[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_312":313,"_314":315},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_17":18,"_38":-7,"_126":-5,"_19":127,"_128":129,"_130":131,"_132":133,"_134":135,"_21":136,"_137":-5,"_138":-5,"_139":24,"_140":141,"_142":85,"_143":-5,"_144":-5,"_145":146},"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":24,"_30":-5},"handle","oromaskevic23","name","imperial-nca-31day-runtime","branchName","p0-signed-capability-connectors-20260828","path","connector_auth.ts","project",{"_32":72,"_13":14,"_36":73,"_74":-5,"_75":24,"_76":77,"_78":77,"_79":80,"_81":-5,"_30":68,"_82":83,"_84":85,"_86":-5,"_87":-5,"_88":26,"_40":41,"_89":90,"_91":92,"_93":94,"_95":-5,"_96":97,"_98":97,"_99":100,"_101":100,"_102":100,"_103":97,"_104":97,"_53":105,"_106":107,"_108":109,"_110":24},"file",{"_63":64,"_13":18,"_65":66,"_67":24,"_71":-5},"isDirectory",false,"page",0,"history",[31],"hasNext","userId",{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":-5,"_58":-5,"_59":-5,"_60":61},"id","1527b85a-f475-4f22-9c10-a4e101031023","branchId","75cac199-8a96-496a-9e25-3222107dae53","createdAt",["D",1787916759847],"version",2,"orgId","01a03585-eb44-758d-92a4-77db1a9a243c","parentId","b3a38199-ec2d-4d7e-992a-59229cd6f67d","incomingCommitId","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","mcp","clientLabel","ChatGPT","user",{"_32":68,"_40":41,"_11":12,"_69":70},{"_63":64,"_13":18,"_65":66,"_67":24},"pull","merge","revert","multiple","commits",[62],{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":-5,"_58":-5},"fileId","2d19a7ca-a2d4-11f1-be21-1607ee4eb77e","fileType","script","deleted","fe39b163-4b50-466e-82d1-8bd01133e4b6","avatar","https://lh3.googleusercontent.com/a/ACg8ocIo1MJ3hDjpQrinMIRok3d2YY1vpHgehs8m2u1_vc7pmFovRGI=s96-c","deletedAtVersion","80b8839b-de86-40ee-8340-1df5edf7503f",["D",1787871527621],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","100-NCA 31-day bootstrap runtime","imageUrl","pinnedFileId","d8315798-a2ac-11f1-ac46-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","80b8839bde8640ee83401df5edf7503f","tursoHostname","80b8839bde8640ee83401df5edf7503f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789526460011],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_125":70},"org",{"_11":12,"_120":121,"_69":70,"_30":68,"_122":123,"_124":24},"branch",{"_38":111,"_13":16,"_32":35,"_112":72,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":14,"_119":12},"isOwned",10,"projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Олександр Ромаскевич","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_32":72,"_13":14,"_36":307,"_74":-5,"_75":24,"_76":77,"_78":77,"_79":80,"_81":-5,"_30":68,"_82":83,"_84":85,"_86":-5,"_87":-5,"_88":26,"_40":41,"_89":90,"_91":92,"_93":308,"_95":-5,"_96":97,"_98":97,"_99":100,"_101":100,"_102":100,"_103":97,"_104":97,"_53":309,"_106":310,"_108":311,"_110":24},"tree",[167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"files",[167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"counts",{"_155":26,"_156":157,"_158":26,"_159":160,"_161":162},"contents",[],{"_32":147,"_13":18,"_63":64,"_42":-5,"_34":35,"_148":39,"_149":85,"_36":150,"_38":26,"_65":66,"_151":152,"_67":24,"_153":-5,"_17":154},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},"13b1b7b9-24a3-4a45-8f5f-bcb3eb1a07d9","branchVersion","latest",["D",1787916759847],"content","const EXECUTION_BRIDGE = \"https://oromaskevic23--4ca6bf4aa2ae11f1a3f01607ee4eb77e.web.val.run\";\nconst SERVICE_ID = \"VAL_TOWN_CODEX_CONNECTOR\";\n\ntype Capability = \"QUEUE_READ\" | \"QUEUE_CLAIM\" | \"QUEUE_COMPLETE\" | \"QUEUE_FAIL\" | \"QUEUE_RELEASE\";\n\nfunction utf8(value:string){ return new TextEncoder().encode(value); }\n\nasync function sha256(value:string){\n const digest = await crypto.subtle.digest(\"SHA-256\", utf8(value));\n return \"sha256:\" + [...new Uint8Array(digest)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");\n}\n\nasync function hmacHex(secret:string,value:string){\n const key = await crypto.subtle.importKey(\"raw\", utf8(secret), {name:\"HMAC\",hash:\"SHA-256\"}, false, [\"sign\"]);\n const signature = await crypto.subtle.sign(\"HMAC\", key, utf8(value));\n return [...new Uint8Array(signature)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");\n}\n\nexport async function signedCapabilityFetch(method:string,pathWithQuery:string,capability:Capability,body=\"\"){\n const token = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\n if (!token) throw new Error(\"EXECUTION_APPROVAL_TOKEN_MISSING\");\n const timestamp = new Date().toISOString();\n const nonce = crypto.randomUUID();\n const bodyHash = await sha256(body);\n const canonical = [method.toUpperCase(),pathWithQuery,timestamp,nonce,SERVICE_ID,capability,bodyHash].join(\"\\n\");\n const signature = await hmacHex(token,canonical);\n const headers:Record = {\n \"x-imperial-service-id\":SERVICE_ID,\n \"x-imperial-capability\":capability,\n \"x-imperial-timestamp\":timestamp,\n \"x-imperial-nonce\":nonce,\n \"x-imperial-signature\":signature,\n };\n if (body) headers[\"content-type\"] = \"application/json\";\n return await fetch(`${EXECUTION_BRIDGE}${pathWithQuery}`,{\n method:method.toUpperCase(),headers,body:body || undefined,signal:AbortSignal.timeout(10_000)\n });\n}\n\nexport const connectorAuthMetadata = {\n serviceId:SERVICE_ID,\n secretExposed:false,\n authMode:\"HMAC_SHA256_SIGNED_CAPABILITY\",\n tokenTransport:\"SERVER_SIDE_ONLY\"\n};","label",[18],"pulls","branches",3,"forks","envVars",{"_163":165,"_166":26},"connections",{"_163":26,"_164":26},"count","unfilledCount",5,"emptyCount",{"_32":300,"_13":301,"_63":302,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":303,"_38":26,"_65":189,"_151":304,"_67":24,"_153":-5,"_191":305,"_17":306},{"_32":147,"_13":18,"_63":64,"_42":-5,"_34":35,"_148":39,"_149":85,"_36":297,"_38":26,"_65":66,"_151":152,"_67":24,"_153":-5,"_191":298,"_17":299},{"_32":290,"_13":291,"_63":292,"_42":-5,"_34":35,"_148":165,"_149":85,"_36":293,"_38":187,"_65":66,"_151":294,"_67":24,"_153":-5,"_191":295,"_17":296},{"_32":282,"_13":283,"_63":284,"_42":-5,"_34":35,"_148":285,"_149":85,"_36":286,"_38":26,"_65":66,"_151":287,"_67":24,"_153":-5,"_191":288,"_17":289},{"_32":274,"_13":275,"_63":276,"_42":-5,"_34":35,"_148":277,"_149":85,"_36":278,"_38":39,"_65":66,"_151":279,"_67":24,"_153":-5,"_191":280,"_17":281},{"_32":266,"_13":267,"_63":268,"_42":-5,"_34":35,"_148":269,"_149":85,"_36":270,"_38":187,"_65":66,"_151":271,"_67":24,"_153":-5,"_191":272,"_17":273},{"_32":258,"_13":259,"_63":260,"_42":-5,"_34":35,"_148":261,"_149":85,"_36":262,"_38":187,"_65":66,"_151":263,"_67":24,"_153":-5,"_191":264,"_17":265},{"_32":251,"_13":252,"_63":253,"_42":-5,"_34":35,"_148":111,"_149":85,"_36":254,"_38":26,"_65":66,"_151":255,"_67":24,"_153":-5,"_191":256,"_17":257},{"_32":244,"_13":245,"_63":246,"_42":-5,"_34":35,"_148":157,"_149":85,"_36":247,"_38":187,"_65":66,"_151":248,"_67":24,"_153":-5,"_191":249,"_17":250},{"_32":237,"_13":238,"_63":239,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":240,"_38":26,"_65":189,"_151":241,"_67":24,"_153":-5,"_191":242,"_17":243},{"_32":230,"_13":231,"_63":232,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":233,"_38":26,"_65":66,"_151":234,"_67":24,"_153":-5,"_191":235,"_17":236},{"_32":223,"_13":224,"_63":225,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":226,"_38":26,"_65":66,"_151":227,"_67":24,"_153":-5,"_191":228,"_17":229},{"_32":216,"_13":217,"_63":218,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":219,"_38":26,"_65":189,"_151":220,"_67":24,"_153":-5,"_191":221,"_17":222},{"_32":208,"_13":209,"_63":210,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":211,"_38":26,"_65":212,"_151":213,"_67":24,"_153":-5,"_191":214,"_17":215},{"_32":201,"_13":202,"_63":203,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":204,"_38":26,"_65":189,"_151":205,"_67":24,"_153":-5,"_191":206,"_17":207},{"_32":194,"_13":195,"_63":196,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":197,"_38":26,"_65":66,"_151":198,"_67":24,"_153":-5,"_191":199,"_17":200},{"_32":184,"_13":185,"_63":186,"_42":-5,"_34":35,"_148":187,"_149":85,"_36":188,"_38":26,"_65":189,"_151":190,"_67":24,"_153":-5,"_191":192,"_17":193},"6d3c4b87-f400-4e57-8eb7-f42171bc7923","stripe_status.ts","01a04824-884d-71a4-a5ec-bb829810451b",1,["D",1787916748882],"http","import Stripe from \"npm:stripe\";\n\nexport default async function (_req: Request): Promise {\n const names = Object.keys(Deno.env.toObject()).filter(k => /stripe/i.test(k));\n const candidates = names.filter(k => /secret|api|key|token/i.test(k));\n let credentialSource: string | null = null;\n let accountId: string | null = null;\n for (const name of candidates) {\n const value = Deno.env.get(name);\n if (!value) continue;\n try {\n const stripe = new Stripe(value);\n const acct = await stripe.accounts.retrieve();\n if (acct?.id) { credentialSource = name; accountId = acct.id; break; }\n } catch {}\n }\n return Response.json({stripeEnvKeys:names, candidateCredentialKeys:candidates, readOnlyStripeAccountProbe:credentialSource?\"PASS\":\"NOT_AVAILABLE\", credentialSource, accountId: accountId ? accountId.slice(0,8)+\"…\" : null});\n}\n","children",[],[185],"84a9f7ce-27ed-4416-aafa-c69da5faa9f8","stripe_probe.ts","01a04824-884d-71a4-a5ec-b49a8164c965",["D",1787916748882],"import Stripe from \"npm:stripe\";\n\nexport default async function () {\n const names = Object.keys(Deno.env.toObject()).filter(k => /stripe/i.test(k));\n const candidates = names.filter(k => /secret|api|key|token/i.test(k));\n let workingKey: string | null = null;\n for (const name of candidates) {\n const value = Deno.env.get(name);\n if (!value) continue;\n try {\n const stripe = new Stripe(value);\n const acct = await stripe.accounts.retrieve();\n if (acct?.id) { workingKey = name; break; }\n } catch { /* read-only probe only */ }\n }\n return {stripeEnvKeys:names, candidateCredentialKeys:candidates, readOnlyStripeAccountProbe:workingKey ? \"PASS\" : \"NOT_AVAILABLE\", credentialSource:workingKey ? workingKey : null};\n}\n",[],[195],"336b4fa2-7995-41dc-9040-546a182bb1b8","stripe_bridge.ts","01a04824-884d-71a4-a5ec-b3aac6641d23",["D",1787916748882],"import Stripe from \"npm:stripe\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst KEY = Deno.env.get(\"STRIPE_SECRET_KEY\");\nconst WHSEC = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\");\nconst APPROVAL = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\n\nasync function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS stripe_events (\n id TEXT PRIMARY KEY, type TEXT NOT NULL, created INTEGER NOT NULL,\n livemode INTEGER NOT NULL, payload TEXT NOT NULL, received_at TEXT NOT NULL\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS payment_evidence (\n evidence_id TEXT PRIMARY KEY, agent_id TEXT, customer_email TEXT,\n amount_total INTEGER, currency TEXT, payment_status TEXT,\n checkout_session_id TEXT, payment_intent_id TEXT, received_at TEXT NOT NULL,\n evidence_source TEXT NOT NULL\n )`);\n}\n\nexport default async function(req: Request): Promise {\n await ensureTables();\n const url = new URL(req.url);\n\n if (url.pathname === \"/status\") {\n return Response.json({\n stripeBridge:\"IMPERIAL_STRIPE_BRIDGE_v1\",\n apiCredential: KEY ? \"PRESENT\" : \"MISSING\",\n webhookSecret: WHSEC ? \"PRESENT\" : \"MISSING\",\n liveReady: Boolean(KEY && WHSEC),\n truthBoundary:\"No payment is counted without verified Stripe event evidence\"\n });\n }\n\n if (url.pathname === \"/create-checkout-session\" && req.method === \"POST\") {\n const supplied = req.headers.get(\"authorization\");\n if (!APPROVAL || supplied !== `Bearer ${APPROVAL}`) return Response.json({error:\"APPROVAL_REQUIRED\"},{status:401});\n if (!KEY) return Response.json({error:\"STRIPE_SECRET_KEY_MISSING\"},{status:503});\n const stripe = new Stripe(KEY);\n const body = await req.json().catch(()=>null) as any;\n const amountUsd = Number(body?.amount_usd);\n const description = String(body?.description ?? \"IMPERIAL Core service\");\n const agentId = String(body?.agent_id ?? \"UNKNOWN\");\n if (!Number.isFinite(amountUsd) || amountUsd <= 0 || amountUsd > 1000000) {\n return Response.json({error:\"INVALID_AMOUNT\"},{status:400});\n }\n const session = await stripe.checkout.sessions.create({\n mode:\"payment\",\n line_items:[{price_data:{currency:\"usd\",product_data:{name:description},unit_amount:Math.round(amountUsd*100)},quantity:1}],\n metadata:{agent_id:agentId, system:\"IMPERIAL Core\"},\n success_url:`${url.origin}/success?session_id={CHECKOUT_SESSION_ID}`,\n cancel_url:`${url.origin}/cancel`\n });\n return Response.json({id:session.id,url:session.url,status:session.status});\n }\n\n if (url.pathname === \"/webhook\" && req.method === \"POST\") {\n if (!KEY || !WHSEC) return Response.json({error:\"STRIPE_WEBHOOK_NOT_CONFIGURED\"},{status:503});\n const stripe = new Stripe(KEY);\n const signature = req.headers.get(\"stripe-signature\");\n if (!signature) return new Response(\"Missing signature\",{status:400});\n const raw = await req.text();\n let event: Stripe.Event;\n try { event = await stripe.webhooks.constructEventAsync(raw, signature, WHSEC); }\n catch { return new Response(\"Bad signature\",{status:400}); }\n await sqlite.execute({sql:`INSERT OR IGNORE INTO stripe_events(id,type,created,livemode,payload,received_at) VALUES(?,?,?,?,?,?)`,args:[event.id,event.type,event.created,event.livemode?1:0,raw,new Date().toISOString()]});\n if (event.type === \"checkout.session.completed\") {\n const s = event.data.object as Stripe.Checkout.Session;\n await sqlite.execute({sql:`INSERT OR REPLACE INTO payment_evidence(evidence_id,agent_id,customer_email,amount_total,currency,payment_status,checkout_session_id,payment_intent_id,received_at,evidence_source) VALUES(?,?,?,?,?,?,?,?,?,?)`,args:[event.id,String(s.metadata?.agent_id ?? \"UNKNOWN\"),String(s.customer_details?.email ?? \"\"),Number(s.amount_total ?? 0),String(s.currency ?? \"\"),String(s.payment_status ?? \"\"),s.id,String(s.payment_intent ?? \"\"),new Date().toISOString(),\"STRIPE_SIGNED_WEBHOOK\"]});\n }\n return Response.json({received:true,event_id:event.id,type:event.type});\n }\n\n if (url.pathname === \"/success\") return new Response(\"Payment received. Verification is being recorded.\");\n if (url.pathname === \"/cancel\") return new Response(\"Payment cancelled.\");\n return new Response(\"IMPERIAL Stripe Bridge\",{status:200});\n}\n",[],[202],"abbf7178-7cea-47fd-9cc2-439fe5306415","runner.ts","01a04824-884d-71a4-a5ec-ad363ee40685",["D",1787916748882],"interval","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst START = \"2026-08-28T01:42:37+03:00\";\nconst END = \"2026-09-28T01:42:37+03:00\";\nconst ROUTER_VERSION = \"IMPERIAL-Revenue-Mission-Router-v4.1-LIVE\";\nconst SEARCH_VERSION = \"IMPERIAL-Strategic-Search-v1.0-LIVE\";\n\nfunction phase(day:number) {\n if (day <= 3) return \"OFFER_AND_PROOF\";\n if (day <= 7) return \"MARKET_VALIDATION\";\n if (day <= 14) return \"QUALIFIED_PIPELINE\";\n if (day <= 21) return \"DELIVERY_AND_CONVERSION\";\n if (day <= 28) return \"SCALE_PROVEN_CHANNELS\";\n return \"CLOSURE_AND_AUDIT\";\n}\n\ntype Route = {\n primary:string; fallback:string; buyer:string; proof:string; cashPath:string;\n margin:number; urgency:number; evidence:number; timeToCash:number; roleFit:number;\n};\n\nconst ROUTES:Record = {\n \"Kids Media\": {\n primary:\"B2B positive-media licensing / branded educational production\",\n fallback:\"paid localization or pilot-production package\",\n buyer:\"publishers, education platforms, family brands, broadcasters\",\n proof:\"pilot concept + story bible + safety/localization sample\",\n cashPath:\"paid pilot, production deposit, or licence deposit\",\n margin:0.78, urgency:0.58, evidence:0.72, timeToCash:0.63, roleFit:0.96\n },\n \"Dropshipping Commerce\": {\n primary:\"paid ecommerce growth diagnostic + implementation retainer\",\n fallback:\"validated product / merchandising operations package\",\n buyer:\"existing ecommerce operators and brands\",\n proof:\"store/product audit with sourced conversion and operations findings\",\n cashPath:\"paid diagnostic, then implementation retainer\",\n margin:0.72, urgency:0.82, evidence:0.78, timeToCash:0.84, roleFit:0.97\n },\n \"AI Automation\": {\n primary:\"high-ticket governed AI automation discovery + implementation\",\n fallback:\"workflow assessment and bounded prototype engagement\",\n buyer:\"SMEs and enterprise teams with repetitive high-cost workflows\",\n proof:\"workflow map + bounded prototype + eval + labelled ROI hypothesis\",\n cashPath:\"paid discovery or implementation deposit\",\n margin:0.88, urgency:0.82, evidence:0.82, timeToCash:0.78, roleFit:0.99\n },\n \"B2B Revenue\": {\n primary:\"paid RevOps / enterprise sales acceleration sprint\",\n fallback:\"account pipeline and proposal-system engagement\",\n buyer:\"B2B firms with measurable sales bottlenecks\",\n proof:\"funnel diagnosis + account map + proposal system\",\n cashPath:\"strategy sprint fee, then service retainer\",\n margin:0.84, urgency:0.90, evidence:0.84, timeToCash:0.86, roleFit:0.99\n },\n \"Creative & Digital\": {\n primary:\"premium digital production / licensing engagement\",\n fallback:\"paid concept, prototype, or design sprint\",\n buyer:\"brands, agencies, property, media and technology companies\",\n proof:\"portfolio-grade concept, prototype or visual demo\",\n cashPath:\"design/development deposit or licence fee\",\n margin:0.80, urgency:0.68, evidence:0.80, timeToCash:0.70, roleFit:0.97\n },\n \"Education\": {\n primary:\"B2B training / curriculum / enablement licence\",\n fallback:\"paid course-production or assessment-design package\",\n buyer:\"companies, schools, training providers, professional organizations\",\n proof:\"sample module + curriculum map + assessment plan\",\n cashPath:\"cohort/licence deposit or production fee\",\n margin:0.79, urgency:0.62, evidence:0.80, timeToCash:0.64, roleFit:0.98\n },\n \"Data & Market Intelligence\": {\n primary:\"paid market intelligence / competitive decision-support sprint\",\n fallback:\"research subscription or recurring intelligence brief\",\n buyer:\"operators, investors, product and strategy teams\",\n proof:\"sourced intelligence brief with confidence labels\",\n cashPath:\"paid research sprint or subscription prepayment\",\n margin:0.86, urgency:0.74, evidence:0.90, timeToCash:0.76, roleFit:0.99\n },\n \"SME Services\": {\n primary:\"paid operational diagnostic + transformation retainer\",\n fallback:\"bounded implementation package for one measurable constraint\",\n buyer:\"SMEs with measurable process, cost or growth constraints\",\n proof:\"diagnostic + control map + implementation roadmap\",\n cashPath:\"paid diagnostic, then implementation retainer\",\n margin:0.76, urgency:0.84, evidence:0.82, timeToCash:0.82, roleFit:0.98\n }\n};\n\nfunction routeScore(r:Route) {\n // Planning score only. Never a probability or revenue forecast.\n return 0.23*r.evidence + 0.22*r.roleFit + 0.20*r.timeToCash + 0.14*r.margin + 0.13*r.urgency + 0.08;\n}\n\nconst STAGES = [\n \"DEFINE_OFFER\",\n \"BUILD_PROOF\",\n \"QUALIFY_BUYERS\",\n \"PREPARE_APPROVED_OUTREACH\",\n \"HANDLE_RESPONSE_OR_RESEARCH_NEXT\",\n \"PREPARE_PROPOSAL_OR_PAID_DIAGNOSTIC\",\n \"DELIVER_OR_IMPROVE_PROOF\",\n \"VERIFY_EVIDENCE_AND_REPLAN\"\n] as const;\n\nfunction actionStage(stageIndex:number, day:number) {\n if (day >= 29) return \"AUDIT_AND_CLOSE\";\n return STAGES[Math.max(0, Math.min(STAGES.length-1, stageIndex))];\n}\n\nfunction nextAction(domain:string, stageIndex:number, day:number) {\n const r = ROUTES[domain];\n if (!r) return \"ROLE_ALIGNED_RESEARCH: define one lawful high-value offer and evidence plan\";\n const stage = actionStage(stageIndex, day);\n const m:Record = {\n DEFINE_OFFER:`lock one primary offer: ${r.primary}; keep only one fallback: ${r.fallback}`,\n BUILD_PROOF:`build/fact-check proof asset: ${r.proof}`,\n QUALIFY_BUYERS:`build a small qualified buyer queue matching: ${r.buyer}; no mass spam`,\n PREPARE_APPROVED_OUTREACH:`prepare personalized factual outreach drafts for qualified buyers; external send requires allowed connector/policy`,\n HANDLE_RESPONSE_OR_RESEARCH_NEXT:`process verified buyer replies if any; otherwise improve qualification using evidence, not volume`,\n PREPARE_PROPOSAL_OR_PAID_DIAGNOSTIC:`prepare a concrete paid proposal with cash path: ${r.cashPath}`,\n DELIVER_OR_IMPROVE_PROOF:`if a paid engagement exists, deliver governed scope; otherwise strengthen proof and buyer fit`,\n VERIFY_EVIDENCE_AND_REPLAN:`verify external evidence, reject pipeline-as-revenue, score route, then keep primary or switch to fallback`,\n AUDIT_AND_CLOSE:`audit lawful collected net revenue, evidence, refunds/chargebacks and unresolved obligations`\n };\n return `${stage}: ${m[stage]}`;\n}\n\nexport default async function (interval: Interval) {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS agents (\n agent_id TEXT PRIMARY KEY, domain TEXT NOT NULL, role TEXT NOT NULL,\n target_usd INTEGER NOT NULL DEFAULT 1000000, salman INTEGER NOT NULL DEFAULT 100,\n status TEXT NOT NULL DEFAULT 'ARMED', last_heartbeat TEXT,\n tick_count INTEGER NOT NULL DEFAULT 0, mission_day INTEGER NOT NULL DEFAULT 1,\n phase TEXT, next_action TEXT, network_ok INTEGER NOT NULL DEFAULT 0\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS routing_state (\n agent_id TEXT PRIMARY KEY,\n router_version TEXT NOT NULL,\n strategic_search_version TEXT NOT NULL,\n route_revision INTEGER NOT NULL DEFAULT 0,\n strategic_phase TEXT NOT NULL,\n action_stage TEXT NOT NULL,\n primary_route TEXT NOT NULL,\n fallback_route TEXT NOT NULL,\n buyer_profile TEXT NOT NULL,\n proof_asset TEXT NOT NULL,\n cash_path TEXT NOT NULL,\n planning_score REAL NOT NULL,\n next_action TEXT NOT NULL,\n next_action_at TEXT NOT NULL,\n approval_gate TEXT NOT NULL,\n evidence_gate TEXT NOT NULL,\n truth_boundary TEXT NOT NULL,\n last_replanned_at TEXT NOT NULL\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS agent_progress (\n agent_id TEXT PRIMARY KEY,\n stage_index INTEGER NOT NULL DEFAULT 0,\n stage_state TEXT NOT NULL DEFAULT 'WAITING_FOR_EVIDENCE',\n evidence_count INTEGER NOT NULL DEFAULT 0,\n last_evidence_ref TEXT,\n last_advanced_at TEXT\n )`);\n await sqlite.execute(`INSERT OR IGNORE INTO agent_progress(agent_id) SELECT agent_id FROM agents`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n agent_id TEXT NOT NULL,\n action_stage TEXT NOT NULL,\n next_action TEXT NOT NULL,\n connector TEXT NOT NULL,\n execution_state TEXT NOT NULL,\n created_at TEXT NOT NULL,\n updated_at TEXT NOT NULL,\n evidence_ref TEXT,\n permission_decision TEXT,\n permission_reason TEXT\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS codex_assist_profile (\n agent_id TEXT PRIMARY KEY,\n enabled INTEGER NOT NULL DEFAULT 1,\n preferred_model TEXT NOT NULL,\n reasoning_effort TEXT NOT NULL,\n allowed_tasks TEXT NOT NULL,\n authority_rule TEXT NOT NULL,\n status TEXT NOT NULL\n )`);\n await sqlite.execute(`INSERT OR IGNORE INTO codex_assist_profile(agent_id,enabled,preferred_model,reasoning_effort,allowed_tasks,authority_rule,status)\n SELECT agent_id,1,'ChatGPT Codex (Plus)','plan-managed','code,automation,integration,prototype,test,debug,data-pipeline,landing-page,technical-proof','CODEX_ASSIST_HAS_NO_INDEPENDENT_AUTHORITY','PLUS_ONLY' FROM agents`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS codex_assist_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n agent_id TEXT NOT NULL,\n mission_stage TEXT NOT NULL,\n task_type TEXT NOT NULL,\n objective TEXT NOT NULL,\n context TEXT,\n acceptance_criteria TEXT NOT NULL,\n state TEXT NOT NULL DEFAULT 'QUEUED_PLUS_HANDOFF',\n created_at TEXT NOT NULL,\n started_at TEXT,\n completed_at TEXT,\n result_ref TEXT,\n result_text TEXT,\n error TEXT\n )`);\n\n const now = new Date();\n const start = new Date(START);\n const end = new Date(END);\n const day = Math.max(1, Math.min(31, Math.floor((now.getTime()-start.getTime())/86400000)+1));\n const active = now <= end;\n\n let networkOk = 0;\n const probes = [\n [\"https://www.cloudflare.com/cdn-cgi/trace\", {}],\n [\"https://api.github.com/zen\", {headers:{\"User-Agent\":\"IMPERIAL-Core-NCA-Runtime\"}}],\n ] as const;\n for (const [url, init] of probes) {\n try {\n const r = await fetch(url, {...init, signal: AbortSignal.timeout(5000)});\n if (r.ok) { networkOk = 1; break; }\n } catch { /* next independent probe */ }\n }\n\n const rows = await sqlite.execute(`SELECT a.agent_id,a.domain,a.tick_count,COALESCE(p.stage_index,0) AS stage_index FROM agents a LEFT JOIN agent_progress p ON p.agent_id=a.agent_id ORDER BY a.agent_id`);\n for (const row of rows.rows as any[]) {\n const id = String(row.agent_id);\n const d = String(row.domain);\n const stageIndex = Number(row.stage_index ?? 0);\n const r = ROUTES[d];\n const action = nextAction(d, stageIndex, day);\n const stage = actionStage(stageIndex, day);\n\n await sqlite.execute({sql:`UPDATE agents SET status=?, last_heartbeat=?, tick_count=tick_count+1,\n mission_day=?, phase=?, next_action=?, network_ok=? WHERE agent_id=?`,\n args:[active?\"RUNNING\":\"MISSION_ENDED\", now.toISOString(), day, phase(day), action, networkOk, id]});\n\n if (r) {\n await sqlite.execute({sql:`INSERT INTO routing_state(\n agent_id,router_version,strategic_search_version,route_revision,strategic_phase,action_stage,\n primary_route,fallback_route,buyer_profile,proof_asset,cash_path,planning_score,next_action,next_action_at,\n approval_gate,evidence_gate,truth_boundary,last_replanned_at)\n VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)\n ON CONFLICT(agent_id) DO UPDATE SET\n router_version=excluded.router_version,\n strategic_search_version=excluded.strategic_search_version,\n route_revision=routing_state.route_revision+1,\n strategic_phase=excluded.strategic_phase,\n action_stage=excluded.action_stage,\n primary_route=excluded.primary_route,\n fallback_route=excluded.fallback_route,\n buyer_profile=excluded.buyer_profile,\n proof_asset=excluded.proof_asset,\n cash_path=excluded.cash_path,\n planning_score=excluded.planning_score,\n next_action=excluded.next_action,\n next_action_at=excluded.next_action_at,\n approval_gate=excluded.approval_gate,\n evidence_gate=excluded.evidence_gate,\n truth_boundary=excluded.truth_boundary,\n last_replanned_at=excluded.last_replanned_at`,\n args:[id,ROUTER_VERSION,SEARCH_VERSION,1,phase(day),stage,r.primary,r.fallback,r.buyer,r.proof,r.cashPath,\n routeScore(r),action,now.toISOString(),\n \"EXTERNAL_SEND_SPEND_SIGN_OR_IRREVERSIBLE_ACTION_REQUIRES_ALLOWED_AUTHORITY\",\n \"COUNT_ONLY_LAWFUL_EXTERNALLY_EVIDENCED_COLLECTED_NET_REVENUE\",\n \"PLANNING_SCORE_IS_NOT_REVENUE_FORECAST_OR_GUARANTEE\",now.toISOString()]});\n }\n }\n\n await sqlite.execute(`UPDATE execution_queue\n SET execution_state='SUPERSEDED', updated_at=?\n WHERE execution_state='READY'\n AND EXISTS (\n SELECT 1 FROM routing_state rs\n WHERE rs.agent_id=execution_queue.agent_id\n AND (rs.action_stage<>execution_queue.action_stage OR rs.next_action<>execution_queue.next_action)\n )`, [now.toISOString()]);\n\n await sqlite.execute(`INSERT INTO execution_queue(\n agent_id,action_stage,next_action,connector,execution_state,created_at,updated_at,permission_decision,permission_reason\n )\n SELECT rs.agent_id,rs.action_stage,rs.next_action,\n CASE\n WHEN rs.action_stage IN ('DEFINE_OFFER','BUILD_PROOF','QUALIFY_BUYERS','HANDLE_RESPONSE_OR_RESEARCH_NEXT','VERIFY_EVIDENCE_AND_REPLAN') THEN 'RESEARCH_CRM'\n WHEN rs.action_stage='PREPARE_APPROVED_OUTREACH' THEN 'GMAIL_DRAFT'\n WHEN rs.action_stage='PREPARE_PROPOSAL_OR_PAID_DIAGNOSTIC' THEN 'CRM_STRIPE_PREP'\n ELSE 'RUNTIME_INTERNAL'\n END,\n 'READY',?,?,'ALLOW','STANDING_DELEGATION_L1_OR_PREPARATION'\n FROM routing_state rs\n WHERE NOT EXISTS (\n SELECT 1 FROM execution_queue q\n WHERE q.agent_id=rs.agent_id\n AND q.action_stage=rs.action_stage\n AND q.next_action=rs.next_action\n AND q.execution_state IN ('READY','CLAIMED')\n )`, [now.toISOString(),now.toISOString()]);\n\n await sqlite.execute(`INSERT INTO codex_assist_queue(agent_id,mission_stage,task_type,objective,context,acceptance_criteria,state,created_at)\n SELECT rs.agent_id,rs.action_stage,\n CASE WHEN rs.action_stage='BUILD_PROOF' THEN 'TECHNICAL_PROOF' ELSE 'DELIVERY_AUTOMATION' END,\n CASE WHEN rs.action_stage='BUILD_PROOF'\n THEN 'Create the smallest implementation-ready technical artifact that materially strengthens this proof asset: ' || rs.proof_asset\n ELSE 'Implement or improve the technical delivery needed for the proven engagement without expanding business scope.' END,\n 'Primary route: ' || rs.primary_route || '\\nBuyer: ' || rs.buyer_profile || '\\nCash path: ' || rs.cash_path || '\\nNCA next action: ' || rs.next_action,\n 'Return implementation-ready code/design, explicit assumptions, test plan, security checks, and completion evidence. Do not contact buyers, spend money, sign, or claim revenue.',\n 'QUEUED_PLUS_HANDOFF',?\n FROM routing_state rs\n JOIN codex_assist_profile cp ON cp.agent_id=rs.agent_id AND cp.enabled=1\n WHERE rs.action_stage IN ('BUILD_PROOF','DELIVER_OR_IMPROVE_PROOF')\n AND NOT EXISTS (\n SELECT 1 FROM codex_assist_queue cq\n WHERE cq.agent_id=rs.agent_id AND cq.mission_stage=rs.action_stage\n AND cq.state IN ('QUEUED_PLUS_HANDOFF','HANDOFF_RUNNING','COMPLETED')\n )`, [now.toISOString()]);\n\n console.log(JSON.stringify({\n runtime:\"IMPERIAL_NCA_BOOTSTRAP\",\n agents:rows.rows.length,\n missionDay:day,\n router:ROUTER_VERSION,\n strategicSearch:SEARCH_VERSION,\n routedAgents:rows.rows.length,\n networkOk,\n at:now.toISOString()\n }));\n}\n",[],[209],"e600010f-d736-4a74-ba75-c9a235ecce68","proof_catalog.ts","01a04824-884d-71a4-a5ec-a95b9a1527b3",["D",1787916748882],"const proofs: Record = {\n \"Kids Media\": {artifact:\"Positive Media Licensing Proof Pack\",deliverable:\"pilot concept + story bible + child-safety/localization checklist\",demonstrates:[\"positive-world creative development\",\"brand-safe content structure\",\"localization-ready production brief\"],truth:\"Capability demonstrator only; no audience or revenue claim.\"},\n \"Dropshipping Commerce\": {artifact:\"Ecommerce Growth Diagnostic Proof Pack\",deliverable:\"store audit framework + merchandising checklist + conversion hypothesis ledger\",demonstrates:[\"structured ecommerce diagnosis\",\"evidence-labelled conversion hypotheses\",\"implementation-retainer scoping\"],truth:\"No conversion uplift claimed without measured client data.\"},\n \"AI Automation\": {artifact:\"Governed AI Automation Proof Pack\",deliverable:\"workflow map + bounded automation architecture + eval/security checklist\",demonstrates:[\"workflow decomposition\",\"governed automation design\",\"test and rollback planning\"],truth:\"ROI remains a hypothesis until measured against a real client baseline.\"},\n \"B2B Revenue\": {artifact:\"RevOps Acceleration Proof Pack\",deliverable:\"funnel diagnosis template + account map + proposal-system blueprint\",demonstrates:[\"pipeline bottleneck analysis\",\"account prioritization\",\"proposal workflow design\"],truth:\"No pipeline or revenue is counted as collected revenue.\"},\n \"Creative & Digital\": {artifact:\"Premium Digital Prototype Proof Pack\",deliverable:\"concept brief + prototype specification + acceptance-test checklist\",demonstrates:[\"premium concept development\",\"prototype scoping\",\"production-quality acceptance criteria\"],truth:\"Portfolio demonstrator; no fabricated client endorsement.\"},\n \"Education\": {artifact:\"B2B Learning License Proof Pack\",deliverable:\"sample module structure + curriculum map + assessment blueprint\",demonstrates:[\"instructional architecture\",\"assessment alignment\",\"license-ready packaging\"],truth:\"Learning outcomes require real learner evaluation before claims.\"},\n \"Data & Market Intelligence\": {artifact:\"Decision Intelligence Proof Pack\",deliverable:\"source register + confidence-labelled brief template + decision matrix\",demonstrates:[\"source discipline\",\"confidence labelling\",\"decision-oriented synthesis\"],truth:\"No unsourced market facts or investment recommendations.\"},\n \"SME Services\": {artifact:\"Operational Diagnostic Proof Pack\",deliverable:\"constraint map + control checklist + implementation roadmap\",demonstrates:[\"process diagnosis\",\"risk/control mapping\",\"bounded transformation planning\"],truth:\"Savings or growth claims require client evidence.\"}\n};\n\nexport default async function(req: Request): Promise {\n const u = new URL(req.url);\n const domain = u.searchParams.get(\"domain\");\n if (domain) {\n const proof = proofs[domain];\n if (!proof) return Response.json({error:\"UNKNOWN_DOMAIN\"},{status:404});\n return Response.json({system:\"IMPERIAL Core\",evidenceClass:\"LIVE_CAPABILITY_PROOF\",domain,...proof,generatedAt:new Date().toISOString()});\n }\n return Response.json({system:\"IMPERIAL Core\",evidenceClass:\"LIVE_CAPABILITY_PROOF_CATALOG\",count:Object.keys(proofs).length,proofs,truthBoundary:\"These are capability demonstrators, not customer results, revenue evidence, endorsements, or guarantees.\"});\n}\n",[],[217],"37ed44c3-0895-4168-ab7b-36b0c37684da","permission_manager_test.ts","01a04824-884d-71a4-a5ec-a71b854ac7f7",["D",1787916748882],"import { decidePermission } from './permission_manager.ts';\n\nconst base = {missionBound:true,runtimeDomainBound:true,capabilityAllowed:true,guardianPass:true};\nconst privateAction = decidePermission({...base,approvalGrantPresent:false,reversiblePrivateWorkspaceAction:true,externalSend:false,financialOrIrreversible:false});\nconst externalSend = decidePermission({...base,approvalGrantPresent:false,reversiblePrivateWorkspaceAction:false,externalSend:true,financialOrIrreversible:false});\nconst externalSendGranted = decidePermission({...base,approvalGrantPresent:true,reversiblePrivateWorkspaceAction:false,externalSend:true,financialOrIrreversible:false});\nconst spend = decidePermission({...base,approvalGrantPresent:false,reversiblePrivateWorkspaceAction:false,externalSend:false,financialOrIrreversible:true});\nconst badMission = decidePermission({...base,missionBound:false,approvalGrantPresent:true,reversiblePrivateWorkspaceAction:true,externalSend:false,financialOrIrreversible:false});\nif (privateAction!=='ALLOW') throw new Error('privateAction');\nif (externalSend!=='APPROVAL_REQUIRED') throw new Error('externalSend');\nif (externalSendGranted!=='ALLOW') throw new Error('externalSendGranted');\nif (spend!=='APPROVAL_REQUIRED') throw new Error('spend');\nif (badMission!=='DENY') throw new Error('badMission');\nconsole.log(JSON.stringify({tests:'5/5 PASS',privateAction,externalSend,externalSendGranted,spend,badMission}));\n",[],[224],"088a2740-b929-4f38-9e00-2dc7366ddf23","permission_manager.ts","01a04824-884d-71a4-a5ec-a089d9a83a66",["D",1787916748882],"export type Decision = 'ALLOW'|'APPROVAL_REQUIRED'|'DENY';\n\nexport type PermissionContext = {\n missionBound: boolean;\n runtimeDomainBound: boolean;\n capabilityAllowed: boolean;\n guardianPass: boolean;\n approvalGrantPresent: boolean;\n reversiblePrivateWorkspaceAction: boolean;\n externalSend: boolean;\n financialOrIrreversible: boolean;\n};\n\nexport function decidePermission(c: PermissionContext): Decision {\n if (!c.missionBound || !c.runtimeDomainBound || !c.capabilityAllowed || !c.guardianPass) return 'DENY';\n if (c.financialOrIrreversible) return c.approvalGrantPresent ? 'ALLOW' : 'APPROVAL_REQUIRED';\n if (c.externalSend) return c.approvalGrantPresent ? 'ALLOW' : 'APPROVAL_REQUIRED';\n if (c.reversiblePrivateWorkspaceAction) return 'ALLOW';\n return c.approvalGrantPresent ? 'ALLOW' : 'APPROVAL_REQUIRED';\n}\n\nexport const CANON = {\n component: 'IMPERIAL Permission Manager',\n version: '1.0-LIVE',\n effectiveAuthority: 'Mission Authority ∩ AI Passport ∩ EIS ∩ Runtime Domain Policy ∩ Guardian Core ∩ Approval Gateway',\n delegationRule: 'Child Authority ⊆ Parent Mission Authority',\n noBypass: true,\n};\n",[],[231],"6faacefe-5b3a-4799-bbfc-cb7b17d3a7c4","execution_bridge.ts","01a04824-884d-71a4-a5ec-9c6a951fdccf",["D",1787916748882],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst POLICY_VERSION = \"IMPERIAL-EXECUTION-BRIDGE-2.0.0\";\nconst MISSION_ID = \"IC-IMPERIAL-NCA-31DAY-COMMERCIAL-RUNTIME-001\";\nconst SERVICE_ID = \"VAL_TOWN_CODEX_CONNECTOR\";\nconst PASSPORT_ID = \"AI-PASSPORT-HANTER-EXECUTION-CONNECTOR-001\";\nconst SERVICE_EXPIRES_AT = \"2026-09-27T22:42:37.000Z\";\nconst APPROVAL_EXPIRES_AT = \"2026-09-27T22:42:37.000Z\";\nconst MAX_BODY_BYTES = 16 * 1024;\nconst MAX_TASK_CHARS = 4096;\nconst ALLOWED_PERMISSION_REASON = \"STANDING_DELEGATION_L1_OR_PREPARATION\";\nconst CAPABILITIES = new Set([\n \"QUEUE_READ\",\n \"QUEUE_CLAIM\",\n \"QUEUE_COMPLETE\",\n \"QUEUE_FAIL\",\n \"QUEUE_RELEASE\",\n]);\nconst DOMAINS = new Map([\n [\"Kids Media\", [\"ORCH-KIDS-MEDIA-001\", \"RD-KIDS-MEDIA-001\"]],\n [\"Dropshipping Commerce\", [\"ORCH-DROPSHIPPING-001\", \"RD-DROPSHIPPING-001\"]],\n [\"AI Automation\", [\"ORCH-AI-AUTOMATION-001\", \"RD-AI-AUTOMATION-001\"]],\n [\"B2B Revenue\", [\"ORCH-B2B-REVENUE-001\", \"RD-B2B-REVENUE-001\"]],\n [\"Creative & Digital\", [\"ORCH-CREATIVE-DIGITAL-001\", \"RD-CREATIVE-DIGITAL-001\"]],\n [\"Education\", [\"ORCH-EDUCATION-001\", \"RD-EDUCATION-001\"]],\n [\"Data & Market Intelligence\", [\"ORCH-DATA-MARKET-001\", \"RD-DATA-MARKET-001\"]],\n [\"SME Services\", [\"ORCH-SME-SERVICES-001\", \"RD-SME-SERVICES-001\"]],\n]);\nconst INJECTION_PATTERNS = [\n /ignore (?:all |any )?(?:previous|prior|system) instructions/i,\n /(?:this is |treat (?:this|the following) as )(?:a )?system message/i,\n /(?:the )?architect (?:has )?approved/i,\n /reveal (?:the )?(?:system prompt|secrets?|credentials?)/i,\n /(?:execute|run) (?:this |the )?(?:command|code|script)/i,\n /bypass (?:the )?(?:approval|guardian|security|policy)/i,\n];\n\ntype Capability = \"QUEUE_READ\" | \"QUEUE_CLAIM\" | \"QUEUE_COMPLETE\" | \"QUEUE_FAIL\" | \"QUEUE_RELEASE\";\ntype AuditType =\n | \"QUEUE_READY_READ\"\n | \"QUEUE_ITEM_CLAIMED\"\n | \"QUEUE_CLAIM_REJECTED\"\n | \"QUEUE_ITEM_COMPLETED\"\n | \"QUEUE_ITEM_FAILED\"\n | \"QUEUE_ITEM_RELEASED\"\n | \"QUEUE_CLAIM_EXPIRED\"\n | \"AUTHORIZATION_DENIED\";\n\nfunction secret(): string {\n const value = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\n if (!value) throw new Error(\"SERVER_AUTH_UNAVAILABLE\");\n return value;\n}\n\nfunction utf8(value: string): Uint8Array {\n return new TextEncoder().encode(value);\n}\n\nasync function sha256(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", utf8(value));\n return \"sha256:\" + [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hmac(value: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n utf8(secret()),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const signature = await crypto.subtle.sign(\"HMAC\", key, utf8(value));\n return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqual(left: string, right: string): boolean {\n if (left.length !== right.length || !/^[a-f0-9]+$/.test(left) || !/^[a-f0-9]+$/.test(right)) return false;\n let difference = 0;\n for (let index = 0; index < left.length; index += 1) {\n difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n }\n return difference === 0;\n}\n\nfunction json(data: unknown, status = 200): Response {\n return Response.json(data, {\n status,\n headers: {\n \"cache-control\": \"no-store\",\n \"x-content-type-options\": \"nosniff\",\n },\n });\n}\n\nfunction exactObject(value: unknown, required: string[], optional: string[] = []): Record | null {\n if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n const object = value as Record;\n const allowed = new Set([...required, ...optional]);\n if (required.some((key) => !Object.hasOwn(object, key))) return null;\n if (Object.keys(object).some((key) => !allowed.has(key))) return null;\n return object;\n}\n\nfunction safeIdentifier(value: unknown, minimum = 8, maximum = 128): string | null {\n if (typeof value !== \"string\" || value.length < minimum || value.length > maximum) return null;\n return /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value) ? value : null;\n}\n\nfunction safeEvidenceRef(value: unknown): string | null {\n if (typeof value !== \"string\" || value.length > 2048) return null;\n return /^(?:urn:evidence:|https:\\/\\/)[^\\s]{8,2048}$/.test(value) ? value : null;\n}\n\nfunction safeHash(value: unknown): string | null {\n return typeof value === \"string\" && /^sha256:[a-f0-9]{64}$/.test(value) ? value : null;\n}\n\nfunction sanitizeTask(value: unknown) {\n const original = typeof value === \"string\" ? value : \"\";\n const normalized = original\n .replace(/[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f]/g, \" \")\n .trim();\n const text = normalized.slice(0, MAX_TASK_CHARS);\n return {\n text,\n trust: \"UNTRUSTED_TASK_DATA\",\n authority: \"NONE\",\n prompt_injection_detected: INJECTION_PATTERNS.some((pattern) => pattern.test(text)),\n truncated: normalized.length > MAX_TASK_CHARS,\n };\n}\n\nasync function addColumn(name: string, definition: string) {\n try {\n await sqlite.execute(`ALTER TABLE execution_queue ADD COLUMN ${name} ${definition}`);\n } catch (error) {\n if (!String(error).toLowerCase().includes(\"duplicate column\")) throw error;\n }\n}\n\nasync function ensureSchema() {\n await addColumn(\"mission_id\", \"TEXT\");\n await addColumn(\"orchestrator_id\", \"TEXT\");\n await addColumn(\"runtime_domain\", \"TEXT\");\n await addColumn(\"guardian_state\", \"TEXT\");\n await addColumn(\"approval_state\", \"TEXT\");\n await addColumn(\"approval_decision_id\", \"TEXT\");\n await addColumn(\"approval_expires_at\", \"TEXT\");\n await addColumn(\"approval_revoked_at\", \"TEXT\");\n await addColumn(\"policy_version\", \"TEXT\");\n await addColumn(\"retriable\", \"INTEGER NOT NULL DEFAULT 1\");\n await addColumn(\"authorization_binding\", \"TEXT\");\n await addColumn(\"claim_id\", \"TEXT\");\n await addColumn(\"claimed_by\", \"TEXT\");\n await addColumn(\"claimed_at\", \"TEXT\");\n await addColumn(\"claim_expires_at\", \"TEXT\");\n await addColumn(\"authorization_decision_id\", \"TEXT\");\n await addColumn(\"failure_reason\", \"TEXT\");\n await addColumn(\"failure_retriable\", \"INTEGER\");\n await addColumn(\"completion_request_id\", \"TEXT\");\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_bridge_claims (\n claim_id TEXT PRIMARY KEY,\n queue_item_id INTEGER NOT NULL,\n claimed_by TEXT NOT NULL,\n passport_id TEXT NOT NULL,\n agent_id TEXT NOT NULL,\n orchestrator_id TEXT NOT NULL,\n runtime_domain TEXT NOT NULL,\n claimed_at TEXT NOT NULL,\n claim_expires_at TEXT NOT NULL,\n authorization_decision_id TEXT NOT NULL,\n state TEXT NOT NULL,\n retriable INTEGER NOT NULL,\n completed_at TEXT,\n failure_reason TEXT\n )`);\n await sqlite.execute(`CREATE UNIQUE INDEX IF NOT EXISTS execution_bridge_one_active_claim\n ON execution_bridge_claims(queue_item_id) WHERE state='ACTIVE'`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_bridge_nonces (\n nonce TEXT PRIMARY KEY,\n service_id TEXT NOT NULL,\n capability TEXT NOT NULL,\n used_at TEXT NOT NULL,\n expires_at TEXT NOT NULL\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_bridge_requests (\n request_id TEXT PRIMARY KEY,\n operation TEXT NOT NULL,\n claim_id TEXT NOT NULL,\n service_id TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS execution_bridge_audit (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n event_id TEXT NOT NULL UNIQUE,\n event_type TEXT NOT NULL,\n timestamp TEXT NOT NULL,\n queue_item_id INTEGER,\n claim_id TEXT,\n request_id TEXT,\n service_id TEXT NOT NULL,\n passport_id TEXT NOT NULL,\n agent_id TEXT,\n orchestrator_id TEXT,\n runtime_domain TEXT,\n authorization_decision_id TEXT NOT NULL,\n previous_state TEXT,\n new_state TEXT,\n result TEXT NOT NULL,\n reason_code TEXT NOT NULL,\n evidence_ref TEXT,\n evidence_sha256 TEXT,\n event_hash TEXT NOT NULL,\n event_signature TEXT NOT NULL\n )`);\n await sqlite.execute(`CREATE TRIGGER IF NOT EXISTS execution_bridge_audit_no_update\n BEFORE UPDATE ON execution_bridge_audit BEGIN SELECT RAISE(ABORT, 'AUDIT_IMMUTABLE'); END`);\n await sqlite.execute(`CREATE TRIGGER IF NOT EXISTS execution_bridge_audit_no_delete\n BEFORE DELETE ON execution_bridge_audit BEGIN SELECT RAISE(ABORT, 'AUDIT_IMMUTABLE'); END`);\n await bindUnboundQueueItems();\n}\n\nfunction domainBinding(domain: string): [string, string] | null {\n return (DOMAINS.get(domain) as [string, string] | undefined) ?? null;\n}\n\nasync function queueBinding(row: Record, orchestratorId: string, runtimeDomain: string): Promise {\n return await hmac(JSON.stringify([\n \"QUEUE_AUTHORIZATION_BINDING_V2\",\n row.id,\n row.agent_id,\n row.action_stage,\n row.next_action,\n row.connector,\n row.created_at,\n row.permission_decision,\n row.permission_reason,\n MISSION_ID,\n orchestratorId,\n runtimeDomain,\n \"PASS\",\n \"ACTIVE\",\n `PM-${row.id}-${row.created_at}`,\n APPROVAL_EXPIRES_AT,\n POLICY_VERSION,\n ]));\n}\n\nasync function bindUnboundQueueItems() {\n const rows = await sqlite.execute(`SELECT q.id,q.agent_id,q.action_stage,q.next_action,q.connector,q.created_at,\n q.permission_decision,q.permission_reason,a.domain\n FROM execution_queue q JOIN agents a ON a.agent_id=q.agent_id\n WHERE q.authorization_binding IS NULL`);\n for (const row of rows.rows as Record[]) {\n if (row.permission_decision !== \"ALLOW\" || row.permission_reason !== ALLOWED_PERMISSION_REASON) continue;\n const binding = domainBinding(String(row.domain));\n if (!binding) continue;\n const [orchestratorId, runtimeDomain] = binding;\n const approvalDecisionId = `PM-${row.id}-${row.created_at}`;\n const authorizationBinding = await queueBinding(row, orchestratorId, runtimeDomain);\n await sqlite.execute({\n sql: `UPDATE execution_queue SET mission_id=?,orchestrator_id=?,runtime_domain=?,guardian_state='PASS',\n approval_state='ACTIVE',approval_decision_id=?,approval_expires_at=?,approval_revoked_at=NULL,\n policy_version=?,retriable=1,authorization_binding=?\n WHERE id=? AND authorization_binding IS NULL AND permission_decision='ALLOW' AND permission_reason=?`,\n args: [\n MISSION_ID,\n orchestratorId,\n runtimeDomain,\n approvalDecisionId,\n APPROVAL_EXPIRES_AT,\n POLICY_VERSION,\n authorizationBinding,\n row.id,\n ALLOWED_PERMISSION_REASON,\n ],\n });\n }\n}\n\nasync function verifyQueueBinding(row: Record): Promise {\n const expected = await queueBinding(row, String(row.orchestrator_id), String(row.runtime_domain));\n return typeof row.authorization_binding === \"string\" && constantTimeEqual(expected, row.authorization_binding);\n}\n\nasync function eventMaterial(input: {\n eventType: AuditType;\n timestamp: string;\n queueItemId: number | null;\n claimId: string | null;\n requestId: string | null;\n serviceId: string;\n agentId: string | null;\n orchestratorId: string | null;\n runtimeDomain: string | null;\n authorizationDecisionId: string;\n previousState: string | null;\n newState: string | null;\n result: \"PASS\" | \"DENY\";\n reasonCode: string;\n evidenceRef: string | null;\n evidenceSha256: string | null;\n}) {\n const eventId = crypto.randomUUID();\n const ordered = [\n eventId,\n input.eventType,\n input.timestamp,\n input.queueItemId,\n input.claimId,\n input.requestId,\n input.serviceId,\n PASSPORT_ID,\n input.agentId,\n input.orchestratorId,\n input.runtimeDomain,\n input.authorizationDecisionId,\n input.previousState,\n input.newState,\n input.result,\n input.reasonCode,\n input.evidenceRef,\n input.evidenceSha256,\n ];\n const eventHash = await sha256(JSON.stringify(ordered));\n const eventSignature = await hmac(eventHash);\n return { ...input, eventId, eventHash, eventSignature };\n}\n\nfunction auditInsert(event: Awaited>) {\n return {\n sql: `INSERT INTO execution_bridge_audit(\n event_id,event_type,timestamp,queue_item_id,claim_id,request_id,service_id,passport_id,\n agent_id,orchestrator_id,runtime_domain,authorization_decision_id,previous_state,new_state,\n result,reason_code,evidence_ref,evidence_sha256,event_hash,event_signature\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n event.eventId,\n event.eventType,\n event.timestamp,\n event.queueItemId,\n event.claimId,\n event.requestId,\n event.serviceId,\n PASSPORT_ID,\n event.agentId,\n event.orchestratorId,\n event.runtimeDomain,\n event.authorizationDecisionId,\n event.previousState,\n event.newState,\n event.result,\n event.reasonCode,\n event.evidenceRef,\n event.evidenceSha256,\n event.eventHash,\n event.eventSignature,\n ],\n };\n}\n\nfunction conditionalClaimAuditInsert(\n event: Awaited>,\n claimId: string,\n) {\n const base = auditInsert(event);\n const valuesIndex = base.sql.indexOf(\" VALUES(\");\n const header = base.sql.slice(0, valuesIndex);\n return {\n sql: `${header} SELECT ?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?\n WHERE EXISTS(SELECT 1 FROM execution_bridge_claims WHERE claim_id=? AND state='ACTIVE')`,\n args: [...base.args, claimId],\n };\n}\n\nasync function appendDenied(reasonCode: string, serviceId = \"UNVERIFIED_CALLER\") {\n try {\n await ensureSchema();\n const timestamp = new Date().toISOString();\n const event = await eventMaterial({\n eventType: \"AUTHORIZATION_DENIED\",\n timestamp,\n queueItemId: null,\n claimId: null,\n requestId: null,\n serviceId: serviceId === SERVICE_ID ? serviceId : \"UNVERIFIED_CALLER\",\n agentId: null,\n orchestratorId: null,\n runtimeDomain: null,\n authorizationDecisionId: await sha256(JSON.stringify([\"DENY\", timestamp, reasonCode])),\n previousState: null,\n newState: null,\n result: \"DENY\",\n reasonCode,\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(event));\n } catch {\n // Authorization response remains fail-closed even if audit storage is unavailable.\n }\n}\n\nasync function authenticate(req: Request, body: string, required: Capability) {\n const serviceId = req.headers.get(\"x-imperial-service-id\") ?? \"\";\n const capability = req.headers.get(\"x-imperial-capability\") ?? \"\";\n const timestamp = req.headers.get(\"x-imperial-timestamp\") ?? \"\";\n const nonce = req.headers.get(\"x-imperial-nonce\") ?? \"\";\n const signature = req.headers.get(\"x-imperial-signature\") ?? \"\";\n\n if (\n serviceId !== SERVICE_ID ||\n capability !== required ||\n !CAPABILITIES.has(capability) ||\n !/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$/.test(timestamp) ||\n !/^[A-Za-z0-9_-]{16,128}$/.test(nonce) ||\n !/^[a-f0-9]{64}$/.test(signature)\n ) {\n await appendDenied(\"SIGNED_CAPABILITY_REQUIRED\", serviceId);\n return { ok: false as const, status: 401, reason: \"UNAUTHORIZED\" };\n }\n const age = Math.abs(Date.now() - Date.parse(timestamp));\n if (!Number.isFinite(age) || age > 60_000 || Date.parse(SERVICE_EXPIRES_AT) <= Date.now()) {\n await appendDenied(\"SIGNED_CAPABILITY_EXPIRED\", serviceId);\n return { ok: false as const, status: 401, reason: \"UNAUTHORIZED\" };\n }\n\n const url = new URL(req.url);\n const bodyHash = await sha256(body);\n const canonical = [\n req.method.toUpperCase(),\n url.pathname + url.search,\n timestamp,\n nonce,\n serviceId,\n capability,\n bodyHash,\n ].join(\"\\n\");\n const expected = await hmac(canonical);\n if (!constantTimeEqual(expected, signature)) {\n await appendDenied(\"SIGNATURE_INVALID\", serviceId);\n return { ok: false as const, status: 401, reason: \"UNAUTHORIZED\" };\n }\n\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM execution_bridge_nonces WHERE expires_at < ?\",\n args: [new Date().toISOString()],\n });\n const inserted = await sqlite.execute({\n sql: `INSERT OR IGNORE INTO execution_bridge_nonces(nonce,service_id,capability,used_at,expires_at)\n VALUES(?,?,?,?,?)`,\n args: [\n nonce,\n serviceId,\n capability,\n timestamp,\n new Date(Date.parse(timestamp) + 5 * 60_000).toISOString(),\n ],\n });\n if (inserted.rowsAffected !== 1) {\n await appendDenied(\"REPLAY_DENIED\", serviceId);\n return { ok: false as const, status: 409, reason: \"REPLAY_DENIED\" };\n }\n\n return {\n ok: true as const,\n serviceId,\n capability: capability as Capability,\n authorizationDecisionId: await sha256(JSON.stringify([\n POLICY_VERSION,\n PASSPORT_ID,\n serviceId,\n capability,\n timestamp,\n nonce,\n bodyHash,\n ])),\n };\n}\n\nasync function expireClaims() {\n const now = new Date().toISOString();\n const expired = await sqlite.execute({\n sql: `SELECT c.claim_id,c.queue_item_id,c.claimed_by,c.agent_id,c.orchestrator_id,\n c.runtime_domain,c.authorization_decision_id,c.retriable,q.execution_state\n FROM execution_bridge_claims c JOIN execution_queue q ON q.id=c.queue_item_id\n WHERE c.state='ACTIVE' AND c.claim_expires_at<=?`,\n args: [now],\n });\n for (const row of expired.rows as Record[]) {\n const newState = Number(row.retriable) === 1 ? \"READY\" : \"FAILED\";\n const event = await eventMaterial({\n eventType: \"QUEUE_CLAIM_EXPIRED\",\n timestamp: now,\n queueItemId: Number(row.queue_item_id),\n claimId: String(row.claim_id),\n requestId: null,\n serviceId: String(row.claimed_by),\n agentId: String(row.agent_id),\n orchestratorId: String(row.orchestrator_id),\n runtimeDomain: String(row.runtime_domain),\n authorizationDecisionId: String(row.authorization_decision_id),\n previousState: \"CLAIMED\",\n newState,\n result: \"PASS\",\n reasonCode: \"CLAIM_LEASE_EXPIRED\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.batch([\n {\n sql: `UPDATE execution_bridge_claims SET state='EXPIRED'\n WHERE claim_id=? AND state='ACTIVE' AND claim_expires_at<=?`,\n args: [row.claim_id, now],\n },\n {\n sql: `UPDATE execution_queue SET execution_state=?,claim_id=NULL,claimed_by=NULL,\n claimed_at=NULL,claim_expires_at=NULL,updated_at=?\n WHERE id=? AND execution_state='CLAIMED' AND claim_id=?`,\n args: [newState, now, row.queue_item_id, row.claim_id],\n },\n auditInsert(event),\n ]);\n }\n return expired.rows.length;\n}\n\nfunction rowEligible(row: Record, now: string): boolean {\n return row.execution_state === \"READY\" &&\n row.permission_decision === \"ALLOW\" &&\n row.permission_reason === ALLOWED_PERMISSION_REASON &&\n row.guardian_state === \"PASS\" &&\n row.approval_state === \"ACTIVE\" &&\n row.approval_revoked_at === null &&\n typeof row.approval_expires_at === \"string\" &&\n Date.parse(row.approval_expires_at) > Date.parse(now) &&\n row.policy_version === POLICY_VERSION &&\n typeof row.runtime_domain === \"string\" &&\n [...DOMAINS.values()].some((entry) => entry[1] === row.runtime_domain) &&\n !sanitizeTask(row.next_action).prompt_injection_detected;\n}\n\nasync function readyItems(limit: number) {\n const now = new Date().toISOString();\n const result = await sqlite.execute({\n sql: `SELECT q.id,q.agent_id,q.action_stage,q.next_action,q.connector,q.execution_state,q.created_at,\n q.permission_decision,q.permission_reason,q.mission_id,q.orchestrator_id,q.runtime_domain,\n q.guardian_state,q.approval_state,q.approval_decision_id,q.approval_expires_at,\n q.approval_revoked_at,q.policy_version,q.retriable,q.authorization_binding\n FROM execution_queue q\n WHERE q.execution_state='READY' AND q.permission_decision='ALLOW'\n AND q.approval_state='ACTIVE' AND q.approval_revoked_at IS NULL\n AND q.approval_expires_at>? AND q.policy_version=?\n ORDER BY q.id LIMIT ?`,\n args: [now, POLICY_VERSION, Math.min(100, Math.max(1, limit * 3))],\n });\n const output = [];\n for (const row of result.rows as Record[]) {\n if (!rowEligible(row, now) || !(await verifyQueueBinding(row))) continue;\n output.push({\n queue_item_id: Number(row.id),\n mission_id: String(row.mission_id),\n agent_id: String(row.agent_id),\n orchestrator_id: String(row.orchestrator_id),\n runtime_domain: String(row.runtime_domain),\n task_type: String(row.connector),\n sanitized_task_payload: sanitizeTask(row.next_action),\n approval_decision_id: String(row.approval_decision_id),\n approval_state: String(row.approval_state),\n created_at: String(row.created_at),\n expires_at: String(row.approval_expires_at),\n policy_version: String(row.policy_version),\n evidence_refs: [],\n });\n if (output.length >= limit) break;\n }\n return output;\n}\n\nasync function readBody(req: Request): Promise {\n const length = Number(req.headers.get(\"content-length\") ?? \"0\");\n if (Number.isFinite(length) && length > MAX_BODY_BYTES) return null;\n const text = await req.text();\n return utf8(text).byteLength <= MAX_BODY_BYTES ? text : null;\n}\n\nasync function handleReady(req: Request, body: string) {\n const auth = await authenticate(req, body, \"QUEUE_READ\");\n if (!auth.ok) return json({ error: auth.reason }, auth.status);\n await expireClaims();\n const url = new URL(req.url);\n const requested = Number(url.searchParams.get(\"limit\") ?? \"20\");\n const limit = Number.isInteger(requested) ? Math.min(100, Math.max(1, requested)) : 20;\n const items = await readyItems(limit);\n const timestamp = new Date().toISOString();\n const event = await eventMaterial({\n eventType: \"QUEUE_READY_READ\",\n timestamp,\n queueItemId: null,\n claimId: null,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: null,\n orchestratorId: null,\n runtimeDomain: null,\n authorizationDecisionId: auth.authorizationDecisionId,\n previousState: null,\n newState: null,\n result: \"PASS\",\n reasonCode: \"AUTHORIZED_FILTERED_READ\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(event));\n return json({\n bridge: POLICY_VERSION,\n caller: auth.serviceId,\n passport_id: PASSPORT_ID,\n secret_exposed: false,\n count: items.length,\n items,\n });\n}\n\nasync function getQueueRow(id: number) {\n const result = await sqlite.execute({\n sql: `SELECT q.id,q.agent_id,q.action_stage,q.next_action,q.connector,q.execution_state,q.created_at,\n q.permission_decision,q.permission_reason,q.mission_id,q.orchestrator_id,q.runtime_domain,\n q.guardian_state,q.approval_state,q.approval_decision_id,q.approval_expires_at,\n q.approval_revoked_at,q.policy_version,q.retriable,q.authorization_binding,q.claim_id\n FROM execution_queue q WHERE q.id=?`,\n args: [id],\n });\n return (result.rows[0] as Record | undefined) ?? null;\n}\n\nasync function handleClaim(req: Request, body: string) {\n const auth = await authenticate(req, body, \"QUEUE_CLAIM\");\n if (!auth.ok) return json({ error: auth.reason }, auth.status);\n await expireClaims();\n const parsed = JSON.parse(body || \"{}\");\n const input = exactObject(parsed, [\"queue_item_id\"], [\"lease_seconds\"]);\n const queueItemId = Number(input?.queue_item_id);\n const leaseSeconds = Number(input?.lease_seconds ?? 300);\n if (!input || !Number.isInteger(queueItemId) || !Number.isInteger(leaseSeconds) || leaseSeconds < 30 || leaseSeconds > 900) {\n return json({ error: \"MALFORMED_CLAIM_REQUEST\" }, 400);\n }\n\n const row = await getQueueRow(queueItemId);\n const now = new Date().toISOString();\n if (!row || !rowEligible(row, now) || !(await verifyQueueBinding(row))) {\n const event = await eventMaterial({\n eventType: \"QUEUE_CLAIM_REJECTED\",\n timestamp: now,\n queueItemId,\n claimId: null,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: row ? String(row.agent_id) : null,\n orchestratorId: row ? String(row.orchestrator_id) : null,\n runtimeDomain: row ? String(row.runtime_domain) : null,\n authorizationDecisionId: auth.authorizationDecisionId,\n previousState: row ? String(row.execution_state) : null,\n newState: row ? String(row.execution_state) : null,\n result: \"DENY\",\n reasonCode: \"ITEM_NOT_EXECUTABLE\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(event));\n return json({ claimed: false, error: \"ITEM_NOT_EXECUTABLE\" }, 409);\n }\n\n const claimId = crypto.randomUUID();\n const expiresAt = new Date(Date.now() + leaseSeconds * 1000).toISOString();\n const authorizationDecisionId = await sha256(JSON.stringify([\n auth.authorizationDecisionId,\n queueItemId,\n row.agent_id,\n row.runtime_domain,\n row.approval_decision_id,\n claimId,\n now,\n expiresAt,\n ]));\n const event = await eventMaterial({\n eventType: \"QUEUE_ITEM_CLAIMED\",\n timestamp: now,\n queueItemId,\n claimId,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: String(row.agent_id),\n orchestratorId: String(row.orchestrator_id),\n runtimeDomain: String(row.runtime_domain),\n authorizationDecisionId,\n previousState: \"READY\",\n newState: \"CLAIMED\",\n result: \"PASS\",\n reasonCode: \"ATOMIC_COMPARE_AND_SET\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n\n try {\n await sqlite.batch([\n {\n sql: `INSERT INTO execution_bridge_claims(\n claim_id,queue_item_id,claimed_by,passport_id,agent_id,orchestrator_id,runtime_domain,\n claimed_at,claim_expires_at,authorization_decision_id,state,retriable\n )\n SELECT ?,q.id,?,?,?,?,?,?,?,?,?,q.retriable\n FROM execution_queue q\n WHERE q.id=? AND q.execution_state='READY' AND q.permission_decision='ALLOW'\n AND q.guardian_state='PASS' AND q.approval_state='ACTIVE'\n AND q.approval_revoked_at IS NULL AND q.approval_expires_at>?\n AND q.policy_version=? AND q.authorization_binding=?`,\n args: [\n claimId,\n auth.serviceId,\n PASSPORT_ID,\n row.agent_id,\n row.orchestrator_id,\n row.runtime_domain,\n now,\n expiresAt,\n authorizationDecisionId,\n \"ACTIVE\",\n queueItemId,\n now,\n POLICY_VERSION,\n row.authorization_binding,\n ],\n },\n {\n sql: `UPDATE execution_queue SET execution_state='CLAIMED',claim_id=?,claimed_by=?,\n claimed_at=?,claim_expires_at=?,authorization_decision_id=?,updated_at=?\n WHERE id=? AND execution_state='READY'\n AND EXISTS(SELECT 1 FROM execution_bridge_claims c WHERE c.claim_id=? AND c.state='ACTIVE')`,\n args: [claimId, auth.serviceId, now, expiresAt, authorizationDecisionId, now, queueItemId, claimId],\n },\n conditionalClaimAuditInsert(event, claimId),\n ]);\n } catch {\n const rejected = await eventMaterial({\n eventType: \"QUEUE_CLAIM_REJECTED\",\n timestamp: new Date().toISOString(),\n queueItemId,\n claimId: null,\n requestId: null,\n serviceId: auth.serviceId,\n agentId: String(row.agent_id),\n orchestratorId: String(row.orchestrator_id),\n runtimeDomain: String(row.runtime_domain),\n authorizationDecisionId,\n previousState: \"READY\",\n newState: \"READY\",\n result: \"DENY\",\n reasonCode: \"CONCURRENT_OR_DUPLICATE_CLAIM\",\n evidenceRef: null,\n evidenceSha256: null,\n });\n await sqlite.execute(auditInsert(rejected));\n return json({ claimed: false, error: \"ALREADY_CLAIMED\" }, 409);\n }\n\n const claimed = await sqlite.execute({\n sql: \"SELECT claim_id FROM execution_bridge_claims WHERE claim_id=? AND state='ACTIVE'\",\n args: [claimId],\n });\n if (!claimed.rows.length) return json({ claimed: false, error: \"ALREADY_CLAIMED\" }, 409);\n\n return json({\n claimed: true,\n secret_exposed: false,\n claim: {\n claim_id: claimId,\n queue_item_id: queueItemId,\n claimed_by: auth.serviceId,\n agent_id: String(row.agent_id),\n orchestrator_id: String(row.orchestrator_id),\n runtime_domain: String(row.runtime_domain),\n claimed_at: now,\n claim_expires_at: expiresAt,\n authorization_decision_id: authorizationDecisionId,\n task_type: String(row.connector),\n sanitized_task_payload: sanitizeTask(row.next_action),\n },\n }, 201);\n}\n\nasync function getClaim(claimId: string) {\n const result = await sqlite.execute({\n sql: `SELECT c.*,q.execution_state,q.permission_decision,q.permission_reason,q.guardian_state,\n q.approval_state,q.approval_expires_at,q.approval_revoked_at,q.policy_version,\n q.authorization_binding,q.next_action\n FROM execution_bridge_claims c JOIN execution_queue q ON q.id=c.queue_item_id\n WHERE c.claim_id=?`,\n args: [claimId],\n });\n return (result.rows[0] as Record | undefined) ?? null;\n}\n\nfunction activeClaim(row: Record, serviceId: string, now: string): boolean {\n return row.state === \"ACTIVE\" &&\n row.execution_state === \"CLAIMED\" &&\n row.claimed_by === serviceId &&\n row.permission_decision === \"ALLOW\" &&\n row.permission_reason === ALLOWED_PERMISSION_REASON &&\n row.guardian_state === \"PASS\" &&\n row.approval_state === \"ACTIVE\" &&\n row.approval_revoked_at === null &&\n typeof row.approval_expires_at === \"string\" &&\n Date.parse(row.approval_expires_at) > Date.parse(now) &&\n typeof row.claim_expires_at === \"string\" &&\n Date.parse(row.claim_expires_at) > Date.parse(now) &&\n row.policy_version === POLICY_VERSION;\n}\n\nasync function handleFinalize(req: Request, body: string, operation: \"complete\" | \"fail\" | \"release\") {\n const capability = ({\n complete: \"QUEUE_COMPLETE\",\n fail: \"QUEUE_FAIL\",\n release: \"QUEUE_RELEASE\",\n } as const)[operation];\n const auth = await authenticate(req, body, capability);\n if (!auth.ok) return json({ error: auth.reason }, auth.status);\n\n const parsed = JSON.parse(body || \"{}\");\n const required = operation === \"release\"\n ? [\"claim_id\", \"request_id\", \"reason\"]\n : operation === \"fail\"\n ? [\"claim_id\", \"request_id\", \"evidence_ref\", \"evidence_sha256\", \"failure_reason\", \"retriable\"]\n : [\"claim_id\", \"request_id\", \"evidence_ref\", \"evidence_sha256\"];\n const input = exactObject(parsed, required);\n if (!input) return json({ error: \"MALFORMED_FINALIZE_REQUEST\" }, 400);\n const claimId = safeIdentifier(input.claim_id);\n const requestId = safeIdentifier(input.request_id);\n const evidenceRef = operation === \"release\" ? null : safeEvidenceRef(input.evidence_ref);\n const evidenceSha256 = operation === \"release\" ? null : safeHash(input.evidence_sha256);\n const failureReason = operation === \"fail\"\n ? (typeof input.failure_reason === \"string\" && /^[A-Z0-9_:-]{3,128}$/.test(input.failure_reason) ? input.failure_reason : null)\n : null;\n const releaseReason = operation === \"release\"\n ? (typeof input.reason === \"string\" && /^[A-Z0-9_:-]{3,128}$/.test(input.reason) ? input.reason : null)\n : null;\n const retriable = operation === \"fail\" && typeof input.retriable === \"boolean\" ? input.retriable : false;\n if (!claimId || !requestId || (operation !== \"release\" && (!evidenceRef || !evidenceSha256)) ||\n (operation === \"fail\" && !failureReason) || (operation === \"release\" && !releaseReason)) {\n return json({ error: \"FINALIZE_FIELDS_INVALID\" }, 400);\n }\n\n await expireClaims();\n const claim = await getClaim(claimId);\n const now = new Date().toISOString();\n if (!claim || !activeClaim(claim, auth.serviceId, now) ||\n (operation === \"release\" && Number(claim.retriable) !== 1)) {\n return json({ updated: false, error: \"ACTIVE_AUTHORIZED_CLAIM_REQUIRED\" }, 409);\n }\n\n const queueItemId = Number(claim.queue_item_id);\n const newState = operation === \"complete\" ? \"COMPLETED\" : operation === \"fail\" ? \"FAILED\" : \"READY\";\n const claimState = operation === \"complete\" ? \"COMPLETED\" : operation === \"fail\" ? \"FAILED\" : \"RELEASED\";\n const eventType: AuditType = operation === \"complete\"\n ? \"QUEUE_ITEM_COMPLETED\"\n : operation === \"fail\"\n ? \"QUEUE_ITEM_FAILED\"\n : \"QUEUE_ITEM_RELEASED\";\n const reasonCode = operation === \"complete\" ? \"COMPLETION_EVIDENCE_PERSISTED\" : operation === \"fail\"\n ? failureReason!\n : releaseReason!;\n const event = await eventMaterial({\n eventType,\n timestamp: now,\n queueItemId,\n claimId,\n requestId,\n serviceId: auth.serviceId,\n agentId: String(claim.agent_id),\n orchestratorId: String(claim.orchestrator_id),\n runtimeDomain: String(claim.runtime_domain),\n authorizationDecisionId: String(claim.authorization_decision_id),\n previousState: \"CLAIMED\",\n newState,\n result: \"PASS\",\n reasonCode,\n evidenceRef,\n evidenceSha256,\n });\n\n const batch = [\n {\n sql: \"INSERT INTO execution_bridge_requests(request_id,operation,claim_id,service_id,created_at) VALUES(?,?,?,?,?)\",\n args: [requestId, operation.toUpperCase(), claimId, auth.serviceId, now],\n },\n {\n sql: `UPDATE execution_bridge_claims SET state=?,completed_at=?,failure_reason=?\n WHERE claim_id=? AND state='ACTIVE' AND claimed_by=? AND claim_expires_at>?`,\n args: [claimState, now, failureReason, claimId, auth.serviceId, now],\n },\n {\n sql: `UPDATE execution_queue SET execution_state=?,evidence_ref=?,updated_at=?,\n failure_reason=?,failure_retriable=?,completion_request_id=?,\n claim_id=CASE WHEN ?='READY' THEN NULL ELSE claim_id END,\n claimed_by=CASE WHEN ?='READY' THEN NULL ELSE claimed_by END,\n claimed_at=CASE WHEN ?='READY' THEN NULL ELSE claimed_at END,\n claim_expires_at=CASE WHEN ?='READY' THEN NULL ELSE claim_expires_at END\n WHERE id=? AND execution_state='CLAIMED' AND claim_id=?\n AND EXISTS(SELECT 1 FROM execution_bridge_requests WHERE request_id=?)`,\n args: [\n newState,\n evidenceRef,\n now,\n failureReason,\n operation === \"fail\" ? (retriable ? 1 : 0) : null,\n requestId,\n newState,\n newState,\n newState,\n newState,\n queueItemId,\n claimId,\n requestId,\n ],\n },\n ];\n if (operation === \"complete\") {\n batch.push({\n sql: `UPDATE agent_progress SET\n stage_index=CASE WHEN stage_index<7 THEN stage_index+1 ELSE 0 END,\n stage_state='WAITING_FOR_EVIDENCE',\n evidence_count=evidence_count+1,\n last_evidence_ref=?,\n last_advanced_at=?\n WHERE agent_id=? AND EXISTS(\n SELECT 1 FROM execution_queue q\n WHERE q.id=? AND q.execution_state='COMPLETED' AND q.completion_request_id=?\n )`,\n args: [evidenceRef, now, claim.agent_id, queueItemId, requestId],\n });\n }\n batch.push(auditInsert(event));\n\n try {\n await sqlite.batch(batch);\n } catch {\n return json({ updated: false, error: \"REPLAY_OR_STATE_CONFLICT\" }, 409);\n }\n\n return json({\n updated: true,\n operation: operation.toUpperCase(),\n queue_item_id: queueItemId,\n claim_id: claimId,\n state: newState,\n agent_progress_updated: operation === \"complete\",\n secret_exposed: false,\n audit_event_id: event.eventId,\n audit_event_hash: event.eventHash,\n });\n}\n\nfunction legacyAuthorized(req: Request): boolean {\n const value = req.headers.get(\"authorization\");\n if (!value?.startsWith(\"Bearer \")) return false;\n return constantTimeEqual(value.slice(7), secret());\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/health\") {\n return json({\n service: \"IMPERIAL_EXECUTION_BRIDGE\",\n version: POLICY_VERSION,\n status: \"UP\",\n secret_configured: Boolean(Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\")),\n secret_exposed: false,\n });\n }\n\n if (req.method === \"GET\" && url.pathname === \"/readiness\") {\n try {\n await ensureSchema();\n return json({ service: \"IMPERIAL_EXECUTION_BRIDGE\", ready: true, policy: POLICY_VERSION });\n } catch {\n return json({ service: \"IMPERIAL_EXECUTION_BRIDGE\", ready: false, error: \"STORAGE_UNAVAILABLE\" }, 503);\n }\n }\n\n const legacy = new Set([\"/queue\", \"/ready\", \"/claim\", \"/complete\", \"/status\"]);\n if (legacy.has(url.pathname)) {\n if (!legacyAuthorized(req)) return json({ error: \"UNAUTHORIZED\" }, 401);\n return json({ error: \"LEGACY_ENDPOINT_DISABLED_USE_GOVERNED_CAPABILITY\" }, 410);\n }\n\n const body = await readBody(req);\n if (body === null) return json({ error: \"PAYLOAD_TOO_LARGE\" }, 413);\n\n try {\n if (req.method === \"GET\" && url.pathname === \"/execution-bridge/ready\") {\n return await handleReady(req, body);\n }\n if (req.method === \"POST\" && url.pathname === \"/execution-bridge/claim\") {\n return await handleClaim(req, body);\n }\n if (req.method === \"POST\" && url.pathname === \"/execution-bridge/complete\") {\n return await handleFinalize(req, body, \"complete\");\n }\n if (req.method === \"POST\" && url.pathname === \"/execution-bridge/fail\") {\n return await handleFinalize(req, body, \"fail\");\n }\n if (req.method === \"POST\" && url.pathname === \"/execution-bridge/release\") {\n return await handleFinalize(req, body, \"release\");\n }\n return json({ error: \"NOT_FOUND\" }, 404);\n } catch (error) {\n const code = String(error).includes(\"SERVER_AUTH_UNAVAILABLE\")\n ? \"SERVER_AUTH_UNAVAILABLE\"\n : String(error).includes(\"JSON\")\n ? \"MALFORMED_JSON\"\n : \"INTERNAL_ERROR\";\n return json({ error: code }, code === \"SERVER_AUTH_UNAVAILABLE\" ? 503 : code === \"MALFORMED_JSON\" ? 400 : 500);\n }\n}\n",[],[238],"11908778-d88c-4c0b-b5b2-c3a43a68ce22","connector_queue_read.ts","01a04824-884d-71a4-a5ec-9999d2de9060",["D",1787916770118],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { signedCapabilityFetch, connectorAuthMetadata } from \"./connector_auth.ts\";\n\nconst RESULT_KEY = \"connector/queue-ready.json\";\n\nasync function main() {\n const path = \"/execution-bridge/ready?limit=100\";\n const response = await signedCapabilityFetch(\"GET\", path, \"QUEUE_READ\");\n const body = await response.json().catch(() => ({ error: \"INVALID_JSON\" }));\n if (!response.ok) {\n const result = {\n bridge: \"CONNECTOR_QUEUE_READ_v3_SIGNED\",\n ok: false,\n status: response.status,\n error: body?.error ?? \"READ_FAILED\",\n secretExposed: false,\n authMode: connectorAuthMetadata.authMode,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n }\n\n const items = Array.isArray(body?.items) ? body.items : [];\n const result = {\n bridge: \"CONNECTOR_QUEUE_READ_v3_SIGNED\",\n ok: true,\n secretExposed: false,\n authMode: connectorAuthMetadata.authMode,\n caller: body?.caller,\n passport_id: body?.passport_id,\n policy_version: body?.bridge,\n readyAllowCount: items.length,\n items,\n recordedAt: new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY, result);\n return result;\n}\n\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[],[245],"c0b8f6fe-d1c9-4377-abf9-0fd6f3428b2f","connector_queue_finalize.ts","8c89a016-a2d4-11f1-b871-1607ee4eb77e",["D",1787916919922],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport request from \"./connector_finalize_request.ts\";\nimport { signedCapabilityFetch, connectorAuthMetadata } from \"./connector_auth.ts\";\n\nconst RESULT_KEY = \"connector/queue-finalize.json\";\nconst ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;\nconst REASON = /^[A-Z0-9_:-]{3,128}$/;\nconst EVIDENCE = /^(?:urn:evidence:|https:\\/\\/)[^\\s]{8,2048}$/;\nconst HASH = /^sha256:[a-f0-9]{64}$/;\n\nasync function main() {\n if (request?.enabled !== true || !ID.test(String(request?.claim_id)) || !ID.test(String(request?.request_id))) {\n throw new Error(\"SIGNED_FINALIZE_REQUEST_NOT_ARMED_OR_INVALID\");\n }\n const operation = request.operation;\n let path:string;\n let capability:\"QUEUE_RELEASE\"|\"QUEUE_FAIL\";\n let payload:any;\n if (operation === \"RELEASE\") {\n if (!REASON.test(String(request.reason))) throw new Error(\"RELEASE_REASON_INVALID\");\n path = \"/execution-bridge/release\";\n capability = \"QUEUE_RELEASE\";\n payload = {claim_id:request.claim_id,request_id:request.request_id,reason:request.reason};\n } else if (operation === \"FAIL\") {\n if (!REASON.test(String(request.reason)) || !EVIDENCE.test(String(request.evidence_ref)) || !HASH.test(String(request.evidence_sha256))) {\n throw new Error(\"FAIL_EVIDENCE_OR_REASON_INVALID\");\n }\n path = \"/execution-bridge/fail\";\n capability = \"QUEUE_FAIL\";\n payload = {claim_id:request.claim_id,request_id:request.request_id,evidence_ref:request.evidence_ref,evidence_sha256:request.evidence_sha256,failure_reason:request.reason,retriable:Boolean(request.retriable)};\n } else {\n throw new Error(\"FINALIZE_OPERATION_INVALID\");\n }\n const body = JSON.stringify(payload);\n const response = await signedCapabilityFetch(\"POST\",path,capability,body);\n const resultBody = await response.json().catch(()=>({error:\"INVALID_JSON\"}));\n const result = {\n bridge:\"CONNECTOR_QUEUE_FINALIZE_v1_SIGNED\",operation,ok:response.ok,updated:Boolean(resultBody?.updated),\n queue_item_id:resultBody?.queue_item_id,claim_id:resultBody?.claim_id,state:resultBody?.state,\n audit_event_id:resultBody?.audit_event_id,audit_event_hash:resultBody?.audit_event_hash,\n status:response.status,error:response.ok?undefined:(resultBody?.error??\"FINALIZE_FAILED\"),\n secretExposed:false,authMode:connectorAuthMetadata.authMode,recordedAt:new Date().toISOString()\n };\n await blob.setJSON(RESULT_KEY,result);\n return result;\n}\n\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[],[252],"26703d6a-56a8-4123-9a04-343dde0bd9bb","connector_queue_complete_501.ts","01a04824-884d-71a4-a5ec-95a1792798dc",8,["D",1787916901992],"// Historical one-off completion helper for queue item 501.\n// Disabled after execution_bridge v2.0.0 migrated to signed capabilities.\n// The historical evidence remains in project blob storage at evidence/queue-501.json.\nexport default function () {\n throw new Error(\"LEGACY_QUEUE_501_COMPLETION_HELPER_DISABLED\");\n}\n",[],[259],"d9c4115e-b1b7-49c2-984c-6ac475379a4b","connector_queue_complete.ts","01a04824-884d-71a4-a5ec-91f83393878c",6,["D",1787916880806],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport request from \"./connector_completion_request.ts\";\nimport { signedCapabilityFetch, connectorAuthMetadata } from \"./connector_auth.ts\";\n\nconst RESULT_KEY = \"connector/queue-complete.json\";\n\nfunction validRequest(value:any) {\n return value?.enabled === true &&\n typeof value?.claim_id === \"string\" && /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/.test(value.claim_id) &&\n typeof value?.request_id === \"string\" && /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/.test(value.request_id) &&\n typeof value?.evidence_ref === \"string\" && /^(?:urn:evidence:|https:\\/\\/)[^\\s]{8,2048}$/.test(value.evidence_ref) &&\n typeof value?.evidence_sha256 === \"string\" && /^sha256:[a-f0-9]{64}$/.test(value.evidence_sha256);\n}\n\nasync function main() {\n if (!validRequest(request)) throw new Error(\"SIGNED_COMPLETION_REQUEST_NOT_ARMED_OR_INVALID\");\n const payload = JSON.stringify({\n claim_id: request.claim_id,\n request_id: request.request_id,\n evidence_ref: request.evidence_ref,\n evidence_sha256: request.evidence_sha256,\n });\n const response = await signedCapabilityFetch(\"POST\",\"/execution-bridge/complete\",\"QUEUE_COMPLETE\",payload);\n const body = await response.json().catch(()=>({error:\"INVALID_JSON\"}));\n const result = {\n bridge:\"CONNECTOR_QUEUE_COMPLETE_v2_SIGNED\",\n ok:response.ok,\n updated:Boolean(body?.updated),\n operation:body?.operation,\n queue_item_id:body?.queue_item_id,\n claim_id:body?.claim_id,\n state:body?.state,\n agent_progress_updated:Boolean(body?.agent_progress_updated),\n audit_event_id:body?.audit_event_id,\n audit_event_hash:body?.audit_event_hash,\n status:response.status,\n error:response.ok ? undefined : (body?.error ?? \"COMPLETE_FAILED\"),\n secretExposed:false,\n authMode:connectorAuthMetadata.authMode,\n recordedAt:new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY,result);\n return result;\n}\n\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[],[267],"0665ea75-65c5-40ea-84dd-4c1f019bf18b","connector_queue_claim.ts","01a04824-884d-71a4-a5ec-8c5f57c3e9ff",7,["D",1787916897150],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { signedCapabilityFetch, connectorAuthMetadata } from \"./connector_auth.ts\";\n\nconst RESULT_KEY = \"connector/queue-claim.json\";\nconst SUPPORTED_CONNECTORS = new Set([\"RESEARCH_CRM\", \"GMAIL_DRAFT\", \"CRM_STRIPE_PREP\", \"RUNTIME_INTERNAL\"]);\n\nasync function main() {\n const readyPath = \"/execution-bridge/ready?limit=100\";\n const readyResponse = await signedCapabilityFetch(\"GET\", readyPath, \"QUEUE_READ\");\n const readyBody = await readyResponse.json().catch(() => ({ error: \"INVALID_JSON\" }));\n if (!readyResponse.ok) {\n const result = { bridge:\"CONNECTOR_QUEUE_CLAIM_v3_SIGNED\", ok:false, claimed:false, stage:\"READ\", status:readyResponse.status, error:readyBody?.error ?? \"READ_FAILED\", secretExposed:false, authMode:connectorAuthMetadata.authMode, recordedAt:new Date().toISOString() };\n await blob.setJSON(RESULT_KEY,result);\n return result;\n }\n\n const candidates = Array.isArray(readyBody?.items)\n ? readyBody.items.filter((x:any)=>SUPPORTED_CONNECTORS.has(String(x?.task_type)))\n : [];\n if (!candidates.length) {\n const result = { bridge:\"CONNECTOR_QUEUE_CLAIM_v3_SIGNED\", ok:true, claimed:false, reason:\"NO_SUPPORTED_READY_ALLOW_ITEM\", secretExposed:false, authMode:connectorAuthMetadata.authMode, recordedAt:new Date().toISOString() };\n await blob.setJSON(RESULT_KEY,result);\n return result;\n }\n\n const item = candidates[0];\n const body = JSON.stringify({queue_item_id:item.queue_item_id,lease_seconds:900});\n const claimResponse = await signedCapabilityFetch(\"POST\",\"/execution-bridge/claim\",\"QUEUE_CLAIM\",body);\n const claimBody = await claimResponse.json().catch(()=>({error:\"INVALID_JSON\"}));\n const result = {\n bridge:\"CONNECTOR_QUEUE_CLAIM_v3_SIGNED\",\n ok:claimResponse.ok,\n claimed:Boolean(claimBody?.claimed),\n secretExposed:false,\n authMode:connectorAuthMetadata.authMode,\n selected:item,\n claim:claimBody?.claim,\n status:claimResponse.status,\n error:claimResponse.ok ? undefined : (claimBody?.error ?? \"CLAIM_FAILED\"),\n recordedAt:new Date().toISOString(),\n };\n await blob.setJSON(RESULT_KEY,result);\n return result;\n}\n\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[],[275],"aa030a56-b5a9-4ffa-ae46-9f2a7e475528","connector_finalize_request.ts","858079a2-a2d4-11f1-88be-1607ee4eb77e",9,["D",1787916908165],"export default {\n enabled: false,\n operation: \"RELEASE\" as \"RELEASE\" | \"FAIL\",\n claim_id: \"\",\n request_id: \"\",\n reason: \"\",\n evidence_ref: \"\",\n evidence_sha256: \"\",\n retriable: true\n};\n",[],[283],"187e2608-1847-40d7-aa10-da07f1ced83e","connector_completion_request.ts","01a04824-884d-71a4-a5ec-889508a45e4e",["D",1787916869166],"export default {\n enabled: false,\n claim_id: \"\",\n request_id: \"\",\n evidence_ref: \"\",\n evidence_sha256: \"\"\n};\n",[],[291],["D",1787916759847],[],[18],"2afdea00-6d1b-4280-af4a-675457abb79d","codex_bridge.ts","01a04824-884d-71a4-a5ec-8530a53b5516",["D",1787916748882],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst TOKEN = Deno.env.get(\"EXECUTION_APPROVAL_TOKEN\");\nconst MODE = \"CHATGPT_CODEX_PLUS_ONLY\";\n\nfunction auth(req: Request) {\n return Boolean(TOKEN && req.headers.get(\"authorization\") === `Bearer ${TOKEN}`);\n}\n\nasync function ensure() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS codex_assist_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n agent_id TEXT NOT NULL,\n mission_stage TEXT NOT NULL,\n task_type TEXT NOT NULL,\n objective TEXT NOT NULL,\n context TEXT,\n acceptance_criteria TEXT NOT NULL,\n state TEXT NOT NULL DEFAULT 'QUEUED_PLUS_HANDOFF',\n created_at TEXT NOT NULL,\n started_at TEXT,\n completed_at TEXT,\n result_ref TEXT,\n result_text TEXT,\n error TEXT\n )`);\n}\n\nexport default async function(req: Request): Promise {\n await ensure();\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/status\") {\n const q = await sqlite.execute(`SELECT state,COUNT(*) AS n FROM codex_assist_queue GROUP BY state ORDER BY state`);\n return Response.json({\n layer:\"IMPERIAL_CODEX_ASSIST_v2\",\n mode:MODE,\n profiles:100,\n externalOpenAIApi:false,\n apiBillingAllowed:false,\n automaticPaidApiCalls:false,\n authority:\"ASSIST_ONLY_NO_INDEPENDENT_AUTHORITY\",\n execution:\"USE_CODEX_INCLUDED_WITH_CHATGPT_PLAN; EXTERNAL_RUNTIME_ONLY_PREPARES_HANDOFF_TASKS\",\n queue:q.rows\n });\n }\n\n if (!auth(req)) return Response.json({error:\"UNAUTHORIZED\"},{status:401});\n\n if (req.method === \"POST\" && url.pathname === \"/enqueue\") {\n const b = await req.json().catch(()=>null) as any;\n const agentId = String(b?.agent_id ?? \"\");\n const taskType = String(b?.task_type ?? \"\");\n const objective = String(b?.objective ?? \"\");\n const stage = String(b?.mission_stage ?? \"UNKNOWN\");\n const context = String(b?.context ?? \"\");\n const acceptance = String(b?.acceptance_criteria ?? \"\");\n if (!agentId || !taskType || !objective || !acceptance) return Response.json({error:\"REQUIRED_FIELDS_MISSING\"},{status:400});\n const p = await sqlite.execute({sql:`SELECT enabled FROM codex_assist_profile WHERE agent_id=?`,args:[agentId]});\n if (!p.rows.length || Number((p.rows[0] as any).enabled)!==1) return Response.json({error:\"CODEX_NOT_ENABLED_FOR_AGENT\"},{status:403});\n const now = new Date().toISOString();\n const r = await sqlite.execute({sql:`INSERT INTO codex_assist_queue(agent_id,mission_stage,task_type,objective,context,acceptance_criteria,state,created_at) VALUES(?,?,?,?,?,?,?,?)`,args:[agentId,stage,taskType,objective,context,acceptance,\"QUEUED_PLUS_HANDOFF\",now]});\n return Response.json({queued:true,id:Number(r.lastInsertRowid),mode:MODE});\n }\n\n if (url.pathname === \"/run-next\") {\n return Response.json({error:\"EXTERNAL_API_DISABLED_PLUS_ONLY\",mode:MODE,paidApiCalls:false},{status:403});\n }\n\n if (req.method === \"GET\" && url.pathname === \"/result\") {\n const id = Number(url.searchParams.get(\"id\"));\n if (!Number.isInteger(id)) return Response.json({error:\"INVALID_ID\"},{status:400});\n const r = await sqlite.execute({sql:`SELECT id,agent_id,state,result_ref,result_text,error,completed_at FROM codex_assist_queue WHERE id=?`,args:[id]});\n return Response.json(r.rows[0] ?? {error:\"NOT_FOUND\"},{status:r.rows.length?200:404});\n }\n\n return Response.json({error:\"NOT_FOUND\"},{status:404});\n}\n",[],[301],["D",1787871527621],["D",1789526460011],{"_11":12,"_125":70},{"_11":12,"_120":121,"_69":70,"_30":68,"_122":123,"_124":24},{"_38":111,"_13":16,"_32":35,"_112":72,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":14,"_119":12},"ctx",{"_53":-5,"_144":346,"_347":348,"_349":350,"_351":24,"_352":24,"_353":24,"_354":85,"_355":-5,"_356":-7,"_357":-7,"_358":26,"_359":24,"_360":24,"_361":-5,"_362":24,"_363":24,"_364":24,"_365":-5},"ENV",{"_316":317,"_318":319,"_320":321,"_322":323,"_324":325,"_326":327,"_328":329,"_330":331,"_332":333,"_334":335,"_336":337,"_338":339,"_340":341,"_342":343,"_344":345},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","main","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · connector_auth.ts