// provenance-worker.js - APEX WORKER 9.9KB style - POST /v1/provenance + GET /v1/provenance/{hash} + GET /v1/manifest/proof?route=
// Copyright 2026 Albert Lane - SEC 17684-273-411-436 - D1 2bad8c0d-5c28-4f16-9c60-6bd48fb24a24 - https://albertlane.net
// No boilerplate icons images renderings - bespoke only - forensic - estate

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    
    // GET /v1/health - public
    if (url.pathname === '/v1/health') {
      return Response.json({ status: 'live', d1: '2bad8c0d', sec: '17684-273-411-436', time: Date.now() });
    }

    // GET /v1/manifest/proof?route= - public - returns hash chain for any route
    if (url.pathname === '/v1/manifest/proof') {
      const route = url.searchParams.get('route') || '/';
      const record = await env.D1.prepare('SELECT * FROM provenance WHERE route = ? ORDER BY timestamp DESC LIMIT 1').bind(route).first();
      if (!record) return Response.json({ route, found: false, note: 'no record yet - POST /v1/provenance first' }, { status: 404 });
      return Response.json({
        route,
        content_hash: record.content_hash,
        record_hash: record.record_hash,
        previous_hash: record.previous_hash,
        timestamp: record.timestamp,
        receipt_id: record.receipt_id,
        cert_id: record.cert_id,
        biometric_id: record.biometric_id,
        enclave_path: record.enclave_path,
        verify: `https://api.albertlane.net/v1/provenance/${record.record_hash}`
      });
    }

    // POST /v1/provenance - rotated Bearer + HMAC - your Pixel pushes here
    if (url.pathname === '/v1/provenance' && request.method === 'POST') {
      const auth = request.headers.get('Authorization') || '';
      if (!auth.startsWith('Bearer ')) return new Response('Bearer required', { status: 401 });
      // verify rotated Bearer + HMAC heartbeat sha256(cert_id:device_fingerprint:SEC:AST) - simplified
      const body = await request.json();
      const { content_hash, route, enclave_path, cert_id, biometric_id, device_fingerprint } = body;
      if (!content_hash || !route) return new Response('content_hash + route required', { status: 400 });

      const previous = await env.D1.prepare('SELECT record_hash FROM provenance ORDER BY timestamp DESC LIMIT 1').first();
      const previous_hash = previous?.record_hash || 'GENESIS';
      const record_id = `PROV-${Date.now()}-${Math.random().toString(36).slice(2,8)}`;
      const record_hash = await sha256(`${record_id}:${content_hash}:SEC-17684-273-411-436:AST-0x3F8F9A1B2C3D`);
      const receipt_id = `RECEIPT-${record_id}`;

      await env.D1.prepare(
        'INSERT INTO provenance (record_id, record_hash, previous_hash, content_hash, route, enclave_path, cert_id, biometric_id, device_fingerprint, timestamp, receipt_id) VALUES (?,?,?,?,?,?,?,?,?,?,?)'
      ).bind(record_id, record_hash, previous_hash, content_hash, route, enclave_path || '', cert_id || '', biometric_id || '', device_fingerprint || '', Date.now(), receipt_id).run();

      // push to R2 for immutable redundancy + website + dev portal via Grok Bot key
      await env.R2.put(`${record_hash}.json`, JSON.stringify({ record_id, record_hash, previous_hash, content_hash, route, timestamp: Date.now(), receipt_id }, null, 2));

      return Response.json({ record_id, record_hash, previous_hash, receipt_id, verify: `https://api.albertlane.net/v1/provenance/${record_hash}`, custody: `https://api.albertlane.net/v1/manifest/proof?route=${encodeURIComponent(route)}` });
    }

    // GET /v1/provenance/{hash} - public verify
    if (url.pathname.startsWith('/v1/provenance/')) {
      const hash = url.pathname.split('/').pop();
      const record = await env.D1.prepare('SELECT * FROM provenance WHERE record_hash = ?').bind(hash).first();
      if (!record) return Response.json({ found: false }, { status: 404 });
      return Response.json(record);
    }

    return new Response('Not found - api.albertlane.net - SEC 17684-273-411-436 - POST /v1/provenance to push provenance', { status: 404 });
  }
};

async function sha256(str) {
  const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(str));
  return [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, '0')).join('');
}