[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_289":290,"_291":292},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_17":18,"_49":-7,"_212":-5,"_19":213,"_214":215,"_216":217,"_218":219,"_220":221,"_21":222,"_223":-5,"_224":-5,"_225":24,"_226":227,"_228":172,"_229":-5,"_230":-5,"_231":232},"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":24,"_30":-5},"handle","mosadek","name","brain-session-attest-canary","branchName","main","path","main.ts","project",{"_43":160,"_13":14,"_47":161,"_162":-5,"_163":24,"_164":165,"_166":165,"_167":168,"_169":-5,"_30":78,"_170":74,"_171":172,"_173":-5,"_174":-5,"_175":26,"_51":52,"_176":177,"_178":179,"_180":181,"_182":-5,"_183":184,"_185":184,"_186":187,"_188":187,"_189":187,"_190":184,"_191":184,"_63":192,"_193":194,"_195":196,"_197":24},"file",{"_73":74,"_13":18,"_75":76,"_77":24,"_159":-5},"isDirectory",false,"page",0,"history",[31,32,33,34,35,36,37,38,39,40,41,42],"hasNext","userId",{"_43":152,"_45":46,"_47":153,"_49":154,"_51":52,"_53":145,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":155,"_21":156,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":157},{"_43":145,"_45":46,"_47":146,"_49":147,"_51":52,"_53":138,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":148,"_21":149,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":150},{"_43":138,"_45":46,"_47":139,"_49":140,"_51":52,"_53":131,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":141,"_21":142,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":143},{"_43":131,"_45":46,"_47":132,"_49":133,"_51":52,"_53":124,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":134,"_21":135,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":136},{"_43":124,"_45":46,"_47":125,"_49":126,"_51":52,"_53":117,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":127,"_21":128,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":129},{"_43":117,"_45":46,"_47":118,"_49":119,"_51":52,"_53":110,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":120,"_21":121,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":122},{"_43":110,"_45":46,"_47":111,"_49":112,"_51":52,"_53":102,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":113,"_21":114,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":115},{"_43":102,"_45":46,"_47":103,"_49":104,"_51":52,"_53":105,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":106,"_21":107,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":108},{"_43":95,"_45":46,"_47":96,"_49":97,"_51":52,"_53":88,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":98,"_21":99,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":100},{"_43":88,"_45":46,"_47":89,"_49":90,"_51":52,"_53":81,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":91,"_21":92,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":93},{"_43":81,"_45":46,"_47":82,"_49":83,"_51":52,"_53":44,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":84,"_21":85,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":86},{"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_21":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71},"id","6457a933-6fec-4d81-8ddc-c27c39f7a902","branchId","b0e333de-a4c5-4bb9-a276-b1babf93bd29","createdAt",["D",1788889096453],"version",1,"orgId","01a0715b-703f-741f-ab35-c85020e4a5e0","parentId","incomingCommitId","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","mcp","clientLabel","ChatGPT","user",{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},"pull","merge","revert","multiple","commits",[72],{"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_21":65,"_66":-5,"_67":-5,"_68":-5},"fileId","12e23346-abac-11f1-a170-1607ee4eb77e","fileType","http","deleted","6be0fc5c-1fef-4bd6-a1e1-67a3f8c0764e","avatar","https://lh3.googleusercontent.com/a/ACg8ocL1eT_LHhKSg5px3nXIO6eez79aZXef466qXKh2gak-0iwrvw=s96-c","bb930c03-6bd3-4ad3-99f4-e48b69a8394f",["D",1788889329951],2,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[87],{"_43":81,"_45":46,"_47":82,"_49":83,"_51":52,"_53":44,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":84,"_21":85,"_66":-5,"_67":-5,"_68":-5},"a24b3893-27ca-4b25-a358-b95697f7896b",["D",1788889579922],3,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[94],{"_43":88,"_45":46,"_47":89,"_49":90,"_51":52,"_53":81,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":91,"_21":92,"_66":-5,"_67":-5,"_68":-5},"705bc8aa-1911-4526-8dd5-1cf8ed30564e",["D",1788889646687],4,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[101],{"_43":95,"_45":46,"_47":96,"_49":97,"_51":52,"_53":88,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":98,"_21":99,"_66":-5,"_67":-5,"_68":-5},"3c713da0-0214-4395-98e3-3f298677f6b6",["D",1788889984255],9,"ae4336ac-74f1-413f-b3cb-3bc6824809e5",{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[109],{"_43":102,"_45":46,"_47":103,"_49":104,"_51":52,"_53":105,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":106,"_21":107,"_66":-5,"_67":-5,"_68":-5},"08cc29f8-24a8-465f-882e-abf287de882a",["D",1788890074134],10,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[116],{"_43":110,"_45":46,"_47":111,"_49":112,"_51":52,"_53":102,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":113,"_21":114,"_66":-5,"_67":-5,"_68":-5},"68dfbafb-35f8-456d-945b-39e22a1e57e8",["D",1788890082485],11,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[123],{"_43":117,"_45":46,"_47":118,"_49":119,"_51":52,"_53":110,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":120,"_21":121,"_66":-5,"_67":-5,"_68":-5},"97b54dba-5be5-4df4-a22d-bfbc670143ff",["D",1788890095229],12,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[130],{"_43":124,"_45":46,"_47":125,"_49":126,"_51":52,"_53":117,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":127,"_21":128,"_66":-5,"_67":-5,"_68":-5},"9cf152f1-d8db-4599-b1ff-1212b0b84931",["D",1788890101409],13,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[137],{"_43":131,"_45":46,"_47":132,"_49":133,"_51":52,"_53":124,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":134,"_21":135,"_66":-5,"_67":-5,"_68":-5},"f844fcd7-fad7-4758-9be4-94663e7faa71",["D",1788890110470],14,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[144],{"_43":138,"_45":46,"_47":139,"_49":140,"_51":52,"_53":131,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":141,"_21":142,"_66":-5,"_67":-5,"_68":-5},"cfa1f4c8-6b8f-4573-824d-88b092d7fce3",["D",1788890118263],15,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[151],{"_43":145,"_45":46,"_47":146,"_49":147,"_51":52,"_53":138,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":148,"_21":149,"_66":-5,"_67":-5,"_68":-5},"b8fe2987-a9d1-4d43-b95c-c461e1b1bc97",["D",1788890160841],16,{"_43":78,"_51":52,"_11":12,"_79":80},{"_73":74,"_13":18,"_75":76,"_77":24},[158],{"_43":152,"_45":46,"_47":153,"_49":154,"_51":52,"_53":145,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":155,"_21":156,"_66":-5,"_67":-5,"_68":-5},"deletedAtVersion","bbda209a-5fe0-4980-a701-219be290b80c",["D",1788889096399],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","ChatGPT MCP session provenance canary","imageUrl","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","bbda209a5fe04980a701219be290b80c","tursoHostname","bbda209a5fe04980a701219be290b80c-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789499469860],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_211":80},"org",{"_11":12,"_206":207,"_79":80,"_30":78,"_208":209,"_210":24},"branch",{"_49":154,"_13":16,"_43":46,"_198":160,"_199":-5,"_200":-5,"_201":-5,"_202":-5,"_203":-5,"_204":14,"_205":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Mo Sadek","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_43":160,"_13":14,"_47":284,"_162":-5,"_163":24,"_164":165,"_166":165,"_167":168,"_169":-5,"_30":78,"_170":74,"_171":172,"_173":-5,"_174":-5,"_175":26,"_51":52,"_176":177,"_178":179,"_180":285,"_182":-5,"_183":184,"_185":184,"_186":187,"_188":187,"_189":187,"_190":184,"_191":184,"_63":286,"_193":287,"_195":288,"_197":24},"tree",[251,252,253,254],"files",[251,252,253,254],"counts",{"_241":26,"_242":50,"_243":26,"_244":245,"_246":247},"contents",[],{"_43":233,"_13":18,"_73":74,"_53":-5,"_45":46,"_234":154,"_235":172,"_47":236,"_49":119,"_75":76,"_237":238,"_77":24,"_239":-5,"_17":240},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},"660e80ff-29ed-4268-8fda-57ca039996a7","branchVersion","latest",["D",1788890160841],"content","import { Hono } from \"npm:hono\";\nimport { McpServer, StreamableHttpTransport } from \"https://esm.sh/mcp-lite@0.8.1\";\nimport { z } from \"https://esm.sh/zod@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { createRemoteJWKSet, jwtVerify } from \"npm:jose\";\n\nconst CHATGPT_CLIENT_ID = \"https://chatgpt.com/oauth/client.json\";\nconst CHATGPT_JWKS = new URL(\"https://chatgpt.com/oauth/jwks.json\");\nconst CHATGPT_REDIRECT = \"https://chatgpt.com/connector_platform_oauth_redirect\";\nconst CHATGPT_CONNECTOR_RANGES = \"https://openai.com/chatgpt-connectors.json\";\nconst SCOPE = \"session:attest\";\nconst enc = new TextEncoder();\nlet rangeCache:{fetchedAt:number,creationTime:string,prefixes:string[]}={fetchedAt:0,creationTime:\"\",prefixes:[]};\nconst hmacSecret = Deno.env.get(\"ATTEST_HMAC_SECRET\") ?? \"\";\nif (hmacSecret.length < 32) throw new Error(\"ATTEST_HMAC_SECRET missing\");\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_codes(\n code_hash TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n redirect_uri TEXT NOT NULL,\n resource TEXT NOT NULL,\n scope TEXT NOT NULL,\n code_challenge TEXT NOT NULL,\n expires_at INTEGER NOT NULL,\n used INTEGER NOT NULL DEFAULT 0\n)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_tokens(\n token_hash TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n resource TEXT NOT NULL,\n scope TEXT NOT NULL,\n issued_at INTEGER NOT NULL,\n expires_at INTEGER NOT NULL,\n client_auth_method TEXT NOT NULL\n)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS client_assertion_jti(\n jti TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL\n)`);\n\nfunction b64u(bytes: Uint8Array) {\n let s = \"\";\n for (const b of bytes) s += String.fromCharCode(b);\n return btoa(s).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/,\"\");\n}\nfunction unb64u(s:string){\n s=s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\");\n while(s.length%4)s+=\"=\";\n const raw=atob(s); return Uint8Array.from(raw,c=>c.charCodeAt(0));\n}\nasync function sha256Bytes(bytes:Uint8Array){\n return new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes));\n}\nasync function sha256Text(s:string){ return b64u(await sha256Bytes(enc.encode(s))); }\nasync function sha256Hex(s:string){\n return [...await sha256Bytes(enc.encode(s))].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nasync function hmacTag(kind:string, raw:string){\n const k=await crypto.subtle.importKey(\"raw\",enc.encode(hmacSecret),{name:\"HMAC\",hash:\"SHA-256\"},false,[\"sign\"]);\n const sig=new Uint8Array(await crypto.subtle.sign(\"HMAC\",k,enc.encode(kind+\"\\n\"+raw)));\n return b64u(sig);\n}\nfunction randomToken(bytes=32){ const a=crypto.getRandomValues(new Uint8Array(bytes)); return b64u(a); }\nfunction oauthError(error:string, description:string, status=400){\n return Response.json({error,error_description:description},{status,headers:{\"cache-control\":\"no-store\"}});\n}\nfunction base(req:Request){ const u=new URL(req.url); return u.protocol+\"//\"+u.host; }\nfunction resourceMetadata(origin:string){\n return {\n resource: origin,\n authorization_servers:[origin],\n scopes_supported:[SCOPE],\n resource_documentation: origin+\"/\"\n };\n}\nfunction authMetadata(origin:string){\n return {\n issuer:origin,\n authorization_endpoint:origin+\"/oauth/authorize\",\n token_endpoint:origin+\"/oauth/token\",\n response_types_supported:[\"code\"],\n grant_types_supported:[\"authorization_code\"],\n code_challenge_methods_supported:[\"S256\"],\n scopes_supported:[SCOPE],\n token_endpoint_auth_methods_supported:[\"private_key_jwt\"],\n client_id_metadata_document_supported:true,\n authorization_response_iss_parameter_supported:true\n };\n}\nasync function validateChatGPTClientDocument(clientId:string, redirectUri:string){\n if(clientId!==CHATGPT_CLIENT_ID || redirectUri!==CHATGPT_REDIRECT) return false;\n const r=await fetch(clientId,{headers:{\"accept\":\"application/json\"}});\n if(!r.ok) return false;\n const j=await r.json() as any;\n const redirects=Array.isArray(j.redirect_uris)?j.redirect_uris:[];\n const methods=Array.isArray(j.token_endpoint_auth_methods_supported)\n ? j.token_endpoint_auth_methods_supported\n : [j.token_endpoint_auth_method].filter(Boolean);\n return redirects.includes(redirectUri) && methods.includes(\"private_key_jwt\");\n}\nasync function verifyClientAssertion(assertion:string, clientId:string, tokenEndpoint:string){\n const jwks=createRemoteJWKSet(CHATGPT_JWKS);\n const {payload,protectedHeader}=await jwtVerify(assertion,jwks,{\n issuer:clientId,\n audience:tokenEndpoint,\n clockTolerance:5\n });\n if(payload.sub!==clientId) throw new Error(\"client_assertion sub mismatch\");\n if(typeof payload.jti!==\"string\" || payload.jti.length<8) throw new Error(\"client_assertion jti missing\");\n if(typeof payload.exp!==\"number\") throw new Error(\"client_assertion exp missing\");\n if(!protectedHeader.kid) throw new Error(\"client_assertion kid missing\");\n const expMs=payload.exp*1000;\n const inserted=await sqlite.execute({\n sql:\"INSERT OR IGNORE INTO client_assertion_jti(jti,expires_at) VALUES(?,?)\",\n args:[payload.jti,expMs]\n });\n if(Number((inserted as any).rowsAffected??0)!==1) throw new Error(\"client_assertion replay\");\n return {jti:payload.jti,expMs,kid:protectedHeader.kid};\n}\nfunction ipv4ToInt(ip:string){\n const p=ip.split(\".\").map(Number);\n if(p.length!==4 || p.some(x=>!Number.isInteger(x)||x<0||x>255)) return null;\n return (((p[0]*256+p[1])*256+p[2])*256+p[3])>>>0;\n}\nfunction cidrContains(ip:string,cidr:string){\n const [base,bitsRaw]=cidr.split(\"/\");\n const bits=Number(bitsRaw), n=ipv4ToInt(ip), b=ipv4ToInt(base);\n if(n===null||b===null||!Number.isInteger(bits)||bits<0||bits>32)return false;\n const mask=bits===0?0:((0xffffffff << (32-bits))>>>0);\n return ((n & mask)>>>0)===((b & mask)>>>0);\n}\nasync function getConnectorRanges(){\n const now=Date.now();\n if(rangeCache.prefixes.length && now-rangeCache.fetchedAt<300_000) return rangeCache;\n const r=await fetch(CHATGPT_CONNECTOR_RANGES,{headers:{accept:\"application/json\"}});\n if(!r.ok) throw new Error(\"connector range fetch failed\");\n const j=await r.json() as any;\n const prefixes=(Array.isArray(j.prefixes)?j.prefixes:[])\n .map((x:any)=>x?.ipv4Prefix)\n .filter((x:any)=>typeof x===\"string\");\n if(!prefixes.length || typeof j.creationTime!==\"string\") throw new Error(\"connector range manifest invalid\");\n rangeCache={fetchedAt:now,creationTime:j.creationTime,prefixes};\n return rangeCache;\n}\nasync function verifyOpenAiConnectorSource(req:Request){\n const ip=(req.headers.get(\"cf-connecting-ip\")??\"\").trim();\n if(!ip) return {ok:false as const,reason:\"missing_proxy_controlled_source_ip\"};\n try{\n const ranges=await getConnectorRanges();\n const matched=ranges.prefixes.find(c=>cidrContains(ip,c));\n if(!matched) return {ok:false as const,reason:\"source_ip_not_in_openai_connector_ranges\",creationTime:ranges.creationTime};\n return {ok:true as const,matchedPrefix:matched,creationTime:ranges.creationTime};\n }catch{\n return {ok:false as const,reason:\"openai_connector_range_verification_unavailable\"};\n }\n}\nasync function verifyBearer(req:Request, origin:string){\n const a=req.headers.get(\"authorization\")??\"\";\n if(!a.startsWith(\"Bearer \")) return {ok:false as const,reason:\"missing_bearer\"};\n const raw=a.slice(7).trim();\n if(raw.length<20) return {ok:false as const,reason:\"malformed_bearer\"};\n const hash=await sha256Hex(raw);\n const q=await sqlite.execute({\n sql:\"SELECT client_id,resource,scope,issued_at,expires_at,client_auth_method FROM oauth_tokens WHERE token_hash=? LIMIT 1\",\n args:[hash]\n });\n const row=(q.rows?.[0]??null) as any;\n if(!row) return {ok:false as const,reason:\"unknown_bearer\"};\n if(Number(row.expires_at)z.toJSONSchema(schema as z.ZodType)\n});\nmcp.tool(\"attest_chatgpt_session\",{\n description:\"Candidate-only: return opaque correlation tags only when the request carries a short-lived bearer minted after ChatGPT private_key_jwt client authentication.\",\n inputSchema:z.object({}),\n securitySchemes:[{type:\"oauth2\",scopes:[SCOPE]}],\n handler:async(_args:any,ctx:any)=>{\n const meta=ctx?.request?.params?._meta??{};\n const oauthVerified=meta[\"brain/verified_chatgpt_oauth\"]===true;\n const networkVerified=meta[\"brain/openai_connector_network_verified\"]===true;\n const verified=oauthVerified && networkVerified;\n if(!verified){\n const rm=currentOrigin+\"/.well-known/oauth-protected-resource\";\n return {\n content:[{type:\"text\",text:\"Authentication required.\"}],\n _meta:{\"mcp/www_authenticate\":[`Bearer resource_metadata=\"${rm}\", error=\"invalid_token\", error_description=\"ChatGPT client authentication required\"`]},\n isError:true\n };\n }\n const subject=meta[\"openai/subject\"];\n const session=meta[\"openai/session\"];\n if(typeof subject!==\"string\" || subject.length<8 || typeof session!==\"string\" || session.length<8){\n return {content:[{type:\"text\",text:\"Required ChatGPT correlation metadata absent.\"}],isError:true};\n }\n const subject_tag=await hmacTag(\"subject\",subject);\n const session_tag=await hmacTag(\"session\",session);\n return {\n content:[{type:\"text\",text:\"Candidate session attestation observed.\"}],\n structuredContent:{\n schema:\"CHATGPT_SESSION_ATTEST_CANARY_V3\",\n classification:\"CANDIDATE_POSITIVE_CHATGPT_HOST_NETWORK_AND_SESSION_WITNESS\",\n candidate_positive_physical_session_provenance:true,\n promotion_ready:false,\n host_auth:{\n oauth_client_auth:\"private_key_jwt\",\n openai_connector_egress_allowlist:true,\n matched_prefix:meta[\"brain/openai_network_prefix\"]??null,\n ranges_creation_time:meta[\"brain/openai_ranges_creation_time\"]??null\n },\n subject_tag,\n session_tag,\n raw_subject_returned:false,\n raw_session_returned:false,\n raw_source_ip_returned:false,\n sender_filtered:true,\n token_expires_at:Number(meta[\"brain/token_expires_at\"]??0),\n caveat:\"OpenAI documents IP allowlisting as OpenAI-network identification, not user/workspace identity. Session specificity comes from host-supplied openai/session. This remains nonauthority pending a real ChatGPT positive execution and independent review; mTLS is the stronger documented client-auth mechanism.\"\n }\n };\n }\n} as any);\nconst transport=new StreamableHttpTransport();\nconst mcpHandler=transport.bind(mcp);\n\nconst app=new Hono();\napp.get(\"/\",c=>c.json({\n schema:\"PROJECT_BRAIN_SESSION_ATTESTATION_CANARY_V3\",\n classification:\"CANDIDATE_NONAUTHORITY\",\n mcp:c.req.url.replace(/\\/$/,\"\")+\"/mcp\",\n objective:\"Test conjunctive ChatGPT witness: private_key_jwt OAuth + proxy-controlled source IP in current OpenAI connector ranges + openai/session. No authority or promotion is implied.\"\n}));\napp.get(\"/.well-known/oauth-protected-resource\",c=>c.json(resourceMetadata(base(c.req.raw))));\napp.get(\"/.well-known/oauth-authorization-server\",c=>c.json(authMetadata(base(c.req.raw))));\napp.get(\"/selftest/network-range\",async c=>{\n try{\n const ranges=await getConnectorRanges();\n const first=ranges.prefixes[0]??\"\";\n const firstIp=first.split(\"/\")[0]??\"\";\n return c.json({\n ok:Boolean(first)&&cidrContains(firstIp,first)&&!cidrContains(\"203.0.113.1\",first),\n creationTime:ranges.creationTime,\n prefixCount:ranges.prefixes.length,\n firstPrefix:first\n });\n }catch(e){\n return c.json({ok:false,error:\"range_selftest_failed\"},500);\n }\n});\n\napp.get(\"/oauth/authorize\",async c=>{\n const u=new URL(c.req.url), origin=base(c.req.raw);\n const clientId=u.searchParams.get(\"client_id\")??\"\";\n const redirect=u.searchParams.get(\"redirect_uri\")??\"\";\n const responseType=u.searchParams.get(\"response_type\")??\"\";\n const challenge=u.searchParams.get(\"code_challenge\")??\"\";\n const method=u.searchParams.get(\"code_challenge_method\")??\"\";\n const state=u.searchParams.get(\"state\")??\"\";\n const resource=u.searchParams.get(\"resource\")??\"\";\n const scope=u.searchParams.get(\"scope\")??\"\";\n if(responseType!==\"code\") return c.body(\"unsupported response_type\",400);\n if(method!==\"S256\" || challenge.length<43) return c.body(\"PKCE S256 required\",400);\n if(resource!==origin) return c.body(\"resource mismatch\",400);\n if(!scope.split(/\\s+/).includes(SCOPE)) return c.body(\"scope missing\",400);\n if(!await validateChatGPTClientDocument(clientId,redirect)) return c.body(\"ChatGPT CIMD/redirect validation failed\",400);\n const code=randomToken(32), codeHash=await sha256Hex(code), expires=Date.now()+90_000;\n await sqlite.execute({\n sql:\"INSERT INTO oauth_codes(code_hash,client_id,redirect_uri,resource,scope,code_challenge,expires_at,used) VALUES(?,?,?,?,?,?,?,0)\",\n args:[codeHash,clientId,redirect,resource,SCOPE,challenge,expires]\n });\n const out=new URL(redirect);\n out.searchParams.set(\"code\",code);\n if(state) out.searchParams.set(\"state\",state);\n out.searchParams.set(\"iss\",origin);\n return c.redirect(out.toString(),302);\n});\n\napp.post(\"/oauth/token\",async c=>{\n const origin=base(c.req.raw), tokenEndpoint=origin+\"/oauth/token\";\n const raw=await c.req.raw.text();\n const f=new URLSearchParams(raw);\n const grant=f.get(\"grant_type\")??\"\";\n const code=f.get(\"code\")??\"\";\n const redirect=f.get(\"redirect_uri\")??\"\";\n const clientId=f.get(\"client_id\")??\"\";\n const verifier=f.get(\"code_verifier\")??\"\";\n const resource=f.get(\"resource\")??\"\";\n const assertionType=f.get(\"client_assertion_type\")??\"\";\n const assertion=f.get(\"client_assertion\")??\"\";\n if(grant!==\"authorization_code\") return oauthError(\"unsupported_grant_type\",\"authorization_code required\");\n if(clientId!==CHATGPT_CLIENT_ID || redirect!==CHATGPT_REDIRECT || resource!==origin) return oauthError(\"invalid_client\",\"client/resource binding mismatch\",401);\n if(assertionType!==\"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\" || !assertion) return oauthError(\"invalid_client\",\"private_key_jwt client assertion required\",401);\n try{ await verifyClientAssertion(assertion,clientId,tokenEndpoint); }\n catch(e){ return oauthError(\"invalid_client\",\"ChatGPT private_key_jwt verification failed\",401); }\n const codeHash=await sha256Hex(code);\n const q=await sqlite.execute({sql:\"SELECT * FROM oauth_codes WHERE code_hash=? LIMIT 1\",args:[codeHash]});\n const row=(q.rows?.[0]??null) as any;\n if(!row || Number(row.used)!==0 || Number(row.expires_at){\n const origin=base(c.req.raw);\n currentOrigin=origin;\n const host=await verifyBearer(c.req.raw,origin);\n const network=await verifyOpenAiConnectorSource(c.req.raw);\n if(c.req.method!==\"POST\") return mcpHandler(c.req.raw);\n let body:any;\n try{body=await c.req.raw.clone().json();}catch{return mcpHandler(c.req.raw);}\n if(body && typeof body===\"object\" && body.params && typeof body.params===\"object\"){\n const incoming=(body.params._meta && typeof body.params._meta===\"object\")?body.params._meta:{};\n const clean:any={};\n for(const [k,v] of Object.entries(incoming)) if(!k.startsWith(\"brain/\")) clean[k]=v;\n clean[\"brain/verified_chatgpt_oauth\"]=host.ok;\n clean[\"brain/openai_connector_network_verified\"]=network.ok;\n if(host.ok){\n clean[\"brain/token_expires_at\"]=host.expires_at;\n clean[\"brain/client_auth_method\"]=\"private_key_jwt\";\n }\n if(network.ok){\n clean[\"brain/openai_network_prefix\"]=network.matchedPrefix;\n clean[\"brain/openai_ranges_creation_time\"]=network.creationTime;\n }\n body.params._meta=clean;\n }\n const headers=new Headers(c.req.raw.headers);\n headers.delete(\"content-length\");\n const rewritten=new Request(c.req.url,{method:c.req.method,headers,body:JSON.stringify(body)});\n const resp=await mcpHandler(rewritten);\n if(body?.method===\"tools/list\" && resp.ok){\n const textBody=await resp.text();\n const prefix=\"data: \";\n const raw=textBody.startsWith(prefix)?textBody.slice(prefix.length).trim():textBody.trim();\n try{\n const rpc=JSON.parse(raw);\n const tools=rpc?.result?.tools;\n if(Array.isArray(tools)){\n for(const tool of tools){\n if(tool?.name===\"attest_chatgpt_session\"){\n tool.securitySchemes=[{type:\"oauth2\",scopes:[SCOPE]}];\n }\n }\n const outHeaders=new Headers(resp.headers);\n outHeaders.delete(\"content-length\");\n return new Response(\"data: \"+JSON.stringify(rpc)+\"\\n\\n\",{status:resp.status,headers:outHeaders});\n }\n }catch{}\n return new Response(textBody,{status:resp.status,headers:resp.headers});\n }\n return resp;\n});\n\napp.onError((err)=>Promise.reject(err));\nexport default app.fetch;\n","label",[18],"pulls","branches","forks","envVars",{"_248":50,"_250":26},"connections",{"_248":26,"_249":26},"count","unfilledCount","emptyCount",{"_43":275,"_13":276,"_73":277,"_53":-5,"_45":46,"_234":278,"_235":172,"_47":279,"_49":50,"_75":280,"_237":281,"_77":24,"_239":-5,"_261":282,"_17":283},{"_43":233,"_13":18,"_73":74,"_53":-5,"_45":46,"_234":154,"_235":172,"_47":272,"_49":119,"_75":76,"_237":238,"_77":24,"_239":-5,"_261":273,"_17":274},{"_43":264,"_13":265,"_73":266,"_53":-5,"_45":46,"_234":267,"_235":172,"_47":268,"_49":26,"_75":76,"_237":269,"_77":24,"_239":-5,"_261":270,"_17":271},{"_43":255,"_13":256,"_73":257,"_53":-5,"_45":46,"_234":258,"_235":172,"_47":259,"_49":26,"_75":76,"_237":260,"_77":24,"_239":-5,"_261":262,"_17":263},"3724467b-9892-4923-996e-c61da4e77491","source_hash.ts","bf29b2f4-abad-11f1-a478-1607ee4eb77e",7,["D",1788889814969],"import { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nconst enc=new TextEncoder();\nconst hex=(b:Uint8Array)=>[...b].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nexport default async function(){\n const content=await readFile(\"/main.ts\",import.meta.url);\n const bytes=enc.encode(content);\n const digest=new Uint8Array(await crypto.subtle.digest(\"SHA-256\",bytes));\n return Response.json({bytes:bytes.length,sha256:hex(digest)});\n}","children",[],[256],"70a29bec-29f0-4478-8e91-a2396a3c137c","network_observe.ts","f2d14eb4-abad-11f1-a8fb-1607ee4eb77e",8,["D",1788889901593],"export default async function(req:Request){\n const names=[\"cf-connecting-ip\",\"x-forwarded-for\",\"x-real-ip\",\"forwarded\",\"true-client-ip\",\"cf-ray\",\"fly-client-ip\"];\n const headers:Object={};\n for(const n of names) headers[n]=req.headers.get(n);\n return Response.json({headers});\n}",[],[265],["D",1788890160841],[],[18],"1a9c64f5-3aaf-40db-97d9-bcb97821b66f","hash_main.ts","77321c5c-abad-11f1-8aaa-1607ee4eb77e",6,["D",1788889762610],"script","import { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nconst enc=new TextEncoder();\nconst hex=(b:Uint8Array)=>[...b].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nexport default async function(){\n const content=await readFile(\"/main.ts\",import.meta.url);\n const bytes=enc.encode(content);\n const digest=new Uint8Array(await crypto.subtle.digest(\"SHA-256\",bytes));\n const out={bytes:bytes.length,sha256:hex(digest)};\n console.log(JSON.stringify(out));\n return out;\n}",[],[276],["D",1788889096399],["D",1789499469860],{"_11":12,"_211":80},{"_11":12,"_206":207,"_79":80,"_30":78,"_208":209,"_210":24},{"_49":154,"_13":16,"_43":46,"_198":160,"_199":-5,"_200":-5,"_201":-5,"_202":-5,"_203":-5,"_204":14,"_205":12},"ctx",{"_63":-5,"_230":322,"_323":324,"_325":326,"_327":24,"_328":24,"_329":24,"_330":172,"_331":-5,"_332":-7,"_333":-7,"_334":26,"_335":24,"_336":24,"_337":-5,"_338":24,"_339":24,"_340":24,"_341":-5},"ENV",{"_293":294,"_295":296,"_297":16,"_298":299,"_300":301,"_302":303,"_304":305,"_306":307,"_308":309,"_310":311,"_312":313,"_314":315,"_316":317,"_318":319,"_320":321},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · main.ts