[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_239":240,"_241":242},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_93":-7,"_94":95,"_29":-7,"_96":-5,"_15":97,"_98":99,"_100":101,"_102":103,"_104":105,"_106":-5,"_107":-5,"_108":-5,"_109":38,"_110":111,"_112":50,"_113":-5,"_114":-5,"_115":116},"routes/_app.x.$handle.$name.branches",{"_11":12,"_13":14,"_15":16,"_17":18},"handle","mosadek","name","work-webbotauth-isolated-canary","project",{"_20":28,"_13":14,"_22":36,"_35":-5,"_37":38,"_39":40,"_41":40,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":50,"_51":-5,"_52":-5,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":65,"_66":65,"_67":68,"_69":68,"_70":68,"_71":65,"_72":65,"_73":74,"_75":76,"_77":78,"_79":38},"branches",[19],{"_20":21,"_22":23,"_24":25,"_13":26,"_27":28,"_29":30,"_31":-5,"_32":-5,"_33":34,"_35":-5},"id","d14bf048-fc63-4ed3-8b85-fd638d355c00","createdAt",["D",1789322498116],"updatedAt",["D",1789325342074],"main","projectId","957e5128-9177-49d7-a4f3-6a71d16c1656","version",13,"forkedBranchId","forkedBranchVersion","lockfileKey","1789325342251-esm.town_v_mosadek_work-webbotauth-isolated-canary@13-main","deletedAt",["D",1789322498116],"legacyEnvVars",false,"privacy","public","httpPrivacy","description","Isolated ChatGPT Work Web Bot Auth canary","imageUrl","userId","6be0fc5c-1fef-4bd6-a1e1-67a3f8c0764e","pinnedFileId","2a72cbfc-af9d-11f1-b509-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0715b-703f-741f-ab35-c85020e4a5e0","tursoName","957e5128917749d7a4f36a71d16c1656","tursoHostname","957e5128917749d7a4f36a71d16c1656-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789497078049],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_92":88},"org",{"_11":12,"_85":86,"_87":88,"_45":46,"_89":90,"_91":38},"branch",{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_80":-5,"_81":-5,"_82":-5,"_83":14,"_84":12},"isOwned","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Mo Sadek","avatar","https://lh3.googleusercontent.com/a/ACg8ocL1eT_LHhKSg5px3nXIO6eez79aZXef466qXKh2gak-0iwrvw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_20":28,"_13":14,"_22":234,"_35":-5,"_37":38,"_39":40,"_41":40,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":50,"_51":-5,"_52":-5,"_53":54,"_55":56,"_57":58,"_59":60,"_61":235,"_63":-5,"_64":65,"_66":65,"_67":68,"_69":68,"_70":68,"_71":65,"_72":65,"_73":236,"_75":237,"_77":238,"_79":38},"tree",[201,202,203,204,205,206,207,208],"files",[201,202,203,204,205,206,207,208],"counts",{"_192":54,"_17":148,"_193":54,"_194":195,"_196":197},"contents",[117,118,119,120,121,122,123,124],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_20":185,"_13":186,"_127":187,"_129":-5,"_130":21,"_131":188,"_133":50,"_22":189,"_29":54,"_136":137,"_138":190,"_140":38,"_141":-5,"_94":191},{"_20":178,"_13":179,"_127":180,"_129":-5,"_130":21,"_131":181,"_133":50,"_22":182,"_29":148,"_136":137,"_138":183,"_140":38,"_141":-5,"_94":184},{"_20":171,"_13":172,"_127":173,"_129":-5,"_130":21,"_131":174,"_133":50,"_22":175,"_29":54,"_136":137,"_138":176,"_140":38,"_141":-5,"_94":177},{"_20":165,"_13":166,"_127":167,"_129":-5,"_130":21,"_131":30,"_133":50,"_22":168,"_29":54,"_136":137,"_138":169,"_140":38,"_141":-5,"_94":170},{"_20":158,"_13":159,"_127":48,"_129":-5,"_130":21,"_131":160,"_133":50,"_22":161,"_29":148,"_136":162,"_138":163,"_140":38,"_141":-5,"_94":164},{"_20":151,"_13":152,"_127":153,"_129":-5,"_130":21,"_131":154,"_133":50,"_22":155,"_29":54,"_136":137,"_138":156,"_140":38,"_141":-5,"_94":157},{"_20":143,"_13":144,"_127":145,"_129":-5,"_130":21,"_131":146,"_133":50,"_22":147,"_29":148,"_136":137,"_138":149,"_140":38,"_141":-5,"_94":150},{"_20":125,"_13":126,"_127":128,"_129":-5,"_130":21,"_131":132,"_133":50,"_22":134,"_29":135,"_136":137,"_138":139,"_140":38,"_141":-5,"_94":142},"5d508ed2-d93d-4f96-8136-a6c58b0c111c","wba1_selftest.ts","fileId","2aff8564-af9e-11f1-9be9-1607ee4eb77e","parentId","branchId","branchVersion",12,"latest",["D",1789325230528],2,"fileType","script","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { generateNonce, sign, verify } from \"npm:web-bot-auth@0.2.0\";\nimport { signerFromJWK, verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst EXPECTED_MAIN_BYTES = 9441;\nconst EXPECTED_MAIN_SHA256 = \"a91dcaf988ae467d8fa741b47474504eb2eedbaf9871dbd9bfeed16c1e7f2241\";\nconst GOOD_AGENT = \"https://signature-agent.test\";\nconst GOOD_AGENT_HEADER = `sig1=\"${GOOD_AGENT}\";type=directory`;\nconst TEST_PRIVATE: JsonWebKey = {\n kty: \"OKP\", crv: \"Ed25519\", alg: \"EdDSA\", kid: \"test-key-ed25519\",\n d: \"n4Ni-HpISpVObnQMW0wOhCKROaIKqKtW_2ZYb2p9KcU\",\n x: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\nconst TEST_PUBLIC: JsonWebKey = {\n kty: \"OKP\", crv: \"Ed25519\", alg: \"EdDSA\", kid: \"test-key-ed25519\",\n x: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\n\nasync function sha256(text: string) {\n const d = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n return [...new Uint8Array(d)].map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction assert(ok: unknown, name: string, detail?: unknown) {\n if (!ok) throw new Error(`${name}: ${JSON.stringify(detail ?? null)}`);\n return { name, ok: true };\n}\nasync function expectReject(name: string, fn: () => Promise) {\n try { await fn(); return { name, ok: false, detail: \"unexpected_accept\" }; }\n catch (e) { return { name, ok: true, detail: String((e as Error)?.message ?? e) }; }\n}\nasync function signedRequest(opts: { agentHeader?: string; created?: Date; expires?: Date; nonce?: string | null } = {}) {\n const agentHeader = opts.agentHeader ?? GOOD_AGENT_HEADER;\n const req = new Request(\"https://example.com/attest\", { headers: { \"Signature-Agent\": agentHeader } });\n const now = new Date();\n const fields = await sign(req, {\n signer: await signerFromJWK(TEST_PRIVATE),\n created: opts.created ?? now,\n expires: opts.expires ?? new Date(now.getTime() + 60_000),\n ...(opts.nonce === null ? {} : { nonce: opts.nonce ?? generateNonce() }),\n });\n return new Request(req.url, { headers: {\n Signature: fields.signature,\n \"Signature-Input\": fields.signatureInput,\n \"Signature-Agent\": agentHeader,\n }});\n}\nasync function localVerify(req: Request, requireGoodAgent = true) {\n const verifier = await verifierFromJWK(TEST_PUBLIC);\n return await verify(req, {\n algorithms: [\"ed25519\", \"rsa-pss-sha512\"],\n maxAge: 120,\n clockSkew: 10,\n resolver(candidate) {\n if (candidate.keyid !== verifier.keyid) throw new Error(\"unknown key\");\n return verifier;\n },\n validate(sig) {\n if (!sig.nonce) return false;\n if (!requireGoodAgent) return true;\n return sig.signatureAgent?.type === \"directory\" && sig.signatureAgent.uri === GOOD_AGENT;\n },\n });\n}\n\nconst results: any[] = [];\nconst mainSource = await readFile(\"/main.ts\", import.meta.url);\nconst mainBytes = new TextEncoder().encode(mainSource).length;\nconst mainSha = await sha256(mainSource);\nresults.push(assert(mainBytes === EXPECTED_MAIN_BYTES, \"candidate bytes exact\", { mainBytes }));\nresults.push(assert(mainSha === EXPECTED_MAIN_SHA256, \"candidate sha exact\", { mainSha }));\n\nconst valid = await signedRequest();\nconst verified: any = await localVerify(valid);\nresults.push(assert(Boolean(verified?.nonce), \"synthetic valid signed request passes\"));\n\nconst badHeaders = new Headers(valid.headers);\nconst oldSig = badHeaders.get(\"Signature\")!;\nbadHeaders.set(\"Signature\", oldSig.slice(0, -2) + (oldSig.endsWith(\"AA\") ? \"BB\" : \"AA\"));\nresults.push(await expectReject(\"bad signature rejected\", () => localVerify(new Request(valid.url, { headers: badHeaders }))));\n\nconst wrongAgent = await signedRequest({ agentHeader: 'sig1=\"https://evil.example\";type=directory' });\nresults.push(await expectReject(\"wrong Signature-Agent rejected\", () => localVerify(wrongAgent)));\n\nresults.push(await expectReject(\"unknown key rejected\", async () => verify(valid, {\n algorithms: [\"ed25519\"], maxAge: 120, clockSkew: 10,\n resolver() { throw new Error(\"unknown key\"); },\n})));\n\nconst oldCreated = new Date(Date.now() - 600_000);\nconst oldExpires = new Date(Date.now() - 300_000);\nconst expired = await signedRequest({ created: oldCreated, expires: oldExpires });\nresults.push(await expectReject(\"expired/too-old signature rejected\", () => localVerify(expired)));\n\nconst noNonce = await signedRequest({ nonce: null });\nresults.push(await expectReject(\"missing signed nonce rejected\", () => localVerify(noNonce)));\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS wba1_replay_selftest_v1(\n signed_nonce TEXT PRIMARY KEY,\n agent_id TEXT NOT NULL,\n receipt_sha256 TEXT NOT NULL UNIQUE,\n issued_at_ms INTEGER NOT NULL,\n receipt_expires_at_ms INTEGER NOT NULL,\n used_at_ms INTEGER\n)`);\nconst suffix = crypto.randomUUID();\nconst nonce = `nonce-${suffix}`;\nconst now = Date.now();\nconst concurrent = await Promise.allSettled([1, 2].map(async i => sqlite.execute({\n sql: `INSERT INTO wba1_replay_selftest_v1(signed_nonce,agent_id,receipt_sha256,issued_at_ms,receipt_expires_at_ms,used_at_ms) VALUES(?,?,?,?,?,NULL)`,\n args: [nonce, \"agent-a\", await sha256(`receipt-${suffix}-${i}`), now, now + 120_000],\n})));\nconst fulfilled = concurrent.filter(x => x.status === \"fulfilled\").length;\nconst rejected = concurrent.filter(x => x.status === \"rejected\").length;\nresults.push(assert(fulfilled === 1 && rejected === 1, \"concurrent nonce replay admits exactly one\", { fulfilled, rejected }));\n\nconst receipt = `receipt-main-${suffix}`;\nconst receiptHash = await sha256(receipt);\nconst nonce2 = `nonce-receipt-${suffix}`;\nawait sqlite.execute({\n sql: `INSERT INTO wba1_replay_selftest_v1(signed_nonce,agent_id,receipt_sha256,issued_at_ms,receipt_expires_at_ms,used_at_ms) VALUES(?,?,?,?,?,NULL)`,\n args: [nonce2, \"agent-right\", receiptHash, now, now + 120_000],\n});\nasync function consume(r: string, agent: string) {\n const h = await sha256(r);\n const t = Date.now();\n const q: any = await sqlite.execute({\n sql: `UPDATE wba1_replay_selftest_v1 SET used_at_ms=? WHERE receipt_sha256=? AND agent_id=? AND used_at_ms IS NULL AND receipt_expires_at_ms>=? RETURNING signed_nonce`,\n args: [t, h, agent, t],\n });\n return Array.isArray(q.rows) && q.rows.length === 1;\n}\nresults.push(assert(!(await consume(receipt, \"agent-wrong\")), \"wrong-agent receipt rejected\"));\nresults.push(assert(await consume(receipt, \"agent-right\"), \"right-agent receipt accepted once\"));\nresults.push(assert(!(await consume(receipt, \"agent-right\")), \"receipt replay rejected\"));\n\nconst expiredReceipt = `receipt-expired-${suffix}`;\nawait sqlite.execute({\n sql: `INSERT INTO wba1_replay_selftest_v1(signed_nonce,agent_id,receipt_sha256,issued_at_ms,receipt_expires_at_ms,used_at_ms) VALUES(?,?,?,?,?,NULL)`,\n args: [`nonce-expired-${suffix}`, \"agent-right\", await sha256(expiredReceipt), now - 10_000, now - 1],\n});\nresults.push(assert(!(await consume(expiredReceipt, \"agent-right\")), \"expired receipt rejected\"));\n\nconst directoryRes = await fetch(\"https://chatgpt.com/.well-known/http-message-signatures-directory\", {\n headers: { Accept: \"application/http-message-signatures-directory+json, application/json;q=0.9\" },\n redirect: \"error\",\n});\nconst directoryText = await directoryRes.text();\nlet directory: any = null;\ntry { directory = JSON.parse(directoryText); } catch {}\nresults.push(assert(directoryRes.ok && Array.isArray(directory?.keys) && directory.keys.length > 0, \"live OpenAI signing directory reachable\", { status: directoryRes.status, keyCount: directory?.keys?.length ?? 0 }));\nconst nowSeconds = Math.floor(Date.now() / 1000);\nconst liveValidKeys = Array.isArray(directory?.keys) ? directory.keys.filter((key: any) =>\n (key.nbf === undefined || (Number.isFinite(key.nbf) && nowSeconds >= Number(key.nbf))) &&\n (key.exp === undefined || (Number.isFinite(key.exp) && nowSeconds < Number(key.exp)))\n) : [];\nresults.push(assert(liveValidKeys.length > 0, \"live OpenAI JWK NumericDate seconds accepted\", { nowSeconds, keyCount: directory?.keys?.length ?? 0, validKeyCount: liveValidKeys.length, sampleNbf: directory?.keys?.[0]?.nbf, sampleExp: directory?.keys?.[0]?.exp }));\nresults.push(assert(mainSource.includes(\"const nowSeconds = Math.floor(nowMs / 1000);\"), \"candidate converts Date.now milliseconds to JWK NumericDate seconds\"));\n\nconst summary = {\n schema: \"WBA1_ISOLATED_CRYPTO_AND_REPLAY_SELFTEST_V1\",\n ok: results.every(r => r.ok),\n pass: results.filter(r => r.ok).length,\n total: results.length,\n candidate: { bytes: mainBytes, sha256: mainSha },\n package: \"web-bot-auth@0.2.0\",\n results,\n trust_limits: {\n proves_real_chatgpt_work: false,\n work_cloud_runtime_admission: false,\n p_real: false,\n independence: false,\n human_authority_approval: false,\n },\n};\nconsole.log(JSON.stringify(summary, null, 2));\nexport default summary;\n","deleted","label",[126],"6ef02103-210e-403d-b9f8-509966b9f5dc","probe_api.ts","4410ee90-af9d-11f1-a468-1607ee4eb77e",3,["D",1789322591881],1,"import * as W from \"npm:web-bot-auth@0.2.0\";\nimport * as C from \"npm:web-bot-auth@0.2.0/crypto\";\nconsole.log(JSON.stringify({web:Object.keys(W).sort(),crypto:Object.keys(C).sort(),sign:String((W as any).sign).slice(0,2200),verify:String((W as any).verify).slice(0,1800),signerFromJWK:String((C as any).signerFromJWK).slice(0,1200)},null,2));",[144],"ce851446-a472-4a75-aa17-4c4a39166660","main_hash.ts","6c03ee7e-afa3-11f1-bae9-1607ee4eb77e",10,["D",1789325185129],"import { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nconst source = await readFile(\"/main.ts\", import.meta.url);\nconst bytes = new TextEncoder().encode(source).length;\nconst digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(source));\nconst sha256 = [...new Uint8Array(digest)].map(b => b.toString(16).padStart(2,\"0\")).join(\"\");\nconsole.log(JSON.stringify({bytes,sha256}));\nexport default {bytes,sha256};",[152],"4c998b68-5b46-41ac-951a-8f45814bcc9b","main.ts",9,["D",1789325174156],"http","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n HTTP_MESSAGE_SIGNATURES_DIRECTORY,\n verify,\n type UntrustedWebBotSignatureCandidate,\n type VerifiedWebBotSignature,\n} from \"npm:web-bot-auth@0.2.0\";\nimport { verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst OPENAI_SIGNATURE_AGENT = \"https://chatgpt.com\";\nconst OPENAI_DIRECTORY = `${OPENAI_SIGNATURE_AGENT}${HTTP_MESSAGE_SIGNATURES_DIRECTORY}`;\nconst DIRECTORY_MEDIA_TYPE = \"application/http-message-signatures-directory+json\";\nconst MAX_DIRECTORY_KEYS = 100;\nconst MAX_SIGNATURE_AGE_SECONDS = 120;\nconst CLOCK_SKEW_SECONDS = 10;\nconst RECEIPT_TTL_SECONDS = 120;\nconst AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;\n\ntype DirectoryKey = JsonWebKey & { kid?: string; nbf?: number; exp?: number };\ntype Directory = { keys: DirectoryKey[]; purpose?: string };\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n let binary = \"\";\n for (const b of bytes) binary += String.fromCharCode(b);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomReceipt(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return bytesToBase64Url(bytes);\n}\n\nasync function sha256Hex(text: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction exactOpenAIAgentURI(uri: string): boolean {\n try {\n const u = new URL(uri);\n return u.protocol === \"https:\" && u.hostname === \"chatgpt.com\" && u.port === \"\" &&\n u.username === \"\" && u.password === \"\" &&\n (u.pathname === \"/\" || u.pathname === \"\") && u.search === \"\" && u.hash === \"\";\n } catch {\n return false;\n }\n}\n\nfunction parseDirectory(value: unknown): Directory {\n if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"DIRECTORY_NOT_OBJECT\");\n const obj = value as Record;\n if (!Array.isArray(obj.keys) || obj.keys.length < 1) throw new Error(\"DIRECTORY_KEYS_REQUIRED\");\n if (obj.keys.length > MAX_DIRECTORY_KEYS) throw new Error(\"DIRECTORY_TOO_MANY_KEYS\");\n const keys: DirectoryKey[] = [];\n for (const candidate of obj.keys) {\n if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) throw new Error(\"DIRECTORY_KEY_NOT_OBJECT\");\n const key = candidate as DirectoryKey;\n if (typeof key.kty !== \"string\") throw new Error(\"DIRECTORY_KEY_KTY_REQUIRED\");\n keys.push(key);\n }\n return { keys, purpose: typeof obj.purpose === \"string\" ? obj.purpose : undefined };\n}\n\nfunction keyTimeValid(key: DirectoryKey, nowMs: number): boolean {\n // Web Bot Auth directory JWK nbf/exp use NumericDate seconds, while Date.now() is ms.\n const nowSeconds = Math.floor(nowMs / 1000);\n if (key.nbf !== undefined && (!Number.isFinite(key.nbf) || nowSeconds < Number(key.nbf))) return false;\n if (key.exp !== undefined && (!Number.isFinite(key.exp) || nowSeconds >= Number(key.exp))) return false;\n return true;\n}\n\nasync function fetchOpenAIDirectory(): Promise {\n const res = await fetch(OPENAI_DIRECTORY, {\n method: \"GET\",\n headers: { Accept: `${DIRECTORY_MEDIA_TYPE}, application/json;q=0.9` },\n redirect: \"error\",\n });\n if (!res.ok) throw new Error(`OPENAI_DIRECTORY_HTTP_${res.status}`);\n const raw = await res.text();\n let parsed: unknown;\n try { parsed = JSON.parse(raw); } catch { throw new Error(\"OPENAI_DIRECTORY_BAD_JSON\"); }\n return parseDirectory(parsed);\n}\n\nasync function resolveOpenAIVerifier(candidate: UntrustedWebBotSignatureCandidate) {\n const entry = candidate.signatureAgent;\n if (entry === undefined || entry.type !== \"directory\" || !exactOpenAIAgentURI(entry.uri)) {\n throw new Error(\"SIGNATURE_AGENT_NOT_EXACT_CHATGPT\");\n }\n const directory = await fetchOpenAIDirectory();\n const nowMs = Date.now();\n for (const key of directory.keys) {\n if (!keyTimeValid(key, nowMs)) continue;\n try {\n const verifier = await verifierFromJWK(key);\n if (verifier.keyid === candidate.keyid) return verifier;\n } catch {\n // Fail closed by ignoring malformed or unsupported entries.\n }\n }\n throw new Error(\"OPENAI_SIGNING_KEY_NOT_FOUND\");\n}\n\nasync function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS work_webbotauth_receipts_v1(\n signed_nonce TEXT PRIMARY KEY,\n agent_id TEXT NOT NULL,\n receipt_sha256 TEXT NOT NULL UNIQUE,\n signature_keyid TEXT NOT NULL,\n signature_created_ms INTEGER NOT NULL,\n signature_expires_ms INTEGER NOT NULL,\n issued_at_ms INTEGER NOT NULL,\n receipt_expires_at_ms INTEGER NOT NULL,\n used_at_ms INTEGER\n )`);\n}\n\nasync function mintReceiptFromVerifiedRequest(request: Request, agentId: string) {\n if (!AGENT_ID_RE.test(agentId)) throw new Error(\"AGENT_ID_INVALID\");\n const verified: VerifiedWebBotSignature = await verify(request, {\n algorithms: [\"ed25519\", \"rsa-pss-sha512\"],\n maxAge: MAX_SIGNATURE_AGE_SECONDS,\n clockSkew: CLOCK_SKEW_SECONDS,\n resolver: resolveOpenAIVerifier,\n validate(signature) {\n if (signature.nonce === undefined) return false;\n const entry = signature.signatureAgent;\n if (entry === undefined || entry.type !== \"directory\" || !exactOpenAIAgentURI(entry.uri)) return false;\n const now = Date.now();\n if (signature.created.getTime() > now + CLOCK_SKEW_SECONDS * 1000) return false;\n if (signature.expires.getTime() < now - CLOCK_SKEW_SECONDS * 1000) return false;\n return true;\n },\n });\n if (!verified.nonce) throw new Error(\"SIGNED_NONCE_REQUIRED\");\n\n const receipt = randomReceipt();\n const receiptSha256 = await sha256Hex(receipt);\n const issuedAtMs = Date.now();\n const receiptExpiresAtMs = issuedAtMs + RECEIPT_TTL_SECONDS * 1000;\n const targetUriCovered = verified.components.some(\n (component) => component.name === \"@target-uri\" && Object.keys(component.parameters).length === 0,\n );\n\n await ensureTables();\n try {\n await sqlite.execute({\n sql: `INSERT INTO work_webbotauth_receipts_v1(\n signed_nonce,agent_id,receipt_sha256,signature_keyid,signature_created_ms,\n signature_expires_ms,issued_at_ms,receipt_expires_at_ms,used_at_ms\n ) VALUES(?,?,?,?,?,?,?,?,NULL)`,\n args: [\n verified.nonce, agentId, receiptSha256, verified.keyid,\n verified.created.getTime(), verified.expires.getTime(), issuedAtMs, receiptExpiresAtMs,\n ],\n });\n } catch (error) {\n const message = String((error as Error)?.message ?? error);\n if (/UNIQUE|constraint/i.test(message)) throw new Error(\"SIGNED_NONCE_REPLAY\");\n throw error;\n }\n\n return {\n receipt,\n receipt_expires_at: new Date(receiptExpiresAtMs).toISOString(),\n signature_keyid: verified.keyid,\n signature_created_at: verified.created.toISOString(),\n signature_expires_at: verified.expires.toISOString(),\n target_uri_covered: targetUriCovered,\n };\n}\n\nasync function consumeReceipt(receipt: string, agentId: string): Promise {\n if (!AGENT_ID_RE.test(agentId) || receipt.length < 20 || receipt.length > 256) return false;\n const receiptSha256 = await sha256Hex(receipt);\n const nowMs = Date.now();\n await ensureTables();\n const result: any = await sqlite.execute({\n sql: `UPDATE work_webbotauth_receipts_v1 SET used_at_ms=?\n WHERE receipt_sha256=? AND agent_id=? AND used_at_ms IS NULL\n AND receipt_expires_at_ms>=? RETURNING signed_nonce`,\n args: [nowMs, receiptSha256, agentId, nowMs],\n });\n return Array.isArray(result.rows) && result.rows.length === 1;\n}\n\nfunction json(status: number, body: unknown): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}\n\nexport default async function handler(request: Request): Promise {\n const url = new URL(request.url);\n if (request.method === \"GET\" && url.pathname === \"/attest-work\") {\n const agentId = url.searchParams.get(\"agent_id\") ?? \"\";\n try {\n const out = await mintReceiptFromVerifiedRequest(request, agentId);\n return json(200, {\n ok: true,\n classification: \"CHATGPT_SIGNED_BROWSER_RECEIPT_MINTED_CANDIDATE_ONLY\",\n ...out,\n trust_limits: {\n work_cloud_runtime_production_admission: false,\n execution_distinct: false,\n independent_verification: false,\n p_real: false,\n human_authority_approval: false,\n production_qualified: false,\n },\n });\n } catch (error) {\n return json(401, {\n ok: false,\n classification: \"WORK_WEBBOTAUTH_ATTESTATION_REJECTED\",\n reason: String((error as Error)?.message ?? error),\n });\n }\n }\n\n // Canary only. Production admission must consume the receipt in the\n // authority-selected registration/reconciliation transaction.\n if (request.method === \"POST\" && url.pathname === \"/consume-canary\") {\n let body: any;\n try { body = await request.json(); } catch { return json(400, { ok: false, reason: \"BAD_JSON\" }); }\n const ok = await consumeReceipt(String(body?.receipt ?? \"\"), String(body?.agent_id ?? \"\"));\n return json(ok ? 200 : 409, {\n ok,\n classification: ok ? \"RECEIPT_CONSUMED_CANARY_ONLY\" : \"RECEIPT_REJECTED_CANARY_ONLY\",\n });\n }\n return json(404, { ok: false, reason: \"NOT_FOUND\" });\n}\n",[159],"744433e7-ab87-4a60-9caa-64fcc67a82e2","evidence_hashes.ts","c993c41a-afa3-11f1-b695-1607ee4eb77e",["D",1789325342074],"import { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nasync function id(path:string){const s=await readFile(path,import.meta.url);const b=new TextEncoder().encode(s);const d=await crypto.subtle.digest(\"SHA-256\",b);return {path,bytes:b.length,sha256:[...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\")};}\nconst out=[];for(const p of [\"/main.ts\",\"/wba1_selftest.ts\",\"/crypto_selftest.ts\",\"/db_concurrency_selftest.ts\",\"/directory_probe.ts\"]){out.push(await id(p));}\nconsole.log(JSON.stringify(out,null,2));\nexport default out;",[166],"c0671a8d-4142-430c-beb3-647eade8b96c","directory_probe.ts","27412572-af9e-11f1-8124-1607ee4eb77e",6,["D",1789322922132],"const url=\"https://chatgpt.com/.well-known/http-message-signatures-directory\";\nconst res=await fetch(url,{headers:{accept:\"application/http-message-signatures-directory+json, application/json;q=0.9\"},redirect:\"error\"});\nconst text=await res.text();\nlet parsed:any=null; let parse_error:string|null=null;\ntry{parsed=JSON.parse(text)}catch(e){parse_error=String((e as Error)?.message??e)}\nconst keys=Array.isArray(parsed?.keys)?parsed.keys:[];\nconsole.log(JSON.stringify({schema:\"OPENAI_WEBBOTAUTH_DIRECTORY_LIVE_PROBE_V1\",status:res.status,ok:res.ok,content_type:res.headers.get(\"content-type\"),cache_control:res.headers.get(\"cache-control\"),parse_error,purpose:parsed?.purpose??null,key_count:keys.length,keys:keys.slice(0,20).map((k:any)=>({kid:k.kid??null,kty:k.kty??null,crv:k.crv??null,alg:k.alg??null,nbf:k.nbf??null,exp:k.exp??null,x_present:typeof k.x===\"string\",n_present:typeof k.n===\"string\"}))},null,2));",[172],"1ae795ef-4902-4468-a108-ed5cb40a1ab6","db_concurrency_selftest.ts","f179cdfe-af9d-11f1-946f-1607ee4eb77e",8,["D",1789323099957],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS work_webbotauth_receipts_v1(\n signed_nonce TEXT PRIMARY KEY,\n agent_id TEXT NOT NULL,\n receipt_sha256 TEXT NOT NULL UNIQUE,\n signature_keyid TEXT NOT NULL,\n signature_created_ms INTEGER NOT NULL,\n signature_expires_ms INTEGER NOT NULL,\n issued_at_ms INTEGER NOT NULL,\n receipt_expires_at_ms INTEGER NOT NULL,\n used_at_ms INTEGER\n)`);\nconst nonce = `wba1-concurrent-${crypto.randomUUID()}`;\nconst attempts = await Promise.allSettled(Array.from({length:16}, async (_,i) => {\n const raw = new TextEncoder().encode(`${nonce}:${i}`);\n const digest = await crypto.subtle.digest(\"SHA-256\", raw);\n const receiptHash = [...new Uint8Array(digest)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");\n return await sqlite.execute({sql:`INSERT INTO work_webbotauth_receipts_v1(\n signed_nonce,agent_id,receipt_sha256,signature_keyid,signature_created_ms,\n signature_expires_ms,issued_at_ms,receipt_expires_at_ms,used_at_ms\n ) VALUES(?,?,?,?,?,?,?,?,NULL)`, args:[nonce,\"agent-A\",receiptHash,\"test-key\",1,999999,1,9999999999999]});\n}));\nconst q:any = await sqlite.execute({sql:\"SELECT COUNT(*) AS n, MIN(receipt_sha256) AS winner FROM work_webbotauth_receipts_v1 WHERE signed_nonce=?\",args:[nonce]});\nconst fulfilled = attempts.filter(x=>x.status===\"fulfilled\").length;\nconst rejected = attempts.filter(x=>x.status===\"rejected\").length;\nconst row = q.rows?.[0] ?? {};\nconsole.log(JSON.stringify({schema:\"WORK_WEBBOTAUTH_CONCURRENT_NONCE_SELFTEST_V1\",attempts:16,fulfilled,rejected,rows_for_nonce:Number(row.n??-1),winner:row.winner,pass:fulfilled===1 && rejected===15 && Number(row.n)===1,rejection_samples:attempts.filter(x=>x.status===\"rejected\").slice(0,3).map((x:any)=>String(x.reason?.message??x.reason))},null,2));",[179],"7cf78841-9a67-4b60-a190-b7ea3dd84144","crypto_selftest.ts","dc3cb348-af9d-11f1-8952-1607ee4eb77e",4,["D",1789322796448],"import { generateNonce, sign, verify, type SignatureFields, type VerifiedWebBotSignature } from \"npm:web-bot-auth@0.2.0\";\nimport { signerFromJWK, verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst TEST_JWK: JsonWebKey = {\n kty: \"OKP\", crv: \"Ed25519\", kid: \"test-key-ed25519\", alg: \"EdDSA\",\n d: \"n4Ni-HpISpVObnQMW0wOhCKROaIKqKtW_2ZYb2p9KcU\",\n x: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\nconst OPENAI_AGENT = \"https://chatgpt.com\";\nconst LIVE_URL = \"https://mosadek--2a72cbfcaf9d11f1b5091607ee4eb77e.web.val.run/attest-work?agent_id=chat-unproven-gpt56sol-20260913-1946-bbn-a91\";\n\nfunction withSignature(request: Request, fields: SignatureFields): Request {\n const headers = new Headers(request.headers);\n headers.set(\"signature\", fields.signature);\n headers.set(\"signature-input\", fields.signatureInput);\n return new Request(request, { headers });\n}\nfunction exactOpenAIAgent(sig: VerifiedWebBotSignature): boolean {\n const a: any = sig.signatureAgent;\n return !!a && a.type === \"directory\" && a.uri === OPENAI_AGENT;\n}\nasync function candidateVerify(request: Request, verifier: any, now = new Date()) {\n return await verify(request, {\n algorithms: [\"ed25519\", \"rsa-pss-sha512\"], maxAge: 120, clockSkew: 10, now,\n resolver: () => verifier,\n validate(sig) { return sig.nonce !== undefined && exactOpenAIAgent(sig as any); },\n });\n}\nasync function mustReject(name: string, fn: () => Promise, out: any[]) {\n try { await fn(); out.push({ name, ok: false, reason: \"UNEXPECTED_ACCEPT\" }); }\n catch (e) { out.push({ name, ok: true, rejection: String((e as Error)?.message ?? e) }); }\n}\n\nconst results: any[] = [];\nconst signer = await signerFromJWK(TEST_JWK);\nconst verifier = await verifierFromJWK(TEST_JWK);\nconst now = new Date();\nconst created = new Date(now.getTime() - 1000);\nconst expires = new Date(now.getTime() + 60_000);\nconst nonce = generateNonce();\nconst headers = new Headers({ \"signature-agent\": `\"${OPENAI_AGENT}\"` });\nconst base = new Request(LIVE_URL, { headers });\nconst fields = await sign(base, { signer, created, expires, nonce });\nconst signed = withSignature(base, fields);\ntry {\n const v = await candidateVerify(signed, verifier, now);\n results.push({ name: \"synthetic valid signed request\", ok: v.nonce === nonce && exactOpenAIAgent(v as any), keyid: v.keyid, nonce: v.nonce, signatureAgent: v.signatureAgent, covered: v.components.map((c:any)=>c.name) });\n} catch (e) { results.push({ name: \"synthetic valid signed request\", ok: false, error: String((e as Error)?.message ?? e) }); }\n\nconst badHeaders = new Headers(signed.headers);\nconst originalSignature = badHeaders.get(\"signature\")!;\nbadHeaders.set(\"signature\", originalSignature.replace(/:([A-Za-z0-9+/])/, (_m, c) => `:${c === \"A\" ? \"B\" : \"A\"}`));\nawait mustReject(\"bad signature\", () => candidateVerify(new Request(signed, { headers: badHeaders }), verifier, now), results);\n\nconst wrongAgentBase = new Request(LIVE_URL, { headers: { \"signature-agent\": '\"https://evil.example\"' } });\nconst wrongAgentFields = await sign(wrongAgentBase, { signer, created, expires, nonce: generateNonce() });\nawait mustReject(\"wrong Signature-Agent\", () => candidateVerify(withSignature(wrongAgentBase, wrongAgentFields), verifier, now), results);\n\nawait mustReject(\"unknown key\", () => verify(signed, {\n algorithms:[\"ed25519\",\"rsa-pss-sha512\"], maxAge:120, clockSkew:10, now,\n resolver: async () => { throw new Error(\"OPENAI_SIGNING_KEY_NOT_FOUND\"); },\n validate(sig) { return sig.nonce !== undefined && exactOpenAIAgent(sig as any); },\n}), results);\n\nconst oldCreated = new Date(now.getTime() - 300_000);\nconst oldExpires = new Date(now.getTime() + 60_000);\nconst oldFields = await sign(base, { signer, created: oldCreated, expires: oldExpires, nonce: generateNonce() });\nawait mustReject(\"too-old signature\", () => candidateVerify(withSignature(base, oldFields), verifier, now), results);\n\nconst expiredCreated = new Date(now.getTime() - 60_000);\nconst expiredExpires = new Date(now.getTime() - 20_000);\nconst expiredFields = await sign(base, { signer, created: expiredCreated, expires: expiredExpires, nonce: generateNonce() });\nawait mustReject(\"expired signature\", () => candidateVerify(withSignature(base, expiredFields), verifier, now), results);\n\nconst noNonceFields = await sign(base, { signer, created, expires });\nawait mustReject(\"missing signed nonce\", () => candidateVerify(withSignature(base, noNonceFields), verifier, now), results);\n\nconst pass = results.filter(x=>x.ok).length;\nconsole.log(JSON.stringify({\n schema:\"WORK_WEBBOTAUTH_CRYPTO_SELFTEST_V1\",\n source_package:\"web-bot-auth@0.2.0\",\n total:results.length, pass, fail:results.length-pass,\n results,\n live_synthetic_headers:{\"signature-agent\":`\"${OPENAI_AGENT}\"`,signature:fields.signature,\"signature-input\":fields.signatureInput},\n note:\"Synthetic test key proves library/profile behavior only; it is not OpenAI Work provenance.\"\n}, null, 2));",[186],"pulls","forks","envVars",{"_198":54,"_200":54},"connections",{"_198":54,"_199":54},"count","unfilledCount","emptyCount",{"_20":185,"_13":186,"_127":187,"_129":-5,"_130":21,"_131":188,"_133":50,"_22":231,"_29":54,"_136":137,"_138":190,"_140":38,"_141":-5,"_210":232,"_94":233},{"_20":178,"_13":179,"_127":180,"_129":-5,"_130":21,"_131":181,"_133":50,"_22":228,"_29":148,"_136":137,"_138":183,"_140":38,"_141":-5,"_210":229,"_94":230},{"_20":171,"_13":172,"_127":173,"_129":-5,"_130":21,"_131":174,"_133":50,"_22":225,"_29":54,"_136":137,"_138":176,"_140":38,"_141":-5,"_210":226,"_94":227},{"_20":165,"_13":166,"_127":167,"_129":-5,"_130":21,"_131":30,"_133":50,"_22":222,"_29":54,"_136":137,"_138":169,"_140":38,"_141":-5,"_210":223,"_94":224},{"_20":158,"_13":159,"_127":48,"_129":-5,"_130":21,"_131":160,"_133":50,"_22":219,"_29":148,"_136":162,"_138":163,"_140":38,"_141":-5,"_210":220,"_94":221},{"_20":151,"_13":152,"_127":153,"_129":-5,"_130":21,"_131":154,"_133":50,"_22":216,"_29":54,"_136":137,"_138":156,"_140":38,"_141":-5,"_210":217,"_94":218},{"_20":143,"_13":144,"_127":145,"_129":-5,"_130":21,"_131":146,"_133":50,"_22":213,"_29":148,"_136":137,"_138":149,"_140":38,"_141":-5,"_210":214,"_94":215},{"_20":125,"_13":126,"_127":128,"_129":-5,"_130":21,"_131":132,"_133":50,"_22":209,"_29":135,"_136":137,"_138":139,"_140":38,"_141":-5,"_210":211,"_94":212},["D",1789325230528],"children",[],[126],["D",1789322591881],[],[144],["D",1789325185129],[],[152],["D",1789325174156],[],[159],["D",1789325342074],[],[166],["D",1789322922132],[],[172],["D",1789323099957],[],[179],["D",1789322796448],[],[186],["D",1789322498116],["D",1789497078049],{"_11":12,"_92":88},{"_11":12,"_85":86,"_87":88,"_45":46,"_89":90,"_91":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_80":-5,"_81":-5,"_82":-5,"_83":14,"_84":12},"ctx",{"_73":-5,"_114":272,"_273":274,"_275":276,"_277":38,"_278":38,"_279":38,"_280":50,"_281":-5,"_282":-7,"_283":-7,"_284":54,"_285":38,"_286":38,"_287":-5,"_288":38,"_289":38,"_290":38,"_291":-5},"ENV",{"_243":244,"_245":246,"_247":26,"_248":249,"_250":251,"_252":253,"_254":255,"_256":257,"_258":259,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1