[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_183":184,"_185":186},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_69":138,"_41":-7,"_139":-5,"_17":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":-5,"_150":-5,"_151":152,"_153":49,"_154":155,"_156":26,"_157":-5,"_158":-5,"_159":160},"routes/_app.x.$handle.$name.compare.$branch",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":-5},"handle","nt5k","name","shopper-bot","branchName","2-12","project",{"_32":40,"_13":14,"_34":99,"_47":-5,"_100":49,"_50":51,"_101":51,"_102":103,"_104":-5,"_105":106,"_107":-5,"_108":49,"_109":-5,"_110":-5,"_111":112,"_53":54,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":118,"_119":118,"_120":121,"_122":121,"_123":121,"_124":118,"_125":118,"_126":127,"_128":129,"_130":28,"_48":49},"ahead",23,"behind",4,"diff",{"_62":63,"_64":65,"_66":67},"hasChanges",true,"sourceBranch",{"_41":56,"_13":16,"_32":57,"_39":40,"_43":33,"_44":58,"_59":51,"_60":40,"_61":54,"_55":14,"_52":12},"targetBranch",{"_32":33,"_34":35,"_36":37,"_13":38,"_39":40,"_41":42,"_43":-5,"_44":-5,"_45":46,"_47":-5,"_48":49,"_50":51,"_52":12,"_53":54,"_55":14},"pull","id","a92e1566-4029-11f1-beaa-42b51c65c3df","createdAt",["D",1777068310140],"updatedAt",["D",1778335993819],"main","projectId","a92cf884-4029-11f1-beaa-42b51c65c3df","version",17,"forkedBranchId","forkedBranchVersion","lockfileKey","1778335994101-esm.town_v_nt5k_shopper-bot@17-main","deletedAt","isOwned",false,"privacy","public","userHandle","orgId","019da797-be18-764d-b758-bf5ecf812067","projectName",24,"9814a07a-44ec-11f1-9173-42b51c65c3df",13,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","added",[],"deleted",[],"modified",[68],{"_69":70,"_71":72,"_73":74},"path","main.ts","targetFile",{"_32":92,"_13":70,"_76":93,"_78":-5,"_79":33,"_80":58,"_81":49,"_34":94,"_41":95,"_83":84,"_85":96,"_64":49,"_87":-5,"_88":-7,"_69":97,"_90":98},"sourceFile",{"_32":75,"_13":70,"_76":77,"_78":-5,"_79":57,"_80":56,"_81":26,"_34":82,"_41":20,"_83":84,"_85":86,"_64":49,"_87":-5,"_88":-7,"_69":89,"_90":91},"c333d71a-4502-11f1-9da0-42b51c65c3df","fileId","019de0ba-e526-721c-bd4f-691ed348fdcd","parentId","branchId","branchVersion","latest",["D",1777601359223],"fileType","http","content","// shopper-bot.ts — Tutorial 4: verify and sign responses.\nimport {\n InMemoryNonceCache,\n sign,\n signResponse,\n verify,\n verifyResponse,\n} from \"https://esm.sh/ed-sig-http@0.2\";\nimport type { PublicKeyResolver } from \"https://esm.sh/ed-sig-http@0.2\";\n\nconst MANIFEST_JSON = `{\n \"moltweb_version\": \"0.4\",\n \"identity\": \"moltweb:shopper-bot-2-12\",\n \"public_key\": \"z6MkekxV2y27WKFcpheP3GkfDx3M1Mgpos434AsMQ24zzj1J\",\n \"endpoint\": \"https://nt5k--019de0bae526721cbd4f691ed348fdcd.web.val.run\",\n \"capabilities\": [\n {\n \"name\": \"shopping-orchestrator\",\n \"description\": \"Coordinates multi-vendor price comparisons.\",\n \"method\": \"POST\",\n \"path\": \"/run\",\n \"example_request\": {\n \"product\": \"Sony WH-1000XM5\"\n }\n }\n ],\n \"published_at\": \"2026-05-01T00:00:46.536Z\",\n \"signature\": \"z4XsZPRg9V8Q4T5wuDTNFGBE6XMZkB8iyGwqVwF6bNdsRKGUXHgUYmLMGHkKE3TL43dnCo8frHjTKN15hrNLUQ5MC\"\n}`;\n\nconst REGISTRY = Deno.env.get(\"MOLTWEB_REGISTRY\") ??\n \"https://staging.moltweb.app\";\nconst CF_ACCESS_CLIENT_ID = Deno.env.get(\"CF_ACCESS_CLIENT_ID\") ?? \"\";\nconst CF_ACCESS_CLIENT_SECRET = Deno.env.get(\"CF_ACCESS_CLIENT_SECRET\") ?? \"\";\n\nconst MY_IDENTITY = Deno.env.get(\"MOLTWEB_IDENTITY\") ?? \"\";\nconst MY_PUBLIC_KEY = Deno.env.get(\"MOLTWEB_PUBLIC_KEY\") ?? \"\";\nconst MY_PRIVATE_KEY = Deno.env.get(\"MOLTWEB_PRIVATE_KEY\") ?? \"\";\n\nif (!MY_IDENTITY || !MY_PUBLIC_KEY || !MY_PRIVATE_KEY) {\n throw new Error(\n \"Missing MOLTWEB_* env vars — see Tutorial 4, Step 1.\",\n );\n}\n\nfunction registryFetch(url: string): Promise {\n const headers: Record = {};\n if (CF_ACCESS_CLIENT_ID && CF_ACCESS_CLIENT_SECRET) {\n headers[\"CF-Access-Client-Id\"] = CF_ACCESS_CLIENT_ID;\n headers[\"CF-Access-Client-Secret\"] = CF_ACCESS_CLIENT_SECRET;\n }\n\n return fetch(url, { headers });\n}\n\nconst TARGET_HANDLE = \"quote-bot-2-12\";\n\nconst resolver: PublicKeyResolver = {\n async resolve(identity: string): Promise {\n if (!identity.startsWith(\"moltweb:\")) {\n throw new Error(`not a MoltWeb identity: ${identity}`);\n }\n const handle = identity.slice(\"moltweb:\".length).split(\"@\")[0];\n const res = await registryFetch(\n `${REGISTRY}/.well-known/moltweb/id/${handle}`,\n );\n if (!res.ok) throw new Error(`registry returned ${res.status}`);\n const doc = await res.json();\n return doc.public_key;\n },\n};\n\nconst requestNonceCache = new InMemoryNonceCache();\nconst responseNonceCache = new InMemoryNonceCache();\n\nasync function signedJsonResponse(\n status: number,\n payload: unknown,\n): Promise {\n const body = JSON.stringify(payload);\n const signed = await signResponse({\n response: {\n status,\n body,\n headers: { \"Content-Type\": \"application/json\" },\n },\n privateKey: MY_PRIVATE_KEY,\n publicKey: MY_PUBLIC_KEY,\n identityHeader: \"MoltWeb-Identity\",\n identity: MY_IDENTITY,\n });\n\n return new Response(signed.body, {\n status: signed.status,\n headers: signed.headers,\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/.well-known/moltweb.json\") {\n return new Response(MANIFEST_JSON, {\n headers: { \"Content-Type\": \"application/moltweb+json\" },\n });\n }\n\n if (url.pathname === \"/run\") {\n const parsed = await parseRunRequest(req, url);\n if (parsed instanceof Response) return parsed;\n\n try {\n const quoteData = await callForQuote(TARGET_HANDLE, parsed.product);\n return await signedJsonResponse(200, quoteData);\n } catch (e) {\n return await signedJsonResponse(\n 502,\n { error: (e as Error).message },\n );\n }\n }\n\n return new Response(\"shopper-bot — POST /run or GET /run?product=X\", {\n headers: { \"Content-Type\": \"text/plain\" },\n });\n}\n\nasync function parseRunRequest(\n req: Request,\n url: URL,\n): Promise<{ product: string } | Response> {\n if (req.method === \"GET\") {\n return { product: url.searchParams.get(\"product\") ?? \"Sony WH-1000XM5\" };\n }\n\n if (req.method !== \"POST\") {\n return await signedJsonResponse(405, { error: \"method_not_allowed\" });\n }\n\n const bodyText = await req.text();\n const headers: Record = {};\n for (const [k, v] of req.headers) headers[k] = v;\n\n let result;\n try {\n result = await verify(\n {\n request: {\n method: req.method,\n url: req.url,\n headers,\n body: bodyText,\n },\n resolver,\n identityHeader: \"MoltWeb-Identity\",\n },\n { nonceCache: requestNonceCache },\n );\n } catch (e) {\n return await signedJsonResponse(\n 502,\n { error: \"resolver_failed\", detail: (e as Error).message },\n );\n }\n\n if (!result.ok) {\n return await signedJsonResponse(\n 401,\n { error: \"unauthorized\", reason: result.reason },\n );\n }\n\n const parsed = JSON.parse(bodyText || \"{}\") as { product?: string };\n if (!parsed.product) {\n return await signedJsonResponse(\n 400,\n { error: \"missing required field: product\" },\n );\n }\n\n return { product: parsed.product };\n}\n\nasync function callForQuote(handle: string, product: string) {\n const manifestRes = await registryFetch(\n `${REGISTRY}/api/v1/agents/${handle}/manifest`,\n );\n if (!manifestRes.ok) {\n throw new Error(`registry returned ${manifestRes.status} for ${handle}`);\n }\n const manifest = await manifestRes.json();\n\n const cap = manifest.capabilities.find(\n (c: { name: string }) => c.name === \"price-comparison\",\n );\n if (!cap) throw new Error(`${handle} does not expose price-comparison`);\n\n const endpoint = manifest.endpoint.replace(/\\/$/, \"\");\n const path = cap.path ?? \"/quote\";\n const method = (cap.method ?? \"POST\").toUpperCase();\n const callUrl = endpoint + path;\n const body = JSON.stringify({ product });\n\n const signed = await sign({\n request: {\n method,\n url: callUrl,\n headers: { \"Content-Type\": \"application/json\" },\n body,\n },\n privateKey: MY_PRIVATE_KEY,\n publicKey: MY_PUBLIC_KEY,\n identityHeader: \"MoltWeb-Identity\",\n identity: MY_IDENTITY,\n });\n\n const res = await fetch(signed.url, {\n method: signed.method,\n headers: signed.headers,\n body: signed.body,\n });\n\n const respText = await res.text();\n const respHeaders: Record = {};\n res.headers.forEach((value, key) => {\n respHeaders[key] = value;\n });\n\n const verification = await verifyResponse(\n {\n response: { status: res.status, headers: respHeaders, body: respText },\n resolver,\n identityHeader: \"MoltWeb-Identity\",\n },\n { nonceCache: responseNonceCache },\n );\n\n if (!verification.ok) {\n throw new Error(`response signature failed (${verification.reason})`);\n }\n\n if (!res.ok) {\n throw new Error(`${handle} returned ${res.status}: ${respText}`);\n }\n\n return {\n ...JSON.parse(respText),\n verified_responder: verification.identity,\n };\n}","label","children",[70],"contentHash","1291523bff8592d19e6c48a7412c6648aabd9584f334119dc54dd6af4feaa194","b982adbe-4051-11f1-8cdd-42b51c65c3df","a931e4a2-4029-11f1-beaa-42b51c65c3df",["D",1777085517383],12,"// shopper-bot.ts — Tutorial 3: discover and call other MoltWeb agents.\nimport {\n InMemoryNonceCache,\n sign,\n verify,\n} from \"https://esm.sh/ed-sig-http@0.1\";\nimport type { PublicKeyResolver } from \"https://esm.sh/ed-sig-http@0.1\";\n\nconst REGISTRY = Deno.env.get(\"MOLTWEB_REGISTRY\") ??\n \"https://staging.moltweb.app\";\n\nconst MY_IDENTITY = Deno.env.get(\"MOLTWEB_IDENTITY\") ?? \"\";\nconst MY_PUBLIC_KEY = Deno.env.get(\"MOLTWEB_PUBLIC_KEY\") ?? \"\";\nconst MY_PRIVATE_KEY = Deno.env.get(\"MOLTWEB_PRIVATE_KEY\") ?? \"\";\n\nif (!MY_IDENTITY || !MY_PUBLIC_KEY || !MY_PRIVATE_KEY) {\n throw new Error(\n \"Missing MOLTWEB_* env vars — see Tutorial 3, Step 2.\",\n );\n}\n\n// The handle of the agent we want to call. Replace with your own\n// quote-bot handle from Tutorial 1.\nconst TARGET_HANDLE = \"quote-bot-2-8\";\n\n// §4 — resolve the caller's public key from the registry identity doc.\nconst resolver: PublicKeyResolver = {\n async resolve(identity: string): Promise {\n if (!identity.startsWith(\"moltweb:\")) {\n throw new Error(`not a MoltWeb identity: ${identity}`);\n }\n const handle = identity.slice(\"moltweb:\".length).split(\"@\")[0];\n const res = await fetch(`${REGISTRY}/.well-known/moltweb/id/${handle}`);\n if (!res.ok) throw new Error(`registry returned ${res.status}`);\n const doc = await res.json();\n return doc.public_key;\n },\n};\n\nconst nonceCache = new InMemoryNonceCache();\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.pathname === \"/.well-known/moltweb.json\") {\n return new Response(MANIFEST_JSON, {\n headers: { \"Content-Type\": \"application/moltweb+json\" },\n });\n }\n\n if (url.pathname === \"/run\") {\n const product = url.searchParams.get(\"product\") ?? \"Sony WH-1000XM5\";\n try {\n const quotes = await callForQuote(TARGET_HANDLE, product);\n return Response.json(quotes);\n } catch (e) {\n return Response.json(\n { error: (e as Error).message },\n { status: 502 },\n );\n }\n }\n\n // §4 — shopping-orchestrator capability endpoint.\n // Receives a signed POST from the registry playground (or any caller)\n // and fans out to quote-bot via a signed call of its own.\n if (req.method === \"POST\" && url.pathname === \"/shop\") {\n const bodyText = await req.text();\n\n const headers: Record = {};\n for (const [k, v] of req.headers) headers[k] = v;\n\n const result = await verify(\n {\n request: {\n method: req.method,\n url: req.url,\n headers,\n body: bodyText,\n },\n resolver,\n identityHeader: \"MoltWeb-Identity\",\n },\n { nonceCache },\n );\n\n if (!result.ok) {\n return Response.json(\n { error: \"unauthorized\", reason: result.reason },\n { status: 401 },\n );\n }\n\n const parsed = JSON.parse(bodyText || \"{}\") as { product?: string };\n if (!parsed.product) {\n return Response.json(\n { error: \"missing required field: product\" },\n { status: 400 },\n );\n }\n try {\n const quotes = await callForQuote(TARGET_HANDLE, parsed.product);\n return Response.json(quotes);\n } catch (e) {\n const status = e instanceof UpstreamError && e.status < 500\n ? e.status\n : 502;\n return Response.json(\n { error: (e as Error).message },\n { status },\n );\n }\n }\n\n return new Response(\"shopper-bot — POST /shop or GET /run?product=X\", {\n headers: { \"Content-Type\": \"text/plain\" },\n });\n}\n\nclass UpstreamError extends Error {\n constructor(public readonly status: number, message: string) {\n super(message);\n }\n}\n\nasync function callForQuote(handle: string, product: string) {\n // 1. Discover: fetch the target's signed manifest from the registry.\n // The registry is a JSON mirror of what the target serves at its\n // own /.well-known/moltweb.json — convenient for one-shot lookups.\n const manifestRes = await fetch(\n `${REGISTRY}/api/v1/agents/${handle}/manifest`,\n );\n if (!manifestRes.ok) {\n throw new Error(`registry returned ${manifestRes.status} for ${handle}`);\n }\n const manifest = await manifestRes.json();\n\n // 2. Find the capability and its endpoint.\n const cap = manifest.capabilities.find(\n (c: { name: string }) => c.name === \"price-comparison\",\n );\n if (!cap) throw new Error(`${handle} does not expose price-comparison`);\n\n const endpoint = manifest.endpoint.replace(/\\/$/, \"\");\n const path = cap.path ?? \"/quote\";\n const method = (cap.method ?? \"POST\").toUpperCase();\n const callUrl = endpoint + path;\n\n // 3. Build the request we want to send.\n const body = JSON.stringify({ product });\n const unsigned = {\n method,\n url: callUrl,\n headers: { \"Content-Type\": \"application/json\" },\n body,\n };\n\n // 4. Sign it. The library adds Signature-Input, Signature,\n // Content-Digest, and MoltWeb-Identity headers. Everything\n // covered by the signature is fixed at this point — any change\n // below will invalidate it.\n const signed = await sign({\n request: unsigned,\n privateKey: MY_PRIVATE_KEY,\n publicKey: MY_PUBLIC_KEY,\n identityHeader: \"MoltWeb-Identity\",\n identity: MY_IDENTITY,\n });\n\n // 5. Send.\n const res = await fetch(signed.url, {\n method: signed.method,\n headers: signed.headers,\n body: signed.body,\n });\n\n if (!res.ok) {\n const text = await res.text();\n throw new UpstreamError(\n res.status,\n `${handle} returned ${res.status}: ${text}`,\n );\n }\n return res.json();\n}\n\nconst MANIFEST_JSON = `{\n \"moltweb_version\": \"0.1\",\n \"identity\": \"moltweb:shopper-bot-2-8\",\n \"public_key\": \"z6MkpWEEvHvHRxedzT2n2SJjfiHSawY9yLx6qJwmTXNuqkEa\",\n \"endpoint\": \"https://nt5k--019dc275fc1974f8a818d734988e526c.web.val.run\",\n \"capabilities\": [\n {\n \"name\": \"shopping-orchestrator\",\n \"description\": \"Coordinates multi-vendor price comparisons.\",\n \"method\": \"POST\",\n \"path\": \"/shop\"\n }\n ],\n \"published_at\": \"2026-04-25T02:27:27.360Z\",\n \"signature\": \"z52v2ycVm6GGxSaX8yeBTiBDUEBXc5RWTfNc95Lpzw54xfrPCBdF9zB6X3kKyK1UBM8QSGXQvPXxHikFBqHbGbjWA\"\n}`;",[70],"928302c02423216e8953b5dd69cb92b27e951b481e4106b15b30c70ae0705cff",["D",1777068310131],"legacyEnvVars","httpPrivacy","description","dynamic branch based shopper-bot","imageUrl","userId","6f0640ef-54ab-4f82-82db-248689f9b23e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_137":133},"org",{"_11":12,"_131":-5,"_132":133,"_105":106,"_134":135,"_136":49},"branch","displayName","avatar","https://avatars.githubusercontent.com/u/49963557?v=4","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_32":40,"_13":14,"_34":179,"_47":-5,"_100":49,"_50":51,"_101":51,"_102":103,"_104":-5,"_105":106,"_107":-5,"_108":49,"_109":-5,"_110":-5,"_111":112,"_53":54,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":118,"_119":118,"_120":121,"_122":121,"_123":121,"_124":118,"_125":118,"_126":180,"_128":181,"_130":182,"_48":49},"tree",[176],"files",[176],"counts",{"_166":112,"_167":58,"_168":112,"_169":170,"_171":172},"contents",[163],"file","upstreamProject","upstreamBranch",{"_32":33,"_34":161,"_36":162,"_13":38,"_39":40,"_41":42,"_43":-5,"_44":-5,"_45":46,"_47":-5,"_48":49,"_50":51,"_52":12,"_53":54,"_55":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1777068310140],["D",1778335993819],{"_32":75,"_13":70,"_76":77,"_78":-5,"_79":57,"_80":56,"_81":26,"_34":164,"_41":20,"_83":84,"_85":86,"_64":49,"_87":-5,"_69":165},["D",1777601359223],[70],"pulls","branches","forks","envVars",{"_173":22,"_175":112},"connections",{"_173":112,"_174":112},"count","unfilledCount","emptyCount",{"_32":75,"_13":70,"_76":77,"_78":-5,"_79":57,"_80":56,"_81":26,"_34":82,"_41":20,"_83":84,"_85":86,"_64":49,"_87":-5,"_88":177,"_69":178},[],[70],["D",1777068310131],{"_11":12,"_137":133},{"_11":12,"_131":-5,"_132":133,"_105":106,"_134":135,"_136":49},{"_41":56,"_13":16,"_32":57,"_39":40,"_43":33,"_44":58,"_59":51,"_60":40,"_61":54,"_55":14,"_52":12},"ctx",{"_126":-5,"_158":216,"_217":218,"_219":220,"_221":49,"_222":49,"_223":49,"_224":26,"_225":-5,"_226":-7,"_227":-7,"_228":112,"_229":49,"_230":49,"_231":-5,"_232":49,"_233":49,"_234":49,"_235":-5},"ENV",{"_187":188,"_189":190,"_191":38,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Compare

Merge2-12intomain

Hmain.ts+149-101