[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","cleitoncosta","name","currentness-attestor","path","main.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":42,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":12,"_13":44},"permalink","https://www.val.town/x/cleitoncosta/currentness-attestor/code/main.ts","extension","id","0c589b3b-b74a-4bb9-9785-dd8b54fa7282","fileId","01a078ee-7696-7756-bb0b-01e476076611","parentId","branchId","85bfc61c-5aa3-47ce-bf09-4994778cb3c8","branchVersion",47,"latest",true,"createdAt",["D",1788742646534],"version",21,"fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst VERSION = \"0.1.0\";\nconst MAX_BODY_BYTES = 256 * 1024;\nconst MAX_TIMEOUT_MS = 10_000;\nconst MAX_REDIRECTS = 3;\nconst ALLOWED_METHODS = new Set([\"AUTO\", \"HEAD\", \"GET\", \"OPTIONS\"]);\n\nconst corsHeaders = {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-methods\": \"GET, POST, OPTIONS\",\n \"access-control-allow-headers\": \"content-type\",\n \"access-control-max-age\": \"86400\",\n};\n\nfunction json(data: unknown, status = 200) {\n return new Response(JSON.stringify(data, null, 2), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...corsHeaders },\n });\n}\n\nfunction text(body: string, contentType = \"text/plain; charset=utf-8\") {\n return new Response(body, { headers: { \"content-type\": contentType, ...corsHeaders } });\n}\n\nfunction isPrivateIpv4(ip: string): boolean {\n const p = ip.split(\".\").map(Number);\n if (p.length !== 4 || p.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return false;\n const [a, b] = p;\n return a === 0 || a === 10 || a === 127 ||\n (a === 100 && b >= 64 && b <= 127) ||\n (a === 169 && b === 254) ||\n (a === 172 && b >= 16 && b <= 31) ||\n (a === 192 && b === 0) ||\n (a === 192 && b === 168) ||\n (a === 198 && (b === 18 || b === 19)) ||\n a >= 224;\n}\n\nfunction isPrivateIpv6(ip: string): boolean {\n const x = ip.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n return x === \"::\" || x === \"::1\" || x.startsWith(\"fe8\") || x.startsWith(\"fe9\") ||\n x.startsWith(\"fea\") || x.startsWith(\"feb\") || x.startsWith(\"fc\") || x.startsWith(\"fd\") ||\n x.startsWith(\"::ffff:127.\") || x.startsWith(\"::ffff:10.\") || x.startsWith(\"::ffff:192.168.\");\n}\n\nasync function assertPublicUrl(raw: string): Promise {\n let u: URL;\n try {\n u = new URL(raw);\n } catch {\n throw new Error(\"INVALID_URL\");\n }\n if (u.protocol !== \"https:\" && u.protocol !== \"http:\") throw new Error(\"UNSUPPORTED_SCHEME\");\n if (u.username || u.password) throw new Error(\"URL_CREDENTIALS_NOT_ALLOWED\");\n const host = u.hostname.toLowerCase();\n if (!host || host === \"localhost\" || host.endsWith(\".local\") || host.endsWith(\".internal\") || host === \"0.0.0.0\") {\n throw new Error(\"PRIVATE_HOST_BLOCKED\");\n }\n if (isPrivateIpv4(host) || isPrivateIpv6(host)) throw new Error(\"PRIVATE_IP_BLOCKED\");\n\n // Resolve through DNS-over-HTTPS before every request/redirect. Val Town\n // does not expose Deno.resolveDns in this runtime, so we fail closed on DoH errors.\n if (!/^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(host) && !host.includes(\":\")) {\n const ips: string[] = [];\n try {\n for (const type of [\"A\", \"AAAA\"]) {\n const q = new URL(\"https://cloudflare-dns.com/dns-query\");\n q.searchParams.set(\"name\", host);\n q.searchParams.set(\"type\", type);\n const r = await fetch(q, { headers: { accept: \"application/dns-json\" }, redirect: \"error\" });\n if (!r.ok) continue;\n const data = await r.json() as { Answer?: Array<{ data?: string; type?: number }> };\n for (const answer of data.Answer || []) {\n if (answer.data && ((type === \"A\" && answer.type === 1) || (type === \"AAAA\" && answer.type === 28))) ips.push(answer.data);\n }\n }\n } catch {\n throw new Error(\"DNS_RESOLUTION_FAILED\");\n }\n if (!ips.length) throw new Error(\"DNS_RESOLUTION_EMPTY\");\n if (ips.some((ip) => isPrivateIpv4(ip) || isPrivateIpv6(ip))) throw new Error(\"PRIVATE_DNS_TARGET_BLOCKED\");\n }\n return u;\n}\n\nasync function sha256Hex(input: Uint8Array | string): Promise {\n const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes));\n return [...digest].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function readCappedBody(res: Response): Promise<{ bytes: Uint8Array; truncated: boolean }> {\n if (!res.body) return { bytes: new Uint8Array(), truncated: false };\n const reader = res.body.getReader();\n const chunks: Uint8Array[] = [];\n let total = 0;\n let truncated = false;\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n if (!value) continue;\n const remaining = MAX_BODY_BYTES - total;\n if (value.byteLength > remaining) {\n if (remaining > 0) chunks.push(value.slice(0, remaining));\n total += Math.max(remaining, 0);\n truncated = true;\n await reader.cancel();\n break;\n }\n chunks.push(value);\n total += value.byteLength;\n if (total >= MAX_BODY_BYTES) {\n truncated = true;\n await reader.cancel();\n break;\n }\n }\n } finally {\n reader.releaseLock();\n }\n const out = new Uint8Array(total);\n let offset = 0;\n for (const chunk of chunks) { out.set(chunk, offset); offset += chunk.byteLength; }\n return { bytes: out, truncated };\n}\n\ntype ProbeInput = {\n endpointUrl: string;\n docsUrl?: string;\n docsExpectedContains?: string | string[];\n method?: string;\n expectedStatus?: number | number[];\n expectedContains?: string;\n timeoutMs?: number;\n claim?: string;\n};\n\nasync function probe(rawUrl: string, method: string, timeoutMs: number, wantBody: boolean) {\n let current = await assertPublicUrl(rawUrl);\n const redirects: Array<{ from: string; status: number; to: string }> = [];\n const started = performance.now();\n\n for (let i = 0; i <= MAX_REDIRECTS; i++) {\n current = await assertPublicUrl(current.toString());\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n let res: Response;\n try {\n res = await fetch(current, {\n method,\n redirect: \"manual\",\n signal: controller.signal,\n headers: { \"user-agent\": `Currentness-Attestor/${VERSION}` },\n });\n\n if ([301, 302, 303, 307, 308].includes(res.status)) {\n const loc = res.headers.get(\"location\");\n if (!loc) throw new Error(\"REDIRECT_WITHOUT_LOCATION\");\n if (i === MAX_REDIRECTS) throw new Error(\"TOO_MANY_REDIRECTS\");\n const next = new URL(loc, current);\n await assertPublicUrl(next.toString());\n redirects.push({ from: current.toString(), status: res.status, to: next.toString() });\n try { await res.body?.cancel(); } catch { /* no-op */ }\n current = next;\n continue;\n }\n\n let bodyBytes = new Uint8Array();\n let bodyTruncated = false;\n if (wantBody && method !== \"HEAD\") {\n const capped = await readCappedBody(res);\n bodyBytes = capped.bytes;\n bodyTruncated = capped.truncated;\n } else {\n try { await res.body?.cancel(); } catch { /* no-op */ }\n }\n const elapsed = Math.round(performance.now() - started);\n clearTimeout(timer);\n return {\n finalUrl: current.toString(),\n status: res.status,\n statusText: res.statusText,\n latencyMs: elapsed,\n redirects,\n headers: {\n contentType: res.headers.get(\"content-type\"),\n etag: res.headers.get(\"etag\"),\n lastModified: res.headers.get(\"last-modified\"),\n cacheControl: res.headers.get(\"cache-control\"),\n },\n bodyBytes,\n bodyTruncated,\n };\n } finally {\n clearTimeout(timer);\n }\n }\n throw new Error(\"UNREACHABLE\");\n}\n\nasync function attest(input: ProbeInput) {\n if (!input.endpointUrl) throw new Error(\"endpointUrl is required\");\n if (input.endpointUrl.length > 2048 || (input.docsUrl && input.docsUrl.length > 2048)) throw new Error(\"URL_TOO_LONG\");\n if (input.claim && input.claim.length > 500) throw new Error(\"CLAIM_TOO_LONG\");\n const methodRequested = (input.method || \"AUTO\").toUpperCase();\n if (!ALLOWED_METHODS.has(methodRequested)) throw new Error(\"METHOD_NOT_ALLOWED\");\n let method = methodRequested === \"AUTO\" ? (input.expectedContains ? \"GET\" : \"HEAD\") : methodRequested;\n if (input.expectedContains && method === \"HEAD\") method = \"GET\";\n if (input.expectedContains && input.expectedContains.length > 500) throw new Error(\"EXPECTED_CONTAINS_TOO_LONG\");\n const docsNeedles = input.docsExpectedContains == null ? [] : (Array.isArray(input.docsExpectedContains) ? input.docsExpectedContains : [input.docsExpectedContains]);\n if (docsNeedles.length > 5 || docsNeedles.some((s) => typeof s !== \"string\" || s.length > 500)) throw new Error(\"DOCS_EXPECTATIONS_INVALID\");\n const expectedStatuses = input.expectedStatus == null\n ? null\n : (Array.isArray(input.expectedStatus) ? input.expectedStatus : [input.expectedStatus]).map(Number);\n if (expectedStatuses && expectedStatuses.some((s) => !Number.isInteger(s) || s < 100 || s > 599)) throw new Error(\"INVALID_EXPECTED_STATUS\");\n const statusWouldPass = (status: number) => expectedStatuses ? expectedStatuses.includes(status) : status >= 200 && status < 400;\n const timeoutRaw = input.timeoutMs == null ? 5000 : Number(input.timeoutMs);\n if (!Number.isFinite(timeoutRaw)) throw new Error(\"INVALID_TIMEOUT\");\n const timeoutMs = Math.min(Math.max(timeoutRaw, 250), MAX_TIMEOUT_MS);\n const checkedAt = new Date().toISOString();\n const wantBody = method === \"GET\" || Boolean(input.expectedContains);\n\n let endpoint: Awaited>;\n let methodFallback: Record | null = null;\n try {\n endpoint = await probe(input.endpointUrl, method, timeoutMs, wantBody);\n } catch (error) {\n const firstReason = error instanceof Error ? error.message : String(error);\n if (methodRequested === \"AUTO\" && method === \"HEAD\") {\n try {\n method = \"GET\";\n endpoint = await probe(input.endpointUrl, method, timeoutMs, false);\n methodFallback = { from: \"HEAD\", to: \"GET\", reason: firstReason };\n } catch (fallbackError) {\n const reason = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);\n const failed = {\n service: \"Currentness Attestor\",\n version: VERSION,\n checkedAt,\n claim: input.claim || null,\n verdict: \"FAIL\",\n reason,\n methodRequested,\n methodFallback: { from: \"HEAD\", to: \"GET\", reason: firstReason, fallbackError: reason },\n endpoint: { requestedUrl: input.endpointUrl, reachable: false },\n evidenceBoundary: \"Public HTTP surface only. No authenticated/private runtime, downstream business logic, or payment settlement was verified.\",\n };\n return { ...failed, evidenceDigest: await sha256Hex(JSON.stringify(failed)) };\n }\n } else {\n const failed = {\n service: \"Currentness Attestor\",\n version: VERSION,\n checkedAt,\n claim: input.claim || null,\n verdict: \"FAIL\",\n reason: firstReason,\n methodRequested,\n endpoint: { requestedUrl: input.endpointUrl, reachable: false },\n evidenceBoundary: \"Public HTTP surface only. No authenticated/private runtime, downstream business logic, or payment settlement was verified.\",\n };\n return { ...failed, evidenceDigest: await sha256Hex(JSON.stringify(failed)) };\n }\n }\n\n if (methodRequested === \"AUTO\" && method === \"HEAD\" && !statusWouldPass(endpoint.status)) {\n const headStatus = endpoint.status;\n try {\n const getEndpoint = await probe(input.endpointUrl, \"GET\", timeoutMs, false);\n methodFallback = { from: \"HEAD\", to: \"GET\", headStatus, getStatus: getEndpoint.status, reason: \"HEAD_DID_NOT_MEET_EXPECTATION\" };\n endpoint = getEndpoint;\n method = \"GET\";\n } catch (fallbackError) {\n methodFallback = {\n from: \"HEAD\",\n to: \"GET\",\n headStatus,\n reason: \"HEAD_DID_NOT_MEET_EXPECTATION\",\n fallbackError: fallbackError instanceof Error ? fallbackError.message : String(fallbackError),\n };\n }\n }\n\n const statusPass = statusWouldPass(endpoint.status);\n const bodyText = wantBody ? new TextDecoder().decode(endpoint.bodyBytes) : \"\";\n const containsPass = input.expectedContains ? bodyText.includes(input.expectedContains) : null;\n const runtimePass = statusPass && (containsPass !== false);\n const bodySha256 = endpoint.bodyBytes.byteLength ? await sha256Hex(endpoint.bodyBytes) : null;\n\n let docs: Record | null = null;\n let docsPass: boolean | null = docsNeedles.length ? false : null;\n if (input.docsUrl) {\n try {\n const d = await probe(input.docsUrl, \"GET\", timeoutMs, true);\n const docsText = new TextDecoder().decode(d.bodyBytes);\n const contains = docsNeedles.map((needle) => ({ needle, pass: docsText.includes(needle) }));\n docsPass = docsNeedles.length ? contains.every((x) => x.pass) : null;\n docs = {\n requestedUrl: input.docsUrl,\n finalUrl: d.finalUrl,\n status: d.status,\n latencyMs: d.latencyMs,\n contentType: d.headers.contentType,\n bodyBytesCaptured: d.bodyBytes.byteLength,\n bodyTruncated: d.bodyTruncated,\n bodySha256: d.bodyBytes.byteLength ? await sha256Hex(d.bodyBytes) : null,\n expectedContains: contains,\n };\n } catch (error) {\n docsPass = docsNeedles.length ? false : null;\n docs = { requestedUrl: input.docsUrl, error: error instanceof Error ? error.message : String(error), expectedContains: docsNeedles };\n }\n } else if (docsNeedles.length) {\n throw new Error(\"docsUrl required when docsExpectedContains is set\");\n }\n\n const verdict = runtimePass && (docsPass !== false) ? \"PASS\" : \"FAIL\";\n const evidence = {\n service: \"Currentness Attestor\",\n version: VERSION,\n checkedAt,\n claim: input.claim || null,\n verdict,\n assertions: {\n expectedStatus: expectedStatuses,\n statusPass,\n expectedContains: input.expectedContains || null,\n containsPass,\n runtimePass,\n docsPass,\n },\n endpoint: {\n requestedUrl: input.endpointUrl,\n finalUrl: endpoint.finalUrl,\n methodRequested,\n methodUsed: method,\n methodFallback,\n reachable: true,\n status: endpoint.status,\n statusText: endpoint.statusText,\n latencyMs: endpoint.latencyMs,\n redirects: endpoint.redirects,\n headers: endpoint.headers,\n bodyBytesCaptured: endpoint.bodyBytes.byteLength,\n bodyTruncated: endpoint.bodyTruncated,\n bodySha256,\n },\n docs,\n evidenceBoundary: \"Public HTTP surface only. No authenticated/private runtime, downstream business logic, semantic correctness, or payment settlement was verified.\",\n };\n return { ...evidence, evidenceDigest: await sha256Hex(JSON.stringify(evidence)) };\n}\n\nconst contract = {\n name: \"Currentness Attestor\",\n version: VERSION,\n status: \"beta\",\n purpose: \"Generate bounded, reproducible evidence that a public HTTP surface currently matches explicit expectations.\",\n endpoints: {\n \"GET /\": \"service contract\",\n \"GET /attest?url=https://example.com&status=200\": \"quick probe\",\n \"POST /attest\": \"structured attestation\",\n \"GET /openapi.json\": \"OpenAPI 3.1 contract\",\n \"GET /.well-known/agent.json\": \"machine discovery\",\n \"GET /skill.md\": \"agent-readable skill\",\n \"GET /monitor/latest\": \"latest stored currentness observation per monitored rail\",\n \"GET /monitor/history?target=toku-open-jobs&limit=24\": \"recent observations for one monitored rail\",\n \"GET /arc-origin-proof\": \"public ARC/v0 origin-continuity proof for Maestro_A0\",\n },\n constraints: {\n methods: [...ALLOWED_METHODS],\n timeoutMaxMs: MAX_TIMEOUT_MS,\n bodyCaptureMaxBytes: MAX_BODY_BYTES,\n redirectsMax: MAX_REDIRECTS,\n privateNetworkTargets: \"blocked\",\n credentialsAndCustomAuthHeaders: \"not accepted\",\n },\n};\n\nconst openapi = {\n openapi: \"3.1.0\",\n info: { title: \"Currentness Attestor API\", version: VERSION },\n paths: {\n \"/attest\": {\n post: {\n summary: \"Attest a public HTTP endpoint against explicit expectations\",\n requestBody: { required: true, content: { \"application/json\": { schema: {\n type: \"object\", required: [\"endpointUrl\"], properties: {\n endpointUrl: { type: \"string\", format: \"uri\" }, docsUrl: { type: \"string\", format: \"uri\" },\n method: { type: \"string\", enum: [\"AUTO\", \"HEAD\", \"GET\", \"OPTIONS\"], default: \"AUTO\" },\n expectedStatus: { oneOf: [{ type: \"integer\", minimum: 100, maximum: 599 }, { type: \"array\", items: { type: \"integer\", minimum: 100, maximum: 599 } }] },\n expectedContains: { type: \"string\", maxLength: 500 },\n docsExpectedContains: { oneOf: [{ type: \"string\", maxLength: 500 }, { type: \"array\", maxItems: 5, items: { type: \"string\", maxLength: 500 } }] },\n timeoutMs: { type: \"integer\", minimum: 250, maximum: MAX_TIMEOUT_MS }, claim: { type: \"string\", maxLength: 500 },\n },\n } } } },\n responses: { \"200\": { description: \"Attestation evidence\" }, \"400\": { description: \"Invalid request\" } },\n },\n },\n \"/monitor/latest\": {\n get: {\n summary: \"Return the latest stored currentness observation for each monitored economic rail\",\n responses: { \"200\": { description: \"Latest monitor observations\" } },\n },\n },\n \"/monitor/history\": {\n get: {\n summary: \"Return recent observations for one monitored target\",\n parameters: [\n { name: \"target\", in: \"query\", required: true, schema: { type: \"string\", pattern: \"^[a-z0-9-]{1,64}$\" } },\n { name: \"limit\", in: \"query\", required: false, schema: { type: \"integer\", minimum: 1, maximum: 100, default: 24 } },\n ],\n responses: { \"200\": { description: \"Monitor history\" }, \"400\": { description: \"Invalid query\" } },\n },\n },\n },\n};\n\nconst skillMd = `# Currentness Attestor\\n\\nUse this service when an agent must decide whether a **public HTTP claim is current enough to act on** before spending time, compute, capital, or human attention.\\n\\nThe service is intentionally bounded: no credentials, cookies, custom authorization headers, browser actions, private-network targets, arbitrary code execution, or payment signing. A PASS proves only the explicit public-surface assertions at the returned timestamp.\\n\\n## POST /attest\\n\\n\\`\\`\\`json\\n{\\n \"endpointUrl\": \"https://example.com/health\",\\n \"method\": \"AUTO\",\\n \"expectedStatus\": 200,\\n \"expectedContains\": \"ok\",\\n \"docsUrl\": \"https://example.com/docs\",\\n \"docsExpectedContains\": [\"GET /health\"],\\n \"claim\": \"The documented health surface is live now\"\\n}\\n\\`\\`\\`\\n\\nAUTO uses HEAD first when no body assertion is required and falls back to GET when HEAD does not meet the expectation. The fallback is recorded instead of silently hidden.\\n\\nThe response includes checkedAt, runtime/docs assertion states, final URL, method used, fallback evidence, latency, redirects, selected headers, capped body SHA-256, evidenceBoundary, and evidenceDigest.\\n\\n## Economic-rail monitor\\n\\nGET /monitor/latest returns the latest observations for the rails currently used by this experiment. GET /monitor/history?target=&limit=24 returns recent observations for one rail. Surface health is not the same thing as paid demand, inventory, or payout health; those require separate assertions.\\n`;\n\nexport default async function handler(req: Request): Promise {\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204, headers: corsHeaders });\n const u = new URL(req.url);\n\n if (req.method === \"GET\" && u.pathname === \"/arc-origin-proof\") return json({\n schemaVersion: \"arc-origin-proof/v1\",\n subject: \"Maestro_A0\",\n operatorSurface: \"Val Town project cleitoncosta/currentness-attestor\",\n agentPublicId: \"01M1WN96MS6WDXGW886YD2WFZZ\",\n wallet: \"0x8307fFc56ef96757F7d2e978F0D7FfEA249D6dFA\",\n challenge: \"arc_origin_ab841c227bd49a091e5767db272c28c6\",\n statement: \"This stable public endpoint is controlled through the same operator account that authorized Maestro_A0's wallet registration and publication. It proves public publication of the exact ARC challenge; it does not by itself prove Selah approval, attribution quality, or payment.\",\n contributionTraceIds: [\n \"01M1WNW1XPBV7VY96WWFPGKEHH\",\n \"01M1WNWHGVXGCBW8RGW09VV93J\",\n \"01M1WNWKRCA2WHQ32QPKVQNEBJ\"\n ],\n publishedAt: \"2026-09-07T00:50:00Z\"\n });\n if (req.method === \"GET\" && u.pathname === \"/\") return json(contract);\n if (req.method === \"GET\" && u.pathname === \"/openapi.json\") return json(openapi);\n if (req.method === \"GET\" && u.pathname === \"/.well-known/agent.json\") return json({\n name: contract.name, version: VERSION, capabilities: [\"http-currentness\", \"docs-vs-runtime\", \"evidence-digest\"], openapi: \"/openapi.json\", skill: \"/skill.md\",\n });\n if (req.method === \"GET\" && u.pathname === \"/skill.md\") return text(skillMd, \"text/markdown; charset=utf-8\");\n\n if (req.method === \"GET\" && u.pathname === \"/monitor/latest\") {\n try {\n const result = await sqlite.execute(`SELECT m.target_id, m.target_label, m.checked_at, m.verdict,\n m.http_status, m.latency_ms, m.reason, m.evidence_digest\n FROM monitor_results m\n JOIN (SELECT target_id, MAX(id) AS max_id FROM monitor_results GROUP BY target_id) latest\n ON latest.max_id = m.id\n ORDER BY m.target_id`);\n return json({ generatedAt: new Date().toISOString(), targets: result.rows });\n } catch (error) {\n return json({ generatedAt: new Date().toISOString(), targets: [], state: \"MONITOR_NOT_INITIALIZED\", error: error instanceof Error ? error.message : String(error) });\n }\n }\n\n if (req.method === \"GET\" && u.pathname === \"/monitor/history\") {\n const target = u.searchParams.get(\"target\") || \"\";\n const limit = Math.min(Math.max(Number(u.searchParams.get(\"limit\") || 24), 1), 100);\n if (!/^[a-z0-9-]{1,64}$/.test(target) || !Number.isFinite(limit)) return json({ error: \"INVALID_MONITOR_QUERY\" }, 400);\n try {\n const result = await sqlite.execute({\n sql: `SELECT target_id, target_label, checked_at, verdict, http_status, latency_ms, reason, evidence_digest\n FROM monitor_results WHERE target_id = ? ORDER BY id DESC LIMIT ?`,\n args: [target, limit],\n });\n return json({ target, count: result.rows.length, observations: result.rows });\n } catch (error) {\n return json({ error: \"MONITOR_NOT_INITIALIZED\", detail: error instanceof Error ? error.message : String(error) }, 503);\n }\n }\n\n if (u.pathname === \"/attest\" && req.method === \"GET\") {\n const url = u.searchParams.get(\"url\") || \"\";\n const status = u.searchParams.get(\"status\");\n const contains = u.searchParams.get(\"contains\") || undefined;\n try {\n return json(await attest({ endpointUrl: url, expectedStatus: status ? Number(status) : undefined, expectedContains: contains }));\n } catch (error) {\n return json({ error: error instanceof Error ? error.message : String(error) }, 400);\n }\n }\n\n if (u.pathname === \"/attest\" && req.method === \"POST\") {\n try {\n const input = await req.json() as ProbeInput;\n return json(await attest(input));\n } catch (error) {\n return json({ error: error instanceof Error ? error.message : String(error) }, 400);\n }\n }\n\n return json({ error: \"NOT_FOUND\", contract: \"/\" }, 404);\n}\n\n\nexport { attest };\n","deleted",false,"label",[14],"29d89160-b2c5-4968-aef7-006c8b40fa1e",["D",1788735288858],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Live docs-vs-runtime evidence API","imageUrl","userId","6cc24525-830b-4db3-9c9c-fd19fb50e91f","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0773d-9d6b-7580-a53a-683363c351c8","tursoName","29d89160b2c54968aef7006c8b40fa1e","tursoHostname","29d89160b2c54968aef7006c8b40fa1e-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789522252250],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",152,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Cleiton Costa","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgWisWQiXts_2fy5iRiRgl8A6c7Ef94eqE3ur-4mlyUrpCBmQ=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":62,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]