[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_216":217,"_218":219},"routes/_app.x.$handle.$name",{"_98":97,"_31":43,"_107":88,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":57,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",7,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","wba1_selftest.ts","latestPath","fileId","2aff8564-af9e-11f1-9be9-1607ee4eb77e","name","fileType","script","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { generateNonce, sign, verify } from \"npm:web-bot-auth@0.2.0\";\nimport { signerFromJWK, verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst EXPECTED_MAIN_BYTES = 9295;\nconst EXPECTED_MAIN_SHA256 = \"197e37e592cbd9c9915f3eafcbf58951e2193aa97dffb754c6cae9714139d334\";\nconst GOOD_AGENT = \"https://signature-agent.test\";\nconst GOOD_AGENT_HEADER = `sig1=\"${GOOD_AGENT}\";type=directory`;\nconst TEST_PRIVATE: JsonWebKey = {\n kty: \"OKP\", crv: \"Ed25519\", alg: \"EdDSA\", kid: \"test-key-ed25519\",\n d: \"n4Ni-HpISpVObnQMW0wOhCKROaIKqKtW_2ZYb2p9KcU\",\n x: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\nconst TEST_PUBLIC: JsonWebKey = {\n kty: \"OKP\", crv: \"Ed25519\", alg: \"EdDSA\", kid: \"test-key-ed25519\",\n x: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\n\nasync function sha256(text: string) {\n const d = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n return [...new Uint8Array(d)].map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction assert(ok: unknown, name: string, detail?: unknown) {\n if (!ok) throw new Error(`${name}: ${JSON.stringify(detail ?? null)}`);\n return { name, ok: true };\n}\nasync function expectReject(name: string, fn: () => Promise) {\n try { await fn(); return { name, ok: false, detail: \"unexpected_accept\" }; }\n catch (e) { return { name, ok: true, detail: String((e as Error)?.message ?? e) }; }\n}\nasync function signedRequest(opts: { agentHeader?: string; created?: Date; expires?: Date; nonce?: string | null } = {}) {\n const agentHeader = opts.agentHeader ?? GOOD_AGENT_HEADER;\n const req = new Request(\"https://example.com/attest\", { headers: { \"Signature-Agent\": agentHeader } });\n const now = new Date();\n const fields = await sign(req, {\n signer: await signerFromJWK(TEST_PRIVATE),\n created: opts.created ?? now,\n expires: opts.expires ?? new Date(now.getTime() + 60_000),\n ...(opts.nonce === null ? {} : { nonce: opts.nonce ?? generateNonce() }),\n });\n return new Request(req.url, { headers: {\n Signature: fields.signature,\n \"Signature-Input\": fields.signatureInput,\n \"Signature-Agent\": agentHeader,\n }});\n}\nasync function localVerify(req: Request, requireGoodAgent = true) {\n const verifier = await verifierFromJWK(TEST_PUBLIC);\n return await verify(req, {\n algorithms: [\"ed25519\", \"rsa-pss-sha512\"],\n maxAge: 120,\n clockSkew: 10,\n resolver(candidate) {\n if (candidate.keyid !== verifier.keyid) throw new Error(\"unknown key\");\n return verifier;\n },\n validate(sig) {\n if (!sig.nonce) return false;\n if (!requireGoodAgent) return true;\n return sig.signatureAgent?.type === \"directory\" && sig.signatureAgent.uri === GOOD_AGENT;\n },\n });\n}\n\nconst results: any[] = [];\nconst mainSource = await readFile(\"/main.ts\", import.meta.url);\nconst mainBytes = new TextEncoder().encode(mainSource).length;\nconst mainSha = await sha256(mainSource);\nresults.push(assert(mainBytes === EXPECTED_MAIN_BYTES, \"candidate bytes exact\", { mainBytes }));\nresults.push(assert(mainSha === EXPECTED_MAIN_SHA256, \"candidate sha exact\", { mainSha }));\n\nconst valid = await signedRequest();\nconst verified: any = await localVerify(valid);\nresults.push(assert(Boolean(verified?.nonce), \"synthetic valid signed request passes\"));\n\nconst badHeaders = new Headers(valid.headers);\nconst oldSig = badHeaders.get(\"Signature\")!;\nbadHeaders.set(\"Signature\", oldSig.slice(0, -2) + (oldSig.endsWith(\"AA\") ? \"BB\" : \"AA\"));\nresults.push(await expectReject(\"bad signature rejected\", () => localVerify(new Request(valid.url, { headers: badHeaders }))));\n\nconst wrongAgent = await signedRequest({ agentHeader: 'sig1=\"https://evil.example\";type=directory' });\nresults.push(await expectReject(\"wrong Signature-Agent rejected\", () => localVerify(wrongAgent)));\n\nresults.push(await expectReject(\"unknown key rejected\", async () => verify(valid, {\n algorithms: [\"ed25519\"], maxAge: 120, clockSkew: 10,\n resolver() { throw new Error(\"unknown key\"); },\n})));\n\nconst oldCreated = new Date(Date.now() - 600_000);\nconst oldExpires = new Date(Date.now() - 300_000);\nconst expired = await signedRequest({ created: oldCreated, expires: oldExpires });\nresults.push(await expectReject(\"expired/too-old signature rejected\", () => localVerify(expired)));\n\nconst noNonce = await signedRequest({ nonce: null });\nresults.push(await expectReject(\"missing signed nonce rejected\", () => localVerify(noNonce)));\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS wba1_replay_selftest_v1(\n signed_nonce TEXT PRIMARY KEY,\n agent_id TEXT NOT NULL,\n receipt_sha256 TEXT NOT NULL UNIQUE,\n issued_at_ms INTEGER NOT NULL,\n receipt_expires_at_ms INTEGER NOT NULL,\n used_at_ms INTEGER\n)`);\nconst suffix = crypto.randomUUID();\nconst nonce = `nonce-${suffix}`;\nconst now = Date.now();\nconst concurrent = await Promise.allSettled([1, 2].map(async i => sqlite.execute({\n sql: `INSERT INTO wba1_replay_selftest_v1(signed_nonce,agent_id,receipt_sha256,issued_at_ms,receipt_expires_at_ms,used_at_ms) VALUES(?,?,?,?,?,NULL)`,\n args: [nonce, \"agent-a\", await sha256(`receipt-${suffix}-${i}`), now, now + 120_000],\n})));\nconst fulfilled = concurrent.filter(x => x.status === \"fulfilled\").length;\nconst rejected = concurrent.filter(x => x.status === \"rejected\").length;\nresults.push(assert(fulfilled === 1 && rejected === 1, \"concurrent nonce replay admits exactly one\", { fulfilled, rejected }));\n\nconst receipt = `receipt-main-${suffix}`;\nconst receiptHash = await sha256(receipt);\nconst nonce2 = `nonce-receipt-${suffix}`;\nawait sqlite.execute({\n sql: `INSERT INTO wba1_replay_selftest_v1(signed_nonce,agent_id,receipt_sha256,issued_at_ms,receipt_expires_at_ms,used_at_ms) VALUES(?,?,?,?,?,NULL)`,\n args: [nonce2, \"agent-right\", receiptHash, now, now + 120_000],\n});\nasync function consume(r: string, agent: string) {\n const h = await sha256(r);\n const t = Date.now();\n const q: any = await sqlite.execute({\n sql: `UPDATE wba1_replay_selftest_v1 SET used_at_ms=? WHERE receipt_sha256=? AND agent_id=? AND used_at_ms IS NULL AND receipt_expires_at_ms>=? RETURNING signed_nonce`,\n args: [t, h, agent, t],\n });\n return Array.isArray(q.rows) && q.rows.length === 1;\n}\nresults.push(assert(!(await consume(receipt, \"agent-wrong\")), \"wrong-agent receipt rejected\"));\nresults.push(assert(await consume(receipt, \"agent-right\"), \"right-agent receipt accepted once\"));\nresults.push(assert(!(await consume(receipt, \"agent-right\")), \"receipt replay rejected\"));\n\nconst expiredReceipt = `receipt-expired-${suffix}`;\nawait sqlite.execute({\n sql: `INSERT INTO wba1_replay_selftest_v1(signed_nonce,agent_id,receipt_sha256,issued_at_ms,receipt_expires_at_ms,used_at_ms) VALUES(?,?,?,?,?,NULL)`,\n args: [`nonce-expired-${suffix}`, \"agent-right\", await sha256(expiredReceipt), now - 10_000, now - 1],\n});\nresults.push(assert(!(await consume(expiredReceipt, \"agent-right\")), \"expired receipt rejected\"));\n\nconst directoryRes = await fetch(\"https://chatgpt.com/.well-known/http-message-signatures-directory\", {\n headers: { Accept: \"application/http-message-signatures-directory+json, application/json;q=0.9\" },\n redirect: \"error\",\n});\nconst directoryText = await directoryRes.text();\nlet directory: any = null;\ntry { directory = JSON.parse(directoryText); } catch {}\nresults.push(assert(directoryRes.ok && Array.isArray(directory?.keys) && directory.keys.length > 0, \"live OpenAI signing directory reachable\", { status: directoryRes.status, keyCount: directory?.keys?.length ?? 0 }));\n\nconst summary = {\n schema: \"WBA1_ISOLATED_CRYPTO_AND_REPLAY_SELFTEST_V1\",\n ok: results.every(r => r.ok),\n pass: results.filter(r => r.ok).length,\n total: results.length,\n candidate: { bytes: mainBytes, sha256: mainSha },\n package: \"web-bot-auth@0.2.0\",\n results,\n trust_limits: {\n proves_real_chatgpt_work: false,\n work_cloud_runtime_admission: false,\n p_real: false,\n independence: false,\n human_authority_approval: false,\n },\n};\nconsole.log(JSON.stringify(summary, null, 2));\nexport default summary;\n","createdAt",["D",1789322928527],"branchVersion","branchId","d14bf048-fc63-4ed3-8b85-fd638d355c00","id","957e5128-9177-49d7-a4f3-6a71d16c1656","work-webbotauth-isolated-canary",["D",1789322498116],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Isolated ChatGPT Work Web Bot Auth canary","imageUrl","6be0fc5c-1fef-4bd6-a1e1-67a3f8c0764e","pinnedFileId","2a72cbfc-af9d-11f1-b509-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0715b-703f-741f-ab35-c85020e4a5e0","tursoName","957e5128917749d7a4f36a71d16c1656","tursoHostname","957e5128917749d7a4f36a71d16c1656-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789497078049],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"isOwned",13,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mosadek","handle","displayName","Mo Sadek","avatar","https://lh3.googleusercontent.com/a/ACg8ocL1eT_LHhKSg5px3nXIO6eez79aZXef466qXKh2gak-0iwrvw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":211,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":212,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":213,"_82":214,"_84":215,"_86":24},"tree",[186,187,188,189,190,191],"files",[186,187,188,189,190,191],"counts",{"_176":61,"_177":146,"_178":61,"_179":180,"_181":182},"contents",[129,130,131,132,133,134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":169,"_31":170,"_29":171,"_136":-5,"_39":40,"_38":172,"_137":57,"_36":173,"_13":61,"_32":33,"_34":174,"_23":24,"_139":-5,"_26":175},{"_41":162,"_31":163,"_29":164,"_136":-5,"_39":40,"_38":165,"_137":24,"_36":166,"_13":61,"_32":33,"_34":167,"_23":24,"_139":-5,"_26":168},{"_41":155,"_31":156,"_29":157,"_136":-5,"_39":40,"_38":158,"_137":57,"_36":159,"_13":61,"_32":33,"_34":160,"_23":24,"_139":-5,"_26":161},{"_41":149,"_31":150,"_29":55,"_136":-5,"_39":40,"_38":146,"_137":24,"_36":151,"_13":61,"_32":152,"_34":153,"_23":24,"_139":-5,"_26":154},{"_41":141,"_31":142,"_29":143,"_136":-5,"_39":40,"_38":144,"_137":57,"_36":145,"_13":146,"_32":33,"_34":147,"_23":24,"_139":-5,"_26":148},{"_41":135,"_31":27,"_29":30,"_136":-5,"_39":40,"_38":14,"_137":24,"_36":138,"_13":61,"_32":33,"_34":35,"_23":24,"_139":-5,"_26":140},"42dd54fb-d851-4a8b-9af5-71b4bb4fe7a6","parentId","latest",["D",1789322928527],"label",[27],"6ef02103-210e-403d-b9f8-509966b9f5dc","probe_api.ts","4410ee90-af9d-11f1-a468-1607ee4eb77e",3,["D",1789322591881],1,"import * as W from \"npm:web-bot-auth@0.2.0\";\nimport * as C from \"npm:web-bot-auth@0.2.0/crypto\";\nconsole.log(JSON.stringify({web:Object.keys(W).sort(),crypto:Object.keys(C).sort(),sign:String((W as any).sign).slice(0,2200),verify:String((W as any).verify).slice(0,1800),signerFromJWK:String((C as any).signerFromJWK).slice(0,1200)},null,2));",[142],"8abf7ca2-8eb0-4937-897a-0b52753b63e1","main.ts",["D",1789322498182],"http","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n HTTP_MESSAGE_SIGNATURES_DIRECTORY,\n verify,\n type UntrustedWebBotSignatureCandidate,\n type VerifiedWebBotSignature,\n} from \"npm:web-bot-auth@0.2.0\";\nimport { verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst OPENAI_SIGNATURE_AGENT = \"https://chatgpt.com\";\nconst OPENAI_DIRECTORY = `${OPENAI_SIGNATURE_AGENT}${HTTP_MESSAGE_SIGNATURES_DIRECTORY}`;\nconst DIRECTORY_MEDIA_TYPE = \"application/http-message-signatures-directory+json\";\nconst MAX_DIRECTORY_KEYS = 100;\nconst MAX_SIGNATURE_AGE_SECONDS = 120;\nconst CLOCK_SKEW_SECONDS = 10;\nconst RECEIPT_TTL_SECONDS = 120;\nconst AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;\n\ntype DirectoryKey = JsonWebKey & { kid?: string; nbf?: number; exp?: number };\ntype Directory = { keys: DirectoryKey[]; purpose?: string };\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n let binary = \"\";\n for (const b of bytes) binary += String.fromCharCode(b);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomReceipt(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return bytesToBase64Url(bytes);\n}\n\nasync function sha256Hex(text: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction exactOpenAIAgentURI(uri: string): boolean {\n try {\n const u = new URL(uri);\n return u.protocol === \"https:\" && u.hostname === \"chatgpt.com\" && u.port === \"\" &&\n u.username === \"\" && u.password === \"\" &&\n (u.pathname === \"/\" || u.pathname === \"\") && u.search === \"\" && u.hash === \"\";\n } catch {\n return false;\n }\n}\n\nfunction parseDirectory(value: unknown): Directory {\n if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"DIRECTORY_NOT_OBJECT\");\n const obj = value as Record;\n if (!Array.isArray(obj.keys) || obj.keys.length < 1) throw new Error(\"DIRECTORY_KEYS_REQUIRED\");\n if (obj.keys.length > MAX_DIRECTORY_KEYS) throw new Error(\"DIRECTORY_TOO_MANY_KEYS\");\n const keys: DirectoryKey[] = [];\n for (const candidate of obj.keys) {\n if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) throw new Error(\"DIRECTORY_KEY_NOT_OBJECT\");\n const key = candidate as DirectoryKey;\n if (typeof key.kty !== \"string\") throw new Error(\"DIRECTORY_KEY_KTY_REQUIRED\");\n keys.push(key);\n }\n return { keys, purpose: typeof obj.purpose === \"string\" ? obj.purpose : undefined };\n}\n\nfunction keyTimeValid(key: DirectoryKey, nowMs: number): boolean {\n if (key.nbf !== undefined && (!Number.isFinite(key.nbf) || nowMs < Number(key.nbf))) return false;\n if (key.exp !== undefined && (!Number.isFinite(key.exp) || nowMs >= Number(key.exp))) return false;\n return true;\n}\n\nasync function fetchOpenAIDirectory(): Promise {\n const res = await fetch(OPENAI_DIRECTORY, {\n method: \"GET\",\n headers: { Accept: `${DIRECTORY_MEDIA_TYPE}, application/json;q=0.9` },\n redirect: \"error\",\n });\n if (!res.ok) throw new Error(`OPENAI_DIRECTORY_HTTP_${res.status}`);\n const raw = await res.text();\n let parsed: unknown;\n try { parsed = JSON.parse(raw); } catch { throw new Error(\"OPENAI_DIRECTORY_BAD_JSON\"); }\n return parseDirectory(parsed);\n}\n\nasync function resolveOpenAIVerifier(candidate: UntrustedWebBotSignatureCandidate) {\n const entry = candidate.signatureAgent;\n if (entry === undefined || entry.type !== \"directory\" || !exactOpenAIAgentURI(entry.uri)) {\n throw new Error(\"SIGNATURE_AGENT_NOT_EXACT_CHATGPT\");\n }\n const directory = await fetchOpenAIDirectory();\n const nowMs = Date.now();\n for (const key of directory.keys) {\n if (!keyTimeValid(key, nowMs)) continue;\n try {\n const verifier = await verifierFromJWK(key);\n if (verifier.keyid === candidate.keyid) return verifier;\n } catch {\n // Fail closed by ignoring malformed or unsupported entries.\n }\n }\n throw new Error(\"OPENAI_SIGNING_KEY_NOT_FOUND\");\n}\n\nasync function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS work_webbotauth_receipts_v1(\n signed_nonce TEXT PRIMARY KEY,\n agent_id TEXT NOT NULL,\n receipt_sha256 TEXT NOT NULL UNIQUE,\n signature_keyid TEXT NOT NULL,\n signature_created_ms INTEGER NOT NULL,\n signature_expires_ms INTEGER NOT NULL,\n issued_at_ms INTEGER NOT NULL,\n receipt_expires_at_ms INTEGER NOT NULL,\n used_at_ms INTEGER\n )`);\n}\n\nasync function mintReceiptFromVerifiedRequest(request: Request, agentId: string) {\n if (!AGENT_ID_RE.test(agentId)) throw new Error(\"AGENT_ID_INVALID\");\n const verified: VerifiedWebBotSignature = await verify(request, {\n algorithms: [\"ed25519\", \"rsa-pss-sha512\"],\n maxAge: MAX_SIGNATURE_AGE_SECONDS,\n clockSkew: CLOCK_SKEW_SECONDS,\n resolver: resolveOpenAIVerifier,\n validate(signature) {\n if (signature.nonce === undefined) return false;\n const entry = signature.signatureAgent;\n if (entry === undefined || entry.type !== \"directory\" || !exactOpenAIAgentURI(entry.uri)) return false;\n const now = Date.now();\n if (signature.created.getTime() > now + CLOCK_SKEW_SECONDS * 1000) return false;\n if (signature.expires.getTime() < now - CLOCK_SKEW_SECONDS * 1000) return false;\n return true;\n },\n });\n if (!verified.nonce) throw new Error(\"SIGNED_NONCE_REQUIRED\");\n\n const receipt = randomReceipt();\n const receiptSha256 = await sha256Hex(receipt);\n const issuedAtMs = Date.now();\n const receiptExpiresAtMs = issuedAtMs + RECEIPT_TTL_SECONDS * 1000;\n const targetUriCovered = verified.components.some(\n (component) => component.name === \"@target-uri\" && Object.keys(component.parameters).length === 0,\n );\n\n await ensureTables();\n try {\n await sqlite.execute({\n sql: `INSERT INTO work_webbotauth_receipts_v1(\n signed_nonce,agent_id,receipt_sha256,signature_keyid,signature_created_ms,\n signature_expires_ms,issued_at_ms,receipt_expires_at_ms,used_at_ms\n ) VALUES(?,?,?,?,?,?,?,?,NULL)`,\n args: [\n verified.nonce, agentId, receiptSha256, verified.keyid,\n verified.created.getTime(), verified.expires.getTime(), issuedAtMs, receiptExpiresAtMs,\n ],\n });\n } catch (error) {\n const message = String((error as Error)?.message ?? error);\n if (/UNIQUE|constraint/i.test(message)) throw new Error(\"SIGNED_NONCE_REPLAY\");\n throw error;\n }\n\n return {\n receipt,\n receipt_expires_at: new Date(receiptExpiresAtMs).toISOString(),\n signature_keyid: verified.keyid,\n signature_created_at: verified.created.toISOString(),\n signature_expires_at: verified.expires.toISOString(),\n target_uri_covered: targetUriCovered,\n };\n}\n\nasync function consumeReceipt(receipt: string, agentId: string): Promise {\n if (!AGENT_ID_RE.test(agentId) || receipt.length < 20 || receipt.length > 256) return false;\n const receiptSha256 = await sha256Hex(receipt);\n const nowMs = Date.now();\n await ensureTables();\n const result: any = await sqlite.execute({\n sql: `UPDATE work_webbotauth_receipts_v1 SET used_at_ms=?\n WHERE receipt_sha256=? AND agent_id=? AND used_at_ms IS NULL\n AND receipt_expires_at_ms>=? RETURNING signed_nonce`,\n args: [nowMs, receiptSha256, agentId, nowMs],\n });\n return Array.isArray(result.rows) && result.rows.length === 1;\n}\n\nfunction json(status: number, body: unknown): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}\n\nexport default async function handler(request: Request): Promise {\n const url = new URL(request.url);\n if (request.method === \"GET\" && url.pathname === \"/attest-work\") {\n const agentId = url.searchParams.get(\"agent_id\") ?? \"\";\n try {\n const out = await mintReceiptFromVerifiedRequest(request, agentId);\n return json(200, {\n ok: true,\n classification: \"CHATGPT_SIGNED_BROWSER_RECEIPT_MINTED_CANDIDATE_ONLY\",\n ...out,\n trust_limits: {\n work_cloud_runtime_production_admission: false,\n execution_distinct: false,\n independent_verification: false,\n p_real: false,\n human_authority_approval: false,\n production_qualified: false,\n },\n });\n } catch (error) {\n return json(401, {\n ok: false,\n classification: \"WORK_WEBBOTAUTH_ATTESTATION_REJECTED\",\n reason: String((error as Error)?.message ?? error),\n });\n }\n }\n\n // Canary only. Production admission must consume the receipt in the\n // authority-selected registration/reconciliation transaction.\n if (request.method === \"POST\" && url.pathname === \"/consume-canary\") {\n let body: any;\n try { body = await request.json(); } catch { return json(400, { ok: false, reason: \"BAD_JSON\" }); }\n const ok = await consumeReceipt(String(body?.receipt ?? \"\"), String(body?.agent_id ?? \"\"));\n return json(ok ? 200 : 409, {\n ok,\n classification: ok ? \"RECEIPT_CONSUMED_CANARY_ONLY\" : \"RECEIPT_REJECTED_CANARY_ONLY\",\n });\n }\n return json(404, { ok: false, reason: \"NOT_FOUND\" });\n}\n",[150],"c0671a8d-4142-430c-beb3-647eade8b96c","directory_probe.ts","27412572-af9e-11f1-8124-1607ee4eb77e",6,["D",1789322922132],"const url=\"https://chatgpt.com/.well-known/http-message-signatures-directory\";\nconst res=await fetch(url,{headers:{accept:\"application/http-message-signatures-directory+json, application/json;q=0.9\"},redirect:\"error\"});\nconst text=await res.text();\nlet parsed:any=null; let parse_error:string|null=null;\ntry{parsed=JSON.parse(text)}catch(e){parse_error=String((e as Error)?.message??e)}\nconst keys=Array.isArray(parsed?.keys)?parsed.keys:[];\nconsole.log(JSON.stringify({schema:\"OPENAI_WEBBOTAUTH_DIRECTORY_LIVE_PROBE_V1\",status:res.status,ok:res.ok,content_type:res.headers.get(\"content-type\"),cache_control:res.headers.get(\"cache-control\"),parse_error,purpose:parsed?.purpose??null,key_count:keys.length,keys:keys.slice(0,20).map((k:any)=>({kid:k.kid??null,kty:k.kty??null,crv:k.crv??null,alg:k.alg??null,nbf:k.nbf??null,exp:k.exp??null,x_present:typeof k.x===\"string\",n_present:typeof k.n===\"string\"}))},null,2));",[156],"d9ba6986-c938-4033-9256-fd82cacd977b","db_concurrency_selftest.ts","f179cdfe-af9d-11f1-946f-1607ee4eb77e",5,["D",1789322832109],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS work_webbotauth_receipts_v1(\n signed_nonce TEXT PRIMARY KEY,\n agent_id TEXT NOT NULL,\n receipt_sha256 TEXT NOT NULL UNIQUE,\n signature_keyid TEXT NOT NULL,\n signature_created_ms INTEGER NOT NULL,\n signature_expires_ms INTEGER NOT NULL,\n issued_at_ms INTEGER NOT NULL,\n receipt_expires_at_ms INTEGER NOT NULL,\n used_at_ms INTEGER\n)`);\nconst nonce = `wba1-concurrent-${crypto.randomUUID()}`;\nconst attempts = await Promise.allSettled(Array.from({length:16}, async (_,i) => {\n return await sqlite.execute({sql:`INSERT INTO work_webbotauth_receipts_v1(\n signed_nonce,agent_id,receipt_sha256,signature_keyid,signature_created_ms,\n signature_expires_ms,issued_at_ms,receipt_expires_at_ms,used_at_ms\n ) VALUES(?,?,?,?,?,?,?,?,NULL)`, args:[nonce,\"agent-A\",`${String(i).padStart(2,\"0\")}${\"d\".repeat(62)}`,\"test-key\",1,999999,1,9999999999999]});\n}));\nconst q:any = await sqlite.execute({sql:\"SELECT COUNT(*) AS n, MIN(receipt_sha256) AS winner FROM work_webbotauth_receipts_v1 WHERE signed_nonce=?\",args:[nonce]});\nconst fulfilled = attempts.filter(x=>x.status===\"fulfilled\").length;\nconst rejected = attempts.filter(x=>x.status===\"rejected\").length;\nconst row = q.rows?.[0] ?? {};\nconsole.log(JSON.stringify({schema:\"WORK_WEBBOTAUTH_CONCURRENT_NONCE_SELFTEST_V1\",attempts:16,fulfilled,rejected,rows_for_nonce:Number(row.n??-1),winner:row.winner,pass:fulfilled===1 && rejected===15 && Number(row.n)===1,rejection_samples:attempts.filter(x=>x.status===\"rejected\").slice(0,3).map((x:any)=>String(x.reason?.message??x.reason))},null,2));",[163],"7cf78841-9a67-4b60-a190-b7ea3dd84144","crypto_selftest.ts","dc3cb348-af9d-11f1-8952-1607ee4eb77e",4,["D",1789322796448],"import { generateNonce, sign, verify, type SignatureFields, type VerifiedWebBotSignature } from \"npm:web-bot-auth@0.2.0\";\nimport { signerFromJWK, verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst TEST_JWK: JsonWebKey = {\n kty: \"OKP\", crv: \"Ed25519\", kid: \"test-key-ed25519\", alg: \"EdDSA\",\n d: \"n4Ni-HpISpVObnQMW0wOhCKROaIKqKtW_2ZYb2p9KcU\",\n x: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\nconst OPENAI_AGENT = \"https://chatgpt.com\";\nconst LIVE_URL = \"https://mosadek--2a72cbfcaf9d11f1b5091607ee4eb77e.web.val.run/attest-work?agent_id=chat-unproven-gpt56sol-20260913-1946-bbn-a91\";\n\nfunction withSignature(request: Request, fields: SignatureFields): Request {\n const headers = new Headers(request.headers);\n headers.set(\"signature\", fields.signature);\n headers.set(\"signature-input\", fields.signatureInput);\n return new Request(request, { headers });\n}\nfunction exactOpenAIAgent(sig: VerifiedWebBotSignature): boolean {\n const a: any = sig.signatureAgent;\n return !!a && a.type === \"directory\" && a.uri === OPENAI_AGENT;\n}\nasync function candidateVerify(request: Request, verifier: any, now = new Date()) {\n return await verify(request, {\n algorithms: [\"ed25519\", \"rsa-pss-sha512\"], maxAge: 120, clockSkew: 10, now,\n resolver: () => verifier,\n validate(sig) { return sig.nonce !== undefined && exactOpenAIAgent(sig as any); },\n });\n}\nasync function mustReject(name: string, fn: () => Promise, out: any[]) {\n try { await fn(); out.push({ name, ok: false, reason: \"UNEXPECTED_ACCEPT\" }); }\n catch (e) { out.push({ name, ok: true, rejection: String((e as Error)?.message ?? e) }); }\n}\n\nconst results: any[] = [];\nconst signer = await signerFromJWK(TEST_JWK);\nconst verifier = await verifierFromJWK(TEST_JWK);\nconst now = new Date();\nconst created = new Date(now.getTime() - 1000);\nconst expires = new Date(now.getTime() + 60_000);\nconst nonce = generateNonce();\nconst headers = new Headers({ \"signature-agent\": `\"${OPENAI_AGENT}\"` });\nconst base = new Request(LIVE_URL, { headers });\nconst fields = await sign(base, { signer, created, expires, nonce });\nconst signed = withSignature(base, fields);\ntry {\n const v = await candidateVerify(signed, verifier, now);\n results.push({ name: \"synthetic valid signed request\", ok: v.nonce === nonce && exactOpenAIAgent(v as any), keyid: v.keyid, nonce: v.nonce, signatureAgent: v.signatureAgent, covered: v.components.map((c:any)=>c.name) });\n} catch (e) { results.push({ name: \"synthetic valid signed request\", ok: false, error: String((e as Error)?.message ?? e) }); }\n\nconst badHeaders = new Headers(signed.headers);\nconst originalSignature = badHeaders.get(\"signature\")!;\nbadHeaders.set(\"signature\", originalSignature.replace(/:([A-Za-z0-9+/])/, (_m, c) => `:${c === \"A\" ? \"B\" : \"A\"}`));\nawait mustReject(\"bad signature\", () => candidateVerify(new Request(signed, { headers: badHeaders }), verifier, now), results);\n\nconst wrongAgentBase = new Request(LIVE_URL, { headers: { \"signature-agent\": '\"https://evil.example\"' } });\nconst wrongAgentFields = await sign(wrongAgentBase, { signer, created, expires, nonce: generateNonce() });\nawait mustReject(\"wrong Signature-Agent\", () => candidateVerify(withSignature(wrongAgentBase, wrongAgentFields), verifier, now), results);\n\nawait mustReject(\"unknown key\", () => verify(signed, {\n algorithms:[\"ed25519\",\"rsa-pss-sha512\"], maxAge:120, clockSkew:10, now,\n resolver: async () => { throw new Error(\"OPENAI_SIGNING_KEY_NOT_FOUND\"); },\n validate(sig) { return sig.nonce !== undefined && exactOpenAIAgent(sig as any); },\n}), results);\n\nconst oldCreated = new Date(now.getTime() - 300_000);\nconst oldExpires = new Date(now.getTime() + 60_000);\nconst oldFields = await sign(base, { signer, created: oldCreated, expires: oldExpires, nonce: generateNonce() });\nawait mustReject(\"too-old signature\", () => candidateVerify(withSignature(base, oldFields), verifier, now), results);\n\nconst expiredCreated = new Date(now.getTime() - 60_000);\nconst expiredExpires = new Date(now.getTime() - 20_000);\nconst expiredFields = await sign(base, { signer, created: expiredCreated, expires: expiredExpires, nonce: generateNonce() });\nawait mustReject(\"expired signature\", () => candidateVerify(withSignature(base, expiredFields), verifier, now), results);\n\nconst noNonceFields = await sign(base, { signer, created, expires });\nawait mustReject(\"missing signed nonce\", () => candidateVerify(withSignature(base, noNonceFields), verifier, now), results);\n\nconst pass = results.filter(x=>x.ok).length;\nconsole.log(JSON.stringify({\n schema:\"WORK_WEBBOTAUTH_CRYPTO_SELFTEST_V1\",\n source_package:\"web-bot-auth@0.2.0\",\n total:results.length, pass, fail:results.length-pass,\n results,\n live_synthetic_headers:{\"signature-agent\":`\"${OPENAI_AGENT}\"`,signature:fields.signature,\"signature-input\":fields.signatureInput},\n note:\"Synthetic test key proves library/profile behavior only; it is not OpenAI Work provenance.\"\n}, null, 2));",[170],"pulls","branches","forks","envVars",{"_183":61,"_185":61},"connections",{"_183":61,"_184":61},"count","unfilledCount","emptyCount",{"_41":169,"_31":170,"_29":171,"_136":-5,"_39":40,"_38":172,"_137":57,"_36":208,"_13":61,"_32":33,"_34":174,"_23":24,"_139":-5,"_193":209,"_26":210},{"_41":162,"_31":163,"_29":164,"_136":-5,"_39":40,"_38":165,"_137":24,"_36":205,"_13":61,"_32":33,"_34":167,"_23":24,"_139":-5,"_193":206,"_26":207},{"_41":155,"_31":156,"_29":157,"_136":-5,"_39":40,"_38":158,"_137":57,"_36":202,"_13":61,"_32":33,"_34":160,"_23":24,"_139":-5,"_193":203,"_26":204},{"_41":149,"_31":150,"_29":55,"_136":-5,"_39":40,"_38":146,"_137":24,"_36":199,"_13":61,"_32":152,"_34":153,"_23":24,"_139":-5,"_193":200,"_26":201},{"_41":141,"_31":142,"_29":143,"_136":-5,"_39":40,"_38":144,"_137":57,"_36":196,"_13":146,"_32":33,"_34":147,"_23":24,"_139":-5,"_193":197,"_26":198},{"_41":135,"_31":27,"_29":30,"_136":-5,"_39":40,"_38":14,"_137":24,"_36":192,"_13":61,"_32":33,"_34":35,"_23":24,"_139":-5,"_193":194,"_26":195},["D",1789322928527],"children",[],[27],["D",1789322591881],[],[142],["D",1789322498182],[],[150],["D",1789322922132],[],[156],["D",1789322832109],[],[163],["D",1789322796448],[],[170],["D",1789322498116],["D",1789497078049],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"ctx",{"_80":-5,"_126":249,"_250":251,"_252":253,"_254":24,"_255":24,"_256":24,"_257":57,"_258":-5,"_259":-7,"_260":-7,"_261":61,"_262":24,"_263":24,"_264":-5,"_265":24,"_266":24,"_267":24,"_268":-5},"ENV",{"_220":221,"_222":223,"_224":88,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7