[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_204":205,"_206":207},"routes/_app.x.$handle.$name",{"_98":97,"_31":43,"_107":88,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":57,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",6,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","directory_probe.ts","latestPath","fileId","27412572-af9e-11f1-8124-1607ee4eb77e","name","fileType","script","content","const url=\"https://chatgpt.com/.well-known/http-message-signatures-directory\";\nconst res=await fetch(url,{headers:{accept:\"application/http-message-signatures-directory+json, application/json;q=0.9\"},redirect:\"error\"});\nconst text=await res.text();\nlet parsed:any=null; let parse_error:string|null=null;\ntry{parsed=JSON.parse(text)}catch(e){parse_error=String((e as Error)?.message??e)}\nconst keys=Array.isArray(parsed?.keys)?parsed.keys:[];\nconsole.log(JSON.stringify({schema:\"OPENAI_WEBBOTAUTH_DIRECTORY_LIVE_PROBE_V1\",status:res.status,ok:res.ok,content_type:res.headers.get(\"content-type\"),cache_control:res.headers.get(\"cache-control\"),parse_error,purpose:parsed?.purpose??null,key_count:keys.length,keys:keys.slice(0,20).map((k:any)=>({kid:k.kid??null,kty:k.kty??null,crv:k.crv??null,alg:k.alg??null,nbf:k.nbf??null,exp:k.exp??null,x_present:typeof k.x===\"string\",n_present:typeof k.n===\"string\"}))},null,2));","createdAt",["D",1789322922132],"branchVersion","branchId","d14bf048-fc63-4ed3-8b85-fd638d355c00","id","957e5128-9177-49d7-a4f3-6a71d16c1656","work-webbotauth-isolated-canary",["D",1789322498116],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Isolated ChatGPT Work Web Bot Auth canary","imageUrl","6be0fc5c-1fef-4bd6-a1e1-67a3f8c0764e","pinnedFileId","2a72cbfc-af9d-11f1-b509-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0715b-703f-741f-ab35-c85020e4a5e0","tursoName","957e5128917749d7a4f36a71d16c1656","tursoHostname","957e5128917749d7a4f36a71d16c1656-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789497078049],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"isOwned",13,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mosadek","handle","displayName","Mo Sadek","avatar","https://lh3.googleusercontent.com/a/ACg8ocL1eT_LHhKSg5px3nXIO6eez79aZXef466qXKh2gak-0iwrvw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":199,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":200,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":201,"_82":202,"_84":203,"_86":24},"tree",[178,179,180,181,182],"files",[178,179,180,181,182],"counts",{"_168":61,"_169":141,"_170":61,"_171":172,"_173":174},"contents",[129,130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":161,"_31":162,"_29":163,"_137":-5,"_39":40,"_38":164,"_139":57,"_36":165,"_13":61,"_32":33,"_34":166,"_23":24,"_143":-5,"_26":167},{"_41":154,"_31":155,"_29":156,"_137":-5,"_39":40,"_38":157,"_139":24,"_36":158,"_13":61,"_32":33,"_34":159,"_23":24,"_143":-5,"_26":160},{"_41":151,"_31":27,"_29":30,"_137":-5,"_39":40,"_38":14,"_139":57,"_36":152,"_13":61,"_32":33,"_34":35,"_23":24,"_143":-5,"_26":153},{"_41":145,"_31":146,"_29":55,"_137":-5,"_39":40,"_38":141,"_139":24,"_36":147,"_13":61,"_32":148,"_34":149,"_23":24,"_143":-5,"_26":150},{"_41":134,"_31":135,"_29":136,"_137":-5,"_39":40,"_38":138,"_139":57,"_36":140,"_13":141,"_32":33,"_34":142,"_23":24,"_143":-5,"_26":144},"6ef02103-210e-403d-b9f8-509966b9f5dc","probe_api.ts","4410ee90-af9d-11f1-a468-1607ee4eb77e","parentId",3,"latest",["D",1789322591881],1,"import * as W from \"npm:web-bot-auth@0.2.0\";\nimport * as C from \"npm:web-bot-auth@0.2.0/crypto\";\nconsole.log(JSON.stringify({web:Object.keys(W).sort(),crypto:Object.keys(C).sort(),sign:String((W as any).sign).slice(0,2200),verify:String((W as any).verify).slice(0,1800),signerFromJWK:String((C as any).signerFromJWK).slice(0,1200)},null,2));","label",[135],"8abf7ca2-8eb0-4937-897a-0b52753b63e1","main.ts",["D",1789322498182],"http","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n HTTP_MESSAGE_SIGNATURES_DIRECTORY,\n verify,\n type UntrustedWebBotSignatureCandidate,\n type VerifiedWebBotSignature,\n} from \"npm:web-bot-auth@0.2.0\";\nimport { verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst OPENAI_SIGNATURE_AGENT = \"https://chatgpt.com\";\nconst OPENAI_DIRECTORY = `${OPENAI_SIGNATURE_AGENT}${HTTP_MESSAGE_SIGNATURES_DIRECTORY}`;\nconst DIRECTORY_MEDIA_TYPE = \"application/http-message-signatures-directory+json\";\nconst MAX_DIRECTORY_KEYS = 100;\nconst MAX_SIGNATURE_AGE_SECONDS = 120;\nconst CLOCK_SKEW_SECONDS = 10;\nconst RECEIPT_TTL_SECONDS = 120;\nconst AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;\n\ntype DirectoryKey = JsonWebKey & { kid?: string; nbf?: number; exp?: number };\ntype Directory = { keys: DirectoryKey[]; purpose?: string };\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n let binary = \"\";\n for (const b of bytes) binary += String.fromCharCode(b);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomReceipt(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return bytesToBase64Url(bytes);\n}\n\nasync function sha256Hex(text: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction exactOpenAIAgentURI(uri: string): boolean {\n try {\n const u = new URL(uri);\n return u.protocol === \"https:\" && u.hostname === \"chatgpt.com\" && u.port === \"\" &&\n u.username === \"\" && u.password === \"\" &&\n (u.pathname === \"/\" || u.pathname === \"\") && u.search === \"\" && u.hash === \"\";\n } catch {\n return false;\n }\n}\n\nfunction parseDirectory(value: unknown): Directory {\n if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"DIRECTORY_NOT_OBJECT\");\n const obj = value as Record;\n if (!Array.isArray(obj.keys) || obj.keys.length < 1) throw new Error(\"DIRECTORY_KEYS_REQUIRED\");\n if (obj.keys.length > MAX_DIRECTORY_KEYS) throw new Error(\"DIRECTORY_TOO_MANY_KEYS\");\n const keys: DirectoryKey[] = [];\n for (const candidate of obj.keys) {\n if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) throw new Error(\"DIRECTORY_KEY_NOT_OBJECT\");\n const key = candidate as DirectoryKey;\n if (typeof key.kty !== \"string\") throw new Error(\"DIRECTORY_KEY_KTY_REQUIRED\");\n keys.push(key);\n }\n return { keys, purpose: typeof obj.purpose === \"string\" ? obj.purpose : undefined };\n}\n\nfunction keyTimeValid(key: DirectoryKey, nowMs: number): boolean {\n if (key.nbf !== undefined && (!Number.isFinite(key.nbf) || nowMs < Number(key.nbf))) return false;\n if (key.exp !== undefined && (!Number.isFinite(key.exp) || nowMs >= Number(key.exp))) return false;\n return true;\n}\n\nasync function fetchOpenAIDirectory(): Promise {\n const res = await fetch(OPENAI_DIRECTORY, {\n method: \"GET\",\n headers: { Accept: `${DIRECTORY_MEDIA_TYPE}, application/json;q=0.9` },\n redirect: \"error\",\n });\n if (!res.ok) throw new Error(`OPENAI_DIRECTORY_HTTP_${res.status}`);\n const raw = await res.text();\n let parsed: unknown;\n try { parsed = JSON.parse(raw); } catch { throw new Error(\"OPENAI_DIRECTORY_BAD_JSON\"); }\n return parseDirectory(parsed);\n}\n\nasync function resolveOpenAIVerifier(candidate: UntrustedWebBotSignatureCandidate) {\n const entry = candidate.signatureAgent;\n if (entry === undefined || entry.type !== \"directory\" || !exactOpenAIAgentURI(entry.uri)) {\n throw new Error(\"SIGNATURE_AGENT_NOT_EXACT_CHATGPT\");\n }\n const directory = await fetchOpenAIDirectory();\n const nowMs = Date.now();\n for (const key of directory.keys) {\n if (!keyTimeValid(key, nowMs)) continue;\n try {\n const verifier = await verifierFromJWK(key);\n if (verifier.keyid === candidate.keyid) return verifier;\n } catch {\n // Fail closed by ignoring malformed or unsupported entries.\n }\n }\n throw new Error(\"OPENAI_SIGNING_KEY_NOT_FOUND\");\n}\n\nasync function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS work_webbotauth_receipts_v1(\n signed_nonce TEXT PRIMARY KEY,\n agent_id TEXT NOT NULL,\n receipt_sha256 TEXT NOT NULL UNIQUE,\n signature_keyid TEXT NOT NULL,\n signature_created_ms INTEGER NOT NULL,\n signature_expires_ms INTEGER NOT NULL,\n issued_at_ms INTEGER NOT NULL,\n receipt_expires_at_ms INTEGER NOT NULL,\n used_at_ms INTEGER\n )`);\n}\n\nasync function mintReceiptFromVerifiedRequest(request: Request, agentId: string) {\n if (!AGENT_ID_RE.test(agentId)) throw new Error(\"AGENT_ID_INVALID\");\n const verified: VerifiedWebBotSignature = await verify(request, {\n algorithms: [\"ed25519\", \"rsa-pss-sha512\"],\n maxAge: MAX_SIGNATURE_AGE_SECONDS,\n clockSkew: CLOCK_SKEW_SECONDS,\n resolver: resolveOpenAIVerifier,\n validate(signature) {\n if (signature.nonce === undefined) return false;\n const entry = signature.signatureAgent;\n if (entry === undefined || entry.type !== \"directory\" || !exactOpenAIAgentURI(entry.uri)) return false;\n const now = Date.now();\n if (signature.created.getTime() > now + CLOCK_SKEW_SECONDS * 1000) return false;\n if (signature.expires.getTime() < now - CLOCK_SKEW_SECONDS * 1000) return false;\n return true;\n },\n });\n if (!verified.nonce) throw new Error(\"SIGNED_NONCE_REQUIRED\");\n\n const receipt = randomReceipt();\n const receiptSha256 = await sha256Hex(receipt);\n const issuedAtMs = Date.now();\n const receiptExpiresAtMs = issuedAtMs + RECEIPT_TTL_SECONDS * 1000;\n const targetUriCovered = verified.components.some(\n (component) => component.name === \"@target-uri\" && Object.keys(component.parameters).length === 0,\n );\n\n await ensureTables();\n try {\n await sqlite.execute({\n sql: `INSERT INTO work_webbotauth_receipts_v1(\n signed_nonce,agent_id,receipt_sha256,signature_keyid,signature_created_ms,\n signature_expires_ms,issued_at_ms,receipt_expires_at_ms,used_at_ms\n ) VALUES(?,?,?,?,?,?,?,?,NULL)`,\n args: [\n verified.nonce, agentId, receiptSha256, verified.keyid,\n verified.created.getTime(), verified.expires.getTime(), issuedAtMs, receiptExpiresAtMs,\n ],\n });\n } catch (error) {\n const message = String((error as Error)?.message ?? error);\n if (/UNIQUE|constraint/i.test(message)) throw new Error(\"SIGNED_NONCE_REPLAY\");\n throw error;\n }\n\n return {\n receipt,\n receipt_expires_at: new Date(receiptExpiresAtMs).toISOString(),\n signature_keyid: verified.keyid,\n signature_created_at: verified.created.toISOString(),\n signature_expires_at: verified.expires.toISOString(),\n target_uri_covered: targetUriCovered,\n };\n}\n\nasync function consumeReceipt(receipt: string, agentId: string): Promise {\n if (!AGENT_ID_RE.test(agentId) || receipt.length < 20 || receipt.length > 256) return false;\n const receiptSha256 = await sha256Hex(receipt);\n const nowMs = Date.now();\n await ensureTables();\n const result: any = await sqlite.execute({\n sql: `UPDATE work_webbotauth_receipts_v1 SET used_at_ms=?\n WHERE receipt_sha256=? AND agent_id=? AND used_at_ms IS NULL\n AND receipt_expires_at_ms>=? RETURNING signed_nonce`,\n args: [nowMs, receiptSha256, agentId, nowMs],\n });\n return Array.isArray(result.rows) && result.rows.length === 1;\n}\n\nfunction json(status: number, body: unknown): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}\n\nexport default async function handler(request: Request): Promise {\n const url = new URL(request.url);\n if (request.method === \"GET\" && url.pathname === \"/attest-work\") {\n const agentId = url.searchParams.get(\"agent_id\") ?? \"\";\n try {\n const out = await mintReceiptFromVerifiedRequest(request, agentId);\n return json(200, {\n ok: true,\n classification: \"CHATGPT_SIGNED_BROWSER_RECEIPT_MINTED_CANDIDATE_ONLY\",\n ...out,\n trust_limits: {\n work_cloud_runtime_production_admission: false,\n execution_distinct: false,\n independent_verification: false,\n p_real: false,\n human_authority_approval: false,\n production_qualified: false,\n },\n });\n } catch (error) {\n return json(401, {\n ok: false,\n classification: \"WORK_WEBBOTAUTH_ATTESTATION_REJECTED\",\n reason: String((error as Error)?.message ?? error),\n });\n }\n }\n\n // Canary only. Production admission must consume the receipt in the\n // authority-selected registration/reconciliation transaction.\n if (request.method === \"POST\" && url.pathname === \"/consume-canary\") {\n let body: any;\n try { body = await request.json(); } catch { return json(400, { ok: false, reason: \"BAD_JSON\" }); }\n const ok = await consumeReceipt(String(body?.receipt ?? \"\"), String(body?.agent_id ?? \"\"));\n return json(ok ? 200 : 409, {\n ok,\n classification: ok ? \"RECEIPT_CONSUMED_CANARY_ONLY\" : \"RECEIPT_REJECTED_CANARY_ONLY\",\n });\n }\n return json(404, { ok: false, reason: \"NOT_FOUND\" });\n}\n",[146],"c0671a8d-4142-430c-beb3-647eade8b96c",["D",1789322922132],[27],"d9ba6986-c938-4033-9256-fd82cacd977b","db_concurrency_selftest.ts","f179cdfe-af9d-11f1-946f-1607ee4eb77e",5,["D",1789322832109],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS work_webbotauth_receipts_v1(\n signed_nonce TEXT PRIMARY KEY,\n agent_id TEXT NOT NULL,\n receipt_sha256 TEXT NOT NULL UNIQUE,\n signature_keyid TEXT NOT NULL,\n signature_created_ms INTEGER NOT NULL,\n signature_expires_ms INTEGER NOT NULL,\n issued_at_ms INTEGER NOT NULL,\n receipt_expires_at_ms INTEGER NOT NULL,\n used_at_ms INTEGER\n)`);\nconst nonce = `wba1-concurrent-${crypto.randomUUID()}`;\nconst attempts = await Promise.allSettled(Array.from({length:16}, async (_,i) => {\n return await sqlite.execute({sql:`INSERT INTO work_webbotauth_receipts_v1(\n signed_nonce,agent_id,receipt_sha256,signature_keyid,signature_created_ms,\n signature_expires_ms,issued_at_ms,receipt_expires_at_ms,used_at_ms\n ) VALUES(?,?,?,?,?,?,?,?,NULL)`, args:[nonce,\"agent-A\",`${String(i).padStart(2,\"0\")}${\"d\".repeat(62)}`,\"test-key\",1,999999,1,9999999999999]});\n}));\nconst q:any = await sqlite.execute({sql:\"SELECT COUNT(*) AS n, MIN(receipt_sha256) AS winner FROM work_webbotauth_receipts_v1 WHERE signed_nonce=?\",args:[nonce]});\nconst fulfilled = attempts.filter(x=>x.status===\"fulfilled\").length;\nconst rejected = attempts.filter(x=>x.status===\"rejected\").length;\nconst row = q.rows?.[0] ?? {};\nconsole.log(JSON.stringify({schema:\"WORK_WEBBOTAUTH_CONCURRENT_NONCE_SELFTEST_V1\",attempts:16,fulfilled,rejected,rows_for_nonce:Number(row.n??-1),winner:row.winner,pass:fulfilled===1 && rejected===15 && Number(row.n)===1,rejection_samples:attempts.filter(x=>x.status===\"rejected\").slice(0,3).map((x:any)=>String(x.reason?.message??x.reason))},null,2));",[155],"7cf78841-9a67-4b60-a190-b7ea3dd84144","crypto_selftest.ts","dc3cb348-af9d-11f1-8952-1607ee4eb77e",4,["D",1789322796448],"import { generateNonce, sign, verify, type SignatureFields, type VerifiedWebBotSignature } from \"npm:web-bot-auth@0.2.0\";\nimport { signerFromJWK, verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst TEST_JWK: JsonWebKey = {\n kty: \"OKP\", crv: \"Ed25519\", kid: \"test-key-ed25519\", alg: \"EdDSA\",\n d: \"n4Ni-HpISpVObnQMW0wOhCKROaIKqKtW_2ZYb2p9KcU\",\n x: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\nconst OPENAI_AGENT = \"https://chatgpt.com\";\nconst LIVE_URL = \"https://mosadek--2a72cbfcaf9d11f1b5091607ee4eb77e.web.val.run/attest-work?agent_id=chat-unproven-gpt56sol-20260913-1946-bbn-a91\";\n\nfunction withSignature(request: Request, fields: SignatureFields): Request {\n const headers = new Headers(request.headers);\n headers.set(\"signature\", fields.signature);\n headers.set(\"signature-input\", fields.signatureInput);\n return new Request(request, { headers });\n}\nfunction exactOpenAIAgent(sig: VerifiedWebBotSignature): boolean {\n const a: any = sig.signatureAgent;\n return !!a && a.type === \"directory\" && a.uri === OPENAI_AGENT;\n}\nasync function candidateVerify(request: Request, verifier: any, now = new Date()) {\n return await verify(request, {\n algorithms: [\"ed25519\", \"rsa-pss-sha512\"], maxAge: 120, clockSkew: 10, now,\n resolver: () => verifier,\n validate(sig) { return sig.nonce !== undefined && exactOpenAIAgent(sig as any); },\n });\n}\nasync function mustReject(name: string, fn: () => Promise, out: any[]) {\n try { await fn(); out.push({ name, ok: false, reason: \"UNEXPECTED_ACCEPT\" }); }\n catch (e) { out.push({ name, ok: true, rejection: String((e as Error)?.message ?? e) }); }\n}\n\nconst results: any[] = [];\nconst signer = await signerFromJWK(TEST_JWK);\nconst verifier = await verifierFromJWK(TEST_JWK);\nconst now = new Date();\nconst created = new Date(now.getTime() - 1000);\nconst expires = new Date(now.getTime() + 60_000);\nconst nonce = generateNonce();\nconst headers = new Headers({ \"signature-agent\": `\"${OPENAI_AGENT}\"` });\nconst base = new Request(LIVE_URL, { headers });\nconst fields = await sign(base, { signer, created, expires, nonce });\nconst signed = withSignature(base, fields);\ntry {\n const v = await candidateVerify(signed, verifier, now);\n results.push({ name: \"synthetic valid signed request\", ok: v.nonce === nonce && exactOpenAIAgent(v as any), keyid: v.keyid, nonce: v.nonce, signatureAgent: v.signatureAgent, covered: v.components.map((c:any)=>c.name) });\n} catch (e) { results.push({ name: \"synthetic valid signed request\", ok: false, error: String((e as Error)?.message ?? e) }); }\n\nconst badHeaders = new Headers(signed.headers);\nconst originalSignature = badHeaders.get(\"signature\")!;\nbadHeaders.set(\"signature\", originalSignature.replace(/:([A-Za-z0-9+/])/, (_m, c) => `:${c === \"A\" ? \"B\" : \"A\"}`));\nawait mustReject(\"bad signature\", () => candidateVerify(new Request(signed, { headers: badHeaders }), verifier, now), results);\n\nconst wrongAgentBase = new Request(LIVE_URL, { headers: { \"signature-agent\": '\"https://evil.example\"' } });\nconst wrongAgentFields = await sign(wrongAgentBase, { signer, created, expires, nonce: generateNonce() });\nawait mustReject(\"wrong Signature-Agent\", () => candidateVerify(withSignature(wrongAgentBase, wrongAgentFields), verifier, now), results);\n\nawait mustReject(\"unknown key\", () => verify(signed, {\n algorithms:[\"ed25519\",\"rsa-pss-sha512\"], maxAge:120, clockSkew:10, now,\n resolver: async () => { throw new Error(\"OPENAI_SIGNING_KEY_NOT_FOUND\"); },\n validate(sig) { return sig.nonce !== undefined && exactOpenAIAgent(sig as any); },\n}), results);\n\nconst oldCreated = new Date(now.getTime() - 300_000);\nconst oldExpires = new Date(now.getTime() + 60_000);\nconst oldFields = await sign(base, { signer, created: oldCreated, expires: oldExpires, nonce: generateNonce() });\nawait mustReject(\"too-old signature\", () => candidateVerify(withSignature(base, oldFields), verifier, now), results);\n\nconst expiredCreated = new Date(now.getTime() - 60_000);\nconst expiredExpires = new Date(now.getTime() - 20_000);\nconst expiredFields = await sign(base, { signer, created: expiredCreated, expires: expiredExpires, nonce: generateNonce() });\nawait mustReject(\"expired signature\", () => candidateVerify(withSignature(base, expiredFields), verifier, now), results);\n\nconst noNonceFields = await sign(base, { signer, created, expires });\nawait mustReject(\"missing signed nonce\", () => candidateVerify(withSignature(base, noNonceFields), verifier, now), results);\n\nconst pass = results.filter(x=>x.ok).length;\nconsole.log(JSON.stringify({\n schema:\"WORK_WEBBOTAUTH_CRYPTO_SELFTEST_V1\",\n source_package:\"web-bot-auth@0.2.0\",\n total:results.length, pass, fail:results.length-pass,\n results,\n live_synthetic_headers:{\"signature-agent\":`\"${OPENAI_AGENT}\"`,signature:fields.signature,\"signature-input\":fields.signatureInput},\n note:\"Synthetic test key proves library/profile behavior only; it is not OpenAI Work provenance.\"\n}, null, 2));",[162],"pulls","branches","forks","envVars",{"_175":61,"_177":61},"connections",{"_175":61,"_176":61},"count","unfilledCount","emptyCount",{"_41":161,"_31":162,"_29":163,"_137":-5,"_39":40,"_38":164,"_139":57,"_36":196,"_13":61,"_32":33,"_34":166,"_23":24,"_143":-5,"_184":197,"_26":198},{"_41":154,"_31":155,"_29":156,"_137":-5,"_39":40,"_38":157,"_139":24,"_36":193,"_13":61,"_32":33,"_34":159,"_23":24,"_143":-5,"_184":194,"_26":195},{"_41":151,"_31":27,"_29":30,"_137":-5,"_39":40,"_38":14,"_139":57,"_36":190,"_13":61,"_32":33,"_34":35,"_23":24,"_143":-5,"_184":191,"_26":192},{"_41":145,"_31":146,"_29":55,"_137":-5,"_39":40,"_38":141,"_139":24,"_36":187,"_13":61,"_32":148,"_34":149,"_23":24,"_143":-5,"_184":188,"_26":189},{"_41":134,"_31":135,"_29":136,"_137":-5,"_39":40,"_38":138,"_139":57,"_36":183,"_13":141,"_32":33,"_34":142,"_23":24,"_143":-5,"_184":185,"_26":186},["D",1789322591881],"children",[],[135],["D",1789322498182],[],[146],["D",1789322922132],[],[27],["D",1789322832109],[],[155],["D",1789322796448],[],[162],["D",1789322498116],["D",1789497078049],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"ctx",{"_80":-5,"_126":237,"_238":239,"_240":241,"_242":24,"_243":24,"_244":24,"_245":57,"_246":-5,"_247":-7,"_248":-7,"_249":61,"_250":24,"_251":24,"_252":-5,"_253":24,"_254":24,"_255":24,"_256":-5},"ENV",{"_208":209,"_210":211,"_212":88,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v6