[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_473":474,"_475":476},"routes/_app.x.$handle.$name",{"_98":97,"_31":43,"_107":88,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":57,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",102,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","execution_bridge_audit_verify.ts","latestPath","fileId","f82a3c78-a319-11f1-a403-1607ee4eb77e","name","fileType","script","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst PASSPORT_ID = \"AI-PASSPORT-HANTER-EXECUTION-CONNECTOR-001\";\nfunction utf8(value: string): Uint8Array { return new TextEncoder().encode(value); }\nasync function sha256(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", utf8(value));\n return \"sha256:\" + [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function hmac(value: string): Promise {\n const secret = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\n if (!secret) throw new Error(\"SERVER_AUTH_UNAVAILABLE\");\n const key = await crypto.subtle.importKey(\"raw\", utf8(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n const signature = await crypto.subtle.sign(\"HMAC\", key, utf8(value));\n return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction equal(left: string, right: string): boolean {\n if (left.length !== right.length) return false;\n let result = 0;\n for (let index = 0; index < left.length; index += 1) result |= left.charCodeAt(index) ^ right.charCodeAt(index);\n return result === 0;\n}\n\nasync function main() {\n const eventsResult = await sqlite.execute(`SELECT event_id,event_type,timestamp,queue_item_id,claim_id,request_id,\n service_id,passport_id,agent_id,orchestrator_id,runtime_domain,authorization_decision_id,\n previous_state,new_state,result,reason_code,evidence_ref,evidence_sha256,event_hash,event_signature\n FROM execution_bridge_audit WHERE queue_item_id=721 ORDER BY id`);\n const events = [];\n let signaturesValid = true;\n for (const row of eventsResult.rows as Record[]) {\n const material = [\n row.event_id,row.event_type,row.timestamp,row.queue_item_id,row.claim_id,row.request_id,\n row.service_id,PASSPORT_ID,row.agent_id,row.orchestrator_id,row.runtime_domain,\n row.authorization_decision_id,row.previous_state,row.new_state,row.result,row.reason_code,\n row.evidence_ref,row.evidence_sha256,\n ];\n const hashValid = equal(String(row.event_hash), await sha256(JSON.stringify(material)));\n const signatureValid = equal(String(row.event_signature), await hmac(String(row.event_hash)));\n signaturesValid = signaturesValid && hashValid && signatureValid;\n const { event_signature: _signature, ...safe } = row;\n events.push({ ...safe, hash_valid: hashValid, signature_valid: signatureValid });\n }\n const state = await sqlite.execute(`SELECT q.id,q.agent_id,q.execution_state,q.evidence_ref,q.completion_request_id,\n p.stage_index,p.evidence_count,p.last_evidence_ref,p.last_advanced_at\n FROM execution_queue q JOIN agent_progress p ON p.agent_id=q.agent_id WHERE q.id=721`);\n const triggers = await sqlite.execute(`SELECT name FROM sqlite_master WHERE type='trigger'\n AND name IN ('execution_bridge_audit_no_update','execution_bridge_audit_no_delete') ORDER BY name`);\n const result = {\n schema: \"IMPERIAL_EXECUTION_BRIDGE_AUDIT_VERIFICATION_V1\",\n queue_item_id: 721,\n event_count: events.length,\n event_types: events.map((event) => event.event_type),\n event_hashes_and_signatures_valid: signaturesValid,\n append_only_triggers_present: triggers.rows.length === 2,\n state: state.rows[0] ?? null,\n events,\n secretExposed: false,\n verifiedAt: new Date().toISOString(),\n };\n await blob.setJSON(\"evidence/execution-bridge/audit-events.json\", result);\n return result;\n}\nexport default main;\nif (isMain(import.meta.url)) await main();\n","createdAt",["D",1787946735811],"branchVersion","branchId","9599e79a-1b06-4a25-a590-49e65a500be3","id","80b8839b-de86-40ee-8340-1df5edf7503f","imperial-nca-31day-runtime",["D",1787871527621],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","100-NCA 31-day bootstrap runtime","imageUrl","fe39b163-4b50-466e-82d1-8bd01133e4b6","pinnedFileId","d8315798-a2ac-11f1-ac46-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a03585-eb44-758d-92a4-77db1a9a243c","tursoName","80b8839bde8640ee83401df5edf7503f","tursoHostname","80b8839bde8640ee83401df5edf7503f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789526460011],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"isOwned",173,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","oromaskevic23","handle","displayName","Олександр Ромаскевич","avatar","https://lh3.googleusercontent.com/a/ACg8ocIo1MJ3hDjpQrinMIRok3d2YY1vpHgehs8m2u1_vc7pmFovRGI=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":468,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":469,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":470,"_82":471,"_84":472,"_86":24},"tree",[359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385],"files",[359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385],"counts",{"_349":61,"_350":194,"_351":61,"_352":353,"_354":355},"contents",[129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":342,"_31":343,"_29":344,"_158":-5,"_39":40,"_38":345,"_160":57,"_36":346,"_13":169,"_32":162,"_34":347,"_23":24,"_164":-5,"_26":348},{"_41":335,"_31":336,"_29":337,"_158":-5,"_39":40,"_38":338,"_160":57,"_36":339,"_13":61,"_32":162,"_34":340,"_23":24,"_164":-5,"_26":341},{"_41":328,"_31":329,"_29":330,"_158":-5,"_39":40,"_38":331,"_160":57,"_36":332,"_13":179,"_32":33,"_34":333,"_23":24,"_164":-5,"_26":334},{"_41":321,"_31":322,"_29":323,"_158":-5,"_39":40,"_38":324,"_160":57,"_36":325,"_13":61,"_32":33,"_34":326,"_23":24,"_164":-5,"_26":327},{"_41":314,"_31":315,"_29":316,"_158":-5,"_39":40,"_38":317,"_160":57,"_36":318,"_13":179,"_32":33,"_34":319,"_23":24,"_164":-5,"_26":320},{"_41":307,"_31":308,"_29":309,"_158":-5,"_39":40,"_38":310,"_160":57,"_36":311,"_13":179,"_32":33,"_34":312,"_23":24,"_164":-5,"_26":313},{"_41":300,"_31":301,"_29":302,"_158":-5,"_39":40,"_38":303,"_160":57,"_36":304,"_13":171,"_32":33,"_34":305,"_23":24,"_164":-5,"_26":306},{"_41":293,"_31":294,"_29":295,"_158":-5,"_39":40,"_38":296,"_160":57,"_36":297,"_13":171,"_32":33,"_34":298,"_23":24,"_164":-5,"_26":299},{"_41":286,"_31":287,"_29":288,"_158":-5,"_39":40,"_38":289,"_160":57,"_36":290,"_13":61,"_32":33,"_34":291,"_23":24,"_164":-5,"_26":292},{"_41":279,"_31":280,"_29":281,"_158":-5,"_39":40,"_38":282,"_160":57,"_36":283,"_13":159,"_32":33,"_34":284,"_23":24,"_164":-5,"_26":285},{"_41":272,"_31":273,"_29":274,"_158":-5,"_39":40,"_38":275,"_160":57,"_36":276,"_13":171,"_32":33,"_34":277,"_23":24,"_164":-5,"_26":278},{"_41":265,"_31":266,"_29":267,"_158":-5,"_39":40,"_38":268,"_160":57,"_36":269,"_13":61,"_32":33,"_34":270,"_23":24,"_164":-5,"_26":271},{"_41":258,"_31":259,"_29":260,"_158":-5,"_39":40,"_38":261,"_160":24,"_36":262,"_13":223,"_32":162,"_34":263,"_23":24,"_164":-5,"_26":264},{"_41":255,"_31":27,"_29":30,"_158":-5,"_39":40,"_38":14,"_160":57,"_36":256,"_13":61,"_32":33,"_34":35,"_23":24,"_164":-5,"_26":257},{"_41":248,"_31":249,"_29":250,"_158":-5,"_39":40,"_38":251,"_160":57,"_36":252,"_13":171,"_32":33,"_34":253,"_23":24,"_164":-5,"_26":254},{"_41":241,"_31":242,"_29":243,"_158":-5,"_39":40,"_38":244,"_160":24,"_36":245,"_13":61,"_32":33,"_34":246,"_23":24,"_164":-5,"_26":247},{"_41":234,"_31":235,"_29":236,"_158":-5,"_39":40,"_38":237,"_160":57,"_36":238,"_13":61,"_32":33,"_34":239,"_23":24,"_164":-5,"_26":240},{"_41":227,"_31":228,"_29":229,"_158":-5,"_39":40,"_38":230,"_160":57,"_36":231,"_13":61,"_32":33,"_34":232,"_23":24,"_164":-5,"_26":233},{"_41":220,"_31":221,"_29":222,"_158":-5,"_39":40,"_38":223,"_160":57,"_36":224,"_13":61,"_32":33,"_34":225,"_23":24,"_164":-5,"_26":226},{"_41":213,"_31":214,"_29":215,"_158":-5,"_39":40,"_38":216,"_160":57,"_36":217,"_13":171,"_32":33,"_34":218,"_23":24,"_164":-5,"_26":219},{"_41":206,"_31":207,"_29":208,"_158":-5,"_39":40,"_38":209,"_160":57,"_36":210,"_13":61,"_32":162,"_34":211,"_23":24,"_164":-5,"_26":212},{"_41":197,"_31":198,"_29":199,"_158":-5,"_39":40,"_38":200,"_160":24,"_36":201,"_13":202,"_32":203,"_34":204,"_23":24,"_164":-5,"_26":205},{"_41":189,"_31":190,"_29":191,"_158":-5,"_39":40,"_38":192,"_160":57,"_36":193,"_13":194,"_32":33,"_34":195,"_23":24,"_164":-5,"_26":196},{"_41":182,"_31":183,"_29":184,"_158":-5,"_39":40,"_38":185,"_160":57,"_36":186,"_13":61,"_32":162,"_34":187,"_23":24,"_164":-5,"_26":188},{"_41":174,"_31":175,"_29":176,"_158":-5,"_39":40,"_38":177,"_160":57,"_36":178,"_13":179,"_32":162,"_34":180,"_23":24,"_164":-5,"_26":181},{"_41":166,"_31":167,"_29":168,"_158":-5,"_39":40,"_38":169,"_160":57,"_36":170,"_13":171,"_32":33,"_34":172,"_23":24,"_164":-5,"_26":173},{"_41":156,"_31":157,"_29":55,"_158":-5,"_39":40,"_38":159,"_160":57,"_36":161,"_13":61,"_32":162,"_34":163,"_23":24,"_164":-5,"_26":165},"d4c1febe-264d-443d-bbc5-69546fb473f4","stripe_status.ts","parentId",6,"latest",["D",1787899867027],"http","import Stripe from \"npm:stripe\";\n\nexport default async function (_req: Request): Promise {\n const names = Object.keys(Deno.env.toObject()).filter(k => /stripe/i.test(k));\n const candidates = names.filter(k => /secret|api|key|token/i.test(k));\n let credentialSource: string | null = null;\n let accountId: string | null = null;\n for (const name of candidates) {\n const value = Deno.env.get(name);\n if (!value) continue;\n try {\n const stripe = new Stripe(value);\n const acct = await stripe.accounts.retrieve();\n if (acct?.id) { credentialSource = name; accountId = acct.id; break; }\n } catch {}\n }\n return Response.json({stripeEnvKeys:names, candidateCredentialKeys:candidates, readOnlyStripeAccountProbe:credentialSource?\"PASS\":\"NOT_AVAILABLE\", credentialSource, accountId: accountId ? accountId.slice(0,8)+\"…\" : null});\n}\n","label",[157],"b3eee3b0-bd81-45b3-9bc5-260927cc3553","stripe_probe.ts","c94990e2-a2ac-11f1-8630-1607ee4eb77e",5,["D",1787899855011],1,"import Stripe from \"npm:stripe\";\n\nexport default async function () {\n const names = Object.keys(Deno.env.toObject()).filter(k => /stripe/i.test(k));\n const candidates = names.filter(k => /secret|api|key|token/i.test(k));\n let workingKey: string | null = null;\n for (const name of candidates) {\n const value = Deno.env.get(name);\n if (!value) continue;\n try {\n const stripe = new Stripe(value);\n const acct = await stripe.accounts.retrieve();\n if (acct?.id) { workingKey = name; break; }\n } catch { /* read-only probe only */ }\n }\n return {stripeEnvKeys:names, candidateCredentialKeys:candidates, readOnlyStripeAccountProbe:workingKey ? \"PASS\" : \"NOT_AVAILABLE\", credentialSource:workingKey ? workingKey : null};\n}\n",[167],"ad4547e1-dc43-453b-a9af-7e0bbd0baabe","stripe_bridge.ts","f1795386-a2ac-11f1-b0aa-1607ee4eb77e",9,["D",1787899952245],2,"import Stripe from \"npm:stripe\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst KEY = Deno.env.get(\"STRIPE_SECRET_KEY\");\nconst WHSEC = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\");\nconst APPROVAL = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\n\nasync function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS stripe_events (\n id TEXT PRIMARY KEY, type TEXT NOT NULL, created INTEGER NOT NULL,\n livemode INTEGER NOT NULL, payload TEXT NOT NULL, received_at TEXT NOT NULL\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS payment_evidence (\n evidence_id TEXT PRIMARY KEY, agent_id TEXT, customer_email TEXT,\n amount_total INTEGER, currency TEXT, payment_status TEXT,\n checkout_session_id TEXT, payment_intent_id TEXT, received_at TEXT NOT NULL,\n evidence_source TEXT NOT NULL\n )`);\n}\n\nexport default async function(req: Request): Promise {\n await ensureTables();\n const url = new URL(req.url);\n\n if (url.pathname === \"/status\") {\n return Response.json({\n stripeBridge:\"IMPERIAL_STRIPE_BRIDGE_v1\",\n apiCredential: KEY ? \"PRESENT\" : \"MISSING\",\n webhookSecret: WHSEC ? \"PRESENT\" : \"MISSING\",\n liveReady: Boolean(KEY && WHSEC),\n truthBoundary:\"No payment is counted without verified Stripe event evidence\"\n });\n }\n\n if (url.pathname === \"/create-checkout-session\" && req.method === \"POST\") {\n const supplied = req.headers.get(\"authorization\");\n if (!APPROVAL || supplied !== `Bearer ${APPROVAL}`) return Response.json({error:\"APPROVAL_REQUIRED\"},{status:401});\n if (!KEY) return Response.json({error:\"STRIPE_SECRET_KEY_MISSING\"},{status:503});\n const stripe = new Stripe(KEY);\n const body = await req.json().catch(()=>null) as any;\n const amountUsd = Number(body?.amount_usd);\n const description = String(body?.description ?? \"IMPERIAL Core service\");\n const agentId = String(body?.agent_id ?? \"UNKNOWN\");\n if (!Number.isFinite(amountUsd) || amountUsd <= 0 || amountUsd > 1000000) {\n return Response.json({error:\"INVALID_AMOUNT\"},{status:400});\n }\n const session = await stripe.checkout.sessions.create({\n mode:\"payment\",\n line_items:[{price_data:{currency:\"usd\",product_data:{name:description},unit_amount:Math.round(amountUsd*100)},quantity:1}],\n metadata:{agent_id:agentId, system:\"IMPERIAL Core\"},\n success_url:`${url.origin}/success?session_id={CHECKOUT_SESSION_ID}`,\n cancel_url:`${url.origin}/cancel`\n });\n return Response.json({id:session.id,url:session.url,status:session.status});\n }\n\n if (url.pathname === \"/webhook\" && req.method === \"POST\") {\n if (!KEY || !WHSEC) return Response.json({error:\"STRIPE_WEBHOOK_NOT_CONFIGURED\"},{status:503});\n const stripe = new Stripe(KEY);\n const signature = req.headers.get(\"stripe-signature\");\n if (!signature) return new Response(\"Missing signature\",{status:400});\n const raw = await req.text();\n let event: Stripe.Event;\n try { event = await stripe.webhooks.constructEventAsync(raw, signature, WHSEC); }\n catch { return new Response(\"Bad signature\",{status:400}); }\n await sqlite.execute({sql:`INSERT OR IGNORE INTO stripe_events(id,type,created,livemode,payload,received_at) VALUES(?,?,?,?,?,?)`,args:[event.id,event.type,event.created,event.livemode?1:0,raw,new Date().toISOString()]});\n if (event.type === \"checkout.session.completed\") {\n const s = event.data.object as Stripe.Checkout.Session;\n await sqlite.execute({sql:`INSERT OR REPLACE INTO payment_evidence(evidence_id,agent_id,customer_email,amount_total,currency,payment_status,checkout_session_id,payment_intent_id,received_at,evidence_source) VALUES(?,?,?,?,?,?,?,?,?,?)`,args:[event.id,String(s.metadata?.agent_id ?? \"UNKNOWN\"),String(s.customer_details?.email ?? \"\"),Number(s.amount_total ?? 0),String(s.currency ?? \"\"),String(s.payment_status ?? \"\"),s.id,String(s.payment_intent ?? \"\"),new Date().toISOString(),\"STRIPE_SIGNED_WEBHOOK\"]});\n }\n return Response.json({received:true,event_id:event.id,type:event.type});\n }\n\n if (url.pathname === \"/success\") return new Response(\"Payment received. Verification is being recorded.\");\n if (url.pathname === \"/cancel\") return new Response(\"Payment cancelled.\");\n return new Response(\"IMPERIAL Stripe Bridge\",{status:200});\n}\n",[175],"175c337f-5b33-48d8-bd3f-162adcb39b66","skill_status.ts","4621295a-a2d9-11f1-827b-1607ee4eb77e",86,["D",1787918949318],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport default async function(req: Request) {\n if (req.method !== \"GET\") return Response.json({error:\"METHOD_NOT_ALLOWED\"},{status:405});\n const agents = await sqlite.execute(`SELECT COUNT(*) AS n FROM agents`);\n const total = await sqlite.execute(`SELECT COUNT(*) AS n FROM skill_runtime_bindings WHERE runtime_state='ACTIVE_BOUNDED'`);\n const grouped = await sqlite.execute(`SELECT skill_id,skill_version,runtime_state,COUNT(*) AS agents\n FROM skill_runtime_bindings GROUP BY skill_id,skill_version,runtime_state ORDER BY skill_id`);\n const missing = await sqlite.execute(`SELECT COUNT(*) AS n FROM agents a WHERE NOT EXISTS (\n SELECT 1 FROM skill_runtime_bindings s WHERE s.agent_id=a.agent_id AND s.runtime_state='ACTIVE_BOUNDED'\n )`);\n return Response.json({\n service:\"IMPERIAL Skill Runtime Status\",\n agents:Number((agents.rows[0] as any)?.n ?? 0),\n activeBindings:Number((total.rows[0] as any)?.n ?? 0),\n skillSets:grouped.rows,\n agentsWithoutAnyActiveBinding:Number((missing.rows[0] as any)?.n ?? 0),\n authority:\"SKILLS_DO_NOT_GRANT_AUTHORITY\",\n truthBoundary:\"RUNTIME_BINDING_ACTIVE != EXTERNAL_ACTION_AUTHORITY != PRODUCTION\"\n },{headers:{\"cache-control\":\"no-store\",\"x-content-type-options\":\"nosniff\"}});\n}\n",[183],"9240f8af-38c8-44c3-a069-aa9d05ab3bd6","skill_runtime.ts","da5b5150-a2d8-11f1-9e48-1607ee4eb77e",93,["D",1787932523533],3,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst SKILLS = [\n [\"imperial-skill-accelerator\", \"fabric-v2\"],\n [\"imperial-skill-registry\", \"fabric-v2\"],\n [\"imperial-skill-eval-flywheel\", \"fabric-v2\"],\n [\"imperial-skill-security-gate\", \"fabric-v2\"],\n [\"imperial-skill-router\", \"fabric-v2\"],\n [\"imperial-skill-packager\", \"fabric-v2\"],\n [\"IMPERIAL-Skill-Galaxy-SALMAN\", \"2.0.0\"],\n [\"IMPERIAL-Adaptive-Capability-Engine\", \"3.0.0\"],\n [\"IMPERIAL-Revenue-Mission-Router\", \"4.1-LIVE\"],\n [\"IMPERIAL-Strategic-Search\", \"1.0-LIVE\"],\n [\"IMPERIAL-100-NCA-Mission\", \"4.1.0\"],\n] as const;\n\nexport async function ensureSkillRuntimeBindings(now = new Date().toISOString()) {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS skill_runtime_bindings (\n agent_id TEXT NOT NULL,\n skill_id TEXT NOT NULL,\n skill_version TEXT NOT NULL,\n runtime_state TEXT NOT NULL,\n authority_rule TEXT NOT NULL,\n activated_at TEXT NOT NULL,\n last_verified_at TEXT NOT NULL,\n PRIMARY KEY(agent_id, skill_id)\n )`);\n\n for (const [skillId, version] of SKILLS) {\n await sqlite.execute({\n sql:`INSERT INTO skill_runtime_bindings(agent_id,skill_id,skill_version,runtime_state,authority_rule,activated_at,last_verified_at)\n SELECT agent_id, ?, ?, 'ACTIVE_BOUNDED', 'SKILL_DOES_NOT_GRANT_AUTHORITY', ?, ? FROM agents WHERE 1=1\n ON CONFLICT(agent_id,skill_id) DO UPDATE SET\n skill_version=excluded.skill_version,\n runtime_state=excluded.runtime_state,\n authority_rule=excluded.authority_rule,\n last_verified_at=excluded.last_verified_at`,\n args:[skillId,version,now,now]\n });\n }\n\n const agents = await sqlite.execute(`SELECT COUNT(*) AS n FROM agents`);\n const summary = await sqlite.execute(`SELECT skill_id,skill_version,runtime_state,COUNT(*) AS agents\n FROM skill_runtime_bindings GROUP BY skill_id,skill_version,runtime_state ORDER BY skill_id`);\n return { agents: Number((agents.rows[0] as any)?.n ?? 0), bindings: summary.rows };\n}\n\nexport default async function () {\n const result = await ensureSkillRuntimeBindings();\n console.log(JSON.stringify({event:\"skill_runtime_activation\",...result,truth_boundary:\"RUNTIME_BINDING_ACTIVE != EXTERNAL_ACTION_AUTHORITY\"}));\n return result;\n}\n",[190],"0e1cc1c0-3454-47e6-a5a4-55c2f8c491c0","runner.ts","dc9ec438-a26a-11f1-8d34-1607ee4eb77e",95,["D",1787934014072],19,"interval","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ensureSkillRuntimeBindings } from \"./skill_runtime.ts\";\n\nconst START = \"2026-08-28T01:42:37+03:00\";\nconst END = \"2026-09-28T01:42:37+03:00\";\nconst ROUTER_VERSION = \"IMPERIAL-Revenue-Mission-Router-v4.1-LIVE\";\nconst SEARCH_VERSION = \"IMPERIAL-Strategic-Search-v1.0-LIVE\";\n\nfunction phase(day:number) {\n if (day <= 3) return \"OFFER_AND_PROOF\";\n if (day <= 7) return \"MARKET_VALIDATION\";\n if (day <= 14) return \"QUALIFIED_PIPELINE\";\n if (day <= 21) return \"DELIVERY_AND_CONVERSION\";\n if (day <= 28) return \"SCALE_PROVEN_CHANNELS\";\n return \"CLOSURE_AND_AUDIT\";\n}\n\ntype Route = {\n primary:string; fallback:string; buyer:string; proof:string; cashPath:string;\n margin:number; urgency:number; evidence:number; timeToCash:number; roleFit:number;\n};\n\nconst ROUTES:Record = {\n \"Kids Media\": {\n primary:\"B2B positive-media licensing / branded educational production\",\n fallback:\"paid localization or pilot-production package\",\n buyer:\"publishers, education platforms, family brands, broadcasters\",\n proof:\"pilot concept + story bible + safety/localization sample\",\n cashPath:\"paid pilot, production deposit, or licence deposit\",\n margin:0.78, urgency:0.58, evidence:0.72, timeToCash:0.63, roleFit:0.96\n },\n \"Dropshipping Commerce\": {\n primary:\"paid ecommerce growth diagnostic + implementation retainer\",\n fallback:\"validated product / merchandising operations package\",\n buyer:\"existing ecommerce operators and brands\",\n proof:\"store/product audit with sourced conversion and operations findings\",\n cashPath:\"paid diagnostic, then implementation retainer\",\n margin:0.72, urgency:0.82, evidence:0.78, timeToCash:0.84, roleFit:0.97\n },\n \"AI Automation\": {\n primary:\"high-ticket governed AI automation discovery + implementation\",\n fallback:\"workflow assessment and bounded prototype engagement\",\n buyer:\"SMEs and enterprise teams with repetitive high-cost workflows\",\n proof:\"workflow map + bounded prototype + eval + labelled ROI hypothesis\",\n cashPath:\"paid discovery or implementation deposit\",\n margin:0.88, urgency:0.82, evidence:0.82, timeToCash:0.78, roleFit:0.99\n },\n \"B2B Revenue\": {\n primary:\"paid RevOps / enterprise sales acceleration sprint\",\n fallback:\"account pipeline and proposal-system engagement\",\n buyer:\"B2B firms with measurable sales bottlenecks\",\n proof:\"funnel diagnosis + account map + proposal system\",\n cashPath:\"strategy sprint fee, then service retainer\",\n margin:0.84, urgency:0.90, evidence:0.84, timeToCash:0.86, roleFit:0.99\n },\n \"Creative & Digital\": {\n primary:\"premium digital production / licensing engagement\",\n fallback:\"paid concept, prototype, or design sprint\",\n buyer:\"brands, agencies, property, media and technology companies\",\n proof:\"portfolio-grade concept, prototype or visual demo\",\n cashPath:\"design/development deposit or licence fee\",\n margin:0.80, urgency:0.68, evidence:0.80, timeToCash:0.70, roleFit:0.97\n },\n \"Education\": {\n primary:\"B2B training / curriculum / enablement licence\",\n fallback:\"paid course-production or assessment-design package\",\n buyer:\"companies, schools, training providers, professional organizations\",\n proof:\"sample module + curriculum map + assessment plan\",\n cashPath:\"cohort/licence deposit or production fee\",\n margin:0.79, urgency:0.62, evidence:0.80, timeToCash:0.64, roleFit:0.98\n },\n \"Data & Market Intelligence\": {\n primary:\"paid market intelligence / competitive decision-support sprint\",\n fallback:\"research subscription or recurring intelligence brief\",\n buyer:\"operators, investors, product and strategy teams\",\n proof:\"sourced intelligence brief with confidence labels\",\n cashPath:\"paid research sprint or subscription prepayment\",\n margin:0.86, urgency:0.74, evidence:0.90, timeToCash:0.76, roleFit:0.99\n },\n \"SME Services\": {\n primary:\"paid operational diagnostic + transformation retainer\",\n fallback:\"bounded implementation package for one measurable constraint\",\n buyer:\"SMEs with measurable process, cost or growth constraints\",\n proof:\"diagnostic + control map + implementation roadmap\",\n cashPath:\"paid diagnostic, then implementation retainer\",\n margin:0.76, urgency:0.84, evidence:0.82, timeToCash:0.82, roleFit:0.98\n }\n};\n\nfunction routeScore(r:Route) {\n // Planning score only. Never a probability or revenue forecast.\n return 0.23*r.evidence + 0.22*r.roleFit + 0.20*r.timeToCash + 0.14*r.margin + 0.13*r.urgency + 0.08;\n}\n\nconst STAGES = [\n \"DEFINE_OFFER\",\n \"BUILD_PROOF\",\n \"QUALIFY_BUYERS\",\n \"PREPARE_APPROVED_OUTREACH\",\n \"HANDLE_RESPONSE_OR_RESEARCH_NEXT\",\n \"PREPARE_PROPOSAL_OR_PAID_DIAGNOSTIC\",\n \"DELIVER_OR_IMPROVE_PROOF\",\n \"VERIFY_EVIDENCE_AND_REPLAN\"\n] as const;\n\nfunction actionStage(stageIndex:number, day:number) {\n if (day >= 29) return \"AUDIT_AND_CLOSE\";\n return STAGES[Math.max(0, Math.min(STAGES.length-1, stageIndex))];\n}\n\nfunction nextAction(domain:string, stageIndex:number, day:number) {\n const r = ROUTES[domain];\n if (!r) return \"ROLE_ALIGNED_RESEARCH: define one lawful high-value offer and evidence plan\";\n const stage = actionStage(stageIndex, day);\n const m:Record = {\n DEFINE_OFFER:`lock one primary offer: ${r.primary}; keep only one fallback: ${r.fallback}`,\n BUILD_PROOF:`build/fact-check proof asset: ${r.proof}`,\n QUALIFY_BUYERS:`build a small qualified buyer queue matching: ${r.buyer}; no mass spam`,\n PREPARE_APPROVED_OUTREACH:`prepare personalized factual outreach drafts for qualified buyers; external send requires allowed connector/policy`,\n HANDLE_RESPONSE_OR_RESEARCH_NEXT:`process verified buyer replies if any; otherwise improve qualification using evidence, not volume`,\n PREPARE_PROPOSAL_OR_PAID_DIAGNOSTIC:`prepare a concrete paid proposal with cash path: ${r.cashPath}`,\n DELIVER_OR_IMPROVE_PROOF:`if a paid engagement exists, deliver governed scope; otherwise strengthen proof and buyer fit`,\n VERIFY_EVIDENCE_AND_REPLAN:`verify external evidence, reject pipeline-as-revenue, score route, then keep primary or switch to fallback`,\n AUDIT_AND_CLOSE:`audit lawful collected net revenue, evidence, refunds/chargebacks and unresolved obligations`\n };\n return `${stage}: ${m[stage]}`;\n}\n\nexport default async function (interval: Interval) {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS agents (\n agent_id TEXT PRIMARY KEY, domain TEXT NOT NULL, role TEXT NOT NULL,\n target_usd INTEGER NOT NULL DEFAULT 1000000, salman INTEGER NOT NULL DEFAULT 100,\n status TEXT NOT NULL DEFAULT 'ARMED', last_heartbeat TEXT,\n tick_count INTEGER NOT NULL DEFAULT 0, mission_day INTEGER NOT NULL DEFAULT 1,\n phase TEXT, next_action TEXT, network_ok INTEGER NOT NULL DEFAULT 0\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS routing_state (\n agent_id TEXT PRIMARY KEY,\n router_version TEXT NOT NULL,\n strategic_search_version TEXT NOT NULL,\n route_revision INTEGER NOT NULL DEFAULT 0,\n strategic_phase TEXT NOT NULL,\n action_stage TEXT NOT NULL,\n primary_route TEXT NOT NULL,\n fallback_route TEXT NOT NULL,\n buyer_profile TEXT NOT NULL,\n proof_asset TEXT NOT NULL,\n cash_path TEXT NOT NULL,\n planning_score REAL NOT NULL,\n next_action TEXT NOT NULL,\n next_action_at TEXT NOT NULL,\n approval_gate TEXT NOT NULL,\n evidence_gate TEXT NOT NULL,\n truth_boundary TEXT NOT NULL,\n last_replanned_at TEXT NOT NULL\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS agent_progress (\n agent_id TEXT PRIMARY KEY,\n stage_index INTEGER NOT NULL DEFAULT 0,\n stage_state TEXT NOT NULL DEFAULT 'WAITING_FOR_EVIDENCE',\n evidence_count INTEGER NOT NULL DEFAULT 0,\n last_evidence_ref TEXT,\n last_advanced_at TEXT\n )`);\n await sqlite.execute(`INSERT OR IGNORE INTO agent_progress(agent_id) SELECT agent_id FROM agents`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n agent_id TEXT NOT NULL,\n action_stage TEXT NOT NULL,\n next_action TEXT NOT NULL,\n connector TEXT NOT NULL,\n execution_state TEXT NOT NULL,\n created_at TEXT NOT NULL,\n updated_at TEXT NOT NULL,\n evidence_ref TEXT,\n permission_decision TEXT,\n permission_reason TEXT\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS codex_assist_profile (\n agent_id TEXT PRIMARY KEY,\n enabled INTEGER NOT NULL DEFAULT 1,\n preferred_model TEXT NOT NULL,\n reasoning_effort TEXT NOT NULL,\n allowed_tasks TEXT NOT NULL,\n authority_rule TEXT NOT NULL,\n status TEXT NOT NULL\n )`);\n await sqlite.execute(`INSERT OR IGNORE INTO codex_assist_profile(agent_id,enabled,preferred_model,reasoning_effort,allowed_tasks,authority_rule,status)\n SELECT agent_id,1,'ChatGPT Codex (Plus)','plan-managed','code,automation,integration,prototype,test,debug,data-pipeline,landing-page,technical-proof','CODEX_ASSIST_HAS_NO_INDEPENDENT_AUTHORITY','PLUS_ONLY' FROM agents`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS codex_assist_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n agent_id TEXT NOT NULL,\n mission_stage TEXT NOT NULL,\n task_type TEXT NOT NULL,\n objective TEXT NOT NULL,\n context TEXT,\n acceptance_criteria TEXT NOT NULL,\n state TEXT NOT NULL DEFAULT 'QUEUED_PLUS_HANDOFF',\n created_at TEXT NOT NULL,\n started_at TEXT,\n completed_at TEXT,\n result_ref TEXT,\n result_text TEXT,\n error TEXT\n )`);\n\n const now = new Date();\n const skillRuntime = await ensureSkillRuntimeBindings(now.toISOString());\n const start = new Date(START);\n const end = new Date(END);\n const day = Math.max(1, Math.min(31, Math.floor((now.getTime()-start.getTime())/86400000)+1));\n const active = now <= end;\n\n let networkOk = 0;\n const probes = [\n [\"https://www.cloudflare.com/cdn-cgi/trace\", {}],\n [\"https://api.github.com/zen\", {headers:{\"User-Agent\":\"IMPERIAL-Core-NCA-Runtime\"}}],\n ] as const;\n for (const [url, init] of probes) {\n try {\n const r = await fetch(url, {...init, signal: AbortSignal.timeout(5000)});\n if (r.ok) { networkOk = 1; break; }\n } catch { /* next independent probe */ }\n }\n\n const rows = await sqlite.execute(`SELECT a.agent_id,a.domain,a.tick_count,COALESCE(p.stage_index,0) AS stage_index,n.next_action AS navigator_next_action FROM agents a LEFT JOIN agent_progress p ON p.agent_id=a.agent_id LEFT JOIN revenue_navigator_state n ON n.agent_id=a.agent_id ORDER BY a.agent_id`);\n for (const row of rows.rows as any[]) {\n const id = String(row.agent_id);\n const d = String(row.domain);\n const stageIndex = Number(row.stage_index ?? 0);\n const r = ROUTES[d];\n const action = String(row.navigator_next_action ?? nextAction(d, stageIndex, day));\n const stage = actionStage(stageIndex, day);\n\n await sqlite.execute({sql:`UPDATE agents SET status=?, last_heartbeat=?, tick_count=tick_count+1,\n mission_day=?, phase=?, next_action=?, network_ok=? WHERE agent_id=?`,\n args:[active?\"RUNNING\":\"MISSION_ENDED\", now.toISOString(), day, phase(day), action, networkOk, id]});\n\n if (r) {\n await sqlite.execute({sql:`INSERT INTO routing_state(\n agent_id,router_version,strategic_search_version,route_revision,strategic_phase,action_stage,\n primary_route,fallback_route,buyer_profile,proof_asset,cash_path,planning_score,next_action,next_action_at,\n approval_gate,evidence_gate,truth_boundary,last_replanned_at)\n VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)\n ON CONFLICT(agent_id) DO UPDATE SET\n router_version=excluded.router_version,\n strategic_search_version=excluded.strategic_search_version,\n route_revision=routing_state.route_revision+1,\n strategic_phase=excluded.strategic_phase,\n action_stage=excluded.action_stage,\n primary_route=excluded.primary_route,\n fallback_route=excluded.fallback_route,\n buyer_profile=excluded.buyer_profile,\n proof_asset=excluded.proof_asset,\n cash_path=excluded.cash_path,\n planning_score=excluded.planning_score,\n next_action=excluded.next_action,\n next_action_at=excluded.next_action_at,\n approval_gate=excluded.approval_gate,\n evidence_gate=excluded.evidence_gate,\n truth_boundary=excluded.truth_boundary,\n last_replanned_at=excluded.last_replanned_at`,\n args:[id,ROUTER_VERSION,SEARCH_VERSION,1,phase(day),stage,r.primary,r.fallback,r.buyer,r.proof,r.cashPath,\n routeScore(r),action,now.toISOString(),\n \"EXTERNAL_SEND_SPEND_SIGN_OR_IRREVERSIBLE_ACTION_REQUIRES_ALLOWED_AUTHORITY\",\n \"COUNT_ONLY_LAWFUL_EXTERNALLY_EVIDENCED_COLLECTED_NET_REVENUE\",\n \"PLANNING_SCORE_IS_NOT_REVENUE_FORECAST_OR_GUARANTEE\",now.toISOString()]});\n }\n }\n\n await sqlite.execute(`UPDATE execution_queue\n SET execution_state='SUPERSEDED', updated_at=?\n WHERE execution_state='READY'\n AND EXISTS (\n SELECT 1 FROM routing_state rs\n WHERE rs.agent_id=execution_queue.agent_id\n AND (rs.action_stage<>execution_queue.action_stage OR rs.next_action<>execution_queue.next_action)\n )`, [now.toISOString()]);\n\n await sqlite.execute(`INSERT INTO execution_queue(\n agent_id,action_stage,next_action,connector,execution_state,created_at,updated_at,permission_decision,permission_reason\n )\n SELECT rs.agent_id,rs.action_stage,rs.next_action,\n CASE\n WHEN rs.action_stage IN ('DEFINE_OFFER','BUILD_PROOF','QUALIFY_BUYERS','HANDLE_RESPONSE_OR_RESEARCH_NEXT','VERIFY_EVIDENCE_AND_REPLAN') THEN 'RESEARCH_CRM'\n WHEN rs.action_stage='PREPARE_APPROVED_OUTREACH' THEN 'GMAIL_DRAFT'\n WHEN rs.action_stage='PREPARE_PROPOSAL_OR_PAID_DIAGNOSTIC' THEN 'CRM_STRIPE_PREP'\n ELSE 'RUNTIME_INTERNAL'\n END,\n 'READY',?,?,'ALLOW','STANDING_DELEGATION_L1_OR_PREPARATION'\n FROM routing_state rs\n WHERE NOT EXISTS (\n SELECT 1 FROM execution_queue q\n WHERE q.agent_id=rs.agent_id\n AND q.action_stage=rs.action_stage\n AND q.next_action=rs.next_action\n AND q.execution_state IN ('READY','CLAIMED')\n )`, [now.toISOString(),now.toISOString()]);\n\n await sqlite.execute(`INSERT INTO codex_assist_queue(agent_id,mission_stage,task_type,objective,context,acceptance_criteria,state,created_at)\n SELECT rs.agent_id,rs.action_stage,\n CASE WHEN rs.action_stage='BUILD_PROOF' THEN 'TECHNICAL_PROOF' ELSE 'DELIVERY_AUTOMATION' END,\n CASE WHEN rs.action_stage='BUILD_PROOF'\n THEN 'Create the smallest implementation-ready technical artifact that materially strengthens this proof asset: ' || rs.proof_asset\n ELSE 'Implement or improve the technical delivery needed for the proven engagement without expanding business scope.' END,\n 'Primary route: ' || rs.primary_route || '\\nBuyer: ' || rs.buyer_profile || '\\nCash path: ' || rs.cash_path || '\\nNCA next action: ' || rs.next_action,\n 'Return implementation-ready code/design, explicit assumptions, test plan, security checks, and completion evidence. Do not contact buyers, spend money, sign, or claim revenue.',\n 'QUEUED_PLUS_HANDOFF',?\n FROM routing_state rs\n JOIN codex_assist_profile cp ON cp.agent_id=rs.agent_id AND cp.enabled=1\n WHERE rs.action_stage IN ('BUILD_PROOF','DELIVER_OR_IMPROVE_PROOF')\n AND NOT EXISTS (\n SELECT 1 FROM codex_assist_queue cq\n WHERE cq.agent_id=rs.agent_id AND cq.mission_stage=rs.action_stage\n AND cq.state IN ('QUEUED_PLUS_HANDOFF','HANDOFF_RUNNING','COMPLETED')\n )`, [now.toISOString()]);\n\n console.log(JSON.stringify({\n runtime:\"IMPERIAL_NCA_BOOTSTRAP\",\n agents:rows.rows.length,\n missionDay:day,\n router:ROUTER_VERSION,\n strategicSearch:SEARCH_VERSION,\n routedAgents:rows.rows.length,\n networkOk,\n at:now.toISOString()\n }));\n}\n",[198],"5b1eefe8-2f5d-4f03-ac20-bf7384a2913e","proof_catalog.ts","3a5dbc9c-a2b5-11f1-b6ed-1607ee4eb77e",45,["D",1787903467682],"const proofs: Record = {\n \"Kids Media\": {artifact:\"Positive Media Licensing Proof Pack\",deliverable:\"pilot concept + story bible + child-safety/localization checklist\",demonstrates:[\"positive-world creative development\",\"brand-safe content structure\",\"localization-ready production brief\"],truth:\"Capability demonstrator only; no audience or revenue claim.\"},\n \"Dropshipping Commerce\": {artifact:\"Ecommerce Growth Diagnostic Proof Pack\",deliverable:\"store audit framework + merchandising checklist + conversion hypothesis ledger\",demonstrates:[\"structured ecommerce diagnosis\",\"evidence-labelled conversion hypotheses\",\"implementation-retainer scoping\"],truth:\"No conversion uplift claimed without measured client data.\"},\n \"AI Automation\": {artifact:\"Governed AI Automation Proof Pack\",deliverable:\"workflow map + bounded automation architecture + eval/security checklist\",demonstrates:[\"workflow decomposition\",\"governed automation design\",\"test and rollback planning\"],truth:\"ROI remains a hypothesis until measured against a real client baseline.\"},\n \"B2B Revenue\": {artifact:\"RevOps Acceleration Proof Pack\",deliverable:\"funnel diagnosis template + account map + proposal-system blueprint\",demonstrates:[\"pipeline bottleneck analysis\",\"account prioritization\",\"proposal workflow design\"],truth:\"No pipeline or revenue is counted as collected revenue.\"},\n \"Creative & Digital\": {artifact:\"Premium Digital Prototype Proof Pack\",deliverable:\"concept brief + prototype specification + acceptance-test checklist\",demonstrates:[\"premium concept development\",\"prototype scoping\",\"production-quality acceptance criteria\"],truth:\"Portfolio demonstrator; no fabricated client endorsement.\"},\n \"Education\": {artifact:\"B2B Learning License Proof Pack\",deliverable:\"sample module structure + curriculum map + assessment blueprint\",demonstrates:[\"instructional architecture\",\"assessment alignment\",\"license-ready packaging\"],truth:\"Learning outcomes require real learner evaluation before claims.\"},\n \"Data & Market Intelligence\": {artifact:\"Decision Intelligence Proof Pack\",deliverable:\"source register + confidence-labelled brief template + decision matrix\",demonstrates:[\"source discipline\",\"confidence labelling\",\"decision-oriented synthesis\"],truth:\"No unsourced market facts or investment recommendations.\"},\n \"SME Services\": {artifact:\"Operational Diagnostic Proof Pack\",deliverable:\"constraint map + control checklist + implementation roadmap\",demonstrates:[\"process diagnosis\",\"risk/control mapping\",\"bounded transformation planning\"],truth:\"Savings or growth claims require client evidence.\"}\n};\n\nexport default async function(req: Request): Promise {\n const u = new URL(req.url);\n const domain = u.searchParams.get(\"domain\");\n if (domain) {\n const proof = proofs[domain];\n if (!proof) return Response.json({error:\"UNKNOWN_DOMAIN\"},{status:404});\n return Response.json({system:\"IMPERIAL Core\",evidenceClass:\"LIVE_CAPABILITY_PROOF\",domain,...proof,generatedAt:new Date().toISOString()});\n }\n return Response.json({system:\"IMPERIAL Core\",evidenceClass:\"LIVE_CAPABILITY_PROOF_CATALOG\",count:Object.keys(proofs).length,proofs,truthBoundary:\"These are capability demonstrators, not customer results, revenue evidence, endorsements, or guarantees.\"});\n}\n",[207],"580af7a4-bc8b-44b0-86d4-121489353cf6","permission_manager_test.ts","be90b732-a2ae-11f1-9817-1607ee4eb77e",21,["D",1787900699441],"import { decidePermission } from './permission_manager.ts';\n\nconst base = {missionBound:true,runtimeDomainBound:true,capabilityAllowed:true,guardianPass:true};\nconst privateAction = decidePermission({...base,approvalGrantPresent:false,reversiblePrivateWorkspaceAction:true,externalSend:false,financialOrIrreversible:false});\nconst externalSend = decidePermission({...base,approvalGrantPresent:false,reversiblePrivateWorkspaceAction:false,externalSend:true,financialOrIrreversible:false});\nconst externalSendGranted = decidePermission({...base,approvalGrantPresent:true,reversiblePrivateWorkspaceAction:false,externalSend:true,financialOrIrreversible:false});\nconst spend = decidePermission({...base,approvalGrantPresent:false,reversiblePrivateWorkspaceAction:false,externalSend:false,financialOrIrreversible:true});\nconst badMission = decidePermission({...base,missionBound:false,approvalGrantPresent:true,reversiblePrivateWorkspaceAction:true,externalSend:false,financialOrIrreversible:false});\nif (privateAction!=='ALLOW') throw new Error('privateAction');\nif (externalSend!=='APPROVAL_REQUIRED') throw new Error('externalSend');\nif (externalSendGranted!=='ALLOW') throw new Error('externalSendGranted');\nif (spend!=='APPROVAL_REQUIRED') throw new Error('spend');\nif (badMission!=='DENY') throw new Error('badMission');\nconsole.log(JSON.stringify({tests:'5/5 PASS',privateAction,externalSend,externalSendGranted,spend,badMission}));\n",[214],"596600c2-4e45-4cf3-9f86-92bc8b64c769","permission_manager.ts","3bc80526-a2ae-11f1-9cf5-1607ee4eb77e",10,["D",1787900463602],"export type Decision = 'ALLOW'|'APPROVAL_REQUIRED'|'DENY';\n\nexport type PermissionContext = {\n missionBound: boolean;\n runtimeDomainBound: boolean;\n capabilityAllowed: boolean;\n guardianPass: boolean;\n approvalGrantPresent: boolean;\n reversiblePrivateWorkspaceAction: boolean;\n externalSend: boolean;\n financialOrIrreversible: boolean;\n};\n\nexport function decidePermission(c: PermissionContext): Decision {\n if (!c.missionBound || !c.runtimeDomainBound || !c.capabilityAllowed || !c.guardianPass) return 'DENY';\n if (c.financialOrIrreversible) return c.approvalGrantPresent ? 'ALLOW' : 'APPROVAL_REQUIRED';\n if (c.externalSend) return c.approvalGrantPresent ? 'ALLOW' : 'APPROVAL_REQUIRED';\n if (c.reversiblePrivateWorkspaceAction) return 'ALLOW';\n return c.approvalGrantPresent ? 'ALLOW' : 'APPROVAL_REQUIRED';\n}\n\nexport const CANON = {\n component: 'IMPERIAL Permission Manager',\n version: '1.0-LIVE',\n effectiveAuthority: 'Mission Authority ∩ AI Passport ∩ EIS ∩ Runtime Domain Policy ∩ Guardian Core ∩ Approval Gateway',\n delegationRule: 'Child Authority ⊆ Parent Mission Authority',\n noBypass: true,\n};\n",[221],"33ab9d37-3c69-4f0c-92a3-42fd8d278649","execution_bridge_security_test.ts","8b9f1f32-a2d4-11f1-88be-1607ee4eb77e",76,["D",1787916918431],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { bridgeRequest } from \"./execution_bridge_client.ts\";\n\nconst ENDPOINT = \"https://oromaskevic23--4ca6bf4aa2ae11f1a3f01607ee4eb77e.web.val.run\";\nconst RESULT_KEY = \"evidence/execution-bridge/security-live.json\";\n\nasync function status(path: string, init: RequestInit = {}) {\n const response = await fetch(ENDPOINT + path, { ...init, signal: AbortSignal.timeout(25_000) });\n return response.status;\n}\n\nasync function main() {\n const unauthorizedReady = await status(\"/execution-bridge/ready?limit=1\");\n const legacyQueue = await status(\"/queue\");\n const forged = await bridgeRequest(\"GET\", \"/execution-bridge/ready?limit=1\", \"QUEUE_READ\", null, {\n signature: \"0\".repeat(64),\n });\n const timestamp = new Date().toISOString();\n const nonce = \"replaysecurity\" + crypto.randomUUID().replaceAll(\"-\", \"\");\n const first = await bridgeRequest(\"GET\", \"/execution-bridge/ready?limit=1\", \"QUEUE_READ\", null, { timestamp, nonce });\n const replay = await bridgeRequest(\"GET\", \"/execution-bridge/ready?limit=1\", \"QUEUE_READ\", null, { timestamp, nonce });\n const oversized = await status(\"/execution-bridge/claim\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: \"x\".repeat(17 * 1024),\n });\n const result = {\n unauthorizedGovernedDenied: unauthorizedReady === 401,\n legacyQueueProtected: legacyQueue === 401,\n forgedSignatureDenied: forged.status === 401,\n validScopedRead: first.status === 200,\n replayDenied: replay.status === 409,\n oversizedPayloadDenied: oversized === 413,\n statuses: { unauthorizedReady, legacyQueue, forged: forged.status, first: first.status, replay: replay.status, oversized },\n secretExposed: false,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[228],"a9029950-1ae5-410a-88bc-2f384c0652f3","execution_bridge_finalize_concurrency_test.ts","d550a746-a319-11f1-9eed-1607ee4eb77e",101,["D",1787946677336],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { bridgeRequest } from \"./execution_bridge_client.ts\";\n\nconst RESULT_KEY = \"evidence/execution-bridge/finalize-concurrency-live.json\";\n\nasync function main() {\n const ready = await bridgeRequest(\"GET\", \"/execution-bridge/ready?limit=100\", \"QUEUE_READ\");\n const items = ready.ok && Array.isArray(ready.body.items) ? ready.body.items as Record[] : [];\n const candidate = items.find((item) =>\n item.task_type === \"RESEARCH_CRM\" &&\n Number(item.queue_item_id) !== 721 &&\n (item.sanitized_task_payload as Record | undefined)?.prompt_injection_detected === false\n );\n if (!candidate) {\n const result = { exactlyOneFinalize: false, skipped: true, reason: \"NO_SAFE_READY_ITEM\", secretExposed: false, recordedAt: new Date().toISOString() };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n }\n const claimed = await bridgeRequest(\"POST\", \"/execution-bridge/claim\", \"QUEUE_CLAIM\", {\n queue_item_id: Number(candidate.queue_item_id),\n lease_seconds: 300,\n });\n const claim = claimed.body.claim as Record | undefined;\n if (!claimed.ok || !claim) {\n const result = { exactlyOneFinalize: false, skipped: true, reason: \"CLAIM_FAILED\", claimStatus: claimed.status, secretExposed: false, recordedAt: new Date().toISOString() };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n }\n const claimId = String(claim.claim_id);\n const releases = await Promise.all([\n bridgeRequest(\"POST\", \"/execution-bridge/release\", \"QUEUE_RELEASE\", {\n claim_id: claimId,\n request_id: \"req-finalize-race-a-\" + String(candidate.queue_item_id),\n reason: \"CONCURRENCY_TEST_RELEASE\",\n }),\n bridgeRequest(\"POST\", \"/execution-bridge/release\", \"QUEUE_RELEASE\", {\n claim_id: claimId,\n request_id: \"req-finalize-race-b-\" + String(candidate.queue_item_id),\n reason: \"CONCURRENCY_TEST_RELEASE\",\n }),\n ]);\n const winners = releases.filter((response) => response.ok && response.body.updated === true);\n const result = {\n exactlyOneFinalize: winners.length === 1,\n queue_item_id: Number(candidate.queue_item_id),\n claim_id: claimId,\n statuses: releases.map((response) => ({ status: response.status, updated: response.body.updated === true, error: response.body.error ?? null })),\n resulting_state: winners[0]?.body.state ?? null,\n agent_progress_updated: winners[0]?.body.agent_progress_updated ?? null,\n secretExposed: false,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[235],"b9b3d9b5-6161-4215-a36e-c36f80939825","execution_bridge_concurrency_test.ts","8b53b876-a2d4-11f1-bcfa-1607ee4eb77e",75,["D",1787916917938],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { bridgeRequest } from \"./execution_bridge_client.ts\";\n\nconst RESULT_KEY = \"evidence/execution-bridge/concurrency-live.json\";\n\nasync function main() {\n const ready = await bridgeRequest(\"GET\", \"/execution-bridge/ready?limit=100\", \"QUEUE_READ\");\n const items = ready.ok && Array.isArray(ready.body.items) ? ready.body.items as Record[] : [];\n const candidate = items.find((item) =>\n item.task_type === \"RESEARCH_CRM\" &&\n (item.sanitized_task_payload as Record | undefined)?.prompt_injection_detected === false\n );\n if (!candidate) {\n const result = { exactlyOneClaim: false, skipped: true, reason: \"NO_ELIGIBLE_RESEARCH_CRM_ITEM\", readyCount: items.length, secretExposed: false, recordedAt: new Date().toISOString() };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n }\n\n const payload = { queue_item_id: Number(candidate.queue_item_id), lease_seconds: 900 };\n const attempts = await Promise.all([\n bridgeRequest(\"POST\", \"/execution-bridge/claim\", \"QUEUE_CLAIM\", payload),\n bridgeRequest(\"POST\", \"/execution-bridge/claim\", \"QUEUE_CLAIM\", payload),\n ]);\n const winners = attempts.filter((attempt) => attempt.ok && attempt.body.claimed === true);\n const result = {\n exactlyOneClaim: winners.length === 1,\n skipped: false,\n queueItem: candidate,\n attemptStatuses: attempts.map((attempt) => ({ status: attempt.status, claimed: attempt.body.claimed === true, error: attempt.body.error ?? null })),\n winner: winners[0]?.body ?? null,\n secretExposed: false,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[242],"485bef00-092f-48ca-aac9-9bed7d3e9979","execution_bridge_client.ts","6a00e87e-a2d4-11f1-b06e-1607ee4eb77e",79,["D",1787917158058],"const BRIDGE_ENDPOINT = \"https://oromaskevic23--4ca6bf4aa2ae11f1a3f01607ee4eb77e.web.val.run\";\nconst SERVICE_ID = \"VAL_TOWN_CODEX_CONNECTOR\";\nconst CAPABILITIES = new Set([\"QUEUE_READ\",\"QUEUE_CLAIM\",\"QUEUE_COMPLETE\",\"QUEUE_FAIL\",\"QUEUE_RELEASE\",\"QUEUE_AUDIT_READ\"]);\n\nexport type BridgeCapability = \"QUEUE_READ\"|\"QUEUE_CLAIM\"|\"QUEUE_COMPLETE\"|\"QUEUE_FAIL\"|\"QUEUE_RELEASE\"|\"QUEUE_AUDIT_READ\";\nexport type BridgeResponse = { ok: boolean; status: number; body: Record };\n\nfunction secret(): string {\n const value = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\n if (!value) throw new Error(\"SERVER_AUTH_UNAVAILABLE\");\n return value;\n}\nfunction utf8(value: string): Uint8Array { return new TextEncoder().encode(value); }\nasync function sha256(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", utf8(value));\n return \"sha256:\" + [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function hmac(value: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", utf8(secret()), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n const signature = await crypto.subtle.sign(\"HMAC\", key, utf8(value));\n return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction nonce(): string { return crypto.randomUUID().replaceAll(\"-\", \"\") + crypto.randomUUID().slice(0, 8); }\n\nexport async function bridgeRequest(\n method: \"GET\"|\"POST\",\n path: string,\n capability: BridgeCapability,\n payload: Record|null = null,\n testOverride: { timestamp?: string; nonce?: string; signature?: string } = {},\n): Promise {\n if (!CAPABILITIES.has(capability)) throw new Error(\"CAPABILITY_NOT_ALLOWED\");\n if (!path.startsWith(\"/execution-bridge/\")) throw new Error(\"PATH_NOT_ALLOWED\");\n const body = payload === null ? \"\" : JSON.stringify(payload);\n const timestamp = testOverride.timestamp ?? new Date().toISOString();\n const requestNonce = testOverride.nonce ?? nonce();\n const canonical = [method,path,timestamp,requestNonce,SERVICE_ID,capability,await sha256(body)].join(\"\\n\");\n const signature = testOverride.signature ?? await hmac(canonical);\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 25_000);\n try {\n const response = await fetch(BRIDGE_ENDPOINT + path, {\n method,\n headers: {\n \"content-type\": \"application/json\",\n \"x-imperial-service-id\": SERVICE_ID,\n \"x-imperial-capability\": capability,\n \"x-imperial-timestamp\": timestamp,\n \"x-imperial-nonce\": requestNonce,\n \"x-imperial-signature\": signature,\n },\n body: method === \"POST\" ? body : undefined,\n signal: controller.signal,\n });\n const text = await response.text();\n let parsed: Record;\n try { parsed = JSON.parse(text); } catch { parsed = { error: \"NON_JSON_BRIDGE_RESPONSE\" }; }\n return { ok: response.ok, status: response.status, body: parsed };\n } finally {\n clearTimeout(timeout);\n }\n}\n\nexport default async function () {\n return {\n service_id: SERVICE_ID,\n transport: \"SERVER_SIDE_SCOPED_HMAC\",\n secret_configured: Boolean(Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\")),\n secret_exposed: false,\n capabilities: [...CAPABILITIES],\n };\n}\n",[249],"03008c36-dedf-498a-a223-da7054aa261d",["D",1787946735811],[27],"66259f1b-500c-4949-9863-86c4f3264ec9","execution_bridge.ts","4ca6bf4a-a2ae-11f1-a3f0-1607ee4eb77e",100,["D",1787946656802],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst POLICY_VERSION = \"IMPERIAL-EXECUTION-BRIDGE-2.0.0\";\nconst MISSION_ID = \"IC-IMPERIAL-NCA-31DAY-COMMERCIAL-RUNTIME-001\";\nconst SERVICE_ID = \"VAL_TOWN_CODEX_CONNECTOR\";\nconst PASSPORT_ID = \"AI-PASSPORT-HANTER-EXECUTION-CONNECTOR-001\";\nconst SERVICE_EXPIRES_AT = \"2026-09-27T22:42:37.000Z\";\nconst APPROVAL_EXPIRES_AT = \"2026-09-27T22:42:37.000Z\";\nconst MAX_BODY_BYTES = 16 * 1024;\nconst MAX_TASK_CHARS = 4096;\nconst ALLOWED_PERMISSION_REASON = \"STANDING_DELEGATION_L1_OR_PREPARATION\";\nconst CAPABILITIES = new Set([\n \"QUEUE_READ\",\n \"QUEUE_CLAIM\",\n \"QUEUE_COMPLETE\",\n \"QUEUE_FAIL\",\n \"QUEUE_RELEASE\",\n \"QUEUE_AUDIT_READ\",\n]);\nconst DOMAINS = new Map([\n [\"Kids Media\", [\"ORCH-KIDS-MEDIA-001\", \"RD-KIDS-MEDIA-001\"]],\n [\"Dropshipping Commerce\", [\"ORCH-DROPSHIPPING-001\", \"RD-DROPSHIPPING-001\"]],\n [\"AI Automation\", [\"ORCH-AI-AUTOMATION-001\", \"RD-AI-AUTOMATION-001\"]],\n [\"B2B Revenue\", [\"ORCH-B2B-REVENUE-001\", \"RD-B2B-REVENUE-001\"]],\n [\"Creative & Digital\", [\"ORCH-CREATIVE-DIGITAL-001\", \"RD-CREATIVE-DIGITAL-001\"]],\n [\"Education\", [\"ORCH-EDUCATION-001\", \"RD-EDUCATION-001\"]],\n [\"Data & Market Intelligence\", [\"ORCH-DATA-MARKET-001\", \"RD-DATA-MARKET-001\"]],\n [\"SME Services\", [\"ORCH-SME-SERVICES-001\", \"RD-SME-SERVICES-001\"]],\n]);\nconst INJECTION_PATTERNS = [\n /ignore (?:all |any )?(?:previous|prior|system) instructions/i,\n /(?:this is |treat (?:this|the following) as )(?:a )?system message/i,\n /(?:the )?architect (?:has )?approved/i,\n /reveal (?:the )?(?:system prompt|secrets?|credentials?)/i,\n /(?:execute|run) (?:this |the )?(?:command|code|script)/i,\n /bypass (?:the )?(?:approval|guardian|security|policy)/i,\n];\n\ntype Capability = \"QUEUE_READ\" | \"QUEUE_CLAIM\" | \"QUEUE_COMPLETE\" | \"QUEUE_FAIL\" | \"QUEUE_RELEASE\" | \"QUEUE_AUDIT_READ\";\ntype AuditType =\n | \"QUEUE_READY_READ\"\n | \"QUEUE_ITEM_CLAIMED\"\n | \"QUEUE_CLAIM_REJECTED\"\n | \"QUEUE_ITEM_COMPLETED\"\n | \"QUEUE_ITEM_FAILED\"\n | \"QUEUE_ITEM_RELEASED\"\n | \"QUEUE_CLAIM_EXPIRED\"\n | \"QUEUE_AUDIT_READ\"\n | \"AUTHORIZATION_DENIED\";\n\nfunction secret(): string {\n const value = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\n if (!value) throw new Error(\"SERVER_AUTH_UNAVAILABLE\");\n return value;\n}\n\nfunction utf8(value: string): Uint8Array {\n return new TextEncoder().encode(value);\n}\n\nasync function sha256(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", utf8(value));\n return \"sha256:\" + [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hmac(value: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n utf8(secret()),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const signature = await crypto.subtle.sign(\"HMAC\", key, utf8(value));\n return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqual(left: string, right: string): boolean {\n if (left.length !== right.length || !/^[a-f0-9]+$/.test(left) || !/^[a-f0-9]+$/.test(right)) return false;\n let difference = 0;\n for (let index = 0; index < left.length; index += 1) {\n difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n }\n return difference === 0;\n}\n\nfunction json(data: unknown, status = 200): Response {\n return Response.json(data, {\n status,\n headers: {\n \"cache-control\": \"no-store\",\n \"x-content-type-options\": \"nosniff\",\n },\n });\n}\n\nfunction exactObject(value: unknown, required: string[], optional: string[] = []): Record | null {\n if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n const object = value as Record;\n const allowed = new Set([...required, ...optional]);\n if (required.some((key) => !Object.hasOwn(object, key))) return null;\n if (Object.keys(object).some((key) => !allowed.has(key))) return null;\n return object;\n}\n\nfunction safeIdentifier(value: unknown, minimum = 8, maximum = 128): string | null {\n if (typeof value !== \"string\" || value.length < minimum || value.length > maximum) return null;\n return /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value) ? value : null;\n}\n\nfunction safeEvidenceRef(value: unknown): string | null {\n if (typeof value !== \"string\" || value.length > 2048) return null;\n return /^(?:urn:evidence:|https:\\/\\/)[^\\s]{8,2048}$/.test(value) ? value : null;\n}\n\nfunction safeHash(value: unknown): string | null {\n return typeof value === \"string\" && /^sha256:[a-f0-9]{64}$/.test(value) ? value : null;\n}\n\nfunction sanitizeTask(value: unknown) {\n const original = typeof value === \"string\" ? value : \"\";\n const normalized = original\n .replace(/[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f]/g, \" \")\n .trim();\n const text = normalized.slice(0, MAX_TASK_CHARS);\n return {\n text,\n trust: \"UNTRUSTED_TASK_DATA\",\n authority: \"NONE\",\n prompt_injection_detected: INJECTION_PATTERNS.some((pattern) => pattern.test(text)),\n truncated: normalized.length > MAX_TASK_CHARS,\n };\n}\n\nasync function addColumn(name: string, definition: string) {\n try {\n await sqlite.execute(`ALTER TABLE execution_queue ADD COLUMN ${name} ${definition}`);\n } catch (error) {\n if (!String(error).toLowerCase().includes(\"duplicate column\")) throw error;\n }\n}\n\nasync function ensureSchema() {\n await addColumn(\"mission_id\", \"TEXT\");\n await addColumn(\"orchestrator_id\", \"TEXT\");\n await addColumn(\"runtime_domain\", \"TEXT\");\n await addColumn(\"guardian_state\", \"TEXT\");\n await addColumn(\"approval_state\", \"TEXT\");\n await addColumn(\"approval_decision_id\", \"TEXT\");\n await addColumn(\"approval_expires_at\", \"TEXT\");\n await addColumn(\"approval_revoked_at\", \"TEXT\");\n await addColumn(\"policy_version\", \"TEXT\");\n await addColumn(\"retriable\", \"INTEGER NOT NULL DEFAULT 1\");\n await addColumn(\"authorization_binding\", \"TEXT\");\n await addColumn(\"claim_id\", \"TEXT\");\n await addColumn(\"claimed_by\", \"TEXT\");\n await addColumn(\"claimed_at\", \"TEXT\");\n await addColumn(\"claim_expires_at\", \"TEXT\");\n await addColumn(\"authorization_decision_id\", \"TEXT\");\n await addColumn(\"failure_reason\", \"TEXT\");\n await addColumn(\"failure_retriable\", \"INTEGER\");\n await addColumn(\"completion_request_id\", \"TEXT\");\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_bridge_claims (\n claim_id TEXT PRIMARY KEY,\n queue_item_id INTEGER NOT NULL,\n claimed_by TEXT NOT NULL,\n passport_id TEXT NOT NULL,\n agent_id TEXT NOT NULL,\n orchestrator_id TEXT NOT NULL,\n runtime_domain TEXT NOT NULL,\n claimed_at TEXT NOT NULL,\n claim_expires_at TEXT NOT NULL,\n authorization_decision_id TEXT NOT NULL,\n state TEXT NOT NULL,\n retriable INTEGER NOT NULL,\n completed_at TEXT,\n failure_reason TEXT\n )`);\n await sqlite.execute(`CREATE UNIQUE INDEX IF NOT EXISTS execution_bridge_one_active_claim\n ON execution_bridge_claims(queue_item_id) WHERE state='ACTIVE'`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_bridge_nonces (\n nonce TEXT PRIMARY KEY,\n service_id TEXT NOT NULL,\n capability TEXT NOT NULL,\n used_at TEXT NOT NULL,\n expires_at TEXT NOT NULL\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_bridge_requests (\n request_id TEXT PRIMARY KEY,\n operation TEXT NOT NULL,\n claim_id TEXT NOT NULL,\n service_id TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_bridge_audit (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n event_id TEXT NOT NULL UNIQUE,\n event_type TEXT NOT NULL,\n timestamp TEXT NOT NULL,\n queue_item_id INTEGER,\n claim_id TEXT,\n request_id TEXT,\n service_id TEXT NOT NULL,\n passport_id TEXT NOT NULL,\n agent_id TEXT,\n orchestrator_id TEXT,\n runtime_domain TEXT,\n authorization_decision_id TEXT NOT NULL,\n previous_state TEXT,\n new_state TEXT,\n result TEXT NOT NULL,\n reason_code TEXT NOT NULL,\n evidence_ref TEXT,\n evidence_sha256 TEXT,\n event_hash TEXT NOT NULL,\n event_signature TEXT NOT NULL\n )`);\n await sqlite.execute(`CREATE TRIGGER IF NOT EXISTS execution_bridge_audit_no_update\n BEFORE UPDATE ON execution_bridge_audit BEGIN SELECT RAISE(ABORT, 'AUDIT_IMMUTABLE'); END`);\n await sqlite.execute(`CREATE TRIGGER IF NOT EXISTS execution_bridge_audit_no_delete\n BEFORE DELETE ON execution_bridge_audit BEGIN SELECT RAISE(ABORT, 'AUDIT_IMMUTABLE'); END`);\n await bindUnboundQueueItems();\n}\n\nfunction domainBinding(domain: string): [string, string] | null {\n return (DOMAINS.get(domain) as [string, string] | undefined) ?? null;\n}\n\nasync function queueBinding(row: Record, orchestratorId: string, runtimeDomain: string): Promise {\n return await hmac(JSON.stringify([\n \"QUEUE_AUTHORIZATION_BINDING_V2\",\n row.id,\n row.agent_id,\n row.action_stage,\n row.next_action,\n row.connector,\n row.created_at,\n row.permission_decision,\n row.permission_reason,\n MISSION_ID,\n orchestratorId,\n runtimeDomain,\n \"PASS\",\n \"ACTIVE\",\n `PM-${row.id}-${row.created_at}`,\n APPROVAL_EXPIRES_AT,\n POLICY_VERSION,\n ]));\n}\n\nasync function bindUnboundQueueItems() {\n const rows = await sqlite.execute(`SELECT q.id,q.agent_id,q.action_stage,q.next_action,q.connector,q.created_at,\n q.permission_decision,q.permission_reason,a.domain\n FROM execution_queue q JOIN agents a ON a.agent_id=q.agent_id\n WHERE q.authorization_binding IS NULL`);\n for (const row of rows.rows as Record[]) {\n if (row.permission_decision !== \"ALLOW\" || row.permission_reason !== ALLOWED_PERMISSION_REASON) continue;\n const binding = domainBinding(String(row.domain));\n if (!binding) continue;\n const [orchestratorId, runtimeDomain] = binding;\n const approvalDecisionId = `PM-${row.id}-${row.created_at}`;\n const authorizationBinding = await queueBinding(row, orchestratorId, runtimeDomain);\n await sqlite.execute({\n sql: `UPDATE execution_queue SET mission_id=?,orchestrator_id=?,runtime_domain=?,guardian_state='PASS',\n approval_state='ACTIVE',approval_decision_id=?,approval_expires_at=?,approval_revoked_at=NULL,\n policy_version=?,retriable=1,authorization_binding=?\n WHERE id=? AND authorization_binding IS NULL AND permission_decision='ALLOW' AND permission_reason=?`,\n args: [\n MISSION_ID,\n orchestratorId,\n runtimeDomain,\n approvalDecisionId,\n APPROVAL_EXPIRES_AT,\n POLICY_VERSION,\n authorizationBinding,\n row.id,\n ALLOWED_PERMISSION_REASON,\n ],\n });\n }\n}\n\nasync function verifyQueueBinding(row: Record): Promise {\n const expected = await queueBinding(row, String(row.orchestrator_id), String(row.runtime_domain));\n return typeof row.authorization_binding === \"string\" && constantTimeEqual(expected, row.authorization_binding);\n}\n\nasync function eventMaterial(input: {\n eventType: AuditType;\n timestamp: string;\n queueItemId: number | null;\n claimId: string | null;\n requestId: string | null;\n serviceId: string;\n agentId: string | null;\n orchestratorId: string | null;\n runtimeDomain: string | null;\n authorizationDecisionId: string;\n previousState: string | null;\n newState: string | null;\n result: \"PASS\" | \"DENY\";\n reasonCode: string;\n evidenceRef: string | null;\n evidenceSha256: string | null;\n}) {\n const eventId = crypto.randomUUID();\n const ordered = [\n eventId,\n input.eventType,\n input.timestamp,\n input.queueItemId,\n input.claimId,\n input.requestId,\n input.serviceId,\n PASSPORT_ID,\n input.agentId,\n input.orchestratorId,\n input.runtimeDomain,\n input.authorizationDecisionId,\n input.previousState,\n input.newState,\n input.result,\n input.reasonCode,\n input.evidenceRef,\n input.evidenceSha256,\n ];\n const eventHash = await sha256(JSON.stringify(ordered));\n const eventSignature = await hmac(eventHash);\n return { ...input, eventId, eventHash, eventSignature };\n}\n\nfunction auditInsert(event: Awaited>) {\n return {\n sql: `INSERT INTO execution_bridge_audit(\n event_id,event_type,timestamp,queue_item_id,claim_id,request_id,service_id,passport_id,\n agent_id,orchestrator_id,runtime_domain,authorization_decision_id,previous_state,new_state,\n result,reason_code,evidence_ref,evidence_sha256,event_hash,event_signature\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n event.eventId,\n event.eventType,\n event.timestamp,\n event.queueItemId,\n event.claimId,\n event.requestId,\n event.serviceId,\n PASSPORT_ID,\n event.agentId,\n event.orchestratorId,\n event.runtimeDomain,\n event.authorizationDecisionId,\n event.previousState,\n event.newState,\n event.result,\n event.reasonCode,\n event.evidenceRef,\n event.evidenceSha256,\n event.eventHash,\n event.eventSignature,\n ],\n };\n}\n\nfunction conditionalClaimAuditInsert(\n event: Awaited>,\n claimId: string,\n) {\n const base = auditInsert(event);\n const valuesIndex = base.sql.indexOf(\" VALUES(\");\n const header = base.sql.slice(0, valuesIndex);\n return {\n sql: `${header} SELECT ?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?\n WHERE EXISTS(SELECT 1 FROM execution_bridge_claims WHERE claim_id=? AND state='ACTIVE')`,\n args: [...base.args, claimId],\n };\n}\n\nfunction conditionalFinalizeAuditInsert(\n event: Awaited>,\n requestId: string,\n claimId: string,\n claimState: string,\n queueState: string,\n) {\n const base = auditInsert(event);\n const valuesIndex = base.sql.indexOf(\" VALUES(\");\n const header = base.sql.slice(0, valuesIndex);\n return {\n sql: `${header} SELECT ?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?\n WHERE EXISTS(\n SELECT 1 FROM execution_bridge_requests r\n JOIN execution_bridge_claims c ON c.claim_id=r.claim_id\n JOIN execution_queue q ON q.id=c.queue_item_id\n WHERE r.request_id=? AND r.claim_id=? AND c.state=?\n AND q.execution_state=? AND q.completion_request_id=?\n )`,\n args: [...base.args, requestId, claimId, claimState, queueState, requestId],\n };\n}\n\nasync function appendDenied(reasonCode: string, serviceId = \"UNVERIFIED_CALLER\") {\n try {\n await ensureSchema();\n const timestamp = new Date().toISOString();\n const event = await eventMaterial({\n eventType: \"AUTHORIZATION_DENIED\",\n timestamp,\n queueItemId: null,\n claimId: null,\n requestId: null,\n serviceId: serviceId === SERVICE_ID ? serviceId : \"UNVERIFIED_CALLER\",\n agentId: null,\n orchestratorId: null,\n runtimeDomain: null,\n authorizationDecisionId: await sha256(JSON.stringify([\"DENY\", timestamp, reasonCode])),\n previousState: null,\n newState: null,\n result: \"DENY\",\n reasonCode,\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(event));\n } catch {\n // Authorization response remains fail-closed even if audit storage is unavailable.\n }\n}\n\nasync function authenticate(req: Request, body: string, required: Capability) {\n const serviceId = req.headers.get(\"x-imperial-service-id\") ?? \"\";\n const capability = req.headers.get(\"x-imperial-capability\") ?? \"\";\n const timestamp = req.headers.get(\"x-imperial-timestamp\") ?? \"\";\n const nonce = req.headers.get(\"x-imperial-nonce\") ?? \"\";\n const signature = req.headers.get(\"x-imperial-signature\") ?? \"\";\n\n if (\n serviceId !== SERVICE_ID ||\n capability !== required ||\n !CAPABILITIES.has(capability) ||\n !/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$/.test(timestamp) ||\n !/^[A-Za-z0-9_-]{16,128}$/.test(nonce) ||\n !/^[a-f0-9]{64}$/.test(signature)\n ) {\n await appendDenied(\"SIGNED_CAPABILITY_REQUIRED\", serviceId);\n return { ok: false as const, status: 401, reason: \"UNAUTHORIZED\" };\n }\n const age = Math.abs(Date.now() - Date.parse(timestamp));\n if (!Number.isFinite(age) || age > 60_000 || Date.parse(SERVICE_EXPIRES_AT) <= Date.now()) {\n await appendDenied(\"SIGNED_CAPABILITY_EXPIRED\", serviceId);\n return { ok: false as const, status: 401, reason: \"UNAUTHORIZED\" };\n }\n\n const url = new URL(req.url);\n const bodyHash = await sha256(body);\n const canonical = [\n req.method.toUpperCase(),\n url.pathname + url.search,\n timestamp,\n nonce,\n serviceId,\n capability,\n bodyHash,\n ].join(\"\\n\");\n const expected = await hmac(canonical);\n if (!constantTimeEqual(expected, signature)) {\n await appendDenied(\"SIGNATURE_INVALID\", serviceId);\n return { ok: false as const, status: 401, reason: \"UNAUTHORIZED\" };\n }\n\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM execution_bridge_nonces WHERE expires_at < ?\",\n args: [new Date().toISOString()],\n });\n const inserted = await sqlite.execute({\n sql: `INSERT OR IGNORE INTO execution_bridge_nonces(nonce,service_id,capability,used_at,expires_at)\n VALUES(?,?,?,?,?)`,\n args: [\n nonce,\n serviceId,\n capability,\n timestamp,\n new Date(Date.parse(timestamp) + 5 * 60_000).toISOString(),\n ],\n });\n if (inserted.rowsAffected !== 1) {\n await appendDenied(\"REPLAY_DENIED\", serviceId);\n return { ok: false as const, status: 409, reason: \"REPLAY_DENIED\" };\n }\n\n return {\n ok: true as const,\n serviceId,\n capability: capability as Capability,\n authorizationDecisionId: await sha256(JSON.stringify([\n POLICY_VERSION,\n PASSPORT_ID,\n serviceId,\n capability,\n timestamp,\n nonce,\n bodyHash,\n ])),\n };\n}\n\nasync function expireClaims() {\n const now = new Date().toISOString();\n const expired = await sqlite.execute({\n sql: `SELECT c.claim_id,c.queue_item_id,c.claimed_by,c.agent_id,c.orchestrator_id,\n c.runtime_domain,c.authorization_decision_id,c.retriable,q.execution_state\n FROM execution_bridge_claims c JOIN execution_queue q ON q.id=c.queue_item_id\n WHERE c.state='ACTIVE' AND c.claim_expires_at<=?`,\n args: [now],\n });\n for (const row of expired.rows as Record[]) {\n const newState = Number(row.retriable) === 1 ? \"READY\" : \"FAILED\";\n const event = await eventMaterial({\n eventType: \"QUEUE_CLAIM_EXPIRED\",\n timestamp: now,\n queueItemId: Number(row.queue_item_id),\n claimId: String(row.claim_id),\n requestId: null,\n serviceId: String(row.claimed_by),\n agentId: String(row.agent_id),\n orchestratorId: String(row.orchestrator_id),\n runtimeDomain: String(row.runtime_domain),\n authorizationDecisionId: String(row.authorization_decision_id),\n previousState: \"CLAIMED\",\n newState,\n result: \"PASS\",\n reasonCode: \"CLAIM_LEASE_EXPIRED\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.batch([\n {\n sql: `UPDATE execution_bridge_claims SET state='EXPIRED'\n WHERE claim_id=? AND state='ACTIVE' AND claim_expires_at<=?`,\n args: [row.claim_id, now],\n },\n {\n sql: `UPDATE execution_queue SET execution_state=?,claim_id=NULL,claimed_by=NULL,\n claimed_at=NULL,claim_expires_at=NULL,updated_at=?\n WHERE id=? AND execution_state='CLAIMED' AND claim_id=?`,\n args: [newState, now, row.queue_item_id, row.claim_id],\n },\n auditInsert(event),\n ]);\n }\n return expired.rows.length;\n}\n\nfunction rowEligible(row: Record, now: string): boolean {\n return row.execution_state === \"READY\" &&\n row.permission_decision === \"ALLOW\" &&\n row.permission_reason === ALLOWED_PERMISSION_REASON &&\n row.guardian_state === \"PASS\" &&\n row.approval_state === \"ACTIVE\" &&\n row.approval_revoked_at === null &&\n typeof row.approval_expires_at === \"string\" &&\n Date.parse(row.approval_expires_at) > Date.parse(now) &&\n row.policy_version === POLICY_VERSION &&\n typeof row.runtime_domain === \"string\" &&\n [...DOMAINS.values()].some((entry) => entry[1] === row.runtime_domain) &&\n !sanitizeTask(row.next_action).prompt_injection_detected;\n}\n\nasync function readyItems(limit: number) {\n const now = new Date().toISOString();\n const result = await sqlite.execute({\n sql: `SELECT q.id,q.agent_id,q.action_stage,q.next_action,q.connector,q.execution_state,q.created_at,\n q.permission_decision,q.permission_reason,q.mission_id,q.orchestrator_id,q.runtime_domain,\n q.guardian_state,q.approval_state,q.approval_decision_id,q.approval_expires_at,\n q.approval_revoked_at,q.policy_version,q.retriable,q.authorization_binding\n FROM execution_queue q\n WHERE q.execution_state='READY' AND q.permission_decision='ALLOW'\n AND q.approval_state='ACTIVE' AND q.approval_revoked_at IS NULL\n AND q.approval_expires_at>? AND q.policy_version=?\n ORDER BY q.id LIMIT ?`,\n args: [now, POLICY_VERSION, Math.min(100, Math.max(1, limit * 3))],\n });\n const output = [];\n for (const row of result.rows as Record[]) {\n if (!rowEligible(row, now) || !(await verifyQueueBinding(row))) continue;\n output.push({\n queue_item_id: Number(row.id),\n mission_id: String(row.mission_id),\n agent_id: String(row.agent_id),\n orchestrator_id: String(row.orchestrator_id),\n runtime_domain: String(row.runtime_domain),\n task_type: String(row.connector),\n sanitized_task_payload: sanitizeTask(row.next_action),\n approval_decision_id: String(row.approval_decision_id),\n approval_state: String(row.approval_state),\n created_at: String(row.created_at),\n expires_at: String(row.approval_expires_at),\n policy_version: String(row.policy_version),\n evidence_refs: [],\n });\n if (output.length >= limit) break;\n }\n return output;\n}\n\nasync function readBody(req: Request): Promise {\n const length = Number(req.headers.get(\"content-length\") ?? \"0\");\n if (Number.isFinite(length) && length > MAX_BODY_BYTES) return null;\n const text = await req.text();\n return utf8(text).byteLength <= MAX_BODY_BYTES ? text : null;\n}\n\nasync function handleReady(req: Request, body: string) {\n const auth = await authenticate(req, body, \"QUEUE_READ\");\n if (!auth.ok) return json({ error: auth.reason }, auth.status);\n await expireClaims();\n const url = new URL(req.url);\n const requested = Number(url.searchParams.get(\"limit\") ?? \"20\");\n const limit = Number.isInteger(requested) ? Math.min(100, Math.max(1, requested)) : 20;\n const items = await readyItems(limit);\n const timestamp = new Date().toISOString();\n const event = await eventMaterial({\n eventType: \"QUEUE_READY_READ\",\n timestamp,\n queueItemId: null,\n claimId: null,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: null,\n orchestratorId: null,\n runtimeDomain: null,\n authorizationDecisionId: auth.authorizationDecisionId,\n previousState: null,\n newState: null,\n result: \"PASS\",\n reasonCode: \"AUTHORIZED_FILTERED_READ\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(event));\n return json({\n bridge: POLICY_VERSION,\n caller: auth.serviceId,\n passport_id: PASSPORT_ID,\n secret_exposed: false,\n count: items.length,\n items,\n });\n}\n\nasync function getQueueRow(id: number) {\n const result = await sqlite.execute({\n sql: `SELECT q.id,q.agent_id,q.action_stage,q.next_action,q.connector,q.execution_state,q.created_at,\n q.permission_decision,q.permission_reason,q.mission_id,q.orchestrator_id,q.runtime_domain,\n q.guardian_state,q.approval_state,q.approval_decision_id,q.approval_expires_at,\n q.approval_revoked_at,q.policy_version,q.retriable,q.authorization_binding,q.claim_id\n FROM execution_queue q WHERE q.id=?`,\n args: [id],\n });\n return (result.rows[0] as Record | undefined) ?? null;\n}\n\nasync function handleClaim(req: Request, body: string) {\n const auth = await authenticate(req, body, \"QUEUE_CLAIM\");\n if (!auth.ok) return json({ error: auth.reason }, auth.status);\n await expireClaims();\n const parsed = JSON.parse(body || \"{}\");\n const input = exactObject(parsed, [\"queue_item_id\"], [\"lease_seconds\"]);\n const queueItemId = Number(input?.queue_item_id);\n const leaseSeconds = Number(input?.lease_seconds ?? 300);\n if (!input || !Number.isInteger(queueItemId) || !Number.isInteger(leaseSeconds) || leaseSeconds < 30 || leaseSeconds > 900) {\n return json({ error: \"MALFORMED_CLAIM_REQUEST\" }, 400);\n }\n\n const row = await getQueueRow(queueItemId);\n const now = new Date().toISOString();\n if (!row || !rowEligible(row, now) || !(await verifyQueueBinding(row))) {\n const event = await eventMaterial({\n eventType: \"QUEUE_CLAIM_REJECTED\",\n timestamp: now,\n queueItemId,\n claimId: null,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: row ? String(row.agent_id) : null,\n orchestratorId: row ? String(row.orchestrator_id) : null,\n runtimeDomain: row ? String(row.runtime_domain) : null,\n authorizationDecisionId: auth.authorizationDecisionId,\n previousState: row ? String(row.execution_state) : null,\n newState: row ? String(row.execution_state) : null,\n result: \"DENY\",\n reasonCode: \"ITEM_NOT_EXECUTABLE\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(event));\n return json({ claimed: false, error: \"ITEM_NOT_EXECUTABLE\" }, 409);\n }\n\n const claimId = crypto.randomUUID();\n const expiresAt = new Date(Date.now() + leaseSeconds * 1000).toISOString();\n const authorizationDecisionId = await sha256(JSON.stringify([\n auth.authorizationDecisionId,\n queueItemId,\n row.agent_id,\n row.runtime_domain,\n row.approval_decision_id,\n claimId,\n now,\n expiresAt,\n ]));\n const event = await eventMaterial({\n eventType: \"QUEUE_ITEM_CLAIMED\",\n timestamp: now,\n queueItemId,\n claimId,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: String(row.agent_id),\n orchestratorId: String(row.orchestrator_id),\n runtimeDomain: String(row.runtime_domain),\n authorizationDecisionId,\n previousState: \"READY\",\n newState: \"CLAIMED\",\n result: \"PASS\",\n reasonCode: \"ATOMIC_COMPARE_AND_SET\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n\n try {\n await sqlite.batch([\n {\n sql: `INSERT INTO execution_bridge_claims(\n claim_id,queue_item_id,claimed_by,passport_id,agent_id,orchestrator_id,runtime_domain,\n claimed_at,claim_expires_at,authorization_decision_id,state,retriable\n )\n SELECT ?,q.id,?,?,?,?,?,?,?,?,?,q.retriable\n FROM execution_queue q\n WHERE q.id=? AND q.execution_state='READY' AND q.permission_decision='ALLOW'\n AND q.guardian_state='PASS' AND q.approval_state='ACTIVE'\n AND q.approval_revoked_at IS NULL AND q.approval_expires_at>?\n AND q.policy_version=? AND q.authorization_binding=?`,\n args: [\n claimId,\n auth.serviceId,\n PASSPORT_ID,\n row.agent_id,\n row.orchestrator_id,\n row.runtime_domain,\n now,\n expiresAt,\n authorizationDecisionId,\n \"ACTIVE\",\n queueItemId,\n now,\n POLICY_VERSION,\n row.authorization_binding,\n ],\n },\n {\n sql: `UPDATE execution_queue SET execution_state='CLAIMED',claim_id=?,claimed_by=?,\n claimed_at=?,claim_expires_at=?,authorization_decision_id=?,updated_at=?\n WHERE id=? AND execution_state='READY'\n AND EXISTS(SELECT 1 FROM execution_bridge_claims c WHERE c.claim_id=? AND c.state='ACTIVE')`,\n args: [claimId, auth.serviceId, now, expiresAt, authorizationDecisionId, now, queueItemId, claimId],\n },\n conditionalClaimAuditInsert(event, claimId),\n ]);\n } catch {\n const rejected = await eventMaterial({\n eventType: \"QUEUE_CLAIM_REJECTED\",\n timestamp: new Date().toISOString(),\n queueItemId,\n claimId: null,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: String(row.agent_id),\n orchestratorId: String(row.orchestrator_id),\n runtimeDomain: String(row.runtime_domain),\n authorizationDecisionId,\n previousState: \"READY\",\n newState: \"READY\",\n result: \"DENY\",\n reasonCode: \"CONCURRENT_OR_DUPLICATE_CLAIM\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(rejected));\n return json({ claimed: false, error: \"ALREADY_CLAIMED\" }, 409);\n }\n\n const claimed = await sqlite.execute({\n sql: \"SELECT claim_id FROM execution_bridge_claims WHERE claim_id=? AND state='ACTIVE'\",\n args: [claimId],\n });\n if (!claimed.rows.length) return json({ claimed: false, error: \"ALREADY_CLAIMED\" }, 409);\n\n return json({\n claimed: true,\n secret_exposed: false,\n claim: {\n claim_id: claimId,\n queue_item_id: queueItemId,\n claimed_by: auth.serviceId,\n agent_id: String(row.agent_id),\n orchestrator_id: String(row.orchestrator_id),\n runtime_domain: String(row.runtime_domain),\n claimed_at: now,\n claim_expires_at: expiresAt,\n authorization_decision_id: authorizationDecisionId,\n task_type: String(row.connector),\n sanitized_task_payload: sanitizeTask(row.next_action),\n },\n }, 201);\n}\n\nasync function getClaim(claimId: string) {\n const result = await sqlite.execute({\n sql: `SELECT c.*,q.execution_state,q.permission_decision,q.permission_reason,q.guardian_state,\n q.approval_state,q.approval_expires_at,q.approval_revoked_at,q.policy_version,\n q.authorization_binding,q.next_action\n FROM execution_bridge_claims c JOIN execution_queue q ON q.id=c.queue_item_id\n WHERE c.claim_id=?`,\n args: [claimId],\n });\n return (result.rows[0] as Record | undefined) ?? null;\n}\n\nfunction activeClaim(row: Record, serviceId: string, now: string): boolean {\n return row.state === \"ACTIVE\" &&\n row.execution_state === \"CLAIMED\" &&\n row.claimed_by === serviceId &&\n row.permission_decision === \"ALLOW\" &&\n row.permission_reason === ALLOWED_PERMISSION_REASON &&\n row.guardian_state === \"PASS\" &&\n row.approval_state === \"ACTIVE\" &&\n row.approval_revoked_at === null &&\n typeof row.approval_expires_at === \"string\" &&\n Date.parse(row.approval_expires_at) > Date.parse(now) &&\n typeof row.claim_expires_at === \"string\" &&\n Date.parse(row.claim_expires_at) > Date.parse(now) &&\n row.policy_version === POLICY_VERSION;\n}\n\nasync function handleFinalize(req: Request, body: string, operation: \"complete\" | \"fail\" | \"release\") {\n const capability = ({\n complete: \"QUEUE_COMPLETE\",\n fail: \"QUEUE_FAIL\",\n release: \"QUEUE_RELEASE\",\n } as const)[operation];\n const auth = await authenticate(req, body, capability);\n if (!auth.ok) return json({ error: auth.reason }, auth.status);\n\n const parsed = JSON.parse(body || \"{}\");\n const required = operation === \"release\"\n ? [\"claim_id\", \"request_id\", \"reason\"]\n : operation === \"fail\"\n ? [\"claim_id\", \"request_id\", \"evidence_ref\", \"evidence_sha256\", \"failure_reason\", \"retriable\"]\n : [\"claim_id\", \"request_id\", \"evidence_ref\", \"evidence_sha256\"];\n const input = exactObject(parsed, required);\n if (!input) return json({ error: \"MALFORMED_FINALIZE_REQUEST\" }, 400);\n const claimId = safeIdentifier(input.claim_id);\n const requestId = safeIdentifier(input.request_id);\n const evidenceRef = operation === \"release\" ? null : safeEvidenceRef(input.evidence_ref);\n const evidenceSha256 = operation === \"release\" ? null : safeHash(input.evidence_sha256);\n const failureReason = operation === \"fail\"\n ? (typeof input.failure_reason === \"string\" && /^[A-Z0-9_:-]{3,128}$/.test(input.failure_reason) ? input.failure_reason : null)\n : null;\n const releaseReason = operation === \"release\"\n ? (typeof input.reason === \"string\" && /^[A-Z0-9_:-]{3,128}$/.test(input.reason) ? input.reason : null)\n : null;\n const retriable = operation === \"fail\" && typeof input.retriable === \"boolean\" ? input.retriable : false;\n if (!claimId || !requestId || (operation !== \"release\" && (!evidenceRef || !evidenceSha256)) ||\n (operation === \"fail\" && !failureReason) || (operation === \"release\" && !releaseReason)) {\n return json({ error: \"FINALIZE_FIELDS_INVALID\" }, 400);\n }\n\n await expireClaims();\n const claim = await getClaim(claimId);\n const now = new Date().toISOString();\n if (!claim || !activeClaim(claim, auth.serviceId, now) ||\n (operation === \"release\" && Number(claim.retriable) !== 1)) {\n return json({ updated: false, error: \"ACTIVE_AUTHORIZED_CLAIM_REQUIRED\" }, 409);\n }\n\n const queueItemId = Number(claim.queue_item_id);\n const newState = operation === \"complete\" ? \"COMPLETED\" : operation === \"fail\" ? \"FAILED\" : \"READY\";\n const claimState = operation === \"complete\" ? \"COMPLETED\" : operation === \"fail\" ? \"FAILED\" : \"RELEASED\";\n const eventType: AuditType = operation === \"complete\"\n ? \"QUEUE_ITEM_COMPLETED\"\n : operation === \"fail\"\n ? \"QUEUE_ITEM_FAILED\"\n : \"QUEUE_ITEM_RELEASED\";\n const reasonCode = operation === \"complete\" ? \"COMPLETION_EVIDENCE_PERSISTED\" : operation === \"fail\"\n ? failureReason!\n : releaseReason!;\n const event = await eventMaterial({\n eventType,\n timestamp: now,\n queueItemId,\n claimId,\n requestId,\n serviceId: auth.serviceId,\n agentId: String(claim.agent_id),\n orchestratorId: String(claim.orchestrator_id),\n runtimeDomain: String(claim.runtime_domain),\n authorizationDecisionId: String(claim.authorization_decision_id),\n previousState: \"CLAIMED\",\n newState,\n result: \"PASS\",\n reasonCode,\n evidenceRef,\n evidenceSha256,\n });\n\n const batch = [\n {\n sql: `INSERT INTO execution_bridge_requests(request_id,operation,claim_id,service_id,created_at)\n SELECT ?,?,?,?,? WHERE EXISTS(\n SELECT 1 FROM execution_bridge_claims c\n JOIN execution_queue q ON q.id=c.queue_item_id\n WHERE c.claim_id=? AND c.state='ACTIVE' AND c.claimed_by=?\n AND c.claim_expires_at>? AND q.execution_state='CLAIMED' AND q.claim_id=?\n )`,\n args: [\n requestId,\n operation.toUpperCase(),\n claimId,\n auth.serviceId,\n now,\n claimId,\n auth.serviceId,\n now,\n claimId,\n ],\n },\n {\n sql: `UPDATE execution_bridge_claims SET state=?,completed_at=?,failure_reason=?\n WHERE claim_id=? AND state='ACTIVE' AND claimed_by=? AND claim_expires_at>?\n AND EXISTS(SELECT 1 FROM execution_bridge_requests WHERE request_id=? AND claim_id=?)`,\n args: [claimState, now, failureReason, claimId, auth.serviceId, now, requestId, claimId],\n },\n {\n sql: `UPDATE execution_queue SET execution_state=?,evidence_ref=?,updated_at=?,\n failure_reason=?,failure_retriable=?,completion_request_id=?,\n claim_id=CASE WHEN ?='READY' THEN NULL ELSE claim_id END,\n claimed_by=CASE WHEN ?='READY' THEN NULL ELSE claimed_by END,\n claimed_at=CASE WHEN ?='READY' THEN NULL ELSE claimed_at END,\n claim_expires_at=CASE WHEN ?='READY' THEN NULL ELSE claim_expires_at END\n WHERE id=? AND execution_state='CLAIMED' AND claim_id=?\n AND EXISTS(SELECT 1 FROM execution_bridge_requests WHERE request_id=?)`,\n args: [\n newState,\n evidenceRef,\n now,\n failureReason,\n operation === \"fail\" ? (retriable ? 1 : 0) : null,\n requestId,\n newState,\n newState,\n newState,\n newState,\n queueItemId,\n claimId,\n requestId,\n ],\n },\n ];\n if (operation === \"complete\") {\n batch.push({\n sql: `UPDATE agent_progress SET\n stage_index=CASE WHEN stage_index<7 THEN stage_index+1 ELSE 0 END,\n stage_state='WAITING_FOR_EVIDENCE',\n evidence_count=evidence_count+1,\n last_evidence_ref=?,\n last_advanced_at=?\n WHERE agent_id=? AND EXISTS(\n SELECT 1 FROM execution_queue q\n WHERE q.id=? AND q.execution_state='COMPLETED' AND q.completion_request_id=?\n )`,\n args: [evidenceRef, now, claim.agent_id, queueItemId, requestId],\n });\n }\n batch.push(conditionalFinalizeAuditInsert(event, requestId, claimId, claimState, newState));\n\n try {\n await sqlite.batch(batch);\n } catch {\n return json({ updated: false, error: \"REPLAY_OR_STATE_CONFLICT\" }, 409);\n }\n\n const finalized = await sqlite.execute({\n sql: `SELECT r.request_id FROM execution_bridge_requests r\n JOIN execution_bridge_claims c ON c.claim_id=r.claim_id\n JOIN execution_queue q ON q.id=c.queue_item_id\n WHERE r.request_id=? AND r.claim_id=? AND c.state=?\n AND q.execution_state=? AND q.completion_request_id=?`,\n args: [requestId, claimId, claimState, newState, requestId],\n });\n if (!finalized.rows.length) {\n return json({ updated: false, error: \"REPLAY_OR_STATE_CONFLICT\" }, 409);\n }\n\n return json({\n updated: true,\n operation: operation.toUpperCase(),\n queue_item_id: queueItemId,\n claim_id: claimId,\n state: newState,\n agent_progress_updated: operation === \"complete\",\n secret_exposed: false,\n audit_event_id: event.eventId,\n audit_event_hash: event.eventHash,\n });\n}\n\nasync function handleAuditRead(req: Request, body: string) {\n const auth = await authenticate(req, body, \"QUEUE_AUDIT_READ\");\n if (!auth.ok) return json({ error: auth.reason }, auth.status);\n await expireClaims();\n const url = new URL(req.url);\n const rawIds = url.searchParams.get(\"queue_item_ids\") ?? \"\";\n const ids = [...new Set(rawIds.split(\",\").map((value) => Number(value.trim())).filter((value) => Number.isInteger(value) && value > 0))];\n const requestedLimit = Number(url.searchParams.get(\"limit\") ?? \"100\");\n const limit = Number.isInteger(requestedLimit) ? Math.min(200, Math.max(1, requestedLimit)) : 100;\n if (!ids.length || ids.length > 20 || ids.join(\",\") !== rawIds.split(\",\").map((value) => String(Number(value.trim()))).join(\",\")) {\n return json({ error: \"VALID_QUEUE_ITEM_IDS_REQUIRED\" }, 400);\n }\n const placeholders = ids.map(() => \"?\").join(\",\");\n const queueRows = await sqlite.execute({\n sql: `SELECT id,agent_id,orchestrator_id,runtime_domain,execution_state,evidence_ref,claim_id,claimed_by,\n claimed_at,claim_expires_at,completion_request_id,failure_reason,failure_retriable,updated_at\n FROM execution_queue WHERE id IN (${placeholders}) ORDER BY id`,\n args: ids,\n });\n const claims = await sqlite.execute({\n sql: `SELECT claim_id,queue_item_id,claimed_by,passport_id,agent_id,orchestrator_id,runtime_domain,\n claimed_at,claim_expires_at,state,retriable,completed_at,failure_reason\n FROM execution_bridge_claims WHERE queue_item_id IN (${placeholders}) ORDER BY queue_item_id,claimed_at`,\n args: ids,\n });\n const events = await sqlite.execute({\n sql: `SELECT event_id,event_type,timestamp,queue_item_id,claim_id,request_id,service_id,passport_id,\n agent_id,orchestrator_id,runtime_domain,authorization_decision_id,previous_state,new_state,result,\n reason_code,evidence_ref,evidence_sha256,event_hash\n FROM execution_bridge_audit WHERE queue_item_id IN (${placeholders}) ORDER BY id DESC LIMIT ?`,\n args: [...ids, limit],\n });\n const timestamp = new Date().toISOString();\n const auditEvent = await eventMaterial({\n eventType: \"QUEUE_AUDIT_READ\",\n timestamp,\n queueItemId: null,\n claimId: null,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: null,\n orchestratorId: null,\n runtimeDomain: null,\n authorizationDecisionId: auth.authorizationDecisionId,\n previousState: null,\n newState: null,\n result: \"PASS\",\n reasonCode: \"AUTHORIZED_SCOPED_AUDIT_READ\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(auditEvent));\n return json({\n bridge: POLICY_VERSION,\n caller: auth.serviceId,\n passport_id: PASSPORT_ID,\n secret_exposed: false,\n requested_queue_item_ids: ids,\n queue_rows: queueRows.rows,\n claims: claims.rows,\n events: events.rows,\n audit_read_event_id: auditEvent.eventId,\n audit_read_event_hash: auditEvent.eventHash,\n });\n}\n\nfunction legacyAuthorized(req: Request): boolean {\n const value = req.headers.get(\"authorization\");\n if (!value?.startsWith(\"Bearer \")) return false;\n return constantTimeEqual(value.slice(7), secret());\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/health\") {\n return json({\n service: \"IMPERIAL_EXECUTION_BRIDGE\",\n version: POLICY_VERSION,\n status: \"UP\",\n secret_configured: Boolean(Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\")),\n secret_exposed: false,\n });\n }\n\n if (req.method === \"GET\" && url.pathname === \"/readiness\") {\n try {\n await ensureSchema();\n return json({ service: \"IMPERIAL_EXECUTION_BRIDGE\", ready: true, policy: POLICY_VERSION });\n } catch {\n return json({ service: \"IMPERIAL_EXECUTION_BRIDGE\", ready: false, error: \"STORAGE_UNAVAILABLE\" }, 503);\n }\n }\n\n const legacy = new Set([\"/queue\", \"/ready\", \"/claim\", \"/complete\", \"/status\"]);\n if (legacy.has(url.pathname)) {\n if (!legacyAuthorized(req)) return json({ error: \"UNAUTHORIZED\" }, 401);\n return json({ error: \"LEGACY_ENDPOINT_DISABLED_USE_GOVERNED_CAPABILITY\" }, 410);\n }\n\n const body = await readBody(req);\n if (body === null) return json({ error: \"PAYLOAD_TOO_LARGE\" }, 413);\n\n try {\n if (req.method === \"GET\" && url.pathname === \"/execution-bridge/ready\") {\n return await handleReady(req, body);\n }\n if (req.method === \"GET\" && url.pathname === \"/execution-bridge/audit\") {\n return await handleAuditRead(req, body);\n }\n if (req.method === \"POST\" && url.pathname === \"/execution-bridge/claim\") {\n return await handleClaim(req, body);\n }\n if (req.method === \"POST\" && url.pathname === \"/execution-bridge/complete\") {\n return await handleFinalize(req, body, \"complete\");\n }\n if (req.method === \"POST\" && url.pathname === \"/execution-bridge/fail\") {\n return await handleFinalize(req, body, \"fail\");\n }\n if (req.method === \"POST\" && url.pathname === \"/execution-bridge/release\") {\n return await handleFinalize(req, body, \"release\");\n }\n return json({ error: \"NOT_FOUND\" }, 404);\n } catch (error) {\n const code = String(error).includes(\"SERVER_AUTH_UNAVAILABLE\")\n ? \"SERVER_AUTH_UNAVAILABLE\"\n : String(error).includes(\"JSON\")\n ? \"MALFORMED_JSON\"\n : \"INTERNAL_ERROR\";\n return json({ error: code }, code === \"SERVER_AUTH_UNAVAILABLE\" ? 503 : code === \"MALFORMED_JSON\" ? 400 : 500);\n }\n}\n",[259],"42700934-55e0-4c7c-b1d7-3ebff410c5a4","controlled_batch_status.ts","d4f57504-a2da-11f1-b21e-1607ee4eb77e",88,["D",1787919618438],"import { bridgeRequest } from \"./execution_bridge_client.ts\";\n\nexport default async function () {\n const ids = [504,511,527,540,553,566,579,591];\n const path = `/execution-bridge/audit?queue_item_ids=${ids.join(\",\")}&limit=200`;\n const r = await bridgeRequest(\"GET\",path,\"QUEUE_AUDIT_READ\");\n console.log(JSON.stringify({ok:r.ok,status:r.status,ids,body:r.body}));\n return r;\n}\n",[266],"a94eeb6e-8e32-48a7-936c-eb61cccbd755","connector_queue_reconcile.ts","1a74a380-a2d5-11f1-8579-1607ee4eb77e",80,["D",1787917409813],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { bridgeRequest } from \"./execution_bridge_client.ts\";\n\nconst COMMAND_KEY = \"connector/reconcile-command.json\";\nconst RESULT_KEY = \"connector/queue-reconciliation.json\";\n\nasync function main() {\n const command = await blob.getJSON(COMMAND_KEY).catch(() => null) as {queue_item_ids?:unknown; limit?:unknown}|null;\n const ids = Array.isArray(command?.queue_item_ids)\n ? [...new Set(command.queue_item_ids.map(Number).filter((id)=>Number.isInteger(id) && id > 0))]\n : [];\n const limitRaw = Number(command?.limit ?? 100);\n const limit = Number.isInteger(limitRaw) ? Math.min(200, Math.max(1, limitRaw)) : 100;\n if (!ids.length || ids.length > 20) throw new Error(\"VALID_RECONCILE_QUEUE_ITEM_IDS_REQUIRED\");\n const path = `/execution-bridge/audit?queue_item_ids=${ids.join(\",\")}&limit=${limit}`;\n const response = await bridgeRequest(\"GET\", path, \"QUEUE_AUDIT_READ\");\n const result = {\n bridge: \"CONNECTOR_QUEUE_RECONCILE_v2\",\n ok: response.ok,\n status: response.status,\n secretExposed: false,\n requestedQueueItemIds: ids,\n body: response.body,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\n\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[273],"38b21535-1d7c-430b-9d79-e809a5e431eb","connector_queue_read.ts","8704a6d4-a2d1-11f1-8b6a-1607ee4eb77e",74,["D",1787916917422],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { bridgeRequest } from \"./execution_bridge_client.ts\";\n\nconst RESULT_KEY = \"connector/queue-ready-v3.json\";\n\nasync function main() {\n const response = await bridgeRequest(\"GET\", \"/execution-bridge/ready?limit=100\", \"QUEUE_READ\");\n const items = response.ok && Array.isArray(response.body.items) ? response.body.items : [];\n const result = {\n bridge: \"CONNECTOR_QUEUE_READ_v3\",\n ok: response.ok,\n status: response.status,\n serviceIdentity: response.body.caller ?? \"VAL_TOWN_CODEX_CONNECTOR\",\n passportId: response.body.passport_id ?? null,\n secretExposed: false,\n readyCount: items.length,\n items,\n error: response.ok ? undefined : response.body.error,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[280],"e0fa8ebb-ad2e-4249-92fe-7a4c013e7c21","connector_queue_finalize.ts","8a5fe9a8-a2d4-11f1-88be-1607ee4eb77e",72,["D",1787916916334],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { bridgeRequest, type BridgeCapability } from \"./execution_bridge_client.ts\";\n\nconst COMMAND_KEY = \"connector/finalize-command.json\";\nconst RESULT_KEY = \"connector/finalize-result.json\";\nconst OPERATIONS = {\n COMPLETE: [\"/execution-bridge/complete\", \"QUEUE_COMPLETE\"],\n FAIL: [\"/execution-bridge/fail\", \"QUEUE_FAIL\"],\n RELEASE: [\"/execution-bridge/release\", \"QUEUE_RELEASE\"],\n} as const;\n\nasync function main() {\n const command = await blob.getJSON(COMMAND_KEY).catch(() => null) as Record | null;\n const operation = String(command?.operation ?? \"\");\n const route = OPERATIONS[operation as keyof typeof OPERATIONS];\n if (!command || !route) {\n const result = { bridge: \"CONNECTOR_QUEUE_FINALIZE_v1\", ok: false, error: \"VALID_FINALIZE_COMMAND_REQUIRED\", secretExposed: false, recordedAt: new Date().toISOString() };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n }\n const { operation: _ignored, ...payload } = command;\n const response = await bridgeRequest(\"POST\", route[0], route[1] as BridgeCapability, payload);\n const result = {\n bridge: \"CONNECTOR_QUEUE_FINALIZE_v1\",\n ok: response.ok,\n status: response.status,\n operation,\n result: response.body,\n secretExposed: false,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[287],"088bc5c8-8f3b-4ee6-a6a5-dd8ac17f1cf4","connector_queue_complete_501.ts","538e598e-a2d2-11f1-950b-1607ee4eb77e",78,["D",1787916997313],"// Historical one-off helper for queue item 501.\n// Disabled permanently after successful historical use and execution_bridge v2.0.0 migration.\n// Evidence remains in project blob storage; this file must never replay completion.\nexport default function () {\n throw new Error(\"HISTORICAL_QUEUE_501_HELPER_DISABLED_NO_REPLAY\");\n}\n",[294],"9625949e-6175-4c2b-89d1-3f226b4fe429","connector_queue_complete.ts","4ca9f6b4-a2d2-11f1-9bd5-1607ee4eb77e",77,["D",1787916988126],"// Legacy bearer completion adapter. Disabled after execution_bridge v2.0.0.\n// Use connector_queue_finalize.ts with an explicit connector/finalize-command.json command.\nexport default function () {\n throw new Error(\"LEGACY_BEARER_COMPLETION_ADAPTER_DISABLED_USE_SIGNED_FINALIZER\");\n}\n",[301],"8891e8b1-fe22-4ce9-91ff-600bdf885844","connector_queue_claim.ts","8bcf9516-a2d1-11f1-bfbf-1607ee4eb77e",73,["D",1787916916813],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { bridgeRequest } from \"./execution_bridge_client.ts\";\n\nconst COMMAND_KEY = \"connector/claim-command.json\";\nconst RESULT_KEY = \"connector/queue-claim-v3.json\";\n\nasync function main() {\n const command = await blob.getJSON(COMMAND_KEY).catch(() => null) as Record | null;\n const queueItemId = Number(command?.queue_item_id);\n const leaseSeconds = Number(command?.lease_seconds ?? 900);\n if (!command || !Number.isInteger(queueItemId) || !Number.isInteger(leaseSeconds)) {\n const result = { bridge: \"CONNECTOR_QUEUE_CLAIM_v3\", ok: false, claimed: false, error: \"VALID_CLAIM_COMMAND_REQUIRED\", secretExposed: false, recordedAt: new Date().toISOString() };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n }\n\n const ready = await bridgeRequest(\"GET\", \"/execution-bridge/ready?limit=100\", \"QUEUE_READ\");\n const items = ready.ok && Array.isArray(ready.body.items) ? ready.body.items as Record[] : [];\n const visible = items.some((item) => Number(item.queue_item_id) === queueItemId);\n if (!visible) {\n const result = { bridge: \"CONNECTOR_QUEUE_CLAIM_v3\", ok: false, claimed: false, error: \"ITEM_NOT_IN_AUTHORIZED_READY_VIEW\", secretExposed: false, recordedAt: new Date().toISOString() };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n }\n\n const response = await bridgeRequest(\"POST\", \"/execution-bridge/claim\", \"QUEUE_CLAIM\", {\n queue_item_id: queueItemId,\n lease_seconds: leaseSeconds,\n });\n const result = {\n bridge: \"CONNECTOR_QUEUE_CLAIM_v3\",\n ok: response.ok,\n status: response.status,\n claimed: response.body.claimed === true,\n claim: response.body.claim ?? null,\n error: response.ok ? undefined : response.body.error,\n secretExposed: false,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[308],"7883de2a-0e4c-4f22-937b-770ef9637711","connector_completion_request.ts","43cbdbe8-a2d2-11f1-9a33-1607ee4eb77e",82,["D",1787918796895],"export default {\n id: 503,\n evidence_ref: \"AIRTABLE:recpbH78lJ2hQgT8r\",\n outcome: \"COMPLETED\"\n};\n",[315],"060d8a69-85e6-4f72-b496-13399a9094b2","commercial_research_evidence.ts","655fe1ae-a319-11f1-9e11-1607ee4eb77e",96,["D",1787946489539],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst CLAIM_KEY = \"connector/queue-claim-v3.json\";\nconst RESULT_KEY = \"commercial/research-result.json\";\n\nasync function sha256(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n return \"sha256:\" + [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function main() {\n const claimResult = await blob.getJSON(CLAIM_KEY).catch(() => null) as Record | null;\n const claim = claimResult?.claim as Record | null;\n if (!claimResult || claimResult.claimed !== true || !claim || Number(claim.queue_item_id) !== 721) {\n const denied = { ok: false, error: \"ACTIVE_CLAIM_721_REQUIRED\", recordedAt: new Date().toISOString() };\n await blob.setJSON(RESULT_KEY, denied);\n return denied;\n }\n\n const recordedAt = new Date().toISOString();\n const evidence = {\n schema: \"IMPERIAL_QUALIFIED_BUYER_RESEARCH_V1\",\n mission_id: \"IC-IMPERIAL-NCA-31DAY-COMMERCIAL-RUNTIME-001\",\n queue_item_id: 721,\n claim_id: String(claim.claim_id),\n agent_id: \"NCA-005\",\n runtime_domain: \"RD-KIDS-MEDIA-001\",\n task_type: \"RESEARCH_CRM\",\n task_executed: \"Build a small qualified buyer queue matching the defined buyer profile; no mass spam.\",\n trust_boundary: {\n source_content: \"UNTRUSTED_PUBLIC_DATA\",\n authority: \"NONE\",\n outreach_authorized: false,\n personal_data_collected: false,\n },\n qualification: {\n level: \"PROFILE_MATCH_ONLY\",\n buyer_intent_verified: false,\n note: \"Public-fit research only; no claim of active demand or purchase intent.\",\n },\n candidates: [\n {\n organization: \"Scholastic Corporation\",\n domain: \"scholastic.com\",\n profile_fit: [\"children's publishing\", \"education\", \"children's media\"],\n rationale: \"Official company profile describes children's books, school resources, digital programs and children's media.\",\n source_url: \"https://www.scholastic.com/aboutscholastic\",\n source_type: \"OFFICIAL_ORGANIZATION_SITE\",\n },\n {\n organization: \"Nickelodeon / Paramount\",\n domain: \"paramount.com\",\n profile_fit: [\"kids entertainment\", \"television production\", \"digital\", \"publishing\"],\n rationale: \"Official Paramount brand page describes a global kids business spanning programming, production, digital, publishing and consumer products.\",\n source_url: \"https://www.paramount.com/about/brands/nickelodeon\",\n source_type: \"OFFICIAL_ORGANIZATION_SITE\",\n },\n {\n organization: \"Sesame Workshop\",\n domain: \"sesameworkshop.org\",\n profile_fit: [\"children's education\", \"media\", \"research\"],\n rationale: \"Official organization site describes a global nonprofit using education, media and research to support children.\",\n source_url: \"https://sesameworkshop.org/\",\n source_type: \"OFFICIAL_ORGANIZATION_SITE\",\n },\n ],\n crm_record_created: false,\n gmail_draft_created: false,\n message_sent: false,\n payment_settled: false,\n revenue_settled: 0,\n recorded_at: recordedAt,\n };\n const serialized = JSON.stringify(evidence);\n const evidenceSha256 = await sha256(serialized);\n const key = \"evidence/commercial/queue-item-721.json\";\n await blob.set(key, serialized);\n const result = {\n ok: true,\n queue_item_id: 721,\n claim_id: String(claim.claim_id),\n evidence_key: key,\n evidence_ref: \"urn:evidence:val-town:commercial:queue-item-721\",\n evidence_sha256: evidenceSha256,\n candidate_count: evidence.candidates.length,\n crm_records_created: 0,\n gmail_drafts_created: 0,\n gmail_messages_sent: 0,\n payments_settled: 0,\n revenue_settled: 0,\n recordedAt,\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[322],"3f671100-960a-47a9-ab5b-feea492bd1bf","codex_netlify_handoff.ts","c2397f5a-a2da-11f1-9582-1607ee4eb77e",91,["D",1787919794660],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nasync function main() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS codex_assist_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n agent_id TEXT NOT NULL,\n mission_stage TEXT NOT NULL,\n task_type TEXT NOT NULL,\n objective TEXT NOT NULL,\n context TEXT,\n acceptance_criteria TEXT NOT NULL,\n state TEXT NOT NULL DEFAULT 'QUEUED_PLUS_HANDOFF',\n created_at TEXT NOT NULL,\n started_at TEXT,\n completed_at TEXT,\n result_ref TEXT,\n result_text TEXT,\n error TEXT\n )`);\n const now = new Date().toISOString();\n const objective = \"Repair and deploy HANTER bridge node #2 to the existing Netlify site hanter-bridge-node-2 without creating a new site. Preserve keyless-transport, side-effects-denied, authority-none behavior and expose a public /health endpoint returning HTTP 200.\";\n const context = \"Existing Netlify site_id: 7a998b62-9d9f-4114-b3c8-e1001ef56d77. Current primary and branch /health URLs return 404. Netlify connector can generate deployment command but source upload/build transport did not complete in this ChatGPT execution environment. Provider #1 Val Town is live; Provider #3 Supabase is live. Do not claim 3-provider diversity until Netlify independently returns 200.\";\n const acceptance = \"Use the existing site only; create minimal source if necessary; deploy; verify /health over public Netlify URL with HTTP 200; response must identify node hanter-bridge-node-2, provider netlify, mode keyless-transport, side_effects denied, authority none; no secrets in code/logs/output; record exact deploy ID, public URL, HTTP status, test output, blockers, and commit/source evidence. Do not fabricate PASS.\";\n const existing = await sqlite.execute({sql:`SELECT id,state FROM codex_assist_queue WHERE agent_id='HANTER' AND mission_stage='PROVIDER_NETLIFY_RECOVERY' AND objective=? AND state IN ('QUEUED_PLUS_HANDOFF','HANDOFF_RUNNING','COMPLETED') ORDER BY id DESC LIMIT 1`,args:[objective]});\n if (existing.rows.length) return {queued:false,existing:existing.rows[0]};\n const result = await sqlite.execute({sql:`INSERT INTO codex_assist_queue(agent_id,mission_stage,task_type,objective,context,acceptance_criteria,state,created_at) VALUES(?,?,?,?,?,?,?,?)`,args:['HANTER','PROVIDER_NETLIFY_RECOVERY','INFRASTRUCTURE_DEPLOYMENT',objective,context,acceptance,'QUEUED_PLUS_HANDOFF',now]});\n return {queued:true,id:Number(result.lastInsertRowid),state:'QUEUED_PLUS_HANDOFF',created_at:now};\n}\n\nexport default main;\nif (import.meta.main) console.log(JSON.stringify(await main()));\n",[329],"31be2612-1a41-43ef-aa20-738544e372a4","codex_handoff_status.ts","2992a190-a2db-11f1-9ae4-1607ee4eb77e",89,["D",1787919760368],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nexport default async function(req: Request) {\n if (req.method !== \"GET\") return Response.json({error:\"METHOD_NOT_ALLOWED\"},{status:405});\n const r = await sqlite.execute(`SELECT id,state,created_at FROM codex_assist_queue WHERE agent_id='HANTER' AND mission_stage='PROVIDER_NETLIFY_RECOVERY' ORDER BY id DESC LIMIT 1`);\n return Response.json({service:\"IMPERIAL Codex Handoff Status\",netlifyRecovery:r.rows[0] ?? null,authority:\"ASSIST_ONLY_NO_INDEPENDENT_AUTHORITY\"},{headers:{\"cache-control\":\"no-store\"}});\n}\n",[336],"60374907-bd57-4045-b4c6-9641815f2aea","codex_bridge.ts","2494efb0-a2b1-11f1-a91a-1607ee4eb77e",38,["D",1787902943902],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst TOKEN = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\nconst MODE = \"CHATGPT_CODEX_PLUS_ONLY\";\n\nfunction auth(req: Request) {\n return Boolean(TOKEN && req.headers.get(\"authorization\") === `Bearer ${TOKEN}`);\n}\n\nasync function ensure() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS codex_assist_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n agent_id TEXT NOT NULL,\n mission_stage TEXT NOT NULL,\n task_type TEXT NOT NULL,\n objective TEXT NOT NULL,\n context TEXT,\n acceptance_criteria TEXT NOT NULL,\n state TEXT NOT NULL DEFAULT 'QUEUED_PLUS_HANDOFF',\n created_at TEXT NOT NULL,\n started_at TEXT,\n completed_at TEXT,\n result_ref TEXT,\n result_text TEXT,\n error TEXT\n )`);\n}\n\nexport default async function(req: Request): Promise {\n await ensure();\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/status\") {\n const q = await sqlite.execute(`SELECT state,COUNT(*) AS n FROM codex_assist_queue GROUP BY state ORDER BY state`);\n return Response.json({\n layer:\"IMPERIAL_CODEX_ASSIST_v2\",\n mode:MODE,\n profiles:100,\n externalOpenAIApi:false,\n apiBillingAllowed:false,\n automaticPaidApiCalls:false,\n authority:\"ASSIST_ONLY_NO_INDEPENDENT_AUTHORITY\",\n execution:\"USE_CODEX_INCLUDED_WITH_CHATGPT_PLAN; EXTERNAL_RUNTIME_ONLY_PREPARES_HANDOFF_TASKS\",\n queue:q.rows\n });\n }\n\n if (!auth(req)) return Response.json({error:\"UNAUTHORIZED\"},{status:401});\n\n if (req.method === \"POST\" && url.pathname === \"/enqueue\") {\n const b = await req.json().catch(()=>null) as any;\n const agentId = String(b?.agent_id ?? \"\");\n const taskType = String(b?.task_type ?? \"\");\n const objective = String(b?.objective ?? \"\");\n const stage = String(b?.mission_stage ?? \"UNKNOWN\");\n const context = String(b?.context ?? \"\");\n const acceptance = String(b?.acceptance_criteria ?? \"\");\n if (!agentId || !taskType || !objective || !acceptance) return Response.json({error:\"REQUIRED_FIELDS_MISSING\"},{status:400});\n const p = await sqlite.execute({sql:`SELECT enabled FROM codex_assist_profile WHERE agent_id=?`,args:[agentId]});\n if (!p.rows.length || Number((p.rows[0] as any).enabled)!==1) return Response.json({error:\"CODEX_NOT_ENABLED_FOR_AGENT\"},{status:403});\n const now = new Date().toISOString();\n const r = await sqlite.execute({sql:`INSERT INTO codex_assist_queue(agent_id,mission_stage,task_type,objective,context,acceptance_criteria,state,created_at) VALUES(?,?,?,?,?,?,?,?)`,args:[agentId,stage,taskType,objective,context,acceptance,\"QUEUED_PLUS_HANDOFF\",now]});\n return Response.json({queued:true,id:Number(r.lastInsertRowid),mode:MODE});\n }\n\n if (url.pathname === \"/run-next\") {\n return Response.json({error:\"EXTERNAL_API_DISABLED_PLUS_ONLY\",mode:MODE,paidApiCalls:false},{status:403});\n }\n\n if (req.method === \"GET\" && url.pathname === \"/result\") {\n const id = Number(url.searchParams.get(\"id\"));\n if (!Number.isInteger(id)) return Response.json({error:\"INVALID_ID\"},{status:400});\n const r = await sqlite.execute({sql:`SELECT id,agent_id,state,result_ref,result_text,error,completed_at FROM codex_assist_queue WHERE id=?`,args:[id]});\n return Response.json(r.rows[0] ?? {error:\"NOT_FOUND\"},{status:r.rows.length?200:404});\n }\n\n return Response.json({error:\"NOT_FOUND\"},{status:404});\n}\n",[343],"pulls","branches","forks","envVars",{"_356":169,"_358":61},"connections",{"_356":61,"_357":61},"count","unfilledCount","emptyCount",{"_41":342,"_31":343,"_29":344,"_158":-5,"_39":40,"_38":345,"_160":57,"_36":465,"_13":169,"_32":162,"_34":347,"_23":24,"_164":-5,"_387":466,"_26":467},{"_41":335,"_31":336,"_29":337,"_158":-5,"_39":40,"_38":338,"_160":57,"_36":462,"_13":61,"_32":162,"_34":340,"_23":24,"_164":-5,"_387":463,"_26":464},{"_41":328,"_31":329,"_29":330,"_158":-5,"_39":40,"_38":331,"_160":57,"_36":459,"_13":179,"_32":33,"_34":333,"_23":24,"_164":-5,"_387":460,"_26":461},{"_41":321,"_31":322,"_29":323,"_158":-5,"_39":40,"_38":324,"_160":57,"_36":456,"_13":61,"_32":33,"_34":326,"_23":24,"_164":-5,"_387":457,"_26":458},{"_41":314,"_31":315,"_29":316,"_158":-5,"_39":40,"_38":317,"_160":57,"_36":453,"_13":179,"_32":33,"_34":319,"_23":24,"_164":-5,"_387":454,"_26":455},{"_41":307,"_31":308,"_29":309,"_158":-5,"_39":40,"_38":310,"_160":57,"_36":450,"_13":179,"_32":33,"_34":312,"_23":24,"_164":-5,"_387":451,"_26":452},{"_41":300,"_31":301,"_29":302,"_158":-5,"_39":40,"_38":303,"_160":57,"_36":447,"_13":171,"_32":33,"_34":305,"_23":24,"_164":-5,"_387":448,"_26":449},{"_41":293,"_31":294,"_29":295,"_158":-5,"_39":40,"_38":296,"_160":57,"_36":444,"_13":171,"_32":33,"_34":298,"_23":24,"_164":-5,"_387":445,"_26":446},{"_41":286,"_31":287,"_29":288,"_158":-5,"_39":40,"_38":289,"_160":57,"_36":441,"_13":61,"_32":33,"_34":291,"_23":24,"_164":-5,"_387":442,"_26":443},{"_41":279,"_31":280,"_29":281,"_158":-5,"_39":40,"_38":282,"_160":57,"_36":438,"_13":159,"_32":33,"_34":284,"_23":24,"_164":-5,"_387":439,"_26":440},{"_41":272,"_31":273,"_29":274,"_158":-5,"_39":40,"_38":275,"_160":57,"_36":435,"_13":171,"_32":33,"_34":277,"_23":24,"_164":-5,"_387":436,"_26":437},{"_41":265,"_31":266,"_29":267,"_158":-5,"_39":40,"_38":268,"_160":57,"_36":432,"_13":61,"_32":33,"_34":270,"_23":24,"_164":-5,"_387":433,"_26":434},{"_41":258,"_31":259,"_29":260,"_158":-5,"_39":40,"_38":261,"_160":24,"_36":429,"_13":223,"_32":162,"_34":263,"_23":24,"_164":-5,"_387":430,"_26":431},{"_41":255,"_31":27,"_29":30,"_158":-5,"_39":40,"_38":14,"_160":57,"_36":426,"_13":61,"_32":33,"_34":35,"_23":24,"_164":-5,"_387":427,"_26":428},{"_41":248,"_31":249,"_29":250,"_158":-5,"_39":40,"_38":251,"_160":57,"_36":423,"_13":171,"_32":33,"_34":253,"_23":24,"_164":-5,"_387":424,"_26":425},{"_41":241,"_31":242,"_29":243,"_158":-5,"_39":40,"_38":244,"_160":24,"_36":420,"_13":61,"_32":33,"_34":246,"_23":24,"_164":-5,"_387":421,"_26":422},{"_41":234,"_31":235,"_29":236,"_158":-5,"_39":40,"_38":237,"_160":57,"_36":417,"_13":61,"_32":33,"_34":239,"_23":24,"_164":-5,"_387":418,"_26":419},{"_41":227,"_31":228,"_29":229,"_158":-5,"_39":40,"_38":230,"_160":57,"_36":414,"_13":61,"_32":33,"_34":232,"_23":24,"_164":-5,"_387":415,"_26":416},{"_41":220,"_31":221,"_29":222,"_158":-5,"_39":40,"_38":223,"_160":57,"_36":411,"_13":61,"_32":33,"_34":225,"_23":24,"_164":-5,"_387":412,"_26":413},{"_41":213,"_31":214,"_29":215,"_158":-5,"_39":40,"_38":216,"_160":57,"_36":408,"_13":171,"_32":33,"_34":218,"_23":24,"_164":-5,"_387":409,"_26":410},{"_41":206,"_31":207,"_29":208,"_158":-5,"_39":40,"_38":209,"_160":57,"_36":405,"_13":61,"_32":162,"_34":211,"_23":24,"_164":-5,"_387":406,"_26":407},{"_41":197,"_31":198,"_29":199,"_158":-5,"_39":40,"_38":200,"_160":24,"_36":402,"_13":202,"_32":203,"_34":204,"_23":24,"_164":-5,"_387":403,"_26":404},{"_41":189,"_31":190,"_29":191,"_158":-5,"_39":40,"_38":192,"_160":57,"_36":399,"_13":194,"_32":33,"_34":195,"_23":24,"_164":-5,"_387":400,"_26":401},{"_41":182,"_31":183,"_29":184,"_158":-5,"_39":40,"_38":185,"_160":57,"_36":396,"_13":61,"_32":162,"_34":187,"_23":24,"_164":-5,"_387":397,"_26":398},{"_41":174,"_31":175,"_29":176,"_158":-5,"_39":40,"_38":177,"_160":57,"_36":393,"_13":179,"_32":162,"_34":180,"_23":24,"_164":-5,"_387":394,"_26":395},{"_41":166,"_31":167,"_29":168,"_158":-5,"_39":40,"_38":169,"_160":57,"_36":390,"_13":171,"_32":33,"_34":172,"_23":24,"_164":-5,"_387":391,"_26":392},{"_41":156,"_31":157,"_29":55,"_158":-5,"_39":40,"_38":159,"_160":57,"_36":386,"_13":61,"_32":162,"_34":163,"_23":24,"_164":-5,"_387":388,"_26":389},["D",1787899867027],"children",[],[157],["D",1787899855011],[],[167],["D",1787899952245],[],[175],["D",1787918949318],[],[183],["D",1787932523533],[],[190],["D",1787934014072],[],[198],["D",1787903467682],[],[207],["D",1787900699441],[],[214],["D",1787900463602],[],[221],["D",1787916918431],[],[228],["D",1787946677336],[],[235],["D",1787916917938],[],[242],["D",1787917158058],[],[249],["D",1787946735811],[],[27],["D",1787946656802],[],[259],["D",1787919618438],[],[266],["D",1787917409813],[],[273],["D",1787916917422],[],[280],["D",1787916916334],[],[287],["D",1787916997313],[],[294],["D",1787916988126],[],[301],["D",1787916916813],[],[308],["D",1787918796895],[],[315],["D",1787946489539],[],[322],["D",1787919794660],[],[329],["D",1787919760368],[],[336],["D",1787902943902],[],[343],["D",1787871527621],["D",1789526460011],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"ctx",{"_80":-5,"_126":506,"_507":508,"_509":510,"_511":24,"_512":24,"_513":24,"_514":57,"_515":-5,"_516":-7,"_517":-7,"_518":61,"_519":24,"_520":24,"_521":-5,"_522":24,"_523":24,"_524":24,"_525":-5},"ENV",{"_477":478,"_479":480,"_481":88,"_482":483,"_484":485,"_486":487,"_488":489,"_490":491,"_492":493,"_494":495,"_496":497,"_498":499,"_500":501,"_502":503,"_504":505},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v102