[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_198":199,"_200":201},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_111":112,"_41":-7,"_113":-5,"_17":114,"_115":116,"_117":118,"_119":120,"_121":122,"_123":-5,"_124":-5,"_125":126,"_127":26,"_128":129,"_130":78,"_131":-5,"_132":-5,"_133":134},"routes/_app.x.$handle.$name.compare.$branch",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":-5},"handle","sebas1","name","rumbo-r2-authorizer","branchName","v1-selftest-idempotency","project",{"_32":40,"_13":14,"_34":67,"_47":-5,"_68":26,"_49":50,"_69":50,"_70":71,"_72":-5,"_73":74,"_75":76,"_77":78,"_79":-5,"_80":-5,"_81":20,"_52":53,"_82":83,"_84":85,"_86":87,"_88":-5,"_89":90,"_91":90,"_92":93,"_94":93,"_95":93,"_96":90,"_97":90,"_98":99,"_100":101,"_102":28,"_48":26},"ahead",0,"behind",15,"diff",{"_61":62,"_63":64,"_65":66},"hasChanges",false,"sourceBranch",{"_41":55,"_13":16,"_32":56,"_39":40,"_43":33,"_44":57,"_58":50,"_59":40,"_60":53,"_54":14,"_51":12},"targetBranch",{"_32":33,"_34":35,"_36":37,"_13":38,"_39":40,"_41":42,"_43":-5,"_44":-5,"_45":46,"_47":-5,"_48":26,"_49":50,"_51":12,"_52":53,"_54":14},"pull","id","3bec92a5-228b-4d7e-8a94-d7a3be5df58e","createdAt",["D",1787974602620],"updatedAt",["D",1787988816758],"main","projectId","c407813c-3b2b-489f-a186-e17f90eccf60","version",18,"forkedBranchId","forkedBranchVersion","lockfileKey","1787988817144-esm.town_v_sebas1_rumbo-r2-authorizer@18-main","deletedAt","isOwned","privacy","public","userHandle","orgId","01a04116-f28c-754c-9173-77bf5814fcd6","projectName",2,"8a248fbe-877a-4473-bdcc-eb5ede77e880",3,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","added",[],"deleted",[],"modified",[],["D",1787974602620],"legacyEnvVars","httpPrivacy","description","Dedicated fail-closed RUMBO R2 authorizer","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","da1a7e96-a35a-11f1-816f-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","c407813c3b2b489fa186e17f90eccf60","tursoHostname","c407813c3b2b489fa186e17f90eccf60-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789452068287],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_110":106},"org",{"_11":12,"_103":104,"_105":106,"_73":74,"_107":108,"_109":26},"branch","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","path","","adoptOrgId",{"_32":40,"_13":14,"_34":193,"_47":-5,"_68":26,"_49":50,"_69":50,"_70":71,"_72":-5,"_73":74,"_75":76,"_77":78,"_79":-5,"_80":-5,"_81":20,"_52":53,"_82":83,"_84":85,"_86":194,"_88":-5,"_89":90,"_91":90,"_92":93,"_94":93,"_95":93,"_96":90,"_97":90,"_98":195,"_100":196,"_102":197,"_48":26},"tree",[180,181,182],"files",[180,181,182],"counts",{"_169":20,"_170":171,"_172":20,"_173":174,"_175":176},"contents",[137,138,139],"file","upstreamProject","upstreamBranch",{"_32":33,"_34":135,"_36":136,"_13":38,"_39":40,"_41":42,"_43":-5,"_44":-5,"_45":46,"_47":-5,"_48":26,"_49":50,"_51":12,"_52":53,"_54":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787974602620],["D",1787988816758],{"_32":163,"_13":164,"_142":165,"_144":-5,"_145":56,"_146":149,"_147":78,"_34":166,"_41":20,"_150":123,"_152":167,"_63":26,"_154":-5,"_111":168},{"_32":156,"_13":157,"_142":158,"_144":-5,"_145":56,"_146":149,"_147":78,"_34":159,"_41":20,"_150":160,"_152":161,"_63":26,"_154":-5,"_111":162},{"_32":140,"_13":141,"_142":143,"_144":-5,"_145":56,"_146":55,"_147":78,"_34":148,"_41":149,"_150":151,"_152":153,"_63":26,"_154":-5,"_111":155},"b3406a6b-2b05-4321-af10-6b3ec108ebbf","selftest.ts","fileId","01a04b99-0a90-70cc-9f24-b0ca62586634","parentId","branchId","branchVersion","latest",["D",1787974730042],1,"fileType","script","content","const base = \"https://sebas1--01a04b97888474acad4b69a9c8fc6775.web.val.run\";\nconst root = Deno.env.get(\"R2_AUTH_ROOT_TOKEN\");\nif (!root) throw new Error(\"ROOT_TOKEN_MISSING\");\n\nconst headers = {Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\nconst repo = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst pkg = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst baseSha = \"1ad77acefc7326595c50d7b0edffa81a2188e737\";\nconst headSha = \"d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7\";\n\nconst healthRes = await fetch(base+\"/health\");\nconst health = await healthRes.json();\n\nconst unauthRes = await fetch(base+\"/v1/ledger\");\nconst invalidRes = await fetch(base+\"/v1/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"TEST_ONLY\",repository_identity_sha256:\"0\".repeat(64),pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"1\".repeat(64)\n })\n});\nconst mergeIssueRes = await fetch(base+\"/v1/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"MERGE_PR\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"2\".repeat(64),\n ttl_seconds:300\n })\n});\nconst mergeConsumeRes = await fetch(base+\"/v1/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"MERGE_PR\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"2\".repeat(64),\n authorization_id:\"00000000-0000-4000-8000-000000000000\",\n token:\"A\".repeat(43),consumer:\"selftest\"\n })\n});\n\nconst randomBytes = new Uint8Array(32);\ncrypto.getRandomValues(randomBytes);\nconst uniqueEvidence = [...randomBytes].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nconst binding = {\n action:\"TEST_ONLY\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:uniqueEvidence\n};\n\nconst issueRes = await fetch(base+\"/v1/authorize\",{\n method:\"POST\",headers,body:JSON.stringify({...binding,ttl_seconds:300})\n});\nconst issue:any = await issueRes.json();\nif (issueRes.status !== 201) throw new Error(`ISSUE_FAILED_${issueRes.status}_${issue.error||\"UNKNOWN\"}`);\n\nconst wrongRes = await fetch(base+\"/v1/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({...binding,authorization_id:issue.authorization_id,token:\"B\".repeat(43),consumer:\"selftest-wrong\"})\n});\n\nconst consumeRes = await fetch(base+\"/v1/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({...binding,authorization_id:issue.authorization_id,token:issue.token,consumer:\"selftest-v1\"})\n});\nconst consume:any = await consumeRes.json();\n\nconst replayRes = await fetch(base+\"/v1/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({...binding,authorization_id:issue.authorization_id,token:issue.token,consumer:\"selftest-replay\"})\n});\n\nconst duplicateRes = await fetch(base+\"/v1/authorize\",{\n method:\"POST\",headers,body:JSON.stringify({...binding,ttl_seconds:300})\n});\n\nconst ledgerRes = await fetch(base+\"/v1/ledger?limit=100\",{headers});\nconst ledger:any = await ledgerRes.json();\nconst tokenHashLeak = Array.isArray(ledger.records) && ledger.records.some((r:any)=>Object.prototype.hasOwnProperty.call(r,\"token_sha256\"));\n\nconst auditRes = await fetch(base+\"/v1/audit\",{headers});\nconst audit:any = await auditRes.json();\n\nconst pass =\n healthRes.status===200 &&\n health.implementation===\"DEDICATED_R2_AUTHORIZER_V1\" &&\n health.root_token_configured===true &&\n health.merge_authorization_enabled===false &&\n health.production_go===false &&\n unauthRes.status===401 &&\n invalidRes.status===400 &&\n mergeIssueRes.status===423 &&\n mergeConsumeRes.status===423 &&\n issueRes.status===201 &&\n issue.merge_authorized===false &&\n issue.production_go===false &&\n wrongRes.status===403 &&\n consumeRes.status===200 &&\n consume.consumed===true &&\n consume.merge_authorized===false &&\n consume.production_go===false &&\n replayRes.status===409 &&\n duplicateRes.status===409 &&\n ledgerRes.status===200 &&\n tokenHashLeak===false &&\n auditRes.status===200 &&\n audit.audit_chain_ok===true &&\n audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n unauthenticated_ledger:unauthRes.status,\n invalid_binding:invalidRes.status,\n merge_issue_disabled:mergeIssueRes.status,\n merge_consume_disabled:mergeConsumeRes.status,\n test_issue:issueRes.status,\n wrong_token:wrongRes.status,\n test_consume:consumeRes.status,\n replay:replayRes.status,\n duplicate:duplicateRes.status,\n ledger:ledgerRes.status,\n token_hash_leak:tokenHashLeak,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n authorization_id:issue.authorization_id,\n request_sha256:issue.request_sha256,\n receipt_sha256:consume.receipt_sha256,\n audit_tail_sha256:audit.tail_sha256,\n production_go:false,\n merge_authorization_enabled:false\n},null,2));\nif(!pass) Deno.exit(1);\n","label",[141],"9f91d593-0419-41bb-919b-f8296e3f4337","main.tsx","01a04b99-0a90-70cc-9f24-add0c1f0a16a",["D",1787974716049],"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\n\nconst IMPLEMENTATION = \"DEDICATED_R2_AUTHORIZER_V1\";\nconst REPOSITORY_IDENTITY_SHA256 = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst CONTROL_PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst SHA256_RE = /^[a-f0-9]{64}$/;\nconst GIT_SHA_RE = /^[a-f0-9]{40}$/;\nconst MAX_BODY_BYTES = 64 * 1024;\nconst MIN_TTL_SECONDS = 60;\nconst MAX_TTL_SECONDS = 900;\n\ntype GuardAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype Binding = {\n action: GuardAction;\n repository_identity_sha256: string;\n pr_number: number;\n base_sha: string;\n head_sha: string;\n package_sha256: string;\n evidence_sha256: string;\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS authorizations (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_authorizations_status ON authorizations(status,expires_at)`,\n `CREATE TABLE IF NOT EXISTS audit_events (\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n authorization_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_unique ON audit_events(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_event_object_unique\n ON audit_events(event_type,authorization_id)\n WHERE authorization_id IS NOT NULL`\n]);\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n const aa = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < aa.length; i++) diff |= aa[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction authorized(req: Request): boolean {\n const expected = Deno.env.get(\"R2_AUTH_ROOT_TOKEN\") || \"\";\n const observed = bearer(req);\n return !!expected && !!observed && constantTimeEqual(expected, observed);\n}\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k) + \":\" + canonical(o[k])).join(\",\") + \"}\";\n}\n\nasync function sha256(s: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(digest)].map(x => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomToken(bytes = 32): string {\n const raw = new Uint8Array(bytes);\n crypto.getRandomValues(raw);\n const binary = Array.from(raw, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\nasync function bodyJson(c: any): Promise {\n const len = Number(c.req.header(\"content-length\") || \"0\");\n if (Number.isFinite(len) && len > MAX_BODY_BYTES) throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt = await c.req.text();\n if (new TextEncoder().encode(txt).length > MAX_BODY_BYTES) throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt || \"{}\");\n}\n\nfunction parseBinding(v: any): Binding | null {\n const action = String(v?.action || \"\") as GuardAction;\n const repository_identity_sha256 = String(v?.repository_identity_sha256 || \"\");\n const pr_number = Number(v?.pr_number);\n const base_sha = String(v?.base_sha || \"\");\n const head_sha = String(v?.head_sha || \"\");\n const package_sha256 = String(v?.package_sha256 || \"\");\n const evidence_sha256 = String(v?.evidence_sha256 || \"\");\n\n if (action !== \"TEST_ONLY\" && action !== \"MERGE_PR\") return null;\n if (repository_identity_sha256 !== REPOSITORY_IDENTITY_SHA256) return null;\n if (!Number.isSafeInteger(pr_number) || pr_number <= 0) return null;\n if (!GIT_SHA_RE.test(base_sha) || !GIT_SHA_RE.test(head_sha)) return null;\n if (package_sha256 !== CONTROL_PACKAGE_SHA256) return null;\n if (!SHA256_RE.test(evidence_sha256)) return null;\n\n return {action,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256};\n}\n\nasync function audit(event_type: string, authorization_id: string | null, object_sha256: string | null) {\n if (authorization_id) {\n const existing = await sqlite.execute({\n sql: \"SELECT event_sha256 FROM audit_events WHERE event_type=? AND authorization_id=? LIMIT 1\",\n args: [event_type, authorization_id]\n });\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n\n for (let attempt = 0; attempt < 8; attempt++) {\n const last = await sqlite.execute(\"SELECT event_sha256 FROM audit_events ORDER BY seq DESC LIMIT 1\");\n const prev = String(last.rows[0]?.event_sha256 || \"0\".repeat(64));\n const created_at = new Date().toISOString();\n const event = {event_type,authorization_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256 = await sha256(canonical(event));\n try {\n await sqlite.execute({\n sql: `INSERT INTO audit_events(event_type,authorization_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,\n args: [event_type,authorization_id,object_sha256,prev,event_sha256,created_at]\n });\n return event_sha256;\n } catch (e) {\n if (authorization_id) {\n const existing = await sqlite.execute({\n sql: \"SELECT event_sha256 FROM audit_events WHERE event_type=? AND authorization_id=? LIMIT 1\",\n args: [event_type, authorization_id]\n });\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\", (c) => c.json({\n service:\"rumbo-r2-authorizer\",\n implementation:IMPLEMENTATION,\n status:\"ok\",\n production_go:false\n}));\n\napp.get(\"/health\", (c) => c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_AUTH_ROOT_TOKEN\"),\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n repository_identity_sha256:REPOSITORY_IDENTITY_SHA256,\n package_sha256:CONTROL_PACKAGE_SHA256,\n ttl_seconds:{min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},\n capabilities:[\n \"dedicated-external-authorizer\",\n \"exact-pr-binding\",\n \"one-time-token-ledger\",\n \"audit-hash-chain\",\n \"fail-closed-merge-gate\"\n ],\n production_go:false\n}), 200, {\"Cache-Control\":\"no-store\"});\n\napp.post(\"/v1/authorize\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < MIN_TTL_SECONDS || ttl > MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const request_sha256 = await sha256(canonical(binding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM authorizations WHERE request_sha256=? LIMIT 1\",\n args:[request_sha256]\n });\n if (prior.rows.length) {\n const row:any = prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const raw_token = randomToken();\n const token_sha256 = await sha256(raw_token);\n const authorization_id = crypto.randomUUID();\n const issued = new Date();\n const issued_at = issued.toISOString();\n const expires_at = new Date(issued.getTime() + ttl * 1000).toISOString();\n\n await sqlite.execute({\n sql:`INSERT INTO authorizations(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorization_id,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n request_sha256,token_sha256,issued_at,expires_at\n ]\n });\n\n try {\n await audit(\"AUTHORIZATION_ISSUED\",authorization_id,request_sha256);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n throw e;\n }\n\n return c.json({\n authorized:true,\n authorization_id,\n action:binding.action,\n request_sha256,\n token:raw_token,\n token_type:\"One-Time\",\n issued_at,\n expires_at,\n merge_authorized:binding.action === \"MERGE_PR\",\n production_go:false,\n note:\"Raw one-time token is returned only at issuance; only SHA-256 is persisted.\"\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/consume\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorization_id = String(b.authorization_id || \"\");\n const raw_token = String(b.token || \"\");\n const consumer = String(b.consumer || \"\");\n if (!authorization_id || !/^[A-Za-z0-9_-]{43,128}$/.test(raw_token)) {\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)) {\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const request_sha256 = await sha256(canonical(binding));\n const rs = await sqlite.execute({sql:\"SELECT * FROM authorizations WHERE authorization_id=? LIMIT 1\",args:[authorization_id]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status,authorization_id},409,{\"Cache-Control\":\"no-store\"});\n }\n if (!constantTimeEqual(String(row.request_sha256),request_sha256)) {\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const observed_token_sha256 = await sha256(raw_token);\n if (!constantTimeEqual(String(row.token_sha256),observed_token_sha256)) {\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumed_at = new Date().toISOString();\n const updated:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumed_at,consumer,authorization_id]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt = {\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v1\",\n authorization_id,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n request_sha256,\n consumed_at,\n consumer,\n merge_authorized:binding.action === \"MERGE_PR\",\n production_go:false\n };\n const receipt_sha256 = await sha256(canonical(receipt));\n await audit(\"AUTHORIZATION_CONSUMED\",authorization_id,receipt_sha256);\n\n return c.json({...receipt,consumed:true,receipt_sha256},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/revoke\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const authorization_id = String(b.authorization_id || \"\");\n if (!authorization_id) return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n\n const rs = await sqlite.execute({\n sql:\"SELECT status,request_sha256,expires_at FROM authorizations WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const updated:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n\n await audit(\"AUTHORIZATION_REVOKED\",authorization_id,String(row.request_sha256));\n return c.json({revoked:true,authorization_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/ledger\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rawLimit = Number(c.req.query(\"limit\") || \"50\");\n const limit = Number.isSafeInteger(rawLimit) ? Math.max(1,Math.min(100,rawLimit)) : 50;\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM authorizations ORDER BY issued_at DESC LIMIT ?`,\n args:[now,limit]\n });\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-ledger/v1\",\n implementation:IMPLEMENTATION,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute(\"SELECT * FROM audit_events ORDER BY seq ASC\");\n let prev = \"0\".repeat(64);\n let ok = true;\n for (const r of rs.rows as any[]) {\n const event = {\n event_type:r.event_type,\n authorization_id:r.authorization_id,\n object_sha256:r.object_sha256,\n prev_event_sha256:r.prev_event_sha256,\n created_at:r.created_at\n };\n const computed = await sha256(canonical(event));\n if (String(r.prev_event_sha256) !== prev || String(r.event_sha256) !== computed) ok = false;\n prev = String(r.event_sha256);\n }\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-audit/v1\",\n audit_chain_ok:ok,\n count:rs.rows.length,\n tail_sha256:prev,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.onError((err,c) => {\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n",[157],"abe2cb29-7688-4687-8ce7-a58b78f004e2","RELEASE_V1.md","01a04b99-0a90-70cc-9f24-a87961fc51d2",["D",1787974716049],"# RUMBO R2 Dedicated Authorizer V1\n\nStatus: **LIVE_CANDIDATE / FAIL_CLOSED / PRODUCTION_NO_GO**\n\nThis val separates R2 authorization custody from the general continuity relay.\n\n## Identity pins\n\n- repository identity SHA-256:\n `59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23`\n- control package SHA-256:\n `afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\n## Security properties\n\n- dedicated encrypted controller bearer `R2_AUTH_ROOT_TOKEN`;\n- no raw bearer in source;\n- exact binding to action, PR number, base/head SHA, package SHA-256 and evidence SHA-256;\n- one-time random token returned only at issuance;\n- only token SHA-256 persisted;\n- TTL 60–900 seconds;\n- duplicate exact request rejection;\n- atomic single consumption;\n- replay rejection;\n- token mismatch rejection;\n- binding mismatch rejection;\n- expiry/revoke states;\n- independent audit hash chain;\n- ledger and audit endpoints require the dedicated bearer;\n- token hashes are not projected by ledger reads;\n- `production_go=false` invariant.\n\n## Merge gate\n\n`MERGE_PR` is checked at both issuance and consumption.\n\nIt remains disabled because:\n\n`R2_ALLOW_MERGE_AUTHORIZATION`\n\nis intentionally absent.\n\n## Live adversarial test\n\nVal Town evaluation:\n\n`01a04b98-76d2-7582-919e-e052f8b1ca26`\n\nResult: **PASS**.\n\nObserved matrix:\n\n- health → 200\n- unauthenticated ledger → 401\n- invalid repository binding → 400\n- MERGE_PR issue while disabled → 423\n- MERGE_PR consume while disabled → 423\n- TEST_ONLY issue → 201\n- wrong one-time token → 403\n- exact consume → 200\n- replay → 409\n- duplicate exact authorize → 409\n- ledger → 200\n- token-hash leakage → false\n- audit → 200\n- audit chain valid → true\n\nTest receipt SHA-256:\n\n`9c01ae930da60c2c724bcfafe10fc0d77c3f8ac79e510d4e2d6aa4f9a5563e8d`\n\nAudit tail SHA-256:\n\n`8173af91ee447e9bf0d0aa7a0beb66a88dd5ebf44a5cd4674f45eb769cb59ec9`\n\n## Boundary\n\nThis service can issue and consume exact fail-closed authorization receipts.\n\nIt does not observe GitHub independently, does not hold a GitHub App credential, does not deploy, and cannot grant product production approval.\n",[164],"pulls","branches",10,"forks","envVars",{"_177":55,"_179":20},"connections",{"_177":20,"_178":20},"count","unfilledCount","emptyCount",{"_32":163,"_13":164,"_142":165,"_144":-5,"_145":56,"_146":149,"_147":78,"_34":190,"_41":20,"_150":123,"_152":167,"_63":26,"_154":-5,"_184":191,"_111":192},{"_32":156,"_13":157,"_142":158,"_144":-5,"_145":56,"_146":149,"_147":78,"_34":187,"_41":20,"_150":160,"_152":161,"_63":26,"_154":-5,"_184":188,"_111":189},{"_32":140,"_13":141,"_142":143,"_144":-5,"_145":56,"_146":55,"_147":78,"_34":183,"_41":149,"_150":151,"_152":153,"_63":26,"_154":-5,"_184":185,"_111":186},["D",1787974730042],"children",[],[141],["D",1787974716049],[],[157],["D",1787974716049],[],[164],["D",1787974602620],["D",1789452068287],{"_11":12,"_110":106},{"_11":12,"_103":104,"_105":106,"_73":74,"_107":108,"_109":26},{"_41":55,"_13":16,"_32":56,"_39":40,"_43":33,"_44":57,"_58":50,"_59":40,"_60":53,"_54":14,"_51":12},"ctx",{"_98":-5,"_132":231,"_232":233,"_234":235,"_236":26,"_237":26,"_238":26,"_239":78,"_240":-5,"_241":-7,"_242":-7,"_243":20,"_244":26,"_245":26,"_246":-5,"_247":26,"_248":26,"_249":26,"_250":-5},"ENV",{"_202":203,"_204":205,"_206":38,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Compare

Mergev1-selftest-idempotencyintomain