[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","sebas1","name","rumbo-r2-github-observer","path","main.tsx","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/sebas1/rumbo-r2-github-observer/code/main.tsx","extension","id","d75387e5-02bc-429a-ad17-155ed1020c3f","fileId","3875e380-a361-11f1-aa59-1607ee4eb77e","parentId","branchId","3b4d54a6-dc1b-448d-8db8-741c5fde7ed2","branchVersion",15,"latest",true,"createdAt",["D",1787988616945],"version",7,"fileType","http","content","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\n\nconst IMPLEMENTATION = \"R2_GITHUB_OBSERVER_V1_6_DURABLE_REOBSERVATION_JOURNAL\";\nconst GITHUB_BROKER_BASE = \"https://sebas1--cec0f0e4a36311f1a6461607ee4eb77e.web.val.run\";\nconst GITHUB_BROKER_IMPLEMENTATION = \"R2_GITHUB_APP_CUSTODY_BROKER_V1_3_OBSERVER_JOURNAL_PINNED\";\nconst REPO_OWNER = \"fscfede-beep\";\nconst REPO_NAME = \"rumbo-control-queue\";\nconst REPO_FULL = `${REPO_OWNER}/${REPO_NAME}`;\nconst REPOSITORY_ID = 1314199389;\nconst OWNER_ID = 293577326;\nconst DEFAULT_BRANCH = \"main\";\nconst PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst SIGNING_KID = \"aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8\";\nconst VERIFY_JWK: JsonWebKey = {\n kty:\"EC\",crv:\"P-256\",\n x:\"lYPzwJFKYb5YZsikYx57Wr6TfkwwNyog15s0BN_p8fA\",\n y:\"9bVfI4jPqeN-yt2KQjz9MgmsDjLpbqzs1pw1DcgPwHQ\",\n key_ops:[\"verify\"],ext:true\n};\nconst API_VERSION = \"2026-03-10\";\nconst MAX_BODY = 64 * 1024;\n\nconst STATIC_PINS: Record = {\n \".github/workflows/continuity-r2-observe.yml\":\n \"3d5dd465aad367cde5eabfff2ba7033865ceef8b\",\n \"tools/continuity-r2/EXPECTED_PACKAGE.json\":\n \"1260b3516219341c63107dca1cc1b21a1ecb9ba0\",\n \"tools/continuity-r2/snapshot_guard.py\":\n \"752f12df05d0b6b1bc122cbe61a3145458fdd074\"\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS observer_receipts(\n receipt_sha256 TEXT PRIMARY KEY,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n observed_at TEXT NOT NULL,\n observation_status TEXT NOT NULL,\n blocking_count INTEGER NOT NULL,\n native_enforcement_proven INTEGER NOT NULL CHECK(native_enforcement_proven IN (0,1)),\n merge_ready INTEGER NOT NULL CHECK(merge_ready IN (0,1)),\n state_sha256 TEXT,\n readme_sha256 TEXT,\n signature_kid TEXT NOT NULL,\n signature_b64url TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_observer_pr_head\n ON observer_receipts(pr_number,head_sha)`,\n `CREATE TABLE IF NOT EXISTS observer_receipts_v2(\n receipt_sha256 TEXT PRIMARY KEY,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n observed_at TEXT NOT NULL,\n observation_status TEXT NOT NULL,\n blocking_count INTEGER NOT NULL,\n native_enforcement_proven INTEGER NOT NULL,\n merge_ready INTEGER NOT NULL,\n state_sha256 TEXT,\n readme_sha256 TEXT,\n broker_implementation TEXT NOT NULL,\n invocation_mode TEXT NOT NULL,\n signature_kid TEXT NOT NULL,\n signature_b64url TEXT NOT NULL,\n receipt_json TEXT NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_observer_v2_pr_head_time\n ON observer_receipts_v2(pr_number,head_sha,observed_at DESC)`,\n `CREATE TABLE IF NOT EXISTS observer_audit(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n receipt_sha256 TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_observer_audit_prev\n ON observer_audit(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_observer_audit_event_receipt\n ON observer_audit(event_type,receipt_sha256)\n WHERE receipt_sha256 IS NOT NULL`\n]);\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\nfunction ct(a:string,b:string):boolean {\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0; for(let i=0;i {\n const expectedHash=Deno.env.get(\"R2_BROKER_OBSERVER_AUTOPILOT_TOKEN_SHA256\")||\"\";\n const observed=bearer(req);\n if(!expectedHash||!observed)return false;\n const observedHash=await sha256Text(observed);\n return ct(expectedHash,observedHash);\n}\nasync function observeAuthorized(req:Request):Promise<\"ROOT\"|\"BROKER_AUTOPILOT\"|null> {\n if(authorized(req))return \"ROOT\";\n if(await brokerAutopilotAuthorized(req))return \"BROKER_AUTOPILOT\";\n return null;\n}\nfunction canonical(v:unknown):string {\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256Text(s:string):Promise {\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64url(bytes:Uint8Array):string {\n const raw=Array.from(bytes,b=>String.fromCharCode(b)).join(\"\");\n return btoa(raw).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\nasync function signCanonical(s:string):Promise {\n const raw=Deno.env.get(\"R2_OBSERVER_SIGNING_JWK_V1\")||\"\";\n if(!raw)throw new Error(\"OBSERVER_SIGNING_KEY_NOT_CONFIGURED\");\n const jwk=JSON.parse(raw);\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"sign\"]);\n const sig=await crypto.subtle.sign({name:\"ECDSA\",hash:\"SHA-256\"},key,new TextEncoder().encode(s));\n return b64url(new Uint8Array(sig));\n}\nfunction decodeBase64(s:string):string {\n const compact=s.replace(/\\s+/g,\"\");\n const raw=atob(compact);\n return new TextDecoder().decode(Uint8Array.from(raw,ch=>ch.charCodeAt(0)));\n}\nasync function bodyJson(c:any):Promise {\n const len=Number(c.req.header(\"content-length\")||\"0\");\n if(Number.isFinite(len)&&len>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt=await c.req.text();\n if(new TextEncoder().encode(txt).length>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt||\"{}\");\n}\nfunction add(checks:any[],name:string,ok:boolean,detail:any,blocking=true){\n checks.push({name,status:ok?\"PASS\":\"FAIL\",detail,blocking});\n}\nlet brokerTokenCache:{token:string;expires_at_ms:number}|null=null;\n\nasync function brokerHealth(){\n try{\n const res=await fetch(GITHUB_BROKER_BASE+\"/health\",{headers:{\"User-Agent\":\"rumbo-r2-github-observer/1.2\"}});\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n }catch(e){\n return {status:0,json:null,text:String(e)};\n }\n}\n\nasync function getGithubToken():Promise<{ok:true;token:string;expires_at:string}|{ok:false;error:string}>{\n if(brokerTokenCache&&brokerTokenCache.expires_at_ms>Date.now()+60_000){\n return {ok:true,token:brokerTokenCache.token,expires_at:new Date(brokerTokenCache.expires_at_ms).toISOString()};\n }\n const roleToken=Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\")||\"\";\n if(!roleToken)return {ok:false,error:\"GITHUB_BROKER_ROLE_TOKEN_NOT_CONFIGURED\"};\n let res:Response;\n try{\n res=await fetch(GITHUB_BROKER_BASE+\"/v1/token/observer\",{\n method:\"POST\",\n headers:{Authorization:`Bearer ${roleToken}`,\"User-Agent\":\"rumbo-r2-github-observer/1.2\"}\n });\n }catch{\n return {ok:false,error:\"GITHUB_BROKER_UNREACHABLE\"};\n }\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n if(res.status!==200||!json){\n return {ok:false,error:String(json?.error||`GITHUB_BROKER_HTTP_${res.status}`)};\n }\n const expiresAt=Date.parse(String(json.expires_at||\"\"));\n const perms=json.permissions||{};\n const valid=\n typeof json.token===\"string\"&&json.token.length>20&&\n Number(json.repository_id)===REPOSITORY_ID&&\n json.broker_implementation===GITHUB_BROKER_IMPLEMENTATION&&\n json.role===\"observer\"&&\n perms.contents===\"read\"&&\n perms.pull_requests===\"read\"&&\n perms.administration===\"read\"&&\n json.production_go===false&&\n Number.isFinite(expiresAt)&&expiresAt>Date.now()+60_000;\n if(!valid)return {ok:false,error:\"GITHUB_BROKER_TOKEN_CONTRACT_INVALID\"};\n brokerTokenCache={token:String(json.token),expires_at_ms:expiresAt};\n return {ok:true,token:String(json.token),expires_at:String(json.expires_at)};\n}\n\nasync function github(path:string,method=\"GET\",body?:unknown){\n const tokenResult=await getGithubToken();\n if(!tokenResult.ok)return {status:0,headers:new Headers(),json:null,text:tokenResult.error};\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${tokenResult.token}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-github-observer/1.2\"\n },\n body:body===undefined?undefined:JSON.stringify(body)\n });\n const text=await res.text();\n let json:any=null;\n try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,headers:res.headers,json,text};\n}\nasync function fetchContent(path:string,ref:string){\n const encoded=path.split(\"/\").map(encodeURIComponent).join(\"/\");\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/contents/${encoded}?ref=${encodeURIComponent(ref)}`);\n if(r.status!==200||!r.json||typeof r.json.content!==\"string\"){\n return {ok:false,status:r.status,sha:null,text:null,error:r.json?.message||r.text};\n }\n return {\n ok:true,status:r.status,sha:String(r.json.sha||\"\"),\n text:decodeBase64(r.json.content),error:null\n };\n}\nfunction validateState(state:any,ctx:{pr:number;base:string;head:string;branch:string}){\n const checks:any[]=[];\n\n /*\n * LIVE_STATE.json is a sealed bootstrap snapshot, not a source of current PR\n * coordinates. Current PR/base/head/branch authority comes from GitHub API\n * reads performed in this observation and is signed into the observer receipt.\n * This distinction is required for JIT refresh of the dormant bootstrap branch:\n * the sealed payload can remain byte-stable while GitHub main advances.\n */\n add(checks,\"state_schema\",state?.schema===\"rumbo-continuity-live-state/v2\",state?.schema);\n add(checks,\"state_repo_full\",state?.repository?.full_name===REPO_FULL,state?.repository?.full_name);\n add(checks,\"state_repo_id\",Number(state?.repository?.repository_id)===REPOSITORY_ID,state?.repository?.repository_id);\n add(checks,\"state_owner_login\",state?.repository?.owner_login===REPO_OWNER,state?.repository?.owner_login);\n add(checks,\"state_owner_id\",Number(state?.repository?.owner_id)===OWNER_ID,state?.repository?.owner_id);\n add(checks,\"state_owner_type\",state?.repository?.owner_type===\"User\",state?.repository?.owner_type);\n add(checks,\"state_visibility\",state?.repository?.visibility===\"private\",state?.repository?.visibility);\n add(checks,\"state_default_branch\",state?.repository?.default_branch===DEFAULT_BRANCH,state?.repository?.default_branch);\n add(checks,\"state_control_package\",state?.control_package?.sha256===PACKAGE_SHA256,state?.control_package?.sha256);\n add(checks,\"state_local_artifact_seal\",state?.control_package?.local_artifact_seal===\"PASS\",state?.control_package?.local_artifact_seal);\n add(checks,\"state_direct_main_forbidden\",state?.safety?.direct_main_mutation===\"FORBIDDEN_BY_PROCESS\",state?.safety?.direct_main_mutation);\n add(checks,\"state_merge_without_review_forbidden\",state?.safety?.merge_without_reviewed_pr===\"FORBIDDEN_BY_PROCESS\",state?.safety?.merge_without_reviewed_pr);\n add(checks,\"state_runtime_merge_gate_disabled\",state?.safety?.merge_authorization_runtime_gate===\"DISABLED\",state?.safety?.merge_authorization_runtime_gate);\n add(checks,\"state_production_false\",state?.safety?.production_go_from_this_file===false,state?.safety?.production_go_from_this_file);\n add(checks,\"state_product_no_go\",state?.authority?.product_production===\"NO_GO\",state?.authority?.product_production);\n add(checks,\"state_control_plane_not_operational_go\",state?.canonical_state?.control_plane_operational_go===false,state?.canonical_state?.control_plane_operational_go);\n\n add(checks,\"state_lineage_snapshot_non_authoritative\",true,{\n snapshot_successor_pr:state?.lineage?.successor_pr??null,\n snapshot_successor_branch:state?.lineage?.successor_branch??null,\n snapshot_successor_base_sha:state?.repository?.successor_branch_base_sha??null,\n runtime_pr:ctx.pr,\n runtime_branch:ctx.branch,\n runtime_base_sha:ctx.base,\n runtime_head_sha:ctx.head,\n authority:\"RUNTIME_GITHUB_API_AND_SIGNED_OBSERVER_RECEIPT\"\n },false);\n\n return checks;\n}\nasync function nativeEnforcement(){\n const checks:any[]=[];\n const protection=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/branches/${DEFAULT_BRANCH}/protection`);\n let classic=false;\n if(protection.status===200&&protection.json){\n const j=protection.json;\n const reviews=j.required_pull_request_reviews;\n const requiredApprovals=Number(reviews?.required_approving_review_count||0);\n const pr=!!reviews&&requiredApprovals>=1;\n const force=j.allow_force_pushes?.enabled===false;\n const del=j.allow_deletions?.enabled===false;\n classic=pr&&force&&del;\n }\n add(checks,\"classic_branch_protection\",classic,{status:protection.status},false);\n\n const list=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets`);\n let ruleset=false;\n const inspected:any[]=[];\n if(list.status===200&&Array.isArray(list.json)){\n for(const item of list.json){\n if(item?.enforcement!==\"active\"||item?.target!==\"branch\"||!item?.id)continue;\n const detail=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets/${item.id}`);\n if(detail.status!==200||!detail.json)continue;\n const types=new Set((detail.json.rules||[]).map((r:any)=>String(r.type)));\n const include=(detail.json.conditions?.ref_name?.include||[]).map(String);\n const targetsMain=include.includes(\"~DEFAULT_BRANCH\")||include.includes(\"refs/heads/main\")||include.includes(\"main\");\n const pullRule=(detail.json.rules||[]).find((r:any)=>String(r.type)===\"pull_request\");\n const requiredApprovals=Number(pullRule?.parameters?.required_approving_review_count||0);\n const protects=types.has(\"pull_request\")&&types.has(\"non_fast_forward\")&&types.has(\"deletion\")&&targetsMain&&requiredApprovals>=1;\n inspected.push({id:item.id,types:[...types],include,required_approvals:requiredApprovals,protects});\n if(protects)ruleset=true;\n }\n }\n add(checks,\"active_main_ruleset\",ruleset,{status:list.status,inspected},false);\n return {\n proven:classic||ruleset,\n classic,\n ruleset,\n protection_status:protection.status,\n rulesets_status:list.status,\n checks\n };\n}\nasync function appendAudit(event_type:string,receipt_sha256:string|null,object_sha256:string|null){\n if(receipt_sha256){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM observer_audit WHERE event_type=? AND receipt_sha256=? LIMIT 1\",args:[event_type,receipt_sha256]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n for(let attempt=0;attempt<8;attempt++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM observer_audit ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,receipt_sha256,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256=await sha256Text(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO observer_audit(event_type,receipt_sha256,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,receipt_sha256,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n }catch(e){\n if(!String(e).includes(\"UNIQUE\"))throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-github-observer\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\napp.get(\"/health\",async c=>{\n const broker=await brokerHealth();\n const brokerReady=broker.status===200&&broker.json?.implementation===GITHUB_BROKER_IMPLEMENTATION&&broker.json?.broker_ready===true;\n const roleTokenConfigured=!!Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\");\n return c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_OBSERVER_ROOT_TOKEN\"),\n signing_key_configured:!!Deno.env.get(\"R2_OBSERVER_SIGNING_JWK_V1\"),\n broker_autopilot_token_hash_configured:!!Deno.env.get(\"R2_BROKER_OBSERVER_AUTOPILOT_TOKEN_SHA256\"),\n broker_autopilot_plaintext_token_persisted_here:false,\n broker_autopilot_scope:\"OBSERVE_ONLY\",\n direct_github_token_path_retired:true,\n github_broker:{\n base:GITHUB_BROKER_BASE,\n expected_implementation:GITHUB_BROKER_IMPLEMENTATION,\n observed_implementation:broker.json?.implementation||null,\n role:\"observer\",\n role_token_configured:roleTokenConfigured,\n health_status:broker.status,\n broker_ready:brokerReady\n },\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID,default_branch:DEFAULT_BRANCH},\n package_sha256:PACKAGE_SHA256,\n static_git_blob_pins:STATIC_PINS,\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KID,verify_jwk:VERIFY_JWK},\n state_authority_policy:{\n accepted_bootstrap_schema:\"rumbo-continuity-live-state/v2\",\n snapshot_coordinates_authoritative:false,\n runtime_pr_coordinates_source:\"GITHUB_API\",\n runtime_coordinates_signed_in_receipt:true,\n sealed_payload_can_be_jit_refreshed_without_content_rewrite:true\n },\n receipt_journal_policy:{\n authoritative_ledger:\"observer_receipts_v2\",\n legacy_projection:\"observer_receipts\",\n same_pr_head_reobservation_supported:true,\n full_signed_receipt_persisted:true,\n broker_implementation_persisted:true,\n invocation_mode_persisted:true,\n ledger_endpoint:\"GET /v2/ledger\"\n },\n native_enforcement_policy:{\n minimum_approving_reviews:1,\n classic_requires_force_push_disabled:true,\n classic_requires_deletion_disabled:true,\n ruleset_required_rules:[\"pull_request\",\"non_fast_forward\",\"deletion\"]\n },\n capabilities:[\n \"private-github-independent-observation\",\n \"broker-post-install-autopilot-observe-only\",\n \"hashed-service-token-auth\",\n \"github-app-broker-jit-token\",\n \"no-durable-github-installation-token\",\n \"exact-repository-identity\",\n \"exact-pr-base-head-binding\",\n \"git-lineage-compare\",\n \"static-bootstrap-blob-pinning\",\n \"stable-state-invariant-validation\",\n \"runtime-github-coordinate-authority\",\n \"jit-dormant-branch-refresh-compatible\",\n \"native-enforcement-observation\",\n \"minimum-one-approval-enforcement\",\n \"force-push-and-deletion-enforcement\",\n \"implementation-bound-signed-receipts\",\n \"signed-observer-receipts\",\n \"durable-observer-ledger\",\n \"durable-full-signed-receipt-journal-v2\",\n \"same-pr-head-reobservation-journaling\",\n \"signed-receipt-reconstruction\",\n \"audit-hash-chain\"\n ],\n observer_can_run:roleTokenConfigured&&brokerReady,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/observe\",async c=>{\n const authMode=await observeAuthorized(c.req.raw);\n if(!authMode)return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const tokenCheck=await getGithubToken();\n if(!tokenCheck.ok){\n return c.json({\n error:\"GITHUB_BROKER_NOT_READY\",\n reason:tokenCheck.error,\n observer_can_run:false,\n production_go:false\n },424,{\"Cache-Control\":\"no-store\"});\n }\n try{\n const b=await bodyJson(c);\n const prNumber=Number(b?.pr_number);\n const expectedBase=String(b?.expected_base_sha||\"\");\n const expectedHead=String(b?.expected_head_sha||\"\");\n if(!Number.isSafeInteger(prNumber)||prNumber<=0||!/^[a-f0-9]{40}$/.test(expectedBase)||!/^[a-f0-9]{40}$/.test(expectedHead)){\n return c.json({error:\"INVALID_EXACT_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const checks:any[]=[];\n const repo=await github(`/repos/${REPO_OWNER}/${REPO_NAME}`);\n add(checks,\"repo_api_read\",repo.status===200,repo.status);\n add(checks,\"repo_id\",Number(repo.json?.id)===REPOSITORY_ID,repo.json?.id);\n add(checks,\"owner_id\",Number(repo.json?.owner?.id)===OWNER_ID,repo.json?.owner?.id);\n add(checks,\"private_repo\",repo.json?.private===true,repo.json?.private);\n add(checks,\"default_branch\",repo.json?.default_branch===DEFAULT_BRANCH,repo.json?.default_branch);\n\n const pr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${prNumber}`);\n add(checks,\"pr_api_read\",pr.status===200,pr.status);\n add(checks,\"pr_open\",pr.json?.state===\"open\",pr.json?.state);\n add(checks,\"pr_draft\",pr.json?.draft===true,pr.json?.draft);\n add(checks,\"pr_base_ref\",pr.json?.base?.ref===DEFAULT_BRANCH,pr.json?.base?.ref);\n add(checks,\"pr_base_sha_exact\",pr.json?.base?.sha===expectedBase,pr.json?.base?.sha);\n add(checks,\"pr_head_sha_exact\",pr.json?.head?.sha===expectedHead,pr.json?.head?.sha);\n const branch=String(pr.json?.head?.ref||\"\");\n add(checks,\"pr_branch_present\",!!branch,branch);\n\n const cmp=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/compare/${expectedBase}...${expectedHead}`);\n add(checks,\"compare_api_read\",cmp.status===200,cmp.status);\n add(checks,\"head_descends_from_base\",cmp.json?.behind_by===0&&Number(cmp.json?.ahead_by)>=1,{status:cmp.json?.status,ahead_by:cmp.json?.ahead_by,behind_by:cmp.json?.behind_by});\n\n const fileEvidence:any={};\n for(const [path,pin] of Object.entries(STATIC_PINS)){\n const f=await fetchContent(path,expectedHead);\n fileEvidence[path]={status:f.status,git_blob_sha:f.sha};\n add(checks,`static_pin:${path}`,f.ok&&f.sha===pin,{observed:f.sha,expected:pin,status:f.status});\n }\n\n const liveFile=await fetchContent(\"tools/continuity-r2/LIVE_STATE.json\",expectedHead);\n add(checks,\"live_state_read\",liveFile.ok,{status:liveFile.status,error:liveFile.error});\n let state:any=null;\n if(liveFile.ok){\n try{state=JSON.parse(liveFile.text!);}catch{}\n }\n add(checks,\"live_state_json\",!!state,state?\"parsed\":\"invalid\");\n if(state){\n checks.push(...validateState(state,{pr:prNumber,base:expectedBase,head:expectedHead,branch}));\n }\n\n const readmeFile=await fetchContent(\"tools/continuity-r2/README.md\",expectedHead);\n add(checks,\"readme_read\",readmeFile.ok,{status:readmeFile.status,error:readmeFile.error});\n if(readmeFile.ok){\n add(checks,\"readme_package_pin\",readmeFile.text!.includes(PACKAGE_SHA256),PACKAGE_SHA256);\n add(checks,\"readme_production_no_go\",readmeFile.text!.includes(\"PRODUCTION_NO_GO\"),\"required marker\");\n }\n\n const native=await nativeEnforcement();\n checks.push(...native.checks);\n\n const blocking=checks.filter(x=>x.blocking&&x.status!==\"PASS\");\n const observationStatus=blocking.length===0?\"OBSERVATION_PASS\":\"NO_GO\";\n const stateSha=liveFile.ok?await sha256Text(liveFile.text!):null;\n const readmeSha=readmeFile.ok?await sha256Text(readmeFile.text!):null;\n const observedAt=new Date().toISOString();\n const unsigned={\n schema:\"rumbo-r2-github-observer-receipt/v1\",\n observer_implementation:IMPLEMENTATION,\n broker_implementation:GITHUB_BROKER_IMPLEMENTATION,\n authoritative_for:\"R2_GITHUB_PR_SNAPSHOT_ONLY\",\n production_go:false,\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID},\n pr_number:prNumber,\n base_sha:expectedBase,\n head_sha:expectedHead,\n head_branch:branch||null,\n observed_at:observedAt,\n package_sha256:PACKAGE_SHA256,\n state_sha256:stateSha,\n readme_sha256:readmeSha,\n static_file_evidence:fileEvidence,\n native_enforcement:{\n proven:native.proven,\n classic_branch_protection:native.classic,\n active_main_ruleset:native.ruleset,\n protection_api_status:native.protection_status,\n rulesets_api_status:native.rulesets_status\n },\n checks,\n blocking_count:blocking.length,\n observation_status:observationStatus,\n merge_ready:observationStatus===\"OBSERVATION_PASS\"&&native.proven,\n invocation_mode:authMode,\n note:\"Independent GitHub snapshot observation only. Receipt cannot authorize product production.\"\n };\n const canon=canonical(unsigned);\n const receiptSha=await sha256Text(canon);\n const signature=await signCanonical(canon);\n const receipt={\n ...unsigned,\n receipt_sha256:receiptSha,\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KID,signature_b64url:signature}\n };\n\n await sqlite.execute({sql:`INSERT OR IGNORE INTO observer_receipts_v2(\n receipt_sha256,pr_number,base_sha,head_sha,observed_at,observation_status,blocking_count,\n native_enforcement_proven,merge_ready,state_sha256,readme_sha256,broker_implementation,\n invocation_mode,signature_kid,signature_b64url,receipt_json\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,args:[\n receiptSha,prNumber,expectedBase,expectedHead,observedAt,observationStatus,blocking.length,\n native.proven?1:0,receipt.merge_ready?1:0,stateSha,readmeSha,GITHUB_BROKER_IMPLEMENTATION,\n authMode,SIGNING_KID,signature,JSON.stringify(receipt)\n ]});\n await appendAudit(\"OBSERVER_RECEIPT_CREATED_V2\",receiptSha,receiptSha);\n\n // Preserve the original v1 projection as first-observation compatibility only.\n // It intentionally keeps its historical unique PR/head constraint; v2 is the\n // authoritative complete journal for every fresh signed re-observation.\n const prior=await sqlite.execute({sql:\"SELECT receipt_sha256 FROM observer_receipts WHERE pr_number=? AND head_sha=? LIMIT 1\",args:[prNumber,expectedHead]});\n if(!prior.rows.length){\n await sqlite.execute({sql:`INSERT INTO observer_receipts(\n receipt_sha256,pr_number,base_sha,head_sha,observed_at,observation_status,blocking_count,\n native_enforcement_proven,merge_ready,state_sha256,readme_sha256,signature_kid,signature_b64url\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)`,args:[\n receiptSha,prNumber,expectedBase,expectedHead,observedAt,observationStatus,blocking.length,\n native.proven?1:0,receipt.merge_ready?1:0,stateSha,readmeSha,SIGNING_KID,signature\n ]});\n await appendAudit(\"OBSERVER_RECEIPT_CREATED\",receiptSha,receiptSha);\n }\n\n return c.json(receipt,observationStatus===\"OBSERVATION_PASS\"?200:409,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT receipt_sha256,pr_number,base_sha,head_sha,observed_at,\n observation_status,blocking_count,native_enforcement_proven,merge_ready,state_sha256,readme_sha256,\n signature_kid FROM observer_receipts ORDER BY observed_at DESC LIMIT 100`);\n return c.json({schema:\"rumbo-r2-github-observer-ledger/v1\",implementation:IMPLEMENTATION,production_go:false,records:rs.rows},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v2/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT receipt_json FROM observer_receipts_v2 ORDER BY observed_at DESC LIMIT 50`);\n const receipts=(rs.rows as any[]).map(r=>{\n try{return JSON.parse(String(r.receipt_json||\"{}\"));}catch{return {parse_error:true};}\n });\n const legacy=await sqlite.execute(\"SELECT COUNT(*) AS count FROM observer_receipts\");\n return c.json({\n schema:\"rumbo-r2-github-observer-ledger/v2\",\n implementation:IMPLEMENTATION,\n authoritative_journal:true,\n same_pr_head_reobservation_supported:true,\n full_signed_receipts:true,\n legacy_v1_projection_count:Number((legacy.rows[0] as any)?.count||0),\n production_go:false,\n records:receipts\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v2/receipt/:sha\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const sha=String(c.req.param(\"sha\")||\"\");\n if(!/^[a-f0-9]{64}$/.test(sha))return c.json({error:\"INVALID_RECEIPT_SHA256\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT receipt_json FROM observer_receipts_v2 WHERE receipt_sha256=? LIMIT 1\",args:[sha]});\n if(!rs.rows.length)return c.json({error:\"RECEIPT_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n let receipt:any=null;\n try{receipt=JSON.parse(String((rs.rows[0] as any).receipt_json||\"\"));}catch{\n return c.json({error:\"RECEIPT_JOURNAL_CORRUPT\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n }\n return c.json({\n schema:\"rumbo-r2-github-observer-receipt-envelope/v2\",\n implementation:IMPLEMENTATION,\n production_go:false,\n receipt\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM observer_audit ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,receipt_sha256:r.receipt_sha256,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256Text(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-github-observer-audit/v1\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\nexport default app.fetch;\n","deleted",false,"label",[14],"8438d584-50f8-4401-a0e3-85e0f7aa21f4",["D",1787977337892],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Independent fail-closed GitHub observer for RUMBO R2","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","8438d58450f84401a0e385e0f7aa21f4","tursoHostname","8438d58450f84401a0e385e0f7aa21f4-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789452068287],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",16,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":62,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]