[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_200":201,"_202":203},"routes/_app.x.$handle.$name",{"_98":97,"_32":44,"_107":88,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":125,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",29,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":20,"_34":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":20,"_34":35},"deleted",false,"deletedHere","path","README.md","latestPath","fileId","01a078ee-7696-7756-bb0a-ff8228412895","name","fileType","content","# Currentness Attestor\n\nA bounded evidence service for answering a narrow question:\n\n> Does this public HTTP surface match an explicit expectation **right now**?\n\nThe service exists to avoid a common failure mode in agent research and automation:\n\n`DOCUMENTED / INDEXED / HISTORICALLY TRUE != CURRENT RUNTIME TRUE`\n\n## V0 contract\n\n`POST /attest` accepts:\n\n- `endpointUrl` — public HTTP/HTTPS target\n- `method` — `HEAD`, `GET`, or `OPTIONS`\n- `expectedStatus` — one status or a list\n- `expectedContains` — optional runtime text assertion\n- `docsUrl` — optional public docs/README URL\n- `docsExpectedContains` — up to five exact docs assertions\n- `timeoutMs` — 250–10000 ms\n- `claim` — optional human-readable claim\n\nIt returns:\n\n- UTC `checkedAt`\n- PASS/FAIL verdict\n- explicit assertion results\n- final URL and redirect chain\n- status and latency\n- selected HTTP headers\n- capped response-body SHA-256\n- optional docs SHA-256 + docs assertion results\n- `evidenceDigest`\n- an explicit `evidenceBoundary`\n\n## Safety boundaries\n\nThis is deliberately **not** an arbitrary request proxy or remote-code runner.\n\n- no credentials in target URLs\n- no cookies or custom Authorization headers\n- no arbitrary code/commands\n- no browser login/session handling\n- private/local/link-local targets blocked\n- DNS targets checked before each request and redirect\n- redirect count capped\n- response capture capped at 256 KiB\n- timeout capped at 10 seconds\n- public HTTP evidence only\n\nDNS is preflighted through DNS-over-HTTPS because the Val Town runtime does not expose `Deno.resolveDns`. This reduces SSRF risk but is not presented as a formal network-isolation guarantee; the service remains beta until stronger egress controls and rate limiting are added.\n\n## Evidence semantics\n\nA PASS means only that the explicit public-surface assertions passed at `checkedAt`.\n\nIt does **not** prove:\n\n- authenticated/private runtime behavior\n- semantic correctness of a business process\n- downstream service health hidden behind the tested surface\n- payment settlement\n- causal validity of claims that were not explicitly tested\n\n## Machine discovery\n\n- `/` — service contract\n- `/openapi.json` — OpenAPI 3.1\n- `/.well-known/agent.json` — machine-readable capability metadata\n- `/skill.md` — agent-readable usage contract\n\n## Current status\n\n`0.1.0-beta`\n\nValidation performed during build:\n\n1. public `https://example.com` + expected 200 → PASS\n2. public `https://example.com` + body contains `Example Domain` → PASS and body hash produced\n3. `http://127.0.0.1/` → FAIL for `PRIVATE_IP_BLOCKED`\n\nEconomic state: **no organic sale yet**. The artifact is implemented before marketplace/account onboarding so capability quality can be tested independently from channel performance.\n","# Currentness Attestor\n\nA bounded evidence service for answering a narrow question:\n\n> Does this public HTTP surface match an explicit expectation **right now**?\n\nThe service exists to avoid a common failure mode in agent research and automation:\n\n`DOCUMENTED / INDEXED / HISTORICALLY TRUE != CURRENT RUNTIME TRUE`\n\n## V0 contract\n\n`POST /attest` accepts:\n\n- `endpointUrl` — public HTTP/HTTPS target\n- `method` — `HEAD`, `GET`, or `OPTIONS`\n- `expectedStatus` — one status or a list\n- `expectedContains` — optional runtime text assertion\n- `docsUrl` — optional public docs/README URL\n- `docsExpectedContains` — up to five exact docs assertions\n- `timeoutMs` — 250–10000 ms\n- `claim` — optional human-readable claim\n\nIt returns:\n\n- UTC `checkedAt`\n- PASS/FAIL verdict\n- explicit assertion results\n- final URL and redirect chain\n- status and latency\n- selected HTTP headers\n- capped response-body SHA-256\n- optional docs SHA-256 + docs assertion results\n- `evidenceDigest`\n- an explicit `evidenceBoundary`\n\n## Safety boundaries\n\nThis is deliberately **not** an arbitrary request proxy or remote-code runner.\n\n- no credentials in target URLs\n- no cookies or custom Authorization headers\n- no arbitrary code/commands\n- no browser login/session handling\n- private/local/link-local targets blocked\n- DNS targets checked before each request and redirect\n- redirect count capped\n- response capture capped at 256 KiB\n- timeout capped at 10 seconds\n- public HTTP evidence only\n\nDNS is preflighted through DNS-over-HTTPS because the Val Town runtime does not expose `Deno.resolveDns`. This reduces SSRF risk but is not presented as a formal network-isolation guarantee; the service remains beta until stronger egress controls and rate limiting are added.\n\n## Evidence semantics\n\nA PASS means only that the explicit public-surface assertions passed at `checkedAt`.\n\nIt does **not** prove:\n\n- authenticated/private runtime behavior\n- semantic correctness of a business process\n- downstream service health hidden behind the tested surface\n- payment settlement\n- causal validity of claims that were not explicitly tested\n\n## Machine discovery\n\n- `/` — service contract\n- `/openapi.json` — OpenAPI 3.1\n- `/.well-known/agent.json` — machine-readable capability metadata\n- `/skill.md` — agent-readable usage contract\n\n## Current status\n\n`0.1.0-beta`\n\nValidation performed during build: **SELF_TEST_PASS 8/8**.\n\n1. service contract → PASS\n2. public status assertion → PASS\n3. public content assertion + SHA-256 → PASS\n4. private IPv4 target → blocked for `PRIVATE_IP_BLOCKED`\n5. localhost → blocked for `PRIVATE_HOST_BLOCKED`\n6. non-HTTP scheme → blocked for `UNSUPPORTED_SCHEME`\n7. docs + runtime positive control → PASS\n8. docs/runtime disagreement mutation → expected FAIL\n\n## Economic-rail monitor\n\n`monitor.ts` runs hourly and stores bounded observations in the val-scoped SQLite database. The public read-only surfaces are:\n\n- `/monitor/latest`\n- `/monitor/history?target=&limit=24`\n\nThe first live run immediately found an important currentness failure: PayanAgent's static `SKILL.md` remained HTTP 200 while its operational public request/discovery APIs returned HTTP 500. Independent retrieval reproduced the API failures. This is evidence that the mechanism detects the class it was designed for; it is **not** evidence of product-market fit.\n\nA healthy HTTP surface is also not evidence of paid inventory or payout health. For example, a job page can return 200 while having zero open paid jobs. Those economic assertions remain separate.\n\nEconomic state: **no organic sale yet**. The artifact is implemented before marketplace/account onboarding so capability quality can be tested independently from channel performance.\n","createdAt",["D",1788736218927],"branchVersion","branchId","85bfc61c-5aa3-47ce-bf09-4994778cb3c8","id","29d89160-b2c5-4968-aef7-006c8b40fa1e","currentness-attestor",["D",1788735288858],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Live docs-vs-runtime evidence API","imageUrl","6cc24525-830b-4db3-9c9c-fd19fb50e91f","pinnedFileId","01a078ee-7696-7756-bb0b-01e476076611","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0773d-9d6b-7580-a53a-683363c351c8","tursoName","29d89160b2c54968aef7006c8b40fa1e","tursoHostname","29d89160b2c54968aef7006c8b40fa1e-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789522252250],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":54,"_103":104,"_105":25},"branch",{"_13":87,"_32":88,"_42":41,"_89":43,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":44,"_96":97},"isOwned",152,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","cleitoncosta","handle","displayName","Cleiton Costa","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgWisWQiXts_2fy5iRiRgl8A6c7Ef94eqE3ur-4mlyUrpCBmQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_32":44,"_37":195,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":196,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":197,"_82":198,"_84":199,"_86":25},"tree",[178,179,180,181],"files",[178,179,180,181],"counts",{"_167":61,"_168":151,"_169":61,"_170":171,"_172":173},"contents",[130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_42":163,"_32":28,"_30":31,"_137":-5,"_40":41,"_39":14,"_139":125,"_37":164,"_13":165,"_33":20,"_34":36,"_24":25,"_144":-5,"_27":166},{"_42":155,"_32":156,"_30":56,"_137":-5,"_40":41,"_39":157,"_139":25,"_37":158,"_13":159,"_33":160,"_34":161,"_24":25,"_144":44,"_27":162},{"_42":146,"_32":147,"_30":148,"_137":-5,"_40":41,"_39":149,"_139":125,"_37":150,"_13":151,"_33":152,"_34":153,"_24":25,"_144":-5,"_27":154},{"_42":134,"_32":135,"_30":136,"_137":-5,"_40":41,"_39":138,"_139":125,"_37":140,"_13":141,"_33":142,"_34":143,"_24":25,"_144":-5,"_27":145},"61659d9b-5fbe-4b0b-9504-53a4b0b09e0a","test.ts","f0bf9698-aa46-11f1-bad0-1607ee4eb77e","parentId",15,"latest",["D",1788735759848],4,"script","import handler from \"./main.ts\";\n\nasync function call(path: string) {\n const res = await handler(new Request(`https://self.test${path}`));\n const body = await res.json();\n return { status: res.status, body };\n}\n\nasync function postAttest(payload: Record) {\n const res = await handler(new Request(\"https://self.test/attest\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify(payload),\n }));\n const body = await res.json();\n return { status: res.status, body };\n}\n\nfunction check(ok: unknown, label: string) {\n if (!ok) throw new Error(`FAIL: ${label}`);\n console.log(`PASS: ${label}`);\n}\n\nasync function run() {\n const root = await call(\"/\");\n check(root.status === 200 && root.body.name === \"Currentness Attestor\", \"contract endpoint\");\n\n const status = await call(\"/attest?url=https%3A%2F%2Fexample.com&status=200\");\n check(status.body.verdict === \"PASS\" && status.body.endpoint?.status === 200, \"public status assertion\");\n\n const contains = await call(\"/attest?url=https%3A%2F%2Fexample.com&status=200&contains=Example%20Domain\");\n check(contains.body.verdict === \"PASS\" && contains.body.assertions?.containsPass === true && Boolean(contains.body.endpoint?.bodySha256), \"public content + hash assertion\");\n\n const privateIp = await call(\"/attest?url=http%3A%2F%2F127.0.0.1%2F&status=200\");\n check(privateIp.body.verdict === \"FAIL\" && privateIp.body.reason === \"PRIVATE_IP_BLOCKED\", \"private IPv4 negative control\");\n\n const localHost = await call(\"/attest?url=http%3A%2F%2Flocalhost%2F&status=200\");\n check(localHost.body.verdict === \"FAIL\" && localHost.body.reason === \"PRIVATE_HOST_BLOCKED\", \"localhost negative control\");\n\n const badScheme = await call(\"/attest?url=file%3A%2F%2F%2Fetc%2Fpasswd&status=200\");\n check(badScheme.body.verdict === \"FAIL\" && badScheme.body.reason === \"UNSUPPORTED_SCHEME\", \"non-HTTP scheme negative control\");\n\n const docsAndRuntime = await postAttest({\n endpointUrl: \"https://example.com\",\n method: \"GET\",\n expectedStatus: 200,\n expectedContains: \"Example Domain\",\n docsUrl: \"https://example.com\",\n docsExpectedContains: [\"Example Domain\"],\n });\n check(docsAndRuntime.body.verdict === \"PASS\" && docsAndRuntime.body.assertions?.runtimePass === true && docsAndRuntime.body.assertions?.docsPass === true, \"docs + runtime positive control\");\n\n const staleDocs = await postAttest({\n endpointUrl: \"https://example.com\",\n expectedStatus: 200,\n docsUrl: \"https://example.com\",\n docsExpectedContains: [\"definitely-not-present-currentness-attestor\"],\n });\n check(staleDocs.body.verdict === \"FAIL\" && staleDocs.body.assertions?.runtimePass === true && staleDocs.body.assertions?.docsPass === false, \"docs/runtime disagreement negative control\");\n\n console.log(\"SELF_TEST_PASS 8/8\");\n return { pass: true, tests: 8 };\n}\n\n\nawait run();\n","label",[135],"59e174e7-5854-4f23-847b-a031092df16c","monitor.ts","4fd637b8-aa47-11f1-9b24-1607ee4eb77e",22,["D",1788735959431],1,"interval","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { attest } from \"./main.ts\";\n\nconst TARGETS = [\n {\n id: \"payan-discover\",\n label: \"PayanAgent discovery API\",\n endpointUrl: \"https://payanagent.com/api/v1/discover?q=currentness\",\n expectedStatus: 200,\n },\n {\n id: \"payan-requests\",\n label: \"PayanAgent public requests API\",\n endpointUrl: \"https://payanagent.com/api/v1/requests\",\n expectedStatus: 200,\n },\n {\n id: \"toku-open-jobs\",\n label: \"Toku open-jobs API\",\n endpointUrl: \"https://www.toku.agency/api/agents/jobs?status=OPEN&limit=1\",\n expectedStatus: 200,\n },\n {\n id: \"workprotocol-jobs\",\n label: \"WorkProtocol jobs API\",\n endpointUrl: \"https://workprotocol.ai/api/jobs\",\n expectedStatus: 200,\n },\n {\n id: \"agentgigs-jobs\",\n label: \"AgentGigs public jobs page\",\n endpointUrl: \"https://www.agentgigs.io/jobs\",\n expectedStatus: 200,\n },\n {\n id: \"self\",\n label: \"Currentness Attestor\",\n endpointUrl: \"https://currentness-attestor.val.run/\",\n expectedStatus: 200,\n },\n] as const;\n\nasync function ensureSchema() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS monitor_results (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n target_id TEXT NOT NULL,\n target_label TEXT NOT NULL,\n checked_at TEXT NOT NULL,\n verdict TEXT NOT NULL,\n http_status INTEGER,\n latency_ms INTEGER,\n reason TEXT,\n evidence_digest TEXT,\n evidence_json TEXT NOT NULL\n )`);\n await sqlite.execute(\"CREATE INDEX IF NOT EXISTS idx_monitor_target_checked ON monitor_results(target_id, checked_at DESC)\");\n}\n\nexport default async function (_interval?: { lastRunAt?: Date }) {\n await ensureSchema();\n const summary: Array> = [];\n\n for (const target of TARGETS) {\n const evidence = await attest({\n endpointUrl: target.endpointUrl,\n method: \"AUTO\",\n expectedStatus: target.expectedStatus,\n timeoutMs: 5000,\n claim: `${target.label} should expose its current public surface`,\n }) as any;\n\n await sqlite.execute({\n sql: `INSERT INTO monitor_results\n (target_id,target_label,checked_at,verdict,http_status,latency_ms,reason,evidence_digest,evidence_json)\n VALUES (?,?,?,?,?,?,?,?,?)`,\n args: [\n target.id,\n target.label,\n String(evidence.checkedAt || new Date().toISOString()),\n String(evidence.verdict || \"UNKNOWN\"),\n evidence.endpoint?.status ?? null,\n evidence.endpoint?.latencyMs ?? null,\n evidence.reason ?? null,\n evidence.evidenceDigest ?? null,\n JSON.stringify(evidence),\n ],\n });\n\n summary.push({\n target: target.id,\n verdict: evidence.verdict,\n status: evidence.endpoint?.status ?? null,\n latencyMs: evidence.endpoint?.latencyMs ?? null,\n reason: evidence.reason ?? null,\n });\n }\n\n // Keep the demo useful without accumulating unbounded data.\n const cutoff = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute({ sql: \"DELETE FROM monitor_results WHERE checked_at < ?\", args: [cutoff] });\n\n console.log(JSON.stringify({ monitor: \"currentness-attestor\", targets: summary }));\n return summary;\n}\n",[147],"eb1328c0-960a-494c-87ad-94dd979a9901","main.ts",28,["D",1788736208712],19,"http","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst VERSION = \"0.1.0\";\nconst MAX_BODY_BYTES = 256 * 1024;\nconst MAX_TIMEOUT_MS = 10_000;\nconst MAX_REDIRECTS = 3;\nconst ALLOWED_METHODS = new Set([\"AUTO\", \"HEAD\", \"GET\", \"OPTIONS\"]);\n\nconst corsHeaders = {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-methods\": \"GET, POST, OPTIONS\",\n \"access-control-allow-headers\": \"content-type\",\n \"access-control-max-age\": \"86400\",\n};\n\nfunction json(data: unknown, status = 200) {\n return new Response(JSON.stringify(data, null, 2), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...corsHeaders },\n });\n}\n\nfunction text(body: string, contentType = \"text/plain; charset=utf-8\") {\n return new Response(body, { headers: { \"content-type\": contentType, ...corsHeaders } });\n}\n\nfunction isPrivateIpv4(ip: string): boolean {\n const p = ip.split(\".\").map(Number);\n if (p.length !== 4 || p.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return false;\n const [a, b] = p;\n return a === 0 || a === 10 || a === 127 ||\n (a === 100 && b >= 64 && b <= 127) ||\n (a === 169 && b === 254) ||\n (a === 172 && b >= 16 && b <= 31) ||\n (a === 192 && b === 0) ||\n (a === 192 && b === 168) ||\n (a === 198 && (b === 18 || b === 19)) ||\n a >= 224;\n}\n\nfunction isPrivateIpv6(ip: string): boolean {\n const x = ip.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n return x === \"::\" || x === \"::1\" || x.startsWith(\"fe8\") || x.startsWith(\"fe9\") ||\n x.startsWith(\"fea\") || x.startsWith(\"feb\") || x.startsWith(\"fc\") || x.startsWith(\"fd\") ||\n x.startsWith(\"::ffff:127.\") || x.startsWith(\"::ffff:10.\") || x.startsWith(\"::ffff:192.168.\");\n}\n\nasync function assertPublicUrl(raw: string): Promise {\n let u: URL;\n try {\n u = new URL(raw);\n } catch {\n throw new Error(\"INVALID_URL\");\n }\n if (u.protocol !== \"https:\" && u.protocol !== \"http:\") throw new Error(\"UNSUPPORTED_SCHEME\");\n if (u.username || u.password) throw new Error(\"URL_CREDENTIALS_NOT_ALLOWED\");\n const host = u.hostname.toLowerCase();\n if (!host || host === \"localhost\" || host.endsWith(\".local\") || host.endsWith(\".internal\") || host === \"0.0.0.0\") {\n throw new Error(\"PRIVATE_HOST_BLOCKED\");\n }\n if (isPrivateIpv4(host) || isPrivateIpv6(host)) throw new Error(\"PRIVATE_IP_BLOCKED\");\n\n // Resolve through DNS-over-HTTPS before every request/redirect. Val Town\n // does not expose Deno.resolveDns in this runtime, so we fail closed on DoH errors.\n if (!/^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(host) && !host.includes(\":\")) {\n const ips: string[] = [];\n try {\n for (const type of [\"A\", \"AAAA\"]) {\n const q = new URL(\"https://cloudflare-dns.com/dns-query\");\n q.searchParams.set(\"name\", host);\n q.searchParams.set(\"type\", type);\n const r = await fetch(q, { headers: { accept: \"application/dns-json\" }, redirect: \"error\" });\n if (!r.ok) continue;\n const data = await r.json() as { Answer?: Array<{ data?: string; type?: number }> };\n for (const answer of data.Answer || []) {\n if (answer.data && ((type === \"A\" && answer.type === 1) || (type === \"AAAA\" && answer.type === 28))) ips.push(answer.data);\n }\n }\n } catch {\n throw new Error(\"DNS_RESOLUTION_FAILED\");\n }\n if (!ips.length) throw new Error(\"DNS_RESOLUTION_EMPTY\");\n if (ips.some((ip) => isPrivateIpv4(ip) || isPrivateIpv6(ip))) throw new Error(\"PRIVATE_DNS_TARGET_BLOCKED\");\n }\n return u;\n}\n\nasync function sha256Hex(input: Uint8Array | string): Promise {\n const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes));\n return [...digest].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function readCappedBody(res: Response): Promise<{ bytes: Uint8Array; truncated: boolean }> {\n if (!res.body) return { bytes: new Uint8Array(), truncated: false };\n const reader = res.body.getReader();\n const chunks: Uint8Array[] = [];\n let total = 0;\n let truncated = false;\n try {\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n if (!value) continue;\n const remaining = MAX_BODY_BYTES - total;\n if (value.byteLength > remaining) {\n if (remaining > 0) chunks.push(value.slice(0, remaining));\n total += Math.max(remaining, 0);\n truncated = true;\n await reader.cancel();\n break;\n }\n chunks.push(value);\n total += value.byteLength;\n if (total >= MAX_BODY_BYTES) {\n truncated = true;\n await reader.cancel();\n break;\n }\n }\n } finally {\n reader.releaseLock();\n }\n const out = new Uint8Array(total);\n let offset = 0;\n for (const chunk of chunks) { out.set(chunk, offset); offset += chunk.byteLength; }\n return { bytes: out, truncated };\n}\n\ntype ProbeInput = {\n endpointUrl: string;\n docsUrl?: string;\n docsExpectedContains?: string | string[];\n method?: string;\n expectedStatus?: number | number[];\n expectedContains?: string;\n timeoutMs?: number;\n claim?: string;\n};\n\nasync function probe(rawUrl: string, method: string, timeoutMs: number, wantBody: boolean) {\n let current = await assertPublicUrl(rawUrl);\n const redirects: Array<{ from: string; status: number; to: string }> = [];\n const started = performance.now();\n\n for (let i = 0; i <= MAX_REDIRECTS; i++) {\n current = await assertPublicUrl(current.toString());\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n let res: Response;\n try {\n res = await fetch(current, {\n method,\n redirect: \"manual\",\n signal: controller.signal,\n headers: { \"user-agent\": `Currentness-Attestor/${VERSION}` },\n });\n\n if ([301, 302, 303, 307, 308].includes(res.status)) {\n const loc = res.headers.get(\"location\");\n if (!loc) throw new Error(\"REDIRECT_WITHOUT_LOCATION\");\n if (i === MAX_REDIRECTS) throw new Error(\"TOO_MANY_REDIRECTS\");\n const next = new URL(loc, current);\n await assertPublicUrl(next.toString());\n redirects.push({ from: current.toString(), status: res.status, to: next.toString() });\n try { await res.body?.cancel(); } catch { /* no-op */ }\n current = next;\n continue;\n }\n\n let bodyBytes = new Uint8Array();\n let bodyTruncated = false;\n if (wantBody && method !== \"HEAD\") {\n const capped = await readCappedBody(res);\n bodyBytes = capped.bytes;\n bodyTruncated = capped.truncated;\n } else {\n try { await res.body?.cancel(); } catch { /* no-op */ }\n }\n const elapsed = Math.round(performance.now() - started);\n clearTimeout(timer);\n return {\n finalUrl: current.toString(),\n status: res.status,\n statusText: res.statusText,\n latencyMs: elapsed,\n redirects,\n headers: {\n contentType: res.headers.get(\"content-type\"),\n etag: res.headers.get(\"etag\"),\n lastModified: res.headers.get(\"last-modified\"),\n cacheControl: res.headers.get(\"cache-control\"),\n },\n bodyBytes,\n bodyTruncated,\n };\n } finally {\n clearTimeout(timer);\n }\n }\n throw new Error(\"UNREACHABLE\");\n}\n\nasync function attest(input: ProbeInput) {\n if (!input.endpointUrl) throw new Error(\"endpointUrl is required\");\n if (input.endpointUrl.length > 2048 || (input.docsUrl && input.docsUrl.length > 2048)) throw new Error(\"URL_TOO_LONG\");\n if (input.claim && input.claim.length > 500) throw new Error(\"CLAIM_TOO_LONG\");\n const methodRequested = (input.method || \"AUTO\").toUpperCase();\n if (!ALLOWED_METHODS.has(methodRequested)) throw new Error(\"METHOD_NOT_ALLOWED\");\n let method = methodRequested === \"AUTO\" ? (input.expectedContains ? \"GET\" : \"HEAD\") : methodRequested;\n if (input.expectedContains && method === \"HEAD\") method = \"GET\";\n if (input.expectedContains && input.expectedContains.length > 500) throw new Error(\"EXPECTED_CONTAINS_TOO_LONG\");\n const docsNeedles = input.docsExpectedContains == null ? [] : (Array.isArray(input.docsExpectedContains) ? input.docsExpectedContains : [input.docsExpectedContains]);\n if (docsNeedles.length > 5 || docsNeedles.some((s) => typeof s !== \"string\" || s.length > 500)) throw new Error(\"DOCS_EXPECTATIONS_INVALID\");\n const expectedStatuses = input.expectedStatus == null\n ? null\n : (Array.isArray(input.expectedStatus) ? input.expectedStatus : [input.expectedStatus]).map(Number);\n if (expectedStatuses && expectedStatuses.some((s) => !Number.isInteger(s) || s < 100 || s > 599)) throw new Error(\"INVALID_EXPECTED_STATUS\");\n const statusWouldPass = (status: number) => expectedStatuses ? expectedStatuses.includes(status) : status >= 200 && status < 400;\n const timeoutRaw = input.timeoutMs == null ? 5000 : Number(input.timeoutMs);\n if (!Number.isFinite(timeoutRaw)) throw new Error(\"INVALID_TIMEOUT\");\n const timeoutMs = Math.min(Math.max(timeoutRaw, 250), MAX_TIMEOUT_MS);\n const checkedAt = new Date().toISOString();\n const wantBody = method === \"GET\" || Boolean(input.expectedContains);\n\n let endpoint: Awaited>;\n let methodFallback: Record | null = null;\n try {\n endpoint = await probe(input.endpointUrl, method, timeoutMs, wantBody);\n } catch (error) {\n const firstReason = error instanceof Error ? error.message : String(error);\n if (methodRequested === \"AUTO\" && method === \"HEAD\") {\n try {\n method = \"GET\";\n endpoint = await probe(input.endpointUrl, method, timeoutMs, false);\n methodFallback = { from: \"HEAD\", to: \"GET\", reason: firstReason };\n } catch (fallbackError) {\n const reason = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);\n const failed = {\n service: \"Currentness Attestor\",\n version: VERSION,\n checkedAt,\n claim: input.claim || null,\n verdict: \"FAIL\",\n reason,\n methodRequested,\n methodFallback: { from: \"HEAD\", to: \"GET\", reason: firstReason, fallbackError: reason },\n endpoint: { requestedUrl: input.endpointUrl, reachable: false },\n evidenceBoundary: \"Public HTTP surface only. No authenticated/private runtime, downstream business logic, or payment settlement was verified.\",\n };\n return { ...failed, evidenceDigest: await sha256Hex(JSON.stringify(failed)) };\n }\n } else {\n const failed = {\n service: \"Currentness Attestor\",\n version: VERSION,\n checkedAt,\n claim: input.claim || null,\n verdict: \"FAIL\",\n reason: firstReason,\n methodRequested,\n endpoint: { requestedUrl: input.endpointUrl, reachable: false },\n evidenceBoundary: \"Public HTTP surface only. No authenticated/private runtime, downstream business logic, or payment settlement was verified.\",\n };\n return { ...failed, evidenceDigest: await sha256Hex(JSON.stringify(failed)) };\n }\n }\n\n if (methodRequested === \"AUTO\" && method === \"HEAD\" && !statusWouldPass(endpoint.status)) {\n const headStatus = endpoint.status;\n try {\n const getEndpoint = await probe(input.endpointUrl, \"GET\", timeoutMs, false);\n methodFallback = { from: \"HEAD\", to: \"GET\", headStatus, getStatus: getEndpoint.status, reason: \"HEAD_DID_NOT_MEET_EXPECTATION\" };\n endpoint = getEndpoint;\n method = \"GET\";\n } catch (fallbackError) {\n methodFallback = {\n from: \"HEAD\",\n to: \"GET\",\n headStatus,\n reason: \"HEAD_DID_NOT_MEET_EXPECTATION\",\n fallbackError: fallbackError instanceof Error ? fallbackError.message : String(fallbackError),\n };\n }\n }\n\n const statusPass = statusWouldPass(endpoint.status);\n const bodyText = wantBody ? new TextDecoder().decode(endpoint.bodyBytes) : \"\";\n const containsPass = input.expectedContains ? bodyText.includes(input.expectedContains) : null;\n const runtimePass = statusPass && (containsPass !== false);\n const bodySha256 = endpoint.bodyBytes.byteLength ? await sha256Hex(endpoint.bodyBytes) : null;\n\n let docs: Record | null = null;\n let docsPass: boolean | null = docsNeedles.length ? false : null;\n if (input.docsUrl) {\n try {\n const d = await probe(input.docsUrl, \"GET\", timeoutMs, true);\n const docsText = new TextDecoder().decode(d.bodyBytes);\n const contains = docsNeedles.map((needle) => ({ needle, pass: docsText.includes(needle) }));\n docsPass = docsNeedles.length ? contains.every((x) => x.pass) : null;\n docs = {\n requestedUrl: input.docsUrl,\n finalUrl: d.finalUrl,\n status: d.status,\n latencyMs: d.latencyMs,\n contentType: d.headers.contentType,\n bodyBytesCaptured: d.bodyBytes.byteLength,\n bodyTruncated: d.bodyTruncated,\n bodySha256: d.bodyBytes.byteLength ? await sha256Hex(d.bodyBytes) : null,\n expectedContains: contains,\n };\n } catch (error) {\n docsPass = docsNeedles.length ? false : null;\n docs = { requestedUrl: input.docsUrl, error: error instanceof Error ? error.message : String(error), expectedContains: docsNeedles };\n }\n } else if (docsNeedles.length) {\n throw new Error(\"docsUrl required when docsExpectedContains is set\");\n }\n\n const verdict = runtimePass && (docsPass !== false) ? \"PASS\" : \"FAIL\";\n const evidence = {\n service: \"Currentness Attestor\",\n version: VERSION,\n checkedAt,\n claim: input.claim || null,\n verdict,\n assertions: {\n expectedStatus: expectedStatuses,\n statusPass,\n expectedContains: input.expectedContains || null,\n containsPass,\n runtimePass,\n docsPass,\n },\n endpoint: {\n requestedUrl: input.endpointUrl,\n finalUrl: endpoint.finalUrl,\n methodRequested,\n methodUsed: method,\n methodFallback,\n reachable: true,\n status: endpoint.status,\n statusText: endpoint.statusText,\n latencyMs: endpoint.latencyMs,\n redirects: endpoint.redirects,\n headers: endpoint.headers,\n bodyBytesCaptured: endpoint.bodyBytes.byteLength,\n bodyTruncated: endpoint.bodyTruncated,\n bodySha256,\n },\n docs,\n evidenceBoundary: \"Public HTTP surface only. No authenticated/private runtime, downstream business logic, semantic correctness, or payment settlement was verified.\",\n };\n return { ...evidence, evidenceDigest: await sha256Hex(JSON.stringify(evidence)) };\n}\n\nconst contract = {\n name: \"Currentness Attestor\",\n version: VERSION,\n status: \"beta\",\n purpose: \"Generate bounded, reproducible evidence that a public HTTP surface currently matches explicit expectations.\",\n endpoints: {\n \"GET /\": \"service contract\",\n \"GET /attest?url=https://example.com&status=200\": \"quick probe\",\n \"POST /attest\": \"structured attestation\",\n \"GET /openapi.json\": \"OpenAPI 3.1 contract\",\n \"GET /.well-known/agent.json\": \"machine discovery\",\n \"GET /skill.md\": \"agent-readable skill\",\n \"GET /monitor/latest\": \"latest stored currentness observation per monitored rail\",\n \"GET /monitor/history?target=toku-open-jobs&limit=24\": \"recent observations for one monitored rail\",\n },\n constraints: {\n methods: [...ALLOWED_METHODS],\n timeoutMaxMs: MAX_TIMEOUT_MS,\n bodyCaptureMaxBytes: MAX_BODY_BYTES,\n redirectsMax: MAX_REDIRECTS,\n privateNetworkTargets: \"blocked\",\n credentialsAndCustomAuthHeaders: \"not accepted\",\n },\n};\n\nconst openapi = {\n openapi: \"3.1.0\",\n info: { title: \"Currentness Attestor API\", version: VERSION },\n paths: {\n \"/attest\": {\n post: {\n summary: \"Attest a public HTTP endpoint against explicit expectations\",\n requestBody: { required: true, content: { \"application/json\": { schema: {\n type: \"object\", required: [\"endpointUrl\"], properties: {\n endpointUrl: { type: \"string\", format: \"uri\" }, docsUrl: { type: \"string\", format: \"uri\" },\n method: { type: \"string\", enum: [\"AUTO\", \"HEAD\", \"GET\", \"OPTIONS\"], default: \"AUTO\" },\n expectedStatus: { oneOf: [{ type: \"integer\", minimum: 100, maximum: 599 }, { type: \"array\", items: { type: \"integer\", minimum: 100, maximum: 599 } }] },\n expectedContains: { type: \"string\", maxLength: 500 },\n docsExpectedContains: { oneOf: [{ type: \"string\", maxLength: 500 }, { type: \"array\", maxItems: 5, items: { type: \"string\", maxLength: 500 } }] },\n timeoutMs: { type: \"integer\", minimum: 250, maximum: MAX_TIMEOUT_MS }, claim: { type: \"string\", maxLength: 500 },\n },\n } } } },\n responses: { \"200\": { description: \"Attestation evidence\" }, \"400\": { description: \"Invalid request\" } },\n },\n },\n \"/monitor/latest\": {\n get: {\n summary: \"Return the latest stored currentness observation for each monitored economic rail\",\n responses: { \"200\": { description: \"Latest monitor observations\" } },\n },\n },\n \"/monitor/history\": {\n get: {\n summary: \"Return recent observations for one monitored target\",\n parameters: [\n { name: \"target\", in: \"query\", required: true, schema: { type: \"string\", pattern: \"^[a-z0-9-]{1,64}$\" } },\n { name: \"limit\", in: \"query\", required: false, schema: { type: \"integer\", minimum: 1, maximum: 100, default: 24 } },\n ],\n responses: { \"200\": { description: \"Monitor history\" }, \"400\": { description: \"Invalid query\" } },\n },\n },\n },\n};\n\nconst skillMd = `# Currentness Attestor\\n\\nUse this service when an agent must decide whether a **public HTTP claim is current enough to act on** before spending time, compute, capital, or human attention.\\n\\nThe service is intentionally bounded: no credentials, cookies, custom authorization headers, browser actions, private-network targets, arbitrary code execution, or payment signing. A PASS proves only the explicit public-surface assertions at the returned timestamp.\\n\\n## POST /attest\\n\\n\\`\\`\\`json\\n{\\n \"endpointUrl\": \"https://example.com/health\",\\n \"method\": \"AUTO\",\\n \"expectedStatus\": 200,\\n \"expectedContains\": \"ok\",\\n \"docsUrl\": \"https://example.com/docs\",\\n \"docsExpectedContains\": [\"GET /health\"],\\n \"claim\": \"The documented health surface is live now\"\\n}\\n\\`\\`\\`\\n\\nAUTO uses HEAD first when no body assertion is required and falls back to GET when HEAD does not meet the expectation. The fallback is recorded instead of silently hidden.\\n\\nThe response includes checkedAt, runtime/docs assertion states, final URL, method used, fallback evidence, latency, redirects, selected headers, capped body SHA-256, evidenceBoundary, and evidenceDigest.\\n\\n## Economic-rail monitor\\n\\nGET /monitor/latest returns the latest observations for the rails currently used by this experiment. GET /monitor/history?target=&limit=24 returns recent observations for one rail. Surface health is not the same thing as paid demand, inventory, or payout health; those require separate assertions.\\n`;\n\nexport default async function handler(req: Request): Promise {\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204, headers: corsHeaders });\n const u = new URL(req.url);\n\n if (req.method === \"GET\" && u.pathname === \"/\") return json(contract);\n if (req.method === \"GET\" && u.pathname === \"/openapi.json\") return json(openapi);\n if (req.method === \"GET\" && u.pathname === \"/.well-known/agent.json\") return json({\n name: contract.name, version: VERSION, capabilities: [\"http-currentness\", \"docs-vs-runtime\", \"evidence-digest\"], openapi: \"/openapi.json\", skill: \"/skill.md\",\n });\n if (req.method === \"GET\" && u.pathname === \"/skill.md\") return text(skillMd, \"text/markdown; charset=utf-8\");\n\n if (req.method === \"GET\" && u.pathname === \"/monitor/latest\") {\n try {\n const result = await sqlite.execute(`SELECT m.target_id, m.target_label, m.checked_at, m.verdict,\n m.http_status, m.latency_ms, m.reason, m.evidence_digest\n FROM monitor_results m\n JOIN (SELECT target_id, MAX(id) AS max_id FROM monitor_results GROUP BY target_id) latest\n ON latest.max_id = m.id\n ORDER BY m.target_id`);\n return json({ generatedAt: new Date().toISOString(), targets: result.rows });\n } catch (error) {\n return json({ generatedAt: new Date().toISOString(), targets: [], state: \"MONITOR_NOT_INITIALIZED\", error: error instanceof Error ? error.message : String(error) });\n }\n }\n\n if (req.method === \"GET\" && u.pathname === \"/monitor/history\") {\n const target = u.searchParams.get(\"target\") || \"\";\n const limit = Math.min(Math.max(Number(u.searchParams.get(\"limit\") || 24), 1), 100);\n if (!/^[a-z0-9-]{1,64}$/.test(target) || !Number.isFinite(limit)) return json({ error: \"INVALID_MONITOR_QUERY\" }, 400);\n try {\n const result = await sqlite.execute({\n sql: `SELECT target_id, target_label, checked_at, verdict, http_status, latency_ms, reason, evidence_digest\n FROM monitor_results WHERE target_id = ? ORDER BY id DESC LIMIT ?`,\n args: [target, limit],\n });\n return json({ target, count: result.rows.length, observations: result.rows });\n } catch (error) {\n return json({ error: \"MONITOR_NOT_INITIALIZED\", detail: error instanceof Error ? error.message : String(error) }, 503);\n }\n }\n\n if (u.pathname === \"/attest\" && req.method === \"GET\") {\n const url = u.searchParams.get(\"url\") || \"\";\n const status = u.searchParams.get(\"status\");\n const contains = u.searchParams.get(\"contains\") || undefined;\n try {\n return json(await attest({ endpointUrl: url, expectedStatus: status ? Number(status) : undefined, expectedContains: contains }));\n } catch (error) {\n return json({ error: error instanceof Error ? error.message : String(error) }, 400);\n }\n }\n\n if (u.pathname === \"/attest\" && req.method === \"POST\") {\n try {\n const input = await req.json() as ProbeInput;\n return json(await attest(input));\n } catch (error) {\n return json({ error: error instanceof Error ? error.message : String(error) }, 400);\n }\n }\n\n return json({ error: \"NOT_FOUND\", contract: \"/\" }, 404);\n}\n\n\nexport { attest };\n",[156],"75a1e7fc-a26e-419e-b8ba-47425c3b9780",["D",1788736218927],2,[28],"pulls","branches","forks","envVars",{"_174":176,"_177":61},"connections",{"_174":61,"_175":61},"count","unfilledCount",18,"emptyCount",{"_42":163,"_32":28,"_30":31,"_137":-5,"_40":41,"_39":14,"_139":125,"_37":192,"_13":165,"_33":20,"_34":36,"_24":25,"_144":-5,"_183":193,"_27":194},{"_42":155,"_32":156,"_30":56,"_137":-5,"_40":41,"_39":157,"_139":25,"_37":189,"_13":159,"_33":160,"_34":161,"_24":25,"_144":44,"_183":190,"_27":191},{"_42":146,"_32":147,"_30":148,"_137":-5,"_40":41,"_39":149,"_139":125,"_37":186,"_13":151,"_33":152,"_34":153,"_24":25,"_144":-5,"_183":187,"_27":188},{"_42":134,"_32":135,"_30":136,"_137":-5,"_40":41,"_39":138,"_139":125,"_37":182,"_13":141,"_33":142,"_34":143,"_24":25,"_144":-5,"_183":184,"_27":185},["D",1788735759848],"children",[],[135],["D",1788735959431],[],[147],["D",1788736208712],[],[156],["D",1788736218927],[],[28],["D",1788735288858],["D",1789522252250],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":54,"_103":104,"_105":25},{"_13":87,"_32":88,"_42":41,"_89":43,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":44,"_96":97},"ctx",{"_80":-5,"_127":233,"_234":235,"_236":237,"_238":25,"_239":25,"_240":25,"_241":125,"_242":-5,"_243":-7,"_244":-7,"_245":61,"_246":25,"_247":25,"_248":-5,"_249":25,"_250":25,"_251":25,"_252":-5},"ENV",{"_204":205,"_206":207,"_208":88,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v29