[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","sebas1","name","rumbo-r2-deployer","path","main.tsx","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/sebas1/rumbo-r2-deployer/code/main.tsx","extension","id","0879033c-6236-4f41-a3d1-f665ab4d27a5","fileId","862fe8ba-a35b-11f1-8a2b-1607ee4eb77e","parentId","branchId","05a3146a-0d13-441a-b505-9ff526f70e96","branchVersion",19,"latest",true,"createdAt",["D",1787988935061],"version",10,"fileType","http","content","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app=new Hono();\n\nconst IMPLEMENTATION=\"R2_DEPLOYER_CONTROLLER_V3_7_OBSERVER_JOURNAL_PINNED\";\nconst GITHUB_BROKER_BASE=\"https://sebas1--cec0f0e4a36311f1a6461607ee4eb77e.web.val.run\";\nconst GITHUB_BROKER_IMPLEMENTATION=\"R2_GITHUB_APP_CUSTODY_BROKER_V1_3_OBSERVER_JOURNAL_PINNED\";\nconst REPO_OWNER=\"fscfede-beep\";\nconst REPO_NAME=\"rumbo-control-queue\";\nconst REPO_FULL=`${REPO_OWNER}/${REPO_NAME}`;\nconst REPOSITORY_ID=1314199389;\nconst OWNER_ID=293577326;\nconst DEFAULT_BRANCH=\"main\";\nconst REPO_IDENTITY_SHA256=\"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst PACKAGE_SHA256=\"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst DORMANT_R2_BRANCH=\"audit/continuity-r2-r4-reconciled-20260828\";\nconst R2_STATIC_PINS:Record={\n \".github/workflows/continuity-r2-observe.yml\":\"3d5dd465aad367cde5eabfff2ba7033865ceef8b\",\n \"tools/continuity-r2/EXPECTED_PACKAGE.json\":\"1260b3516219341c63107dca1cc1b21a1ecb9ba0\",\n \"tools/continuity-r2/snapshot_guard.py\":\"752f12df05d0b6b1bc122cbe61a3145458fdd074\"\n};\nconst R2_REQUIRED_DYNAMIC_FILES=[\n \"tools/continuity-r2/LIVE_STATE.json\",\n \"tools/continuity-r2/README.md\"\n];\nconst AUTHORIZER_IMPLEMENTATION=\"DEDICATED_R2_AUTHORIZER_V3_6_OBSERVER_JOURNAL_PINNED\";\nconst AUTHORIZER_SIGNING_KID=\"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\";\nconst AUTHORIZER_VERIFY_JWK:JsonWebKey={\n kty:\"EC\",crv:\"P-256\",\n x:\"TV0M-YRfRzqMB6dTZIhLOu7w21Tkgul-lUns7HwpHy4\",\n y:\"mRWAIOykqSBgsAXqC9t3OOmk3KLljPH935lilXma-W4\",\n key_ops:[\"verify\"],ext:true\n};\nconst API_VERSION=\"2026-03-10\";\nconst MAX_BODY=64*1024;\nconst MAX_EXEC_RECEIPT_AGE_SECONDS=900;\nconst MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS=300;\nconst SHA256_RE=/^[a-f0-9]{64}$/;\nconst GIT_SHA_RE=/^[a-f0-9]{40}$/;\nconst B64URL_RE=/^[A-Za-z0-9_-]{80,128}$/;\n\ntype AuthorizerAction=\"TEST_ONLY\"|\"MERGE_PR\";\ntype VerifiedReceipt={\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.6\";\n authorizer_implementation:string;\n authorization_id:string;\n action:AuthorizerAction;\n repository_identity_sha256:string;\n pr_number:number;\n base_sha:string;\n head_sha:string;\n package_sha256:string;\n evidence_sha256:string;\n observer_receipt_sha256:string|null;\n request_sha256:string;\n consumed_at:string;\n consumer:string;\n merge_authorized:boolean;\n production_go:false;\n consumed:true;\n receipt_sha256:string;\n receipt_signature:{alg:\"ES256\";kid:string;signature_b64url:string};\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS deploy_plans_v3(\n plan_id TEXT PRIMARY KEY,\n authorizer_action TEXT NOT NULL CHECK(authorizer_action IN ('TEST_ONLY','MERGE_PR')),\n authorizer_authorization_id TEXT NOT NULL UNIQUE,\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n observer_receipt_sha256 TEXT,\n authorizer_request_sha256 TEXT NOT NULL,\n authorizer_receipt_sha256 TEXT NOT NULL UNIQUE,\n authorizer_signature_kid TEXT NOT NULL,\n authorizer_consumed_at TEXT NOT NULL,\n authorizer_merge_authorized INTEGER NOT NULL CHECK(authorizer_merge_authorized IN (0,1)),\n request_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('PREPARED','CANCELLED','EXECUTED')),\n created_at TEXT NOT NULL,\n executed_at TEXT,\n provider_merge_sha TEXT,\n provider_main_readback_sha TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_deploy_plans_v3_status ON deploy_plans_v3(status,created_at)`,\n `CREATE TABLE IF NOT EXISTS deploy_audit_v3(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n plan_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v3_prev ON deploy_audit_v3(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v3_event_plan\n ON deploy_audit_v3(event_type,plan_id)\n WHERE plan_id IS NOT NULL`\n]);\n\nfunction bearer(req:Request):string{\n const h=req.headers.get(\"authorization\")||\"\";\n return h.startsWith(\"Bearer \")?h.slice(7):\"\";\n}\nfunction ct(a:string,b:string):boolean{\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0;for(let i=0;i{\n const expectedHash=Deno.env.get(\"R2_BROKER_JIT_AUTOPILOT_TOKEN_SHA256\")||\"\";\n const observed=bearer(req);\n if(!expectedHash||!observed)return false;\n const observedHash=await sha256(observed);\n return ct(expectedHash,observedHash);\n}\nasync function jitAuthorized(req:Request):Promise<\"ROOT\"|\"BROKER_AUTOPILOT\"|null>{\n if(authorized(req))return \"ROOT\";\n if(await brokerAutopilotAuthorized(req))return \"BROKER_AUTOPILOT\";\n return null;\n}\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nasync function bodyJson(c:any):Promise{\n const len=Number(c.req.header(\"content-length\")||\"0\");\n if(Number.isFinite(len)&&len>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt=await c.req.text();\n if(new TextEncoder().encode(txt).length>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt||\"{}\");\n}\nfunction canonicalReceipt(v:any){\n return {\n schema:v.schema,\n authorizer_implementation:v.authorizer_implementation,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nfunction structuralReceiptCheck(v:any):v is VerifiedReceipt{\n if(!v||typeof v!==\"object\")return false;\n if(v.schema!==\"rumbo-r2-dedicated-authorizer-consumption/v3.6\")return false;\n if(v.authorizer_implementation!==AUTHORIZER_IMPLEMENTATION)return false;\n if(typeof v.authorization_id!==\"string\"||v.authorization_id.length<16||v.authorization_id.length>128)return false;\n if(v.action!==\"TEST_ONLY\"&&v.action!==\"MERGE_PR\")return false;\n if(v.repository_identity_sha256!==REPO_IDENTITY_SHA256)return false;\n if(!Number.isSafeInteger(v.pr_number)||v.pr_number<=0)return false;\n if(!GIT_SHA_RE.test(String(v.base_sha||\"\"))||!GIT_SHA_RE.test(String(v.head_sha||\"\")))return false;\n if(v.package_sha256!==PACKAGE_SHA256)return false;\n if(!SHA256_RE.test(String(v.evidence_sha256||\"\"))||!SHA256_RE.test(String(v.request_sha256||\"\")))return false;\n if(v.observer_receipt_sha256!==null&&!SHA256_RE.test(String(v.observer_receipt_sha256||\"\")))return false;\n if(!Number.isFinite(Date.parse(String(v.consumed_at||\"\"))))return false;\n if(typeof v.consumer!==\"string\"||!/^[A-Za-z0-9_.:-]{1,128}$/.test(v.consumer))return false;\n if(v.consumed!==true||v.production_go!==false)return false;\n if(typeof v.merge_authorized!==\"boolean\"||v.merge_authorized!==(v.action===\"MERGE_PR\"))return false;\n if(v.action===\"MERGE_PR\"&&(!v.observer_receipt_sha256||v.evidence_sha256!==v.observer_receipt_sha256))return false;\n if(v.action===\"TEST_ONLY\"&&v.observer_receipt_sha256!==null)return false;\n if(!SHA256_RE.test(String(v.receipt_sha256||\"\")))return false;\n if(v.receipt_signature?.alg!==\"ES256\"||v.receipt_signature?.kid!==AUTHORIZER_SIGNING_KID)return false;\n if(!B64URL_RE.test(String(v.receipt_signature?.signature_b64url||\"\")))return false;\n return true;\n}\nasync function verifyAuthorizerReceipt(v:any):Promise<{ok:true;receipt:VerifiedReceipt}|{ok:false;error:string}>{\n if(!structuralReceiptCheck(v))return {ok:false,error:\"INVALID_AUTHORIZER_V3_RECEIPT_STRUCTURE\"};\n const canon=canonical(canonicalReceipt(v));\n const computed=await sha256(canon);\n if(!ct(computed,String(v.receipt_sha256)))return {ok:false,error:\"AUTHORIZER_RECEIPT_HASH_MISMATCH\"};\n let key:CryptoKey;\n try{key=await crypto.subtle.importKey(\"jwk\",AUTHORIZER_VERIFY_JWK,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);}\n catch{return {ok:false,error:\"AUTHORIZER_VERIFY_KEY_IMPORT_FAILED\"};}\n let sig:Uint8Array;\n try{sig=b64urlDecode(String(v.receipt_signature.signature_b64url));}\n catch{return {ok:false,error:\"AUTHORIZER_SIGNATURE_ENCODING_INVALID\"};}\n const valid=await crypto.subtle.verify({name:\"ECDSA\",hash:\"SHA-256\"},key,sig,new TextEncoder().encode(canon));\n if(!valid)return {ok:false,error:\"AUTHORIZER_RECEIPT_SIGNATURE_INVALID\"};\n return {ok:true,receipt:v};\n}\nlet brokerTokenCache:{token:string;expires_at_ms:number}|null=null;\n\nasync function brokerHealth(){\n try{\n const res=await fetch(GITHUB_BROKER_BASE+\"/health\",{headers:{\"User-Agent\":\"rumbo-r2-deployer/3.2\"}});\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n }catch(e){\n return {status:0,json:null,text:String(e)};\n }\n}\n\nasync function getGithubToken():Promise<{ok:true;token:string;expires_at:string}|{ok:false;error:string}>{\n if(brokerTokenCache&&brokerTokenCache.expires_at_ms>Date.now()+60_000){\n return {ok:true,token:brokerTokenCache.token,expires_at:new Date(brokerTokenCache.expires_at_ms).toISOString()};\n }\n const roleToken=Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\")||\"\";\n if(!roleToken)return {ok:false,error:\"GITHUB_BROKER_ROLE_TOKEN_NOT_CONFIGURED\"};\n let res:Response;\n try{\n res=await fetch(GITHUB_BROKER_BASE+\"/v1/token/deployer\",{\n method:\"POST\",\n headers:{Authorization:`Bearer ${roleToken}`,\"User-Agent\":\"rumbo-r2-deployer/3.2\"}\n });\n }catch{\n return {ok:false,error:\"GITHUB_BROKER_UNREACHABLE\"};\n }\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n if(res.status!==200||!json){\n return {ok:false,error:String(json?.error||`GITHUB_BROKER_HTTP_${res.status}`)};\n }\n const expiresAt=Date.parse(String(json.expires_at||\"\"));\n const perms=json.permissions||{};\n const valid=\n typeof json.token===\"string\"&&json.token.length>20&&\n Number(json.repository_id)===REPOSITORY_ID&&\n json.broker_implementation===GITHUB_BROKER_IMPLEMENTATION&&\n json.role===\"deployer\"&&\n perms.contents===\"read\"&&\n perms.pull_requests===\"write\"&&\n perms.administration===\"read\"&&\n json.production_go===false&&\n Number.isFinite(expiresAt)&&expiresAt>Date.now()+60_000;\n if(!valid)return {ok:false,error:\"GITHUB_BROKER_TOKEN_CONTRACT_INVALID\"};\n brokerTokenCache={token:String(json.token),expires_at_ms:expiresAt};\n return {ok:true,token:String(json.token),expires_at:String(json.expires_at)};\n}\n\nasync function github(path:string,method=\"GET\",body?:unknown){\n const tokenResult=await getGithubToken();\n if(!tokenResult.ok)return {status:0,json:null,text:tokenResult.error};\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${tokenResult.token}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-deployer/3.2\",\n \"Content-Type\":\"application/json\"\n },\n body:body===undefined?undefined:JSON.stringify(body)\n });\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n}\n\nasync function verifyJitBootstrapFiles(){\n const evidence:any={static:{},dynamic:{}};\n for(const [path,expectedSha] of Object.entries(R2_STATIC_PINS)){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/contents/${path}?ref=${encodeURIComponent(DORMANT_R2_BRANCH)}`);\n const actual=String(r.json?.sha||\"\");\n evidence.static[path]={status:r.status,expected_git_blob_sha:expectedSha,actual_git_blob_sha:actual,match:r.status===200&&actual===expectedSha};\n if(r.status!==200||actual!==expectedSha)return {ok:false,error:\"R2_STATIC_PIN_MISMATCH\",evidence};\n }\n for(const path of R2_REQUIRED_DYNAMIC_FILES){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/contents/${path}?ref=${encodeURIComponent(DORMANT_R2_BRANCH)}`);\n const actual=String(r.json?.sha||\"\");\n evidence.dynamic[path]={status:r.status,git_blob_sha:actual,present:r.status===200&&/^[a-f0-9]{40}$/.test(actual)};\n if(r.status!==200||!/^[a-f0-9]{40}$/.test(actual))return {ok:false,error:\"R2_DYNAMIC_FILE_MISSING\",evidence};\n }\n return {ok:true,evidence};\n}\n\nasync function currentMainSha(){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n const sha=String(r.json?.object?.sha||\"\");\n if(r.status!==200||!GIT_SHA_RE.test(sha))return {ok:false,error:\"CURRENT_MAIN_UNREADABLE\",status:r.status,sha:null};\n return {ok:true,sha,status:r.status};\n}\n\nasync function readDormantBranch(){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/branches/${encodeURIComponent(DORMANT_R2_BRANCH)}`);\n const sha=String(r.json?.commit?.sha||\"\");\n if(r.status!==200||!GIT_SHA_RE.test(sha))return {ok:false,error:\"DORMANT_R2_BRANCH_UNREADABLE\",status:r.status,sha:null};\n return {ok:true,sha,status:r.status};\n}\n\nasync function compareMainToHead(mainSha:string,headSha:string){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/compare/${mainSha}...${headSha}`);\n if(r.status!==200||!r.json)return {ok:false,error:\"JIT_COMPARE_UNREADABLE\",status:r.status};\n return {\n ok:true,\n status:String(r.json.status||\"\"),\n ahead_by:Number(r.json.ahead_by||0),\n behind_by:Number(r.json.behind_by||0),\n merge_base_sha:String(r.json.merge_base_commit?.sha||\"\")\n };\n}\n\nasync function openDormantActivationPr(){\n const q=`/repos/${REPO_OWNER}/${REPO_NAME}/pulls?state=open&base=${encodeURIComponent(DEFAULT_BRANCH)}&head=${encodeURIComponent(REPO_OWNER+\":\"+DORMANT_R2_BRANCH)}&per_page=20`;\n const list=await github(q);\n if(list.status!==200||!Array.isArray(list.json))return {ok:false,error:\"JIT_PR_LIST_UNREADABLE\",status:list.status};\n\n if(list.json.length>1)return {ok:false,error:\"AMBIGUOUS_MULTIPLE_JIT_PRS\",count:list.json.length};\n if(list.json.length===1){\n const pr=list.json[0];\n if(pr?.draft!==true)return {ok:false,error:\"EXISTING_JIT_PR_NOT_DRAFT\",pr_number:Number(pr?.number||0)};\n return {ok:true,created:false,pr};\n }\n\n const body=[\n \"RUMBO R2 JIT activation candidate.\",\n \"\",\n \"This PR is prepared only after the dedicated external observer substrate is available.\",\n \"It carries the sealed R2 bootstrap candidate and remains DRAFT.\",\n \"\",\n \"This PR does NOT imply MERGE_PR authorization, deployment, PRODUCT_GO or PRODUCTION_GO.\",\n \"Native private-repository enforcement, signed external observation, independent review and all downstream gates remain required.\"\n ].join(\"\\n\");\n const created=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls`,\"POST\",{\n title:\"continuity: JIT R2 observer activation candidate\",\n head:DORMANT_R2_BRANCH,\n base:DEFAULT_BRANCH,\n body,\n draft:true,\n maintainer_can_modify:false\n });\n if(created.status!==201||!created.json?.number)return {ok:false,error:\"JIT_PR_CREATE_FAILED\",status:created.status,message:created.json?.message||null};\n if(created.json?.draft!==true)return {ok:false,error:\"JIT_PR_CREATED_NOT_DRAFT\",pr_number:Number(created.json.number)};\n return {ok:true,created:true,pr:created.json};\n}\n\nasync function refreshJitPrAgainstMain(prNumber:number,expectedHeadSha:string,mainSha:string){\n let cmp=await compareMainToHead(mainSha,expectedHeadSha);\n if(!cmp.ok)return cmp;\n\n if(cmp.behind_by===0&&cmp.merge_base_sha===mainSha){\n return {ok:true,updated:false,head_sha:expectedHeadSha,compare:cmp};\n }\n\n const upd=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${prNumber}/update-branch`,\"PUT\",{\n expected_head_sha:expectedHeadSha\n });\n if(upd.status!==202){\n return {ok:false,error:\"JIT_UPDATE_BRANCH_FAILED\",status:upd.status,message:upd.json?.message||null,compare_before:cmp};\n }\n\n let last:any=null;\n for(let i=0;i<8;i++){\n await new Promise(r=>setTimeout(r,500));\n const pr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${prNumber}`);\n if(pr.status!==200||!pr.json){last={status:pr.status};continue;}\n const headSha=String(pr.json?.head?.sha||\"\");\n if(!GIT_SHA_RE.test(headSha)){last={status:pr.status,head_sha:headSha};continue;}\n const post=await compareMainToHead(mainSha,headSha);\n last={status:pr.status,head_sha:headSha,compare:post};\n if(post.ok&&post.behind_by===0&&post.merge_base_sha===mainSha){\n return {ok:true,updated:true,head_sha:headSha,compare:post};\n }\n }\n return {ok:false,error:\"JIT_UPDATE_BRANCH_NOT_CONVERGED\",last};\n}\n\nasync function nativeEnforcement(){\n const protection=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/branches/${DEFAULT_BRANCH}/protection`);\n let classic=false;\n let classicRequiredApprovals=0;\n if(protection.status===200&&protection.json){\n const j=protection.json;\n classicRequiredApprovals=Number(j.required_pull_request_reviews?.required_approving_review_count||0);\n classic=classicRequiredApprovals>=1 &&\n j.allow_force_pushes?.enabled===false &&\n j.allow_deletions?.enabled===false;\n }\n\n const list=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets`);\n let ruleset=false;\n let rulesetRequiredApprovals=0;\n const rulesets:any[]=[];\n if(list.status===200&&Array.isArray(list.json)){\n for(const item of list.json){\n if(item?.enforcement!==\"active\"||item?.target!==\"branch\"||!item?.id)continue;\n const detail=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets/${item.id}`);\n if(detail.status!==200||!detail.json)continue;\n const rules=detail.json.rules||[];\n const types=new Set(rules.map((r:any)=>String(r.type)));\n const include=(detail.json.conditions?.ref_name?.include||[]).map(String);\n const targetsMain=include.includes(\"~DEFAULT_BRANCH\")||include.includes(\"refs/heads/main\")||include.includes(\"main\");\n const pullRule=rules.find((r:any)=>String(r.type)===\"pull_request\");\n const required=Number(pullRule?.parameters?.required_approving_review_count||0);\n const protects=targetsMain &&\n types.has(\"pull_request\") &&\n types.has(\"non_fast_forward\") &&\n types.has(\"deletion\") &&\n required>=1;\n rulesets.push({id:item.id,targets_main:targetsMain,required_approvals:required,types:[...types],protects});\n if(protects){\n ruleset=true;\n rulesetRequiredApprovals=Math.max(rulesetRequiredApprovals,required);\n }\n }\n }\n\n const requiredApprovals=Math.max(classic?classicRequiredApprovals:0,ruleset?rulesetRequiredApprovals:0);\n return {\n proven:classic||ruleset,\n classic,\n ruleset,\n required_approvals:requiredApprovals,\n classic_required_approvals:classicRequiredApprovals,\n ruleset_required_approvals:rulesetRequiredApprovals,\n protection_status:protection.status,\n rulesets_status:list.status,\n inspected_rulesets:rulesets\n };\n}\nasync function providerPreflight(row:any){\n const checks:any[]=[];\n const add=(name:string,ok:boolean,detail:any)=>checks.push({name,status:ok?\"PASS\":\"FAIL\",detail});\n\n const repo=await github(`/repos/${REPO_OWNER}/${REPO_NAME}`);\n add(\"repo_api\",repo.status===200,repo.status);\n add(\"repo_id\",Number(repo.json?.id)===REPOSITORY_ID,repo.json?.id);\n add(\"owner_id\",Number(repo.json?.owner?.id)===OWNER_ID,repo.json?.owner?.id);\n add(\"private_repo\",repo.json?.private===true,repo.json?.private);\n add(\"default_branch\",repo.json?.default_branch===DEFAULT_BRANCH,repo.json?.default_branch);\n\n const pr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}`);\n add(\"pr_api\",pr.status===200,pr.status);\n add(\"pr_open\",pr.json?.state===\"open\",pr.json?.state);\n add(\"pr_ready\",pr.json?.draft===false,pr.json?.draft);\n add(\"base_main\",pr.json?.base?.ref===DEFAULT_BRANCH,pr.json?.base?.ref);\n add(\"base_sha_exact\",pr.json?.base?.sha===row.base_sha,pr.json?.base?.sha);\n add(\"head_sha_exact\",pr.json?.head?.sha===row.head_sha,pr.json?.head?.sha);\n\n const cmp=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/compare/${row.base_sha}...${row.head_sha}`);\n add(\"compare_api\",cmp.status===200,cmp.status);\n add(\"head_descends_from_base\",cmp.json?.behind_by===0&&Number(cmp.json?.ahead_by)>=1,{ahead_by:cmp.json?.ahead_by,behind_by:cmp.json?.behind_by});\n\n const main=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n add(\"main_ref_api\",main.status===200,main.status);\n add(\"current_main_equals_bound_base\",main.json?.object?.sha===row.base_sha,main.json?.object?.sha);\n\n const native=await nativeEnforcement();\n add(\"native_enforcement\",native.proven,native);\n\n const reviews=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}/reviews?per_page=100`);\n add(\"reviews_api\",reviews.status===200,reviews.status);\n const latestByReviewer=new Map();\n if(reviews.status===200&&Array.isArray(reviews.json)){\n for(const review of reviews.json){\n const login=String(review?.user?.login||\"\");\n if(!login)continue;\n const prior=latestByReviewer.get(login);\n const currentTime=Date.parse(String(review?.submitted_at||\"\"))||Number(review?.id||0);\n const priorTime=prior?(Date.parse(String(prior?.submitted_at||\"\"))||Number(prior?.id||0)):-1;\n if(currentTime>=priorTime)latestByReviewer.set(login,review);\n }\n }\n const authorLogin=String(pr.json?.user?.login||\"\");\n const approved=[...latestByReviewer.entries()]\n .filter(([login,review])=>login!==authorLogin&&String(review?.state||\"\").toUpperCase()===\"APPROVED\")\n .map(([login])=>login);\n const requiredApprovals=Number(native.required_approvals||0);\n add(\"required_review_approvals\",\n native.proven&&requiredApprovals>=1&&approved.length>=requiredApprovals,\n {required:requiredApprovals,approved_count:approved.length,approved_reviewers:approved,author:authorLogin}\n );\n\n return {\n ok:checks.every(x=>x.status===\"PASS\"),\n checks,\n native,\n required_approvals:requiredApprovals,\n approved_reviewers:approved,\n current_main_sha:main.json?.object?.sha||null\n };\n}\nasync function audit(event_type:string,plan_id:string|null,object_sha256:string|null){\n if(plan_id){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM deploy_audit_v3 WHERE event_type=? AND plan_id=? LIMIT 1\",args:[event_type,plan_id]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n for(let i=0;i<8;i++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM deploy_audit_v3 ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,plan_id,object_sha256,prev_event_sha256:prev,created_at};\n const h=await sha256(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO deploy_audit_v3(event_type,plan_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,plan_id,object_sha256,prev,h,created_at]});\n return h;\n }catch(e){if(!String(e).includes(\"UNIQUE\"))throw e;}\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-deployer\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\napp.get(\"/health\",async c=>{\n const broker=await brokerHealth();\n const brokerReady=broker.status===200&&broker.json?.implementation===GITHUB_BROKER_IMPLEMENTATION&&broker.json?.broker_ready===true;\n const roleTokenConfigured=!!Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\");\n return c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\"),\n broker_autopilot_token_hash_configured:!!Deno.env.get(\"R2_BROKER_JIT_AUTOPILOT_TOKEN_SHA256\"),\n broker_autopilot_plaintext_token_persisted_here:false,\n broker_autopilot_scope:\"JIT_PREPARE_ONLY\",\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n direct_github_token_path_retired:true,\n github_broker:{\n base:GITHUB_BROKER_BASE,\n expected_implementation:GITHUB_BROKER_IMPLEMENTATION,\n observed_implementation:broker.json?.implementation||null,\n role:\"deployer\",\n role_token_configured:roleTokenConfigured,\n health_status:broker.status,\n broker_ready:brokerReady\n },\n provider_credential_ready:roleTokenConfigured&&brokerReady,\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID,default_branch:DEFAULT_BRANCH},\n package_sha256:PACKAGE_SHA256,\n authorizer:{\n implementation:AUTHORIZER_IMPLEMENTATION,\n receipt_schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.6\",\n signature_alg:\"ES256\",\n signing_kid:AUTHORIZER_SIGNING_KID,\n verify_jwk:AUTHORIZER_VERIFY_JWK,\n observer_receipt_required_for_merge:true\n },\n jit_activation_policy:{\n endpoint:\"POST /v3/jit/prepare-activation\",\n dormant_branch:DORMANT_R2_BRANCH,\n create_draft_only:true,\n update_branch_via_pull_requests_write:true,\n direct_ref_write_forbidden:true,\n exact_static_blob_pins:R2_STATIC_PINS,\n required_dynamic_files:R2_REQUIRED_DYNAMIC_FILES,\n main_revalidation_required:true,\n observer_required_after_preparation:true,\n merge_authorized:false,\n deploy_enabled:false\n },\n execution_policy:{\n required_authorizer_action:\"MERGE_PR\",\n observer_receipt_required:true,\n max_prepare_merge_receipt_age_seconds:MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS,\n max_execute_receipt_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,\n current_main_must_equal_bound_base:true,\n pr_must_be_ready_not_draft:true,\n native_enforcement_required:true,\n minimum_native_approving_reviews:1,\n actual_review_approval_fulfillment_required:true,\n pr_author_approval_not_counted:true,\n exact_head_sha_merge:true,\n post_merge_main_readback_required:true,\n test_only_never_executable:true\n },\n capabilities:[\n \"signed-authorizer-v3.6-verification\",\n \"broker-post-install-autopilot-jit-only\",\n \"hashed-service-token-auth\",\n \"observer-linked-merge-authority\",\n \"github-app-broker-jit-token\",\n \"no-durable-github-installation-token\",\n \"github-rest-provider-preflight\",\n \"jit-draft-pr-activation-preparation\",\n \"jit-update-branch-with-pull-requests-write\",\n \"jit-static-bootstrap-pin-revalidation\",\n \"jit-main-drift-abort\",\n \"no-direct-ref-write-for-jit\",\n \"exact-live-main-base-revalidation\",\n \"native-enforcement-revalidation\",\n \"required-review-approval-fulfillment\",\n \"pr-author-excluded-from-approval-count\",\n \"authorizer-implementation-anti-downgrade\",\n \"exact-head-sha-merge\",\n \"post-merge-main-readback\",\n \"fail-closed-provider-credential\",\n \"audit-hash-chain\"\n ],\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v3/jit/prepare-activation\",async c=>{\n const authMode=await jitAuthorized(c.req.raw);\n if(!authMode)return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\"){\n return c.json({error:\"DEPLOY_MUST_REMAIN_DISABLED_DURING_JIT_PREP\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n\n const tokenCheck=await getGithubToken();\n if(!tokenCheck.ok){\n return c.json({\n error:\"GITHUB_BROKER_NOT_READY\",\n reason:tokenCheck.error,\n jit_activation_prepared:false,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },424,{\"Cache-Control\":\"no-store\"});\n }\n\n const main0=await currentMainSha();\n if(!main0.ok)return c.json({...main0,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n\n const branch0=await readDormantBranch();\n if(!branch0.ok)return c.json({...branch0,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n\n const pins0=await verifyJitBootstrapFiles();\n if(!pins0.ok)return c.json({...pins0,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const allOpen=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls?state=open&base=${encodeURIComponent(DEFAULT_BRANCH)}&per_page=100`);\n if(allOpen.status!==200||!Array.isArray(allOpen.json)){\n return c.json({error:\"OPEN_PR_SET_UNREADABLE\",status:allOpen.status,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n }\n const otherR2=allOpen.json.filter((p:any)=>\n String(p?.head?.ref||\"\")!==DORMANT_R2_BRANCH &&\n (\n String(p?.title||\"\").toLowerCase().includes(\"jit r2\") ||\n String(p?.title||\"\").toLowerCase().includes(\"r2 observer activation\") ||\n String(p?.head?.ref||\"\").startsWith(\"audit/continuity-r2\")\n )\n );\n if(otherR2.length){\n return c.json({\n error:\"OTHER_R2_ACTIVATION_PR_OPEN\",\n pr_numbers:otherR2.map((p:any)=>Number(p.number)),\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const opened=await openDormantActivationPr();\n if(!opened.ok)return c.json({...opened,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n const prNumber=Number(opened.pr?.number||0);\n const initialHead=String(opened.pr?.head?.sha||\"\");\n const initialBase=String(opened.pr?.base?.sha||\"\");\n if(!Number.isSafeInteger(prNumber)||prNumber<=0||!GIT_SHA_RE.test(initialHead)||!GIT_SHA_RE.test(initialBase)){\n return c.json({error:\"JIT_PR_COORDINATES_INVALID\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n if(opened.pr?.draft!==true||String(opened.pr?.head?.ref||\"\")!==DORMANT_R2_BRANCH||String(opened.pr?.base?.ref||\"\")!==DEFAULT_BRANCH){\n return c.json({error:\"JIT_PR_CONTRACT_INVALID\",pr_number:prNumber,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const refreshed=await refreshJitPrAgainstMain(prNumber,initialHead,String(main0.sha));\n if(!refreshed.ok)return c.json({...refreshed,pr_number:prNumber,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const pins1=await verifyJitBootstrapFiles();\n if(!pins1.ok)return c.json({...pins1,pr_number:prNumber,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const main1=await currentMainSha();\n if(!main1.ok)return c.json({...main1,pr_number:prNumber,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n if(main1.sha!==main0.sha){\n await audit(\"V3_JIT_MAIN_DRIFT_ABORT\",String(prNumber),await sha256(canonical({main0:main0.sha,main1:main1.sha})));\n return c.json({\n error:\"MAIN_DRIFT_DURING_JIT_PREP\",\n pr_number:prNumber,\n observed_main_before:main0.sha,\n observed_main_after:main1.sha,\n retry_required:true,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const finalPr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${prNumber}`);\n if(finalPr.status!==200||!finalPr.json)return c.json({error:\"FINAL_JIT_PR_UNREADABLE\",pr_number:prNumber,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n const finalHead=String(finalPr.json?.head?.sha||\"\");\n const finalBase=String(finalPr.json?.base?.sha||\"\");\n if(\n finalPr.json?.draft!==true||\n String(finalPr.json?.head?.ref||\"\")!==DORMANT_R2_BRANCH||\n String(finalPr.json?.base?.ref||\"\")!==DEFAULT_BRANCH||\n finalBase!==main1.sha||\n !GIT_SHA_RE.test(finalHead)\n ){\n return c.json({\n error:\"FINAL_JIT_PR_CONTRACT_INVALID\",\n pr_number:prNumber,\n final_base_sha:finalBase||null,\n final_head_sha:finalHead||null,\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const lineage=await compareMainToHead(String(main1.sha),finalHead);\n if(!lineage.ok||lineage.behind_by!==0||lineage.merge_base_sha!==main1.sha){\n return c.json({error:\"FINAL_JIT_LINEAGE_INVALID\",pr_number:prNumber,lineage,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receiptBasis={\n pr_number:prNumber,\n base_sha:String(main1.sha),\n head_sha:finalHead,\n head_branch:DORMANT_R2_BRANCH,\n static_pins:R2_STATIC_PINS,\n package_sha256:PACKAGE_SHA256\n };\n const preparation_sha256=await sha256(canonical(receiptBasis));\n await audit(\"V3_JIT_ACTIVATION_PREPARED\",String(prNumber),preparation_sha256);\n\n return c.json({\n schema:\"rumbo-r2-jit-activation-preparation/v1\",\n implementation:IMPLEMENTATION,\n invocation_mode:authMode,\n jit_activation_prepared:true,\n pr_created:opened.created,\n pr_number:prNumber,\n pr_draft:true,\n base_sha:String(main1.sha),\n head_sha:finalHead,\n head_branch:DORMANT_R2_BRANCH,\n branch_refresh_performed:refreshed.updated,\n main_revalidated_after_refresh:true,\n static_pins_verified:true,\n dynamic_files_present:true,\n preparation_sha256,\n next_gate:\"SIGNED_EXTERNAL_OBSERVER\",\n merge_authorized:false,\n deploy_enabled:false,\n product_production:\"NO_GO\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/prepare\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c);\n const verified=await verifyAuthorizerReceipt(b?.authorizer_receipt);\n if(!verified.ok)return c.json({error:verified.error,production_go:false},400,{\"Cache-Control\":\"no-store\"});\n const r=verified.receipt;\n\n if(r.action===\"MERGE_PR\"){\n const age=(Date.now()-Date.parse(r.consumed_at))/1000;\n if(!Number.isFinite(age)||age< -60||age>MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS){\n return c.json({error:\"MERGE_AUTHORIZER_RECEIPT_STALE\",production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n if(!r.observer_receipt_sha256||r.evidence_sha256!==r.observer_receipt_sha256){\n return c.json({error:\"OBSERVER_LINK_REQUIRED_FOR_MERGE\",production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n }\n\n const planBinding={\n authorizer_action:r.action,\n authorizer_authorization_id:r.authorization_id,\n repository_identity_sha256:r.repository_identity_sha256,\n pr_number:r.pr_number,\n base_sha:r.base_sha,\n head_sha:r.head_sha,\n package_sha256:r.package_sha256,\n evidence_sha256:r.evidence_sha256,\n observer_receipt_sha256:r.observer_receipt_sha256,\n authorizer_request_sha256:r.request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n authorizer_signature_kid:r.receipt_signature.kid,\n authorizer_consumed_at:r.consumed_at,\n authorizer_merge_authorized:r.merge_authorized\n };\n const request_sha256=await sha256(canonical(planBinding));\n const prior=await sqlite.execute({sql:\"SELECT plan_id,status FROM deploy_plans_v3 WHERE request_sha256=? LIMIT 1\",args:[request_sha256]});\n if(prior.rows.length)return c.json({error:\"PLAN_ALREADY_EXISTS\",plan_id:prior.rows[0].plan_id,status:prior.rows[0].status,request_sha256,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const plan_id=crypto.randomUUID(),created_at=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO deploy_plans_v3(\n plan_id,authorizer_action,authorizer_authorization_id,repository_identity_sha256,\n pr_number,base_sha,head_sha,package_sha256,evidence_sha256,observer_receipt_sha256,\n authorizer_request_sha256,authorizer_receipt_sha256,authorizer_signature_kid,\n authorizer_consumed_at,authorizer_merge_authorized,request_sha256,status,created_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'PREPARED',?)`,args:[\n plan_id,r.action,r.authorization_id,r.repository_identity_sha256,r.pr_number,r.base_sha,r.head_sha,\n r.package_sha256,r.evidence_sha256,r.observer_receipt_sha256,r.request_sha256,r.receipt_sha256,\n r.receipt_signature.kid,r.consumed_at,r.merge_authorized?1:0,request_sha256,created_at\n ]});\n await audit(\"V3_PLAN_PREPARED\",plan_id,request_sha256);\n\n const blocked_by:string[]=[];\n if(r.action!==\"MERGE_PR\"||!r.merge_authorized)blocked_by.push(\"AUTHORIZER_ACTION_NOT_MERGE_PR\");\n if(r.action===\"MERGE_PR\"&&!r.observer_receipt_sha256)blocked_by.push(\"OBSERVER_RECEIPT_MISSING\");\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\")blocked_by.push(\"R2_ALLOW_DEPLOY_FALSE\");\n const broker=await brokerHealth();\n const brokerRoleConfigured=!!Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\");\n const brokerReady=broker.status===200&&broker.json?.implementation===GITHUB_BROKER_IMPLEMENTATION&&broker.json?.broker_ready===true;\n if(!brokerRoleConfigured)blocked_by.push(\"GITHUB_BROKER_ROLE_TOKEN_NOT_CONFIGURED\");\n else if(!brokerReady)blocked_by.push(\"GITHUB_BROKER_NOT_READY\");\n\n return c.json({\n prepared:true,plan_id,request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n observer_receipt_sha256:r.observer_receipt_sha256,\n authorizer_signature_verified:true,\n authorizer_action:r.action,\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n executable:blocked_by.length===0,\n blocked_by,\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/preflight\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v3 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const tokenCheck=await getGithubToken();\n if(!tokenCheck.ok)return c.json({\n error:\"GITHUB_BROKER_NOT_READY\",\n reason:tokenCheck.error,\n plan_id,\n production_go:false\n },424,{\"Cache-Control\":\"no-store\"});\n const result=await providerPreflight(rs.rows[0]);\n return c.json({plan_id,...result,production_go:false},result.ok?200:409,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/execute\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v3 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)!==\"PREPARED\")return c.json({error:\"PLAN_NOT_PREPARED\",status:row.status,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n if(String(row.authorizer_action)!==\"MERGE_PR\"||Number(row.authorizer_merge_authorized)!==1){\n return c.json({error:\"AUTHORIZER_ACTION_NOT_MERGE_PR\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n if(!row.observer_receipt_sha256||String(row.evidence_sha256)!==String(row.observer_receipt_sha256)){\n return c.json({error:\"OBSERVER_LINK_REQUIRED_FOR_MERGE\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const age=(Date.now()-Date.parse(String(row.authorizer_consumed_at||\"\")))/1000;\n if(!Number.isFinite(age)||age< -60||age>MAX_EXEC_RECEIPT_AGE_SECONDS){\n return c.json({error:\"AUTHORIZER_RECEIPT_STALE\",plan_id,max_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\"){\n return c.json({error:\"DEPLOY_DISABLED\",plan_id,production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const tokenCheck=await getGithubToken();\n if(!tokenCheck.ok){\n return c.json({\n error:\"GITHUB_BROKER_NOT_READY\",\n reason:tokenCheck.error,\n plan_id,\n production_go:false\n },424,{\"Cache-Control\":\"no-store\"});\n }\n\n const pre=await providerPreflight(row);\n if(!pre.ok){\n await audit(\"V3_PROVIDER_PREFLIGHT_NO_GO\",plan_id,await sha256(canonical(pre.checks)));\n return c.json({error:\"PROVIDER_PREFLIGHT_NO_GO\",plan_id,checks:pre.checks,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const merge=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}/merge`,\"PUT\",{\n sha:String(row.head_sha),\n merge_method:\"merge\"\n });\n if(merge.status!==200||merge.json?.merged!==true||!GIT_SHA_RE.test(String(merge.json?.sha||\"\"))){\n await audit(\"V3_PROVIDER_MERGE_FAILED\",plan_id,await sha256(merge.text||\"\"));\n return c.json({error:\"PROVIDER_MERGE_FAILED\",plan_id,status:merge.status,message:merge.json?.message||null,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n const mergeSha=String(merge.json.sha);\n\n const main=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n const mainSha=String(main.json?.object?.sha||\"\");\n if(main.status!==200||mainSha!==mergeSha){\n await audit(\"V3_POST_MERGE_READBACK_FAILED\",plan_id,await sha256(canonical({mergeSha,mainSha,status:main.status})));\n return c.json({error:\"POST_MERGE_MAIN_READBACK_MISMATCH\",plan_id,merge_sha:mergeSha,main_sha:mainSha,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const executed_at=new Date().toISOString();\n const updated:any=await sqlite.execute({\n sql:\"UPDATE deploy_plans_v3 SET status='EXECUTED',executed_at=?,provider_merge_sha=?,provider_main_readback_sha=? WHERE plan_id=? AND status='PREPARED'\",\n args:[executed_at,mergeSha,mainSha,plan_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"EXECUTION_LEDGER_RACE\",plan_id,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"V3_PROVIDER_MERGE_EXECUTED\",plan_id,mergeSha);\n\n return c.json({\n executed:true,\n plan_id,\n provider:\"GITHUB_REST\",\n merged_pr:Number(row.pr_number),\n merge_sha:mergeSha,\n main_readback_sha:mainSha,\n observer_receipt_sha256:String(row.observer_receipt_sha256),\n authorizer_receipt_sha256:String(row.authorizer_receipt_sha256),\n product_production_go:false,\n production_go:false,\n note:\"This executes only the gated R2 observer-installation PR merge. It is not product production authorization.\"\n },200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/cancel\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const updated:any=await sqlite.execute({sql:\"UPDATE deploy_plans_v3 SET status='CANCELLED' WHERE plan_id=? AND status='PREPARED'\",args:[plan_id]});\n if(Number(updated?.rowsAffected??0)!==1)return c.json({error:\"PLAN_NOT_CANCELLABLE\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"V3_PLAN_CANCELLED\",plan_id,null);\n return c.json({cancelled:true,plan_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v3/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT plan_id,authorizer_action,authorizer_authorization_id,\n repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256,\n observer_receipt_sha256,authorizer_request_sha256,authorizer_receipt_sha256,\n authorizer_signature_kid,authorizer_consumed_at,authorizer_merge_authorized,\n request_sha256,status,created_at,executed_at,provider_merge_sha,provider_main_readback_sha\n FROM deploy_plans_v3 ORDER BY created_at DESC LIMIT 100`);\n const broker=await brokerHealth();\n const brokerReady=broker.status===200&&broker.json?.implementation===GITHUB_BROKER_IMPLEMENTATION&&broker.json?.broker_ready===true;\n return c.json({\n schema:\"rumbo-r2-deployer-ledger/v3.7\",\n implementation:IMPLEMENTATION,\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n direct_github_token_path_retired:true,\n broker_role_token_configured:!!Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\"),\n broker_ready:brokerReady,\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v3/audit\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM deploy_audit_v3 ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,plan_id:r.plan_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-deployer-audit/v3\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.all(\"/v2/*\",c=>c.json({error:\"V2_RETIRED_USE_V3_OBSERVER_LINKED_AUTHORIZATION\",replacement_prepare:\"/v3/prepare\",production_go:false},410,{\"Cache-Control\":\"no-store\"}));\napp.all(\"/v1/*\",c=>c.json({error:\"V1_RETIRED_USE_V3_OBSERVER_LINKED_AUTHORIZATION\",replacement_prepare:\"/v3/prepare\",production_go:false},410,{\"Cache-Control\":\"no-store\"}));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\nexport default app.fetch;\n","deleted",false,"label",[14],"dc841a2e-8ac0-491d-b8e5-ee9e11dc6e2a",["D",1787974891297],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Fail-closed RUMBO R2 deployer controller","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","dc841a2e8ac0491db8e5ee9e11dc6e2a","tursoHostname","dc841a2e8ac0491db8e5ee9e11dc6e2a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789452068287],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",20,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":62,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]