Hi

\",\n});\n```\n\n## Utility Imports\n\nPin utility imports to a version:\n\n```ts\nimport { parseProject, readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n```\n\n### `serveFile`\n\n```ts\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", (c) => serveFile(c.req.path, import.meta.url));\n```\n\n### `readFile`\n\n```ts\nconst fileContent = await readFile(\"/frontend/index.html\", import.meta.url);\n```\n\n### `listFiles`\n\n```ts\nconst files = await listFiles(import.meta.url);\n```\n\n### `parseProject`\n\n```ts\nconst projectVal = parseProject(import.meta.url);\nconsole.log(projectVal.username);\nconsole.log(projectVal.name);\nconsole.log(projectVal.version);\nconsole.log(projectVal.branch);\nconsole.log(projectVal.links.self.project);\n```\n\n`parseProject` and the other standard-library utilities run only on the server. Pass needed data to\nthe client through HTML or an API request.\n\n## Platform Specifics\n\n- Redirect with `new Response(null, { status: 302, headers: { Location: \"/place/to/redirect\" }})` rather than `Response.redirect`.\n- Avoid external or base64 images. Prefer emoji, Unicode, icon libraries, or platform-supported image generation.\n- Use `

` for inline AI images.\n- Do not use Deno KV for storage.\n- Do not use browser `alert()`, `prompt()`, or `confirm()`.\n- Use Open-Meteo for weather unless the task says otherwise.\n- Add a view-source link from `import.meta.url.replace(\"ems.sh\", \"val.town\")` with `target=\"_top\"`.\n- Add `` to capture client errors.\n- Use `try`/`catch` only with a clear local resolution; let contextual errors bubble.\n- Read environment variables with `Deno.env.get(\"KEY\")`; prefer APIs that avoid keys when possible.\n- Use `https://esm.sh` for npm and Deno dependencies that must work on server and browser.\n- Prefer static client-side sites unless backend storage is explicitly required.\n\n## React and Styling\n\nWhen React is needed, pin matching versions and put this first in the file:\n\n```ts\n/** @jsxImportSource https://esm.sh/react@18.2.0 */\n```\n\nPin React and its dependencies consistently. The generic platform default is Tailwind through\n``; uAgents instead follows the local\nbeer.css conventions in `../AGENTS.md`.\n\n## Recommended Structure\n\n```\n├── backend/\n│ ├── database/\n│ │ ├── migrations.ts\n│ │ ├── queries.ts\n│ │ └── README.md\n│ ├── routes/\n│ │ ├── [route].ts\n│ │ └── static.ts\n│ └── index.ts\n├── frontend/\n│ ├── components/\n│ │ ├── App.tsx\n│ │ └── [Component].tsx\n│ ├── favicon.svg\n│ ├── index.html\n│ ├── index.tsx\n│ ├── README.md\n│ └── style.css\n├── README.md\n└── shared/\n └── utils.ts\n```\n\n## Backend (Hono) Patterns\n\n- Use Hono for APIs.\n- Keep the entry point at `backend/index.ts`.\n- Serve static assets with `serveFile`.\n- Create RESTful CRUD routes.\n- Re-throw Hono errors to retain original error detail:\n\n```ts\napp.onError((err, c) => {\n throw err;\n});\n```\n\nFor an HTML entry point that needs initial server data, read the file, fetch the data, inject a\nserialized script before ``, and return `c.html(html)`.\n\n## Database Patterns\n\n- Run migrations on startup or comment them out when performance requires it.\n- Change table names instead of altering existing SQLite tables.\n- Export clear, typed query functions.\n\n## Common Gotchas\n\n1. Val Town runs Deno serverlessly, not Node.js.\n2. Code in `shared/` must work in browser and server contexts; do not use `Deno` there.\n3. Use `https://esm.sh` imports that work in both contexts.\n4. SQLite has limited `ALTER TABLE` support; create a new table and copy data for schema changes.\n5. Pin React to 18.2.0 consistently; mismatched versions cause rendering issues.\n6. Val Town supports text files only. Use `readFile` helpers to read project files across branches and forks.\n7. A `fetch` handler is the HTTP entry point: `export default app.fetch`.\n\n## Key Files\n\n- `AGENTS.md` — uAgents-local conventions and module map\n- `../AGENTS.md` — Val Town repository conventions\n- `README.md` — uAgents architecture and operating contracts\n","children",[],[383],"23efb6f3-0083-4d06-915b-e688f35160ca","val.yml","f3605d0e-6128-11f1-9354-1607ee4eb77e",651,["D",1788773355439],13,"# val.yml — metadata contract for this val. Not consumed by `vt` today; reserved\n# for a future repo wrapper over vt-cli (safer deploys, env checks, file typing).\nname: \"uAgents\"\norg: \"ttai\"\npublic: true # intended private; free-plan private-val limit forced public at create\n#\n# Two surfaces:\n# /c// → customer functions (Bearer key auth; cname from the URL)\n# /admin → Val Town OAuth-gated admin UI (gated to ADMIN_USERS)\n#\n# Only index.http.ts is the HTTP val. Other files must avoid Val Town's reserved\n# filename infixes (http, cron, email, …) — e.g. core/api.ts, not core/http.ts.\nfiles:\n index.http.ts: http\n\n# Env vars this app reads. Set them in the Val Town UI sidebar — never in code.\n# Shopify vars are per-customer: prefix = uppercased customer id (JJS = Jhaji).\n# The shop must expose Storefront MCP at https://{shop}/api/mcp.\n#\n# required — app will not work without this\n# recommended — has a safe fallback but set explicitly for production\n# optional — feature-flagged; functions 503 with the exact var name when missing\nenv:\n ADMIN_USERS: required # comma-separated Val Town usernames for /admin access\n OPENAI_API_KEY: required # OpenAI key for all LangChain agent-backed functions\n OAUTH_STATE_ENCRYPTION_KEY: recommended # AES-GCM key for admin OAuth session cookie; `openssl rand -base64 32`\n JJS_SHOPIFY_SHOP: optional # Jhaji store hostname, e.g. ttai-merchandise-dev.myshopify.com (no scheme)\n JJS_SHOPIFY_CLIENT_ID: optional # Jhaji Dev Dashboard app client id (client-credentials grant)\n JJS_SHOPIFY_CLIENT_SECRET: optional # Jhaji Dev Dashboard app client secret\n TTAI_SHOPIFY_SHOP: optional # ToughTongue AI dev store hostname (no scheme)\n TTAI_SHOPIFY_CLIENT_ID: optional # TTAI Dev Dashboard app client id\n TTAI_SHOPIFY_CLIENT_SECRET: optional # TTAI Dev Dashboard app client secret\n FITELO_N8N_WEBHOOK_URL: optional # Fitelo n8n webhook the post-session-sms fn forwards booking SMS to\n FITELO_PAYMENT_WEBHOOK_URL: optional # Fitelo n8n ezweight payment-link webhook (payment_link_requested branch)\n FITELO_EZWEIGHT_PRODUCT_ID: optional # Fitelo POS productId for the EZWeight 999 first step\n CORESTACK_RESEND_API_KEY: optional # Resend API key for notify-qualified — same key as backend RESEND_API_KEY\n CORESTACK_NOTIFY_EMAILS: optional # Comma-separated sales-team recipients for the qualified-lead email\n CORESTACK_FROM_EMAIL: optional # Override from-address; defaults to \"Tough Tongue AI \"\n",[],[392],"a17d6cb6-e1b8-4017-bfe6-f364eeab5315","index.http.ts",280,["D",1780941501215],10,"http","// index.http.ts — HTTP entry point, built on Hono. Two surfaces, one app:\n// /c// → customer functions (each customer is a mounted sub-app)\n// /admin → Val Town OAuth admin UI (gated to ADMIN_USERS)\n// A function may invoke an agent internally; the API doesn't distinguish.\n// This file is pure wiring; logic lives in backend/ and frontend/.\n\nimport { Hono } from \"npm:hono@^4\";\nimport { type AdminUc, getAdminUc, withValTownAuth } from \"./backend/core/auth.ts\";\nimport {\n buildAdminView,\n buildCalls,\n buildCallsView,\n saveAuthForm,\n} from \"./backend/core/handlers.ts\";\nimport { apiErrorHandler } from \"./backend/core/api.ts\";\nimport { mountCustomers } from \"./backend/customers/registry.ts\";\nimport { LOGO_MIME, LOGO_SVG } from \"./frontend/assets.ts\";\nimport { renderAdmin, renderDenied, renderLogin } from \"./frontend/admin.tsx\";\nimport { renderCalls } from \"./frontend/calls.tsx\";\n\nconst app = new Hono();\n\n// -----------------------------------------------------------------------------\n// public assets — SVG logo / favicon (no auth; browser-cached)\n// -----------------------------------------------------------------------------\nconst logoResponse = () =>\n new Response(LOGO_SVG, {\n headers: { \"content-type\": LOGO_MIME, \"cache-control\": \"public, max-age=604800\" },\n });\napp.get(\"/logo.svg\", logoResponse);\napp.get(\"/favicon.ico\", logoResponse);\n\n// -----------------------------------------------------------------------------\n// admin — OAuth gate to ADMIN_USERS, then three pages\n// -----------------------------------------------------------------------------\nconst admin = new Hono<{ Variables: { uc: AdminUc } }>();\n\nadmin.use(\"*\", async (c, next) => {\n const uc = await getAdminUc(c.req.raw);\n if (!uc.isAuthed) return c.html(renderLogin(), 401);\n if (!uc.isAdmin) return c.html(renderDenied(uc.username ?? \"\"), 403);\n c.set(\"uc\", uc);\n await next();\n});\n\nadmin.get(\"/\", async (c) => {\n const uc = c.get(\"uc\");\n const saved = c.req.query(\"saved\") === \"1\";\n const view = await buildAdminView(\n uc.username ?? \"\",\n uc.avatarUrl,\n new URL(c.req.url).origin,\n saved,\n );\n return c.html(renderAdmin(view));\n});\n\nadmin.get(\"/calls\", (c) => {\n const uc = c.get(\"uc\");\n const view = buildCallsView(uc.username ?? \"\", uc.avatarUrl, new URL(c.req.url).origin);\n return c.html(renderCalls(view));\n});\n\n// JSON feed for the Recent calls page: filter by customer + selected functions.\nadmin.get(\"/calls.json\", async (c) => {\n const customer = c.req.query(\"customer\") ?? \"\";\n const fns = c.req.queries(\"fn\") ?? [];\n return c.json({ calls: await buildCalls(customer, fns) });\n});\n\nadmin.post(\"/auth\", async (c) => {\n await saveAuthForm(c.req.raw);\n return c.redirect(\"/admin?saved=1\", 303);\n});\nadmin.onError(apiErrorHandler);\n\n// -----------------------------------------------------------------------------\n// wiring — mount surfaces; root error boundary; JSON 404\n// -----------------------------------------------------------------------------\napp.get(\"/\", (c) => c.redirect(\"/admin\"));\napp.route(\"/admin\", admin);\nmountCustomers(app);\n\napp.onError(apiErrorHandler);\napp.notFound((c) => c.json({ ok: false, error: `Not found: ${c.req.path}` }, 404));\n\nexport default withValTownAuth((req) => app.fetch(req));\n","uagents",[],[401],"fd314dfe-9e8a-4e72-9448-9c8d14a748ad","deno.json","f353dd04-6128-11f1-ac3a-1607ee4eb77e",610,["D",1785503537350],7,"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\n \"lib\": [\"dom\", \"dom.iterable\", \"dom.asynciterable\", \"deno.ns\", \"deno.unstable\"]\n },\n \"fmt\": {\n \"lineWidth\": 100,\n \"exclude\": [\".vt\"]\n },\n \"lint\": {\n \"exclude\": [\".vt\"],\n \"rules\": {\n \"exclude\": [\"no-explicit-any\", \"no-external-import\", \"no-import-prefix\"]\n }\n },\n \"node_modules_dir\": false,\n \"unstable\": [\"temporal\", \"worker-options\", \"sloppy-imports\", \"node-globals\"],\n \"tasks\": {\n \"view-meta\": \"deno run -A scripts/view-meta.ts\",\n \"set-meta\": \"deno run -A scripts/set-meta.ts\",\n \"del-meta\": \"deno run -A scripts/del-meta.ts\",\n \"get-customer-info\": \"deno run -A scripts/get-customer-info.ts\",\n \"fetch-context\": \"deno run -A scripts/fetch-context.ts\",\n \"resolve-incoming-caller\": \"deno run -A scripts/resolve-incoming-caller.ts\"\n }\n}\n",[],[411],"f5a034a1-6f82-4a71-8662-5a100b9e22e1","README.md","f3e9fe92-6128-11f1-b4a4-1607ee4eb77e",633,["D",1786181484238],26,"# uAgents\n\nA single Val Town HTTP val ([Hono](https://hono.dev) router) that exposes small, per-customer\n**functions** behind a per-customer API key, plus a [beer.css](https://www.beercss.com/) admin UI to\nmanage those keys. A function is a plain request→response unit that **may or may not invoke an\nagent** (LangChain + OpenAI) internally. Deno-native, no build step. Deployed to the `ttai` org.\nPair with **uFns** for lightweight integration endpoints.\n\nTwo surfaces, one val:\n\n| Surface | Path | Auth |\n| --------- | --------------------------- | -------------------------------------- |\n| Functions | `GET\\|POST /c//` | Bearer key, verified for that `cname` |\n| Admin UI | `GET /admin` (`/` → it) | Val Town OAuth, gated to `ADMIN_USERS` |\n\n> This repo does **not** use `vtx`. Use the native `vt` CLI directly. Pushing cleanly is your\n> responsibility.\n\n---\n\n## Layout\n\n```\nuAgents/\n index.http.ts Hono root app: admin sub-app + customer sub-apps + /logo.svg\n val.yml name, files contract, env declarations\n deno.json Deno/Val Town compiler + lint config + task shortcuts\n .env.sample copy → .env and fill in for local scripts (gitignored)\n backend/\n core/ cross-cutting infrastructure\n shared.ts env(), JSON helpers, mintKey()\n app.ts static config: globals() + per-customer Secrets types ← registry\n api.ts ApiError, readJsonObject(), error mapping ← mini framework\n db.ts SQLite: customer_auth + call_log (8k-row + 14d retention)\n auth.ts OAuth admin gate + authenticate(req, cname)\n handlers.ts admin view assembly + key-config form save + call queries\n agentic-core/ the agent framework — no concrete agents live here\n types.ts Agent / AgentCtx / AgentResult contract\n runtime.ts LangChain ChatOpenAI wiring (global LLM key) + runAgent()\n tool-loop.ts generic model→tools→model loop (reusable by any agent)\n prompt.ts shared input-shaping helpers (withContext, str, compact)\n agents/ concrete agents + their LangChain tool wrappers\n quote-agent.ts the quote agent (structured output)\n shopify-mcp-agent.ts unified Shopify agent (Admin tools + Storefront MCP, ≤12 rounds)\n shopify-admin-tools.ts LangChain tool wrappers for Shopify Admin reads\n integrations/ external-service primitives (one folder per integration)\n shopify/\n config.ts validate a customer's ShopifySecrets → ShopifyConfig (503 on missing)\n token.ts Admin token via client-credentials grant (cached ~24h)\n errors.ts map scope/credential failures to visible 4xx (not masked 502)\n client.ts adminGql() (fetch, no SDK)\n snapshot.ts resolveCustomer(), resolveCustomerGid(), listAbandonedCheckouts()\n context.ts deterministic reads for fetch-context\n ident-matching.ts shared email/phone matching helpers (used by snapshot.ts + context.ts)\n metafields.ts setMetafields(), readMetafields() — generic, no business logic\n tags.ts addTags(), removeTags() — generic resource tagging (split out of metafields.ts)\n customers/ one auth scope per customer; their functions live here\n types.ts Fn / FnCtx / Customer / CustomerSpec contracts\n define.ts defineCustomer() — a Hono sub-app per customer\n agent-fn.ts agentFn() — bridge any Agent into an FnSpec\n builtins.ts reusable functions (echo) customers can register\n registry.ts all customers + mountCustomers() ← register here\n jjs/\n index.ts customer: Jhaji (echo, get-customer-info, get-metafields, shopify-sidekick, post-feedback)\n get-customer-info.ts deterministic Shopify read (no LLM)\n get-metafields.ts read customer metafields (all or by namespace)\n post-feedback.ts POST_SESSION hook — writes call feedback as ttai_call.* metafields\n shopify-sidekick.ts function that invokes the Shopify agent\n ttai/\n index.ts customer: ToughTongue AI (echo, get-a-new-quote)\n get-a-new-quote.ts function that invokes the quote agent\n scripts/ local Deno scripts for testing against the real store\n get-customer-info.ts fetch customer profile + all metafields by email\n fetch-context.ts fetch exact order context + recent abandoned checkouts\n frontend/\n layout.tsx Shell: beer.css doc + top app bar (logo + brand + actions + user)\n shared.tsx doc(), UserMenu/LoginLink (navbar), logout, banner\n assets.ts inline SVG \"uA\" logo → served at /logo.svg (favicon + navbar)\n admin.tsx admin (Auth + Debug + TTAI Integration tabs) / login / denied\n debug.tsx Debug tab: live runner (URL + Authorization + curl + body)\n integration.tsx TTAI Integration tab: endpoint URL + params-schema JSON\n auth-header.tsx Authorization header display helper (shared by debug + integration)\n calls.tsx Recent calls page (customer + fn filters, expandable req/resp)\n types.ts admin view models\n styles/ modular CSS layers (Next.js-style)\n tokens.ts design tokens + semantic M3 aliases (palette is runtime-generated)\n base.ts document layout + typography scale\n components.ts cards, key row, tabs, chips, table, debug box\n index.ts composes layers → GLOBAL_CSS\n```\n\n> File naming: only `index.http.ts` is the HTTP entry. Val Town infers a file's val-type from\n> reserved name infixes (`http`, `cron`, `email`, …), so the mini-framework lives in `core/api.ts`,\n> **not** `core/http.ts`.\n\n---\n\n## Auth model (per-customer key, cname in the URL)\n\nThe customer (`cname`) is the first path segment: `/c//`. Auth is scoped to that cname:\n\n- Send the key as `Authorization: Bearer ` (or `X-API-Key: `).\n- Each customer is a [Hono](https://hono.dev) sub-app mounted at `/c/`. Its middleware (bound to\n that `id`) calls `authenticate(req, cname)` — loads ``'s config and compares the bearer\n token to the stored key in constant time. Rejected when the customer is unconfigured/disabled\n (403) or the key is missing/wrong (401). The customer module \"owns\" its name + validation by\n construction. An outer middleware records every call (success or denied) to the call log — status,\n latency, and the full request + response bodies (headers stripped, capped). The log is a shared\n ring buffer: rows older than 14 days are deleted, and once past 8,000 rows the oldest 500 are\n dropped in a batch.\n- **Admin UI** is gated by Val Town OAuth — only usernames in `ADMIN_USERS` get in.\n\nKeys are minted in the admin UI (generated on first save, rotatable), stored in SQLite, and shown in\nthe UI so you can copy them. They carry a readable `utt__` prefix, but routing no\nlonger depends on the prefix — the URL's `cname` is authoritative.\n\n### Security properties (code is public)\n\nThe val is public on Val Town — anyone can read the source. Security rests on secrets, not\nobscurity:\n\n| Surface | Protection | Notes |\n| -------------------- | ------------------------------------------ | ----------------------------------------------------------------------- |\n| `/c//` | Per-customer Bearer key (SQLite) | Constant-time compare; 403 when disabled |\n| `/admin/*` | Val Town OAuth + `ADMIN_USERS` allow-list | All sub-routes including `calls.json` |\n| `/admin/auth` (POST) | OAuth + admin check + registry guard | `customer` field validated against known registry — rejects unknown ids |\n| Shopify creds | Val Town env vars (never in code/logs) | Only read server-side; 503 names missing var |\n| Call log bodies | Headers stripped; 2 KB detail / 8 KB body | Admin-only; drop >14d, then 8,000-row cap (prune 500) |\n| Key length timing | Early-exit on mismatched length | Acceptable: all keys share the fixed-length prefix |\n| Rate limiting | None per-customer beyond Val Town platform | An attacker needs a valid key (admin-issued) to reach agents |\n\n---\n\n## Customers & functions\n\nEverything served over the API is a **function** — a `Fn = (ctx) => Response`. Functions are\nregistered per customer and exposed at `/c//`. A function may invoke an agent or not; the\nAPI doesn't distinguish. A customer's `index.ts` declares its functions via\n`defineCustomer({ id, label, fns })`; the factory builds a Hono sub-app, wiring auth + call-logging\nmiddleware (bound to that `id`) and a route per function. Routing, methods, and errors are Hono's\njob — there is no hand-rolled path parsing.\n\nEach customer is a folder under `backend/customers/`. To add one:\n\n1. Copy `backend/customers/jjs/` to `backend/customers//` and edit the id + label.\n2. Register it in `backend/customers/registry.ts`.\n3. In the admin UI, generate + enable its key.\n\nCurrent functions:\n\n- **`echo`** (builtin, all customers) — reflects method, query, and body back to the caller.\n- **`get-a-new-quote`** (`ttai`) — invokes a LangChain + OpenAI agent that invents a fresh, original\n quote. Output is schema-constrained (`quote`, `author`, `theme`) via structured output. Optional\n JSON body `{ \"theme\": \"courage\" }`; otherwise a theme is picked for you.\n- **`get-customer-info`** (`jjs`, `ttai`) — deterministic Shopify Admin read (no LLM). Body with at\n least one of `customer_id` / `customer_email` / `customer_phone` → profile, pending orders,\n abandoned checkouts. The same lookup is exposed to the agent as `get_customer_info`.\n- **`fetch-context`** (`jjs`, `ttai`) — deterministic Shopify Admin read (no LLM). Body\n `{ order_id, user_email?, user_phone? }` returns `user_phone`, `abandoned_ts`, `cart_value`, exact\n order JSON in `order_context`, matching unrecovered last-10-day abandoned checkouts in\n `user_context`, and an empty `related_items` array for response-shape compatibility.\n- **`shopify-sidekick`** (`jjs`, `ttai`) — full-service Shopify agent (`shopify-mcp-agent`). Body\n `{ prompt, customer_id?, customer_email?, customer_phone?, cart_id? }`. Combines two Admin tools\n (customer lookup, abandoned checkouts) with five Storefront MCP tools from the shop's `/api/mcp`\n (catalog search, product details, cart create/update, policies). Up to 12 tool rounds.\n\n**Add a function** — drop a file in `backend/customers//` exporting an `Fn`, then add it to that\ncustomer's `fns` map. Reusable functions (like `echo`) live in `backend/customers/builtins.ts`.\n\n**Invoke an agent from a function** — see `customers/ttai/get-a-new-quote.ts` or\n`customers/jjs/shopify-sidekick.ts`: each adapts the request into an `AgentCtx` and calls\n`runAgent()`. The runtime (`agentic-core/runtime.ts`) owns all LLM wiring, so agents stay\ndeclarative; add new concrete agents under `backend/agents/`. Tool-using agents reuse\n`agentic-core/tool-loop.ts` (model→tools→model). The framework lives in `agentic-core/`; `agents/`\nholds only the concrete agents.\n\n**Add an integration** — create `backend/integrations//` with a customer-agnostic client +\nhelpers (see `shopify/`). Resolve per-customer credentials from `__*` env so adding\na merchant is config-only.\n\n---\n\n## Environment variables\n\nSet these in the **Val Town UI sidebar** — never in code (`Deno.env.set()` is a no-op on Val Town).\nAll config is **static and explicit** in `backend/core/app.ts` (declared in `val.yml`).\n`OAUTH_STATE_ENCRYPTION_KEY` is read directly by the Val Town OAuth middleware (`std/oauth`).\n\n**Two kinds of config, listed explicitly — no prefix magic:**\n\n- **Globals** — `globals()` returns a typed `{ openaiKey, adminUsers }`. Shared infra (the LLM key,\n the admin allow-list); used by the runtime + auth only.\n- **Per-customer secrets** — each customer has a named type (`SecretsJjs`, `SecretsTtai`) and a\n resolver (`jjsSecrets()`, `ttaiSecrets()`) that reads **only that customer's listed env vars**\n (`JJS_SHOPIFY_*`, `TTAI_SHOPIFY_*`) into a typed object. A customer's\n `defineCustomer({ secrets })` resolver runs once; every `Fn` / `Agent` for that customer is handed\n its own typed `ctx.secrets` (e.g. a `jjs` function sees exactly `SecretsJjs`). Add a customer =\n add a `Secrets` type + resolver in `app.ts`, then pass it in that customer's `index.ts`.\n\n> The isolation is a **soft convention**, not a hard wall — nothing physically stops code from\n> importing `env()`. The value is clarity + types: what each customer can read is declared in one\n> place, and the type system keeps a `jjs` function from reaching another customer's (or a global's)\n> secrets.\n\n| Var | Status | Used by | Purpose |\n| ---------------------------- | ----------- | --------------------------------- | ------------------------------------------------------------ |\n| `ADMIN_USERS` | required | `core/auth.ts` (`/admin`) | Comma-separated Val Town usernames allowed into the admin |\n| `OPENAI_API_KEY` | required | `agentic-core/runtime.ts` | OpenAI key for the LangChain agents (agent-backed functions) |\n| `OAUTH_STATE_ENCRYPTION_KEY` | recommended | `std/oauth` via `withValTownAuth` | AES-GCM key material that encrypts the admin session cookie |\n| `JJS_SHOPIFY_SHOP` | optional | `integrations/shopify` (`jjs`) | jjs store hostname — must expose `/api/mcp` (no scheme) |\n| `JJS_SHOPIFY_CLIENT_ID` | optional | `integrations/shopify/token.ts` | jjs Dev Dashboard app client id — mints Admin tokens |\n| `JJS_SHOPIFY_CLIENT_SECRET` | optional | `integrations/shopify/token.ts` | jjs Dev Dashboard app client secret |\n| `TTAI_SHOPIFY_SHOP` | optional | `integrations/shopify` (`ttai`) | TTAI dev store hostname — must expose `/api/mcp` (no scheme) |\n| `TTAI_SHOPIFY_CLIENT_ID` | optional | `integrations/shopify/token.ts` | TTAI Dev Dashboard app client id — mints Admin tokens |\n| `TTAI_SHOPIFY_CLIENT_SECRET` | optional | `integrations/shopify/token.ts` | TTAI Dev Dashboard app client secret |\n\nNotes:\n\n- `ADMIN_USERS` example: `alice,bob`. Empty/unset ⇒ nobody can reach `/admin` (everyone is denied).\n- `OPENAI_API_KEY` only matters for agents. Unset ⇒ agent-backed functions return **503**; plain\n functions (e.g. `echo`) still work.\n- `JJS_SHOPIFY_*` and `TTAI_SHOPIFY_*` only matter for their own Shopify functions. A new merchant\n lists its own vars in a `secretsAcme()` resolver (`app.ts`). Unset shop/client creds ⇒ those\n functions return **503** naming the exact var.\n- **Admin auth (Shopify Dev Dashboard):** set `CLIENT_ID` + `CLIENT_SECRET` from the app's Settings\n page. `token.ts` exchanges them for a ~24h Admin token via the client-credentials grant and caches\n it. See\n [Admin & Storefront API → Generate tokens](../../../docs/wiki/integrations/shopify/admin-api.md).\n- `OAUTH_STATE_ENCRYPTION_KEY` — if unset, the middleware auto-generates a key and stores it in Val\n Town blob storage per redirect URI. That works, but **set it explicitly** so admin sessions\n survive redeploys and work on self-hosted runtimes. Any high-entropy string works (it's SHA-256'd\n to a 256-bit AES key); generate one with:\n\n```bash\n# generate a 32-byte base64 key (macOS: append `| pbcopy` to copy it)\nopenssl rand -base64 32\n```\n\nThen paste the value into the val's **Environment Variables** sidebar as\n`OAUTH_STATE_ENCRYPTION_KEY`. `vt` does not manage env vars — they must be set in the Val Town UI.\n\n---\n\n## Local scripts\n\nScripts in `scripts/` run with Deno directly against the real store — no val deployment needed. They\nimport the backend primitives via relative paths, so they stay in sync automatically.\n\n**One-time setup** (from `exp/vals/uAgents/`):\n\n```bash\ncp .env.sample .env\n# fill in JJS_SHOPIFY_SHOP, JJS_SHOPIFY_CLIENT_ID, JJS_SHOPIFY_CLIENT_SECRET\n```\n\n### `get-customer-info`\n\nResolves a customer by email and prints their profile, pending orders, abandoned checkouts, and all\nmetafields. Optionally scope metafields to a namespace.\n\n```bash\n# from exp/vals/uAgents/\ndeno task get-customer-info mayank.raj.unofficial@gmail.com\ndeno task get-customer-info mayank.raj.unofficial@gmail.com ttai_call # scope to namespace\n\n# or directly\ndeno run -A scripts/get-customer-info.ts mayank.raj.unofficial@gmail.com\n```\n\n### `fetch-context`\n\nResolves an order, backfills the customer's phone when Shopify has it, returns exact order JSON in\n`order_context`, and returns unrecovered abandoned checkouts in `user_context` only when they match\nthat order's customer/email/phone and were created in the last 10 days. `abandoned_ts` and\n`cart_value` are taken from the newest matching abandoned checkout. This function does not call\nOpenAI or generate related product recommendations; `related_items` is intentionally returned as\n`[]` for compatibility.\n\n```bash\n# from exp/vals/uAgents/\ndeno task fetch-context --order-id '#1001'\ndeno task fetch-context -c jjs '#1001' --user-email priya.sharma@example.com\n\n# or directly\ndeno run -A scripts/fetch-context.ts --order-id '#1001'\n```\n\n---\n\n## Local → Val Town with `vt`\n\nRun from **inside this directory** (`exp/vals/uAgents/`).\n\n```bash\nvt status # review what changed\nvt push # push (forceful — revert via the Val Town website if needed)\nvt browse # open the deployed val\n```\n\nFirst push of a brand-new val: `vt create uAgents .`. To link an existing remote val, `vt clone` it\nto a temp dir and move its `.vt/` folder next to this code. After pushing, set the\n[environment variables](#environment-variables) in the Val Town UI.\n\n---\n\n## Try it\n\n```bash\n# 1. In /admin, generate + enable a key for \"ttai\", then:\nexport VT_TTAI_APP_TOKEN=\"generate-from-admin-ui\"\nexport VT_JJS_APP_TOKEN=\"generate-from-admin-ui\"\n\n# plain function (echo)\ncurl -X POST https://uagents.val.run/c/ttai/echo \\\n -H \"Authorization: Bearer $VT_TTAI_APP_TOKEN\" \\\n -H \"Content-Type: application/json\" -d '{\"hi\":\"there\"}'\n\n# agent-backed function (fresh quote)\ncurl -X POST https://uagents.val.run/c/ttai/get-a-new-quote \\\n -H \"Authorization: Bearer $VT_TTAI_APP_TOKEN\" \\\n -H \"Content-Type: application/json\" -d '{\"theme\":\"craftsmanship\"}'\n\n# jjs Shopify sidekick (Admin + Storefront MCP)\ncurl -X POST https://uagents.val.run/c/jjs/shopify-sidekick \\\n -H \"Authorization: Bearer $VT_JJS_APP_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"prompt\":\"Search for hoodies and add the first one to a new cart\",\"customer_email\":\"mayank.raj.unofficial@gmail.com\"}'\n```\n\nNegative paths (auth + routing) — handy as a quick smoke test:\n\n```bash\nBASE=https://uagents.val.run\n\n# missing key → 401\ncurl -s -o /dev/null -w '%{http_code}\\n' -X POST \"$BASE/c/ttai/echo\" -d '{}'\n\n# wrong key → 401\ncurl -s -o /dev/null -w '%{http_code}\\n' -X POST \"$BASE/c/ttai/echo\" \\\n -H \"Authorization: Bearer nope\" -d '{}'\n\n# unknown customer → 404\ncurl -s -o /dev/null -w '%{http_code}\\n' -X POST \"$BASE/c/nope/echo\" \\\n -H \"Authorization: Bearer $VT_TTAI_APP_TOKEN\" -d '{}'\n\n# unknown function on a real customer → 404\ncurl -s -o /dev/null -w '%{http_code}\\n' -X POST \"$BASE/c/ttai/nope\" \\\n -H \"Authorization: Bearer $VT_TTAI_APP_TOKEN\" -d '{}'\n```\n",[],[420],"30ce2821-4fe4-4973-909d-41ce65b1d219","AGENTS.md","a5bb54c0-7571-11f1-b237-1607ee4eb77e",640,["D",1788752201431],"# uAgents — Local Guide\n\n> A single Val Town Hono app for authenticated customer functions and the beer.css admin UI. Read `../AGENTS.md` first; this file adds uAgents-only boundaries.\n\n## Start Here\n\n1. Read `README.md` for architecture, routes, auth, data retention, and environment contracts.\n2. Read `val.yml` before deployment or environment changes; it is the local metadata contract.\n3. Read `valtown-platform-reference.md` only for generic Val Town API and platform facts; this local guide wins on project conventions.\n4. Read the nearest module before editing: `backend/core/`, `backend/customers/`, `backend/agents/`, `backend/integrations/`, or `frontend/`.\n5. Keep `index.http.ts` as the only HTTP-trigger filename. Val Town infers trigger type from filenames.\n\n## Module Map\n\n```\nindex.http.ts\n├── backend/core/ app setup, auth, API errors, SQLite, admin handlers\n├── backend/customers/ customer definitions, route registration, function contracts\n├── backend/agentic-core/ shared agent runtime and tool loop\n├── backend/agents/ concrete agents and tool adapters\n├── backend/integrations/ customer-agnostic external-service clients\n├── frontend/ Preact admin UI and beer.css layers\n└── scripts/ local, real-service diagnostic helpers\n```\n\n## Change Boundaries\n\n| Change | Start with | Preserve |\n| --- | --- | --- |\n| Customer function | `backend/customers//` + `registry.ts` | Customer-scoped auth and explicit registration |\n| Agent behavior | `backend/agents/` + `agentic-core/` | Shared runtime owns LLM setup; agents stay declarative |\n| External integration | `backend/integrations//` | Typed per-customer secrets; visible 4xx/503 failures |\n| API/auth/admin | `backend/core/` | Hono middleware, constant-time key comparison, admin gate |\n| Admin UI | `frontend/` | beer.css tokens → base → components; no baked palette |\n\n## Non-Negotiables\n\n- Keep routing in Hono. Do not hand-roll path parsing.\n- Keep reusable integration logic customer-agnostic; customer modules own route registration and validation.\n- Read secrets only through the typed resolver in `backend/core/app.ts`; never put a value in source, logs, or responses.\n- Keep function request and response logging bounded and header-free; preserve retention limits.\n- Use Deno-native imports and the native `vt` CLI from this directory. Do not add Node build tooling.\n- Run `deno check --allow-import index.http.ts`, `deno lint`, and `deno fmt` before deployment.\n- Do not alter `.vt/` link state by hand.\n\n## Key Files\n\n- `README.md` — full architecture, API surface, auth, environment, and local scripts\n- `valtown-platform-reference.md` — preserved Val Town platform/API reference\n- `val.yml` — Val Town metadata, trigger declaration, and environment inventory\n- `index.http.ts` — only HTTP entry point\n- `backend/core/app.ts` — typed global and customer secret resolvers\n- `backend/customers/registry.ts` — registered customer applications\n- `backend/agentic-core/runtime.ts` — shared LLM runtime\n- `frontend/styles/index.ts` — composed admin UI stylesheet\n",[],[429],"5115440a-9447-4dc7-9012-dd40a4d49af6",".vtignore","a5c30cba-7571-11f1-ad5a-1607ee4eb77e",575,["D",1783058175024],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor\n",[],[437],"c43a91fc-7768-445d-894c-09919e8212d3",".gitignore","a9258dc4-843a-11f1-b20a-1607ee4eb77e",603,["D",1784552289835],".env\nscripts/.env\n",[],[445],"d84c0d0f-d790-4707-b0e0-a3639874eb9d",".env.sample","a09df8b8-68a5-11f1-9dd7-1607ee4eb77e",420,["D",1781519599844],"# Shopify Dev Dashboard app credentials (same vars as pushed to Val Town)\n# JJS — Jhaji merchant store\nJJS_SHOPIFY_SHOP=ttai-merchandise-dev.myshopify.com\nJJS_SHOPIFY_CLIENT_ID=\nJJS_SHOPIFY_CLIENT_SECRET=\n\n# TTAI — ToughTongue AI internal dev store (for testing before production)\nTTAI_SHOPIFY_SHOP=\nTTAI_SHOPIFY_CLIENT_ID=\nTTAI_SHOPIFY_CLIENT_SECRET=\n",[],[453],["D",1784552289843],[],[18,191],["D",1782893137906],[],[18,199],["D",1785503537455],[],[18,207],["D",1782893137775],[],[18,83],["D",1784111059795],[],[18,219],["D",1788892242730],[],[18,226],["D",1782157536216],[],[18,233],["D",1782893137939],[],[18,240],["D",1782893137811],[],[18,247],["D",1781519599541],[364,365,366,367,368,369,370,371,372],[18],"8df317d9-1e53-4d64-bbaf-05bab76aa472","types.ts","f4109fca-6128-11f1-90f7-1607ee4eb77e","f2b2b82a-6128-11f1-9496-1607ee4eb77e",334,["D",1780944386447],8,"// types.ts — View models passed from backend handlers into the admin UI.\n\n/** One customer row for the Auth tab + the data the Debug/Integration tabs need. */\nexport interface CustomerView {\n id: string;\n label: string;\n fns: string[];\n secret: string;\n enabled: boolean;\n configured: boolean;\n updatedTs: string;\n descriptions: Record; // fn name → plain-language description\n sampleBodies: Record>; // fn name → example POST body\n paramsSchemas: Record>; // fn name → JSON Schema\n}\n\n/** A single logged invocation, shown (expandable) on the Recent calls page. */\nexport interface CallView {\n id: number;\n customer: string;\n fn: string;\n ok: boolean;\n status: number;\n latency_ms: number;\n detail: string;\n req_body: string;\n resp_body: string;\n ts: string;\n}\n\n/** The full /admin page model: signed-in user + every customer's config. */\nexport interface AdminView {\n username: string;\n avatarUrl?: string;\n baseUrl: string;\n customers: CustomerView[];\n saved: boolean;\n}\n\n/** A customer's selectable functions, for the Recent calls page filters. */\nexport interface CallsCustomer {\n id: string;\n label: string;\n fns: string[];\n}\n\nexport interface CallsView {\n username: string;\n avatarUrl?: string;\n baseUrl: string;\n customers: CallsCustomer[];\n}\n",[],[500,491],"frontend","a1457f60-24f4-4020-a557-4cff6f56b16e","shared.tsx","fe520698-632d-11f1-aacf-1607ee4eb77e",386,["D",1780952006405],"/** @jsxImportSource https://esm.sh/preact@10.29.1 */\n// shared.tsx — Render helpers + navbar/chrome shared across admin pages.\n\nimport { render } from \"https://esm.sh/preact-render-to-string@6.6.7?deps=preact@10.29.1\";\nimport type { ComponentChildren, VNode } from \"https://esm.sh/preact@10.29.1\";\n\n/** Serialize a Preact tree into a full HTML document string. */\nexport function doc(node: VNode): string {\n return \"\" + render(node);\n}\n\n/** Serialize data for safe inlining inside a `\n \n

History · scripts