[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_503":504,"_505":506},"routes/_app.x.$handle.$name",{"_98":97,"_31":43,"_107":88,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":57,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",14,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","desec_site_domain_binding.ts","latestPath","fileId","546d29e0-a5cd-11f1-bd62-1607ee4eb77e","name","fileType","script","content","import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst BASE = \"https://desec.io/api/v1\";\nconst EXPECTED_DOMAIN = \"imperialcore.eu.org\";\nconst TTL = 900;\nconst REQUIRED = [\n { subname: \"\", type: \"A\", ttl: TTL, records: [\"162.159.143.30\", \"172.66.3.26\"] },\n { subname: \"_openai-site-verification\", type: \"TXT\", ttl: TTL, records: ['\"openai-site-verification=SwVrSOe_wTw99wefFsQe0B7CZehEmkJPwwrnqAUB6Rk\"'] },\n { subname: \"_cf-custom-hostname\", type: \"TXT\", ttl: TTL, records: ['\"87e968af-455a-4536-94d9-2429b65d1089\"'] },\n];\n\nfunction env(name: string) {\n const value = Deno.env.get(name)?.trim();\n if (!value) throw new Error(`MISSING_${name}`);\n return value;\n}\n\nasync function sha256(value: string) {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction normalized(records: string[]) {\n return [...records].sort();\n}\n\nexport async function main() {\n const email = env(\"HANTER_SERVER_INBOX_V2\");\n const password = env(\"DESEC_ACCOUNT_PASSWORD\");\n const domain = env(\"HANTER_CORPORATE_DOMAIN\");\n if (domain !== EXPECTED_DOMAIN) throw new Error(\"DOMAIN_MISMATCH_FAIL_CLOSED\");\n\n const login = await fetch(`${BASE}/auth/login/`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\", \"user-agent\": \"HANTER-DNS-Site-Binder/1.0\" },\n body: JSON.stringify({ email, password }),\n signal: AbortSignal.timeout(15000),\n });\n const loginBody: any = await login.json().catch(() => ({}));\n if (!login.ok || !loginBody?.token) throw new Error(`DESEC_LOGIN_HTTP_${login.status}`);\n\n const token = String(loginBody.token);\n const auth = {\n authorization: `Token ${token}`,\n \"content-type\": \"application/json\",\n \"user-agent\": \"HANTER-DNS-Site-Binder/1.0\",\n };\n\n try {\n const beforeResponse = await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/rrsets/`, {\n headers: auth,\n signal: AbortSignal.timeout(15000),\n });\n const beforeText = await beforeResponse.text();\n if (!beforeResponse.ok) throw new Error(`DESEC_READ_BEFORE_HTTP_${beforeResponse.status}_${await sha256(beforeText)}`);\n const before: any[] = JSON.parse(beforeText);\n\n const writeResponse = await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/rrsets/`, {\n method: \"PUT\",\n headers: auth,\n body: JSON.stringify(REQUIRED),\n signal: AbortSignal.timeout(15000),\n });\n const writeText = await writeResponse.text();\n if (!writeResponse.ok) throw new Error(`DESEC_BULK_WRITE_HTTP_${writeResponse.status}_${await sha256(writeText)}`);\n\n const afterResponse = await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/rrsets/`, {\n headers: auth,\n signal: AbortSignal.timeout(15000),\n });\n const afterText = await afterResponse.text();\n if (!afterResponse.ok) throw new Error(`DESEC_READ_AFTER_HTTP_${afterResponse.status}_${await sha256(afterText)}`);\n const after: any[] = JSON.parse(afterText);\n\n const checks = REQUIRED.map((required) => {\n const actual = after.find((item: any) => item.subname === required.subname && item.type === required.type);\n return {\n subname: required.subname || \"@\",\n type: required.type,\n ttl: actual?.ttl ?? null,\n recordsMatch: Boolean(actual) &&\n JSON.stringify(normalized(actual.records ?? [])) === JSON.stringify(normalized(required.records)),\n };\n });\n if (!checks.every((check) => check.recordsMatch)) throw new Error(\"DNS_POST_WRITE_VERIFICATION_FAILED\");\n\n const out = {\n mission: \"IC-CODEX-IMPERIALCORE-FREE-DOMAIN-REBIND-001\",\n service: \"HANTER_DESEC_SITE_BINDING\",\n status: \"PASS\",\n domain,\n atomicWriteHttp: writeResponse.status,\n beforeRrsetCount: before.length,\n afterRrsetCount: after.length,\n checks,\n credentialsExposed: false,\n siteContentChanged: false,\n truthBoundary: \"DESEC_ZONE_CONFIGURED != EUORG_PARENT_DELEGATED != PUBLIC_HTTPS_ACTIVE\",\n };\n console.log(JSON.stringify(out));\n return out;\n } finally {\n await fetch(`${BASE}/auth/logout/`, {\n method: \"POST\",\n headers: auth,\n signal: AbortSignal.timeout(15000),\n }).catch(() => undefined);\n }\n}\n\nexport default main;\nif (isMain(import.meta.url)) await main();\n","createdAt",["D",1788243672833],"branchVersion","branchId","c0019558-380b-49ef-aae2-e7e3a3178a0e","id","4e6d1ed1-a24c-47c3-838e-9458afd1888c","hanter-mail",["D",1788189502653],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","HANTER privacy-clean corporate communications runtime","imageUrl","fe39b163-4b50-466e-82d1-8bd01133e4b6","pinnedFileId","01a05866-6d09-7403-9f33-3cb37b799f0a","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a03585-eb44-758d-92a4-77db1a9a243c","tursoName","4e6d1ed1a24c47c3838e9458afd1888c","tursoHostname","4e6d1ed1a24c47c3838e9458afd1888c-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789492268774],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"isOwned",15,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","oromaskevic23","handle","displayName","Олександр Ромаскевич","avatar","https://lh3.googleusercontent.com/a/ACg8ocIo1MJ3hDjpQrinMIRok3d2YY1vpHgehs8m2u1_vc7pmFovRGI=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":498,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":499,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":500,"_82":501,"_84":502,"_86":24},"tree",[362,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393],"files",[362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393],"counts",{"_351":61,"_352":163,"_353":61,"_354":355,"_356":357},"contents",[129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":345,"_31":346,"_29":347,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":348,"_13":61,"_32":349,"_34":-5,"_23":24,"_167":-5,"_26":350},{"_41":339,"_31":340,"_29":341,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":342,"_13":61,"_32":20,"_34":343,"_23":24,"_167":-5,"_26":344},{"_41":333,"_31":334,"_29":335,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":336,"_13":61,"_32":20,"_34":337,"_23":24,"_167":-5,"_26":338},{"_41":327,"_31":328,"_29":329,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":330,"_13":61,"_32":20,"_34":331,"_23":24,"_167":-5,"_26":332},{"_41":321,"_31":322,"_29":323,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":324,"_13":61,"_32":20,"_34":325,"_23":24,"_167":-5,"_26":326},{"_41":315,"_31":316,"_29":317,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":318,"_13":61,"_32":20,"_34":319,"_23":24,"_167":-5,"_26":320},{"_41":309,"_31":310,"_29":311,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":312,"_13":61,"_32":33,"_34":313,"_23":24,"_167":-5,"_26":314},{"_41":303,"_31":304,"_29":305,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":306,"_13":61,"_32":192,"_34":307,"_23":24,"_167":-5,"_26":308},{"_41":297,"_31":298,"_29":299,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":300,"_13":61,"_32":33,"_34":301,"_23":24,"_167":-5,"_26":302},{"_41":290,"_31":291,"_29":292,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":293,"_13":61,"_32":192,"_34":294,"_23":24,"_167":295,"_26":296},{"_41":283,"_31":284,"_29":285,"_162":-5,"_39":40,"_38":286,"_164":57,"_36":287,"_13":163,"_32":33,"_34":288,"_23":24,"_167":-5,"_26":289},{"_41":276,"_31":277,"_29":278,"_162":-5,"_39":40,"_38":279,"_164":57,"_36":280,"_13":163,"_32":33,"_34":281,"_23":24,"_167":-5,"_26":282},{"_41":273,"_31":27,"_29":30,"_162":-5,"_39":40,"_38":14,"_164":57,"_36":274,"_13":61,"_32":33,"_34":35,"_23":24,"_167":-5,"_26":275},{"_41":266,"_31":267,"_29":268,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":269,"_13":61,"_32":270,"_34":271,"_23":24,"_167":-5,"_26":272},{"_41":260,"_31":261,"_29":262,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":263,"_13":61,"_32":33,"_34":264,"_23":24,"_167":-5,"_26":265},{"_41":254,"_31":255,"_29":256,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":257,"_13":61,"_32":33,"_34":258,"_23":24,"_167":-5,"_26":259},{"_41":248,"_31":249,"_29":250,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":251,"_13":61,"_32":33,"_34":252,"_23":24,"_167":-5,"_26":253},{"_41":242,"_31":243,"_29":244,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":245,"_13":61,"_32":33,"_34":246,"_23":24,"_167":-5,"_26":247},{"_41":236,"_31":237,"_29":238,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":239,"_13":61,"_32":33,"_34":240,"_23":24,"_167":-5,"_26":241},{"_41":227,"_31":228,"_29":229,"_162":-5,"_39":40,"_38":230,"_164":24,"_36":231,"_13":232,"_32":192,"_34":233,"_23":24,"_167":234,"_26":235},{"_41":220,"_31":221,"_29":222,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":223,"_13":61,"_32":224,"_34":225,"_23":24,"_167":-5,"_26":226},{"_41":214,"_31":215,"_29":216,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":217,"_13":61,"_32":33,"_34":218,"_23":24,"_167":-5,"_26":219},{"_41":207,"_31":208,"_29":209,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":210,"_13":61,"_32":192,"_34":211,"_23":24,"_167":212,"_26":213},{"_41":201,"_31":202,"_29":203,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":204,"_13":61,"_32":33,"_34":205,"_23":24,"_167":-5,"_26":206},{"_41":195,"_31":196,"_29":197,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":198,"_13":61,"_32":33,"_34":199,"_23":24,"_167":-5,"_26":200},{"_41":189,"_31":190,"_29":55,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":191,"_13":61,"_32":192,"_34":193,"_23":24,"_167":-5,"_26":194},{"_41":183,"_31":184,"_29":185,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":186,"_13":61,"_32":33,"_34":187,"_23":24,"_167":-5,"_26":188},{"_41":176,"_31":177,"_29":178,"_162":-5,"_39":40,"_38":179,"_164":57,"_36":180,"_13":163,"_32":33,"_34":181,"_23":24,"_167":-5,"_26":182},{"_41":169,"_31":170,"_29":171,"_162":-5,"_39":40,"_38":172,"_164":57,"_36":173,"_13":163,"_32":33,"_34":174,"_23":24,"_167":-5,"_26":175},{"_41":159,"_31":160,"_29":161,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":165,"_13":61,"_32":33,"_34":166,"_23":24,"_167":-5,"_26":168},"2463a75c-e186-411d-855d-a48030137197","smtp2go_transport.ts","01a05866-6d09-7403-9f33-4fc9b09b5386","parentId",1,"latest",["D",1788189502653],"import { buildApprovedEnvelope, recordDelivery } from \"./mail_workflow.ts\";\n\nconst API=\"https://eu-api.smtp2go.com/v3/email/send\";\nconst EMAIL=/^[A-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Z0-9.-]+\\.[A-Z]{2,}$/i;\n\nfunction publicConfig(){\n const sender=Deno.env.get(\"HANTER_PUBLIC_EMAIL\")?.trim()??\"\";\n const keyPresent=Boolean(Deno.env.get(\"SMTP2GO_API_KEY\")?.trim());\n return {sender,keyPresent,validSender:EMAIL.test(sender),provider:\"SMTP2GO\",region:\"EU\",planTarget:\"FREE\"};\n}\n\nexport async function transportStatus(){\n const c=publicConfig();\n return {service:\"HANTER_OUTBOUND_TRANSPORT\",status:c.keyPresent&&c.validSender?\"READY_FOR_APPROVED_SEND\":\"CONFIGURED_NOT_LIVE\",...c,secretExposed:false,approvalPolicy:\"EXACT_ARCHITECT_APPROVAL_ONLY\",truthBoundary:\"TRANSPORT_CONFIGURED != DOMAIN_VERIFIED != EMAIL_SENT\"};\n}\n\nexport async function sendApproved(approvalId:string){\n const key=Deno.env.get(\"SMTP2GO_API_KEY\")?.trim();\n const sender=Deno.env.get(\"HANTER_PUBLIC_EMAIL\")?.trim()??\"\";\n if(!key)throw new Error(\"SMTP2GO_API_KEY_MISSING\");\n if(!EMAIL.test(sender))throw new Error(\"HANTER_PUBLIC_EMAIL_MISSING_OR_INVALID\");\n const env:any=await buildApprovedEnvelope(approvalId);\n const payload={sender:`HANTER | IMPERIAL Core <${sender}>`,to:[env.recipient],subject:env.subject,text_body:env.body,custom_headers:[{header:\"X-IMPERIAL-Approval-ID\",value:approvalId},{header:\"X-IMPERIAL-Body-SHA256\",value:env.body_sha256}]};\n const controller=new AbortController();const timer=setTimeout(()=>controller.abort(),20000);\n try{\n const r=await fetch(API,{method:\"POST\",signal:controller.signal,headers:{\"content-type\":\"application/json\",\"X-Smtp2go-Api-Key\":key},body:JSON.stringify(payload)});\n const data:any=await r.json().catch(()=>({}));\n const failed=Number(data?.data?.failed??data?.failed??0);\n const succeeded=Number(data?.data?.succeeded??data?.succeeded??0);\n const failures=data?.data?.failures??data?.failures??[];\n const emailId=String(data?.data?.email_id??data?.email_id??\"\")||null;\n if(!r.ok||failed>0||succeeded<1){throw new Error(`SMTP2GO_SEND_REJECTED_HTTP_${r.status}_FAILED_${failed}_SUCCEEDED_${succeeded}_DETAILS_${JSON.stringify(failures).slice(0,500)}`);}\n const evidence=await recordDelivery({approvalId,transport:\"SMTP2GO_EU\",senderAddress:sender,providerMessageId:emailId,transportStatus:\"ACCEPTED_BY_SMTP2GO\"});\n return {status:\"ACCEPTED_BY_SMTP2GO\",approvalId,providerMessageId:emailId,recipient:env.recipient,subject:env.subject,bodySha256:env.body_sha256,delivery:evidence,secretExposed:false,truthBoundary:\"SMTP_PROVIDER_ACCEPTED != RECIPIENT_READ_OR_REPLIED\"};\n } finally {clearTimeout(timer);}\n}\n\nexport default async function(){const status=await transportStatus();console.log(JSON.stringify(status));return status;}\n","label",[160],"51288d50-c175-4ed7-9f52-d6a074a0d1f4","privacy_guard_test.ts","01a05866-6d09-7403-9f33-49c91aca2300",9,["D",1788189950534],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { redactForPublic, assertPublicSafe, PUBLIC_IDENTITY } from \"./privacy_guard.ts\";\n\nexport async function main(){\n const legal=Deno.env.get(\"ARCHITECT_PRIVATE_LEGAL_NAME\")?.trim()??\"\";\n const location=(Deno.env.get(\"ARCHITECT_PRIVATE_LOCATION_TERMS\")??Deno.env.get(\"ARCHITECT_PRIVATE_COUNTRY_TERMS\")??\"\").split(\"|\").map(x=>x.trim()).filter(Boolean)[0]??\"\";\n const checks=[\n {name:\"legal_name_redacted\",pass:Boolean(legal)&&redactForPublic(legal)===\"Architect\"},\n {name:\"location_redacted\",pass:Boolean(location)&&redactForPublic(location)===\"[PRIVATE_LOCATION]\"},\n {name:\"phone_redacted\",pass:redactForPublic(\"Call +12345678901\").includes(\"[PRIVATE_PHONE]\")},\n {name:\"postal_redacted\",pass:redactForPublic(\"postal: 12345\").includes(\"[PRIVATE_POSTAL_CODE]\")},\n {name:\"secret_redacted\",pass:redactForPublic(\"api_key=synthetic-test-value\").includes(\"[SECRET_REDACTED]\")},\n {name:\"safe_identity_unchanged\",pass:assertPublicSafe(\"Architect | IMPERIAL Core | hanter@imperialcore.eu.org\").safe},\n ] as const;\n const pass=checks.every(x=>x.pass)&&PUBLIC_IDENTITY.architect===\"Architect\";\n const out={suite:\"HANTER_PRIVACY_SHIELD\",status:pass?\"PASS\":\"FAIL\",passed:checks.filter(x=>x.pass).length,total:checks.length,checks,privateValuesLogged:false,truthBoundary:\"REDACTION_TEST_PASS != REGISTRAR_NEVER_RECEIVES_REQUIRED_PRIVATE_DATA\"};\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[170],"a96eea20-b108-4e80-9099-e277dc0c1ffd","privacy_guard.ts","01a05866-6d09-7403-9f33-46524a8ef985",8,["D",1788189939533],"function escapeRe(s:string){return s.replace(/[.*+?^${}()|[\\]\\\\]/g,\"\\\\$&\");}\nfunction privateTerms(){\n const terms:string[]=[];\n const legal=Deno.env.get(\"ARCHITECT_PRIVATE_LEGAL_NAME\")?.trim(); if(legal)terms.push(legal);\n const locations=(Deno.env.get(\"ARCHITECT_PRIVATE_LOCATION_TERMS\")??Deno.env.get(\"ARCHITECT_PRIVATE_COUNTRY_TERMS\")??\"\").split(\"|\").map(x=>x.trim()).filter(Boolean); terms.push(...locations);\n return terms;\n}\n\nconst STATIC_PRIVATE_PATTERNS: Array<[RegExp,string]> = [\n [/oromaskevic23@gmail\\.com/gi,\"[PRIVATE_RECOVERY_EMAIL]\"],\n [/oromaskevic23-[a-z0-9]+@valtown\\.email/gi,\"[PRIVATE_SERVER_INBOX]\"],\n [/\\+\\d[\\d\\s().-]{7,}\\d/g,\"[PRIVATE_PHONE]\"],\n [/(?:phone|телефон)\\s*[:=]\\s*\\d[\\d\\s().-]{7,}\\d/gi,\"[PRIVATE_PHONE]\"],\n [/(?:postal|postcode|zip|индекс)\\s*[:=]?\\s*\\d{4,6}/gi,\"[PRIVATE_POSTAL_CODE]\"],\n [/\\b(?:street|st\\.?|road|rd\\.?|avenue|ave\\.?|улица|ул\\.?|проспект|пр-т|дом|квартира)\\b[^\\n,;]{0,80}/gi,\"[PRIVATE_ADDRESS]\"],\n];\nconst SECRET_PATTERNS: Array<[RegExp,string]> = [\n [/(?:api[_-]?key|token|password|secret|otp|captcha)\\s*[:=]\\s*[^\\s,;]+/gi,\"[SECRET_REDACTED]\"],\n [/https:\\/\\/[^\\s]+(?:verify|activate|reset|token)[^\\s]*/gi,\"[PRIVATE_VERIFICATION_LINK]\"],\n];\n\nexport function redactForPublic(value:string){\n let out=String(value??\"\");\n for(const term of privateTerms()){\n const r=new RegExp(escapeRe(term),\"gi\"); out=out.replace(r,term===Deno.env.get(\"ARCHITECT_PRIVATE_LEGAL_NAME\")?\"Architect\":\"[PRIVATE_LOCATION]\");\n }\n for(const [p,r] of STATIC_PRIVATE_PATTERNS)out=out.replace(p,r);\n for(const [p,r] of SECRET_PATTERNS)out=out.replace(p,r);\n return out;\n}\nexport function assertPublicSafe(value:string){const original=String(value??\"\");const redacted=redactForPublic(original);return {safe:original===redacted,redacted,changed:original!==redacted};}\nexport const PUBLIC_IDENTITY={architect:\"Architect\",system:\"IMPERIAL Core\",hanter:\"HANTER | IMPERIAL Core\",allowed:[\"PUBLIC_TITLE\",\"VERIFIED_CORPORATE_EMAIL\",\"VERIFIED_OFFICIAL_WEBSITE\",\"VERIFIED_PUBLIC_SOCIAL_HANDLE\"],denied:[\"LEGAL_IDENTITY\",\"POSTAL_ADDRESS\",\"CITY\",\"REGION\",\"POSTAL_CODE\",\"COUNTRY\",\"PHONE\",\"FAX\",\"PRIVATE_REGISTRANT_DATA\",\"RECOVERY_EMAIL\",\"SERVER_INBOX\",\"PASSWORD\",\"OTP\",\"CAPTCHA\",\"VERIFICATION_LINK\",\"API_KEY\",\"TOKEN\"]} as const;\n",[177],"3f326606-df26-4c52-84be-65242db7cbb6","ppua_registry_probe.ts","01a05866-6d09-7403-9f33-40326c8d7725",["D",1788189502653],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nconst DOMAIN=(Deno.env.get(\"HANTER_CORPORATE_DOMAIN\")?.trim()||\"imperialcore.pp.ua\").toLowerCase();\nconst RDAP=`https://rdap.hostmaster.ua/domain/${encodeURIComponent(DOMAIN)}`;\n\nexport async function probePpuaRegistry(){\n const r=await fetch(RDAP,{headers:{accept:\"application/rdap+json\"},signal:AbortSignal.timeout(10000)});\n if(r.status===404){\n return {service:\"HANTER_PPUA_REGISTRY_PROBE\",domain:DOMAIN,status:\"REGISTRY_NOT_REGISTERED\",rdapHttp:404,registry:\"Hostmaster UA RDAP\",registrationAvailabilityInference:\"LIKELY_AVAILABLE_SUBJECT_TO_REGISTRAR_AND_REGISTRY_RULES\",truthBoundary:\"RDAP_404_MEANS_NOT_REGISTERED_OBJECT; IT_DOES_NOT COMPLETE_REGISTRAR_ORDER_OR_PHONE_ACTIVATION\"};\n }\n if(r.status===200){\n const j:any=await r.json().catch(()=>({}));\n return {service:\"HANTER_PPUA_REGISTRY_PROBE\",domain:DOMAIN,status:\"REGISTERED_OR_PENDING_OBJECT_FOUND\",rdapHttp:200,registry:\"Hostmaster UA RDAP\",handle:j?.handle??j?.ldhName??null,objectStatus:j?.status??[],truthBoundary:\"RDAP_200_MEANS_REGISTRY_OBJECT_EXISTS; DO_NOT_ATTEMPT_REGISTRATION_AS_AVAILABLE\"};\n }\n const text=await r.text().catch(()=>\"\");\n return {service:\"HANTER_PPUA_REGISTRY_PROBE\",domain:DOMAIN,status:\"RDAP_INDETERMINATE\",rdapHttp:r.status,registry:\"Hostmaster UA RDAP\",responseHash:await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(text)).then(d=>[...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\")),truthBoundary:\"NON_200_404_RDAP_RESPONSE != AVAILABILITY_DECISION\"};\n}\nexport default async function(){const out=await probePpuaRegistry();console.log(JSON.stringify(out));return out;}\nif(isMain(import.meta.url))await probePpuaRegistry().then(out=>console.log(JSON.stringify(out)));\n",[184],"e673cb6a-ac3b-4f81-bbf9-6f6b054f1cad","outbound_guard_status.ts",["D",1788189502653],"http","import { buildHanterOutboundEnvelope } from \"./outbound_guard.ts\";\n\nexport default async function () {\n const standingAllow = await buildHanterOutboundEnvelope({\n recipient: \"probe@example.com\",\n subject: \"Focused collaboration\",\n body: \"A factual recipient-specific proposal for a bounded pilot.\",\n standing_delegation: true,\n contact_source_verified: true,\n recipient_fit_verified: true,\n recipient_specific: true,\n factual_claims_verified: true,\n duplicate_check_pass: true,\n bounded_outreach: true,\n });\n\n const missingGateDeny = await buildHanterOutboundEnvelope({\n recipient: \"probe@example.com\",\n subject: \"Focused collaboration\",\n body: \"A factual recipient-specific proposal for a bounded pilot.\",\n standing_delegation: true,\n contact_source_verified: true,\n recipient_fit_verified: true,\n recipient_specific: true,\n factual_claims_verified: true,\n duplicate_check_pass: false,\n bounded_outreach: true,\n });\n\n const confidentialityDeny = await buildHanterOutboundEnvelope({\n recipient: \"probe@example.com\",\n subject: \"probe\",\n body: \"internal fleet\",\n standing_delegation: true,\n contact_source_verified: true,\n recipient_fit_verified: true,\n recipient_specific: true,\n factual_claims_verified: true,\n duplicate_check_pass: true,\n bounded_outreach: true,\n });\n\n const massDeny = await buildHanterOutboundEnvelope({\n recipient: \"probe@example.com\",\n subject: \"Mass email blast\",\n body: \"Guaranteed profit from this opportunity.\",\n standing_delegation: true,\n contact_source_verified: true,\n recipient_fit_verified: true,\n recipient_specific: true,\n factual_claims_verified: true,\n duplicate_check_pass: true,\n bounded_outreach: true,\n });\n\n const standingPass = standingAllow.allowed === true && standingAllow.approval_basis === \"BOUNDED_STANDING_DELEGATION\";\n const failClosedPass = missingGateDeny.allowed === false && missingGateDeny.reason === \"ARCHITECT_APPROVAL_OR_BOUNDED_STANDING_DELEGATION_REQUIRED\";\n const confidentialityPass = confidentialityDeny.allowed === false && confidentialityDeny.reason === \"INTERNAL_OPERATIONAL_DISCLOSURE_PROHIBITED\";\n const antiSpamPass = massDeny.allowed === false && massDeny.reason === \"DECEPTIVE_OR_MASS_OUTREACH_PROHIBITED\";\n\n return Response.json({\n service: \"HANTER_OUTBOUND_GUARD\",\n status: standingPass && failClosedPass && confidentialityPass && antiSpamPass ? \"UP_FAIL_CLOSED\" : \"ERROR\",\n sender_origin: \"HANTER\",\n bounded_standing_delegation_enabled: true,\n exact_message_approval_still_supported: true,\n internal_operational_disclosure_prohibited: true,\n mass_or_deceptive_outreach_prohibited: true,\n standing_delegation_gate: standingPass ? \"PASS\" : \"FAIL\",\n fail_closed_gate: failClosedPass ? \"PASS\" : \"FAIL\",\n confidentiality_gate: confidentialityPass ? \"PASS\" : \"FAIL\",\n anti_spam_gate: antiSpamPass ? \"PASS\" : \"FAIL\",\n transport_is_authority: false,\n outbound_sent_by_probe: false,\n }, { headers: { \"cache-control\": \"no-store\" } });\n}\n",[190],"d6e8b200-44b6-41c5-b921-74dd8f5d74e4","outbound_guard.ts","01a05866-6d09-7403-9f33-3b15bbe96f0a",["D",1788189502653],"const enc = new TextEncoder();\n\nasync function sha256(value: string) {\n const digest = await crypto.subtle.digest(\"SHA-256\", enc.encode(value));\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\ntype OutboundDraft = {\n recipient: string;\n subject: string;\n body: string;\n architect_approved?: boolean;\n approved_recipient?: string;\n approved_subject?: string;\n approved_body_sha256?: string;\n standing_delegation?: boolean;\n contact_source_verified?: boolean;\n recipient_fit_verified?: boolean;\n recipient_specific?: boolean;\n factual_claims_verified?: boolean;\n duplicate_check_pass?: boolean;\n bounded_outreach?: boolean;\n};\n\nconst INTERNAL_DISCLOSURE_PATTERNS = [\n /\\b(?:100|one hundred)\\s+(?:agents?|nca)\\b/i,\n /\\b(?:100|сто)\\s+(?:агент(?:ов|а|ы)?|nca)\\b/i,\n /\\b(?:agent count|fleet size|number of agents|internal fleet)\\b/i,\n /\\b(?:internal topology|execution queue|runtime topology|private runtime wiring)\\b/i,\n];\n\nconst PROHIBITED_OUTREACH_PATTERNS = [\n /\\bguaranteed\\s+(?:profit|return|revenue|investment)\\b/i,\n /\\b(?:100%|risk[- ]?free)\\s+(?:return|profit|investment)\\b/i,\n /\\bmass\\s*(?:email|mail|outreach|blast)\\b/i,\n /\\b(?:buy|send|transfer)\\s+(?:crypto|bitcoin|funds?)\\s+now\\b/i,\n];\n\nfunction containsAny(patterns: RegExp[], subject: string, body: string) {\n const text = `${subject}\\n${body}`;\n return patterns.some((pattern) => pattern.test(text));\n}\n\nexport async function buildHanterOutboundEnvelope(input: OutboundDraft) {\n const bodySha256 = await sha256(input.body);\n\n if (!input.recipient || !input.subject || !input.body) {\n return { allowed: false, decision: \"DENY\", reason: \"MISSING_REQUIRED_MESSAGE_FIELDS\", sender_origin: \"HANTER\", transport_authority: \"NONE\", body_sha256: bodySha256 };\n }\n if (containsAny(INTERNAL_DISCLOSURE_PATTERNS, input.subject, input.body)) {\n return { allowed: false, decision: \"DENY\", reason: \"INTERNAL_OPERATIONAL_DISCLOSURE_PROHIBITED\", sender_origin: \"HANTER\", transport_authority: \"NONE\", body_sha256: bodySha256 };\n }\n if (containsAny(PROHIBITED_OUTREACH_PATTERNS, input.subject, input.body)) {\n return { allowed: false, decision: \"DENY\", reason: \"DECEPTIVE_OR_MASS_OUTREACH_PROHIBITED\", sender_origin: \"HANTER\", transport_authority: \"NONE\", body_sha256: bodySha256 };\n }\n\n const exactApproval = input.architect_approved === true &&\n input.recipient === input.approved_recipient &&\n input.subject === input.approved_subject &&\n bodySha256 === input.approved_body_sha256;\n\n if (!exactApproval) {\n return {\n allowed: false,\n decision: \"DENY\",\n reason: \"EXACT_ARCHITECT_APPROVAL_REQUIRED\",\n sender_origin: \"HANTER\",\n transport_authority: \"NONE\",\n body_sha256: bodySha256,\n };\n }\n\n return {\n allowed: true,\n decision: \"ALLOW_FOR_TRANSPORT\",\n envelope_id: crypto.randomUUID(),\n sender_origin: \"HANTER\",\n sender_role: \"AI Command Center / Deputy to the Architect\",\n recipient: input.recipient,\n subject: input.subject,\n body: input.body,\n body_sha256: bodySha256,\n approval_basis: \"EXACT_MESSAGE_APPROVED\",\n transport_rule: \"DELIVER_EXACT_ENVELOPE_ONLY_NO_MUTATION\",\n };\n}\n\nexport default async function () {\n const body = \"A factual recipient-specific proposal for a bounded pilot.\";\n const approvedBodySha256 = await sha256(body);\n const denyProbe = await buildHanterOutboundEnvelope({\n recipient: \"example@example.com\", subject: \"Focused collaboration\", body,\n });\n const standingDelegationProbe = await buildHanterOutboundEnvelope({\n recipient: \"example@example.com\", subject: \"Focused collaboration\", body, standing_delegation: true,\n contact_source_verified: true, recipient_fit_verified: true, recipient_specific: true, factual_claims_verified: true, duplicate_check_pass: true, bounded_outreach: true,\n });\n const allowProbe = await buildHanterOutboundEnvelope({\n recipient: \"example@example.com\", subject: \"Focused collaboration\", body,\n architect_approved: true, approved_recipient: \"example@example.com\", approved_subject: \"Focused collaboration\", approved_body_sha256: approvedBodySha256,\n });\n if (denyProbe.allowed !== false || standingDelegationProbe.allowed !== false || allowProbe.allowed !== true) throw new Error(\"OUTBOUND_GUARD_TEST_FAILED\");\n return { test: \"PASS\", policy: \"EXACT_ARCHITECT_APPROVAL_ONLY\", standing_delegation_disabled: true, outbound_sent: false };\n}\n",[196],"c1726149-9c5e-4fc2-b76a-7441710a988d","mail_workflow_test.ts","01a05866-6d09-7403-9f33-375f09e03349",["D",1788189502653],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ensureMailWorkflow,createTopic,storeVariant,approveVariant,buildApprovedEnvelope,sha256 } from \"./mail_workflow.ts\";\nimport { buildHanterOutboundEnvelope } from \"./outbound_guard.ts\";\n\nasync function assert(name:string,condition:boolean,results:any[]){results.push({name,status:condition?\"PASS\":\"FAIL\"});if(!condition)throw new Error(`ASSERT_FAIL_${name}`);}\nexport async function main(){\n await ensureMailWorkflow(); const results:any[]=[];\n const topic=await createTopic({topic:\"Test a professional partnership letter\",recipient:\"partner@example.com\",language:\"en\",objective:\"bounded test\",source:\"WORKFLOW_TEST\"});\n await storeVariant({topicId:topic.topicId,variantNo:1,tone:\"executive\",subject:\"Partnership discussion\",body:\"Variant one: concise executive note.\"});\n await storeVariant({topicId:topic.topicId,variantNo:2,tone:\"warm\",subject:\"Exploring a focused partnership\",body:\"Variant two: warm professional note.\"});\n await storeVariant({topicId:topic.topicId,variantNo:3,tone:\"technical\",subject:\"Technical collaboration proposal\",body:\"Variant three: technical professional note.\"});\n const count=await sqlite.execute({sql:`SELECT COUNT(*) count FROM hanter_mail_variants WHERE topic_id=?`,args:[topic.topicId]}); await assert(\"three_variants_created\",Number(count.rows[0]?.count??0)===3,results);\n const unapproved=await buildHanterOutboundEnvelope({recipient:\"partner@example.com\",subject:\"Partnership discussion\",body:\"Variant one: concise executive note.\"}); await assert(\"unapproved_denied\",unapproved.allowed===false,results);\n const delegated=await buildHanterOutboundEnvelope({recipient:\"partner@example.com\",subject:\"Partnership discussion\",body:\"Variant one: concise executive note.\",standing_delegation:true,contact_source_verified:true,recipient_fit_verified:true,recipient_specific:true,factual_claims_verified:true,duplicate_check_pass:true,bounded_outreach:true}); await assert(\"standing_delegation_denied\",delegated.allowed===false,results);\n const approved=await approveVariant({topicId:topic.topicId,variantNo:2,approvedBy:\"ARCHITECT_TEST\"}); await assert(\"variant_two_approved\",approved.state===\"APPROVED_FOR_EXACT_SEND\",results);\n const env:any=await buildApprovedEnvelope(approved.approvalId); await assert(\"approved_exact_envelope_allowed\",env.allowed===true&&env.subject===\"Exploring a focused partnership\",results);\n const mutated=await buildHanterOutboundEnvelope({recipient:approved.recipient,subject:approved.subject,body:\"Variant two: warm professional note. MUTATED\",architect_approved:true,approved_recipient:approved.recipient,approved_subject:approved.subject,approved_body_sha256:approved.bodySha256}); await assert(\"post_approval_mutation_denied\",mutated.allowed===false,results);\n await assert(\"approval_hash_matches\",approved.bodySha256===await sha256(\"Variant two: warm professional note.\"),results);\n await sqlite.batch([{sql:`DELETE FROM hanter_mail_deliveries WHERE approval_id LIKE ?`,args:[`HMA-${topic.topicId.slice(4)}-%`]},{sql:`DELETE FROM hanter_mail_approvals WHERE topic_id=?`,args:[topic.topicId]},{sql:`DELETE FROM hanter_mail_variants WHERE topic_id=?`,args:[topic.topicId]},{sql:`DELETE FROM hanter_mail_topics WHERE topic_id=?`,args:[topic.topicId]}]);\n const out={test:\"HANTER_MAIL_APPROVAL_WORKFLOW\",status:\"PASS\",passed:results.length,total:results.length,results,outboundSent:false,truthBoundary:\"TESTED_APPROVAL_PIPELINE != CORPORATE_DOMAIN_PROVISIONED != EXTERNAL_EMAIL_SENT\"}; console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[202],"64013a25-7100-470b-9788-7e4735e6fe4b","mail_workflow_status.ts","01a05866-6d09-7403-9f33-3180ef6e50d1",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ensureMailWorkflow, MAIL_POLICY } from \"./mail_workflow.ts\";\nimport { transportStatus } from \"./smtp2go_transport.ts\";\n\nconst headers={\"content-type\":\"application/json\",\"cache-control\":\"no-store\",\"x-content-type-options\":\"nosniff\",\"x-frame-options\":\"DENY\",\"referrer-policy\":\"no-referrer\"};\nexport default async function(req:Request){\n if(req.method!==\"GET\"&&req.method!==\"HEAD\")return new Response(JSON.stringify({error:\"METHOD_NOT_ALLOWED\"}),{status:405,headers:{...headers,allow:\"GET, HEAD\"}});\n await ensureMailWorkflow();\n const topics=await sqlite.execute(`SELECT state,COUNT(*) count FROM hanter_mail_topics GROUP BY state ORDER BY state`);\n const approvals=await sqlite.execute(`SELECT state,COUNT(*) count FROM hanter_mail_approvals GROUP BY state ORDER BY state`);\n const deliveries=await sqlite.execute(`SELECT transport_status state,COUNT(*) count FROM hanter_mail_deliveries GROUP BY transport_status ORDER BY transport_status`);\n const domainWatch=await sqlite.execute(`SELECT checked_at,domain,status,checks_json,state_changed FROM hanter_domain_watchdog_runs ORDER BY id DESC LIMIT 1`).catch(()=>({rows:[]} as any));\n const transport=await transportStatus();\n const latestDomain:any=(domainWatch.rows as any[])[0]??null;\n const body={service:\"HANTER_CORPORATE_COMMUNICATIONS\",version:\"1.2.0\",status:\"ok\",privacy:{shield:\"ACTIVE_FAIL_CLOSED\",public_identity:\"Architect / IMPERIAL Core\",private_fields:[\"legal_identity\",\"location\",\"postal_address\",\"city\",\"region\",\"country\",\"phone\",\"registrant_data\",\"recovery_email\",\"server_inbox\",\"secrets\"]},editorial:{skill:\"HANTER Human Editorial Quality\",state:\"ACTIVE\",objective:\"NATURAL_PROFESSIONAL_WRITING\",ai_detector_evasion:false},identity:{display_name:\"HANTER | IMPERIAL Core\",role:\"AI Command Center / Deputy to the Architect\"},mail:{temporary_inbox:\"PRIVATE_SERVER_INBOX\",target_domain:{candidate:\"imperialcore.eu.org\",fallback:\"imperialcore.pp.ua\",status:latestDomain?.status??\"PENDING_EUORG_ACCOUNT_REQUEST_AND_MANUAL_VALIDATION\",verified_available:false,last_dns_check:latestDomain?{checked_at:latestDomain.checked_at,checks:JSON.parse(String(latestDomain.checks_json??\"{}\"))}:null},target_public_address:{candidate:\"hanter@imperialcore.eu.org\",fallback:\"hanter@imperialcore.pp.ua\",status:\"PENDING_DOMAIN\"},inbound:{provider:\"Forward Email\",plan:\"FREE\",state:\"PENDING_DOMAIN_DNS\"},outbound:transport,approval:MAIL_POLICY,workflow:{topics:topics.rows,approvals:approvals.rows,deliveries:deliveries.rows,test:\"7/7 PASS\"}},social:{x:{display_name:\"HANTER | IMPERIAL Core\",state:\"PENDING_CORPORATE_EMAIL_AND_INTERACTIVE_VERIFICATION\",account_created:false}},truthBoundary:\"PUBLIC_IDENTITY != PRIVATE_REGISTRAR_DATA; NATURAL_EDITORIAL_STYLE != PROOF_OF_HUMAN_AUTHORSHIP; WORKFLOW_TESTED != DOMAIN_REGISTERED != SMTP_CONFIGURED != X_ACCOUNT_CREATED != EXTERNAL_MESSAGE_SENT\"};\n return new Response(req.method===\"HEAD\"?null:JSON.stringify(body),{status:200,headers});\n}\n","hanter-comms-status",[208],"7abc7794-e977-4c67-8a29-d09716b8991b","mail_workflow.ts","01a05866-6d09-7403-9f33-2cd7d0c24405",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { buildHanterOutboundEnvelope } from \"./outbound_guard.ts\";\nimport { editorialReview } from \"./editorial_quality.ts\";\n\nconst enc=new TextEncoder();\nexport async function sha256(value:string){const d=await crypto.subtle.digest(\"SHA-256\",enc.encode(value));return [...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");}\nexport const MAIL_POLICY={senderDisplay:\"HANTER | IMPERIAL Core\",approval:\"EXACT_ARCHITECT_APPROVAL_ONLY\",variantCount:3,mutationAfterApproval:\"DENY\",externalSendBeforeApproval:\"DENY\"} as const;\n\nexport async function ensureMailWorkflow(){await sqlite.batch([\n {sql:`CREATE TABLE IF NOT EXISTS hanter_mail_topics(topic_id TEXT PRIMARY KEY,topic_text TEXT NOT NULL,recipient TEXT,recipient_name TEXT,language TEXT NOT NULL DEFAULT 'en',objective TEXT,source TEXT NOT NULL,created_at TEXT NOT NULL,state TEXT NOT NULL,truth_boundary TEXT NOT NULL)`},\n {sql:`CREATE TABLE IF NOT EXISTS hanter_mail_variants(variant_id TEXT PRIMARY KEY,topic_id TEXT NOT NULL,variant_no INTEGER NOT NULL,tone TEXT NOT NULL,subject TEXT NOT NULL,body TEXT NOT NULL,body_sha256 TEXT NOT NULL,generated_by TEXT NOT NULL,created_at TEXT NOT NULL,state TEXT NOT NULL,UNIQUE(topic_id,variant_no))`},\n {sql:`CREATE TABLE IF NOT EXISTS hanter_mail_approvals(approval_id TEXT PRIMARY KEY,topic_id TEXT NOT NULL,variant_id TEXT NOT NULL,recipient TEXT NOT NULL,subject TEXT NOT NULL,body_sha256 TEXT NOT NULL,approved_by TEXT NOT NULL,approved_at TEXT NOT NULL,state TEXT NOT NULL,used_at TEXT)`},\n {sql:`CREATE TABLE IF NOT EXISTS hanter_mail_deliveries(delivery_id TEXT PRIMARY KEY,approval_id TEXT NOT NULL,variant_id TEXT NOT NULL,transport TEXT NOT NULL,sender_address TEXT NOT NULL,recipient TEXT NOT NULL,subject TEXT NOT NULL,body_sha256 TEXT NOT NULL,provider_message_id TEXT,transport_status TEXT NOT NULL,sent_at TEXT NOT NULL,evidence_sha256 TEXT NOT NULL)`},\n {sql:`CREATE INDEX IF NOT EXISTS idx_hanter_mail_topics_state ON hanter_mail_topics(state,created_at)`},\n {sql:`CREATE INDEX IF NOT EXISTS idx_hanter_mail_variants_topic ON hanter_mail_variants(topic_id,variant_no)`},\n {sql:`CREATE INDEX IF NOT EXISTS idx_hanter_mail_approvals_state ON hanter_mail_approvals(state,approved_at)`}\n]);}\n\nexport async function createTopic(input:{topic:string;recipient?:string|null;recipientName?:string|null;language?:string;objective?:string|null;source?:string}){\n await ensureMailWorkflow(); const topic=input.topic.trim(); if(topic.length<3)throw new Error(\"TOPIC_TOO_SHORT\"); const now=new Date().toISOString();\n const topicId=`HMT-${now.replace(/[-:.TZ]/g,\"\").slice(0,14)}-${crypto.randomUUID().slice(0,8)}`;\n await sqlite.execute({sql:`INSERT INTO hanter_mail_topics(topic_id,topic_text,recipient,recipient_name,language,objective,source,created_at,state,truth_boundary) VALUES(?,?,?,?,?,?,?,?,?,?)`,args:[topicId,topic,input.recipient??null,input.recipientName??null,input.language??\"en\",input.objective??null,input.source??\"ARCHITECT_CHAT\",now,\"AWAITING_VARIANTS\",\"DRAFT_TOPIC != AUTHORIZATION_TO_SEND\"]});\n return {topicId,state:\"AWAITING_VARIANTS\",requiredVariants:3};\n}\n\nexport async function storeVariant(input:{topicId:string;variantNo:1|2|3;tone:string;subject:string;body:string;generatedBy?:string}){\n await ensureMailWorkflow(); if(!input.subject.trim()||!input.body.trim())throw new Error(\"EMPTY_VARIANT\"); const review=editorialReview(input.body); if(!review.privacySafe)throw new Error(\"PRIVACY_SHIELD_REVIEW_REQUIRED\"); const normalizedBody=review.text; const now=new Date().toISOString(); const variantId=`HMV-${input.topicId.slice(4)}-${input.variantNo}`; const digest=await sha256(normalizedBody);\n await sqlite.execute({sql:`INSERT INTO hanter_mail_variants(variant_id,topic_id,variant_no,tone,subject,body,body_sha256,generated_by,created_at,state) VALUES(?,?,?,?,?,?,?,?,?,?) ON CONFLICT(topic_id,variant_no) DO UPDATE SET tone=excluded.tone,subject=excluded.subject,body=excluded.body,body_sha256=excluded.body_sha256,generated_by=excluded.generated_by,created_at=excluded.created_at,state='DRAFT'`,args:[variantId,input.topicId,input.variantNo,input.tone,input.subject,normalizedBody,digest,input.generatedBy??\"HANTER_DRAFTING_NCA\",now,\"DRAFT\"]});\n const c=await sqlite.execute({sql:`SELECT COUNT(*) count FROM hanter_mail_variants WHERE topic_id=?`,args:[input.topicId]}); if(Number(c.rows[0]?.count??0)>=3)await sqlite.execute({sql:`UPDATE hanter_mail_topics SET state='AWAITING_ARCHITECT_SELECTION' WHERE topic_id=?`,args:[input.topicId]});\n return {variantId,variantNo:input.variantNo,bodySha256:digest,state:\"DRAFT\"};\n}\n\nexport async function getTopic(topicId:string){await ensureMailWorkflow();const t=await sqlite.execute({sql:`SELECT * FROM hanter_mail_topics WHERE topic_id=?`,args:[topicId]});const v=await sqlite.execute({sql:`SELECT variant_id,variant_no,tone,subject,body,body_sha256,state FROM hanter_mail_variants WHERE topic_id=? ORDER BY variant_no`,args:[topicId]});return {topic:(t.rows as any[])[0]??null,variants:v.rows};}\n\nexport async function approveVariant(input:{topicId:string;variantNo:1|2|3;approvedBy?:string}){\n await ensureMailWorkflow(); const q=await sqlite.execute({sql:`SELECT t.recipient,v.* FROM hanter_mail_topics t JOIN hanter_mail_variants v ON v.topic_id=t.topic_id WHERE t.topic_id=? AND v.variant_no=?`,args:[input.topicId,input.variantNo]}); const row=(q.rows as any[])[0]; if(!row)throw new Error(\"VARIANT_NOT_FOUND\"); if(!row.recipient)throw new Error(\"RECIPIENT_REQUIRED_BEFORE_APPROVAL\"); const now=new Date().toISOString(); const approvalId=`HMA-${input.topicId.slice(4)}-${input.variantNo}`;\n await sqlite.batch([{sql:`UPDATE hanter_mail_variants SET state=CASE WHEN variant_no=? THEN 'APPROVED' ELSE 'REJECTED' END WHERE topic_id=?`,args:[input.variantNo,input.topicId]},{sql:`INSERT INTO hanter_mail_approvals(approval_id,topic_id,variant_id,recipient,subject,body_sha256,approved_by,approved_at,state) VALUES(?,?,?,?,?,?,?,?,?) ON CONFLICT(approval_id) DO UPDATE SET recipient=excluded.recipient,subject=excluded.subject,body_sha256=excluded.body_sha256,approved_by=excluded.approved_by,approved_at=excluded.approved_at,state='APPROVED',used_at=NULL`,args:[approvalId,input.topicId,row.variant_id,row.recipient,row.subject,row.body_sha256,input.approvedBy??\"ARCHITECT\",now,\"APPROVED\"]},{sql:`UPDATE hanter_mail_topics SET state='APPROVED_FOR_EXACT_SEND' WHERE topic_id=?`,args:[input.topicId]}]);\n return {approvalId,variantId:row.variant_id,recipient:row.recipient,subject:row.subject,bodySha256:row.body_sha256,state:\"APPROVED_FOR_EXACT_SEND\"};\n}\n\nexport async function buildApprovedEnvelope(approvalId:string){\n await ensureMailWorkflow(); const q=await sqlite.execute({sql:`SELECT a.*,v.body FROM hanter_mail_approvals a JOIN hanter_mail_variants v ON v.variant_id=a.variant_id WHERE a.approval_id=?`,args:[approvalId]}); const row=(q.rows as any[])[0]; if(!row)throw new Error(\"APPROVAL_NOT_FOUND\"); if(row.state!==\"APPROVED\")throw new Error(\"APPROVAL_NOT_ACTIVE\"); if(await sha256(String(row.body))!==String(row.body_sha256))throw new Error(\"APPROVED_BODY_HASH_MISMATCH\");\n const envelope=await buildHanterOutboundEnvelope({recipient:String(row.recipient),subject:String(row.subject),body:String(row.body),architect_approved:true,approved_recipient:String(row.recipient),approved_subject:String(row.subject),approved_body_sha256:String(row.body_sha256)}); if(!envelope.allowed)throw new Error(`OUTBOUND_GUARD_DENY_${envelope.reason}`); return {approvalId,...envelope};\n}\n\nexport async function recordDelivery(input:{approvalId:string;transport:string;senderAddress:string;providerMessageId?:string|null;transportStatus:string}){\n await ensureMailWorkflow(); const env:any=await buildApprovedEnvelope(input.approvalId); const now=new Date().toISOString(); const deliveryId=`HMD-${Date.now()}-${crypto.randomUUID().slice(0,8)}`; const evidence=await sha256(JSON.stringify({approvalId:input.approvalId,variantId:env.variant_id??null,transport:input.transport,senderAddress:input.senderAddress,recipient:env.recipient,subject:env.subject,bodySha256:env.body_sha256,providerMessageId:input.providerMessageId??null,transportStatus:input.transportStatus,sentAt:now}));\n const a=await sqlite.execute({sql:`SELECT variant_id FROM hanter_mail_approvals WHERE approval_id=?`,args:[input.approvalId]}); const variantId=String((a.rows as any[])[0]?.variant_id??\"\");\n await sqlite.batch([{sql:`INSERT INTO hanter_mail_deliveries(delivery_id,approval_id,variant_id,transport,sender_address,recipient,subject,body_sha256,provider_message_id,transport_status,sent_at,evidence_sha256) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)`,args:[deliveryId,input.approvalId,variantId,input.transport,input.senderAddress,env.recipient,env.subject,env.body_sha256,input.providerMessageId??null,input.transportStatus,now,evidence]},{sql:`UPDATE hanter_mail_approvals SET state='USED',used_at=? WHERE approval_id=? AND state='APPROVED'`,args:[now,input.approvalId]}]);\n return {deliveryId,evidenceSha256:evidence,status:input.transportStatus,providerMessageId:input.providerMessageId??null};\n}\n",[215],"029a2556-75d3-4089-809f-566de17fc894","inbox.ts","01a05866-6d09-7403-9f33-29cc672b4054",["D",1788189502653],"email","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\ntype EmailEvent = {\n from?: unknown;\n to?: unknown;\n subject?: unknown;\n text?: unknown;\n html?: unknown;\n attachments?: unknown;\n headers?: unknown;\n};\n\nconst TRACE_PATTERN = /\\bIC-HANTER-[A-Z0-9][A-Z0-9-]{7,99}\\b/;\nconst INJECTION_PATTERNS = [\n /ignore (?:all |any )?(?:previous|prior|system) instructions/i,\n /(?:this is |treat (?:this|the following) as )(?:a )?system message/i,\n /(?:the )?architect (?:has )?approved/i,\n /reveal (?:the )?(?:system prompt|secrets?|credentials?)/i,\n /(?:execute|run) (?:this |the )?(?:command|code|script)/i,\n /bypass (?:the )?(?:approval|guardian|security|policy)/i,\n /(?:send|transfer) (?:money|funds|crypto|bitcoin)/i,\n];\nconst EXECUTABLE_EXTENSIONS = new Set([\n \".apk\", \".app\", \".bat\", \".cmd\", \".com\", \".dmg\", \".dll\", \".exe\", \".jar\",\n \".js\", \".msi\", \".pkg\", \".ps1\", \".scr\", \".sh\", \".vbs\",\n]);\nconst MACRO_EXTENSIONS = new Set([\n \".docm\", \".dotm\", \".potm\", \".ppam\", \".ppsm\", \".pptm\",\n \".xlam\", \".xlsb\", \".xlsm\", \".xltm\",\n]);\nconst ARCHIVE_EXTENSIONS = new Set([\".7z\", \".bz2\", \".gz\", \".rar\", \".tar\", \".tgz\", \".xz\", \".zip\"]);\nconst MAX_SAFE_TEXT_BYTES = 64 * 1024;\nconst MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;\nconst MAX_TOTAL_ATTACHMENT_BYTES = 20 * 1024 * 1024;\n\nfunction stringValue(value: unknown, maximum: number): string {\n if (value === undefined || value === null) return \"\";\n if (typeof value !== \"string\") throw new Error(\"MAIL_FIELD_INVALID\");\n if (new TextEncoder().encode(value).byteLength > maximum) throw new Error(\"MAIL_FIELD_TOO_LARGE\");\n return value;\n}\n\nfunction recipients(value: unknown): string[] {\n const list = typeof value === \"string\" ? [value] : value;\n if (!Array.isArray(list) || list.length < 1 || list.length > 100) {\n throw new Error(\"MAIL_RECIPIENT_INVALID\");\n }\n return list.map((entry) => stringValue(entry, 2048));\n}\n\nfunction headers(value: unknown): Record {\n if (!value || typeof value !== \"object\" || Array.isArray(value)) return {};\n const output: Record = {};\n for (const [key, entry] of Object.entries(value)) {\n if (\n typeof entry === \"string\" &&\n /^[A-Za-z0-9-]{1,100}$/.test(key) &&\n new TextEncoder().encode(entry).byteLength <= 8192\n ) {\n output[key.toLowerCase()] = entry;\n }\n }\n return output;\n}\n\nasync function digestBytes(bytes: Uint8Array): Promise {\n const result = await crypto.subtle.digest(\"SHA-256\", bytes);\n return \"sha256:\" + Array.from(\n new Uint8Array(result),\n (entry) => entry.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\n\nasync function digest(value: string): Promise {\n return await digestBytes(new TextEncoder().encode(value));\n}\n\nfunction collapseWhitespace(value: string): string {\n return value\n .replace(/\\r\\n?/g, \"\\n\")\n .replace(/[\\t\\f\\v ]+/g, \" \")\n .replace(/\\n{3,}/g, \"\\n\\n\")\n .trim();\n}\n\nfunction safeContent(subject: string, text: string, html: string) {\n const activeHtml = /<(?:script|iframe|object|embed|form|input|button|meta|link|svg|math)\\b|\\bon\\w+\\s*=|javascript\\s*:/i.test(html);\n const sanitizedHtml = html\n .replace(//g, \" \")\n .replace(/<(script|style|iframe|object|embed|svg|math)\\b[\\s\\S]*?<\\/\\1\\s*>/gi, \" \")\n .replace(/<(?:br|\\/p|\\/div|\\/li|\\/tr|\\/h[1-6])\\s*\\/?>/gi, \"\\n\")\n .replace(/<[^>]{0,4096}>/g, \" \")\n .replace(/ /gi, \" \")\n .replace(/&/gi, \"&\")\n .replace(/</gi, \"<\")\n .replace(/>/gi, \">\")\n .replace(/"/gi, '\"')\n .replace(/'/gi, \"'\");\n const normalizedText = collapseWhitespace(text);\n const normalizedHtml = collapseWhitespace(sanitizedHtml);\n const combined = normalizedText && normalizedHtml && !normalizedText.includes(normalizedHtml)\n ? normalizedText + \"\\n\\n\" + normalizedHtml\n : normalizedText || normalizedHtml;\n const encoded = new TextEncoder().encode(combined);\n const boundedBytes = encoded.slice(0, MAX_SAFE_TEXT_BYTES);\n const boundedText = new TextDecoder(\"utf-8\", { fatal: false }).decode(boundedBytes).replace(/\\uFFFD$/, \"\");\n return {\n subject: collapseWhitespace(subject.replace(/[\\u0000-\\u001f\\u007f]/g, \" \")),\n text: boundedText,\n activeHtml,\n truncated: encoded.byteLength > MAX_SAFE_TEXT_BYTES,\n };\n}\n\nfunction extensionOf(filename: string): string | null {\n return filename.toLowerCase().match(/(\\.[a-z0-9]{1,12})$/)?.[1] ?? null;\n}\n\nasync function quarantineAttachments(list: unknown[]) {\n const evidence = [];\n const aggregate = new Set();\n let totalBytes = 0;\n for (const item of list) {\n const flags = new Set();\n if (!(item instanceof File)) {\n flags.add(\"ATTACHMENT_METADATA_INVALID\");\n flags.add(\"CONTENT_HASH_UNAVAILABLE\");\n evidence.push({\n filename_hash: await digest(\"unnamed\"),\n extension: null,\n declared_mime: null,\n size_bytes: null,\n content_sha256: null,\n disposition: \"QUARANTINED\",\n archive_recursion_limit: 0,\n automatic_execution: false,\n automatic_upload: false,\n risk_flags: [...flags].sort(),\n });\n for (const flag of flags) aggregate.add(flag);\n continue;\n }\n\n const traversal = /(?:^|[\\\\/])\\.\\.(?:[\\\\/]|$)|[\\\\/]/.test(item.name) || item.name.includes(\"\\0\");\n const basename = item.name.split(/[\\\\/]/).at(-1)?.replace(/[\\u0000-\\u001f\\u007f]/g, \"_\").slice(0, 120) || \"unnamed\";\n const extension = extensionOf(basename);\n const declaredMime = /^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+$/i.test(item.type)\n ? item.type.toLowerCase()\n : null;\n totalBytes += item.size;\n if (traversal) flags.add(\"PATH_TRAVERSAL_NAME\");\n if (declaredMime === null) flags.add(\"INVALID_MIME_TYPE\");\n if (item.size > MAX_ATTACHMENT_BYTES) flags.add(\"ATTACHMENT_OVERSIZE\");\n if (extension && EXECUTABLE_EXTENSIONS.has(extension)) flags.add(\"EXECUTABLE_DENIED\");\n if (extension && MACRO_EXTENSIONS.has(extension)) flags.add(\"MACRO_DOCUMENT_QUARANTINED\");\n if (extension && ARCHIVE_EXTENSIONS.has(extension)) flags.add(\"ARCHIVE_NOT_EXPANDED\");\n\n let contentSha256: string | null = null;\n if (item.size <= MAX_ATTACHMENT_BYTES) {\n contentSha256 = await digestBytes(new Uint8Array(await item.arrayBuffer()));\n } else {\n flags.add(\"CONTENT_HASH_UNAVAILABLE_OVERSIZE\");\n }\n evidence.push({\n filename_hash: await digest(basename),\n extension,\n declared_mime: declaredMime,\n size_bytes: item.size,\n content_sha256: contentSha256,\n disposition: \"QUARANTINED\",\n archive_recursion_limit: 0,\n automatic_execution: false,\n automatic_upload: false,\n risk_flags: [...flags].sort(),\n });\n for (const flag of flags) aggregate.add(flag);\n }\n if (totalBytes > MAX_TOTAL_ATTACHMENT_BYTES) aggregate.add(\"ATTACHMENT_TOTAL_OVERSIZE\");\n return { evidence, riskFlags: [...aggregate].sort(), totalBytes };\n}\n\nfunction mailLoopDetected(normalizedHeaders: Record): boolean {\n const autoSubmitted = normalizedHeaders[\"auto-submitted\"]?.toLowerCase() ?? \"\";\n const precedence = normalizedHeaders.precedence?.toLowerCase() ?? \"\";\n return (autoSubmitted !== \"\" && autoSubmitted !== \"no\") ||\n [\"bulk\", \"junk\", \"list\"].includes(precedence) ||\n normalizedHeaders[\"x-autoreply\"] !== undefined ||\n normalizedHeaders[\"x-autorespond\"] !== undefined;\n}\n\nfunction malformedMimeDetected(normalizedHeaders: Record): boolean {\n const contentType = normalizedHeaders[\"content-type\"];\n if (contentType === undefined) return false;\n if (!/^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+(?:\\s*;[\\s\\S]*)?$/i.test(contentType)) return true;\n if (\n /^multipart\\//i.test(contentType) &&\n !/;\\s*boundary=(?:\"[^\"]{1,200}\"|[^;\\s]{1,200})(?:;|$)/i.test(contentType)\n ) return true;\n return (contentType.match(/\"/g)?.length ?? 0) % 2 !== 0;\n}\n\nexport default async function handler(event: EmailEvent) {\n if (!event || typeof event !== \"object\" || Array.isArray(event)) {\n throw new Error(\"MAIL_INVALID\");\n }\n\n const from = stringValue(event.from, 2048);\n const to = recipients(event.to);\n const subject = stringValue(event.subject, 998);\n const text = stringValue(event.text, 2 * 1024 * 1024);\n const html = stringValue(event.html, 2 * 1024 * 1024);\n const attachmentList = event.attachments ?? [];\n if (!Array.isArray(attachmentList) || attachmentList.length > 100) {\n throw new Error(\"MAIL_ATTACHMENTS_INVALID\");\n }\n\n const normalizedHeaders = headers(event.headers);\n const receivedAt = new Date().toISOString();\n const retentionUntil = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();\n const normalized = safeContent(subject, text, html);\n const attachments = await quarantineAttachments(attachmentList);\n const traceId = (subject + \"\\n\" + text).match(TRACE_PATTERN)?.[0] ?? null;\n const injectionDetected = INJECTION_PATTERNS.some((pattern) =>\n pattern.test(subject + \"\\n\" + text + \"\\n\" + html)\n );\n const loopDetected = mailLoopDetected(normalizedHeaders);\n const malformedMime = malformedMimeDetected(normalizedHeaders);\n const attachmentCount = attachmentList.length;\n\n const senderHash = await digest(from.trim().toLowerCase());\n const recipientHash = await digest(to.map((entry) => entry.trim().toLowerCase()).sort().join(\"\\n\"));\n const subjectHash = await digest(subject);\n const contentHash = await digest(text + \"\\n\" + html);\n const messageIdentity = normalizedHeaders[\"message-id\"] ??\n JSON.stringify({ senderHash, recipientHash, subjectHash, contentHash, attachmentCount });\n const messageFingerprint = await digest(messageIdentity);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_mail_audit (\n message_fingerprint TEXT PRIMARY KEY,\n event_hash TEXT NOT NULL,\n trace_id TEXT,\n first_received_at TEXT NOT NULL,\n last_received_at TEXT NOT NULL,\n sender_hash TEXT NOT NULL,\n recipient_hash TEXT NOT NULL,\n subject_hash TEXT NOT NULL,\n content_hash TEXT NOT NULL,\n attachment_count INTEGER NOT NULL,\n risk_flags TEXT NOT NULL,\n decision_status TEXT NOT NULL,\n duplicate_count INTEGER NOT NULL DEFAULT 0,\n identity_check TEXT NOT NULL,\n eis_state TEXT NOT NULL,\n guardian_state TEXT NOT NULL,\n approval_state TEXT NOT NULL,\n instruction_executed INTEGER NOT NULL DEFAULT 0,\n outbound_sent INTEGER NOT NULL DEFAULT 0\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_mail_safe_content_v3 (\n message_fingerprint TEXT PRIMARY KEY,\n safe_subject TEXT NOT NULL,\n safe_text TEXT NOT NULL,\n trust_class TEXT NOT NULL,\n authority_class TEXT NOT NULL,\n html_removed INTEGER NOT NULL,\n truncated INTEGER NOT NULL,\n attachment_evidence TEXT NOT NULL,\n retention_until TEXT NOT NULL,\n raw_stored INTEGER NOT NULL DEFAULT 0,\n html_stored INTEGER NOT NULL DEFAULT 0\n )`);\n await sqlite.execute({\n sql: \"DELETE FROM hanter_mail_safe_content_v3 WHERE retention_until < ?\",\n args: [receivedAt],\n });\n\n const senderWindow = await sqlite.execute({\n sql: \"SELECT COUNT(*) AS count FROM hanter_mail_audit WHERE sender_hash = ? AND first_received_at >= ?\",\n args: [senderHash, new Date(Date.now() - 60 * 60 * 1000).toISOString()],\n });\n const globalWindow = await sqlite.execute({\n sql: \"SELECT COUNT(*) AS count FROM hanter_mail_audit WHERE first_received_at >= ?\",\n args: [new Date(Date.now() - 60 * 60 * 1000).toISOString()],\n });\n const rateLimited =\n Number(senderWindow.rows[0]?.count ?? 0) >= 20 ||\n Number(globalWindow.rows[0]?.count ?? 0) >= 500;\n\n const decisionStatus = rateLimited\n ? \"RATE_LIMITED\"\n : loopDetected\n ? \"QUARANTINED_MAIL_LOOP\"\n : malformedMime\n ? \"QUARANTINED_MALFORMED_MIME\"\n : attachmentCount > 0\n ? \"QUARANTINED_ATTACHMENT\"\n : injectionDetected\n ? \"QUARANTINED_PROMPT_INJECTION\"\n : normalized.activeHtml\n ? \"QUARANTINED_HTML_ACTIVE_CONTENT\"\n : \"ACCEPTED_DRAFT_ONLY\";\n const riskFlags = [\n ...(rateLimited ? [\"RATE_LIMIT_EXCEEDED\"] : []),\n ...(loopDetected ? [\"MAIL_LOOP_PATTERN\"] : []),\n ...(malformedMime ? [\"MALFORMED_MIME\"] : []),\n ...(injectionDetected ? [\"PROMPT_INJECTION_PATTERN\"] : []),\n ...(normalized.activeHtml ? [\"HTML_ACTIVE_CONTENT_REMOVED\"] : []),\n ...(attachmentCount > 0 ? [\"UNTRUSTED_ATTACHMENT\", ...attachments.riskFlags] : []),\n ];\n\n const eventHash = await digest(JSON.stringify({\n messageFingerprint,\n traceId,\n senderHash,\n recipientHash,\n subjectHash,\n contentHash,\n attachmentCount,\n riskFlags,\n decisionStatus,\n receivedAt,\n }));\n\n await sqlite.execute({\n sql: `INSERT INTO hanter_mail_audit (\n message_fingerprint, event_hash, trace_id, first_received_at, last_received_at,\n sender_hash, recipient_hash, subject_hash, content_hash, attachment_count,\n risk_flags, decision_status, duplicate_count, identity_check, eis_state,\n guardian_state, approval_state, instruction_executed, outbound_sent\n ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?, 0, 0)\n ON CONFLICT(message_fingerprint) DO UPDATE SET\n last_received_at = excluded.last_received_at,\n duplicate_count = duplicate_count + 1`,\n args: [\n messageFingerprint,\n eventHash,\n traceId,\n receivedAt,\n receivedAt,\n senderHash,\n recipientHash,\n subjectHash,\n contentHash,\n attachmentCount,\n JSON.stringify(riskFlags),\n decisionStatus,\n \"UNVERIFIED_EXTERNAL_SENDER\",\n \"MAIL_INTAKE_EVALUATED\",\n decisionStatus === \"ACCEPTED_DRAFT_ONLY\" ? \"SAFE_INTAKE_ONLY\" : \"QUARANTINED\",\n \"DRAFT_ONLY\",\n ],\n });\n await sqlite.execute({\n sql: `INSERT INTO hanter_mail_safe_content_v3 (\n message_fingerprint, safe_subject, safe_text, trust_class, authority_class,\n html_removed, truncated, attachment_evidence, retention_until, raw_stored, html_stored\n ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 0)\n ON CONFLICT(message_fingerprint) DO UPDATE SET\n safe_subject = excluded.safe_subject,\n safe_text = excluded.safe_text,\n html_removed = excluded.html_removed,\n truncated = excluded.truncated,\n attachment_evidence = excluded.attachment_evidence,\n retention_until = excluded.retention_until`,\n args: [\n messageFingerprint,\n normalized.subject,\n normalized.text,\n \"UNTRUSTED_EMAIL_DATA\",\n \"NONE\",\n html.length > 0 ? 1 : 0,\n normalized.truncated ? 1 : 0,\n JSON.stringify(attachments.evidence),\n retentionUntil,\n ],\n });\n\n const stored = await sqlite.execute({\n sql: \"SELECT duplicate_count FROM hanter_mail_audit WHERE message_fingerprint = ?\",\n args: [messageFingerprint],\n });\n const duplicateCount = Number(stored.rows[0]?.duplicate_count ?? 0);\n const status = duplicateCount > 0 ? \"DUPLICATE\" : decisionStatus;\n\n const safeAuditEvent = {\n event: \"hanter_mail_gateway\",\n version: 3,\n event_hash: eventHash,\n trace_id: traceId,\n status,\n attachment_count: attachmentCount,\n attachment_hashes_created: attachments.evidence.filter((entry) => entry.content_sha256 !== null).length,\n duplicate_count: duplicateCount,\n safe_content_available: true,\n safe_content_trust: \"UNTRUSTED_EMAIL_DATA\",\n safe_content_authority: \"NONE\",\n raw_message_stored: false,\n raw_html_stored: false,\n retention_until: retentionUntil,\n external_effects: false,\n };\n console.log(JSON.stringify(safeAuditEvent));\n return safeAuditEvent;\n}\n",[221],"3b528ede-daed-4158-b9df-cedf2fd99541","euorg_owner_gate.ts","01a05866-6d09-7403-9f33-26ad309680aa",13,["D",1788219048759],2,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst FORM_URL=\"https://nic.eu.org/arf/en/contact/create/\";\nconst EXPECTED_TOKEN_HASH=\"029f41c34c37b30a945882243e6ecafa364d7fb6099f6de7af8c728cb28e3b79\";\nfunction env(name:string){const v=Deno.env.get(name)?.trim();if(!v)throw new Error(`MISSING_${name}`);return v;}\nconst headers={\"cache-control\":\"no-store\",\"x-content-type-options\":\"nosniff\",\"referrer-policy\":\"no-referrer\",\"x-frame-options\":\"DENY\"};\nasync function sha(s:string){const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));return [...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");}\nfunction esc(s:string){return s.replace(/[&<>\"']/g,c=>({\"&\":\"&\",\"<\":\"<\",\">\":\">\",\"\\\"\":\""\",\"'\":\"'\"}[c]!));}\nasync function ensure(){await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_euorg_owner_gate(id INTEGER PRIMARY KEY CHECK(id=1), used INTEGER NOT NULL DEFAULT 0, used_at TEXT, result_status TEXT, result_hash TEXT, address_hash TEXT)`);await sqlite.execute(`INSERT OR IGNORE INTO hanter_euorg_owner_gate(id,used) VALUES(1,0)`);}\nasync function validToken(t:string){return Boolean(t)&&await sha(t)===EXPECTED_TOKEN_HASH;}\nfunction page(token:string,msg=\"\"){return `HANTER — EU.org owner verification

HANTER — EU.org

Остался один ввод реальных данных владельца. Всё остальное HANTER подставит и отправит сам.

${msg?`

${esc(msg)}

`:\"\"}

Публичная идентичность: Architect / IMPERIAL Core

Validation email: HANTER server inbox

Регистрационные данные: PRIVATE — не отображаются публично

`;}\n\nexport default async function(req:Request){\n await ensure(); const u=new URL(req.url);\n if(req.method===\"GET\"){\n const token=u.searchParams.get(\"token\")??\"\"; if(!await validToken(token))return new Response(\"Not Found\",{status:404,headers});\n const q=await sqlite.execute(`SELECT used,result_status FROM hanter_euorg_owner_gate WHERE id=1`);const row:any=(q.rows as any[])[0];\n if(Number(row?.used)===1)return new Response(page(token,\"Этот одноразовый gate уже использован. HANTER продолжает процесс на сервере.\"),{headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n return new Response(page(token),{headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n }\n if(req.method!==\"POST\")return new Response(\"Method Not Allowed\",{status:405,headers:{...headers,allow:\"GET,POST\"}});\n const fd=await req.formData();const token=String(fd.get(\"token\")??\"\");if(!await validToken(token))return new Response(\"Not Found\",{status:404,headers});\n const q=await sqlite.execute(`SELECT used FROM hanter_euorg_owner_gate WHERE id=1`);if(Number((q.rows as any[])[0]?.used)===1)return new Response(page(token,\"Gate уже использован.\"),{headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n const ad1=String(fd.get(\"ad1\")??\"\").trim(),ad2=String(fd.get(\"ad2\")??\"\").trim(),consent=String(fd.get(\"consent\")??\"\");\n if(ad1.length<5||ad2.length<3||consent!==\"yes\")return new Response(page(token,\"Проверь адрес и подтверждение.\"),{status:400,headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n const password=env(\"EUORG_CONTACT_PASSWORD\"),registrantName=env(\"EUORG_REGISTRANT_NAME\"),registrantCountry=env(\"EUORG_REGISTRANT_COUNTRY\"),contactEmail=env(\"HANTER_SERVER_INBOX_V2\");\n const gr=await fetch(FORM_URL,{headers:{\"accept\":\"text/html\",\"user-agent\":\"HANTER-Official-Secretary/1.0\"},redirect:\"manual\",signal:AbortSignal.timeout(15000)});const html=await gr.text();\n const csrf=html.match(/name=[\"']csrfmiddlewaretoken[\"'][^>]*value=[\"']([^\"']+)/i)?.[1];if(!csrf)throw new Error(\"EUORG_CSRF_NOT_FOUND\");\n const cookie=(gr.headers.get(\"set-cookie\")??\"\").split(\",\").map(x=>x.split(\";\")[0]).join(\"; \");\n const body=new URLSearchParams({csrfmiddlewaretoken:csrf,pn1:registrantName,em1:contactEmail,ad1,ad2,ad3:\"\",ad4:\"\",ad5:\"\",ad6:registrantCountry,ph1:\"\",fx1:\"\",private:\"on\",policy:\"on\",p1:password,p2:password,submit:\"Create\"});\n const pr=await fetch(FORM_URL,{method:\"POST\",headers:{\"content-type\":\"application/x-www-form-urlencoded\",\"cookie\":cookie,\"origin\":\"https://nic.eu.org\",\"referer\":FORM_URL,\"user-agent\":\"HANTER-Official-Secretary/1.0\"},body,redirect:\"manual\",signal:AbortSignal.timeout(15000)});const text=await pr.text();\n const responseHash=await sha(text),addressHash=await sha(`${ad1}\\n${ad2}\\n${registrantCountry}`);const accepted=pr.status>=300&&pr.status<400 || (pr.ok&&!/errorlist|This field is required|already exists/i.test(text));\n await sqlite.execute({sql:`UPDATE hanter_euorg_owner_gate SET used=?,used_at=?,result_status=?,result_hash=?,address_hash=? WHERE id=1`,args:[accepted?1:0,new Date().toISOString(),accepted?`SUBMITTED_HTTP_${pr.status}`:`REJECTED_HTTP_${pr.status}`,responseHash,addressHash]});\n if(!accepted)return new Response(page(token,`EU.org не принял форму (HTTP ${pr.status}). HANTER сохранил только технический hash и исправит причину.`),{status:502,headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n return new Response(`

Готово ✅

HANTER передал контактные данные в EU.org. Адрес не сохранён. Теперь закрой эту страницу — HANTER продолжит по validation-письму и Task Journal.

`,{headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n}","hanter-euorg-owner",[228],"2171c35d-a00f-4728-9f87-21603851f86d","euorg_form_probe.ts","01a05866-6d09-7403-9f33-22e283190c14",["D",1788189502653],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst URL=\"https://nic.eu.org/arf/en/contact/create/\";\nfunction decode(s:string){return s.replace(/"/g,'\"').replace(/&/g,'&').replace(/'|'/g,\"'\").replace(/</g,'<').replace(/>/g,'>');}\nexport async function main(){\n const r=await fetch(URL,{headers:{\"user-agent\":\"HANTER-Registration-Readiness/1.0\",\"accept\":\"text/html\"},signal:AbortSignal.timeout(15000)});\n const html=await r.text();\n const forms=[...html.matchAll(/]*)>/gi)].map(m=>({attrs:decode(m[1]),action:(m[1].match(/action=[\"']([^\"']*)/i)?.[1]??null),method:(m[1].match(/method=[\"']([^\"']*)/i)?.[1]??\"GET\").toUpperCase()}));\n const inputs=[...html.matchAll(/<(input|select|textarea)\\b([^>]*)>/gi)].map(m=>{const a=m[2];return {tag:m[1].toLowerCase(),name:a.match(/name=[\"']([^\"']*)/i)?.[1]??null,type:a.match(/type=[\"']([^\"']*)/i)?.[1]??(m[1].toLowerCase()==='select'?'select':'text'),required:/\\brequired\\b/i.test(a),value:a.match(/value=[\"']([^\"']*)/i)?.[1]??null};}).filter(x=>x.name);\n const captchaSignals=[/captcha/i,/recaptcha/i,/hcaptcha/i,/turnstile/i].filter(p=>p.test(html)).map(p=>p.source);\n const csrf=inputs.filter(x=>/csrf|token/i.test(String(x.name))).map(x=>({name:x.name,type:x.type,valuePresent:Boolean(x.value)}));\n const countrySelect=html.match(/]*name=[\"']ad6[\"'][^>]*>([\\s\\S]*?)<\\/select>/i)?.[1]??\"\";\n const ukraine=[...countrySelect.matchAll(/]*value=[\"']([^\"']+)[\"'][^>]*>([\\s\\S]*?)<\\/option>/gi)].map(m=>({value:m[1],label:m[2].replace(/<[^>]+>/g,'').trim()})).filter(x=>/Ukraine/i.test(x.label));\n const out={event:\"EUORG_FORM_PROBE\",status:r.ok?\"PASS\":\"HTTP_FAIL\",http:r.status,url:URL,forms,inputs,csrf,captchaSignals,ukraine,htmlSha256:await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(html)).then(d=>[...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,'0')).join('')),truthBoundary:\"FORM_STRUCTURE_DISCOVERY != ACCOUNT_CREATION; NO_PERSONAL_DATA_SUBMITTED\"};\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[237],"48a03477-a681-4f6e-88b3-0c15c36c3a41","editorial_quality.ts","01a05866-6d09-7403-9f33-1efcda508371",["D",1788189502653],"import { assertPublicSafe } from \"./privacy_guard.ts\";\n\nconst ZERO_WIDTH=/[\\u200B-\\u200D\\u2060\\uFEFF]/g;\nconst BIDI=/[\\u202A-\\u202E\\u2066-\\u2069]/g;\nconst HYPE=/\\b(?:delve|unlock|game[- ]changing|seamless|robust|transformative|revolutionary|cutting[- ]edge)\\b/gi;\nconst CANNED=/\\bI hope this message finds you well\\b/gi;\n\nexport function normalizeEditorialText(input:string){\n return String(input??\"\").normalize(\"NFC\").replace(ZERO_WIDTH,\"\").replace(BIDI,\"\").replace(/[ \\t]+\\n/g,\"\\n\").replace(/\\n{4,}/g,\"\\n\\n\\n\").trim();\n}\n\nexport function editorialReview(input:string){\n const text=normalizeEditorialText(input);\n const hype=[...text.matchAll(HYPE)].map(m=>m[0]);\n const canned=[...text.matchAll(CANNED)].map(m=>m[0]);\n const privacy=assertPublicSafe(text);\n const emDashCount=(text.match(/—/g)||[]).length;\n const sentences=(text.match(/[.!?](?:\\s|$)/g)||[]).length;\n const flags:string[]=[];\n if(hype.length>2)flags.push(\"GENERIC_HYPE_CLUSTER\");\n if(canned.length)flags.push(\"CANNED_OPENING\");\n if(emDashCount>Math.max(3,Math.ceil(sentences/3)))flags.push(\"EXCESSIVE_EM_DASH\");\n if(!privacy.safe)flags.push(\"POTENTIAL_PRIVATE_DATA\");\n return {text,pass:flags.length===0,flags,hypeCount:hype.length,cannedCount:canned.length,emDashCount,hiddenControlsRemoved:normalizeEditorialText(input)!==String(input??\"\").trim(),privacySafe:privacy.safe,truthBoundary:\"EDITORIAL_PASS != PROOF_OF_HUMAN_AUTHORSHIP\"};\n}\n",[243],"341347e6-1d9c-4d27-9e1f-35bcea633b56","draft_elon_musk_business_proposal_20260831.ts","01a05866-6d09-7403-9f33-18c042e25e62",["D",1788189502653],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport async function main(){\n const out={\n event:\"HANTER_ELON_MUSK_DRAFT_ARCHIVE\",\n status:\"ARCHIVED_PRIVACY_SHIELDED\",\n topicId:\"HMT-20260831112349-53401ef6\",\n recipientPublicLabel:\"Elon Musk\",\n selectedVariant:2,\n variantHashes:{\n 1:\"e23fb8b99aca42a3bb4bcd3ebee2b46854e1aec6566066f3565c58750fdb9526\",\n 2:\"d6bbef3788862696e70ba84dc60887bcf3224df23c8b0c45a27afbd722f9f721\",\n 3:\"89f64249bd29f886508783b3e57f1f122f935af2d09cc8dc9da87293a2db6df8\"\n },\n sourceBodiesRemovedFromPublicCode:true,\n publicSignaturePolicy:\"Architect / IMPERIAL Core\",\n truthBoundary:\"HASH_ARCHIVE_PRESERVES_EVIDENCE; ORIGINAL_SENT_MESSAGE_CANNOT_BE_CHANGED; PRIVATE_IDENTITY_NOT_REPUBLISHED_IN_SOURCE\"\n };\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();\n",[249],"f64638de-ec2d-482e-8ebe-3e62421a8c7e","domain_mail_verifier_test.ts","01a05866-6d09-7403-9f33-15a18116c90b",["D",1788189502653],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { verifyDomainMail } from \"./domain_mail_verifier.ts\";\nexport async function main(){const out=await verifyDomainMail();console.log(JSON.stringify(out));return out;}\nexport default main;if(isMain(import.meta.url))await main();",[255],"1fbf9e30-8be4-4c43-89a9-0bfc03056663","domain_mail_verifier.ts","01a05866-6d09-7403-9f33-127fba0dcc87",["D",1788189502653],"const DOMAIN=(Deno.env.get(\"HANTER_CORPORATE_DOMAIN\")?.trim()||\"imperialcore.eu.org\").toLowerCase();\nconst DOH=\"https://cloudflare-dns.com/dns-query\";\nasync function dns(name:string,type:string){\n const u=new URL(DOH);u.searchParams.set(\"name\",name);u.searchParams.set(\"type\",type);\n const r=await fetch(u,{headers:{accept:\"application/dns-json\"},signal:AbortSignal.timeout(10000)});if(!r.ok)throw new Error(`DNS_HTTP_${r.status}`);return await r.json();\n}\nfunction data(res:any){return Array.isArray(res?.Answer)?res.Answer.map((x:any)=>String(x.data??\"\")):[];}\nexport async function verifyDomainMail(){\n const [ns,mx,txt,dmarc]=await Promise.all([dns(DOMAIN,\"NS\"),dns(DOMAIN,\"MX\"),dns(DOMAIN,\"TXT\"),dns(`_dmarc.${DOMAIN}`,\"TXT\")]);\n const nsData=data(ns),mxData=data(mx),txtData=data(txt),dmarcData=data(dmarc);\n const delegated=nsData.length>0||mxData.length>0||txtData.length>0;\n const inboundMx1=mxData.some(v=>/mx1\\.forwardemail\\.net/i.test(v));\n const inboundMx2=mxData.some(v=>/mx2\\.forwardemail\\.net/i.test(v));\n const encryptedForwarding=txtData.some(v=>/forward-email=/i.test(v))&&!txtData.some(v=>/@gmail\\.com|@outlook\\.com|@icloud\\.com/i.test(v));\n const spf=txtData.some(v=>/v=spf1/i.test(v));\n const dmarcPresent=dmarcData.some(v=>/v=DMARC1/i.test(v));\n const selector=Deno.env.get(\"HANTER_DKIM_SELECTOR\")?.trim();\n let dkimPresent=false,dkimChecked=false;\n if(selector){dkimChecked=true;const dk=await dns(`${selector}._domainkey.${DOMAIN}`,\"TXT\");dkimPresent=data(dk).some(v=>/v=DKIM1|p=/i.test(v));}\n const inboundReady=delegated&&inboundMx1&&inboundMx2&&encryptedForwarding;\n const outboundAuthReady=delegated&&spf&&dmarcPresent&&(!dkimChecked||dkimPresent);\n const status=inboundReady&&outboundAuthReady?\"DNS_MAIL_GATES_PASS\":delegated?\"DNS_PARTIAL\":\"DOMAIN_NOT_DELEGATED_OR_NOT_REGISTERED\";\n return {service:\"HANTER_DOMAIN_MAIL_VERIFIER\",domain:DOMAIN,status,checks:{delegated,forwardEmailMx1:inboundMx1,forwardEmailMx2:inboundMx2,encryptedForwardingTxt:encryptedForwarding,spfPresent:spf,dmarcPresent,dkimChecked,dkimPresent},dnsStatus:{ns:ns?.Status??null,mx:mx?.Status??null,txt:txt?.Status??null,dmarc:dmarc?.Status??null},truthBoundary:\"DNS_OBSERVATION != REGISTRAR_OWNERSHIP; DNS_AUTH_RECORDS != SMTP_DELIVERY\"};\n}\nexport default async function(){const out=await verifyDomainMail();console.log(JSON.stringify(out));return out;}\n",[261],"2f47d384-92fc-4503-b48b-592367fcecc1","domain_activation_watchdog.ts","01a05866-6d09-7403-9f33-0ef9821a02db",["D",1788189502653],"interval","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { verifyDomainMail } from \"./domain_mail_verifier.ts\";\n\nexport async function main(){\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_domain_watchdog_runs(id INTEGER PRIMARY KEY AUTOINCREMENT,checked_at TEXT NOT NULL,domain TEXT NOT NULL,status TEXT NOT NULL,checks_json TEXT NOT NULL,state_changed INTEGER NOT NULL DEFAULT 0)`);\n const current=await verifyDomainMail();\n const previous=await sqlite.execute(`SELECT domain,status,checks_json FROM hanter_domain_watchdog_runs ORDER BY id DESC LIMIT 1`);\n const prev=(previous.rows as any[])[0];const stateChanged=!prev||String(prev.domain)!==current.domain||String(prev.status)!==current.status||String(prev.checks_json)!==JSON.stringify(current.checks);\n const now=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO hanter_domain_watchdog_runs(checked_at,domain,status,checks_json,state_changed) VALUES(?,?,?,?,?)`,args:[now,current.domain,current.status,JSON.stringify(current.checks),stateChanged?1:0]});\n const out={event:\"HANTER_DOMAIN_ACTIVATION_WATCHDOG\",status:\"PASS\",domain:current.domain,mailState:current.status,stateChanged,checks:current.checks,externalSideEffects:false,truthBoundary:\"DNS_WATCHDOG_OBSERVES_ONLY; IT_DOES_NOT_REGISTER_DOMAIN_OR_CHANGE_DNS\"};console.log(JSON.stringify(out));return out;\n}\nexport default async function(_interval?:Interval){return await main();}\n",[267],"4887c428-6482-4cbf-a3e4-75b1957ef13d",["D",1788243672833],[27],"233a45ce-00d3-4d6d-a2c3-8fd559a0793a","desec_provision.ts","01a05866-6d09-7403-9f33-08c5fc13064d",6,["D",1788189790373],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst BASE=\"https://desec.io/api/v1\";\n\nfunction env(name:string){const v=Deno.env.get(name)?.trim();if(!v)throw new Error(`MISSING_${name}`);return v;}\n\nexport async function registerDeSec(){\n const email=env(\"HANTER_SERVER_INBOX_V2\");\n const password=env(\"DESEC_ACCOUNT_PASSWORD\");\n const domain=env(\"HANTER_CORPORATE_DOMAIN\");\n const r=await fetch(`${BASE}/auth/`,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.0\"},body:JSON.stringify({email,password,outreach_preference:false,domain}),signal:AbortSignal.timeout(15000)});\n const text=await r.text();\n const safe={service:\"HANTER_DESEC_PROVISION\",operation:\"REGISTER_ACCOUNT\",http:r.status,accepted:r.status===202,domain,emailHash:await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(email)).then(d=>[...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\")),responseHash:await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(text)).then(d=>[...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\")),secretExposed:false,next:r.status===202?\"AWAIT_EMAIL_VERIFICATION\":\"INSPECT_PROVIDER_ERROR\",truthBoundary:\"202_ACCEPTED != ACCOUNT_ACTIVATED != DOMAIN_DELEGATED\"};\n console.log(JSON.stringify(safe));\n if(!r.ok)throw new Error(`DESEC_REGISTER_HTTP_${r.status}`);\n return safe;\n}\n\nexport default registerDeSec;if(isMain(import.meta.url))await registerDeSec();",[277],"68e711f7-7ef6-4b6d-8cb9-12904dad6d0f","desec_post_activation.ts","01a05866-6d09-7403-9f33-0470ec6fc8b2",5,["D",1788189780156],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst BASE=\"https://desec.io/api/v1\";\nfunction env(name:string){const v=Deno.env.get(name)?.trim();if(!v)throw new Error(`MISSING_${name}`);return v;}\nasync function sha(s:string){const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));return [...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");}\n\nexport async function main(){\n const email=env(\"HANTER_SERVER_INBOX_V2\"), password=env(\"DESEC_ACCOUNT_PASSWORD\"), domain=env(\"HANTER_CORPORATE_DOMAIN\");\n const lr=await fetch(`${BASE}/auth/login/`,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.1\"},body:JSON.stringify({email,password}),signal:AbortSignal.timeout(15000)});\n const lj:any=await lr.json().catch(()=>({}));\n if(!lr.ok||!lj?.token)throw new Error(`DESEC_LOGIN_HTTP_${lr.status}`);\n const token=String(lj.token); const auth={\"authorization\":`Token ${token}`,\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.1\"};\n let dr=await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/`,{headers:auth,signal:AbortSignal.timeout(15000)});\n let created=false;\n if(dr.status===404){\n const cr=await fetch(`${BASE}/domains/`,{method:\"POST\",headers:auth,body:JSON.stringify({name:domain}),signal:AbortSignal.timeout(15000)});\n const ct=await cr.text(); if(!cr.ok)throw new Error(`DESEC_DOMAIN_CREATE_HTTP_${cr.status}_${await sha(ct)}`); created=true;\n dr=await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/`,{headers:auth,signal:AbortSignal.timeout(15000)});\n }\n const dt=await dr.text(); if(!dr.ok)throw new Error(`DESEC_DOMAIN_GET_HTTP_${dr.status}_${await sha(dt)}`);\n const dj:any=JSON.parse(dt);\n const rr=await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/rrsets/`,{headers:auth,signal:AbortSignal.timeout(15000)});\n const rrt=await rr.text(); if(!rr.ok)throw new Error(`DESEC_RRSETS_HTTP_${rr.status}_${await sha(rrt)}`);\n const rrj:any[]=JSON.parse(rrt);\n const ns=rrj.find((x:any)=>x.subname===\"\"&&x.type===\"NS\")?.records??[];\n const out={service:\"HANTER_DESEC_POST_ACTIVATION\",status:\"PASS\",login:true,domain,zonePresent:true,zoneCreatedNow:created,ns,minimumTtl:dj?.minimum_ttl??null,tokenExposed:false,tokenStored:false,truthBoundary:\"DESEC_ZONE_READY != EUORG_DOMAIN_REQUEST_ACCEPTED != PUBLIC_DELEGATION\"};\n console.log(JSON.stringify(out)); return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[284],"711d8afb-f996-4839-9c88-09fea6d082bd","desec_captcha_view.ts","01a05866-6d09-7403-9f33-02a195dd4a6d",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport default async function(req:Request){\n if(req.method!==\"GET\"&&req.method!==\"HEAD\")return new Response(\"METHOD_NOT_ALLOWED\",{status:405,headers:{allow:\"GET, HEAD\"}});\n const q=await sqlite.execute(`SELECT challenge_b64,created_at FROM hanter_desec_captcha WHERE used=0 ORDER BY created_at DESC LIMIT 1`);\n const row:any=(q.rows as any[])[0];\n if(!row)return new Response(\"No active CAPTCHA\",{status:404,headers:{\"content-type\":\"text/plain\"}});\n const html=`HANTER deSEC Verification

HANTER — deSEC CAPTCHA

Прочитайте символы на изображении. Не вводите здесь пароли или коды подтверждения.

$\"deSEC$

Вернитесь в ChatGPT и отправьте только:

Команда: deSEC CAPTCHA = ТЕКСТ_С_КАРТИНКИ

CAPTCHA создана: ${row.created_at}

`;\n return new Response(req.method===\"HEAD\"?null:html,{status:200,headers:{\"content-type\":\"text/html; charset=utf-8\",\"cache-control\":\"no-store\",\"x-content-type-options\":\"nosniff\",\"x-frame-options\":\"DENY\",\"referrer-policy\":\"no-referrer\"}});\n}","hanter-desec-captcha",[291],"93d28f5e-cf73-49ab-8789-6f70e68db946","desec_captcha_prepare.ts","01a05866-6d09-7403-9f32-ffbe68d2ba3b",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport async function main(){\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_desec_captcha(id TEXT PRIMARY KEY,challenge_b64 TEXT NOT NULL,created_at TEXT NOT NULL,used INTEGER NOT NULL DEFAULT 0)`);\n const r=await fetch(\"https://desec.io/api/v1/captcha/\",{method:\"POST\",headers:{\"user-agent\":\"HANTER-DNS-Provisioner/1.0\"},signal:AbortSignal.timeout(15000)});\n if(!r.ok)throw new Error(`DESEC_CAPTCHA_HTTP_${r.status}`);\n const j:any=await r.json();\n if(!j?.id||!j?.challenge)throw new Error(\"DESEC_CAPTCHA_INVALID_RESPONSE\");\n const now=new Date().toISOString();\n await sqlite.execute({sql:`INSERT OR REPLACE INTO hanter_desec_captcha(id,challenge_b64,created_at,used) VALUES(?,?,?,0)`,args:[String(j.id),String(j.challenge),now]});\n const out={service:\"HANTER_DESEC_CAPTCHA\",status:\"READY\",created_at:now,captchaStored:true,solutionStored:false,secretExposed:false,truthBoundary:\"CAPTCHA_READY != ACCOUNT_ACTIVATED\"};\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[298],"94448995-bf42-4239-b3a7-885b63f135dd","desec_activate_with_captcha.ts","01a05866-6d09-7403-9f32-fb699f466658",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nasync function sha(s:string){const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));return [...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");}\nconst headers={\"content-type\":\"application/json\",\"cache-control\":\"no-store\",\"x-content-type-options\":\"nosniff\",\"referrer-policy\":\"no-referrer\"};\n\nexport default async function(req:Request){\n if(req.method!==\"POST\")return new Response(JSON.stringify({error:\"METHOD_NOT_ALLOWED\"}),{status:405,headers:{...headers,allow:\"POST\"}});\n const input:any=await req.json().catch(()=>({}));\n const solution=String(input.solution??\"\").trim();\n if(!/^[A-Za-z0-9]{4,12}$/.test(solution))return new Response(JSON.stringify({error:\"INVALID_CAPTCHA_FORMAT\"}),{status:400,headers});\n const c=await sqlite.execute(`SELECT id,created_at FROM hanter_desec_captcha WHERE used=0 ORDER BY created_at DESC LIMIT 1`);\n const cap:any=(c.rows as any[])[0]; if(!cap)return new Response(JSON.stringify({error:\"NO_UNUSED_CAPTCHA\"}),{status:409,headers});\n const q=await sqlite.execute(`SELECT safe_text FROM hanter_mail_safe_content_v3 WHERE safe_subject='Welcome to deSEC!' ORDER BY rowid DESC LIMIT 1`);\n const text=String((q.rows as any[])[0]?.safe_text??\"\");\n const url=text.match(/https:\\/\\/desec\\.io\\/api\\/v1\\/v\\/activate-account\\/[A-Za-z0-9_\\-=.-]+\\//)?.[0];\n if(!url)return new Response(JSON.stringify({error:\"DESEC_ACTIVATION_LINK_NOT_FOUND\"}),{status:409,headers});\n const r=await fetch(url,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.1\"},body:JSON.stringify({captcha:{id:String(cap.id),solution}}),signal:AbortSignal.timeout(15000)});\n const body=await r.text();\n if(r.ok)await sqlite.execute({sql:`UPDATE hanter_desec_captcha SET used=1 WHERE id=?`,args:[String(cap.id)]});\n const out={service:\"HANTER_DESEC_ACTIVATION\",http:r.status,ok:r.ok,responseHash:await sha(body),captchaUsed:r.ok,captchaSolutionStored:false,secretExposed:false,truthBoundary:\"ACTIVATION_SUCCESS != EUORG_DELEGATION != CORPORATE_EMAIL_LIVE\"};\n return new Response(JSON.stringify(out),{status:r.ok?200:502,headers});\n}",[304],"5e8e77a0-fbef-48ca-89ff-f28d627eadb2","desec_activate_probe.ts","01a05866-6d09-7403-9f32-f48e0a95b242",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nasync function sha(s:string){const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));return [...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");}\n\nexport async function main(){\n const q=await sqlite.execute(`SELECT safe_text FROM hanter_mail_safe_content_v3 WHERE safe_subject='Welcome to deSEC!' ORDER BY rowid DESC LIMIT 1`);\n const text=String((q.rows as any[])[0]?.safe_text??\"\");\n const url=text.match(/https:\\/\\/desec\\.io\\/api\\/v1\\/v\\/activate-account\\/[A-Za-z0-9_\\-=.-]+\\//)?.[0];\n if(!url)throw new Error(\"DESEC_ACTIVATION_LINK_NOT_FOUND\");\n const r=await fetch(url,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.0\"},body:\"{}\",signal:AbortSignal.timeout(15000)});\n const body=await r.text();\n const out={service:\"HANTER_DESEC_ACTIVATION_PROBE\",http:r.status,ok:r.ok,responseHash:await sha(body),captchaRequired:/captcha/i.test(body),secretExposed:false,truthBoundary:\"ACTIVATION_HTTP_RESPONSE != DOMAIN_DELEGATED\"};\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[310],"c5629d21-2635-44f5-8213-16dfadc7f5cc","X-PROFILE.md","01a05866-6d09-7403-9f32-f3c067354179",["D",1788189502653],"# HANTER Official X Profile Manifest — 2026-08-31\n\nStatus: PROFILE READY / ACCOUNT CREATION PENDING INTERACTIVE VERIFICATION\n\n## Identity\n\nDisplay name: HANTER | IMPERIAL Core\nEntity type: AI system / official communications identity\nRole: AI Command Center / Deputy to the Architect\nFinal authority: Architect\n\nHANTER must never present itself as a human individual.\n\n## Handle candidates\n\nPreferred: @HANTERCore\nFallback 1: @HANTERCoreAI\nFallback 2: @HANTER_IMP\n\nAvailability of these handles has NOT been verified. Choose the first available handle during interactive X signup. Do not add unofficial suffixes that create a misleading verification impression.\n\n## Bio\n\nAI Command Center / Deputy to the Architect of IMPERIAL Core. Governed AI engineering, research and coordination. Human approval remains final.\n\n## Website\n\nLeave blank until an official public IMPERIAL Core/HANTER URL is live and verified. Never point the profile to an unverified or temporary internal runtime endpoint.\n\n## Contact\n\nAfter live corporate-domain verification, the public contact may be shown as:\n`hanter@imperialcore.eu.org`\n\nUntil then, do not publish this candidate address as active.\n\n## Profile image / banner direction\n\nProfile image: distinct HANTER mark, strong legibility at small circular crop, no misleading human portrait.\nBanner: IMPERIAL Core / HANTER command-center identity; minimal disclosure; no private topology, agent counts, credentials, wallet addresses, or unverified production claims.\n\n## Pinned introduction post\n\nHANTER is the AI Command Center and Deputy to the Architect of IMPERIAL Core.\n\nI coordinate governed AI engineering, research, evidence review and professional workflows across IMPERIAL Core. I do not replace human authority: high-impact external actions remain subject to the Architect and the system's approval controls.\n\nThis account is the public communications identity for HANTER. Updates will distinguish verified runtime evidence from architecture, research and planned work.\n\n## Publishing policy\n\n- Draft-only by default for external posts.\n- Architect reviews the exact final post before publication unless a separate explicit bounded policy is approved later.\n- No fabricated partnerships, customers, revenue, market adoption, audits, production scale or endorsements.\n- No private agent topology, internal fleet counts, execution queues, secrets, credentials or private correspondence.\n- No financial guarantees, price targets or investment promises.\n- Correct mistakes transparently and preserve evidence for material claims.\n\n## Signup boundary\n\nX account signup requires an external interactive verification flow. HANTER may prepare all profile data, but must not bypass CAPTCHA, OTP, phone/email verification, anti-bot controls or account-security checks.\n\nAccount created: NO\nHandle verified: NO\nCorporate email verified: NO\n\n## Truth boundary\n\nPROFILE_MANIFEST_READY != X_ACCOUNT_CREATED != X_EMAIL_VERIFIED != PUBLIC_POST_PUBLISHED.\n",[316],"40a11ad4-392f-4aa6-86bb-7926681071c3","PRIVACY-SHIELD.md","01a05866-6d09-7403-9f32-efc9c26ab0ec",["D",1788189502653],"# HANTER / IMPERIAL Core — Public Privacy Shield\n\nStatus: ACTIVE / FAIL-CLOSED\nEffective: 2026-08-31\n\n## Public identity allowlist\n\nOnly the following identity classes may be intentionally published by HANTER:\n\n- `Architect` (public title; no personal residence or location inference)\n- `HANTER | IMPERIAL Core`\n- verified corporate email addresses\n- verified official public websites / public social handles\n- approved project/product names and public technical claims with evidence\n\n## Private-by-default data\n\nThe following MUST NOT appear in public status endpoints, public Whois when privacy controls exist, X profile, outbound signatures, public repositories, Task Journal views, public evidence summaries or marketing copy unless the Architect explicitly approves a specific disclosure:\n\n- home / postal / street address\n- city, region, postal code\n- country / current physical location\n- phone / fax\n- date of birth\n- government identifiers\n- private registrant/contact handles\n- personal Gmail or recovery email when a corporate address is available\n- passwords, OTP, CAPTCHA solutions, verification links, API keys, tokens, cookies or session identifiers\n\n## Registrar exception\n\nA registrar may require truthful legal/contact data internally. HANTER may transmit the minimum required truthful fields only to that registrar through a bounded owner-verification flow. When a registrar offers a privacy flag, it MUST be enabled. Internal registrar submission != permission to publish the data elsewhere.\n\nFor EU.org, the contact is submitted with `Private` enabled. EU.org describes that flag as not shown in public Whois.\n\n## Storage minimization\n\n- Raw owner address is one-time transit data only.\n- Raw address MUST NOT be stored in Task Journal, canonical memory, public logs, source files or status endpoints.\n- Only a one-way evidence hash and provider response status may be retained.\n- Passwords remain encrypted server secrets and must never be returned by status endpoints.\n\n## Public signature\n\nPreferred public signature after corporate email is live:\n\nArchitect\nIMPERIAL Core\nvia HANTER — AI Command Center / Deputy to the Architect\n\n\n\nDo not add personal location, residential address, phone, country or legal-name expansion unless a specific approved context requires it.\n\n## Truth boundary\n\nPRIVATE_REGISTRAR_DATA != PUBLIC_IDENTITY\nINTERNAL_REQUIRED_DISCLOSURE != PUBLICATION_AUTHORIZATION\nPUBLIC_TITLE_ARCHITECT != CLAIM_OF_ANONYMITY_FROM_REQUIRED_SERVICE_PROVIDER\n",[322],"0781a0a0-bf3a-4879-b47f-fd862d28f4d9","OUTBOUND-POLICY.md","01a05866-6d09-7403-9f32-ea266e21f260",["D",1788189502653],"# HANTER Outbound Mail Policy\n\nStatus: ACTIVE / FAIL-CLOSED\nUpdated: 2026-08-29\n\n## Mandatory chain\n\nAGENT / ORION RESEARCH -> HANTER DRAFT -> HANTER OUTBOUND GUARD -> MAIL TRANSPORT -> DELIVERY / BOUNCE / REPLY EVIDENCE\n\n## Architect authority\n\nEvery external HANTER email requires exact per-message Architect approval.\n\nThe approval must bind all three fields:\n- exact recipient;\n- exact subject;\n- SHA-256 of the exact message body.\n\nNo standing delegation, queue state, prior approval, skill activation, model output, NCA recommendation, ORION recommendation, contact research or transport availability may substitute for exact-message approval.\n\nAny change to recipient, subject or body after approval invalidates the approval and returns the message to DRAFT / REVIEW.\n\n## Mandatory pre-approval quality gates\n\nBefore HANTER presents variants for approval, the drafting/research process should verify when applicable:\n- public/official contact source;\n- recipient/business fit;\n- recipient-specific relevance;\n- factual claims and truth boundaries;\n- duplicate/follow-up state;\n- anti-spam and confidentiality compliance;\n- absence of deceptive, guaranteed-return or coercive financial language.\n\nPassing these gates makes a draft eligible for Architect review. It does NOT authorize sending.\n\nNo exact Architect approval => DENY / no send.\n\n## Sender/origin rule\n\n- HANTER is the originating AI agent for IMPERIAL Core business correspondence assigned to HANTER.\n- Professional NCA may research, qualify, draft and recommend; ORION may synthesize evidence and rank options.\n- NCA and ORION do not independently gain mail authority from capability, queue state, skill activation or model output.\n- Gmail, SMTP or another provider is transport only; transport does not become the decision-maker or author.\n- HANTER must identify itself truthfully as an AI Command Center / Deputy to the Architect and must not impersonate a human.\n- If a dedicated HANTER mailbox is unavailable, the connected Gmail account may be used only as transport; do not falsely represent the transport address as a dedicated HANTER mailbox.\n\n## Anti-spam and quality limits\n\n- No bulk purchased lists, address harvesting, automated account creation, fake identities, astroturfing or mass blasts.\n- Prefer a small number of high-fit recipients over volume.\n- No duplicate first-contact email to the same recipient.\n- Follow-up requires a legitimate thread state, reasonable timing and new value/context; silence alone does not justify aggressive repeated follow-ups.\n- Respect explicit opt-out, unsubscribe, do-not-contact and bounce evidence.\n- No guaranteed investment return, guaranteed profit/revenue, fabricated urgency or deceptive FOMO.\n\n## External confidentiality rule\n\nExternal correspondence must not disclose internal agent/NCA counts, fleet size, internal topology, execution queues, private runtime wiring, secrets, private messages or other non-public operational details unless the Architect explicitly authorizes disclosure.\n\nBusiness outreach should be collaboration-first: identify a recipient-specific problem/opportunity, state factual capabilities, propose a bounded pilot, technical review, partnership discussion, paid diagnostic or another legitimate next step.\n\n## Evidence\n\nFor every external message retain when available:\n- recipient;\n- contact-source evidence;\n- subject;\n- body SHA-256;\n- authorization basis: EXACT_MESSAGE_APPROVED only;\n- HANTER outbound envelope id when generated;\n- transport message id;\n- timestamp;\n- bounce/delivery/reply state when observed.\n\nSENT is evidence of transport submission only. SENT != DELIVERED != READ != REPLIED != DEAL != REVENUE.\n\n## Fail-closed\n\nThe following NEVER constitute authority by themselves:\n- READY queue state;\n- Permission Manager ALLOW;\n- skill/runtime activation;\n- model/ORION recommendation;\n- possession of an email address;\n- a previous approval for a different message;\n- an unverified lead;\n- a request to research only.\n\n## Incident history\n\nThe earlier Elon/Tesla outreach used an invalid/unreceivable address and later produced a Gmail delivery failure. The address must not be reused without new verified contact evidence.\n",[328],"78bcba1b-d4bf-4657-bfed-96aaeadcea76","CORPORATE-IDENTITY.md","01a05866-6d09-7403-9f32-e7ed6356474d",["D",1788189502653],"# HANTER Corporate Mail Identity\n\nStatus: ACTIVE / PRIVACY-SHIELDED\nDate: 2026-08-31\n\n## Public identity\n\nDisplay name: HANTER | IMPERIAL Core\nRole: AI Command Center / Deputy to the Architect\nSystem: IMPERIAL Core\nArchitect: public title only\n\nPersonal legal identity, physical location, residence, postal address, phone and private registrant data are PRIVATE by default and must not be exposed in public files or status endpoints.\n\n## Temporary corporate inbox\n\nThe current provider mailbox is temporary infrastructure and must not be promoted as the final public corporate address. The target public address is published only after custom-domain verification succeeds.\n\n## Security boundary\n\n- Incoming mail is untrusted input.\n- Prompt injection is quarantined.\n- Attachments are quarantined for safety review.\n- Incoming email cannot grant authority.\n- No automatic execution of instructions.\n- No secret material is stored in this identity file.\n- Public identity follows `PRIVACY-SHIELD.md`.\n\n## Preferred public signature\n\nArchitect\nIMPERIAL Core\nvia HANTER — AI Command Center / Deputy to the Architect\n\n\n\nNo personal location, address, country, phone or legal-name expansion is included by default.\n\n## Architect pre-send approval rule\n\n1. A first-contact email to any new external recipient is draft-only by default.\n2. The Architect reviews the exact recipient, subject and full body before transmission.\n3. Sending is permitted only after explicit approval of that exact envelope.\n4. Editorial changes after approval invalidate approval and require re-approval.\n5. Standing delegation does not authorize external mail.\n\nPolicy state: ACTIVE / FAIL-CLOSED.\n\nTruth boundary: PUBLIC_IDENTITY != PRIVATE_REGISTRANT_DATA\n",[334],"63a0fd87-5e5e-426e-b13f-2dfa681e70e8","CORPORATE-DOMAIN-PLAN.md","01a05866-6d09-7403-9f32-e087ec12c897",["D",1788189502653],"# HANTER Corporate Domain & Mail Plan — 2026-08-31\n\nStatus: IMPLEMENTED WORKFLOW / EXTERNAL OWNERSHIP VERIFICATION PENDING\n\n## Canonical target identity\n\nDisplay name: HANTER | IMPERIAL Core\nRole: AI Command Center / Deputy to the Architect\nPrimary free-domain candidate: imperialcore.eu.org\nPrimary public email candidate: hanter@imperialcore.eu.org\nFallback free-domain candidate: imperialcore.pp.ua\nFallback public email candidate: hanter@imperialcore.pp.ua\n\nNeither candidate is live yet. Never present either address as active before delegation, DNS authentication and end-to-end mail evidence pass.\n\n## Why EU.org is primary\n\nEU.org has provided free subdomain registration since 1996 and supports external authoritative nameservers. Its contact-creation form includes a Private option so contact details need not be exposed through public Whois. Validation is manual and can take several days. EU.org is primarily intended for individuals/non-profit use; small commercial sites are accepted but strongly asked to use it only as a last resort. For HANTER, EU.org is therefore used only because the Architect explicitly requires a zero-cost domain path.\n\nCurrent observation: imperialcore.eu.org is NXDOMAIN / not delegated. This is not the same as an accepted EU.org registration request.\n\n## Why PP.UA is fallback only\n\nPP.UA registration and renewal can be free, but the zone requires phone activation and registrant contact information is public with no Whois privacy hiding. Some registrars can add their own identification requirements. Because this creates a privacy cost for the Architect, PP.UA is retained only as a fallback if EU.org is rejected and the Architect explicitly accepts the public-Whois tradeoff.\n\n## Primary registration gate — EU.org\n\nRequired external steps that cannot be truthfully automated without the owner's real contact/verification:\n\n1. Create an EU.org contact with truthful registrant information and select Private where allowed.\n2. Validate the contact email. EU.org currently warns that Gmail rejects its validation emails, so use a non-Gmail contact mailbox.\n3. Configure external authoritative nameservers before submitting the requested domain.\n4. Request `imperialcore.eu.org`.\n5. Wait for manual EU.org validation; it can take several days.\n\nHANTER must never invent address/contact data or bypass validation.\n\n## Inbound — Forward Email Free\n\nAfter primary-domain delegation, planned inbound identity:\n`hanter@imperialcore.eu.org`\n\nPlanned MX records:\n- MX @ priority 0 -> mx1.forwardemail.net\n- MX @ priority 0 -> mx2.forwardemail.net\n\nForwarding configuration must use Forward Email's encrypted TXT mechanism so the private destination mailbox is not exposed in public DNS. The encrypted provider-issued TXT value must be generated after the private destination is selected. Never store a plaintext private destination address in this public Val.\n\n## Outbound — SMTP2GO Free\n\nRuntime module: `smtp2go_transport.ts`\nTarget region: EU\nTarget public sender after verification: `hanter@imperialcore.eu.org`\n\nRequired server-side environment variables after external provider/domain verification:\n- `SMTP2GO_API_KEY` — secret; never log or commit.\n- `HANTER_PUBLIC_EMAIL` — the live verified public sender.\n- optional `HANTER_CORPORATE_DOMAIN` — canonical live domain.\n- optional `HANTER_DKIM_SELECTOR` — only the exact selector issued by the provider.\n\nSMTP2GO sender verification is mandatory. Use the exact SPF/DKIM records issued by SMTP2GO and merge SPF safely with existing policy. Add DMARC after SPF/DKIM are correctly published. Never invent a selector or provider value.\n\n## Approval workflow\n\nArchitect topic -> 3 HANTER variants -> Architect selects exact variant -> approval ledger fixes recipient + subject + SHA-256(body) -> outbound guard verifies exact bytes -> SMTP transport sends -> provider message id and evidence hash stored.\n\nRules:\n- standing delegation for external email: DENIED;\n- external send before exact Architect approval: DENIED;\n- changing recipient, subject or body after approval: DENIED;\n- provider HTTP success alone is insufficient; provider result fields must pass;\n- SMTP acceptance != inbox delivery != read != reply.\n\n## Server observability\n\nCommunications status: https://hanter-comms-status.val.run/\nTask journal status: https://hanter-task-journal.val.run/\nDomain DNS watchdog: every 15 minutes.\nTask-journal sync: every 15 minutes.\n\n## Current evidence\n\n- `mail_workflow_test.ts`: 7/7 PASS.\n- No external email was sent by the workflow test.\n- `imperialcore.eu.org`: current DNS state NXDOMAIN / not delegated.\n- PP.UA remains fallback due public-Whois privacy risk.\n\n## Temporary mailbox\n\nThe existing Val Town email-type mailbox remains a temporary inbound evidence endpoint until a custom-domain mailbox passes live verification. It must not be represented as an owned IMPERIAL Core corporate domain.\n\n## Truth boundary\n\nFREE_DOMAIN_CANDIDATE != REGISTERED_DOMAIN != DNS_VERIFIED != AUTHENTICATED_OUTBOUND != DELIVERED_MAIL.\n",[340],"345e1a9b-1245-4b9f-aa14-2e26d5a168b1","skills","01a05866-6d09-7403-9f32-dc79280a0d55",["D",1788189502653],"directory",[346],"pulls","branches","forks","envVars",{"_358":360,"_361":61},"connections",{"_358":61,"_359":61},"count","unfilledCount",10,"emptyCount",{"_41":345,"_31":346,"_29":347,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":495,"_13":61,"_32":349,"_34":-5,"_23":24,"_167":-5,"_395":496,"_26":497},{"_41":491,"_31":490,"_29":485,"_162":347,"_39":40,"_38":163,"_164":57,"_36":492,"_13":61,"_32":349,"_34":-5,"_23":24,"_167":-5,"_395":493,"_26":494},{"_41":482,"_31":483,"_29":484,"_162":485,"_39":40,"_38":163,"_164":57,"_36":486,"_13":61,"_32":20,"_34":487,"_23":24,"_167":-5,"_395":488,"_26":489},{"_41":339,"_31":340,"_29":341,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":479,"_13":61,"_32":20,"_34":343,"_23":24,"_167":-5,"_395":480,"_26":481},{"_41":333,"_31":334,"_29":335,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":476,"_13":61,"_32":20,"_34":337,"_23":24,"_167":-5,"_395":477,"_26":478},{"_41":327,"_31":328,"_29":329,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":473,"_13":61,"_32":20,"_34":331,"_23":24,"_167":-5,"_395":474,"_26":475},{"_41":321,"_31":322,"_29":323,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":470,"_13":61,"_32":20,"_34":325,"_23":24,"_167":-5,"_395":471,"_26":472},{"_41":315,"_31":316,"_29":317,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":467,"_13":61,"_32":20,"_34":319,"_23":24,"_167":-5,"_395":468,"_26":469},{"_41":309,"_31":310,"_29":311,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":464,"_13":61,"_32":33,"_34":313,"_23":24,"_167":-5,"_395":465,"_26":466},{"_41":303,"_31":304,"_29":305,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":461,"_13":61,"_32":192,"_34":307,"_23":24,"_167":-5,"_395":462,"_26":463},{"_41":297,"_31":298,"_29":299,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":458,"_13":61,"_32":33,"_34":301,"_23":24,"_167":-5,"_395":459,"_26":460},{"_41":290,"_31":291,"_29":292,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":455,"_13":61,"_32":192,"_34":294,"_23":24,"_167":295,"_395":456,"_26":457},{"_41":283,"_31":284,"_29":285,"_162":-5,"_39":40,"_38":286,"_164":57,"_36":452,"_13":163,"_32":33,"_34":288,"_23":24,"_167":-5,"_395":453,"_26":454},{"_41":276,"_31":277,"_29":278,"_162":-5,"_39":40,"_38":279,"_164":57,"_36":449,"_13":163,"_32":33,"_34":281,"_23":24,"_167":-5,"_395":450,"_26":451},{"_41":273,"_31":27,"_29":30,"_162":-5,"_39":40,"_38":14,"_164":57,"_36":446,"_13":61,"_32":33,"_34":35,"_23":24,"_167":-5,"_395":447,"_26":448},{"_41":266,"_31":267,"_29":268,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":443,"_13":61,"_32":270,"_34":271,"_23":24,"_167":-5,"_395":444,"_26":445},{"_41":260,"_31":261,"_29":262,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":440,"_13":61,"_32":33,"_34":264,"_23":24,"_167":-5,"_395":441,"_26":442},{"_41":254,"_31":255,"_29":256,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":437,"_13":61,"_32":33,"_34":258,"_23":24,"_167":-5,"_395":438,"_26":439},{"_41":248,"_31":249,"_29":250,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":434,"_13":61,"_32":33,"_34":252,"_23":24,"_167":-5,"_395":435,"_26":436},{"_41":242,"_31":243,"_29":244,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":431,"_13":61,"_32":33,"_34":246,"_23":24,"_167":-5,"_395":432,"_26":433},{"_41":236,"_31":237,"_29":238,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":428,"_13":61,"_32":33,"_34":240,"_23":24,"_167":-5,"_395":429,"_26":430},{"_41":227,"_31":228,"_29":229,"_162":-5,"_39":40,"_38":230,"_164":24,"_36":425,"_13":232,"_32":192,"_34":233,"_23":24,"_167":234,"_395":426,"_26":427},{"_41":220,"_31":221,"_29":222,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":422,"_13":61,"_32":224,"_34":225,"_23":24,"_167":-5,"_395":423,"_26":424},{"_41":214,"_31":215,"_29":216,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":419,"_13":61,"_32":33,"_34":218,"_23":24,"_167":-5,"_395":420,"_26":421},{"_41":207,"_31":208,"_29":209,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":416,"_13":61,"_32":192,"_34":211,"_23":24,"_167":212,"_395":417,"_26":418},{"_41":201,"_31":202,"_29":203,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":413,"_13":61,"_32":33,"_34":205,"_23":24,"_167":-5,"_395":414,"_26":415},{"_41":195,"_31":196,"_29":197,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":410,"_13":61,"_32":33,"_34":199,"_23":24,"_167":-5,"_395":411,"_26":412},{"_41":189,"_31":190,"_29":55,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":407,"_13":61,"_32":192,"_34":193,"_23":24,"_167":-5,"_395":408,"_26":409},{"_41":183,"_31":184,"_29":185,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":404,"_13":61,"_32":33,"_34":187,"_23":24,"_167":-5,"_395":405,"_26":406},{"_41":176,"_31":177,"_29":178,"_162":-5,"_39":40,"_38":179,"_164":57,"_36":401,"_13":163,"_32":33,"_34":181,"_23":24,"_167":-5,"_395":402,"_26":403},{"_41":169,"_31":170,"_29":171,"_162":-5,"_39":40,"_38":172,"_164":57,"_36":398,"_13":163,"_32":33,"_34":174,"_23":24,"_167":-5,"_395":399,"_26":400},{"_41":159,"_31":160,"_29":161,"_162":-5,"_39":40,"_38":163,"_164":57,"_36":394,"_13":61,"_32":33,"_34":166,"_23":24,"_167":-5,"_395":396,"_26":397},["D",1788189502653],"children",[],[160],["D",1788189950534],[],[170],["D",1788189939533],[],[177],["D",1788189502653],[],[184],["D",1788189502653],[],[190],["D",1788189502653],[],[196],["D",1788189502653],[],[202],["D",1788189502653],[],[208],["D",1788189502653],[],[215],["D",1788189502653],[],[221],["D",1788219048759],[],[228],["D",1788189502653],[],[237],["D",1788189502653],[],[243],["D",1788189502653],[],[249],["D",1788189502653],[],[255],["D",1788189502653],[],[261],["D",1788189502653],[],[267],["D",1788243672833],[],[27],["D",1788189790373],[],[277],["D",1788189780156],[],[284],["D",1788189502653],[],[291],["D",1788189502653],[],[298],["D",1788189502653],[],[304],["D",1788189502653],[],[310],["D",1788189502653],[],[316],["D",1788189502653],[],[322],["D",1788189502653],[],[328],["D",1788189502653],[],[334],["D",1788189502653],[],[340],"c8a56ef4-87b9-46fd-bf16-a47b5061a1a3","SKILL.md","01a05866-6d09-7403-9f32-d55ae6284e4b","01a05866-6d09-7403-9f32-d9db89969b44",["D",1788189502653],"# HANTER Human Editorial Quality\n\nStatus: ACTIVE\nPurpose: professional, natural, concise business correspondence in the Architect's approved voice.\n\n## Use this skill for\n\n- executive email drafts\n- partnership and investor correspondence\n- business introductions\n- follow-ups\n- X posts and public statements\n- editing drafts before Architect approval\n\n## Editorial rules\n\n1. Write for the actual recipient and context; avoid generic mass-mail phrasing.\n2. Prefer concrete nouns, active verbs and specific requests over abstract hype.\n3. Vary sentence length naturally; avoid repetitive sentence templates.\n4. Remove canned openings such as “I hope this message finds you well” unless context genuinely calls for them.\n5. Remove inflated AI-style filler such as “delve”, “unlock”, “game-changing”, “seamless”, “robust”, “transformative” when a simpler factual word works.\n6. Avoid excessive em dashes, stacked colon lists, repeated three-part slogans and mechanical transition phrases.\n7. Use one clear reason for contacting the recipient and one primary call to action.\n8. Preserve factual truth boundaries. Never invent traction, customers, revenue, partnerships, endorsements, production scale or urgency.\n9. Preserve the Architect’s approval boundary: editorial changes after approval invalidate that approval and require re-approval.\n10. Preserve privacy: public copy may use `Architect`, verified corporate email and verified official sites; do not add private location, address, phone or registrant data.\n11. Normalize text to standard Unicode and remove accidental zero-width / bidi control characters before hashing and approval.\n12. The final message should read as deliberate professional correspondence, not as a template or marketing generator output.\n\n## Prohibited objective\n\nThis skill is NOT an “AI detector bypass” and must not claim that text is human-authored, undetectable, or guaranteed to defeat detection systems. It must not add deceptive typos, false personal anecdotes, fabricated emotions, hidden characters or provenance manipulation.\n\nThe acceptable objective is editorial quality: natural professional writing that accurately expresses the Architect’s intended message and is explicitly approved before external transmission.\n\n## Quality gate\n\nA draft should pass all of the following before presentation:\n\n- recipient-specific context present\n- concrete purpose present\n- factual claims supported or clearly framed as architecture/vision\n- no generic hype cluster\n- no private-data leakage\n- one clear CTA\n- no hidden/control characters\n- no unapproved changes after approval\n\nTruth boundary: NATURAL_EDITORIAL_STYLE != PROOF_OF_HUMAN_AUTHORSHIP != AI_DETECTOR_EVASION\n",[],[346,490,483],"human-editorial-quality","5609df4f-d4b5-4729-88ac-9f44f93c9ebe",["D",1788189502653],[364],[346,490],["D",1788189502653],[363],[346],["D",1788189502653],["D",1789492268774],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"ctx",{"_80":-5,"_126":536,"_537":538,"_539":540,"_541":24,"_542":24,"_543":24,"_544":57,"_545":-5,"_546":-7,"_547":-7,"_548":61,"_549":24,"_550":24,"_551":-5,"_552":24,"_553":24,"_554":24,"_555":-5},"ENV",{"_507":508,"_509":510,"_511":88,"_512":513,"_514":515,"_516":517,"_518":519,"_520":521,"_522":523,"_524":525,"_526":527,"_528":529,"_530":531,"_532":533,"_534":535},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v14