[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","sebas1","name","rumbo-r2-authorizer","path","main.tsx","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/sebas1/rumbo-r2-authorizer/code/main.tsx","extension","id","cdb2b37f-2322-4c4d-867b-3720afeddb46","fileId","da1a7e96-a35a-11f1-816f-1607ee4eb77e","parentId","branchId","3bec92a5-228b-4d7e-8a94-d7a3be5df58e","branchVersion",17,"latest",true,"createdAt",["D",1787988808749],"version",9,"fileType","http","content","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\n\nconst IMPLEMENTATION = \"DEDICATED_R2_AUTHORIZER_V3_6_OBSERVER_JOURNAL_PINNED\";\nconst OBSERVER_IMPLEMENTATION = \"R2_GITHUB_OBSERVER_V1_6_DURABLE_REOBSERVATION_JOURNAL\";\nconst BROKER_IMPLEMENTATION = \"R2_GITHUB_APP_CUSTODY_BROKER_V1_3_OBSERVER_JOURNAL_PINNED\";\nconst SIGNING_KEY_ID = \"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\";\nconst OBSERVER_SIGNING_KEY_ID = \"aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8\";\nconst OBSERVER_VERIFY_JWK: JsonWebKey = {\n kty:\"EC\",crv:\"P-256\",\n x:\"lYPzwJFKYb5YZsikYx57Wr6TfkwwNyog15s0BN_p8fA\",\n y:\"9bVfI4jPqeN-yt2KQjz9MgmsDjLpbqzs1pw1DcgPwHQ\",\n key_ops:[\"verify\"],ext:true\n};\nconst OBSERVER_REPO_FULL = \"fscfede-beep/rumbo-control-queue\";\nconst OBSERVER_REPOSITORY_ID = 1314199389;\nconst OBSERVER_OWNER_ID = 293577326;\nconst MAX_OBSERVER_ISSUE_AGE_SECONDS = 300;\nconst MAX_OBSERVER_CONSUME_AGE_SECONDS = 600;\nconst RECEIPT_VERIFY_JWK = {\n kty:\"EC\",crv:\"P-256\",\n x:\"TV0M-YRfRzqMB6dTZIhLOu7w21Tkgul-lUns7HwpHy4\",\n y:\"mRWAIOykqSBgsAXqC9t3OOmk3KLljPH935lilXma-W4\",\n key_ops:[\"verify\"],ext:true\n};\nconst REPOSITORY_IDENTITY_SHA256 = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst CONTROL_PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst SHA256_RE = /^[a-f0-9]{64}$/;\nconst GIT_SHA_RE = /^[a-f0-9]{40}$/;\nconst MAX_BODY_BYTES = 64 * 1024;\nconst MIN_TTL_SECONDS = 60;\nconst MAX_TTL_SECONDS = 900;\n\ntype GuardAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype Binding = {\n action: GuardAction;\n repository_identity_sha256: string;\n pr_number: number;\n base_sha: string;\n head_sha: string;\n package_sha256: string;\n evidence_sha256: string;\n};\n\ntype ObserverVerification = {\n ok: boolean;\n error?: string;\n receipt_sha256?: string;\n observed_at?: string;\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS authorizations (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_authorizations_status ON authorizations(status,expires_at)`,\n `CREATE TABLE IF NOT EXISTS authorizations_v3 (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n observer_receipt_sha256 TEXT,\n observer_observed_at TEXT,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_authorizations_v3_status ON authorizations_v3(status,expires_at)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_authorizations_v3_observer\n ON authorizations_v3(observer_receipt_sha256)\n WHERE observer_receipt_sha256 IS NOT NULL`,\n `CREATE TABLE IF NOT EXISTS audit_events (\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n authorization_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_unique ON audit_events(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_event_object_unique\n ON audit_events(event_type,authorization_id)\n WHERE authorization_id IS NOT NULL`\n]);\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n const aa = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < aa.length; i++) diff |= aa[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction authorized(req: Request): boolean {\n const expected = Deno.env.get(\"R2_AUTH_ROOT_TOKEN\") || \"\";\n const observed = bearer(req);\n return !!expected && !!observed && constantTimeEqual(expected, observed);\n}\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k) + \":\" + canonical(o[k])).join(\",\") + \"}\";\n}\n\nasync function sha256(s: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(digest)].map(x => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction b64url(bytes: Uint8Array): string {\n const binary = Array.from(bytes, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\n\nfunction b64urlDecode(s:string):Uint8Array {\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\n\nasync function verifyObserverReceipt(v:any,binding:Binding,maxAgeSeconds:number):Promise {\n if(!v||typeof v!==\"object\")return {ok:false,error:\"OBSERVER_RECEIPT_MISSING\"};\n if(v.schema!==\"rumbo-r2-github-observer-receipt/v1\")return {ok:false,error:\"OBSERVER_SCHEMA_INVALID\"};\n if(v.observer_implementation!==OBSERVER_IMPLEMENTATION)return {ok:false,error:\"OBSERVER_IMPLEMENTATION_MISMATCH\"};\n if(v.broker_implementation!==BROKER_IMPLEMENTATION)return {ok:false,error:\"BROKER_IMPLEMENTATION_MISMATCH\"};\n if(v.authoritative_for!==\"R2_GITHUB_PR_SNAPSHOT_ONLY\")return {ok:false,error:\"OBSERVER_AUTHORITY_SCOPE_INVALID\"};\n if(v.invocation_mode!==\"ROOT\"&&v.invocation_mode!==\"BROKER_AUTOPILOT\")return {ok:false,error:\"OBSERVER_INVOCATION_MODE_INVALID\"};\n if(v.production_go!==false)return {ok:false,error:\"OBSERVER_PRODUCTION_GO_INVALID\"};\n if(v.repository?.full_name!==OBSERVER_REPO_FULL||\n Number(v.repository?.id)!==OBSERVER_REPOSITORY_ID||\n Number(v.repository?.owner_id)!==OBSERVER_OWNER_ID){\n return {ok:false,error:\"OBSERVER_REPOSITORY_IDENTITY_MISMATCH\"};\n }\n if(Number(v.pr_number)!==binding.pr_number||\n String(v.base_sha)!==binding.base_sha||\n String(v.head_sha)!==binding.head_sha||\n String(v.package_sha256)!==binding.package_sha256){\n return {ok:false,error:\"OBSERVER_BINDING_MISMATCH\"};\n }\n if(v.observation_status!==\"OBSERVATION_PASS\"||Number(v.blocking_count)!==0){\n return {ok:false,error:\"OBSERVER_NOT_PASS\"};\n }\n if(v.native_enforcement?.proven!==true||v.merge_ready!==true){\n return {ok:false,error:\"OBSERVER_NATIVE_ENFORCEMENT_NOT_PROVEN\"};\n }\n const observedAt=String(v.observed_at||\"\");\n const observedMs=Date.parse(observedAt);\n const ageSeconds=(Date.now()-observedMs)/1000;\n if(!Number.isFinite(ageSeconds)||ageSeconds< -60||ageSeconds>maxAgeSeconds){\n return {ok:false,error:\"OBSERVER_RECEIPT_STALE\"};\n }\n if(!SHA256_RE.test(String(v.receipt_sha256||\"\"))){\n return {ok:false,error:\"OBSERVER_RECEIPT_HASH_INVALID\"};\n }\n if(v.receipt_signature?.alg!==\"ES256\"||\n v.receipt_signature?.kid!==OBSERVER_SIGNING_KEY_ID||\n !/^[A-Za-z0-9_-]{80,128}$/.test(String(v.receipt_signature?.signature_b64url||\"\"))){\n return {ok:false,error:\"OBSERVER_SIGNATURE_METADATA_INVALID\"};\n }\n\n const {receipt_sha256,receipt_signature,...unsigned}=v;\n const canon=canonical(unsigned);\n const computed=await sha256(canon);\n if(!constantTimeEqual(computed,String(receipt_sha256))){\n return {ok:false,error:\"OBSERVER_RECEIPT_HASH_MISMATCH\"};\n }\n let key:CryptoKey;\n try{\n key=await crypto.subtle.importKey(\"jwk\",OBSERVER_VERIFY_JWK,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n }catch{\n return {ok:false,error:\"OBSERVER_VERIFY_KEY_IMPORT_FAILED\"};\n }\n let sig:Uint8Array;\n try{sig=b64urlDecode(String(receipt_signature.signature_b64url));}\n catch{return {ok:false,error:\"OBSERVER_SIGNATURE_ENCODING_INVALID\"};}\n const verified=await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},key,sig,new TextEncoder().encode(canon)\n );\n if(!verified)return {ok:false,error:\"OBSERVER_SIGNATURE_INVALID\"};\n if(binding.evidence_sha256!==String(receipt_sha256)){\n return {ok:false,error:\"EVIDENCE_MUST_EQUAL_OBSERVER_RECEIPT_SHA256\"};\n }\n return {ok:true,receipt_sha256:String(receipt_sha256),observed_at:observedAt};\n}\n\nasync function signCanonicalReceipt(canonicalReceipt: string): Promise {\n const raw = Deno.env.get(\"R2_RECEIPT_SIGNING_JWK_V1\") || \"\";\n if (!raw) throw new Error(\"RECEIPT_SIGNING_KEY_NOT_CONFIGURED\");\n const jwk = JSON.parse(raw);\n const key = await crypto.subtle.importKey(\n \"jwk\", jwk, {name:\"ECDSA\",namedCurve:\"P-256\"}, false, [\"sign\"]\n );\n const signature = await crypto.subtle.sign(\n {name:\"ECDSA\",hash:\"SHA-256\"}, key, new TextEncoder().encode(canonicalReceipt)\n );\n return b64url(new Uint8Array(signature));\n}\n\nfunction randomToken(bytes = 32): string {\n const raw = new Uint8Array(bytes);\n crypto.getRandomValues(raw);\n const binary = Array.from(raw, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\nasync function bodyJson(c: any): Promise {\n const len = Number(c.req.header(\"content-length\") || \"0\");\n if (Number.isFinite(len) && len > MAX_BODY_BYTES) throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt = await c.req.text();\n if (new TextEncoder().encode(txt).length > MAX_BODY_BYTES) throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt || \"{}\");\n}\n\nfunction parseBinding(v: any): Binding | null {\n const action = String(v?.action || \"\") as GuardAction;\n const repository_identity_sha256 = String(v?.repository_identity_sha256 || \"\");\n const pr_number = Number(v?.pr_number);\n const base_sha = String(v?.base_sha || \"\");\n const head_sha = String(v?.head_sha || \"\");\n const package_sha256 = String(v?.package_sha256 || \"\");\n const evidence_sha256 = String(v?.evidence_sha256 || \"\");\n\n if (action !== \"TEST_ONLY\" && action !== \"MERGE_PR\") return null;\n if (repository_identity_sha256 !== REPOSITORY_IDENTITY_SHA256) return null;\n if (!Number.isSafeInteger(pr_number) || pr_number <= 0) return null;\n if (!GIT_SHA_RE.test(base_sha) || !GIT_SHA_RE.test(head_sha)) return null;\n if (package_sha256 !== CONTROL_PACKAGE_SHA256) return null;\n if (!SHA256_RE.test(evidence_sha256)) return null;\n\n return {action,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256};\n}\n\nasync function audit(event_type: string, authorization_id: string | null, object_sha256: string | null) {\n if (authorization_id) {\n const existing = await sqlite.execute({\n sql: \"SELECT event_sha256 FROM audit_events WHERE event_type=? AND authorization_id=? LIMIT 1\",\n args: [event_type, authorization_id]\n });\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n\n for (let attempt = 0; attempt < 8; attempt++) {\n const last = await sqlite.execute(\"SELECT event_sha256 FROM audit_events ORDER BY seq DESC LIMIT 1\");\n const prev = String(last.rows[0]?.event_sha256 || \"0\".repeat(64));\n const created_at = new Date().toISOString();\n const event = {event_type,authorization_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256 = await sha256(canonical(event));\n try {\n await sqlite.execute({\n sql: `INSERT INTO audit_events(event_type,authorization_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,\n args: [event_type,authorization_id,object_sha256,prev,event_sha256,created_at]\n });\n return event_sha256;\n } catch (e) {\n if (authorization_id) {\n const existing = await sqlite.execute({\n sql: \"SELECT event_sha256 FROM audit_events WHERE event_type=? AND authorization_id=? LIMIT 1\",\n args: [event_type, authorization_id]\n });\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\", (c) => c.json({\n service:\"rumbo-r2-authorizer\",\n implementation:IMPLEMENTATION,\n status:\"ok\",\n production_go:false\n}));\n\napp.get(\"/health\", (c) => c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_AUTH_ROOT_TOKEN\"),\n receipt_signing_key_configured:!!Deno.env.get(\"R2_RECEIPT_SIGNING_JWK_V1\"),\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KEY_ID,verify_jwk:RECEIPT_VERIFY_JWK},\n observer_trust_root:{\n implementation:OBSERVER_IMPLEMENTATION,\n broker_implementation:BROKER_IMPLEMENTATION,\n receipt_schema:\"rumbo-r2-github-observer-receipt/v1\",\n signing_kid:OBSERVER_SIGNING_KEY_ID,\n verify_jwk:OBSERVER_VERIFY_JWK,\n max_issue_age_seconds:MAX_OBSERVER_ISSUE_AGE_SECONDS,\n max_consume_age_seconds:MAX_OBSERVER_CONSUME_AGE_SECONDS,\n merge_requires_native_enforcement:true\n },\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n repository_identity_sha256:REPOSITORY_IDENTITY_SHA256,\n package_sha256:CONTROL_PACKAGE_SHA256,\n ttl_seconds:{min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},\n capabilities:[\n \"dedicated-external-authorizer\",\n \"exact-pr-binding\",\n \"one-time-token-ledger\",\n \"audit-hash-chain\",\n \"signed-consumption-receipts\",\n \"offline-public-key-verification\",\n \"signed-observer-receipt-verification\",\n \"native-enforcement-required-for-merge\",\n \"v1-merge-path-retired\",\n \"v3-observer-gated-merge\",\n \"fail-closed-merge-gate\"\n ],\n production_go:false\n}), 200, {\"Cache-Control\":\"no-store\"});\n\napp.post(\"/v1/authorize\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if (binding.action === \"MERGE_PR\") {\n return c.json({\n error:\"V1_MERGE_PATH_RETIRED_USE_V3_OBSERVER_GATED\",\n replacement:\"/v3/authorize\",\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < MIN_TTL_SECONDS || ttl > MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const request_sha256 = await sha256(canonical(binding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM authorizations WHERE request_sha256=? LIMIT 1\",\n args:[request_sha256]\n });\n if (prior.rows.length) {\n const row:any = prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const raw_token = randomToken();\n const token_sha256 = await sha256(raw_token);\n const authorization_id = crypto.randomUUID();\n const issued = new Date();\n const issued_at = issued.toISOString();\n const expires_at = new Date(issued.getTime() + ttl * 1000).toISOString();\n\n await sqlite.execute({\n sql:`INSERT INTO authorizations(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorization_id,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n request_sha256,token_sha256,issued_at,expires_at\n ]\n });\n\n try {\n await audit(\"AUTHORIZATION_ISSUED\",authorization_id,request_sha256);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n throw e;\n }\n\n return c.json({\n authorized:true,\n authorization_id,\n action:binding.action,\n request_sha256,\n token:raw_token,\n token_type:\"One-Time\",\n issued_at,\n expires_at,\n merge_authorized:binding.action === \"MERGE_PR\",\n production_go:false,\n note:\"Raw one-time token is returned only at issuance; only SHA-256 is persisted.\"\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/consume\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if (binding.action === \"MERGE_PR\") {\n return c.json({\n error:\"V1_MERGE_PATH_RETIRED_USE_V3_OBSERVER_GATED\",\n replacement:\"/v3/consume\",\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorization_id = String(b.authorization_id || \"\");\n const raw_token = String(b.token || \"\");\n const consumer = String(b.consumer || \"\");\n if (!authorization_id || !/^[A-Za-z0-9_-]{43,128}$/.test(raw_token)) {\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)) {\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const request_sha256 = await sha256(canonical(binding));\n const rs = await sqlite.execute({sql:\"SELECT * FROM authorizations WHERE authorization_id=? LIMIT 1\",args:[authorization_id]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status,authorization_id},409,{\"Cache-Control\":\"no-store\"});\n }\n if (!constantTimeEqual(String(row.request_sha256),request_sha256)) {\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const observed_token_sha256 = await sha256(raw_token);\n if (!constantTimeEqual(String(row.token_sha256),observed_token_sha256)) {\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumed_at = new Date().toISOString();\n const updated:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumed_at,consumer,authorization_id]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt = {\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v2\",\n authorization_id,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n request_sha256,\n consumed_at,\n consumer,\n merge_authorized:binding.action === \"MERGE_PR\",\n production_go:false\n };\n const receipt_canonical = canonical(receipt);\n const receipt_sha256 = await sha256(receipt_canonical);\n const receipt_signature_b64url = await signCanonicalReceipt(receipt_canonical);\n await audit(\"AUTHORIZATION_CONSUMED\",authorization_id,receipt_sha256);\n\n return c.json({\n ...receipt,\n consumed:true,\n receipt_sha256,\n receipt_signature:{\n alg:\"ES256\",\n kid:SIGNING_KEY_ID,\n signature_b64url:receipt_signature_b64url\n }\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/authorize\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n let observerReceiptSha:string|null=null;\n let observerObservedAt:string|null=null;\n\n if (binding.action === \"MERGE_PR\") {\n if (Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const verified = await verifyObserverReceipt(\n b.observer_receipt,\n binding,\n MAX_OBSERVER_ISSUE_AGE_SECONDS\n );\n if (!verified.ok) {\n return c.json({\n error:verified.error || \"OBSERVER_RECEIPT_INVALID\",\n production_go:false\n },403,{\"Cache-Control\":\"no-store\"});\n }\n observerReceiptSha=verified.receipt_sha256!;\n observerObservedAt=verified.observed_at!;\n } else if (b.observer_receipt !== undefined && b.observer_receipt !== null) {\n return c.json({error:\"TEST_ONLY_MUST_NOT_CARRY_OBSERVER_MERGE_RECEIPT\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < MIN_TTL_SECONDS || ttl > MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorityBinding = {...binding,observer_receipt_sha256:observerReceiptSha};\n const request_sha256 = await sha256(canonical(authorityBinding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM authorizations_v3 WHERE request_sha256=? LIMIT 1\",\n args:[request_sha256]\n });\n if (prior.rows.length) {\n const row:any=prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256,\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const raw_token=randomToken();\n const token_sha256=await sha256(raw_token);\n const authorization_id=crypto.randomUUID();\n const issued=new Date();\n const issued_at=issued.toISOString();\n const expires_at=new Date(issued.getTime()+ttl*1000).toISOString();\n\n await sqlite.execute({\n sql:`INSERT INTO authorizations_v3(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,observer_receipt_sha256,observer_observed_at,\n request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorization_id,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n observerReceiptSha,observerObservedAt,request_sha256,token_sha256,issued_at,expires_at\n ]\n });\n\n try {\n await audit(\"V3_AUTHORIZATION_ISSUED\",authorization_id,request_sha256);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n throw e;\n }\n\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-issuance/v3.6\",\n authorizer_implementation:IMPLEMENTATION,\n authorized:true,\n authorization_id,\n action:binding.action,\n request_sha256,\n observer_receipt_sha256:observerReceiptSha,\n token:raw_token,\n token_type:\"One-Time\",\n issued_at,\n expires_at,\n merge_authorized:binding.action===\"MERGE_PR\",\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/consume\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b=await bodyJson(c);\n const binding=parseBinding(b);\n if(!binding)return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if(binding.action===\"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\")!==\"true\"){\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorization_id=String(b.authorization_id||\"\");\n const raw_token=String(b.token||\"\");\n const consumer=String(b.consumer||\"\");\n const suppliedObserverSha=b.observer_receipt_sha256===null||b.observer_receipt_sha256===undefined\n ? null : String(b.observer_receipt_sha256);\n\n if(!authorization_id||!/^[A-Za-z0-9_-]{43,128}$/.test(raw_token)){\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if(!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)){\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if(suppliedObserverSha!==null&&!SHA256_RE.test(suppliedObserverSha)){\n return c.json({error:\"INVALID_OBSERVER_RECEIPT_SHA256\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorityBinding={...binding,observer_receipt_sha256:suppliedObserverSha};\n const request_sha256=await sha256(canonical(authorityBinding));\n const rs=await sqlite.execute({\n sql:\"SELECT * FROM authorizations_v3 WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if(!rs.rows.length)return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n\n if(String(row.status)===\"ISSUED\" && Date.parse(String(row.expires_at))<=Date.now()){\n const expired:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(expired?.rowsAffected??0)===1){\n await audit(\"V3_AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if(String(row.status)!==\"ISSUED\"){\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status,authorization_id},409,{\"Cache-Control\":\"no-store\"});\n }\n if(!constantTimeEqual(String(row.request_sha256),request_sha256)){\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const rowObserver=row.observer_receipt_sha256===null?null:String(row.observer_receipt_sha256);\n if(rowObserver!==suppliedObserverSha){\n return c.json({error:\"OBSERVER_RECEIPT_BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n if(binding.action===\"MERGE_PR\"){\n if(!rowObserver||!row.observer_observed_at){\n return c.json({error:\"OBSERVER_RECEIPT_REQUIRED\"},409,{\"Cache-Control\":\"no-store\"});\n }\n const observerAge=(Date.now()-Date.parse(String(row.observer_observed_at)))/1000;\n if(!Number.isFinite(observerAge)||observerAge< -60||observerAge>MAX_OBSERVER_CONSUME_AGE_SECONDS){\n return c.json({\n error:\"OBSERVER_RECEIPT_STALE_AT_CONSUME\",\n max_age_seconds:MAX_OBSERVER_CONSUME_AGE_SECONDS,\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n }\n\n const observed_token_sha256=await sha256(raw_token);\n if(!constantTimeEqual(String(row.token_sha256),observed_token_sha256)){\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumed_at=new Date().toISOString();\n const updated:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumed_at,consumer,authorization_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt={\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.6\",\n authorizer_implementation:IMPLEMENTATION,\n authorization_id,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n observer_receipt_sha256:rowObserver,\n request_sha256,\n consumed_at,\n consumer,\n merge_authorized:binding.action===\"MERGE_PR\",\n production_go:false\n };\n const canon=canonical(receipt);\n const receipt_sha256=await sha256(canon);\n const signature=await signCanonicalReceipt(canon);\n await audit(\"V3_AUTHORIZATION_CONSUMED\",authorization_id,receipt_sha256);\n\n return c.json({\n ...receipt,\n consumed:true,\n receipt_sha256,\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KEY_ID,signature_b64url:signature}\n },200,{\"Cache-Control\":\"no-store\"});\n } catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/revoke\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c);\n const authorization_id=String(b.authorization_id||\"\");\n if(!authorization_id)return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({\n sql:\"SELECT status,request_sha256,expires_at FROM authorizations_v3 WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if(!rs.rows.length)return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)===\"ISSUED\"&&Date.parse(String(row.expires_at))<=Date.now()){\n const expired:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(expired?.rowsAffected??0)===1){\n await audit(\"V3_AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if(String(row.status)!==\"ISSUED\"){\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"V3_AUTHORIZATION_REVOKED\",authorization_id,String(row.request_sha256));\n return c.json({revoked:true,authorization_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v3/ledger\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const now=new Date().toISOString();\n const rs=await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,observer_receipt_sha256,observer_observed_at,request_sha256,\n status,CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM authorizations_v3 ORDER BY issued_at DESC LIMIT 100`,\n args:[now]\n });\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-ledger/v3.6\",\n implementation:IMPLEMENTATION,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\")===\"true\",\n observer_gate_required_for_merge:true,\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/revoke\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const authorization_id = String(b.authorization_id || \"\");\n if (!authorization_id) return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n\n const rs = await sqlite.execute({\n sql:\"SELECT status,request_sha256,expires_at FROM authorizations WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const updated:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n\n await audit(\"AUTHORIZATION_REVOKED\",authorization_id,String(row.request_sha256));\n return c.json({revoked:true,authorization_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/ledger\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rawLimit = Number(c.req.query(\"limit\") || \"50\");\n const limit = Number.isSafeInteger(rawLimit) ? Math.max(1,Math.min(100,rawLimit)) : 50;\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM authorizations ORDER BY issued_at DESC LIMIT ?`,\n args:[now,limit]\n });\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-ledger/v1\",\n implementation:IMPLEMENTATION,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute(\"SELECT * FROM audit_events ORDER BY seq ASC\");\n let prev = \"0\".repeat(64);\n let ok = true;\n for (const r of rs.rows as any[]) {\n const event = {\n event_type:r.event_type,\n authorization_id:r.authorization_id,\n object_sha256:r.object_sha256,\n prev_event_sha256:r.prev_event_sha256,\n created_at:r.created_at\n };\n const computed = await sha256(canonical(event));\n if (String(r.prev_event_sha256) !== prev || String(r.event_sha256) !== computed) ok = false;\n prev = String(r.event_sha256);\n }\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-audit/v1\",\n audit_chain_ok:ok,\n count:rs.rows.length,\n tail_sha256:prev,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.onError((err,c) => {\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n","deleted",false,"label",[14],"c407813c-3b2b-489f-a186-e17f90eccf60",["D",1787974602620],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Dedicated fail-closed RUMBO R2 authorizer","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","c407813c3b2b489fa186e17f90eccf60","tursoHostname","c407813c3b2b489fa186e17f90eccf60-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789539031988],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",18,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":62,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]