`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_502":503,"_504":505},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",42,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","index.ts","latestPath","fileId","01a04c05-88bb-772a-8ca1-918bb0a15986","name","fileType","http","content","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Hono } from \"npm:hono@4.9.5\";\nimport { Root } from \"./frontend/root.tsx\";\nimport {\n boundedText,\n githubFailureState,\n isAgentId,\n isRepoAllowed,\n normalizeRepo,\n parseRepoAllowlist,\n providerSemantic,\n safeEqual,\n} from \"./lib/policy.mjs\";\n\nconst app = new Hono();\nconst MISSION_ID = \"IC-AG-GENERAL-AGENT-PLATFORM-001\";\nconst CANONICAL_REPO = \"oromaskevic23-cmd/CYBER-HAK-Public\";\nconst RECOVERY_STATUS_URL = \"https://oromaskevic23--6796d66aa32f11f1bd771607ee4eb77e.web.val.run\";\nconst PROVIDERS = [\n { id: \"provider-1\", name: \"Val Town\", node: \"hanter-bridge-node-1\", endpoint: \"https://oromaskevic23--46761dd0a2bf11f18ae41607ee4eb77e.web.val.run/health\", present: true },\n { id: \"provider-2\", name: \"Netlify\", node: \"hanter-bridge-node-2\", endpoint: \"https://hanter-bridge-node-2.netlify.app/health\", present: true },\n { id: \"provider-3\", name: \"Supabase\", node: \"hanter-bridge-node-3\", endpoint: \"https://flqxwhibxnyujynmopmr.supabase.co/functions/v1/hanter-bridge-node-3\", present: true },\n];\n\nconst DIRECTORS = [\n { id: \"ORCH-KIDS-MEDIA-001\", name: \"Lucas Bennett\", agents: 8, domain: \"Kids Media\" },\n { id: \"ORCH-DROPSHIPPING-001\", name: \"Mason Reed\", agents: 16, domain: \"Dropshipping Commerce\" },\n { id: \"ORCH-AI-AUTOMATION-001\", name: \"Ethan Cole\", agents: 13, domain: \"AI Automation\" },\n { id: \"ORCH-B2B-REVENUE-001\", name: \"Sophia Laurent\", agents: 13, domain: \"B2B Revenue\" },\n { id: \"ORCH-CREATIVE-DIGITAL-001\", name: \"Adrian Wolfe\", agents: 13, domain: \"Creative & Digital\" },\n { id: \"ORCH-EDUCATION-001\", name: \"Amelia Grant\", agents: 13, domain: \"Education\" },\n { id: \"ORCH-DATA-MARKET-001\", name: \"Victor Hayes\", agents: 12, domain: \"Data & Market Intelligence\" },\n { id: \"ORCH-SME-SERVICES-001\", name: \"Olivia Morgan\", agents: 12, domain: \"SME Services\" },\n];\n\nconst ROSTER = (() => {\n let n = 1;\n return DIRECTORS.flatMap((director) => Array.from({ length: director.agents }, () => ({\n agent_id: `NCA-${String(n++).padStart(3, \"0\")}`,\n director_id: director.id,\n director: director.name,\n department: director.domain,\n current_mission: MISSION_ID,\n current_task: null,\n checkpoint: \"AG-M1-GOVERNED-INTEGRATION\",\n runtime_state: \"RECOVERY_RUNTIME_REPORTED\",\n skill_bindings: [\"AG Builder 1.1.0\"],\n evidence_count: 0,\n heartbeat: null,\n orion_state: \"ADVISORY_ONLY\",\n truth_boundary: \"ASSIGNMENT_NOT_EXECUTION_EVIDENCE\",\n })));\n})();\n\nawait sqlite.batch([\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_organizations (id TEXT PRIMARY KEY,name TEXT NOT NULL,website TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_contacts (id TEXT PRIMARY KEY,organization_id TEXT,name TEXT NOT NULL,email TEXT,source TEXT NOT NULL,status TEXT NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_leads (id TEXT PRIMARY KEY,title TEXT NOT NULL,stage TEXT NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_opportunities (id TEXT PRIMARY KEY,title TEXT NOT NULL,stage TEXT NOT NULL,value_usd REAL,probability INTEGER NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_activities (id TEXT PRIMARY KEY,kind TEXT NOT NULL,subject TEXT NOT NULL,related_type TEXT,related_id TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_tasks (id TEXT PRIMARY KEY,title TEXT NOT NULL,status TEXT NOT NULL,due_at TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_notes (id TEXT PRIMARY KEY,body TEXT NOT NULL,related_type TEXT,related_id TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_missions (id TEXT PRIMARY KEY,title TEXT NOT NULL,status TEXT NOT NULL,director_id TEXT,task_graph_json TEXT NOT NULL,evidence_ref TEXT,approval_state TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_audit_v2 (id INTEGER PRIMARY KEY AUTOINCREMENT,event_type TEXT NOT NULL,subject_id TEXT,detail_json TEXT NOT NULL,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_idempotency (key TEXT PRIMARY KEY,request_hash TEXT NOT NULL,response_json TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_skill_bindings (agent_id TEXT NOT NULL,skill_id TEXT NOT NULL,skill_version TEXT NOT NULL,state TEXT NOT NULL,PRIMARY KEY(agent_id,skill_id))\" },\n]);\nfor (const agent of ROSTER) await sqlite.execute({ sql: \"INSERT OR IGNORE INTO ag_skill_bindings(agent_id,skill_id,skill_version,state) VALUES(?,?,?,?)\", args: [agent.agent_id, \"ag-builder\", \"1.1.0\", \"ACTIVE_BOUNDED\"] });\n\napp.use(\"*\", async (c, next) => {\n await next();\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=(), payment=()\");\n c.header(\"Content-Security-Policy\", \"default-src 'self'; script-src 'self' https://cdn.twind.style https://esm.town https://esm.sh; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'self'\");\n if (c.req.path.startsWith(\"/api/\")) c.header(\"Cache-Control\", \"no-store\");\n});\n\nfunction requireAdmin(c: any) {\n const configured = Deno.env.get(\"AG_ADMIN_TOKEN\");\n if (!configured) return c.json({ ok: false, status: \"BLOCKED\", error: \"AG_ADMIN_TOKEN_NOT_CONFIGURED\" }, 503);\n const provided = c.req.header(\"authorization\")?.replace(/^Bearer\\s+/i, \"\") ?? \"\";\n if (!safeEqual(provided, configured)) return c.json({ ok: false, status: \"BLOCKED\", error: \"UNAUTHORIZED\" }, 401);\n const origin = c.req.header(\"origin\");\n if (origin && origin !== new URL(c.req.url).origin) return c.json({ ok: false, status: \"BLOCKED\", error: \"ORIGIN_DENIED\" }, 403);\n return null;\n}\n\nasync function parseMutation(c: any) {\n if (!/^application\\/json(?:;|$)/i.test(c.req.header(\"content-type\") ?? \"\")) return { error: c.json({ ok: false, error: \"JSON_CONTENT_TYPE_REQUIRED\" }, 415) };\n const length = Number(c.req.header(\"content-length\") ?? 0);\n if (length > 32768) return { error: c.json({ ok: false, error: \"BODY_TOO_LARGE\" }, 413) };\n const key = c.req.header(\"idempotency-key\");\n if (!key || !/^[A-Za-z0-9._:-]{8,128}$/.test(key)) return { error: c.json({ ok: false, error: \"VALID_IDEMPOTENCY_KEY_REQUIRED\" }, 400) };\n try { return { body: await c.req.json(), key }; } catch { return { error: c.json({ ok: false, error: \"MALFORMED_JSON\" }, 400) }; }\n}\n\nasync function fetchJson(url: string, headers: Record = {}, timeoutMs = 5000) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n try {\n const response = await fetch(url, { headers, redirect: \"error\", signal: controller.signal });\n const text = (await response.text()).slice(0, 1000000);\n let body: any = null;\n try { body = text ? JSON.parse(text) : null; } catch { body = { parse_error: true }; }\n return { ok: response.ok, status: response.status, body };\n } finally { clearTimeout(timer); }\n}\n\nlet providerCache: { at: number; value: any[] } | null = null;\nasync function providerHealth() {\n if (providerCache && Date.now() - providerCache.at < 30000) return providerCache.value;\n const checkedAt = new Date().toISOString();\n const value = await Promise.all(PROVIDERS.map(async (provider) => {\n try {\n const result = await fetchJson(provider.endpoint, {}, 4500);\n return { ...provider, http_status: result.status, response: result.body, checked_at: checkedAt, ...providerSemantic(result.ok, result.body, provider.node), side_effect_boundary: \"DENIED\", evidence_reference: `${provider.endpoint} @ ${checkedAt}` };\n } catch (error) {\n return { ...provider, http_status: null, response: null, checked_at: checkedAt, health_state: \"NOT_VERIFIED\", readiness_state: \"NOT_VERIFIED\", authority_state: \"NONE\", boundary_valid: false, side_effect_boundary: \"DENIED\", error: error instanceof Error ? error.name : \"FETCH_FAILED\", evidence_reference: `${provider.endpoint} @ ${checkedAt}` };\n }\n }));\n providerCache = { at: Date.now(), value };\n return value;\n}\n\nlet githubCache: { at: number; repo: string; value: any } | null = null;\nasync function githubStatus(requestedRepo?: string | null) {\n const token = Deno.env.get(\"GITHUB_TOKEN\");\n const configuredRepo = normalizeRepo(Deno.env.get(\"AG_GITHUB_REPO\") ?? CANONICAL_REPO);\n const allowlist = parseRepoAllowlist(Deno.env.get(\"AG_GITHUB_REPO_ALLOWLIST\") ?? \"\");\n const repo = normalizeRepo(requestedRepo ?? configuredRepo);\n if (!repo) return { state: \"REPO_NOT_FOUND\", connected: false, verified_at: new Date().toISOString() };\n if (!token) return { state: \"NOT_CONNECTED\", connected: false, repo, reason: \"GITHUB_CREDENTIAL_NOT_CONFIGURED\", verified_at: new Date().toISOString() };\n if (!isRepoAllowed(repo, allowlist)) return { state: \"ACCESS_DENIED\", connected: false, repo, reason: \"REPOSITORY_NOT_ALLOWLISTED\", verified_at: new Date().toISOString() };\n if (githubCache && githubCache.repo === repo && Date.now() - githubCache.at < 30000) return githubCache.value;\n const headers = { Authorization: `Bearer ${token}`, Accept: \"application/vnd.github+json\", \"User-Agent\": \"AG-Command-Center\" };\n const base = `https://api.github.com/repos/${repo}`;\n try {\n const metadata = await fetchJson(base, headers, 6500);\n if (!metadata.ok) return { state: githubFailureState(metadata.status), connected: false, repo, http_status: metadata.status, verified_at: new Date().toISOString() };\n const [branches, commits, pulls, issues, runs] = await Promise.all([\n fetchJson(`${base}/branches?per_page=100`, headers), fetchJson(`${base}/commits?per_page=1`, headers),\n fetchJson(`${base}/pulls?state=open&per_page=20`, headers), fetchJson(`${base}/issues?state=open&per_page=20`, headers),\n fetchJson(`${base}/actions/runs?per_page=10`, headers),\n ]);\n const latest = Array.isArray(commits.body) ? commits.body[0] : null;\n const value = {\n state: \"CONNECTED\", connected: true, repo: metadata.body.full_name, private: Boolean(metadata.body.private),\n default_branch: metadata.body.default_branch, latest_commit: latest ? { sha: latest.sha, message: latest.commit?.message, url: latest.html_url } : null,\n branches: Array.isArray(branches.body) ? branches.body.map((x: any) => ({ name: x.name, protected: x.protected })) : [],\n pull_requests: Array.isArray(pulls.body) ? pulls.body.map((x: any) => ({ number: x.number, title: x.title, state: x.state, url: x.html_url })) : [],\n issues: Array.isArray(issues.body) ? issues.body.filter((x: any) => !x.pull_request).map((x: any) => ({ number: x.number, title: x.title, state: x.state, url: x.html_url })) : [],\n actions: runs.ok ? (runs.body.workflow_runs ?? []).map((x: any) => ({ id: x.id, name: x.name, status: x.status, conclusion: x.conclusion, url: x.html_url })) : [],\n capability_status: { metadata: metadata.status, branches: branches.status, commits: commits.status, pull_requests: pulls.status, issues: issues.status, actions: runs.status },\n verified_at: new Date().toISOString(), credential_exposed: false,\n };\n githubCache = { at: Date.now(), repo, value };\n return value;\n } catch (error) {\n if (githubCache && githubCache.repo === repo && Date.now() - githubCache.at < 300000) return { ...githubCache.value, state: \"STALE\", connected: false, stale_since: new Date(githubCache.at).toISOString() };\n return { state: \"STALE\", connected: false, repo, reason: error instanceof Error ? error.name : \"FETCH_FAILED\", verified_at: new Date().toISOString() };\n }\n}\n\nasync function recoveryStatus() {\n try { const value = await fetchJson(RECOVERY_STATUS_URL, {}, 5000); return { status: value.ok ? \"PASS\" : \"NOT_VERIFIED\", http_status: value.status, evidence: value.body, verified_at: new Date().toISOString() }; }\n catch (error) { return { status: \"NOT_VERIFIED\", http_status: null, error: error instanceof Error ? error.name : \"FETCH_FAILED\", verified_at: new Date().toISOString() }; }\n}\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/api/health\", (c) => c.json({ ok: true, status: \"PASS\", product: \"AG\", component: \"ag-command-center\", mission_id: MISSION_ID, checkpoint: \"AG-M1-GOVERNED-INTEGRATION\", production: false, timestamp: new Date().toISOString() }));\n\napp.get(\"/api/providers\", async (c) => c.json({ logical_hanter_instances: 1, canonical_state_authority: \"RECOVERY_RUNTIME_UNTIL_ORIGINAL_RESTORED\", rules: { stale_after_seconds: 90, retry: \"EXPONENTIAL_BACKOFF_WITH_JITTER\", idempotency: \"REQUIRED_FOR_MUTATIONS\", replay_protection: \"SIGNED_ENVELOPE_NONCE_AND_EXPIRY_REQUIRED\", split_brain: \"FAIL_CLOSED\", failover: \"HEALTHY_IS_NOT_AUTHORITY\" }, providers: await providerHealth() }));\napp.get(\"/api/runtime/recovery\", async (c) => c.json(await recoveryStatus()));\napp.get(\"/api/agents\", (c) => c.json({ count: ROSTER.length, directors: DIRECTORS.length, agents: ROSTER }));\napp.get(\"/api/missions\", async (c) => c.json({ missions: (await sqlite.execute(\"SELECT * FROM ag_missions ORDER BY updated_at DESC LIMIT 100\")).rows }));\napp.get(\"/api/orion\", async (c) => { const runtime = await recoveryStatus(); return c.json({ role: \"ADVISORY_COORDINATION_ONLY\", authority: \"NONE\", always_on_required: true, runtime }); });\napp.get(\"/api/skills/ag-builder\", async (c) => { const result = await sqlite.execute(\"SELECT state,COUNT(*) count FROM ag_skill_bindings WHERE skill_id='ag-builder' GROUP BY state\"); return c.json({ file: \"skills/ag-builder/SKILL.md\", version: \"1.1.0\", binding_target: 100, bindings: result.rows, governance: \"SKILL_DOES_NOT_GRANT_AUTHORITY\", discoverability: \"SOURCE_PRESENT_AND_AG_RUNTIME_REGISTRY_BOUND\" }); });\napp.get(\"/api/security\", (c) => c.json({ policy: \"DENY_BY_DEFAULT\", chain: [\"AI Passport\", \"Enterprise IMPERIAL Skills\", \"Guardian Core\", \"Approval Gateway\", \"Runtime Domain\", \"Audit Ledger\"], laws: [\"Identity != Authority\", \"Capability != Approval\", \"Intelligence != Privilege\"], cyber_hak: { repository: CANONICAL_REPO, role: \"DEFENSIVE_GOVERNED_CAPABILITY_LAYER\", autonomous_offensive_activity: \"DENIED\", execution_authority: \"NONE\", credential_authority: \"NONE\", financial_authority: \"NONE\" } }));\napp.get(\"/api/github/status\", async (c) => c.json(await githubStatus(c.req.query(\"repo\"))));\n\napp.get(\"/api/crm\", async (c) => {\n const names = [\"organizations\", \"contacts\", \"leads\", \"opportunities\", \"activities\", \"tasks\", \"notes\"];\n const entries = await Promise.all(names.map(async (name) => [name, (await sqlite.execute(`SELECT * FROM ag_crm_${name} ORDER BY created_at DESC LIMIT 100`)).rows]));\n return c.json({ entities: Object.fromEntries(entries), pipeline_stages: [\"NEW\", \"QUALIFY\", \"DISCOVERY\", \"PROPOSAL\", \"NEGOTIATION\", \"WON_EVIDENCED\", \"LOST\"], revenue_claimed_usd: 0, truth_boundary: \"NO_PAYMENT_EVIDENCE_NO_REVENUE\" });\n});\n\napp.post(\"/api/crm/:entity\", async (c) => {\n const denied = requireAdmin(c); if (denied) return denied;\n const parsed = await parseMutation(c); if (parsed.error) return parsed.error;\n const entity = c.req.param(\"entity\");\n const body: any = parsed.body;\n const owner = body.owner_agent_id == null ? null : (isAgentId(body.owner_agent_id) ? body.owner_agent_id : undefined);\n if (owner === undefined) return c.json({ ok: false, error: \"INVALID_OWNER_AGENT_ID\" }, 400);\n const now = new Date().toISOString(); const id = crypto.randomUUID();\n const title = boundedText(body.title ?? body.name ?? body.subject, 240, true);\n if (!title) return c.json({ ok: false, error: \"TITLE_OR_NAME_REQUIRED\" }, 400);\n const statements: Record = {\n organizations: { sql: \"INSERT INTO ag_crm_organizations VALUES(?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.website, 500), owner, boundedText(body.evidence_ref, 500), now, now] },\n contacts: { sql: \"INSERT INTO ag_crm_contacts VALUES(?,?,?,?,?,?,?,?,?,?,?)\", args: [id, body.organization_id ?? null, title, boundedText(body.email, 320), boundedText(body.source, 80) || \"manual\", boundedText(body.status, 40) || \"NEW\", owner, boundedText(body.evidence_ref, 500), now, now] },\n leads: { sql: \"INSERT INTO ag_crm_leads VALUES(?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.stage, 40) || \"NEW\", owner, boundedText(body.evidence_ref, 500), now, now] },\n opportunities: { sql: \"INSERT INTO ag_crm_opportunities VALUES(?,?,?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.stage, 40) || \"QUALIFY\", Number.isFinite(body.value_usd) ? body.value_usd : null, Number.isInteger(body.probability) && body.probability >= 0 && body.probability <= 100 ? body.probability : 0, owner, boundedText(body.evidence_ref, 500), now, now] },\n activities: { sql: \"INSERT INTO ag_crm_activities VALUES(?,?,?,?,?,?,?,?,?)\", args: [id, boundedText(body.kind, 60) || \"NOTE\", title, boundedText(body.related_type, 60), body.related_id ?? null, owner, boundedText(body.evidence_ref, 500), now] },\n tasks: { sql: \"INSERT INTO ag_crm_tasks VALUES(?,?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.status, 40) || \"OPEN\", body.due_at ?? null, owner, boundedText(body.evidence_ref, 500), now, now] },\n notes: { sql: \"INSERT INTO ag_crm_notes VALUES(?,?,?,?,?,?,?)\", args: [id, boundedText(body.body, 8000, true), boundedText(body.related_type, 60), body.related_id ?? null, owner, boundedText(body.evidence_ref, 500), now] },\n };\n const statement = statements[entity]; if (!statement || statement.args.includes(null) && entity === \"notes\" && !statement.args[1]) return c.json({ ok: false, error: \"ENTITY_OR_INPUT_INVALID\" }, 400);\n const requestHash = Array.from(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(JSON.stringify(body))))).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n const existing = await sqlite.execute({ sql: \"SELECT request_hash,response_json FROM ag_idempotency WHERE key=?\", args: [parsed.key] });\n if (existing.rows.length) return (existing.rows[0] as any).request_hash === requestHash ? c.json(JSON.parse(String((existing.rows[0] as any).response_json))) : c.json({ ok: false, error: \"IDEMPOTENCY_KEY_CONFLICT\" }, 409);\n const response = { ok: true, entity, id, created_at: now };\n await sqlite.batch([statement, { sql: \"INSERT INTO ag_audit_v2(event_type,subject_id,detail_json,created_at) VALUES(?,?,?,?)\", args: [\"CRM_ENTITY_CREATED\", id, JSON.stringify({ entity, owner, evidence_ref: body.evidence_ref ?? null }), now] }, { sql: \"INSERT INTO ag_idempotency(key,request_hash,response_json,created_at) VALUES(?,?,?,?)\", args: [parsed.key, requestHash, JSON.stringify(response), now] }]);\n return c.json(response, 201);\n});\n\napp.get(\"/api/overview\", async (c) => {\n const crm = await sqlite.execute(\"SELECT (SELECT COUNT(*) FROM ag_crm_contacts) contacts,(SELECT COUNT(*) FROM ag_crm_organizations) organizations,(SELECT COUNT(*) FROM ag_crm_leads) leads,(SELECT COUNT(*) FROM ag_crm_opportunities) opportunities,(SELECT COUNT(*) FROM ag_crm_opportunities WHERE evidence_ref IS NOT NULL AND evidence_ref<>'') evidenced_opportunities\");\n const [providers, github, runtime] = await Promise.all([providerHealth(), githubStatus(), recoveryStatus()]);\n return c.json({ product: \"AG\", mode: \"RIGHT_HAND_MODE\", mission: { id: MISSION_ID, status: \"ACTIVE_BUILD\", checkpoint: \"AG-M1-GOVERNED-INTEGRATION\" }, hanter: { role: \"SINGLE_AI_COMMAND_CENTER_DEPUTY\", global_orchestrator: false, production: false }, fleet: { registered_agents: ROSTER.length, directors: DIRECTORS.length, roster_type: \"CANONICAL_ASSIGNMENT\", live_execution_claimed: false }, directors: DIRECTORS, orion: { role: \"ADVISORY_COORDINATION_ONLY\", always_on_required: true, status: runtime.status }, governance: [\"AI Passport\", \"Enterprise IMPERIAL Skills\", \"Guardian Core\", \"Approval Gateway\", \"Runtime Domain\", \"Audit Ledger\"], providers, crm: { ...(crm.rows[0] as any), revenue_claimed_usd: 0 }, github });\n});\n\napp.notFound((c) => c.json({ ok: false, status: \"BLOCKED\", error: \"ROUTE_NOT_FOUND\" }, 404));\napp.onError((error, c) => { console.error(\"AG_REQUEST_FAILED\", error instanceof Error ? error.name : \"UNKNOWN\"); return c.json({ ok: false, status: \"BLOCKED\", error: \"INTERNAL_ERROR\" }, 500); });\nexport default app.fetch;\n","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Hono } from \"npm:hono@4.9.5\";\nimport { Root } from \"./frontend/root.tsx\";\nimport { commandStatus, submitCommand, transitionCommand } from \"./lib/command_bus.ts\";\nimport {\n boundedText,\n githubFailureState,\n isAgentId,\n isRepoAllowed,\n normalizeRepo,\n parseRepoAllowlist,\n providerSemantic,\n safeEqual,\n} from \"./lib/policy.mjs\";\n\nconst app = new Hono();\nconst MISSION_ID = \"IC-AG-GENERAL-AGENT-PLATFORM-001\";\nconst CANONICAL_REPO = \"oromaskevic23-cmd/CYBER-HAK-Public\";\nconst RECOVERY_STATUS_URL = \"https://oromaskevic23--6796d66aa32f11f1bd771607ee4eb77e.web.val.run\";\nconst PROVIDERS = [\n { id: \"provider-1\", name: \"Val Town\", node: \"hanter-bridge-node-1\", endpoint: \"https://oromaskevic23--46761dd0a2bf11f18ae41607ee4eb77e.web.val.run/health\", present: true },\n { id: \"provider-2\", name: \"Netlify\", node: \"hanter-bridge-node-2\", endpoint: \"https://hanter-bridge-node-2.netlify.app/health\", present: true },\n { id: \"provider-3\", name: \"Supabase\", node: \"hanter-bridge-node-3\", endpoint: \"https://flqxwhibxnyujynmopmr.supabase.co/functions/v1/hanter-bridge-node-3\", present: true },\n];\n\nconst DIRECTORS = [\n { id: \"ORCH-KIDS-MEDIA-001\", name: \"Lucas Bennett\", agents: 8, domain: \"Kids Media\" },\n { id: \"ORCH-DROPSHIPPING-001\", name: \"Mason Reed\", agents: 16, domain: \"Dropshipping Commerce\" },\n { id: \"ORCH-AI-AUTOMATION-001\", name: \"Ethan Cole\", agents: 13, domain: \"AI Automation\" },\n { id: \"ORCH-B2B-REVENUE-001\", name: \"Sophia Laurent\", agents: 13, domain: \"B2B Revenue\" },\n { id: \"ORCH-CREATIVE-DIGITAL-001\", name: \"Adrian Wolfe\", agents: 13, domain: \"Creative & Digital\" },\n { id: \"ORCH-EDUCATION-001\", name: \"Amelia Grant\", agents: 13, domain: \"Education\" },\n { id: \"ORCH-DATA-MARKET-001\", name: \"Victor Hayes\", agents: 12, domain: \"Data & Market Intelligence\" },\n { id: \"ORCH-SME-SERVICES-001\", name: \"Olivia Morgan\", agents: 12, domain: \"SME Services\" },\n];\n\nconst ROSTER = (() => {\n let n = 1;\n return DIRECTORS.flatMap((director) => Array.from({ length: director.agents }, () => ({\n agent_id: `NCA-${String(n++).padStart(3, \"0\")}`,\n director_id: director.id,\n director: director.name,\n department: director.domain,\n current_mission: MISSION_ID,\n current_task: null,\n checkpoint: \"AG-M1-GOVERNED-INTEGRATION\",\n runtime_state: \"RECOVERY_RUNTIME_REPORTED\",\n skill_bindings: [\"AG Builder 1.1.0\"],\n evidence_count: 0,\n heartbeat: null,\n orion_state: \"ADVISORY_ONLY\",\n truth_boundary: \"ASSIGNMENT_NOT_EXECUTION_EVIDENCE\",\n })));\n})();\n\nawait sqlite.batch([\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_organizations (id TEXT PRIMARY KEY,name TEXT NOT NULL,website TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_contacts (id TEXT PRIMARY KEY,organization_id TEXT,name TEXT NOT NULL,email TEXT,source TEXT NOT NULL,status TEXT NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_leads (id TEXT PRIMARY KEY,title TEXT NOT NULL,stage TEXT NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_opportunities (id TEXT PRIMARY KEY,title TEXT NOT NULL,stage TEXT NOT NULL,value_usd REAL,probability INTEGER NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_activities (id TEXT PRIMARY KEY,kind TEXT NOT NULL,subject TEXT NOT NULL,related_type TEXT,related_id TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_tasks (id TEXT PRIMARY KEY,title TEXT NOT NULL,status TEXT NOT NULL,due_at TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_notes (id TEXT PRIMARY KEY,body TEXT NOT NULL,related_type TEXT,related_id TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_missions (id TEXT PRIMARY KEY,title TEXT NOT NULL,status TEXT NOT NULL,director_id TEXT,task_graph_json TEXT NOT NULL,evidence_ref TEXT,approval_state TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_audit_v2 (id INTEGER PRIMARY KEY AUTOINCREMENT,event_type TEXT NOT NULL,subject_id TEXT,detail_json TEXT NOT NULL,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_idempotency (key TEXT PRIMARY KEY,request_hash TEXT NOT NULL,response_json TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_skill_bindings (agent_id TEXT NOT NULL,skill_id TEXT NOT NULL,skill_version TEXT NOT NULL,state TEXT NOT NULL,PRIMARY KEY(agent_id,skill_id))\" },\n]);\nfor (const agent of ROSTER) await sqlite.execute({ sql: \"INSERT OR IGNORE INTO ag_skill_bindings(agent_id,skill_id,skill_version,state) VALUES(?,?,?,?)\", args: [agent.agent_id, \"ag-builder\", \"1.1.0\", \"ACTIVE_BOUNDED\"] });\n\napp.use(\"*\", async (c, next) => {\n await next();\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=(), payment=()\");\n c.header(\"Content-Security-Policy\", \"default-src 'self'; script-src 'self' https://cdn.twind.style https://esm.town https://esm.sh; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'self'\");\n if (c.req.path.startsWith(\"/api/\")) c.header(\"Cache-Control\", \"no-store\");\n});\n\nfunction requireAdmin(c: any) {\n const configured = Deno.env.get(\"AG_ADMIN_TOKEN\");\n if (!configured) return c.json({ ok: false, status: \"BLOCKED\", error: \"AG_ADMIN_TOKEN_NOT_CONFIGURED\" }, 503);\n const provided = c.req.header(\"authorization\")?.replace(/^Bearer\\s+/i, \"\") ?? \"\";\n if (!safeEqual(provided, configured)) return c.json({ ok: false, status: \"BLOCKED\", error: \"UNAUTHORIZED\" }, 401);\n const origin = c.req.header(\"origin\");\n if (origin && origin !== new URL(c.req.url).origin) return c.json({ ok: false, status: \"BLOCKED\", error: \"ORIGIN_DENIED\" }, 403);\n return null;\n}\n\nasync function parseMutation(c: any) {\n if (!/^application\\/json(?:;|$)/i.test(c.req.header(\"content-type\") ?? \"\")) return { error: c.json({ ok: false, error: \"JSON_CONTENT_TYPE_REQUIRED\" }, 415) };\n const length = Number(c.req.header(\"content-length\") ?? 0);\n if (length > 32768) return { error: c.json({ ok: false, error: \"BODY_TOO_LARGE\" }, 413) };\n const key = c.req.header(\"idempotency-key\");\n if (!key || !/^[A-Za-z0-9._:-]{8,128}$/.test(key)) return { error: c.json({ ok: false, error: \"VALID_IDEMPOTENCY_KEY_REQUIRED\" }, 400) };\n try { return { body: await c.req.json(), key }; } catch { return { error: c.json({ ok: false, error: \"MALFORMED_JSON\" }, 400) }; }\n}\n\nasync function fetchJson(url: string, headers: Record = {}, timeoutMs = 5000) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n try {\n const response = await fetch(url, { headers, redirect: \"error\", signal: controller.signal });\n const text = (await response.text()).slice(0, 1000000);\n let body: any = null;\n try { body = text ? JSON.parse(text) : null; } catch { body = { parse_error: true }; }\n return { ok: response.ok, status: response.status, body };\n } finally { clearTimeout(timer); }\n}\n\nlet providerCache: { at: number; value: any[] } | null = null;\nasync function providerHealth() {\n if (providerCache && Date.now() - providerCache.at < 30000) return providerCache.value;\n const checkedAt = new Date().toISOString();\n const value = await Promise.all(PROVIDERS.map(async (provider) => {\n try {\n const result = await fetchJson(provider.endpoint, {}, 4500);\n return { ...provider, http_status: result.status, response: result.body, checked_at: checkedAt, ...providerSemantic(result.ok, result.body, provider.node), side_effect_boundary: \"DENIED\", evidence_reference: `${provider.endpoint} @ ${checkedAt}` };\n } catch (error) {\n return { ...provider, http_status: null, response: null, checked_at: checkedAt, health_state: \"NOT_VERIFIED\", readiness_state: \"NOT_VERIFIED\", authority_state: \"NONE\", boundary_valid: false, side_effect_boundary: \"DENIED\", error: error instanceof Error ? error.name : \"FETCH_FAILED\", evidence_reference: `${provider.endpoint} @ ${checkedAt}` };\n }\n }));\n providerCache = { at: Date.now(), value };\n return value;\n}\n\nlet githubCache: { at: number; repo: string; value: any } | null = null;\nasync function githubStatus(requestedRepo?: string | null) {\n const token = Deno.env.get(\"GITHUB_TOKEN\");\n const configuredRepo = normalizeRepo(Deno.env.get(\"AG_GITHUB_REPO\") ?? CANONICAL_REPO);\n const allowlist = parseRepoAllowlist(Deno.env.get(\"AG_GITHUB_REPO_ALLOWLIST\") ?? \"\");\n const repo = normalizeRepo(requestedRepo ?? configuredRepo);\n if (!repo) return { state: \"REPO_NOT_FOUND\", connected: false, verified_at: new Date().toISOString() };\n if (!token) return { state: \"NOT_CONNECTED\", connected: false, repo, reason: \"GITHUB_CREDENTIAL_NOT_CONFIGURED\", verified_at: new Date().toISOString() };\n if (!isRepoAllowed(repo, allowlist)) return { state: \"ACCESS_DENIED\", connected: false, repo, reason: \"REPOSITORY_NOT_ALLOWLISTED\", verified_at: new Date().toISOString() };\n if (githubCache && githubCache.repo === repo && Date.now() - githubCache.at < 30000) return githubCache.value;\n const headers = { Authorization: `Bearer ${token}`, Accept: \"application/vnd.github+json\", \"User-Agent\": \"AG-Command-Center\" };\n const base = `https://api.github.com/repos/${repo}`;\n try {\n const metadata = await fetchJson(base, headers, 6500);\n if (!metadata.ok) return { state: githubFailureState(metadata.status), connected: false, repo, http_status: metadata.status, verified_at: new Date().toISOString() };\n const [branches, commits, pulls, issues, runs] = await Promise.all([\n fetchJson(`${base}/branches?per_page=100`, headers), fetchJson(`${base}/commits?per_page=1`, headers),\n fetchJson(`${base}/pulls?state=open&per_page=20`, headers), fetchJson(`${base}/issues?state=open&per_page=20`, headers),\n fetchJson(`${base}/actions/runs?per_page=10`, headers),\n ]);\n const latest = Array.isArray(commits.body) ? commits.body[0] : null;\n const value = {\n state: \"CONNECTED\", connected: true, repo: metadata.body.full_name, private: Boolean(metadata.body.private),\n default_branch: metadata.body.default_branch, latest_commit: latest ? { sha: latest.sha, message: latest.commit?.message, url: latest.html_url } : null,\n branches: Array.isArray(branches.body) ? branches.body.map((x: any) => ({ name: x.name, protected: x.protected })) : [],\n pull_requests: Array.isArray(pulls.body) ? pulls.body.map((x: any) => ({ number: x.number, title: x.title, state: x.state, url: x.html_url })) : [],\n issues: Array.isArray(issues.body) ? issues.body.filter((x: any) => !x.pull_request).map((x: any) => ({ number: x.number, title: x.title, state: x.state, url: x.html_url })) : [],\n actions: runs.ok ? (runs.body.workflow_runs ?? []).map((x: any) => ({ id: x.id, name: x.name, status: x.status, conclusion: x.conclusion, url: x.html_url })) : [],\n capability_status: { metadata: metadata.status, branches: branches.status, commits: commits.status, pull_requests: pulls.status, issues: issues.status, actions: runs.status },\n verified_at: new Date().toISOString(), credential_exposed: false,\n };\n githubCache = { at: Date.now(), repo, value };\n return value;\n } catch (error) {\n if (githubCache && githubCache.repo === repo && Date.now() - githubCache.at < 300000) return { ...githubCache.value, state: \"STALE\", connected: false, stale_since: new Date(githubCache.at).toISOString() };\n return { state: \"STALE\", connected: false, repo, reason: error instanceof Error ? error.name : \"FETCH_FAILED\", verified_at: new Date().toISOString() };\n }\n}\n\nasync function recoveryStatus() {\n try { const value = await fetchJson(RECOVERY_STATUS_URL, {}, 5000); return { status: value.ok ? \"PASS\" : \"NOT_VERIFIED\", http_status: value.status, evidence: value.body, verified_at: new Date().toISOString() }; }\n catch (error) { return { status: \"NOT_VERIFIED\", http_status: null, error: error instanceof Error ? error.name : \"FETCH_FAILED\", verified_at: new Date().toISOString() }; }\n}\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/api/health\", (c) => c.json({ ok: true, status: \"PASS\", product: \"AG\", component: \"ag-command-center\", mission_id: MISSION_ID, checkpoint: \"AG-M1-GOVERNED-INTEGRATION\", production: false, timestamp: new Date().toISOString() }));\n\napp.get(\"/api/providers\", async (c) => c.json({ logical_hanter_instances: 1, canonical_state_authority: \"RECOVERY_RUNTIME_UNTIL_ORIGINAL_RESTORED\", rules: { stale_after_seconds: 90, retry: \"EXPONENTIAL_BACKOFF_WITH_JITTER\", idempotency: \"REQUIRED_FOR_MUTATIONS\", replay_protection: \"SIGNED_ENVELOPE_NONCE_AND_EXPIRY_REQUIRED\", split_brain: \"FAIL_CLOSED\", failover: \"HEALTHY_IS_NOT_AUTHORITY\" }, providers: await providerHealth() }));\napp.get(\"/api/runtime/recovery\", async (c) => c.json(await recoveryStatus()));\napp.get(\"/api/agents\", (c) => c.json({ count: ROSTER.length, directors: DIRECTORS.length, agents: ROSTER }));\napp.get(\"/api/missions\", async (c) => c.json({ missions: (await sqlite.execute(\"SELECT * FROM ag_missions ORDER BY updated_at DESC LIMIT 100\")).rows }));\napp.get(\"/api/orion\", async (c) => { const runtime = await recoveryStatus(); return c.json({ role: \"ADVISORY_COORDINATION_ONLY\", authority: \"NONE\", always_on_required: true, runtime }); });\napp.get(\"/api/skills/ag-builder\", async (c) => { const result = await sqlite.execute(\"SELECT state,COUNT(*) count FROM ag_skill_bindings WHERE skill_id='ag-builder' GROUP BY state\"); return c.json({ file: \"skills/ag-builder/SKILL.md\", version: \"1.1.0\", binding_target: 100, bindings: result.rows, governance: \"SKILL_DOES_NOT_GRANT_AUTHORITY\", discoverability: \"SOURCE_PRESENT_AND_AG_RUNTIME_REGISTRY_BOUND\" }); });\napp.get(\"/api/security\", (c) => c.json({ policy: \"DENY_BY_DEFAULT\", chain: [\"AI Passport\", \"Enterprise IMPERIAL Skills\", \"Guardian Core\", \"Approval Gateway\", \"Runtime Domain\", \"Audit Ledger\"], laws: [\"Identity != Authority\", \"Capability != Approval\", \"Intelligence != Privilege\"], cyber_hak: { repository: CANONICAL_REPO, role: \"DEFENSIVE_GOVERNED_CAPABILITY_LAYER\", autonomous_offensive_activity: \"DENIED\", execution_authority: \"NONE\", credential_authority: \"NONE\", financial_authority: \"NONE\" } }));\napp.get(\"/api/github/status\", async (c) => c.json(await githubStatus(c.req.query(\"repo\"))));\n\napp.get(\"/api/crm\", async (c) => {\n const names = [\"organizations\", \"contacts\", \"leads\", \"opportunities\", \"activities\", \"tasks\", \"notes\"];\n const entries = await Promise.all(names.map(async (name) => [name, (await sqlite.execute(`SELECT * FROM ag_crm_${name} ORDER BY created_at DESC LIMIT 100`)).rows]));\n return c.json({ entities: Object.fromEntries(entries), pipeline_stages: [\"NEW\", \"QUALIFY\", \"DISCOVERY\", \"PROPOSAL\", \"NEGOTIATION\", \"WON_EVIDENCED\", \"LOST\"], revenue_claimed_usd: 0, truth_boundary: \"NO_PAYMENT_EVIDENCE_NO_REVENUE\" });\n});\n\napp.post(\"/api/crm/:entity\", async (c) => {\n const denied = requireAdmin(c); if (denied) return denied;\n const parsed = await parseMutation(c); if (parsed.error) return parsed.error;\n const entity = c.req.param(\"entity\");\n const body: any = parsed.body;\n const owner = body.owner_agent_id == null ? null : (isAgentId(body.owner_agent_id) ? body.owner_agent_id : undefined);\n if (owner === undefined) return c.json({ ok: false, error: \"INVALID_OWNER_AGENT_ID\" }, 400);\n const now = new Date().toISOString(); const id = crypto.randomUUID();\n const title = boundedText(body.title ?? body.name ?? body.subject, 240, true);\n if (!title) return c.json({ ok: false, error: \"TITLE_OR_NAME_REQUIRED\" }, 400);\n const statements: Record = {\n organizations: { sql: \"INSERT INTO ag_crm_organizations VALUES(?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.website, 500), owner, boundedText(body.evidence_ref, 500), now, now] },\n contacts: { sql: \"INSERT INTO ag_crm_contacts VALUES(?,?,?,?,?,?,?,?,?,?,?)\", args: [id, body.organization_id ?? null, title, boundedText(body.email, 320), boundedText(body.source, 80) || \"manual\", boundedText(body.status, 40) || \"NEW\", owner, boundedText(body.evidence_ref, 500), now, now] },\n leads: { sql: \"INSERT INTO ag_crm_leads VALUES(?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.stage, 40) || \"NEW\", owner, boundedText(body.evidence_ref, 500), now, now] },\n opportunities: { sql: \"INSERT INTO ag_crm_opportunities VALUES(?,?,?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.stage, 40) || \"QUALIFY\", Number.isFinite(body.value_usd) ? body.value_usd : null, Number.isInteger(body.probability) && body.probability >= 0 && body.probability <= 100 ? body.probability : 0, owner, boundedText(body.evidence_ref, 500), now, now] },\n activities: { sql: \"INSERT INTO ag_crm_activities VALUES(?,?,?,?,?,?,?,?,?)\", args: [id, boundedText(body.kind, 60) || \"NOTE\", title, boundedText(body.related_type, 60), body.related_id ?? null, owner, boundedText(body.evidence_ref, 500), now] },\n tasks: { sql: \"INSERT INTO ag_crm_tasks VALUES(?,?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.status, 40) || \"OPEN\", body.due_at ?? null, owner, boundedText(body.evidence_ref, 500), now, now] },\n notes: { sql: \"INSERT INTO ag_crm_notes VALUES(?,?,?,?,?,?,?)\", args: [id, boundedText(body.body, 8000, true), boundedText(body.related_type, 60), body.related_id ?? null, owner, boundedText(body.evidence_ref, 500), now] },\n };\n const statement = statements[entity]; if (!statement || statement.args.includes(null) && entity === \"notes\" && !statement.args[1]) return c.json({ ok: false, error: \"ENTITY_OR_INPUT_INVALID\" }, 400);\n const requestHash = Array.from(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(JSON.stringify(body))))).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n const existing = await sqlite.execute({ sql: \"SELECT request_hash,response_json FROM ag_idempotency WHERE key=?\", args: [parsed.key] });\n if (existing.rows.length) return (existing.rows[0] as any).request_hash === requestHash ? c.json(JSON.parse(String((existing.rows[0] as any).response_json))) : c.json({ ok: false, error: \"IDEMPOTENCY_KEY_CONFLICT\" }, 409);\n const response = { ok: true, entity, id, created_at: now };\n await sqlite.batch([statement, { sql: \"INSERT INTO ag_audit_v2(event_type,subject_id,detail_json,created_at) VALUES(?,?,?,?)\", args: [\"CRM_ENTITY_CREATED\", id, JSON.stringify({ entity, owner, evidence_ref: body.evidence_ref ?? null }), now] }, { sql: \"INSERT INTO ag_idempotency(key,request_hash,response_json,created_at) VALUES(?,?,?,?)\", args: [parsed.key, requestHash, JSON.stringify(response), now] }]);\n return c.json(response, 201);\n});\n\napp.get(\"/api/overview\", async (c) => {\n const crm = await sqlite.execute(\"SELECT (SELECT COUNT(*) FROM ag_crm_contacts) contacts,(SELECT COUNT(*) FROM ag_crm_organizations) organizations,(SELECT COUNT(*) FROM ag_crm_leads) leads,(SELECT COUNT(*) FROM ag_crm_opportunities) opportunities,(SELECT COUNT(*) FROM ag_crm_opportunities WHERE evidence_ref IS NOT NULL AND evidence_ref<>'') evidenced_opportunities\");\n const [providers, github, runtime] = await Promise.all([providerHealth(), githubStatus(), recoveryStatus()]);\n return c.json({ product: \"AG\", mode: \"RIGHT_HAND_MODE\", mission: { id: MISSION_ID, status: \"ACTIVE_BUILD\", checkpoint: \"AG-M1-GOVERNED-INTEGRATION\" }, hanter: { role: \"SINGLE_AI_COMMAND_CENTER_DEPUTY\", global_orchestrator: false, production: false }, fleet: { registered_agents: ROSTER.length, directors: DIRECTORS.length, roster_type: \"CANONICAL_ASSIGNMENT\", live_execution_claimed: false }, directors: DIRECTORS, orion: { role: \"ADVISORY_COORDINATION_ONLY\", always_on_required: true, status: runtime.status }, governance: [\"AI Passport\", \"Enterprise IMPERIAL Skills\", \"Guardian Core\", \"Approval Gateway\", \"Runtime Domain\", \"Audit Ledger\"], providers, crm: { ...(crm.rows[0] as any), revenue_claimed_usd: 0 }, github });\n});\n\napp.notFound((c) => c.json({ ok: false, status: \"BLOCKED\", error: \"ROUTE_NOT_FOUND\" }, 404));\napp.onError((error, c) => { console.error(\"AG_REQUEST_FAILED\", error instanceof Error ? error.name : \"UNKNOWN\"); return c.json({ ok: false, status: \"BLOCKED\", error: \"INTERNAL_ERROR\" }, 500); });\nexport default app.fetch;\n","createdAt",["D",1789074854636],"branchVersion","branchId","24770712-378b-401f-a93f-7fe807c5dda9","id","d711419f-af68-49ff-b31a-45902d9292f1","ag-command-center",["D",1787981826165],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","AG HANTER + 100 NCA + CRM command center","imageUrl","fe39b163-4b50-466e-82d1-8bd01133e4b6","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a03585-eb44-758d-92a4-77db1a9a243c","tursoName","d711419faf6849ffb31a45902d9292f1","tursoHostname","d711419faf6849ffb31a45902d9292f1-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789543856531],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",43,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","oromaskevic23","handle","displayName","Олександр Ромаскевич","avatar","https://lh3.googleusercontent.com/a/ACg8ocIo1MJ3hDjpQrinMIRok3d2YY1vpHgehs8m2u1_vc7pmFovRGI=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":497,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":498,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":499,"_83":500,"_85":501,"_87":25},"tree",[193,200,203,230,231,232,233],"files",[193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233],"counts",{"_183":62,"_184":155,"_185":62,"_186":187,"_188":189},"contents",[130,131,132,133,134,135,136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":178,"_32":179,"_30":180,"_138":-5,"_41":42,"_40":155,"_139":58,"_38":181,"_13":62,"_33":170,"_35":-5,"_24":25,"_142":-5,"_27":182},{"_43":172,"_32":173,"_30":174,"_138":-5,"_41":42,"_40":175,"_139":58,"_38":176,"_13":62,"_33":170,"_35":-5,"_24":25,"_142":-5,"_27":177},{"_43":165,"_32":166,"_30":167,"_138":-5,"_41":42,"_40":168,"_139":58,"_38":169,"_13":62,"_33":170,"_35":-5,"_24":25,"_142":-5,"_27":171},{"_43":159,"_32":160,"_30":161,"_138":-5,"_41":42,"_40":155,"_139":58,"_38":162,"_13":62,"_33":20,"_35":163,"_24":25,"_142":-5,"_27":164},{"_43":152,"_32":153,"_30":154,"_138":-5,"_41":42,"_40":155,"_139":58,"_38":156,"_13":62,"_33":20,"_35":157,"_24":25,"_142":-5,"_27":158},{"_43":144,"_32":145,"_30":146,"_138":-5,"_41":42,"_40":147,"_139":58,"_38":148,"_13":62,"_33":149,"_35":150,"_24":25,"_142":-5,"_27":151},{"_43":137,"_32":28,"_30":31,"_138":-5,"_41":42,"_40":14,"_139":25,"_38":140,"_13":141,"_33":34,"_35":37,"_24":25,"_142":45,"_27":143},"59a14fc4-a108-4613-9536-c1a69cd70759","parentId","latest",["D",1789074854636],5,"label",[28],"53a5e604-fb31-435a-90ff-12772bb95284","command_bus_test.ts","89dd9380-ad5c-11f1-9e38-1607ee4eb77e",41,["D",1789074838663],"script","// IMPERIAL Core Command Bus runtime verification\n// Author & Chief Architect: Alexander Romaskevich / RomaskevicH\nimport { submitCommand,transitionCommand,commandStatus } from './lib/command_bus.ts';\n\nconst id=`IC-COMMAND-BUS-TEST-${Date.now()}`;\nconst mission='IC-IMPERIAL-CORE-24H-FULL-ACTIVATION-001';\nconst first=await submitCommand({command_id:id,mission_id:mission,actor:'ARCHITECT',priority:100,assigned_agent:'IMPERIAL-ADRIAN-WALKER-NCA-001',runtime_domain:'DEVELOPMENT',payload:{test:'safe-command-bus'}});\nconst duplicate=await submitCommand({command_id:id,mission_id:mission,actor:'ARCHITECT',priority:100,assigned_agent:'IMPERIAL-ADRIAN-WALKER-NCA-001',runtime_domain:'DEVELOPMENT',payload:{test:'safe-command-bus'}});\nlet conflictDenied=false; try{await submitCommand({command_id:id,mission_id:mission,actor:'ARCHITECT',payload:{test:'different'}});}catch(e){conflictDenied=String((e as Error).message)==='IDEMPOTENCY_CONFLICT';}\nlet authorityDenied=false; try{await submitCommand({command_id:`${id}-X`,mission_id:mission,actor:'UNKNOWN',payload:{}});}catch(e){authorityDenied=String((e as Error).message)==='AUTHORITY_DENIED';}\nawait transitionCommand(id,'POLICY_ALLOWED','GUARDIAN',{decision:'ALLOW',financial_authority:false});\nawait transitionCommand(id,'ASSIGNED','HANTER',{assigned_agent:'IMPERIAL-ADRIAN-WALKER-NCA-001'});\nawait transitionCommand(id,'EXECUTING','IMPERIAL-ADRIAN-WALKER-NCA-001',{execution:'SIMULATED_SAFE_TEST'});\nawait transitionCommand(id,'VERIFYING','IMPERIAL-LUCAS-BENNETT-NCA-002',{review:'INDEPENDENT_TEST_PATH'});\nawait transitionCommand(id,'COMPLETED','IMPERIAL-LUCAS-BENNETT-NCA-002',{result:'PASS',external_side_effects:false});\nlet invalidTransitionDenied=false; try{await transitionCommand(id,'EXECUTING','HANTER',{});}catch(e){invalidTransitionDenied=String((e as Error).message).startsWith('INVALID_TRANSITION_');}\nconst status=await commandStatus(id);\nconsole.log(JSON.stringify({status:'PASS',first_received:first.state==='RECEIVED',duplicate_suppressed:duplicate.duplicate===true,idempotency_conflict_denied:conflictDenied,unauthorized_actor_denied:authorityDenied,final_state:(status as any)?.state,invalid_terminal_transition_denied:invalidTransitionDenied,mission_id:mission,truth_boundary:'Command bus state machine/idempotency/audit path runtime-tested locally; external NCA tool execution not claimed.'}));\n",[145],"c248b291-25c7-4a77-ba0b-0b333cbab467","README.md","01a04c05-88bb-772a-8ca1-8d527cb36132",1,["D",1787981826165],"# React + Hono Starter\n\nA minimal starter template for building client-side React apps with a Hono\nbackend on Val Town. Click **Remix** to get your own copy.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| [`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter) | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| **[`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter)** *(you're here)* | Client-side React SPA with a Hono API backend. |\n\n**Want to build UI?** Start writing React components in\n[`frontend/components/`](/frontend/components/). Import them into `App.tsx` and\nyou're good to go. Styling is [Twind](https://twind.style/) — just use Tailwind\nutility classes, zero config.\n\n**Want to add an API?** Add routes in [`index.ts`](/index.ts) (there's a\ncommented-out example). Fetch them from your React components.\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Hono -->|serves| HTML[\"root.tsx\"]\n HTML -->|loads| Entry[\"index.tsx\"]\n Entry -->|renders| App[\"App.tsx\"]\n App -->|renders| Counter[\"Counter.tsx\"]\n```\n\n## File structure\n\n```\nindex.ts ← Hono backend (serves frontend + API routes)\nfrontend/\n root.tsx ← HTML shell (stamps immutable asset URLs)\n index.tsx ← React entrypoint (mounts )\n favicon.svg ← App icon\n components/\n App.tsx ← Root component (layout + view source link)\n Counter.tsx ← Example component with state\n```\n\n## How it works\n\n1. **`index.ts`** is the HTTP entrypoint — a Hono server that serves the\n frontend and any API routes you add.\n2. **`frontend/root.tsx`** is the HTML shell — it loads Twind and stamps\n immutable asset URLs for the favicon and React entrypoint.\n3. **`frontend/index.tsx`** mounts the React app.\n4. **`frontend/components/App.tsx`** is the root layout — add new components\n alongside it.\n5. **`frontend/components/Counter.tsx`** is an example stateful component —\n replace it with your own!\n\n## Next steps\n\n- Add API routes in `index.ts`\n- Add new components in `frontend/components/`\n- Add a SQLite database — see the\n [React Hono Example](https://www.val.town/x/stevekrouse/reactHonoExample) for\n a full-stack example with database, queries, and shared types\n\nTemplate updates and upgrade paths for existing remixes: [CHANGELOG.md](/CHANGELOG.md)\n",[153],"533e079a-a773-4761-bff1-01388a09ecfe","CHANGELOG.md","01a04c05-88bb-772a-8ca1-885b686d698f",["D",1787981826165],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n

Diff · v42