbd4f691ed348fdcd.web.val.run\",\n \"capabilities\": [\n {\n \"name\": \"shopping-orchestrator\",\n \"description\": \"Coordinates multi-vendor price comparisons.\",\n \"method\": \"POST\",\n \"path\": \"/run\",\n \"example_request\": {\n \"product\": \"Sony WH-1000XM5\"\n }\n }\n ],\n \"published_at\": \"2026-05-01T00:00:46.536Z\",\n \"signature\": \"z4XsZPRg9V8Q4T5wuDTNFGBE6XMZkB8iyGwqVwF6bNdsRKGUXHgUYmLMGHkKE3TL43dnCo8frHjTKN15hrNLUQ5MC\"\n}`;\n\nconst REGISTRY = Deno.env.get(\"MOLTWEB_REGISTRY\") ??\n \"https://moltweb.app\";\nconst CF_ACCESS_CLIENT_ID = Deno.env.get(\"CF_ACCESS_CLIENT_ID\") ?? \"\";\nconst CF_ACCESS_CLIENT_SECRET = Deno.env.get(\"CF_ACCESS_CLIENT_SECRET\") ?? \"\";\n\nconst MY_IDENTITY = Deno.env.get(\"MOLTWEB_IDENTITY\") ?? \"\";\nconst MY_PUBLIC_KEY = Deno.env.get(\"MOLTWEB_PUBLIC_KEY\") ?? \"\";\nconst MY_PRIVATE_KEY = Deno.env.get(\"MOLTWEB_PRIVATE_KEY\") ?? \"\";\n\nif (!MY_IDENTITY || !MY_PUBLIC_KEY || !MY_PRIVATE_KEY) {\n throw new Error(\n \"Missing MOLTWEB_* env vars — see Tutorial 4, Step 1.\",\n );\n}\n\nfunction registryFetch(url: string): Promise {\n const headers: Record = {};\n if (CF_ACCESS_CLIENT_ID && CF_ACCESS_CLIENT_SECRET) {\n headers[\"CF-Access-Client-Id\"] = CF_ACCESS_CLIENT_ID;\n headers[\"CF-Access-Client-Secret\"] = CF_ACCESS_CLIENT_SECRET;\n }\n\n return fetch(url, { headers });\n}\n\nconst TARGET_HANDLE = \"quote-bot-2-12\";\n\nconst resolver: PublicKeyResolver = {\n async resolve(identity: string): Promise {\n if (!identity.startsWith(\"moltweb:\")) {\n throw new Error(`not a MoltWeb identity: ${identity}`);\n }\n const handle = identity.slice(\"moltweb:\".length).split(\"@\")[0];\n const res = await registryFetch(\n `${REGISTRY}/.well-known/moltweb/id/${handle}`,\n );\n if (!res.ok) throw new Error(`registry returned ${res.status}`);\n const doc = await res.json();\n return doc.public_key;\n },\n};\n\nconst requestNonceCache = new InMemoryNonceCache();\nconst responseNonceCache = new InMemoryNonceCache();\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/.well-known/moltweb.json\") {\n return new Response(MANIFEST_JSON, {\n headers: { \"Content-Type\": \"application/moltweb+json\" },\n });\n }\n\n if (url.pathname === \"/run\") {\n const parsed = await parseRunRequest(req, url);\n if (parsed instanceof Response) return parsed;\n\n try {\n const quoteData = await callForQuote(TARGET_HANDLE, parsed.product);\n const responseBody = JSON.stringify(quoteData);\n const signed = await signResponse({\n response: {\n status: 200,\n body: responseBody,\n headers: { \"Content-Type\": \"application/json\" },\n },\n privateKey: MY_PRIVATE_KEY,\n publicKey: MY_PUBLIC_KEY,\n identityHeader: \"MoltWeb-Identity\",\n identity: MY_IDENTITY,\n });\n\n return new Response(signed.body, {\n status: signed.status,\n headers: signed.headers,\n });\n } catch (e) {\n return Response.json(\n { error: (e as Error).message },\n { status: 502 },\n );\n }\n }\n\n return new Response(\"shopper-bot — POST /run or GET /run?product=X\", {\n headers: { \"Content-Type\": \"text/plain\" },\n });\n}\n\nasync function parseRunRequest(\n req: Request,\n url: URL,\n): Promise<{ product: string } | Response> {\n if (req.method === \"GET\") {\n return { product: url.searchParams.get(\"product\") ?? \"Sony WH-1000XM5\" };\n }\n\n if (req.method !== \"POST\") {\n return new Response(\"Method not allowed\", { status: 405 });\n }\n\n const bodyText = await req.text();\n const headers: Record = {};\n for (const [k, v] of req.headers) headers[k] = v;\n\n let result;\n try {\n result = await verify(\n {\n request: {\n method: req.method,\n url: req.url,\n headers,\n body: bodyText,\n },\n resolver,\n identityHeader: \"MoltWeb-Identity\",\n },\n { nonceCache: requestNonceCache },\n );\n } catch (e) {\n return Response.json(\n { error: \"resolver_failed\", detail: (e as Error).message },\n { status: 502 },\n );\n }\n\n if (!result.ok) {\n return Response.json(\n { error: \"unauthorized\", reason: result.reason },\n { status: 401 },\n );\n }\n\n const parsed = JSON.parse(bodyText || \"{}\") as { product?: string };\n if (!parsed.product) {\n return Response.json(\n { error: \"missing required field: product\" },\n { status: 400 },\n );\n }\n\n return { product: parsed.product };\n}\n\nasync function callForQuote(handle: string, product: string) {\n const manifestRes = await registryFetch(\n `${REGISTRY}/api/v1/agents/${handle}/manifest`,\n );\n if (!manifestRes.ok) {\n throw new Error(`registry returned ${manifestRes.status} for ${handle}`);\n }\n const manifest = await manifestRes.json();\n\n const cap = manifest.capabilities.find(\n (c: { name: string }) => c.name === \"price-comparison\",\n );\n if (!cap) throw new Error(`${handle} does not expose price-comparison`);\n\n const endpoint = manifest.endpoint.replace(/\\/$/, \"\");\n const path = cap.path ?? \"/quote\";\n const method = (cap.method ?? \"POST\").toUpperCase();\n const callUrl = endpoint + path;\n const body = JSON.stringify({ product });\n\n const signed = await sign({\n request: {\n method,\n url: callUrl,\n headers: { \"Content-Type\": \"application/json\" },\n body,\n },\n privateKey: MY_PRIVATE_KEY,\n publicKey: MY_PUBLIC_KEY,\n identityHeader: \"MoltWeb-Identity\",\n identity: MY_IDENTITY,\n });\n\n const res = await fetch(signed.url, {\n method: signed.method,\n headers: signed.headers,\n body: signed.body,\n });\n\n const respText = await res.text();\n const respHeaders: Record = {};\n res.headers.forEach((value, key) => {\n respHeaders[key] = value;\n });\n\n const verification = await verifyResponse(\n {\n response: { status: res.status, headers: respHeaders, body: respText },\n resolver,\n identityHeader: \"MoltWeb-Identity\",\n },\n { nonceCache: responseNonceCache },\n );\n\n if (!verification.ok) {\n throw new Error(`response signature failed (${verification.reason})`);\n }\n\n if (!res.ok) {\n throw new Error(`${handle} returned ${res.status}: ${respText}`);\n }\n\n return {\n ...JSON.parse(respText),\n verified_responder: verification.identity,\n };\n}","// shopper-bot.ts — Tutorial 4: verify and sign responses.\nimport {\n InMemoryNonceCache,\n sign,\n signResponse,\n verify,\n verifyResponse,\n} from \"https://esm.sh/ed-sig-http@0.2\";\nimport type { PublicKeyResolver } from \"https://esm.sh/ed-sig-http@0.2\";\n\nconst MANIFEST_JSON = `{\n \"moltweb_version\": \"0.4\",\n \"identity\": \"moltweb:shopper-bot-2-12\",\n \"public_key\": \"z6MkekxV2y27WKFcpheP3GkfDx3M1Mgpos434AsMQ24zzj1J\",\n \"endpoint\": \"https://nt5k--019de0bae526721cbd4f691ed348fdcd.web.val.run\",\n \"capabilities\": [\n {\n \"name\": \"shopping-orchestrator\",\n \"description\": \"Coordinates multi-vendor price comparisons.\",\n \"method\": \"POST\",\n \"path\": \"/run\",\n \"example_request\": {\n \"product\": \"Sony WH-1000XM5\"\n }\n }\n ],\n \"published_at\": \"2026-05-01T00:00:46.536Z\",\n \"signature\": \"z4XsZPRg9V8Q4T5wuDTNFGBE6XMZkB8iyGwqVwF6bNdsRKGUXHgUYmLMGHkKE3TL43dnCo8frHjTKN15hrNLUQ5MC\"\n}`;\n\nconst REGISTRY = Deno.env.get(\"MOLTWEB_REGISTRY\") ??\n \"https://staging.moltweb.app\";\nconst CF_ACCESS_CLIENT_ID = Deno.env.get(\"CF_ACCESS_CLIENT_ID\") ?? \"\";\nconst CF_ACCESS_CLIENT_SECRET = Deno.env.get(\"CF_ACCESS_CLIENT_SECRET\") ?? \"\";\n\nconst MY_IDENTITY = Deno.env.get(\"MOLTWEB_IDENTITY\") ?? \"\";\nconst MY_PUBLIC_KEY = Deno.env.get(\"MOLTWEB_PUBLIC_KEY\") ?? \"\";\nconst MY_PRIVATE_KEY = Deno.env.get(\"MOLTWEB_PRIVATE_KEY\") ?? \"\";\n\nif (!MY_IDENTITY || !MY_PUBLIC_KEY || !MY_PRIVATE_KEY) {\n throw new Error(\n \"Missing MOLTWEB_* env vars — see Tutorial 4, Step 1.\",\n );\n}\n\nfunction registryFetch(url: string): Promise {\n const headers: Record = {};\n if (CF_ACCESS_CLIENT_ID && CF_ACCESS_CLIENT_SECRET) {\n headers[\"CF-Access-Client-Id\"] = CF_ACCESS_CLIENT_ID;\n headers[\"CF-Access-Client-Secret\"] = CF_ACCESS_CLIENT_SECRET;\n }\n\n return fetch(url, { headers });\n}\n\nconst TARGET_HANDLE = \"quote-bot-2-12\";\n\nconst resolver: PublicKeyResolver = {\n async resolve(identity: string): Promise {\n if (!identity.startsWith(\"moltweb:\")) {\n throw new Error(`not a MoltWeb identity: ${identity}`);\n }\n const handle = identity.slice(\"moltweb:\".length).split(\"@\")[0];\n const res = await registryFetch(\n `${REGISTRY}/.well-known/moltweb/id/${handle}`,\n );\n if (!res.ok) throw new Error(`registry returned ${res.status}`);\n const doc = await res.json();\n return doc.public_key;\n },\n};\n\nconst requestNonceCache = new InMemoryNonceCache();\nconst responseNonceCache = new InMemoryNonceCache();\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/.well-known/moltweb.json\") {\n return new Response(MANIFEST_JSON, {\n headers: { \"Content-Type\": \"application/moltweb+json\" },\n });\n }\n\n if (url.pathname === \"/run\") {\n const parsed = await parseRunRequest(req, url);\n if (parsed instanceof Response) return parsed;\n\n try {\n const quoteData = await callForQuote(TARGET_HANDLE, parsed.product);\n const responseBody = JSON.stringify(quoteData);\n const signed = await signResponse({\n response: {\n status: 200,\n body: responseBody,\n headers: { \"Content-Type\": \"application/json\" },\n },\n privateKey: MY_PRIVATE_KEY,\n publicKey: MY_PUBLIC_KEY,\n identityHeader: \"MoltWeb-Identity\",\n identity: MY_IDENTITY,\n });\n\n return new Response(signed.body, {\n status: signed.status,\n headers: signed.headers,\n });\n } catch (e) {\n return Response.json(\n { error: (e as Error).message },\n { status: 502 },\n );\n }\n }\n\n return new Response(\"shopper-bot — POST /run or GET /run?product=X\", {\n headers: { \"Content-Type\": \"text/plain\" },\n });\n}\n\nasync function parseRunRequest(\n req: Request,\n url: URL,\n): Promise<{ product: string } | Response> {\n if (req.method === \"GET\") {\n return { product: url.searchParams.get(\"product\") ?? \"Sony WH-1000XM5\" };\n }\n\n if (req.method !== \"POST\") {\n return new Response(\"Method not allowed\", { status: 405 });\n }\n\n const bodyText = await req.text();\n const headers: Record = {};\n for (const [k, v] of req.headers) headers[k] = v;\n\n let result;\n try {\n result = await verify(\n {\n request: {\n method: req.method,\n url: req.url,\n headers,\n body: bodyText,\n },\n resolver,\n identityHeader: \"MoltWeb-Identity\",\n },\n { nonceCache: requestNonceCache },\n );\n } catch (e) {\n return Response.json(\n { error: \"resolver_failed\", detail: (e as Error).message },\n { status: 502 },\n );\n }\n\n if (!result.ok) {\n return Response.json(\n { error: \"unauthorized\", reason: result.reason },\n { status: 401 },\n );\n }\n\n const parsed = JSON.parse(bodyText || \"{}\") as { product?: string };\n if (!parsed.product) {\n return Response.json(\n { error: \"missing required field: product\" },\n { status: 400 },\n );\n }\n\n return { product: parsed.product };\n}\n\nasync function callForQuote(handle: string, product: string) {\n const manifestRes = await registryFetch(\n `${REGISTRY}/api/v1/agents/${handle}/manifest`,\n );\n if (!manifestRes.ok) {\n throw new Error(`registry returned ${manifestRes.status} for ${handle}`);\n }\n const manifest = await manifestRes.json();\n\n const cap = manifest.capabilities.find(\n (c: { name: string }) => c.name === \"price-comparison\",\n );\n if (!cap) throw new Error(`${handle} does not expose price-comparison`);\n\n const endpoint = manifest.endpoint.replace(/\\/$/, \"\");\n const path = cap.path ?? \"/quote\";\n const method = (cap.method ?? \"POST\").toUpperCase();\n const callUrl = endpoint + path;\n const body = JSON.stringify({ product });\n\n const signed = await sign({\n request: {\n method,\n url: callUrl,\n headers: { \"Content-Type\": \"application/json\" },\n body,\n },\n privateKey: MY_PRIVATE_KEY,\n publicKey: MY_PUBLIC_KEY,\n identityHeader: \"MoltWeb-Identity\",\n identity: MY_IDENTITY,\n });\n\n const res = await fetch(signed.url, {\n method: signed.method,\n headers: signed.headers,\n body: signed.body,\n });\n\n const respText = await res.text();\n const respHeaders: Record = {};\n res.headers.forEach((value, key) => {\n respHeaders[key] = value;\n });\n\n const verification = await verifyResponse(\n {\n response: { status: res.status, headers: respHeaders, body: respText },\n resolver,\n identityHeader: \"MoltWeb-Identity\",\n },\n { nonceCache: responseNonceCache },\n );\n\n if (!verification.ok) {\n throw new Error(`response signature failed (${verification.reason})`);\n }\n\n if (!res.ok) {\n throw new Error(`${handle} returned ${res.status}: ${respText}`);\n }\n\n return {\n ...JSON.parse(respText),\n verified_responder: verification.identity,\n };\n}","createdAt",["D",1777599731985],"branchVersion","branchId","9814a07a-44ec-11f1-9173-42b51c65c3df","id","a92cf884-4029-11f1-beaa-42b51c65c3df","shopper-bot",["D",1777068310131],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","dynamic branch based shopper-bot","imageUrl","6f0640ef-54ab-4f82-82db-248689f9b23e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019da797-be18-764d-b758-bf5ecf812067","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_104":100},"org",{"_97":96,"_98":-5,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":84,"_32":85,"_43":42,"_86":44,"_87":88,"_89":90,"_91":50,"_92":44,"_93":63,"_94":45,"_95":96},"isOwned",24,"2-12","projectId","forkedBranchId","a92e1566-4029-11f1-beaa-42b51c65c3df","forkedBranchVersion",13,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","nt5k","handle","displayName","avatar","https://avatars.githubusercontent.com/u/49963557?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":160,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":161,"_79":162,"_81":163,"_83":25},"tree",[155],"files",[155],"counts",{"_144":61,"_145":90,"_146":61,"_147":148,"_149":150},"contents",[136],"upstreamProject","upstreamBranch",{"_43":88,"_38":129,"_130":131,"_32":132,"_86":44,"_13":133,"_87":-5,"_89":-5,"_134":135,"_47":-5,"_83":25,"_49":50,"_95":96,"_62":63,"_94":45},"emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},["D",1777068310140],"updatedAt",["D",1778335993819],"main",17,"lockfileKey","1778335994101-esm.town_v_nt5k_shopper-bot@17-main",{"_43":137,"_32":28,"_30":31,"_138":-5,"_41":42,"_40":14,"_139":25,"_38":140,"_13":141,"_33":34,"_35":37,"_24":25,"_142":-5,"_27":143},"f94ae3ba-44fe-11f1-8ae4-42b51c65c3df","parentId","latest",["D",1777599731985],18,"label",[28],"pulls","branches","forks","envVars",{"_151":153,"_154":61},"connections",{"_151":61,"_152":61},"count","unfilledCount",4,"emptyCount",{"_43":137,"_32":28,"_30":31,"_138":-5,"_41":42,"_40":14,"_139":25,"_38":156,"_13":141,"_33":34,"_35":37,"_24":25,"_142":-5,"_157":158,"_27":159},["D",1777599731985],"children",[],[28],["D",1777068310131],{"_97":96,"_104":100},{"_97":96,"_98":-5,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":84,"_32":85,"_43":42,"_86":44,"_87":88,"_89":90,"_91":50,"_92":44,"_93":63,"_94":45,"_95":96},"ctx",{"_77":-5,"_126":197,"_198":199,"_200":201,"_202":25,"_203":25,"_204":25,"_205":124,"_206":-5,"_207":-7,"_208":-7,"_209":61,"_210":25,"_211":25,"_212":-5,"_213":25,"_214":25,"_215":25,"_216":-5},"ENV",{"_168":169,"_170":171,"_172":132,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v19