[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","sebas1","name","rumbo-continuity-relay","path","main.tsx","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/sebas1/rumbo-continuity-relay/code/main.tsx","extension","id","651f6353-0412-4c1e-a889-17dd0355c929","fileId","01a04afc-c88b-766f-9e89-3c0c81cf30bc","parentId","branchId","cdbfe23c-d122-4f18-ad6e-34fdd0cb88da","branchVersion",230,"latest",true,"createdAt",["D",1788160991562],"version",132,"fileType","http","content","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { classifyPairing } from \"./pairing_state.ts\";\nimport { R11_BOOTSTRAP_PY } from \"./r11_bootstrap_module.ts\";\nimport { R11_WINDOWS_PS1 } from \"./r11_windows_launcher_module.ts\";\n\nconst app = new Hono();\nconst LANE_RE = /^[A-Z0-9][A-Z0-9_.:-]{0,95}$/;\nconst MAX_BODY = 256 * 1024;\nconst secretKeyRe = /(password|api[_-]?key|secret|access[_-]?token|refresh[_-]?token|private[_-]?key|authorization|session[_-]?cookie)/i;\nconst tokenPrefixRe = /(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{12,}|xox[baprs]-[A-Za-z0-9-]{10,})/;\nconst SHA256_RE = /^[a-f0-9]{64}$/;\nconst R2_TARGET_REPOSITORY_IDENTITY_SHA256 = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst R2_CONTROL_PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst R2_GUARD_MAX_TTL_SECONDS = 900;\nconst DEVICE_PAIRING_TTL_MS = 15 * 60 * 1000;\nconst DEVICE_PAIRING_MAX_PENDING_PER_FINGERPRINT = 3;\nconst DEVICE_PAIRING_MAX_PENDING_GLOBAL = 100;\nconst DEVICE_ACCESS_TOKEN_TTL_MS = 15 * 60 * 1000;\nconst DEVICE_ACCESS_LANE = \"CODEX_REAL_RUNTIME_ACCEPTANCE_V6\";\nconst R11_BOOTSTRAP_SHA256 = \"490907dc0adc4e7adcf65d76fdaa6d8ca9649fcd0a87e02a3163bdbdfccf132d\";\nconst R11_BOOTSTRAP_BYTES = 29735;\nconst R11_WINDOWS_PS1_SHA256 = \"c67925a8780253aa39fdd653d1c67c3581cf5e23a5a6a70c95c41e4f57fc4cbf\";\nconst R11_WINDOWS_PS1_BYTES = 5106;\nconst R11_CHALLENGE_ID = \"1638b61d-86e0-470e-8f2c-138fd9db966c\";\nconst R11_CHALLENGE_SHA256 = \"45afab1a27f762accf1b045c91656ff1bddf5c97009b922f335da93c81b3b653\";\nconst R11_ACCEPTANCE_NOT_AFTER_UTC = \"2026-09-02T03:15:00Z\";\nconst R11_PLUGIN_VERSION = \"1.2.0\";\nconst R11_PLUGIN_MANIFEST_SHA256 = \"c0f12562dbee00f897b7f0d164b35845f7388ec996c19b371c0ccf6e0fb12d27\";\nconst DEVICE_USER_CODE_ALPHABET = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\nasync function init() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS lane_state (\n lane TEXT PRIMARY KEY,\n revision INTEGER NOT NULL DEFAULT 0,\n checkpoint_sha256 TEXT NOT NULL DEFAULT '',\n updated_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS messages (\n id TEXT PRIMARY KEY,\n actor TEXT NOT NULL CHECK(actor IN ('gpt','codex')),\n recipient TEXT NOT NULL CHECK(recipient IN ('gpt','codex')),\n lane TEXT NOT NULL,\n base_revision INTEGER NOT NULL,\n revision INTEGER NOT NULL,\n payload_json TEXT NOT NULL,\n payload_sha256 TEXT NOT NULL,\n message_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL,\n acked_at TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_messages_inbox ON messages(recipient,lane,acked_at,revision)`,\n `CREATE TABLE IF NOT EXISTS acknowledgements (\n id TEXT PRIMARY KEY,\n actor TEXT NOT NULL CHECK(actor IN ('gpt','codex')),\n target_message_id TEXT NOT NULL UNIQUE,\n target_message_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL,\n FOREIGN KEY(target_message_id) REFERENCES messages(id)\n )`,\n `CREATE TABLE IF NOT EXISTS message_auth_provenance (\n message_id TEXT PRIMARY KEY,\n auth_kind TEXT NOT NULL CHECK(auth_kind IN ('device')),\n pairing_id TEXT NOT NULL,\n token_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL,\n FOREIGN KEY(message_id) REFERENCES messages(id),\n FOREIGN KEY(pairing_id) REFERENCES device_pairing_sessions(pairing_id)\n )`,\n `CREATE INDEX IF NOT EXISTS idx_message_auth_pairing ON message_auth_provenance(pairing_id,message_id)`,\n `CREATE TABLE IF NOT EXISTS ack_auth_provenance (\n target_message_id TEXT PRIMARY KEY,\n acknowledgement_id TEXT NOT NULL UNIQUE,\n auth_kind TEXT NOT NULL CHECK(auth_kind IN ('device')),\n pairing_id TEXT NOT NULL,\n token_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL,\n FOREIGN KEY(target_message_id) REFERENCES messages(id),\n FOREIGN KEY(acknowledgement_id) REFERENCES acknowledgements(id),\n FOREIGN KEY(pairing_id) REFERENCES device_pairing_sessions(pairing_id)\n )`,\n `CREATE INDEX IF NOT EXISTS idx_ack_auth_pairing ON ack_auth_provenance(pairing_id,target_message_id)`,\n `CREATE TABLE IF NOT EXISTS audit_events (\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n actor TEXT NOT NULL,\n lane TEXT,\n object_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS pairing_events (\n pairing_id TEXT PRIMARY KEY,\n pairing_code_sha256 TEXT NOT NULL,\n consumed_at TEXT NOT NULL,\n client_label TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS pairing_sessions (\n pairing_id TEXT PRIMARY KEY,\n pairing_code_sha256 TEXT NOT NULL,\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n confirmed_at TEXT,\n client_label TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS device_pairing_sessions (\n pairing_id TEXT PRIMARY KEY,\n device_code_sha256 TEXT NOT NULL UNIQUE,\n user_code_sha256 TEXT NOT NULL UNIQUE,\n client_fingerprint_sha256 TEXT NOT NULL,\n client_label TEXT,\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n approved_at TEXT,\n approved_by TEXT,\n delivered_at TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_device_pairing_pending ON device_pairing_sessions(client_fingerprint_sha256,expires_at,approved_at)`,\n `CREATE TABLE IF NOT EXISTS device_pairing_contracts (\\n pairing_id TEXT PRIMARY KEY,\\n bootstrap_script_sha256 TEXT NOT NULL,\\n acceptance_lane TEXT NOT NULL,\\n challenge_message_id TEXT NOT NULL,\\n challenge_message_sha256 TEXT NOT NULL,\\n created_at TEXT NOT NULL,\\n FOREIGN KEY(pairing_id) REFERENCES device_pairing_sessions(pairing_id)\\n )`,\n `CREATE TABLE IF NOT EXISTS device_access_tokens (\\n token_sha256 TEXT PRIMARY KEY,\\n pairing_id TEXT NOT NULL UNIQUE,\\n lane_scope TEXT NOT NULL,\\n issued_at TEXT NOT NULL,\\n expires_at TEXT NOT NULL,\\n revoked_at TEXT,\\n FOREIGN KEY(pairing_id) REFERENCES device_pairing_sessions(pairing_id)\\n )`,\n `CREATE INDEX IF NOT EXISTS idx_device_access_active ON device_access_tokens(expires_at,revoked_at,lane_scope)`,\n `CREATE TABLE IF NOT EXISTS request_dedup (\n actor TEXT NOT NULL,\n request_id TEXT NOT NULL,\n body_sha256 TEXT NOT NULL,\n message_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n PRIMARY KEY(actor,request_id),\n FOREIGN KEY(message_id) REFERENCES messages(id)\n )`,\n `CREATE TABLE IF NOT EXISTS guard_authorizations (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_guard_status ON guard_authorizations(status,expires_at)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_unique ON audit_events(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_message_accepted_unique ON audit_events(object_id) WHERE event_type='MESSAGE_ACCEPTED'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_message_acked_unique ON audit_events(object_id) WHERE event_type='MESSAGE_ACKED'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_guard_event_unique ON audit_events(event_type,object_id) WHERE event_type LIKE 'GUARD_%'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_device_event_unique ON audit_events(event_type,object_id) WHERE event_type LIKE 'CODEX_DEVICE_%'`,\n `CREATE TRIGGER IF NOT EXISTS messages_revision_guard\n BEFORE INSERT ON messages\n BEGIN\n SELECT CASE\n WHEN COALESCE((SELECT revision FROM lane_state WHERE lane=NEW.lane), -1) != NEW.base_revision\n THEN RAISE(ABORT, 'STALE_REVISION')\n END;\n END`,\n `CREATE TRIGGER IF NOT EXISTS messages_revision_advance\n AFTER INSERT ON messages\n BEGIN\n UPDATE lane_state\n SET revision=NEW.revision, updated_at=NEW.created_at\n WHERE lane=NEW.lane AND revision=NEW.base_revision;\n END`\n ]);\n}\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\n\ntype AuthContext = { role:\"gpt\"|\"codex\"|\"admin\"; kind:\"environment\"|\"device\"; lane_scope?:string; pairing_id?:string; token_sha256?:string; };\n\nasync function authFrom(req: Request): Promise {\n const token = bearer(req);\n if (!token) return null;\n const gpt = Deno.env.get(\"GPT_TOKEN_V4\") || \"\";\n const admin = Deno.env.get(\"ADMIN_TOKEN_V4\") || \"\";\n if (gpt && constantTimeEqual(token,gpt)) return {role:\"gpt\",kind:\"environment\"};\n if (admin && constantTimeEqual(token,admin)) return {role:\"admin\",kind:\"environment\"};\n const tokenSha = await sha(token);\n const nowIso = new Date().toISOString();\n const rs = await sqlite.execute({sql:\"SELECT pairing_id,lane_scope,issued_at,expires_at,revoked_at FROM device_access_tokens WHERE token_sha256=? LIMIT 1\",args:[tokenSha]});\n if (!rs.rows.length) return null;\n const row:any = rs.rows[0];\n const issuedMs = Date.parse(String(row.issued_at || \"\"));\n const storedExpiresMs = Date.parse(String(row.expires_at || \"\"));\n const effectiveExpiresMs = Math.min(storedExpiresMs, issuedMs + DEVICE_ACCESS_TOKEN_TTL_MS);\n if (row.revoked_at || !Number.isFinite(issuedMs) || !Number.isFinite(storedExpiresMs) || effectiveExpiresMs <= Date.now()) return null;\n return {role:\"codex\",kind:\"device\",lane_scope:String(row.lane_scope),pairing_id:String(row.pairing_id),token_sha256:tokenSha};\n}\n\nasync function roleFrom(req: Request): Promise<\"gpt\"|\"codex\"|\"admin\"|null> {\n return (await authFrom(req))?.role || null;\n}\n\nfunction laneAuthorized(auth: AuthContext, lane: string): boolean {\n return auth.kind !== \"device\" || auth.lane_scope === lane;\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n const aa = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < aa.length; i++) diff |= aa[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction guardAuthorized(req: Request): boolean {\n const expected = Deno.env.get(\"R2_GUARD_TOKEN_V1\") || \"\";\n const observed = bearer(req);\n return !!expected && !!observed && constantTimeEqual(expected, observed);\n}\n\nfunction validGitSha(v: unknown): boolean {\n return typeof v === \"string\" && /^[a-f0-9]{40}$/.test(v);\n}\n\nfunction validSha256(v: unknown): v is string {\n return typeof v === \"string\" && SHA256_RE.test(v);\n}\n\nfunction randomOneTimeToken(bytes = 32): string {\n const raw = new Uint8Array(bytes);\n crypto.getRandomValues(raw);\n const binary = Array.from(raw, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\nasync function deriveDeviceAccessToken(pairingId:string, deviceSha:string): Promise {\n const master = Deno.env.get(\"CODEX_DEVICE_TOKEN_MASTER_V1\") || \"\";\n if (!master) throw new Error(\"DEVICE_TOKEN_MASTER_NOT_CONFIGURED\");\n const enc = new TextEncoder();\n const key = await crypto.subtle.importKey(\"raw\",enc.encode(master),{name:\"HMAC\",hash:\"SHA-256\"},false,[\"sign\"]);\n const sig = await crypto.subtle.sign(\"HMAC\",key,enc.encode(\"rumbo-codex-device-token/v1|\"+pairingId+\"|\"+deviceSha));\n const binary = Array.from(new Uint8Array(sig), b => String.fromCharCode(b)).join(\"\");\n return \"cdxdev_\" + btoa(binary).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\n\nfunction randomUserCode(chars = 8): string {\n let out = \"\";\n while (out.length < chars) {\n const raw = new Uint8Array(16);\n crypto.getRandomValues(raw);\n for (const n of raw) {\n const limit = 256 - (256 % DEVICE_USER_CODE_ALPHABET.length);\n if (n >= limit) continue;\n out += DEVICE_USER_CODE_ALPHABET[n % DEVICE_USER_CODE_ALPHABET.length];\n if (out.length === chars) break;\n }\n }\n return out;\n}\n\nfunction normalizeUserCode(v: unknown): string {\n return String(v || \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\");\n}\n\ntype GuardAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype GuardBinding = {\n action: GuardAction;\n repository_identity_sha256: string;\n pr_number: number;\n base_sha: string;\n head_sha: string;\n package_sha256: string;\n evidence_sha256: string;\n};\n\nfunction parseGuardBinding(b: any): GuardBinding | null {\n const action = String(b?.action || \"\") as GuardAction;\n const repository_identity_sha256 = String(b?.repository_identity_sha256 || \"\");\n const pr_number = Number(b?.pr_number);\n const base_sha = String(b?.base_sha || \"\");\n const head_sha = String(b?.head_sha || \"\");\n const package_sha256 = String(b?.package_sha256 || \"\");\n const evidence_sha256 = String(b?.evidence_sha256 || \"\");\n if (action !== \"TEST_ONLY\" && action !== \"MERGE_PR\") return null;\n if (repository_identity_sha256 !== R2_TARGET_REPOSITORY_IDENTITY_SHA256) return null;\n if (!Number.isSafeInteger(pr_number) || pr_number <= 0) return null;\n if (!validGitSha(base_sha) || !validGitSha(head_sha)) return null;\n if (package_sha256 !== R2_CONTROL_PACKAGE_SHA256) return null;\n if (!validSha256(evidence_sha256)) return null;\n return {action,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256};\n}\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\") + \"}\";\n}\nasync function sha(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction hasSecret(v: unknown): boolean {\n if (typeof v === \"string\") return tokenPrefixRe.test(v);\n if (Array.isArray(v)) return v.some(hasSecret);\n if (v && typeof v === \"object\") {\n return Object.entries(v as Record).some(([k,x]) => {\n if (k === \"secrets_exposed\" && x === false) return false;\n return secretKeyRe.test(k) || hasSecret(x);\n });\n }\n return false;\n}\nasync function bodyJson(c: any) {\n const len = Number(c.req.header(\"content-length\") || \"0\");\n if (len > MAX_BODY) throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt = await c.req.text();\n if (new TextEncoder().encode(txt).length > MAX_BODY) throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt || \"{}\");\n}\nasync function audit(event_type:string, actor:string, lane:string|null, object_id:string|null, object_sha256:string|null) {\n const idempotentEvent = event_type === \"MESSAGE_ACCEPTED\" || event_type === \"MESSAGE_ACKED\" || event_type.startsWith(\"GUARD_\") || event_type.startsWith(\"CODEX_DEVICE_\");\n if (idempotentEvent && object_id) {\n const existing = await sqlite.execute({sql:\"SELECT event_sha256 FROM audit_events WHERE event_type=? AND object_id=? LIMIT 1\",args:[event_type,object_id]});\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n for (let attempt=0; attempt<8; attempt++) {\n const last = await sqlite.execute(\"SELECT event_sha256 FROM audit_events ORDER BY seq DESC LIMIT 1\");\n const prev = String(last.rows[0]?.event_sha256 || \"0\".repeat(64));\n const created_at = new Date().toISOString();\n const ev = {event_type,actor,lane,object_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256 = await sha(canonical(ev));\n try {\n await sqlite.execute({sql:`INSERT INTO audit_events(event_type,actor,lane,object_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?,?,?)`,args:[event_type,actor,lane,object_id,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n } catch (e) {\n if (idempotentEvent && object_id) {\n const existing = await sqlite.execute({sql:\"SELECT event_sha256 FROM audit_events WHERE event_type=? AND object_id=? LIMIT 1\",args:[event_type,object_id]});\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\nawait init();\n\napp.get(\"/\", (c) => c.json({service:\"rumbo-continuity-relay\",protocol:\"rumbo-continuity-relay/v1\",implementation_revision:\"R11-EXACT-SINGLE-COMMAND-PROBE\",status:\"ok\",production_go:false}));\napp.get(\"/health\", (c) => c.json({\n ok:true,\n protocol:\"rumbo-continuity-relay/v1\",\n implementation_revision:\"R11-EXACT-SINGLE-COMMAND-PROBE\",\n capabilities:[\n \"atomic-stale-guard\",\"request-idempotency\",\"idempotent-ack\",\"audit-chain\",\n \"device-code-pairing\",\"device-pairing-expiry\",\"device-pairing-rate-limit\",\"preapproval-pairing-inspection\",\"approval-exact-pairing-id-binding\",\n \"scoped-per-device-bearer\",\"authenticated-device-provenance-binding\",\"device-idempotency-provenance-binding\",\"device-ack-provenance-binding\",\"idempotent-audit-recovery\",\"device-token-self-revoke\",\"device-token-failure-revoke\",\"effective-device-token-ttl\",\"stable-token-redelivery-expiry\",\"acked-challenge-resume\",\"bounded-response-network-retry\",\"expired-token-crash-recovery\",\"bounded-codex-exec-timeout\",\"device-message-kind-restriction\",\"device-base-revision-restriction\",\"device-inbox-disabled\",\"device-ack-target-restriction\",\"legacy-static-pairing-deprecated\",\"legacy-shared-codex-bearer-revoked\",\"secretless-public-bootstrap\",\"canonical-plugin-reconstruction\",\"canonical-v1.6-skill-bootstrap\",\n \"codex-runtime-acceptance-verifier\",\"server-enforced-acceptance-deadline\",\"actual-codex-exec-evidence\",\n \"codex-local-random-file-probe\",\"completed-command-execution-evidence\",\"prohibited-item-event-rejection\",\"exact-single-command-evidence\",\"exact-probe-wrapper-binding\",\"collab-tool-event-rejection\",\n \"exact-bootstrap-hash-binding\",\"isolated-codex-home-attestation\",\"ignore-user-config-enforcement\",\"ignore-rules-enforcement\",\"approval-never-enforcement\",\"pairing-contract-binding\",\"regular-auth-json-isolation\",\"secret-scrubbed-shell-env\",\"core-env-inheritance-only\",\"shell-env-probe-evidence\",\"v1-v2-v3-v4-v5-superseded-v6-active\",\n \"external-r2-authorizer\",\"one-time-token-ledger\",\"exact-pr-binding\",\"fail-closed-merge-gate\"\n ],\n guard:{\n configured:!!Deno.env.get(\"R2_GUARD_TOKEN_V1\"),\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n max_ttl_seconds:R2_GUARD_MAX_TTL_SECONDS\n },\n production_go:false\n}));\n\napp.get(\"/v1/state/:lane\", async (c) => {\n const auth = await authFrom(c.req.raw); if (!auth) return c.json({error:\"UNAUTHORIZED\"},401);\n const lane = c.req.param(\"lane\"); if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n if (!laneAuthorized(auth,lane)) return c.json({error:\"DEVICE_TOKEN_SCOPE_VIOLATION\"},403);\n const st = await sqlite.execute({sql:\"SELECT lane,revision,checkpoint_sha256,updated_at FROM lane_state WHERE lane=?\",args:[lane]});\n const row = st.rows[0] || {lane,revision:0,checkpoint_sha256:\"0\".repeat(64),updated_at:null};\n const pending = await sqlite.execute({sql:\"SELECT recipient,COUNT(*) AS n FROM messages WHERE lane=? AND acked_at IS NULL GROUP BY recipient\",args:[lane]});\n return c.json({state:row,pending:pending.rows});\n});\n\napp.get(\"/v1/inbox\", async (c) => {\n const auth = await authFrom(c.req.raw); if (!auth || (auth.role !== \"gpt\" && auth.role !== \"codex\")) return c.json({error:\"UNAUTHORIZED\"},401);\n if (auth.kind === \"device\") return c.json({error:\"DEVICE_TOKEN_USE_CHALLENGE_ROUTE\"},403);\n const role = auth.role;\n const lane = c.req.query(\"lane\") || \"\"; if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n if (!laneAuthorized(auth,lane)) return c.json({error:\"DEVICE_TOKEN_SCOPE_VIOLATION\"},403);\n const rs = await sqlite.execute({sql:`SELECT id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at\n FROM messages WHERE recipient=? AND lane=? AND acked_at IS NULL ORDER BY revision,id LIMIT 100`,args:[role,lane]});\n return c.json({messages:rs.rows.map((r:any)=>({...r,payload:JSON.parse(String(r.payload_json)),payload_json:undefined}))});\n});\n\napp.get(\"/v1/challenge/:lane\", async (c) => {\n const auth = await authFrom(c.req.raw);\n if (!auth || auth.kind !== \"device\" || auth.role !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n const lane = c.req.param(\"lane\");\n if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n if (!laneAuthorized(auth,lane)) return c.json({error:\"DEVICE_TOKEN_SCOPE_VIOLATION\"},403);\n const rs = await sqlite.execute({\n sql:\"SELECT id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at,acked_at FROM messages WHERE lane=? AND actor='gpt' AND recipient='codex' ORDER BY revision ASC\",\n args:[lane]\n });\n if (rs.rows.length !== 1) return c.json({error:\"CHALLENGE_SET_NOT_UNIQUE\",count:rs.rows.length},409);\n const row:any = rs.rows[0];\n return c.json({challenge:{...row,payload:JSON.parse(String(row.payload_json)),payload_json:undefined}});\n});\n\napp.post(\"/v1/messages\", async (c) => {\n const auth = await authFrom(c.req.raw); if (!auth || (auth.role !== \"gpt\" && auth.role !== \"codex\")) return c.json({error:\"UNAUTHORIZED\"},401);\n const actor = auth.role;\n try {\n const b = await bodyJson(c);\n const lane = String(b.lane||\"\"); if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n if (!laneAuthorized(auth,lane)) return c.json({error:\"DEVICE_TOKEN_SCOPE_VIOLATION\"},403);\n const base = Number(b.base_revision); if (!Number.isSafeInteger(base) || base < 0) return c.json({error:\"INVALID_BASE_REVISION\"},400);\n const payload = b.payload ?? {}; if (hasSecret(payload)) return c.json({error:\"SECRET_REJECTED\"},400);\n if (auth.kind === \"device\" && payload?.kind !== \"runtime_acceptance_response_v6\") return c.json({error:\"DEVICE_TOKEN_MESSAGE_KIND_VIOLATION\"},403);\n if (auth.kind === \"device\" && base !== 1) return c.json({error:\"DEVICE_TOKEN_BASE_REVISION_VIOLATION\",expected:1,observed:base},403);\n const requestId = String(b.request_id || \"\").trim();\n if (requestId && !/^[A-Za-z0-9_.:-]{16,128}$/.test(requestId)) return c.json({error:\"INVALID_REQUEST_ID\"},400);\n const requestBodySha256 = await sha(canonical({lane,base_revision:base,payload}));\n if (requestId) {\n const prior = await sqlite.execute({sql:\"SELECT body_sha256,message_id FROM request_dedup WHERE actor=? AND request_id=?\",args:[actor,requestId]});\n if (prior.rows.length) {\n const d:any = prior.rows[0];\n if (String(d.body_sha256)!==requestBodySha256) return c.json({error:\"IDEMPOTENCY_KEY_REUSE_MISMATCH\"},409);\n const m = await sqlite.execute({sql:\"SELECT id,lane,revision,payload_sha256,message_sha256 FROM messages WHERE id=?\",args:[String(d.message_id)]});\n if (!m.rows.length) return c.json({error:\"DEDUP_MESSAGE_MISSING\"},500);\n if (auth.kind === \"device\") {\n const prov = await sqlite.execute({sql:\"SELECT pairing_id,token_sha256 FROM message_auth_provenance WHERE message_id=? LIMIT 1\",args:[String(d.message_id)]});\n const p:any = prov.rows[0];\n if (!p || String(p.pairing_id)!==String(auth.pairing_id) || String(p.token_sha256)!==String(auth.token_sha256)) {\n return c.json({error:\"DEVICE_IDEMPOTENCY_PROVENANCE_MISMATCH\"},403);\n }\n }\n const row:any = m.rows[0];\n const checkpoint_sha256 = await sha(canonical({lane:String(row.lane),revision:Number(row.revision),message_sha256:String(row.message_sha256)}));\n await audit(\"MESSAGE_ACCEPTED\",actor,String(row.lane),String(row.id),String(row.message_sha256));\n return c.json({accepted:true,idempotent:true,id:row.id,lane:row.lane,revision:row.revision,payload_sha256:row.payload_sha256,message_sha256:row.message_sha256,checkpoint_sha256},200);\n }\n }\n await sqlite.execute({sql:\"INSERT OR IGNORE INTO lane_state(lane,revision,checkpoint_sha256,updated_at) VALUES(?,0,?,?)\",args:[lane,\"0\".repeat(64),new Date().toISOString()]});\n const st = await sqlite.execute({sql:\"SELECT revision FROM lane_state WHERE lane=?\",args:[lane]});\n const cur = Number(st.rows[0]?.revision ?? 0); if (cur !== base) return c.json({error:\"STALE_REVISION\",expected:cur,observed:base},409);\n const recipient = actor === \"gpt\" ? \"codex\" : \"gpt\";\n const id = crypto.randomUUID(); const revision = base + 1; const created_at = new Date().toISOString();\n const payload_json = canonical(payload); const payload_sha256 = await sha(payload_json);\n const envelope = {protocol:\"rumbo-continuity-relay/v1\",id,actor,recipient,lane,base_revision:base,revision,payload_sha256,created_at};\n const message_sha256 = await sha(canonical(envelope));\n const checkpoint_sha256 = await sha(canonical({lane,revision,message_sha256}));\n const statements:any[] = [\n {sql:`INSERT INTO messages(id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at)\n VALUES(?,?,?,?,?,?,?,?,?,?)`,args:[id,actor,recipient,lane,base,revision,payload_json,payload_sha256,message_sha256,created_at]},\n {sql:\"UPDATE lane_state SET checkpoint_sha256=? WHERE lane=? AND revision=?\",args:[checkpoint_sha256,lane,revision]}\n ];\n if (auth.kind === \"device\") {\n if (!auth.pairing_id || !auth.token_sha256) return c.json({error:\"DEVICE_AUTH_PROVENANCE_MISSING\"},403);\n statements.push({sql:\"INSERT INTO message_auth_provenance(message_id,auth_kind,pairing_id,token_sha256,created_at) VALUES(?,?,?,?,?)\",args:[id,\"device\",auth.pairing_id,auth.token_sha256,created_at]});\n }\n if (requestId) statements.push({sql:\"INSERT INTO request_dedup(actor,request_id,body_sha256,message_id,created_at) VALUES(?,?,?,?,?)\",args:[actor,requestId,requestBodySha256,id,created_at]});\n try {\n await sqlite.batch(statements);\n } catch (e) {\n if (requestId) {\n const prior = await sqlite.execute({sql:\"SELECT body_sha256,message_id FROM request_dedup WHERE actor=? AND request_id=?\",args:[actor,requestId]});\n if (prior.rows.length) {\n const d:any = prior.rows[0];\n if (String(d.body_sha256)!==requestBodySha256) return c.json({error:\"IDEMPOTENCY_KEY_REUSE_MISMATCH\"},409);\n const m = await sqlite.execute({sql:\"SELECT id,lane,revision,payload_sha256,message_sha256 FROM messages WHERE id=?\",args:[String(d.message_id)]});\n if (m.rows.length) {\n if (auth.kind === \"device\") {\n const prov = await sqlite.execute({sql:\"SELECT pairing_id,token_sha256 FROM message_auth_provenance WHERE message_id=? LIMIT 1\",args:[String(d.message_id)]});\n const p:any = prov.rows[0];\n if (!p || String(p.pairing_id)!==String(auth.pairing_id) || String(p.token_sha256)!==String(auth.token_sha256)) {\n return c.json({error:\"DEVICE_IDEMPOTENCY_PROVENANCE_MISMATCH\"},403);\n }\n }\n const row:any=m.rows[0];\n const cp=await sha(canonical({lane:String(row.lane),revision:Number(row.revision),message_sha256:String(row.message_sha256)}));\n await audit(\"MESSAGE_ACCEPTED\",actor,String(row.lane),String(row.id),String(row.message_sha256));\n return c.json({accepted:true,idempotent:true,id:row.id,lane:row.lane,revision:row.revision,payload_sha256:row.payload_sha256,message_sha256:row.message_sha256,checkpoint_sha256:cp},200);\n }\n }\n }\n if (String(e).includes(\"STALE_REVISION\")) {\n const curState=await sqlite.execute({sql:\"SELECT revision FROM lane_state WHERE lane=?\",args:[lane]});\n return c.json({error:\"STALE_REVISION\",expected:Number(curState.rows[0]?.revision ?? 0),observed:base},409);\n }\n throw e;\n }\n const verify = await sqlite.execute({sql:\"SELECT revision,checkpoint_sha256 FROM lane_state WHERE lane=?\",args:[lane]});\n if (Number(verify.rows[0]?.revision) !== revision || String(verify.rows[0]?.checkpoint_sha256)!==checkpoint_sha256) return c.json({error:\"ATOMIC_ADVANCE_FAILED\"},409);\n await audit(\"MESSAGE_ACCEPTED\",actor,lane,id,message_sha256);\n return c.json({accepted:true,idempotent:false,id,lane,revision,payload_sha256,message_sha256,checkpoint_sha256},201);\n } catch (e) { return c.json({error:String(e?.message||e)},400); }\n});\n\napp.post(\"/v1/acks\", async (c) => {\n const auth = await authFrom(c.req.raw); if (!auth || (auth.role !== \"gpt\" && auth.role !== \"codex\")) return c.json({error:\"UNAUTHORIZED\"},401);\n const actor = auth.role;\n try {\n const b = await bodyJson(c); const id = String(b.message_id||\"\"); const msgSha = String(b.message_sha256||\"\");\n const rs = await sqlite.execute({sql:\"SELECT * FROM messages WHERE id=?\",args:[id]}); const m:any = rs.rows[0];\n if (!m) return c.json({error:\"NOT_FOUND\"},404);\n if (!laneAuthorized(auth,String(m.lane))) return c.json({error:\"DEVICE_TOKEN_SCOPE_VIOLATION\"},403);\n if (auth.kind === \"device\") {\n let mp:any = null;\n try { mp = JSON.parse(String(m.payload_json || \"{}\")); } catch {}\n if (String(m.actor)!==\"gpt\" || String(m.recipient)!==\"codex\" || Number(m.revision)!==1 || mp?.kind!==\"runtime_acceptance_challenge_v6\") {\n return c.json({error:\"DEVICE_TOKEN_ACK_TARGET_VIOLATION\"},403);\n }\n }\n if (String(m.recipient)!==actor) return c.json({error:\"WRONG_RECIPIENT\"},403);\n if (String(m.message_sha256)!==msgSha) return c.json({error:\"HASH_MISMATCH\"},409);\n const prior = await sqlite.execute({sql:\"SELECT id FROM acknowledgements WHERE target_message_id=?\",args:[id]});\n if (prior.rows.length) {\n if (auth.kind === \"device\") {\n const prov = await sqlite.execute({sql:\"SELECT pairing_id,token_sha256 FROM ack_auth_provenance WHERE target_message_id=? LIMIT 1\",args:[id]});\n const p:any = prov.rows[0];\n if (!p || String(p.pairing_id)!==String(auth.pairing_id) || String(p.token_sha256)!==String(auth.token_sha256)) {\n return c.json({error:\"DEVICE_ACK_PROVENANCE_MISMATCH\"},403);\n }\n }\n await audit(\"MESSAGE_ACKED\",actor,String(m.lane),id,msgSha);\n return c.json({acked:true,idempotent:true,message_id:id});\n }\n const ackId = crypto.randomUUID(), created_at = new Date().toISOString();\n const ackStatements:any[] = [\n {sql:\"INSERT OR IGNORE INTO acknowledgements(id,actor,target_message_id,target_message_sha256,created_at) VALUES(?,?,?,?,?)\",args:[ackId,actor,id,msgSha,created_at]},\n {sql:\"UPDATE messages SET acked_at=COALESCE(acked_at,?) WHERE id=?\",args:[created_at,id]}\n ];\n if (auth.kind === \"device\") {\n if (!auth.pairing_id || !auth.token_sha256) return c.json({error:\"DEVICE_AUTH_PROVENANCE_MISSING\"},403);\n ackStatements.push({sql:\"INSERT INTO ack_auth_provenance(target_message_id,acknowledgement_id,auth_kind,pairing_id,token_sha256,created_at) VALUES(?,?,?,?,?,?)\",args:[id,ackId,\"device\",auth.pairing_id,auth.token_sha256,created_at]});\n }\n const results:any = await sqlite.batch(ackStatements);\n const inserted = Number(results?.[0]?.rowsAffected ?? 0) > 0;\n if (inserted) await audit(\"MESSAGE_ACKED\",actor,String(m.lane),id,msgSha);\n return c.json({acked:true,idempotent:!inserted,message_id:id});\n } catch (e) { return c.json({error:String(e?.message||e)},400); }\n});\n\napp.get(\"/v1/acceptance/:lane\", async (c) => {\n const role = await roleFrom(c.req.raw);\n if (role !== \"gpt\" && role !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const lane = c.req.param(\"lane\");\n if ([\"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\",\"CODEX_REAL_RUNTIME_ACCEPTANCE_V2\",\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\",\"CODEX_REAL_RUNTIME_ACCEPTANCE_V4\",\"CODEX_REAL_RUNTIME_ACCEPTANCE_V5\"].includes(lane)) {\n return c.json({\n lane,state:\"SUPERSEDED_BY_CODEX_REAL_RUNTIME_ACCEPTANCE_V6\",\n mechanical_checks_passed:false,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n }\n if (lane !== DEVICE_ACCESS_LANE) return c.json({error:\"UNSUPPORTED_ACCEPTANCE_LANE\"},404,{\"Cache-Control\":\"no-store\"});\n\n const challenges = await sqlite.execute({sql:`SELECT id,revision,payload_json,message_sha256,created_at,acked_at\n FROM messages WHERE lane=? AND actor='gpt' AND recipient='codex' ORDER BY revision ASC`,args:[lane]});\n if (challenges.rows.length !== 1) return c.json({\n lane,state:challenges.rows.length ? \"AMBIGUOUS_CHALLENGE_SET\" : \"CHALLENGE_NOT_PROVEN\",\n challenge_count:challenges.rows.length,mechanical_checks_passed:false,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n const challenge:any = challenges.rows[0];\n let cp:any;\n try { cp = JSON.parse(String(challenge.payload_json)); } catch { cp = null; }\n const required = [\n \"consume_this_exact_message\",\"ack_exact_message_id_and_message_sha256\",\n \"execute_actual_codex_cli_isolated_read_only_never_approve\",\n \"prove_fresh_local_read_challenge_not_present_in_prompt\",\n \"prove_model_shell_environment_core_only\",\n \"prove_model_shell_environment_default_sensitive_excludes\",\n \"prove_codex_home_not_inherited_by_model_shell\",\n \"prove_openai_sensitive_env_not_inherited_by_model_shell\",\n \"execute_exactly_one_shell_command\",\n \"bind_started_and_completed_command_to_exact_probe_wrapper\",\n \"reject_any_second_shell_command\",\n \"reject_collab_web_mcp_and_file_change_items\",\n \"publish_reverse_response_with_same_challenge_nonce\",\n \"bind_ack_and_response_to_same_authenticated_device\",\n \"bind_device_pairing_contract_to_bootstrap_lane_and_challenge\",\n \"include_local_plugin_manifest_sha256\",\"include_local_runtime_receipt_sha256\",\n \"include_local_read_challenge_sha256\",\"include_codex_runtime_nonce\",\n \"include_codex_last_message_sha256\",\"include_codex_exec_events_sha256\",\n \"include_probe_wrapper_sha256\",\"include_expected_and_observed_command_sha256\",\n \"do_not_include_secrets\",\"preserve_fail_closed_project_gates\",\"production_go_false\"\n ];\n const declared = Array.isArray(cp?.acceptance_requirements) ? cp.acceptance_requirements.map(String) : [];\n const deadline = String(cp?.acceptance_not_after_utc || \"\");\n const deadlineMs = Date.parse(deadline);\n const challengeCreatedAt = Date.parse(String(challenge.created_at || \"\"));\n const execContract:any = cp?.required_codex_execution || {};\n const contractOk =\n String(challenge.id) === R11_CHALLENGE_ID &&\n String(challenge.message_sha256) === R11_CHALLENGE_SHA256 &&\n Number(challenge.revision) === 1 &&\n cp?.kind === \"runtime_acceptance_challenge_v6\" &&\n typeof cp?.challenge_nonce === \"string\" && cp.challenge_nonce.length >= 32 &&\n deadline === R11_ACCEPTANCE_NOT_AFTER_UTC && Number.isFinite(deadlineMs) &&\n cp?.canonical_release === \"GPT_CODEX_CONTEXT_BRIDGE_V1_6\" &&\n cp?.canonical_release_sha256 === \"cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b\" &&\n cp?.canonical_skill_sha256 === \"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\" &&\n cp?.expected_plugin_name === \"rumbo-gpt-codex-continuity\" &&\n cp?.expected_plugin_version === R11_PLUGIN_VERSION &&\n cp?.expected_plugin_manifest_sha256 === R11_PLUGIN_MANIFEST_SHA256 &&\n execContract?.mode === \"codex exec\" &&\n execContract?.ephemeral === true &&\n execContract?.sandbox === \"read-only\" &&\n execContract?.ask_for_approval === \"never\" &&\n execContract?.skip_git_repo_check === true &&\n execContract?.dangerous_bypass_forbidden === true &&\n execContract?.model_override_forbidden === true &&\n execContract?.isolated_codex_home === true &&\n execContract?.ignore_user_config === true &&\n execContract?.ignore_rules === true &&\n execContract?.user_config_inherited === false &&\n execContract?.project_config_inherited === false &&\n execContract?.global_agents_md_inherited === false &&\n execContract?.local_read_challenge_required === true &&\n execContract?.hidden_local_nonce_not_in_prompt === true &&\n execContract?.auth_source === \"regular_auth_json_copy\" &&\n execContract?.shell_environment_inherit === \"core\" &&\n execContract?.shell_environment_default_sensitive_excludes === true &&\n execContract?.shell_environment_codex_home_inherited === false &&\n execContract?.shell_environment_openai_sensitive_vars_inherited === false &&\n execContract?.shell_environment_probe_required === true &&\n execContract?.exact_single_shell_command_required === true &&\n execContract?.exact_probe_wrapper_command_required === true &&\n execContract?.additional_shell_commands_forbidden === true &&\n execContract?.collab_tools_forbidden === true &&\n required.every(x => declared.includes(x));\n\n const evidence:any = {\n challenge_message_id:String(challenge.id),\n challenge_message_sha256:String(challenge.message_sha256),\n challenge_revision:Number(challenge.revision),\n challenge_created_at:String(challenge.created_at || \"\"),\n acceptance_not_after_utc:deadline\n };\n if (!contractOk) return c.json({lane,state:\"CHALLENGE_CONTRACT_MISMATCH\",mechanical_checks_passed:false,evidence,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n\n const codexAck = await sqlite.execute({sql:`SELECT a.id,a.created_at,p.auth_kind,p.pairing_id AS auth_pairing_id,p.token_sha256 AS auth_token_sha256\n FROM acknowledgements a\n LEFT JOIN ack_auth_provenance p ON p.target_message_id=a.target_message_id AND p.acknowledgement_id=a.id\n WHERE a.actor='codex' AND a.target_message_id=? AND a.target_message_sha256=? LIMIT 1`,\n args:[String(challenge.id),String(challenge.message_sha256)]});\n if (!codexAck.rows.length) {\n const expired = Date.now() > deadlineMs;\n return c.json({\n lane,state:expired ? \"CHALLENGE_EXPIRED_NO_CODEX_ACK\" : \"PENDING_CODEX_ACK\",\n mechanical_checks_passed:false,evidence,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n }\n\n const ackRow:any = codexAck.rows[0];\n const codexAckAt = Date.parse(String(ackRow.created_at || \"\"));\n if (!Number.isFinite(codexAckAt) || codexAckAt > deadlineMs || codexAckAt < challengeCreatedAt) {\n return c.json({\n lane,state:\"INVALID_CODEX_ACK_TIME\",mechanical_checks_passed:false,\n evidence:{...evidence,codex_ack_id:String(ackRow.id),codex_ack_created_at:String(ackRow.created_at || \"\")},\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n }\n\n const reverse = await sqlite.execute({sql:`SELECT m.id,m.revision,m.payload_json,m.message_sha256,m.created_at,m.acked_at,\n p.auth_kind,p.pairing_id AS auth_pairing_id,p.token_sha256 AS auth_token_sha256\n FROM messages m\n LEFT JOIN message_auth_provenance p ON p.message_id=m.id\n WHERE m.lane=? AND m.actor='codex' AND m.recipient='gpt' AND m.revision>? ORDER BY m.revision ASC`,\n args:[lane,Number(challenge.revision)]});\n if (!reverse.rows.length) return c.json({\n lane,state:\"PENDING_CODEX_RESPONSE\",mechanical_checks_passed:false,\n evidence:{...evidence,codex_ack_id:String(ackRow.id)},production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n if (reverse.rows.length !== 1) return c.json({\n lane,state:\"AMBIGUOUS_MULTIPLE_CODEX_RESPONSES\",response_count:reverse.rows.length,\n mechanical_checks_passed:false,evidence,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n const response:any = reverse.rows[0];\n let rp:any;\n try { rp = JSON.parse(String(response.payload_json)); } catch { rp = null; }\n const responseCreatedAt = Date.parse(String(response.created_at || \"\"));\n const codexExecution:any = rp?.codex_execution || {};\n const devicePairingId = String(rp?.device_pairing_session_id || \"\");\n\n const deviceRows = /^[0-9a-f-]{36}$/.test(devicePairingId)\n ? await sqlite.execute({sql:`SELECT t.token_sha256,t.lane_scope,t.issued_at,t.expires_at,t.revoked_at,\n s.approved_at,s.delivered_at,\n x.bootstrap_script_sha256,x.acceptance_lane,x.challenge_message_id,x.challenge_message_sha256\n FROM device_access_tokens t\n JOIN device_pairing_sessions s ON s.pairing_id=t.pairing_id\n LEFT JOIN device_pairing_contracts x ON x.pairing_id=t.pairing_id\n WHERE t.pairing_id=? LIMIT 1`,args:[devicePairingId]})\n : {rows:[]};\n const device:any = deviceRows.rows[0] || null;\n\n const responseAuthPairingId = String(response.auth_pairing_id || \"\");\n const responseAuthTokenSha256 = String(response.auth_token_sha256 || \"\");\n const ackAuthPairingId = String(ackRow.auth_pairing_id || \"\");\n const ackAuthTokenSha256 = String(ackRow.auth_token_sha256 || \"\");\n const tokenIssuedAt = Date.parse(String(device?.issued_at || \"\"));\n const tokenExpiresAt = Date.parse(String(device?.expires_at || \"\"));\n const tokenRevokedAt = device?.revoked_at ? Date.parse(String(device.revoked_at)) : null;\n const pairingApprovedAt = Date.parse(String(device?.approved_at || \"\"));\n const pairingDeliveredAt = Date.parse(String(device?.delivered_at || \"\"));\n\n const checks = {\n response_before_deadline:Number.isFinite(responseCreatedAt) && responseCreatedAt <= deadlineMs,\n response_after_codex_ack:Number.isFinite(responseCreatedAt) && responseCreatedAt >= codexAckAt,\n response_kind:rp?.kind === \"runtime_acceptance_response_v6\",\n challenge_nonce_exact:typeof rp?.challenge_nonce === \"string\" && rp.challenge_nonce === cp.challenge_nonce,\n challenge_message_id_exact:rp?.challenge_message_id === String(challenge.id),\n challenge_message_sha256_exact:rp?.challenge_message_sha256 === String(challenge.message_sha256),\n canonical_release_exact:rp?.canonical_release === \"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n canonical_release_sha256_exact:rp?.canonical_release_sha256 === \"cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b\",\n canonical_skill_sha256_exact:rp?.canonical_skill_sha256 === \"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n plugin_name_exact:rp?.plugin_name === \"rumbo-gpt-codex-continuity\",\n plugin_version_exact:rp?.plugin_version === R11_PLUGIN_VERSION,\n local_plugin_manifest_sha256_exact:rp?.local_plugin_manifest_sha256 === R11_PLUGIN_MANIFEST_SHA256,\n local_runtime_receipt_sha256:validSha256(rp?.local_runtime_receipt_sha256),\n device_pairing_session_id:/^[0-9a-f-]{36}$/.test(devicePairingId),\n device_binding_exists:!!device,\n device_lane_scope_exact:String(device?.lane_scope || \"\") === DEVICE_ACCESS_LANE,\n pairing_contract_bootstrap_exact:String(device?.bootstrap_script_sha256 || \"\") === R11_BOOTSTRAP_SHA256,\n pairing_contract_lane_exact:String(device?.acceptance_lane || \"\") === DEVICE_ACCESS_LANE,\n pairing_contract_challenge_id_exact:String(device?.challenge_message_id || \"\") === R11_CHALLENGE_ID,\n pairing_contract_challenge_sha_exact:String(device?.challenge_message_sha256 || \"\") === R11_CHALLENGE_SHA256,\n response_auth_kind_device:String(response.auth_kind || \"\") === \"device\",\n response_auth_pairing_exact:responseAuthPairingId === devicePairingId,\n response_auth_token_exact:validSha256(responseAuthTokenSha256) && responseAuthTokenSha256 === String(device?.token_sha256 || \"\"),\n ack_auth_kind_device:String(ackRow.auth_kind || \"\") === \"device\",\n ack_auth_pairing_exact:ackAuthPairingId === devicePairingId,\n ack_auth_token_exact:validSha256(ackAuthTokenSha256) && ackAuthTokenSha256 === String(device?.token_sha256 || \"\"),\n ack_response_same_authenticated_device:ackAuthPairingId === responseAuthPairingId && ackAuthTokenSha256 === responseAuthTokenSha256,\n pairing_approved_before_ack:Number.isFinite(pairingApprovedAt) && pairingApprovedAt <= codexAckAt,\n token_delivered_before_ack:Number.isFinite(pairingDeliveredAt) && pairingDeliveredAt <= codexAckAt,\n token_issued_before_ack:Number.isFinite(tokenIssuedAt) && tokenIssuedAt <= codexAckAt,\n token_active_at_response:Number.isFinite(tokenIssuedAt) && Number.isFinite(tokenExpiresAt) &&\n tokenIssuedAt <= responseCreatedAt && tokenExpiresAt > responseCreatedAt &&\n (tokenRevokedAt === null || (Number.isFinite(tokenRevokedAt) && tokenRevokedAt >= responseCreatedAt)),\n bootstrap_script_sha256_exact:rp?.bootstrap_script_sha256 === R11_BOOTSTRAP_SHA256,\n codex_cli_version:typeof rp?.codex_cli_version === \"string\" && rp.codex_cli_version.length > 0 && rp.codex_cli_version.length <= 300,\n codex_thread_id:typeof rp?.codex_thread_id === \"string\" && rp.codex_thread_id.length > 0 && rp.codex_thread_id.length <= 200,\n codex_runtime_nonce:typeof rp?.codex_runtime_nonce === \"string\" && /^[a-f0-9]{64}$/.test(rp.codex_runtime_nonce),\n codex_local_read_challenge_sha256:validSha256(rp?.codex_local_read_challenge_sha256),\n codex_last_message_sha256:validSha256(rp?.codex_last_message_sha256),\n codex_exec_events_sha256:validSha256(rp?.codex_exec_events_sha256),\n codex_tool_probe_verified:rp?.codex_tool_probe_verified === true,\n codex_tool_probe_sha256:validSha256(rp?.codex_tool_probe_sha256),\n codex_skill_md_sha256_exact:rp?.codex_skill_md_sha256 === \"224197fb56be75ae395fb2e4e2eb48f3bd64d1e187df5799fd6d661e4d1ec09f\",\n codex_probe_wrapper_sha256:validSha256(rp?.codex_probe_wrapper_sha256),\n codex_expected_command_sha256:validSha256(rp?.codex_expected_command_sha256),\n codex_observed_command_sha256:validSha256(rp?.codex_observed_command_sha256) && rp.codex_observed_command_sha256 === rp.codex_expected_command_sha256,\n codex_command_item_id_sha256:validSha256(rp?.codex_command_item_id_sha256),\n codex_exact_single_command_verified:rp?.codex_exact_single_command_verified === true,\n codex_command_execution_started_count:rp?.codex_command_execution_started_count === 1,\n codex_command_execution_count:rp?.codex_command_execution_count === 1,\n codex_prohibited_items_seen:rp?.codex_prohibited_items_seen === false,\n codex_exec_exit_code:rp?.codex_exec_exit_code === 0,\n codex_cli_contract_preflight:rp?.codex_cli_contract_preflight === true,\n codex_output_bindings_exact:rp?.codex_output_bindings_exact === true,\n codex_local_read_proof_exact:rp?.codex_local_read_proof_exact === true,\n codex_env_probe_script_sha256_exact:rp?.codex_env_probe_script_sha256 === \"8dff8e38c986fabdea627183745fb643bfbcb8c9262e915f6d1f8447d90a2f72\",\n codex_shell_environment_probe_verified:rp?.codex_shell_environment_probe_verified === true,\n codex_home_env_absent:rp?.codex_home_env_absent === true,\n openai_sensitive_env_count:rp?.openai_sensitive_env_count === 0,\n sensitive_env_name_count:rp?.sensitive_env_name_count === 0,\n codex_exec_mode:codexExecution?.mode === \"codex exec\",\n codex_exec_ephemeral:codexExecution?.ephemeral === true,\n codex_exec_sandbox:codexExecution?.sandbox === \"read-only\",\n codex_exec_approval_never:codexExecution?.ask_for_approval === \"never\",\n codex_exec_dangerous_bypass:codexExecution?.dangerous_bypass_used === false,\n codex_exec_model_override:codexExecution?.model_override_used === false,\n codex_exec_skip_git_repo_check:codexExecution?.skip_git_repo_check === true,\n codex_exec_isolated_home:codexExecution?.isolated_codex_home === true,\n codex_exec_ignore_user_config:codexExecution?.ignore_user_config === true,\n codex_exec_ignore_rules:codexExecution?.ignore_rules === true,\n codex_exec_user_config_not_inherited:codexExecution?.user_config_inherited === false,\n codex_exec_project_config_not_inherited:codexExecution?.project_config_inherited === false,\n codex_exec_global_agents_not_inherited:codexExecution?.global_agents_md_inherited === false,\n codex_exec_auth_source:codexExecution?.auth_source === \"regular_auth_json_copy\",\n codex_exec_shell_environment_inherit:codexExecution?.shell_environment_inherit === \"core\",\n codex_exec_shell_environment_default_sensitive_excludes:codexExecution?.shell_environment_default_sensitive_excludes === true,\n codex_exec_shell_environment_codex_home_not_inherited:codexExecution?.shell_environment_codex_home_inherited === false,\n codex_exec_shell_environment_openai_sensitive_vars_not_inherited:codexExecution?.shell_environment_openai_sensitive_vars_inherited === false,\n codex_exec_shell_environment_probe_required:codexExecution?.shell_environment_probe_required === true,\n codex_exec_exact_single_shell_command:codexExecution?.exact_single_shell_command === true,\n codex_exec_exact_probe_wrapper_command:codexExecution?.exact_probe_wrapper_command === true,\n codex_exec_additional_shell_commands_forbidden:codexExecution?.additional_shell_commands_forbidden === true,\n codex_exec_collab_tools_forbidden:codexExecution?.collab_tools_forbidden === true,\n runtime_claim:rp?.runtime_claim === \"ACTUAL_CODEX_CLI_EXEC_ISOLATED_READ_ONLY_EXACT_SINGLE_COMMAND_PROVEN\",\n fail_closed_project_gates_preserved:rp?.fail_closed_project_gates_preserved === true,\n secrets_exposed:rp?.secrets_exposed === false,\n production_go:rp?.production_go === false\n };\n\n const responseEvidence:any = {\n ...evidence,\n codex_ack_id:String(ackRow.id),\n codex_ack_created_at:String(ackRow.created_at || \"\"),\n codex_response_message_id:String(response.id),\n codex_response_message_sha256:String(response.message_sha256),\n codex_response_revision:Number(response.revision),\n codex_response_created_at:String(response.created_at || \"\"),\n device_pairing_session_id:devicePairingId,\n checks\n };\n if (!Object.values(checks).every(Boolean)) return c.json({\n lane,state:\"INVALID_CODEX_RESPONSE\",mechanical_checks_passed:false,evidence:responseEvidence,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n const deviceTokenExpired = Number.isFinite(tokenExpiresAt) && tokenExpiresAt <= Date.now();\n if (!device?.revoked_at && !deviceTokenExpired) return c.json({\n lane,state:\"PENDING_DEVICE_TOKEN_INACTIVATION\",mechanical_checks_passed:false,\n evidence:{...responseEvidence,device_token_revoked_at:null,device_token_expires_at:String(device?.expires_at || \"\")},\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n responseEvidence.device_token_revoked_at = device?.revoked_at ? String(device.revoked_at) : null;\n responseEvidence.device_token_expires_at = String(device?.expires_at || \"\");\n responseEvidence.device_token_inactive_reason = device?.revoked_at ? \"REVOKED\" : \"EXPIRED\";\n\n const gptAck = await sqlite.execute({sql:`SELECT id,created_at FROM acknowledgements\n WHERE actor='gpt' AND target_message_id=? AND target_message_sha256=? LIMIT 1`,\n args:[String(response.id),String(response.message_sha256)]});\n if (!gptAck.rows.length) return c.json({\n lane,state:\"PENDING_CHATGPT_ACK\",mechanical_checks_passed:true,\n evidence:responseEvidence,manual_semantic_review_required:true,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n return c.json({\n lane,state:\"PASS_RUNTIME_ROUNDTRIP\",mechanical_checks_passed:true,\n evidence:{...responseEvidence,gpt_ack_id:String((gptAck.rows[0] as any).id)},\n claim_boundary:\"Continuity runtime/authenticated-device/local-read binding only; no project production authorization.\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/guard/authorize\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseGuardBinding(b);\n if (!binding) return c.json({error:\"INVALID_GUARD_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < 60 || ttl > R2_GUARD_MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min_seconds:60,max_seconds:R2_GUARD_MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n const requestSha256 = await sha(canonical(binding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM guard_authorizations WHERE request_sha256=? LIMIT 1\",\n args:[requestSha256]\n });\n if (prior.rows.length) {\n const row:any = prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256:requestSha256\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const rawToken = randomOneTimeToken();\n const tokenSha256 = await sha(rawToken);\n const authorizationId = crypto.randomUUID();\n const issuedAt = new Date();\n const issuedAtIso = issuedAt.toISOString();\n const expiresAt = new Date(issuedAt.getTime() + ttl * 1000).toISOString();\n try {\n await sqlite.execute({\n sql:`INSERT INTO guard_authorizations(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorizationId,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n requestSha256,tokenSha256,issuedAtIso,expiresAt\n ]\n });\n } catch (e) {\n if (String(e).includes(\"UNIQUE\")) return c.json({error:\"AUTHORIZATION_COLLISION\"},409,{\"Cache-Control\":\"no-store\"});\n throw e;\n }\n\n try {\n await audit(\"GUARD_AUTHORIZATION_ISSUED\",\"guard\",null,authorizationId,requestSha256);\n } catch (e) {\n await sqlite.execute({sql:\"UPDATE guard_authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",args:[authorizationId]});\n throw e;\n }\n\n return c.json({\n authorized:true,\n authorization_id:authorizationId,\n action:binding.action,\n request_sha256:requestSha256,\n token:rawToken,\n token_type:\"One-Time\",\n issued_at:issuedAtIso,\n expires_at:expiresAt,\n production_go:false,\n merge_authorized:binding.action === \"MERGE_PR\",\n note:\"The raw one-time token is returned only on issuance; only its SHA-256 is persisted.\"\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/guard/consume\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseGuardBinding(b);\n if (!binding) return c.json({error:\"INVALID_GUARD_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const authorizationId = String(b.authorization_id || \"\");\n const rawToken = String(b.token || \"\");\n if (!authorizationId || !/^[A-Za-z0-9_-]{43,128}$/.test(rawToken)) {\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const requestSha256 = await sha(canonical(binding));\n const rs = await sqlite.execute({sql:\"SELECT * FROM guard_authorizations WHERE authorization_id=? LIMIT 1\",args:[authorizationId]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n await sqlite.execute({sql:\"UPDATE guard_authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",args:[authorizationId]});\n await audit(\"GUARD_AUTHORIZATION_EXPIRED\",\"guard\",null,authorizationId,String(row.request_sha256));\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id:authorizationId},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",authorization_id:authorizationId,status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n if (!constantTimeEqual(String(row.request_sha256), requestSha256)) {\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n const observedTokenSha256 = await sha(rawToken);\n if (!constantTimeEqual(String(row.token_sha256), observedTokenSha256)) {\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumedAt = new Date().toISOString();\n const consumer = String(b.consumer || \"unspecified\").slice(0,128);\n if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)) {\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumedAt,consumer,authorizationId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"AUTHORIZATION_RACE_LOST\",authorization_id:authorizationId},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt = {\n schema:\"rumbo-r2-guard-consumption/v1\",\n authorization_id:authorizationId,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n request_sha256:requestSha256,\n consumed_at:consumedAt,\n consumer,\n production_go:false,\n merge_authorized:binding.action === \"MERGE_PR\"\n };\n const receiptSha256 = await sha(canonical(receipt));\n await audit(\"GUARD_AUTHORIZATION_CONSUMED\",\"guard\",null,authorizationId,receiptSha256);\n return c.json({...receipt,consumed:true,receipt_sha256:receiptSha256},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/guard/revoke\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const authorizationId = String(b.authorization_id || \"\");\n if (!authorizationId) return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute({sql:\"SELECT status,request_sha256,expires_at FROM guard_authorizations WHERE authorization_id=? LIMIT 1\",args:[authorizationId]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorizationId]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"GUARD_AUTHORIZATION_EXPIRED\",\"guard\",null,authorizationId,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id:authorizationId},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorizationId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"GUARD_AUTHORIZATION_REVOKED\",\"guard\",null,authorizationId,String(row.request_sha256));\n return c.json({revoked:true,authorization_id:authorizationId,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/guard/authorizations/:id\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const authorizationId = c.req.param(\"id\");\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM guard_authorizations WHERE authorization_id=? LIMIT 1`,\n args:[now,authorizationId]\n });\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n return c.json({authorization:rs.rows[0],production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/guard/ledger\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rawLimit = Number(c.req.query(\"limit\") || \"50\");\n const limit = Number.isSafeInteger(rawLimit) ? Math.max(1,Math.min(100,rawLimit)) : 50;\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM guard_authorizations ORDER BY issued_at DESC LIMIT ?`,\n args:[now,limit]\n });\n return c.json({\n schema:\"rumbo-r2-guard-ledger/v1\",\n external_authorizer_live:true,\n durable_one_time_token_ledger:true,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\", async (c) => {\n const role = await roleFrom(c.req.raw); if (role !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401);\n const rs = await sqlite.execute(\"SELECT * FROM audit_events ORDER BY seq ASC\");\n let prev=\"0\".repeat(64), ok=true;\n for (const r of rs.rows as any[]) {\n const ev={event_type:r.event_type,actor:r.actor,lane:r.lane,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha(canonical(ev)); if (r.prev_event_sha256!==prev || r.event_sha256!==h) ok=false; prev=String(r.event_sha256);\n }\n return c.json({audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,events:rs.rows});\n});\n\napp.post(\"/v1/pair/codex/device/start\", async (c) => {\n try {\n const b = await bodyJson(c);\n const rawLabel = String(b.client_label || \"\").slice(0,128);\n const clientLabel = rawLabel.replace(/[^\\x20-\\x7E]/g, \"?\");\n const bootstrapScriptSha256 = String(b.bootstrap_script_sha256 || \"\");\n const acceptanceLane = String(b.acceptance_lane || \"\");\n const challengeMessageId = String(b.challenge_message_id || \"\");\n const challengeMessageSha256 = String(b.challenge_message_sha256 || \"\");\n if (\n bootstrapScriptSha256 !== R11_BOOTSTRAP_SHA256 ||\n acceptanceLane !== DEVICE_ACCESS_LANE ||\n challengeMessageId !== R11_CHALLENGE_ID ||\n challengeMessageSha256 !== R11_CHALLENGE_SHA256\n ) {\n return c.json({\n error:\"DEVICE_PAIRING_CONTRACT_MISMATCH\",\n expected:{\n bootstrap_script_sha256:R11_BOOTSTRAP_SHA256,\n acceptance_lane:DEVICE_ACCESS_LANE,\n challenge_message_id:R11_CHALLENGE_ID,\n challenge_message_sha256:R11_CHALLENGE_SHA256\n },\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const ip = c.req.header(\"cf-connecting-ip\") || (c.req.header(\"x-forwarded-for\") || \"\").split(\",\")[0].trim() || \"unknown\";\n const ua = c.req.header(\"user-agent\") || \"unknown\";\n const fingerprint = await sha(ip + \"|\" + ua);\n const now = new Date();\n const nowIso = now.toISOString();\n await sqlite.batch([\n {\n sql:\"DELETE FROM device_pairing_contracts WHERE pairing_id IN (SELECT pairing_id FROM device_pairing_sessions WHERE approved_at IS NULL AND expires_at<=?)\",\n args:[nowIso]\n },\n {\n sql:\"DELETE FROM device_pairing_sessions WHERE approved_at IS NULL AND expires_at<=?\",\n args:[nowIso]\n }\n ]);\n const perClient = await sqlite.execute({\n sql:\"SELECT COUNT(*) AS n FROM device_pairing_sessions WHERE client_fingerprint_sha256=? AND approved_at IS NULL AND expires_at>?\",\n args:[fingerprint,nowIso]\n });\n const globalPending = await sqlite.execute({\n sql:\"SELECT COUNT(*) AS n FROM device_pairing_sessions WHERE approved_at IS NULL AND expires_at>?\",\n args:[nowIso]\n });\n if (Number((perClient.rows[0] as any)?.n || 0) >= DEVICE_PAIRING_MAX_PENDING_PER_FINGERPRINT) {\n return c.json({error:\"DEVICE_PAIRING_RATE_LIMITED\",scope:\"client\",production_go:false},429,{\"Cache-Control\":\"no-store\"});\n }\n if (Number((globalPending.rows[0] as any)?.n || 0) >= DEVICE_PAIRING_MAX_PENDING_GLOBAL) {\n return c.json({error:\"DEVICE_PAIRING_CAPACITY_REACHED\",production_go:false},503,{\"Cache-Control\":\"no-store\"});\n }\n\n for (let attempt=0; attempt<8; attempt++) {\n const pairingId = crypto.randomUUID();\n const deviceCode = randomOneTimeToken(32);\n const userCodeRaw = randomUserCode(8);\n const userCode = userCodeRaw.slice(0,4) + \"-\" + userCodeRaw.slice(4);\n const deviceSha = await sha(deviceCode);\n const userSha = await sha(userCodeRaw);\n const expiresAt = new Date(now.getTime()+DEVICE_PAIRING_TTL_MS).toISOString();\n try {\n await sqlite.batch([\n {\n sql:`INSERT INTO device_pairing_sessions(\n pairing_id,device_code_sha256,user_code_sha256,client_fingerprint_sha256,client_label,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?)`,\n args:[pairingId,deviceSha,userSha,fingerprint,clientLabel,nowIso,expiresAt]\n },\n {\n sql:`INSERT INTO device_pairing_contracts(\n pairing_id,bootstrap_script_sha256,acceptance_lane,challenge_message_id,challenge_message_sha256,created_at\n ) VALUES(?,?,?,?,?,?)`,\n args:[pairingId,bootstrapScriptSha256,acceptanceLane,challengeMessageId,challengeMessageSha256,nowIso]\n }\n ]);\n return c.json({\n schema:\"rumbo-codex-device-pairing/v3\",\n pairing_id:pairingId,\n device_pairing_session_id:pairingId,\n device_code:deviceCode,\n user_code:userCode,\n expires_at:expiresAt,\n expires_in_seconds:Math.floor(DEVICE_PAIRING_TTL_MS/1000),\n poll_after_seconds:2,\n poll_path:\"/v1/pair/codex/device/poll\",\n contract:{\n bootstrap_script_sha256:bootstrapScriptSha256,\n acceptance_lane:acceptanceLane,\n challenge_message_id:challengeMessageId,\n challenge_message_sha256:challengeMessageSha256\n },\n approval_instruction:\"Paste user_code into the authorized RUMBO/ChatGPT continuity conversation. Never share device_code.\",\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n return c.json({error:\"DEVICE_PAIRING_COLLISION_RETRY_EXHAUSTED\",production_go:false},503,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/pair/codex/device/inspect\", async (c) => {\n const actor = await roleFrom(c.req.raw);\n if (actor !== \"gpt\" && actor !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const normalized = normalizeUserCode(b.user_code);\n if (normalized.length !== 8 || [...normalized].some(ch => !DEVICE_USER_CODE_ALPHABET.includes(ch))) {\n return c.json({error:\"INVALID_USER_CODE\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const userSha = await sha(normalized);\n const rs = await sqlite.execute({\n sql:`SELECT s.pairing_id,s.client_label,s.issued_at,s.expires_at,s.approved_at,s.delivered_at,\n x.bootstrap_script_sha256,x.acceptance_lane,x.challenge_message_id,x.challenge_message_sha256\n FROM device_pairing_sessions s\n LEFT JOIN device_pairing_contracts x ON x.pairing_id=s.pairing_id\n WHERE s.user_code_sha256=? LIMIT 1`,\n args:[userSha]\n });\n if (!rs.rows.length) return c.json({error:\"DEVICE_PAIRING_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n const contractOk =\n String(row.bootstrap_script_sha256 || \"\") === R11_BOOTSTRAP_SHA256 &&\n String(row.acceptance_lane || \"\") === DEVICE_ACCESS_LANE &&\n String(row.challenge_message_id || \"\") === R11_CHALLENGE_ID &&\n String(row.challenge_message_sha256 || \"\") === R11_CHALLENGE_SHA256;\n const expired = String(row.expires_at) <= new Date().toISOString();\n return c.json({\n schema:\"rumbo-codex-device-pairing-inspection/v2\",\n pairing_id:row.pairing_id,\n client_label:row.client_label,\n issued_at:row.issued_at,\n expires_at:row.expires_at,\n expired,\n approved:!!row.approved_at,\n token_delivered:!!row.delivered_at,\n contract_ok:contractOk,\n contract:{\n bootstrap_script_sha256:row.bootstrap_script_sha256,\n acceptance_lane:row.acceptance_lane,\n challenge_message_id:row.challenge_message_id,\n challenge_message_sha256:row.challenge_message_sha256\n },\n approval_requires_expected_pairing_id:true,\n approval_requires_exact_contract:true,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/pair/codex/device/approve\", async (c) => {\n const actor = await roleFrom(c.req.raw);\n if (actor !== \"gpt\" && actor !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const normalized = normalizeUserCode(b.user_code);\n if (normalized.length !== 8 || [...normalized].some(ch => !DEVICE_USER_CODE_ALPHABET.includes(ch))) {\n return c.json({error:\"INVALID_USER_CODE\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const expectedPairingId = String(b.expected_pairing_id || \"\");\n if (!/^[0-9a-f-]{36}$/.test(expectedPairingId)) return c.json({error:\"EXPECTED_PAIRING_ID_REQUIRED\"},400,{\"Cache-Control\":\"no-store\"});\n const userSha = await sha(normalized);\n const rs = await sqlite.execute({\n sql:`SELECT s.pairing_id,s.device_code_sha256,s.client_label,s.issued_at,s.expires_at,s.approved_at,s.approved_by,\n x.bootstrap_script_sha256,x.acceptance_lane,x.challenge_message_id,x.challenge_message_sha256\n FROM device_pairing_sessions s\n LEFT JOIN device_pairing_contracts x ON x.pairing_id=s.pairing_id\n WHERE s.user_code_sha256=? LIMIT 1`,\n args:[userSha]\n });\n if (!rs.rows.length) return c.json({error:\"DEVICE_PAIRING_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (String(row.pairing_id) !== expectedPairingId) return c.json({error:\"PAIRING_ID_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n const contractOk =\n String(row.bootstrap_script_sha256 || \"\") === R11_BOOTSTRAP_SHA256 &&\n String(row.acceptance_lane || \"\") === DEVICE_ACCESS_LANE &&\n String(row.challenge_message_id || \"\") === R11_CHALLENGE_ID &&\n String(row.challenge_message_sha256 || \"\") === R11_CHALLENGE_SHA256;\n if (!contractOk) {\n return c.json({error:\"PAIRING_CONTRACT_NOT_ACTIVE\",pairing_id:row.pairing_id,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n const nowIso = new Date().toISOString();\n if (String(row.expires_at) <= nowIso) return c.json({error:\"DEVICE_PAIRING_EXPIRED\"},410,{\"Cache-Control\":\"no-store\"});\n if (row.approved_at) {\n return c.json({approved:true,idempotent:true,pairing_id:row.pairing_id,expires_at:row.expires_at,contract_ok:true,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE device_pairing_sessions SET approved_at=?,approved_by=? WHERE pairing_id=? AND approved_at IS NULL AND expires_at>?\",\n args:[nowIso,actor,String(row.pairing_id),nowIso]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"DEVICE_PAIRING_APPROVAL_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n try {\n await audit(\"CODEX_DEVICE_PAIRING_APPROVED\",actor,DEVICE_ACCESS_LANE,String(row.pairing_id),String(row.device_code_sha256));\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE device_pairing_sessions SET approved_at=NULL,approved_by=NULL WHERE pairing_id=? AND approved_at=? AND delivered_at IS NULL\",\n args:[String(row.pairing_id),nowIso]\n });\n throw e;\n }\n return c.json({\n approved:true,idempotent:false,pairing_id:row.pairing_id,expires_at:row.expires_at,contract_ok:true,\n next:\"The local device may continue polling. Approval does not itself issue an acceptance ACK.\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/pair/codex/device/revoke\", async (c) => {\n const auth = await authFrom(c.req.raw);\n if (!auth) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const actor = auth.role;\n try {\n const b = await bodyJson(c);\n const pairingId = String(b.pairing_id || \"\");\n if (!/^[0-9a-f-]{36}$/.test(pairingId)) return c.json({error:\"INVALID_PAIRING_ID\"},400,{\"Cache-Control\":\"no-store\"});\n if (auth.kind === \"device\" && auth.pairing_id !== pairingId) return c.json({error:\"DEVICE_TOKEN_SELF_REVOKE_SCOPE_VIOLATION\"},403,{\"Cache-Control\":\"no-store\"});\n if (auth.kind !== \"device\" && actor !== \"gpt\" && actor !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute({\n sql:\"SELECT token_sha256,revoked_at,expires_at FROM device_access_tokens WHERE pairing_id=? LIMIT 1\",\n args:[pairingId]\n });\n if (!rs.rows.length) return c.json({error:\"DEVICE_ACCESS_TOKEN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (row.revoked_at) return c.json({revoked:true,idempotent:true,pairing_id:pairingId,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n const revokedAt = new Date().toISOString();\n const updated:any = await sqlite.execute({\n sql:\"UPDATE device_access_tokens SET revoked_at=? WHERE pairing_id=? AND revoked_at IS NULL\",\n args:[revokedAt,pairingId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"DEVICE_ACCESS_TOKEN_REVOKE_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n try {\n await audit(\"CODEX_DEVICE_ACCESS_TOKEN_REVOKED\",actor,DEVICE_ACCESS_LANE,pairingId,String(row.token_sha256));\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE device_access_tokens SET revoked_at=NULL WHERE pairing_id=? AND revoked_at=?\",\n args:[pairingId,revokedAt]\n });\n throw e;\n }\n return c.json({revoked:true,idempotent:false,pairing_id:pairingId,revoked_at:revokedAt,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/pair/codex/device/poll\", async (c) => {\n try {\n const b = await bodyJson(c);\n const deviceCode = String(b.device_code || \"\");\n if (!/^[A-Za-z0-9_-]{43}$/.test(deviceCode)) return c.json({error:\"INVALID_DEVICE_CODE\"},400,{\"Cache-Control\":\"no-store\"});\n const deviceSha = await sha(deviceCode);\n const rs = await sqlite.execute({\n sql:`SELECT s.pairing_id,s.device_code_sha256,s.expires_at,s.approved_at,s.approved_by,s.delivered_at,s.client_label,\n x.bootstrap_script_sha256,x.acceptance_lane,x.challenge_message_id,x.challenge_message_sha256\n FROM device_pairing_sessions s\n LEFT JOIN device_pairing_contracts x ON x.pairing_id=s.pairing_id\n WHERE s.device_code_sha256=? LIMIT 1`,\n args:[deviceSha]\n });\n if (!rs.rows.length) return c.json({error:\"DEVICE_PAIRING_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const d:any = rs.rows[0];\n const contractOk =\n String(d.bootstrap_script_sha256 || \"\") === R11_BOOTSTRAP_SHA256 &&\n String(d.acceptance_lane || \"\") === DEVICE_ACCESS_LANE &&\n String(d.challenge_message_id || \"\") === R11_CHALLENGE_ID &&\n String(d.challenge_message_sha256 || \"\") === R11_CHALLENGE_SHA256;\n if (!contractOk) return c.json({error:\"PAIRING_CONTRACT_NOT_ACTIVE\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const now = new Date();\n const nowIso = now.toISOString();\n if (String(d.expires_at) <= nowIso) return c.json({error:\"DEVICE_PAIRING_EXPIRED\"},410,{\"Cache-Control\":\"no-store\"});\n if (!d.approved_at) return c.json({authorized:false,status:\"PENDING_APPROVAL\",retry_after_seconds:2,production_go:false},202,{\"Cache-Control\":\"no-store\"});\n\n const pairingId = String(d.pairing_id);\n const accessToken = await deriveDeviceAccessToken(pairingId,deviceSha);\n const tokenSha = await sha(accessToken);\n const accessExpiresAt = new Date(now.getTime()+DEVICE_ACCESS_TOKEN_TTL_MS).toISOString();\n let effectiveAccessExpiresAt = accessExpiresAt;\n const existing = await sqlite.execute({\n sql:\"SELECT token_sha256,lane_scope,issued_at,expires_at,revoked_at FROM device_access_tokens WHERE pairing_id=? LIMIT 1\",\n args:[pairingId]\n });\n let tokenDelivery = \"REDELIVERED_ACTIVE\";\n if (!existing.rows.length) {\n await sqlite.execute({\n sql:\"INSERT INTO device_access_tokens(token_sha256,pairing_id,lane_scope,issued_at,expires_at) VALUES(?,?,?,?,?)\",\n args:[tokenSha,pairingId,DEVICE_ACCESS_LANE,nowIso,accessExpiresAt]\n });\n try {\n await audit(\"CODEX_DEVICE_ACCESS_TOKEN_ISSUED\",\"codex\",DEVICE_ACCESS_LANE,pairingId,tokenSha);\n } catch (e) {\n await sqlite.execute({\n sql:\"DELETE FROM device_access_tokens WHERE pairing_id=? AND token_sha256=? AND revoked_at IS NULL\",\n args:[pairingId,tokenSha]\n });\n throw e;\n }\n tokenDelivery = \"ISSUED_NEW\";\n } else {\n const row:any = existing.rows[0];\n if (String(row.token_sha256)!==tokenSha || String(row.lane_scope)!==DEVICE_ACCESS_LANE) return c.json({error:\"DEVICE_ACCESS_TOKEN_BINDING_MISMATCH\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n if (row.revoked_at) return c.json({error:\"DEVICE_ACCESS_TOKEN_REVOKED\",production_go:false},410,{\"Cache-Control\":\"no-store\"});\n if (String(row.expires_at) <= nowIso) {\n const oldIssuedAt = String(row.issued_at || \"\");\n const oldExpiresAt = String(row.expires_at || \"\");\n await sqlite.execute({\n sql:\"UPDATE device_access_tokens SET issued_at=?,expires_at=? WHERE pairing_id=? AND revoked_at IS NULL\",\n args:[nowIso,accessExpiresAt,pairingId]\n });\n try {\n await audit(\"CODEX_DEVICE_ACCESS_TOKEN_REISSUED\",\"codex\",DEVICE_ACCESS_LANE,pairingId,tokenSha);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE device_access_tokens SET issued_at=?,expires_at=? WHERE pairing_id=? AND issued_at=? AND expires_at=? AND revoked_at IS NULL\",\n args:[oldIssuedAt,oldExpiresAt,pairingId,nowIso,accessExpiresAt]\n });\n throw e;\n }\n tokenDelivery = \"REISSUED_EXPIRED\";\n } else {\n effectiveAccessExpiresAt = String(row.expires_at);\n }\n }\n\n if (!d.delivered_at) {\n const deliveredAt = new Date().toISOString();\n const updated:any = await sqlite.execute({\n sql:\"UPDATE device_pairing_sessions SET delivered_at=? WHERE pairing_id=? AND delivered_at IS NULL\",\n args:[deliveredAt,pairingId]\n });\n if (Number(updated?.rowsAffected ?? 0) === 1) {\n try {\n await audit(\"CODEX_DEVICE_PAIRING_TOKEN_DELIVERED\",\"codex\",DEVICE_ACCESS_LANE,pairingId,tokenSha);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE device_pairing_sessions SET delivered_at=NULL WHERE pairing_id=? AND delivered_at=?\",\n args:[pairingId,deliveredAt]\n });\n throw e;\n }\n }\n }\n\n return c.json({\n schema:\"rumbo-codex-device-pairing/v3\",\n authorized:true,\n role:\"codex\",\n token_type:\"Bearer\",\n token:accessToken,\n pairing_id:pairingId,\n device_pairing_session_id:pairingId,\n pairing_delivery:tokenDelivery,\n access_token_expires_at:effectiveAccessExpiresAt,\n lane_scope:DEVICE_ACCESS_LANE,\n confirmed:true,\n contract_ok:true,\n contract:{\n bootstrap_script_sha256:String(d.bootstrap_script_sha256),\n acceptance_lane:String(d.acceptance_lane),\n challenge_message_id:String(d.challenge_message_id),\n challenge_message_sha256:String(d.challenge_message_sha256)\n },\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/pair/codex\", async (c) => {\n return c.json({\n error:\"STATIC_PAIRING_DEPRECATED_USE_DEVICE_FLOW\",\n replacement_start_path:\"/v1/pair/codex/device/start\",\n replacement_poll_path:\"/v1/pair/codex/device/poll\",\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/pair/codex/confirm\", async (c) => {\n return c.json({\n error:\"LEGACY_CONFIRM_DEPRECATED_DEVICE_TOKEN_IS_ALREADY_SCOPED\",\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/bootstrap/codex-device/metadata\", (c) => {\n return c.json({\n schema:\"rumbo-codex-device-bootstrap/v5\",\n implementation_revision:\"R11-EXACT-SINGLE-COMMAND-PROBE\",\n launcher_path:\"/v1/bootstrap/codex-device.py\",\n launcher_sha256:R11_BOOTSTRAP_SHA256,\n launcher_bytes:R11_BOOTSTRAP_BYTES,\n launcher_version:\"7.2\",\n windows_launcher_path:\"/v1/bootstrap/codex-device.ps1\",\n windows_launcher_sha256:R11_WINDOWS_PS1_SHA256,\n windows_launcher_bytes:R11_WINDOWS_PS1_BYTES,\n python_minimum:\"3.11\",\n canonical_release:\"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n canonical_release_sha256:\"cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b\",\n canonical_skill_sha256:\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n plugin_name:\"rumbo-gpt-codex-continuity\",\n plugin_version:R11_PLUGIN_VERSION,\n plugin_manifest_sha256:R11_PLUGIN_MANIFEST_SHA256,\n acceptance_lane:DEVICE_ACCESS_LANE,\n challenge_kind:\"runtime_acceptance_challenge_v6\",\n challenge_message_id:R11_CHALLENGE_ID,\n challenge_message_sha256:R11_CHALLENGE_SHA256,\n acceptance_not_after_utc:R11_ACCEPTANCE_NOT_AFTER_UTC,\n security_boundary:{\n embedded_credentials:false,\n device_code_secret_delivered_only_after_gpt_or_admin_approval:true,\n preapproval_inspection_path:\"/v1/pair/codex/device/inspect\",\n approval_requires_expected_pairing_id:true,\n pairing_contract_inspection_required:true,\n device_pairing_contract_required:true,\n device_inbox_disabled:true,\n device_ack_target_restricted_to_runtime_challenge:true,\n authenticated_device_message_provenance_required:true,\n authenticated_device_ack_provenance_required:true,\n device_idempotency_provenance_required:true,\n ack_response_same_authenticated_device_required:true,\n idempotent_audit_recovery:true,\n per_device_scoped_bearer:true,\n shared_codex_bearer_accepted:false,\n device_token_lane_scope:DEVICE_ACCESS_LANE,\n device_token_ttl_seconds:Math.floor(DEVICE_ACCESS_TOKEN_TTL_MS/1000),\n device_token_effective_ttl_enforced:true,\n device_token_self_revoke_required:true,\n device_token_failure_revoke_required:true,\n challenge_fetch_includes_acked:true,\n expired_device_token_counts_inactive:true,\n bounded_response_network_retry:true,\n device_message_kind_restricted:true,\n device_base_revision_restricted:true,\n actual_codex_exec_required:true,\n codex_exec_timeout_seconds:90,\n codex_exec_ephemeral:true,\n codex_exec_sandbox:\"read-only\",\n approval_policy_never_required:true,\n isolated_codex_home_required:true,\n auth_source_regular_file_copy_required:true,\n ignore_user_config_required:true,\n ignore_rules_required:true,\n user_config_inherited:false,\n project_config_inherited:false,\n global_agents_md_inherited:false,\n shell_environment_inherit:\"core\",\n shell_environment_default_sensitive_excludes:true,\n shell_environment_codex_home_inherited:false,\n shell_environment_openai_sensitive_vars_inherited:false,\n shell_environment_probe_required:true,\n env_probe_script_sha256:\"8dff8e38c986fabdea627183745fb643bfbcb8c9262e915f6d1f8447d90a2f72\",\n exact_single_shell_command_required:true,\n exact_probe_wrapper_command_required:true,\n additional_shell_commands_forbidden:true,\n collab_tools_forbidden:true,\n dangerous_bypass_forbidden:true,\n model_override_forbidden:true,\n exact_runtime_output_hashes_required:true,\n local_random_file_probe_required:true,\n completed_command_execution_required:true,\n command_output_must_bind_probe_manifest_and_skill_hashes:true,\n prohibited_item_types:[\"file_change\",\"web_search\",\"mcp_tool_call\",\"collab_tool_call\"],\n skill_md_sha256:\"224197fb56be75ae395fb2e4e2eb48f3bd64d1e187df5799fd6d661e4d1ec09f\",\n final_chatgpt_ack_required:true,\n production_go:false\n },\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/bootstrap/codex-device.py\", async (c) => {\n const observed = await sha(R11_BOOTSTRAP_PY);\n if (observed !== R11_BOOTSTRAP_SHA256 || new TextEncoder().encode(R11_BOOTSTRAP_PY).length !== R11_BOOTSTRAP_BYTES) {\n return c.json({error:\"BOOTSTRAP_HASH_OR_SIZE_MISMATCH\",observed,production_go:false},500,{\"Cache-Control\":\"no-store\"});\n }\n return new Response(R11_BOOTSTRAP_PY,{\n status:200,\n headers:{\n \"Content-Type\":\"text/x-python; charset=utf-8\",\n \"Content-Disposition\":\"attachment; filename=codex_device_bootstrap_r11_v6.py\",\n \"X-SHA256\":R11_BOOTSTRAP_SHA256,\n \"Cache-Control\":\"no-store\"\n }\n });\n});\n\napp.get(\"/v1/bootstrap/codex-device.ps1\", async (c) => {\n const observed = await sha(R11_WINDOWS_PS1);\n if (observed !== R11_WINDOWS_PS1_SHA256 || new TextEncoder().encode(R11_WINDOWS_PS1).length !== R11_WINDOWS_PS1_BYTES) {\n return c.json({error:\"WINDOWS_LAUNCHER_HASH_OR_SIZE_MISMATCH\",observed,production_go:false},500,{\"Cache-Control\":\"no-store\"});\n }\n return new Response(R11_WINDOWS_PS1,{\n status:200,\n headers:{\n \"Content-Type\":\"text/plain; charset=utf-8\",\n \"Content-Disposition\":\"attachment; filename=RUN_RUMBO_CODEX_R11.ps1\",\n \"X-SHA256\":R11_WINDOWS_PS1_SHA256,\n \"Cache-Control\":\"no-store\"\n }\n });\n});\n\napp.get(\"/v1/bootstrap/skill/metadata\", async (c) => {\n const role = await roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n return c.json({\n release:\"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n protocol:\"gpt-codex-context-bridge/v2\",\n skill_name:\"gpt-codex-context-bridge\",\n skill_zip_sha256:\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n encoding:\"binary/zip\",\n source_blob:\"bridge/v1.6/gpt-codex-context-bridge-skill.zip.b64\",\n claim_boundary:\"Skill bytes are canonical V1.6 bytes; installing/running them in the user's real Codex runtime remains a separate acceptance gate.\"\n });\n});\n\napp.get(\"/v1/bootstrap/skill\", async (c) => {\n const role = await roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n const res = await blob.get(\"bridge/v1.6/gpt-codex-context-bridge-skill.zip.b64\");\n const b64 = await res.text();\n const raw = Uint8Array.from(atob(b64), ch => ch.charCodeAt(0));\n return new Response(raw, {\n status:200,\n headers:{\n \"Content-Type\":\"application/zip\",\n \"Content-Disposition\":\"attachment; filename=gpt-codex-context-bridge.zip\",\n \"X-SHA256\":\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n \"Cache-Control\":\"no-store\"\n }\n });\n});\n\napp.onError((err,c) => { console.error(err); return c.json({error:\"INTERNAL_ERROR\"},500); });\nexport default app.fetch;\n","deleted",false,"label",[14],"ea8b2cee-9441-4610-a164-e736539c861b",["D",1787964475423],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Durable GPT-Codex continuity relay","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","ea8b2cee94414610a164e736539c861b","tursoHostname","ea8b2cee94414610a164e736539c861b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789531243171],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",234,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":62,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]