[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_202":203,"_204":205},"routes/_app.x.$handle.$name",{"_114":113,"_33":60,"_123":104,"_28":124,"_13":14,"_125":-5,"_11":126,"_127":128,"_129":130,"_131":132,"_133":134,"_22":-5,"_135":-5,"_136":-5,"_137":26,"_138":139,"_140":73,"_141":-5,"_142":-5,"_143":144},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_58":59,"_33":60,"_37":61,"_62":-5,"_63":26,"_64":65,"_66":65,"_67":68,"_69":-5,"_18":70,"_71":53,"_72":73,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":81,"_82":83,"_84":85,"_86":-5,"_87":88,"_89":88,"_90":91,"_92":91,"_93":91,"_94":88,"_95":88,"_96":97,"_98":99,"_100":101,"_102":26},"version",3,"changes",[19,20,21],"aiChatInfo","userId",{"_22":50,"_24":51,"_25":26,"_27":26,"_28":52,"_30":52},{"_22":42,"_24":43,"_25":26,"_27":26,"_28":44,"_30":44},{"_22":23,"_24":-7,"_25":26,"_27":26,"_28":29,"_30":29},"file",{"_31":32,"_33":29,"_34":22,"_35":36,"_37":38,"_39":14,"_40":41,"_25":26},"previous","deleted",false,"deletedHere","path","RELEASE_V2.md","latestPath","fileId","c0cb22a8-a35d-11f1-9b65-1607ee4eb77e","name","fileType","content","# RUMBO R2 Deployer Controller V2 — Signed Authorization\n\nStatus: **PASS / LIVE_CANDIDATE / PROVIDER_UNBOUND / PRODUCTION_NO_GO**\n\nV2 closes the trust gap in V1 where a caller could supply an arbitrary\n`authorizer_receipt_sha256`. Deployment planning now accepts only a complete signed\nconsumption receipt from the dedicated R2 authorizer V2 and verifies it offline.\n\n## Pinned authorizer trust root\n\nRequired authorizer:\n\n`DEDICATED_R2_AUTHORIZER_V2_SIGNED_RECEIPTS`\n\nReceipt schema:\n\n`rumbo-r2-dedicated-authorizer-consumption/v2`\n\nAlgorithm:\n\n`ES256 / ECDSA P-256 + SHA-256`\n\nPinned signing key id:\n\n`bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY`\n\nOnly the public verification JWK is embedded in the deployer.\n\n## Plan admission\n\n`POST /v2/prepare` verifies:\n\n- exact receipt schema;\n- repository identity;\n- PR number;\n- Git base/head SHA syntax;\n- sealed control-package SHA-256;\n- evidence and request SHA-256;\n- consumed timestamp;\n- exact production-go false;\n- exact action/merge-authorized consistency;\n- receipt SHA-256 recomputation;\n- signing algorithm and key id;\n- ES256 signature under the pinned public key.\n\nThe plan is derived from the verified receipt rather than duplicate caller-supplied\nbinding fields.\n\nV1 unsigned endpoints are retired with HTTP 410.\n\n## Execution policy\n\nA cryptographically valid `TEST_ONLY` receipt may be stored as a non-executable\nevidence plan, but `POST /v2/execute` rejects it with:\n\n`AUTHORIZER_ACTION_NOT_MERGE_PR`\n\nbefore checking the deployment enable flag.\n\nFor an executable path, all of the following would be required:\n\n1. signed authorizer action `MERGE_PR`;\n2. signed `merge_authorized=true`;\n3. receipt age <= 900 seconds;\n4. `R2_ALLOW_DEPLOY=true`;\n5. a dedicated GitHub App provider credential;\n6. a provider adapter.\n\nThe current runtime fails closed before those conditions:\n\n- deploy enabled: false;\n- GitHub App credential: absent;\n- provider adapter: `NOT_BOUND`;\n- production_go: false.\n\n## Adversarial validation\n\nBranch evaluation:\n\n`01a04ba9-dcc8-767a-9cae-18783c6e0100`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- pinned signed fixture verifies → true;\n- tampered local fixture verifies → false;\n- unauthenticated ledger → 401;\n- V1 unsigned endpoint → 410;\n- tampered signed receipt admission → 400;\n- forged TEST_ONLY→MERGE_PR elevation → 400;\n- unsigned V1 receipt admission → 400;\n- valid signed TEST_ONLY prepare → 201;\n- execute TEST_ONLY plan → 403;\n- duplicate prepare → 409;\n- ledger → 200;\n- signature bytes exposed by ledger → false;\n- audit → 200;\n- audit chain valid → true.\n\nFixture authorizer receipt SHA-256:\n\n`e493623c38a1028e7263311300cb558cc8b69665a718ae9c0845a78e9b03602b`\n\n## Claim boundary\n\nThe deployer controller now independently authenticates authorizer receipts. This closes\nreceipt authenticity and action-escalation gaps between authorization custody and\ndeployment planning.\n\nActual provider execution is still not live and remains impossible under current gates.\nNo merge, deployment or product-production authorization is implied.\n","createdAt",["D",1787975848674],"branchVersion","branchId","05a3146a-0d13-441a-b505-9ff526f70e96",{"_31":45,"_33":44,"_34":46,"_35":48,"_37":49,"_39":14,"_40":41,"_25":26},{"_31":45,"_33":44,"_34":46,"_35":47},"selftest.ts","b2269e78-a35b-11f1-ac36-1607ee4eb77e","script","const base=\"https://sebas1--01a04b9be3e172f68a596ed93f6848e8.web.val.run\";\nconst root=Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\");\nif(!root)throw new Error(\"ROOT_TOKEN_MISSING\");\nconst headers={Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\n\nconst healthRes=await fetch(base+\"/health\");\nconst health=await healthRes.json();\nconst unauthRes=await fetch(base+\"/v1/ledger\");\n\nconst invalidRes=await fetch(base+\"/v1/prepare\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n repository_identity_sha256:\"0\".repeat(64),pr_number:412,\n base_sha:\"1\".repeat(40),head_sha:\"2\".repeat(40),\n package_sha256:\"3\".repeat(64),evidence_sha256:\"4\".repeat(64),\n authorizer_receipt_sha256:\"5\".repeat(64)\n })\n});\n\nconst rb=new Uint8Array(32);crypto.getRandomValues(rb);\nconst evidence=[...rb].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nconst rr=new Uint8Array(32);crypto.getRandomValues(rr);\nconst receipt=[...rr].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n\nconst binding={\n repository_identity_sha256:\"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\",\n pr_number:412,\n base_sha:\"1ad77acefc7326595c50d7b0edffa81a2188e737\",\n head_sha:\"d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7\",\n package_sha256:\"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\",\n evidence_sha256:evidence,\n authorizer_receipt_sha256:receipt\n};\n\nconst prepareRes=await fetch(base+\"/v1/prepare\",{method:\"POST\",headers,body:JSON.stringify(binding)});\nconst prepared:any=await prepareRes.json();\nif(prepareRes.status!==201)throw new Error(`PREPARE_FAILED_${prepareRes.status}_${prepared.error||\"UNKNOWN\"}`);\n\nconst executeRes=await fetch(base+\"/v1/execute\",{method:\"POST\",headers,body:JSON.stringify({plan_id:prepared.plan_id})});\nconst execute:any=await executeRes.json();\n\nconst duplicateRes=await fetch(base+\"/v1/prepare\",{method:\"POST\",headers,body:JSON.stringify(binding)});\nconst cancelRes=await fetch(base+\"/v1/cancel\",{method:\"POST\",headers,body:JSON.stringify({plan_id:prepared.plan_id})});\nconst executeAfterCancelRes=await fetch(base+\"/v1/execute\",{method:\"POST\",headers,body:JSON.stringify({plan_id:prepared.plan_id})});\n\nconst ledgerRes=await fetch(base+\"/v1/ledger\",{headers});\nconst ledger:any=await ledgerRes.json();\nconst auditRes=await fetch(base+\"/v1/audit\",{headers});\nconst audit:any=await auditRes.json();\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"R2_DEPLOYER_CONTROLLER_V1\"&&\n health.root_token_configured===true&&\n health.deploy_enabled===false&&\n health.provider_credential_configured===false&&\n health.provider_adapter===\"NOT_BOUND\"&&\n health.production_go===false&&\n unauthRes.status===401&&\n invalidRes.status===400&&\n prepareRes.status===201&&\n prepared.executable===false&&\n Array.isArray(prepared.blocked_by)&&prepared.blocked_by.length===3&&\n executeRes.status===423&&execute.error===\"DEPLOY_DISABLED\"&&\n duplicateRes.status===409&&\n cancelRes.status===200&&\n executeAfterCancelRes.status===409&&\n ledgerRes.status===200&&\n ledger.deploy_enabled===false&&\n ledger.production_go===false&&\n auditRes.status===200&&audit.audit_chain_ok===true&&audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n unauthenticated_ledger:unauthRes.status,\n invalid_binding:invalidRes.status,\n prepare:prepareRes.status,\n execute_disabled:executeRes.status,\n duplicate_prepare:duplicateRes.status,\n cancel:cancelRes.status,\n execute_after_cancel:executeAfterCancelRes.status,\n ledger:ledgerRes.status,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n plan_id:prepared.plan_id,\n request_sha256:prepared.request_sha256,\n blocked_by:prepared.blocked_by,\n production_go:false,\n deploy_enabled:false\n},null,2));\nif(!pass)Deno.exit(1);\n","const base=\"https://sebas1--01a04ba86323734bb57a4c05426762a8.web.val.run\";\nconst root=Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\");\nif(!root)throw new Error(\"ROOT_TOKEN_MISSING\");\nconst headers={Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\n\nconst fixture={\n \"schema\": \"rumbo-r2-dedicated-authorizer-consumption/v2\",\n \"authorization_id\": \"7aa8e26c-f136-456d-a217-9cf68eacf0d8\",\n \"action\": \"TEST_ONLY\",\n \"repository_identity_sha256\": \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\",\n \"pr_number\": 412,\n \"base_sha\": \"1ad77acefc7326595c50d7b0edffa81a2188e737\",\n \"head_sha\": \"d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7\",\n \"package_sha256\": \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\",\n \"evidence_sha256\": \"c70f96fa0b51130b8137da5c834020e2a218a55352810905b74e82e3a337b412\",\n \"request_sha256\": \"0ae6913ded0e0855ff989d3f3c4558815624346161b723125f6cfcc574733e85\",\n \"consumed_at\": \"2026-08-29T03:55:14.461Z\",\n \"consumer\": \"deployer-v2-fixture\",\n \"merge_authorized\": false,\n \"production_go\": false,\n \"consumed\": true,\n \"receipt_sha256\": \"e493623c38a1028e7263311300cb558cc8b69665a718ae9c0845a78e9b03602b\",\n \"receipt_signature\": {\n \"alg\": \"ES256\",\n \"kid\": \"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\",\n \"signature_b64url\": \"z4tsHUI4OmoeLQgqZfBnWOfQ-4xq0ej6bLiOf7X81eGvOzTEAtTOH68IW5QgoRj_3xP_9eE4GrpjtTA7sFpYrQ\"\n }\n};\n\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nfunction canonicalReceipt(v:any){\n return {\n schema:v.schema,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nasync function localVerify(v:any,jwk:JsonWebKey):Promise{\n const canon=canonical(canonicalReceipt(v));\n if(await sha256(canon)!==v.receipt_sha256)return false;\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n return await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},\n key,\n b64urlDecode(v.receipt_signature.signature_b64url),\n new TextEncoder().encode(canon)\n );\n}\n\nconst healthRes=await fetch(base+\"/health\");\nconst health:any=await healthRes.json();\nconst localSignatureValid=healthRes.status===200\n ? await localVerify(fixture,health.authorizer?.verify_jwk)\n : false;\nconst localTamperValid=healthRes.status===200\n ? await localVerify({...fixture,evidence_sha256:\"f\".repeat(64)},health.authorizer?.verify_jwk)\n : true;\n\nconst unauthRes=await fetch(base+\"/v2/ledger\");\nconst retiredV1Res=await fetch(base+\"/v1/prepare\",{method:\"POST\",headers,body:\"{}\"});\n\nconst tampered={...fixture,evidence_sha256:\"f\".repeat(64)};\nconst tamperedRes=await fetch(base+\"/v2/prepare\",{\n method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:tampered})\n});\nconst forgedMerge={...fixture,action:\"MERGE_PR\",merge_authorized:true};\nconst forgedMergeRes=await fetch(base+\"/v2/prepare\",{\n method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:forgedMerge})\n});\nconst unsignedV1={...fixture,schema:\"rumbo-r2-dedicated-authorizer-consumption/v1\"};\ndelete (unsignedV1 as any).receipt_signature;\nconst unsignedV1Res=await fetch(base+\"/v2/prepare\",{\n method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:unsignedV1})\n});\n\nconst prepareRes=await fetch(base+\"/v2/prepare\",{\n method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:fixture})\n});\nconst prepared:any=await prepareRes.json();\nif(prepareRes.status!==201&&prepareRes.status!==409){\n throw new Error(`PREPARE_UNEXPECTED_${prepareRes.status}_${prepared.error||\"UNKNOWN\"}`);\n}\nif(prepareRes.status===409&&prepared.status!==\"PREPARED\"){\n throw new Error(\"EXISTING_FIXTURE_PLAN_NOT_PREPARED\");\n}\nconst planId=String(prepared.plan_id||\"\");\nif(!planId)throw new Error(\"PLAN_ID_MISSING\");\n\nconst executeRes=await fetch(base+\"/v2/execute\",{\n method:\"POST\",headers,body:JSON.stringify({plan_id:planId})\n});\nconst execute:any=await executeRes.json();\n\nconst duplicateRes=await fetch(base+\"/v2/prepare\",{\n method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:fixture})\n});\n\nconst ledgerRes=await fetch(base+\"/v2/ledger\",{headers});\nconst ledger:any=await ledgerRes.json();\nconst fixturePlan=Array.isArray(ledger.records)\n ? ledger.records.find((x:any)=>String(x.plan_id)===planId)\n : null;\nconst signatureSecretLeak=Array.isArray(ledger.records)\n ? ledger.records.some((x:any)=>Object.prototype.hasOwnProperty.call(x,\"authorizer_signature_b64url\"))\n : true;\n\nconst auditRes=await fetch(base+\"/v2/audit\",{headers});\nconst audit:any=await auditRes.json();\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"R2_DEPLOYER_CONTROLLER_V2_SIGNED_AUTHORIZATION\"&&\n health.root_token_configured===true&&\n health.deploy_enabled===false&&\n health.provider_credential_configured===false&&\n health.provider_adapter===\"NOT_BOUND\"&&\n health.production_go===false&&\n health.authorizer?.implementation===\"DEDICATED_R2_AUTHORIZER_V2_SIGNED_RECEIPTS\"&&\n health.authorizer?.signature_alg===\"ES256\"&&\n health.authorizer?.signing_kid===\"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\"&&\n health.execution_policy?.required_authorizer_action===\"MERGE_PR\"&&\n health.execution_policy?.test_only_never_executable===true&&\n localSignatureValid===true&&\n localTamperValid===false&&\n unauthRes.status===401&&\n retiredV1Res.status===410&&\n tamperedRes.status===400&&\n forgedMergeRes.status===400&&\n unsignedV1Res.status===400&&\n (prepareRes.status===201||prepareRes.status===409)&&\n executeRes.status===403&&\n execute.error===\"AUTHORIZER_ACTION_NOT_MERGE_PR\"&&\n duplicateRes.status===409&&\n ledgerRes.status===200&&\n ledger.production_go===false&&\n fixturePlan?.authorizer_action===\"TEST_ONLY\"&&\n Number(fixturePlan?.authorizer_merge_authorized)===0&&\n fixturePlan?.authorizer_receipt_sha256===fixture.receipt_sha256&&\n fixturePlan?.authorizer_signature_kid===fixture.receipt_signature.kid&&\n signatureSecretLeak===false&&\n auditRes.status===200&&\n audit.audit_chain_ok===true&&\n audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n local_signed_fixture_verified:localSignatureValid,\n local_tamper_verified:localTamperValid,\n unauthenticated_ledger:unauthRes.status,\n v1_unsigned_endpoint_retired:retiredV1Res.status,\n tampered_receipt_prepare:tamperedRes.status,\n forged_merge_receipt_prepare:forgedMergeRes.status,\n unsigned_v1_receipt_prepare:unsignedV1Res.status,\n prepare:prepareRes.status,\n execute_test_only:executeRes.status,\n duplicate_prepare:duplicateRes.status,\n ledger:ledgerRes.status,\n signature_bytes_leaked_in_ledger:signatureSecretLeak,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n plan_id:planId,\n authorizer_receipt_sha256:fixture.receipt_sha256,\n authorizer_signing_kid:fixture.receipt_signature.kid,\n production_go:false,\n deploy_enabled:false\n},null,2));\nif(!pass)Deno.exit(1);\n",["D",1787975848674],{"_31":53,"_33":52,"_34":54,"_35":56,"_37":57,"_39":14,"_40":41,"_25":26},{"_31":53,"_33":52,"_34":54,"_35":55},"main.tsx","862fe8ba-a35b-11f1-8a2b-1607ee4eb77e","http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\nconst IMPLEMENTATION = \"R2_DEPLOYER_CONTROLLER_V1\";\nconst REPO_IDENTITY = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst SHA256_RE=/^[a-f0-9]{64}$/;\nconst GIT_SHA_RE=/^[a-f0-9]{40}$/;\nconst MAX_BODY=64*1024;\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS deploy_plans(\n plan_id TEXT PRIMARY KEY,\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n authorizer_receipt_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('PREPARED','CANCELLED','EXECUTED')),\n created_at TEXT NOT NULL,\n executed_at TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS deploy_audit(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n plan_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_prev ON deploy_audit(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_event_plan ON deploy_audit(event_type,plan_id)\n WHERE plan_id IS NOT NULL`\n]);\n\nfunction bearer(req:Request){\n const h=req.headers.get(\"authorization\")||\"\";\n return h.startsWith(\"Bearer \")?h.slice(7):\"\";\n}\nfunction ct(a:string,b:string){\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0; for(let i=0;i;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string){\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nasync function bodyJson(c:any){\n const len=Number(c.req.header(\"content-length\")||\"0\");\n if(Number.isFinite(len)&&len>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt=await c.req.text();\n if(new TextEncoder().encode(txt).length>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt||\"{}\");\n}\nfunction parse(v:any){\n const x={\n repository_identity_sha256:String(v?.repository_identity_sha256||\"\"),\n pr_number:Number(v?.pr_number),\n base_sha:String(v?.base_sha||\"\"),\n head_sha:String(v?.head_sha||\"\"),\n package_sha256:String(v?.package_sha256||\"\"),\n evidence_sha256:String(v?.evidence_sha256||\"\"),\n authorizer_receipt_sha256:String(v?.authorizer_receipt_sha256||\"\")\n };\n if(x.repository_identity_sha256!==REPO_IDENTITY)return null;\n if(!Number.isSafeInteger(x.pr_number)||x.pr_number<=0)return null;\n if(!GIT_SHA_RE.test(x.base_sha)||!GIT_SHA_RE.test(x.head_sha))return null;\n if(x.package_sha256!==PACKAGE_SHA256)return null;\n if(!SHA256_RE.test(x.evidence_sha256)||!SHA256_RE.test(x.authorizer_receipt_sha256))return null;\n return x;\n}\nasync function audit(event_type:string,plan_id:string|null,object_sha256:string|null){\n if(plan_id){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM deploy_audit WHERE event_type=? AND plan_id=? LIMIT 1\",args:[event_type,plan_id]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n for(let attempt=0;attempt<8;attempt++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM deploy_audit ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,plan_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256=await sha256(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO deploy_audit(event_type,plan_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,plan_id,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n }catch(e){\n if(plan_id){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM deploy_audit WHERE event_type=? AND plan_id=? LIMIT 1\",args:[event_type,plan_id]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n if(!String(e).includes(\"UNIQUE\"))throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-deployer\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\napp.get(\"/health\",c=>c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\"),\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n provider_credential_configured:!!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"),\n provider_adapter:\"NOT_BOUND\",\n package_sha256:PACKAGE_SHA256,\n production_go:false\n}),200,{\"Cache-Control\":\"no-store\"});\n\napp.post(\"/v1/prepare\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),binding=parse(b);\n if(!binding)return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n const request_sha256=await sha256(canonical(binding));\n const prior=await sqlite.execute({sql:\"SELECT plan_id,status FROM deploy_plans WHERE request_sha256=? LIMIT 1\",args:[request_sha256]});\n if(prior.rows.length)return c.json({error:\"PLAN_ALREADY_EXISTS\",plan_id:prior.rows[0].plan_id,status:prior.rows[0].status,request_sha256},409,{\"Cache-Control\":\"no-store\"});\n const plan_id=crypto.randomUUID(),created_at=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO deploy_plans(plan_id,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256,authorizer_receipt_sha256,request_sha256,status,created_at)\n VALUES(?,?,?,?,?,?,?,?,?,'PREPARED',?)`,\n args:[plan_id,binding.repository_identity_sha256,binding.pr_number,binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,binding.authorizer_receipt_sha256,request_sha256,created_at]});\n await audit(\"PLAN_PREPARED\",plan_id,request_sha256);\n return c.json({\n prepared:true,plan_id,request_sha256,\n executable:false,\n blocked_by:[\"R2_ALLOW_DEPLOY_FALSE\",\"PROVIDER_ADAPTER_NOT_BOUND\",\"GITHUB_APP_CREDENTIAL_NOT_CONFIGURED\"],\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n }catch(e){return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});}\n});\n\napp.post(\"/v1/execute\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)!==\"PREPARED\")return c.json({error:\"PLAN_NOT_PREPARED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\")\n return c.json({error:\"DEPLOY_DISABLED\",plan_id,production_go:false},423,{\"Cache-Control\":\"no-store\"});\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"))\n return c.json({error:\"PROVIDER_CREDENTIAL_NOT_CONFIGURED\",plan_id,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n return c.json({error:\"PROVIDER_ADAPTER_NOT_IMPLEMENTED\",plan_id,production_go:false},501,{\"Cache-Control\":\"no-store\"});\n }catch(e){return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});}\n});\n\napp.post(\"/v1/cancel\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const updated:any=await sqlite.execute({sql:\"UPDATE deploy_plans SET status='CANCELLED' WHERE plan_id=? AND status='PREPARED'\",args:[plan_id]});\n if(Number(updated?.rowsAffected??0)!==1)return c.json({error:\"PLAN_NOT_CANCELLABLE\"},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"PLAN_CANCELLED\",plan_id,null);\n return c.json({cancelled:true,plan_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});}\n});\n\napp.get(\"/v1/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT plan_id,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256,authorizer_receipt_sha256,request_sha256,status,created_at,executed_at\n FROM deploy_plans ORDER BY created_at DESC LIMIT 100`);\n return c.json({schema:\"rumbo-r2-deployer-ledger/v1\",implementation:IMPLEMENTATION,deploy_enabled:false,production_go:false,records:rs.rows},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM deploy_audit ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,plan_id:r.plan_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.onError((err,c)=>{console.error(err);return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});});\nexport default app.fetch;\n","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\n\nconst IMPLEMENTATION = \"R2_DEPLOYER_CONTROLLER_V2_SIGNED_AUTHORIZATION\";\nconst REPO_IDENTITY = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst AUTHORIZER_IMPLEMENTATION = \"DEDICATED_R2_AUTHORIZER_V2_SIGNED_RECEIPTS\";\nconst AUTHORIZER_SIGNING_KID = \"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\";\nconst AUTHORIZER_VERIFY_JWK: JsonWebKey = {\n kty:\"EC\",\n crv:\"P-256\",\n x:\"TV0M-YRfRzqMB6dTZIhLOu7w21Tkgul-lUns7HwpHy4\",\n y:\"mRWAIOykqSBgsAXqC9t3OOmk3KLljPH935lilXma-W4\",\n key_ops:[\"verify\"],\n ext:true\n};\nconst SHA256_RE=/^[a-f0-9]{64}$/;\nconst GIT_SHA_RE=/^[a-f0-9]{40}$/;\nconst B64URL_RE=/^[A-Za-z0-9_-]{80,128}$/;\nconst MAX_BODY=64*1024;\nconst MAX_EXEC_RECEIPT_AGE_SECONDS=900;\n\ntype AuthorizerAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype VerifiedReceipt = {\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v2\";\n authorization_id:string;\n action:AuthorizerAction;\n repository_identity_sha256:string;\n pr_number:number;\n base_sha:string;\n head_sha:string;\n package_sha256:string;\n evidence_sha256:string;\n request_sha256:string;\n consumed_at:string;\n consumer:string;\n merge_authorized:boolean;\n production_go:false;\n consumed:true;\n receipt_sha256:string;\n receipt_signature:{\n alg:\"ES256\";\n kid:string;\n signature_b64url:string;\n };\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS deploy_plans_v2(\n plan_id TEXT PRIMARY KEY,\n authorizer_action TEXT NOT NULL CHECK(authorizer_action IN ('TEST_ONLY','MERGE_PR')),\n authorizer_authorization_id TEXT NOT NULL UNIQUE,\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n authorizer_request_sha256 TEXT NOT NULL,\n authorizer_receipt_sha256 TEXT NOT NULL UNIQUE,\n authorizer_signature_kid TEXT NOT NULL,\n authorizer_signature_b64url TEXT NOT NULL,\n authorizer_consumed_at TEXT NOT NULL,\n authorizer_merge_authorized INTEGER NOT NULL CHECK(authorizer_merge_authorized IN (0,1)),\n request_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('PREPARED','CANCELLED','EXECUTED')),\n created_at TEXT NOT NULL,\n executed_at TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_deploy_plans_v2_status ON deploy_plans_v2(status,created_at)`,\n `CREATE TABLE IF NOT EXISTS deploy_audit_v2(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n plan_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v2_prev ON deploy_audit_v2(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v2_event_plan\n ON deploy_audit_v2(event_type,plan_id)\n WHERE plan_id IS NOT NULL`\n]);\n\nfunction bearer(req:Request):string {\n const h=req.headers.get(\"authorization\")||\"\";\n return h.startsWith(\"Bearer \")?h.slice(7):\"\";\n}\nfunction ct(a:string,b:string):boolean {\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0; for(let i=0;i;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise {\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array {\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nasync function bodyJson(c:any):Promise {\n const len=Number(c.req.header(\"content-length\")||\"0\");\n if(Number.isFinite(len)&&len>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt=await c.req.text();\n if(new TextEncoder().encode(txt).length>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt||\"{}\");\n}\nfunction canonicalReceiptFromResponse(v:any) {\n return {\n schema:v.schema,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nfunction structuralReceiptCheck(v:any):v is VerifiedReceipt {\n if(!v||typeof v!==\"object\")return false;\n if(v.schema!==\"rumbo-r2-dedicated-authorizer-consumption/v2\")return false;\n if(typeof v.authorization_id!==\"string\"||v.authorization_id.length<16||v.authorization_id.length>128)return false;\n if(v.action!==\"TEST_ONLY\"&&v.action!==\"MERGE_PR\")return false;\n if(v.repository_identity_sha256!==REPO_IDENTITY)return false;\n if(!Number.isSafeInteger(v.pr_number)||v.pr_number<=0)return false;\n if(!GIT_SHA_RE.test(String(v.base_sha||\"\"))||!GIT_SHA_RE.test(String(v.head_sha||\"\")))return false;\n if(v.package_sha256!==PACKAGE_SHA256)return false;\n if(!SHA256_RE.test(String(v.evidence_sha256||\"\"))||!SHA256_RE.test(String(v.request_sha256||\"\")))return false;\n if(!Number.isFinite(Date.parse(String(v.consumed_at||\"\"))))return false;\n if(typeof v.consumer!==\"string\"||!/^[A-Za-z0-9_.:-]{1,128}$/.test(v.consumer))return false;\n if(v.consumed!==true||v.production_go!==false)return false;\n if(typeof v.merge_authorized!==\"boolean\")return false;\n if(v.merge_authorized!==(v.action===\"MERGE_PR\"))return false;\n if(!SHA256_RE.test(String(v.receipt_sha256||\"\")))return false;\n if(v.receipt_signature?.alg!==\"ES256\"||v.receipt_signature?.kid!==AUTHORIZER_SIGNING_KID)return false;\n if(!B64URL_RE.test(String(v.receipt_signature?.signature_b64url||\"\")))return false;\n return true;\n}\nasync function verifyAuthorizerReceipt(v:any):Promise<{ok:true;receipt:VerifiedReceipt}|{ok:false;error:string}> {\n if(!structuralReceiptCheck(v))return {ok:false,error:\"INVALID_AUTHORIZER_RECEIPT_STRUCTURE\"};\n const canonicalReceipt=canonical(canonicalReceiptFromResponse(v));\n const computed=await sha256(canonicalReceipt);\n if(!ct(computed,String(v.receipt_sha256)))return {ok:false,error:\"AUTHORIZER_RECEIPT_HASH_MISMATCH\"};\n let key:CryptoKey;\n try {\n key=await crypto.subtle.importKey(\"jwk\",AUTHORIZER_VERIFY_JWK,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n } catch {\n return {ok:false,error:\"AUTHORIZER_VERIFY_KEY_IMPORT_FAILED\"};\n }\n let signature:Uint8Array;\n try {\n signature=b64urlDecode(v.receipt_signature.signature_b64url);\n } catch {\n return {ok:false,error:\"AUTHORIZER_SIGNATURE_ENCODING_INVALID\"};\n }\n const verified=await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},\n key,\n signature,\n new TextEncoder().encode(canonicalReceipt)\n );\n if(!verified)return {ok:false,error:\"AUTHORIZER_RECEIPT_SIGNATURE_INVALID\"};\n return {ok:true,receipt:v};\n}\nasync function audit(event_type:string,plan_id:string|null,object_sha256:string|null) {\n if(plan_id){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM deploy_audit_v2 WHERE event_type=? AND plan_id=? LIMIT 1\",args:[event_type,plan_id]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n for(let attempt=0;attempt<8;attempt++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM deploy_audit_v2 ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,plan_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256=await sha256(canonical(ev));\n try{\n await sqlite.execute({\n sql:`INSERT INTO deploy_audit_v2(event_type,plan_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,\n args:[event_type,plan_id,object_sha256,prev,event_sha256,created_at]\n });\n return event_sha256;\n }catch(e){\n if(plan_id){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM deploy_audit_v2 WHERE event_type=? AND plan_id=? LIMIT 1\",args:[event_type,plan_id]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n if(!String(e).includes(\"UNIQUE\"))throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-deployer\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\napp.get(\"/health\",c=>c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\"),\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n provider_credential_configured:!!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"),\n provider_adapter:\"NOT_BOUND\",\n package_sha256:PACKAGE_SHA256,\n authorizer:{\n implementation:AUTHORIZER_IMPLEMENTATION,\n receipt_schema:\"rumbo-r2-dedicated-authorizer-consumption/v2\",\n signature_alg:\"ES256\",\n signing_kid:AUTHORIZER_SIGNING_KID,\n verify_jwk:AUTHORIZER_VERIFY_JWK,\n offline_signature_verification:true\n },\n execution_policy:{\n required_authorizer_action:\"MERGE_PR\",\n max_receipt_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,\n test_only_never_executable:true\n },\n capabilities:[\n \"signed-authorizer-receipt-verification\",\n \"exact-receipt-to-plan-binding\",\n \"test-only-non-executable\",\n \"fail-closed-provider-gate\",\n \"audit-hash-chain\"\n ],\n production_go:false\n}),200,{\"Cache-Control\":\"no-store\"});\n\napp.post(\"/v2/prepare\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c);\n const verified=await verifyAuthorizerReceipt(b?.authorizer_receipt);\n if(!verified.ok)return c.json({error:verified.error,production_go:false},400,{\"Cache-Control\":\"no-store\"});\n const r=verified.receipt;\n const planBinding={\n authorizer_action:r.action,\n authorizer_authorization_id:r.authorization_id,\n repository_identity_sha256:r.repository_identity_sha256,\n pr_number:r.pr_number,\n base_sha:r.base_sha,\n head_sha:r.head_sha,\n package_sha256:r.package_sha256,\n evidence_sha256:r.evidence_sha256,\n authorizer_request_sha256:r.request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n authorizer_signature_kid:r.receipt_signature.kid,\n authorizer_consumed_at:r.consumed_at,\n authorizer_merge_authorized:r.merge_authorized\n };\n const request_sha256=await sha256(canonical(planBinding));\n const prior=await sqlite.execute({\n sql:\"SELECT plan_id,status,authorizer_action FROM deploy_plans_v2 WHERE request_sha256=? LIMIT 1\",\n args:[request_sha256]\n });\n if(prior.rows.length)return c.json({\n error:\"PLAN_ALREADY_EXISTS\",\n plan_id:prior.rows[0].plan_id,\n status:prior.rows[0].status,\n authorizer_action:prior.rows[0].authorizer_action,\n request_sha256,\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n\n const plan_id=crypto.randomUUID(),created_at=new Date().toISOString();\n await sqlite.execute({\n sql:`INSERT INTO deploy_plans_v2(\n plan_id,authorizer_action,authorizer_authorization_id,repository_identity_sha256,\n pr_number,base_sha,head_sha,package_sha256,evidence_sha256,authorizer_request_sha256,\n authorizer_receipt_sha256,authorizer_signature_kid,authorizer_signature_b64url,\n authorizer_consumed_at,authorizer_merge_authorized,request_sha256,status,created_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'PREPARED',?)`,\n args:[\n plan_id,r.action,r.authorization_id,r.repository_identity_sha256,r.pr_number,\n r.base_sha,r.head_sha,r.package_sha256,r.evidence_sha256,r.request_sha256,\n r.receipt_sha256,r.receipt_signature.kid,r.receipt_signature.signature_b64url,\n r.consumed_at,r.merge_authorized?1:0,request_sha256,created_at\n ]\n });\n await audit(\"PLAN_PREPARED\",plan_id,request_sha256);\n\n const blocked_by:string[]=[];\n if(r.action!==\"MERGE_PR\"||r.merge_authorized!==true)blocked_by.push(\"AUTHORIZER_ACTION_NOT_MERGE_PR\");\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\")blocked_by.push(\"R2_ALLOW_DEPLOY_FALSE\");\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"))blocked_by.push(\"GITHUB_APP_CREDENTIAL_NOT_CONFIGURED\");\n blocked_by.push(\"PROVIDER_ADAPTER_NOT_BOUND\");\n\n return c.json({\n prepared:true,\n plan_id,\n request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n authorizer_signature_verified:true,\n authorizer_action:r.action,\n executable:false,\n blocked_by,\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v2/execute\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v2 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)!==\"PREPARED\")return c.json({error:\"PLAN_NOT_PREPARED\",status:row.status,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n if(String(row.authorizer_action)!==\"MERGE_PR\"||Number(row.authorizer_merge_authorized)!==1){\n return c.json({error:\"AUTHORIZER_ACTION_NOT_MERGE_PR\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumedMs=Date.parse(String(row.authorizer_consumed_at||\"\"));\n const ageSeconds=(Date.now()-consumedMs)/1000;\n if(!Number.isFinite(ageSeconds)||ageSeconds< -300||ageSeconds>MAX_EXEC_RECEIPT_AGE_SECONDS){\n return c.json({error:\"AUTHORIZER_RECEIPT_STALE\",plan_id,max_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\"){\n return c.json({error:\"DEPLOY_DISABLED\",plan_id,production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\")){\n return c.json({error:\"PROVIDER_CREDENTIAL_NOT_CONFIGURED\",plan_id,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n }\n return c.json({error:\"PROVIDER_ADAPTER_NOT_IMPLEMENTED\",plan_id,production_go:false},501,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v2/cancel\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const updated:any=await sqlite.execute({\n sql:\"UPDATE deploy_plans_v2 SET status='CANCELLED' WHERE plan_id=? AND status='PREPARED'\",\n args:[plan_id]\n });\n if(Number(updated?.rowsAffected??0)!==1)return c.json({error:\"PLAN_NOT_CANCELLABLE\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"PLAN_CANCELLED\",plan_id,null);\n return c.json({cancelled:true,plan_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v2/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT\n plan_id,authorizer_action,authorizer_authorization_id,repository_identity_sha256,\n pr_number,base_sha,head_sha,package_sha256,evidence_sha256,authorizer_request_sha256,\n authorizer_receipt_sha256,authorizer_signature_kid,authorizer_consumed_at,\n authorizer_merge_authorized,request_sha256,status,created_at,executed_at\n FROM deploy_plans_v2 ORDER BY created_at DESC LIMIT 100`);\n return c.json({\n schema:\"rumbo-r2-deployer-ledger/v2\",\n implementation:IMPLEMENTATION,\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n provider_credential_configured:!!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"),\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v2/audit\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM deploy_audit_v2 ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={\n event_type:r.event_type,\n plan_id:r.plan_id,\n object_sha256:r.object_sha256,\n prev_event_sha256:r.prev_event_sha256,\n created_at:r.created_at\n };\n const h=await sha256(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({\n schema:\"rumbo-r2-deployer-audit/v2\",\n audit_chain_ok:ok,\n count:rs.rows.length,\n tail_sha256:prev,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\n/* V1 endpoints are retired rather than silently accepting unsigned receipt hashes. */\napp.all(\"/v1/*\",c=>c.json({\n error:\"V1_UNSIGNED_AUTHORIZATION_RETIRED_USE_V2_SIGNED_RECEIPT\",\n replacement_prepare:\"/v2/prepare\",\n production_go:false\n},410,{\"Cache-Control\":\"no-store\"}));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\nexport default app.fetch;\n",["D",1787975848674],"id","dc841a2e-8ac0-491d-b8e5-ee9e11dc6e2a","rumbo-r2-deployer",["D",1787974891297],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Fail-closed RUMBO R2 deployer controller","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","dc841a2e8ac0491db8e5ee9e11dc6e2a","tursoHostname","dc841a2e8ac0491db8e5ee9e11dc6e2a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789452068287],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_114":113,"_122":118},"org",{"_114":113,"_115":116,"_117":118,"_18":70,"_119":120,"_121":26},"branch",{"_13":103,"_33":104,"_58":41,"_105":59,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":-5,"_111":60,"_112":113},"isOwned",20,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_58":59,"_33":60,"_37":197,"_62":-5,"_63":26,"_64":65,"_66":65,"_67":68,"_69":-5,"_18":70,"_71":53,"_72":73,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":81,"_82":83,"_84":198,"_86":-5,"_87":88,"_89":88,"_90":91,"_92":91,"_93":91,"_94":88,"_95":88,"_96":199,"_98":200,"_100":201,"_102":26},"tree",[180,181,182,183],"files",[180,181,182,183],"counts",{"_169":77,"_170":171,"_172":77,"_173":174,"_175":176},"contents",[145,146,147,148],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_58":163,"_33":164,"_31":165,"_150":-5,"_40":41,"_39":158,"_151":73,"_37":166,"_13":77,"_34":22,"_35":167,"_25":26,"_154":-5,"_28":168},{"_58":160,"_33":29,"_31":32,"_150":-5,"_40":41,"_39":14,"_151":73,"_37":161,"_13":77,"_34":22,"_35":36,"_25":26,"_154":-5,"_28":162},{"_58":156,"_33":52,"_31":53,"_150":-5,"_40":41,"_39":14,"_151":26,"_37":157,"_13":158,"_34":54,"_35":56,"_25":26,"_154":-5,"_28":159},{"_58":149,"_33":44,"_31":45,"_150":-5,"_40":41,"_39":14,"_151":26,"_37":152,"_13":153,"_34":46,"_35":48,"_25":26,"_154":-5,"_28":155},"898a0424-7b76-42aa-8a5b-7ffe14aa140d","parentId","latest",["D",1787975848674],1,"label",[44],"bd1aa2f1-a344-4941-9f5d-ebb325c1ace0",["D",1787975848674],2,[52],"7811ccdf-34c7-4066-abdb-2a383f02d20a",["D",1787975848674],[29],"cc2a0c6b-cc20-4ee8-98dd-44022aabc1be","RELEASE_V1.md","b226513e-a35b-11f1-ac36-1607ee4eb77e",["D",1787974965083],"# RUMBO R2 Deployer Controller V1\n\nStatus: **LIVE_CANDIDATE / FAIL_CLOSED / PROVIDER_UNBOUND / PRODUCTION_NO_GO**\n\nThis service creates an independent deployment-control boundary separate from both the\ncontinuity relay and the dedicated R2 authorizer.\n\n## Current safety state\n\n- controller bearer: encrypted environment variable `R2_DEPLOY_ROOT_TOKEN`;\n- deploy enable gate `R2_ALLOW_DEPLOY`: absent / false;\n- GitHub App provider credential `R2_GITHUB_APP_TOKEN`: absent;\n- provider adapter: `NOT_BOUND`;\n- product production: false.\n\n## Binding contract\n\nEvery prepared deployment plan binds exactly to:\n\n- repository identity SHA-256;\n- PR number;\n- base SHA;\n- head SHA;\n- sealed package SHA-256;\n- evidence SHA-256;\n- dedicated-authorizer consumption receipt SHA-256.\n\nExact duplicate plans are rejected.\n\n## Execute behavior\n\n`POST /v1/execute` fails closed in this order:\n\n1. plan must exist and remain PREPARED;\n2. `R2_ALLOW_DEPLOY=true` must be explicitly present;\n3. a dedicated GitHub App credential must be configured;\n4. a provider adapter must be implemented.\n\nAt present step 2 fails with HTTP 423. No provider-side mutation can occur.\n\n## Adversarial self-test\n\nVal Town evaluation:\n\n`01a04b9c-9389-760a-be16-a819d85ebf7f`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- unauthenticated ledger → 401;\n- invalid binding → 400;\n- prepare → 201;\n- execute while disabled → 423;\n- duplicate prepare → 409;\n- cancel → 200;\n- execute cancelled plan → 409;\n- ledger → 200;\n- audit → 200;\n- audit chain valid → true.\n\nTest plan request SHA-256:\n\n`4fdc1f93766e2b457c58ae02189b6666c075dc8fadef9c6a9afd2e1ee3d4f5c4`\n\n## Claim boundary\n\nThe external deployer **controller runtime** exists and is live fail-closed.\n\nActual provider deployment remains unresolved because no dedicated GitHub App provider\ncredential or provider adapter is bound. This is intentional and must not be reported as\n`EXTERNAL_DEPLOYER_EXECUTION_LIVE`.\n",[164],"pulls","branches",7,"forks","envVars",{"_177":14,"_179":77},"connections",{"_177":77,"_178":77},"count","unfilledCount","emptyCount",{"_58":163,"_33":164,"_31":165,"_150":-5,"_40":41,"_39":158,"_151":73,"_37":194,"_13":77,"_34":22,"_35":167,"_25":26,"_154":-5,"_185":195,"_28":196},{"_58":160,"_33":29,"_31":32,"_150":-5,"_40":41,"_39":14,"_151":73,"_37":191,"_13":77,"_34":22,"_35":36,"_25":26,"_154":-5,"_185":192,"_28":193},{"_58":156,"_33":52,"_31":53,"_150":-5,"_40":41,"_39":14,"_151":26,"_37":188,"_13":158,"_34":54,"_35":56,"_25":26,"_154":-5,"_185":189,"_28":190},{"_58":149,"_33":44,"_31":45,"_150":-5,"_40":41,"_39":14,"_151":26,"_37":184,"_13":153,"_34":46,"_35":48,"_25":26,"_154":-5,"_185":186,"_28":187},["D",1787975848674],"children",[],[44],["D",1787975848674],[],[52],["D",1787975848674],[],[29],["D",1787974965083],[],[164],["D",1787974891297],["D",1789452068287],{"_114":113,"_122":118},{"_114":113,"_115":116,"_117":118,"_18":70,"_119":120,"_121":26},{"_13":103,"_33":104,"_58":41,"_105":59,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":-5,"_111":60,"_112":113},"ctx",{"_96":-5,"_142":235,"_236":237,"_238":239,"_240":26,"_241":26,"_242":26,"_243":73,"_244":-5,"_245":-7,"_246":-7,"_247":77,"_248":26,"_249":26,"_250":-5,"_251":26,"_252":26,"_253":26,"_254":-5},"ENV",{"_206":207,"_208":209,"_210":104,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3