[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_104":105,"_106":107},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","sebas1","name","rumbo-crm-openai-staging","path","submission_gate.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":58,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/sebas1/rumbo-crm-openai-staging/code/submission_gate.ts","extension","id","721e2295-aecb-4342-8f50-c4d107772897","fileId","fdf0ffb8-ad58-11f1-888a-1607ee4eb77e","parentId","branchId","ceba545d-7cc1-405d-a0c7-d27e7e735161","branchVersion",270,"latest",true,"createdAt",["D",1789347903020],"version",62,"fileType","script","content","import portalPacket from \"./PORTAL_PACKET.json\" with { type: \"json\" };\n\nconst BASE = \"https://rumbo-crm-openai-staging.val.run\";\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_LOGO_SHA256 = \"3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\";\nconst LISTING_URLS = {\n website: `${BASE}/`,\n support: `${BASE}/support`,\n privacy: `${BASE}/privacy`,\n terms: `${BASE}/terms`,\n};\n\nconst facts: Record = {};\nconst technicalFailures: string[] = [];\nconst workspaceDraftBlockers: string[] = [];\nconst publicDirectoryBlockers: string[] = [];\nconst governanceBlockers: string[] = [];\n\nasync function check(name: string, fn: () => Promise) {\n try {\n const ok = await fn();\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) technicalFailures.push(name);\n } catch (e) {\n facts[name] = `ERROR:${e instanceof Error ? e.message : String(e)}`;\n technicalFailures.push(name);\n }\n}\n\nasync function sha256Hex(bytes: Uint8Array) {\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes));\n return Array.from(digest, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nconst mcpHeaders = {\n origin: \"https://chatgpt.com\",\n accept: \"application/json, text/event-stream\",\n \"content-type\": \"application/json\",\n \"mcp-protocol-version\": \"2025-06-18\",\n};\n\nasync function mcpCall(name: string, args: Record) {\n const r = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\",\n headers: mcpHeaders,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: name, method: \"tools/call\", params: { name, arguments: args } }),\n });\n if (r.status !== 200) throw new Error(`mcp_call_${name}_status_${r.status}`);\n return await r.json();\n}\n\nawait check(\"health_exact_sha\", async () => {\n const r = await fetch(`${BASE}/api/openai-plugin/health`, {\n headers: { origin: \"https://chatgpt.com\", accept: \"application/json\" },\n });\n if (r.status !== 200) return false;\n const b = await r.json();\n return b?.sourceSha === EXPECTED_SHA && b?.productionAuthority === false && b?.submissionAuthority === false;\n});\n\nawait check(\"tool_annotations\", async () => {\n const r = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\",\n headers: mcpHeaders,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method: \"tools/list\", params: {} }),\n });\n if (r.status !== 200) return false;\n const b = await r.json();\n const tools = b?.result?.tools ?? [];\n facts.tool_count = tools.length;\n return tools.length === 4 && tools.every((t: any) =>\n t.annotations?.readOnlyHint === true &&\n t.annotations?.openWorldHint === false &&\n t.annotations?.destructiveHint === false\n );\n});\n\nawait check(\"response_minimization\", async () => {\n const fixtures = [\n [\"crm_get_service_readiness\", {}, new Set([\"state\", \"customer_data_tools_exposed\", \"mutating_tools_exposed\", \"production_authority\", \"submission_authority\"])],\n [\"crm_prepare_note\", { workspace_id: \"ws_demo\", subject_id: \"subject_demo\", note: \"Synthetic reviewer note.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"subject_id\", \"note\"])],\n [\"crm_prepare_lead_stage_change\", { workspace_id: \"ws_demo\", lead_id: \"lead_demo\", from_stage: \"new\", to_stage: \"qualified\", reason: \"Synthetic reviewer fixture.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"lead_id\", \"from_stage\", \"to_stage\", \"reason\"])],\n [\"crm_prepare_outreach_draft\", { workspace_id: \"ws_demo\", lead_id: \"lead_demo\", channel: \"email\", objective: \"Prepare a synthetic follow-up draft.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"lead_id\", \"channel\", \"objective\", \"send_authorized\"])],\n ] as const;\n\n const forbiddenKey = /(token|secret|password|api[_-]?key|debug|stack|authorization|cookie)/i;\n for (const [name, args, expectedKeys] of fixtures) {\n const body: any = await mcpCall(name, args as Record);\n const sc = body?.result?.structuredContent;\n if (!sc || typeof sc !== \"object\") return false;\n const keys = Object.keys(sc);\n if (keys.some((k) => forbiddenKey.test(k))) return false;\n if (keys.some((k) => !expectedKeys.has(k as never))) return false;\n const serialized = JSON.stringify(sc).toLowerCase();\n if (serialized.includes(\"bearer \") || serialized.includes(\"sk-\") || serialized.includes(\"stack trace\")) return false;\n }\n return true;\n});\n\nawait check(\"listing_urls_public\", async () => {\n const responses = await Promise.all(Object.values(LISTING_URLS).map((url) => fetch(url, { redirect: \"follow\" })));\n facts.listing_url_statuses = Object.fromEntries(Object.keys(LISTING_URLS).map((key, i) => [key, responses[i].status]));\n return responses.every((r) => r.status >= 200 && r.status < 300);\n});\n\nawait check(\"support_mcp_semantics\", async () => {\n const r = await fetch(LISTING_URLS.support, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return (text.includes(\"rumbo crm\") || text.includes(\"rumbo ia crm\")) &&\n (text.includes(\"proposal-only\") || text.includes(\"review\") || text.includes(\"proposal tools\")) &&\n (text.includes(\"openai\") || text.includes(\"chatgpt\")) &&\n (text.includes(\"sebastian@rumbo.verso.fans\") || text.includes(\"contact support\"));\n});\n\nawait check(\"privacy_mcp_disclosure\", async () => {\n const r = await fetch(LISTING_URLS.privacy, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return (text.includes(\"mcp\") || text.includes(\"chatgpt\") || text.includes(\"plugin\")) &&\n (text.includes(\"note\") || text.includes(\"lead\") || text.includes(\"workspace\") || text.includes(\"identifier\"));\n});\n\nawait check(\"terms_bounded_semantics\", async () => {\n const r = await fetch(LISTING_URLS.terms, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return text.includes(\"human-controlled\") && text.includes(\"proposals\") && text.includes(\"not automatically applied\");\n});\n\nawait check(\"logo_exact_asset\", async () => {\n const r = await fetch(`${BASE}/logo.svg`, { redirect: \"follow\" });\n if (!r.ok || !(r.headers.get(\"content-type\") ?? \"\").includes(\"image/svg+xml\")) return false;\n const hash = await sha256Hex(new Uint8Array(await r.arrayBuffer()));\n facts.logo_sha256 = hash;\n return hash === EXPECTED_LOGO_SHA256;\n});\n\nawait check(\"portal_packet_constraints\", async () => {\n const prompts = portalPacket?.starter_prompts ?? [];\n const unique = new Set(prompts);\n const promptsOk = Array.isArray(prompts) && prompts.length > 0 && prompts.length <= 3 &&\n unique.size === prompts.length && prompts.every((p: unknown) =>\n typeof p === \"string\" && p.length <= 128 && !p.includes(\"@\") && !/[\\r\\n]/.test(p)\n );\n const pkg = portalPacket?.directory_package;\n const packageNameOk = typeof pkg?.package_name === \"string\" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(pkg.package_name);\n const versionOk = typeof pkg?.version === \"string\" && pkg.version.length <= 64 && /^\\d+\\.\\d+\\.\\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pkg.version);\n const developerNameOk = typeof pkg?.developer_name_candidate === \"string\" && pkg.developer_name_candidate.length > 0 && pkg.developer_name_candidate.length <= 80 && !/[\\r\\n]/.test(pkg.developer_name_candidate);\n const capabilities = pkg?.capabilities ?? [];\n const capabilitiesOk = Array.isArray(capabilities) && capabilities.length <= 20 && capabilities.every((c: unknown) =>\n typeof c === \"string\" && c.trim().length > 0 && c.length <= 120 && !/[\\r\\n]/.test(c)\n );\n facts.starter_prompt_count = prompts.length;\n facts.package_name = pkg?.package_name ?? null;\n facts.package_version = pkg?.version ?? null;\n facts.capability_count = capabilities.length;\n facts.annotation_justifications = portalPacket?.review_materials?.annotation_justifications ?? null;\n return promptsOk && packageNameOk && versionOk && developerNameOk && capabilitiesOk &&\n portalPacket?.review_materials?.annotation_justifications === \"PASS_12_OF_12_VALIDATED\";\n});\n\n// Workspace custom-app flow from current official ChatGPT docs:\n// endpoint + required metadata + auth choice -> Scan Tools -> Create draft.\nworkspaceDraftBlockers.push(\"chatgpt_create_app_surface_unverified\");\nworkspaceDraftBlockers.push(\"scan_tools_not_executed\");\nworkspaceDraftBlockers.push(\"create_draft_not_executed\");\n\n// Public Plugin Directory requirements from current official OpenAI plugin submission docs.\npublicDirectoryBlockers.push(\"domain_verification_not_completed\");\npublicDirectoryBlockers.push(\"apps_management_write_unverified\");\npublicDirectoryBlockers.push(\"publisher_identity_unverified\");\npublicDirectoryBlockers.push(\"global_data_residency_unverified\");\npublicDirectoryBlockers.push(\"logo_portal_upload_not_executed\");\npublicDirectoryBlockers.push(\"production_mcp_url_not_authorized\");\npublicDirectoryBlockers.push(\"scan_tools_not_executed\");\npublicDirectoryBlockers.push(\"distribution_scope_unset\");\npublicDirectoryBlockers.push(\"policy_attestations_not_completed\");\n\ngovernanceBlockers.push(\"github_candidate_head_unreconciled\");\n\n// Final public submission of a remote MCP requires completed domain verification.\n// The endpoint stays fail-closed until the portal issues the real token.\nconst challenge = await fetch(`${BASE}/.well-known/openai-apps-challenge`);\nfacts.domain_challenge_status = challenge.status;\nfacts.domain_verification_gate = \"REQUIRED_FOR_FINAL_REMOTE_MCP_SUBMISSION_NOT_COMPLETED\";\nfacts.domain_challenge_capability = challenge.status === 404 ? \"READY_FAIL_CLOSED_NO_TOKEN\" : \"TOKEN_ENDPOINT_ACTIVE_NEEDS_PORTAL_MATCH\";\nfacts.production_url_candidate = portalPacket?.production_mcp_url ?? null;\nfacts.mcp_url_label_contains_staging = portalPacket?.mcp_url_candidate?.includes(\"staging\") === true;\nfacts.production_url_authority = \"SEPARATE_GOVERNANCE_GATE_NOT_INFERRED_FROM_HOSTNAME\";\nfacts.public_submission_execution = \"NOT_EXECUTED_SEPARATE_FROM_READINESS\";\n\nfacts.official_workspace_custom_app_flow = \"ENDPOINT_METADATA_AUTH_SCAN_TOOLS_CREATE_DRAFT\";\nfacts.official_public_submission_type = \"WITH_MCP_REMOTE_MCP_ONLY\";\nfacts.mcp_url_type = \"UNIVERSAL\";\nfacts.auth = \"NONE_FOR_BOUNDED_V1\";\nfacts.ui = \"NONE_CSP_NOT_APPLICABLE\";\nfacts.logo_asset = \"READY_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\";\nfacts.starter_prompts = \"READY_IN_PORTAL_PACKET\";\nfacts.test_cases = \"5_POSITIVE_3_NEGATIVE_READY\";\nfacts.release_notes = \"READY_IN_PORTAL_PACKET\";\nfacts.listing_materials = \"READY_TECHNICALLY\";\nfacts.data_residency_submission_requirement = \"REQUIRED_FOR_MCP_REVIEW_USE_GLOBAL_PROJECT_EU_PROJECTS_CURRENTLY_INELIGIBLE_CONFIRMED_2026_09_13\";\nfacts.demo_recording_submission_requirement = \"NOT_REQUIRED_BY_CURRENT_OFFICIAL_SUBMISSION_OR_MCP_REVIEW_DOCS\";\nfacts.github_candidate_head_reconciliation = \"UNAVAILABLE_IN_THIS_SESSION_FAIL_CLOSED\";\nfacts.money_spend = 0;\nfacts.authority = \"NOT_GRANTED_BY_TECHNICAL_GATE\";\n\nconst technicalState = technicalFailures.length === 0 ? \"PASS\" : \"FAIL\";\nconst workspaceDraftState = technicalFailures.length === 0 && workspaceDraftBlockers.length === 0 && governanceBlockers.length === 0\n ? \"READY_TO_CREATE\"\n : \"BLOCKED_FAIL_CLOSED\";\nconst publicDirectoryState = technicalFailures.length === 0 && publicDirectoryBlockers.length === 0 && governanceBlockers.length === 0\n ? \"READY_TO_SUBMIT\"\n : \"BLOCKED_FAIL_CLOSED\";\n\nconst result = {\n candidate_sha: EXPECTED_SHA,\n technical_state: technicalState,\n workspace_draft_state: workspaceDraftState,\n public_directory_state: publicDirectoryState,\n technical_failures: technicalFailures,\n workspace_draft_blockers: workspaceDraftBlockers,\n public_directory_blockers: publicDirectoryBlockers,\n governance_blockers: governanceBlockers,\n facts,\n};\n\nconsole.log(JSON.stringify(result, null, 2));\nif (technicalState === \"PASS\") console.log(\"RUMBO_OPENAI_TECHNICAL_GATE_PASS\");\nif (workspaceDraftState !== \"READY_TO_CREATE\") console.log(\"RUMBO_OPENAI_WORKSPACE_DRAFT_GATE_BLOCKED\");\nif (publicDirectoryState !== \"READY_TO_SUBMIT\") console.log(\"RUMBO_OPENAI_PUBLIC_DIRECTORY_GATE_BLOCKED\");\n","deleted",false,"label",[14],"3255f42e-7bba-4583-8764-631437397e4e",["D",1789031650837],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","RUMBO IA CRM bounded MCP staging","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","fbed6f64-acf7-11f1-b3b4-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_103":99},"org",{"_9":10,"_96":97,"_98":99,"_55":56,"_100":101,"_102":42},"branch",{"_35":86,"_11":87,"_22":28,"_88":45,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":12,"_95":10},"isOwned",284,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_79":-5,"_137":138,"_139":140,"_141":142,"_143":42,"_144":42,"_145":42,"_146":32,"_147":-5,"_148":-7,"_149":-7,"_150":63,"_151":42,"_152":42,"_153":-5,"_154":42,"_155":42,"_156":42,"_157":-5},"ENV",{"_108":109,"_110":111,"_112":87,"_113":114,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]