A small, realistic agentic web app: a signed-in customer chats with a support agent that looks up orders and proposes refunds, which the customer approves in the UI. It is the project for Parts XI, XII and XIV of the JavaScript field guide (§63, §68, §74–§78).
- Zero runtime dependencies:
node:httpon the server, plain ES modules in the browser. - Session-cookie auth (scrypt, HttpOnly, SameSite), CSRF tokens + Fetch Metadata.
- An agent endpoint that streams typed events (AG-UI style) over Server-Sent Events.
- An actionable-UI component registry with prop validation and human approval.
- Strict CSP with Trusted Types, rate limits, one fail-closed error handler.
- A 26-test Playwright suite: UI, API, security, clock, accessibility, visual.