[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_183":184,"_185":186},"routes/_app.x.$handle.$name",{"_97":96,"_31":42,"_106":87,"_26":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":24,"_121":122,"_123":56,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",14,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","RELEASE_V1_1.md","latestPath","fileId","f15aa2b8-a367-11f1-aadf-1607ee4eb77e","name","fileType","content","# RUMBO R2 GitHub App Custody Broker V1.1 — Exact Scope\n\nStatus: **PASS / CUSTODY_CODE_READY / APP_INSTALLATION_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\n\nThe broker implements the GitHub App Manifest flow, AES-256-GCM private-key custody, app-JWT authentication, role-specific JIT installation tokens, exact one-repository scope verification, and a durable audit hash chain.\n\nHardening added in V1.1:\n\n- exact GitHub App owner/id/slug verification through `GET /app`;\n- exact app permission set: `contents:read`, `pull_requests:write`, `administration:read` (plus implicit `metadata:read` only);\n- zero webhook events;\n- installation must belong to the exact owner, be unsuspended, and use `repository_selection=selected`;\n- installation permissions/events must remain exact;\n- every minted token is independently checked via `GET /installation/repositories` and must expose exactly one private repository: `fscfede-beep/rumbo-control-queue`, repository id `1314199389`, owner id `293577326`;\n- verification tokens are revoked immediately after setup validation;\n- role tokens are revoked before returning an error if exact repository scope validation fails;\n- role responses carry the broker implementation id for downstream anti-downgrade pinning;\n- installation/access tokens are never persisted;\n- plaintext PEM is never returned by an HTTP response; only AES-GCM ciphertext is stored.\n\nSelftest evaluation: `01a04be4-8d9f-75ed-925d-5c285c05a08f` — PASS.\n\nSelftest covers AES-GCM roundtrip, GitHub App RS256 JWT construction, exact manifest permission set, rejection of extra/upgraded permissions, private app manifest, inactive webhook, endpoint authentication and audit-chain integrity.\n\nIndependent static source audit after hardening: PASS across exact app/install/repository scope, revocation behavior, encrypted custody, absence of raw secret literals, no token persistence, implementation-bound token responses and `production_go=false`.\n\nThe broker is intentionally not ready until GitHub completes the authenticated App creation and exact repository installation. No billing or product-production action is performed by this release.\n","createdAt",["D",1787980225131],"branchVersion","branchId","03db65e7-d606-458c-889b-d9ce53af5170","id","44ca72b5-d95b-4859-bf7a-071b0516aa36","rumbo-r2-github-app-broker",["D",1787978449051],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","RUMBO R2 GitHub App custody broker","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","cec0f0e4-a363-11f1-a646-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","44ca72b5d95b4859bf7a071b0516aa36","tursoHostname","44ca72b5d95b4859bf7a071b0516aa36-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789455078571],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":52,"_102":103,"_104":24},"branch",{"_13":86,"_31":87,"_40":39,"_88":41,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":42,"_95":96},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":178,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":179,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":180,"_81":181,"_83":182,"_85":24},"tree",[165,166,167],"files",[165,166,167],"counts",{"_154":60,"_155":138,"_156":60,"_157":158,"_159":160},"contents",[128,129,130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_40":151,"_31":27,"_29":30,"_134":-5,"_38":39,"_37":14,"_136":56,"_35":152,"_13":60,"_32":20,"_33":34,"_23":24,"_141":-5,"_26":153},{"_40":143,"_31":144,"_29":54,"_134":-5,"_38":39,"_37":145,"_136":24,"_35":146,"_13":147,"_32":148,"_33":149,"_23":24,"_141":-5,"_26":150},{"_40":131,"_31":132,"_29":133,"_134":-5,"_38":39,"_37":135,"_136":24,"_35":137,"_13":138,"_32":139,"_33":140,"_23":24,"_141":-5,"_26":142},"dd83e042-d3c9-4f08-99d2-6f8538b31e55","selftest.ts","42375752-a364-11f1-b383-1607ee4eb77e","parentId",13,"latest",["D",1787979657605],3,"script","const base=\"https://sebas1--cec0f0e4a36311f1a6461607ee4eb77e.web.val.run\";\nconst root=Deno.env.get(\"R2_BROKER_ROOT_TOKEN\");\nif(!root) throw new Error(\"ROOT_TOKEN_MISSING\");\nconst auth={Authorization:`Bearer ${root}`};\n\nconst healthRes=await fetch(base+\"/health\");\nconst health=await healthRes.json();\n\nconst unauthSetup=await fetch(base+\"/v1/setup-session\",{method:\"POST\"});\nconst unauthManifest=await fetch(base+\"/v1/manifest-preview\");\nconst unauthObserver=await fetch(base+\"/v1/token/observer\",{method:\"POST\"});\nconst unauthDeployer=await fetch(base+\"/v1/token/deployer\",{method:\"POST\"});\n\nconst selfRes=await fetch(base+\"/v1/selftest\",{method:\"POST\",headers:auth});\nconst self=await selfRes.json();\n\nconst manifestRes=await fetch(base+\"/v1/manifest-preview\",{headers:auth});\nconst preview=await manifestRes.json();\n\nconst auditRes=await fetch(base+\"/v1/audit\",{headers:auth});\nconst audit=await auditRes.json();\n\nconst m=preview.manifest||{};\nconst perms=m.default_permissions||{};\nconst installScope=preview.repository_install_scope||{};\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE\"&&\n health.root_token_configured===true&&\n health.custody_encryption_key_configured===true&&\n health.setup_pepper_configured===true&&\n health.observer_role_hash_configured===true&&\n health.deployer_role_hash_configured===true&&\n health.app_created===false&&\n health.installation_verified===false&&\n health.broker_ready===false&&\n health.tokens_persisted===false&&\n health.private_key_plaintext_persisted===false&&\n health.production_go===false&&\n unauthSetup.status===401&&\n unauthManifest.status===401&&\n unauthObserver.status===401&&\n unauthDeployer.status===401&&\n selfRes.status===200&&\n self.selftest===\"PASS\"&&\n self.aes_gcm_roundtrip===true&&\n self.rsa_app_jwt_shape===true&&\n self.manifest_permissions_exact===true&&\n self.exact_permission_set_accepts_expected===true&&\n self.exact_permission_set_rejects_extra===true&&\n self.exact_permission_set_rejects_upgrade===true&&\n self.manifest_private===true&&\n self.webhook_inactive===true&&\n self.tokens_persisted===false&&\n self.production_go===false&&\n manifestRes.status===200&&\n m.public===false&&\n m.hook_attributes?.active===false&&\n perms.contents===\"read\"&&\n perms.pull_requests===\"write\"&&\n perms.administration===\"read\"&&\n Array.isArray(m.default_events)&&m.default_events.length===0&&\n m.request_oauth_on_install===false&&\n m.setup_on_update===false&&\n installScope.mode===\"ONLY_SELECTED_REPOSITORY\"&&\n installScope.required_repository_id===1314199389&&\n installScope.required_full_name===\"fscfede-beep/rumbo-control-queue\"&&\n preview.production_go===false&&\n auditRes.status===200&&\n audit.audit_chain_ok===true&&\n audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n broker_ready:health.broker_ready,\n unauth_setup:unauthSetup.status,\n unauth_manifest:unauthManifest.status,\n unauth_observer_token:unauthObserver.status,\n unauth_deployer_token:unauthDeployer.status,\n internal_selftest:selfRes.status,\n aes_gcm_roundtrip:self.aes_gcm_roundtrip,\n rsa_app_jwt_shape:self.rsa_app_jwt_shape,\n manifest_permissions_exact:self.manifest_permissions_exact,\n exact_permission_set_accepts_expected:self.exact_permission_set_accepts_expected,\n exact_permission_set_rejects_extra:self.exact_permission_set_rejects_extra,\n exact_permission_set_rejects_upgrade:self.exact_permission_set_rejects_upgrade,\n manifest_private:self.manifest_private,\n webhook_inactive:self.webhook_inactive,\n manifest_preview:manifestRes.status,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n app_created:health.app_created,\n installation_verified:health.installation_verified,\n tokens_persisted:health.tokens_persisted,\n private_key_plaintext_persisted:health.private_key_plaintext_persisted,\n production_go:false\n},null,2));\nif(!pass)Deno.exit(1);\n","label",[132],"c4798585-b79d-4a3d-8315-259f3a5a1557","main.tsx",10,["D",1787979641614],8,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { createPrivateKey, sign as nodeSign, generateKeyPairSync } from \"node:crypto\";\nimport { Buffer } from \"node:buffer\";\n\nconst app=new Hono();\n\nconst IMPLEMENTATION=\"R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE\";\nconst BASE=\"https://sebas1--cec0f0e4a36311f1a6461607ee4eb77e.web.val.run\";\nconst API_VERSION=\"2026-03-10\";\nconst REPO_OWNER=\"fscfede-beep\";\nconst REPO_NAME=\"rumbo-control-queue\";\nconst REPO_FULL=`${REPO_OWNER}/${REPO_NAME}`;\nconst REPOSITORY_ID=1314199389;\nconst OWNER_ID=293577326;\nconst MAX_SETUP_AGE_MS=30*60*1000;\nconst MAX_INSTALL_AGE_MS=2*60*60*1000;\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS setup_sessions(\n session_id TEXT PRIMARY KEY,\n status TEXT NOT NULL CHECK(status IN ('CREATED','APP_CREATED','INSTALLED','EXPIRED','FAILED')),\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n app_id INTEGER,\n app_slug TEXT,\n installation_id INTEGER,\n failure_reason TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS app_custody(\n singleton_id INTEGER PRIMARY KEY CHECK(singleton_id=1),\n app_id INTEGER NOT NULL UNIQUE,\n app_slug TEXT NOT NULL,\n encrypted_private_key TEXT NOT NULL,\n private_key_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS app_installation(\n singleton_id INTEGER PRIMARY KEY CHECK(singleton_id=1),\n installation_id INTEGER NOT NULL UNIQUE,\n account_id INTEGER NOT NULL,\n account_login TEXT NOT NULL,\n repository_id INTEGER NOT NULL,\n verified_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS broker_audit(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n object_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_broker_audit_prev ON broker_audit(prev_event_sha256)`\n]);\n\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256Text(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64url(bytes:Uint8Array):string{\n const raw=Array.from(bytes,b=>String.fromCharCode(b)).join(\"\");\n return btoa(raw).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nfunction bearer(req:Request):string{\n const h=req.headers.get(\"authorization\")||\"\";\n return h.startsWith(\"Bearer \")?h.slice(7):\"\";\n}\nfunction ct(a:string,b:string):boolean{\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0;for(let i=0;i{\n const token=bearer(req);\n if(!token)return false;\n const observed=await sha256Text(token);\n const key=role===\"observer\"?\"R2_OBSERVER_ROLE_TOKEN_SHA256\":\"R2_DEPLOYER_ROLE_TOKEN_SHA256\";\n const expected=Deno.env.get(key)||\"\";\n return !!expected&&ct(expected,observed);\n}\nasync function aesKey():Promise{\n const raw=Deno.env.get(\"R2_CUSTODY_AES_KEY_B64URL\")||\"\";\n if(!raw)throw new Error(\"CUSTODY_AES_KEY_NOT_CONFIGURED\");\n const bytes=b64urlDecode(raw);\n if(bytes.byteLength!==32)throw new Error(\"CUSTODY_AES_KEY_INVALID\");\n return await crypto.subtle.importKey(\"raw\",bytes,{name:\"AES-GCM\"},false,[\"encrypt\",\"decrypt\"]);\n}\nasync function encryptSecret(plaintext:string):Promise{\n const key=await aesKey();\n const iv=crypto.getRandomValues(new Uint8Array(12));\n const ctbuf=await crypto.subtle.encrypt({name:\"AES-GCM\",iv},key,new TextEncoder().encode(plaintext));\n return JSON.stringify({v:1,alg:\"A256GCM\",iv:b64url(iv),ciphertext:b64url(new Uint8Array(ctbuf))});\n}\nasync function decryptSecret(envelope:string):Promise{\n const obj=JSON.parse(envelope);\n if(obj?.v!==1||obj?.alg!==\"A256GCM\")throw new Error(\"CUSTODY_ENVELOPE_INVALID\");\n const key=await aesKey();\n const plain=await crypto.subtle.decrypt({name:\"AES-GCM\",iv:b64urlDecode(String(obj.iv))},key,b64urlDecode(String(obj.ciphertext)));\n return new TextDecoder().decode(new Uint8Array(plain));\n}\nfunction appJwtFromPem(appId:number,pem:string):string{\n const now=Math.floor(Date.now()/1000);\n const header=b64url(new TextEncoder().encode(JSON.stringify({alg:\"RS256\",typ:\"JWT\"})));\n const payload=b64url(new TextEncoder().encode(JSON.stringify({iat:now-60,exp:now+540,iss:String(appId)})));\n const input=`${header}.${payload}`;\n const privateKey=createPrivateKey(pem);\n const sig=nodeSign(\"RSA-SHA256\",Buffer.from(input),privateKey);\n return `${input}.${b64url(new Uint8Array(sig))}`;\n}\nasync function appendAudit(event_type:string,object_id:string|null,object_sha256:string|null){\n for(let i=0;i<8;i++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM broker_audit ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,object_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256=await sha256Text(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO broker_audit(event_type,object_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,object_id,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n }catch(e){if(!String(e).includes(\"UNIQUE\"))throw e;}\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\nasync function setupState(sessionId:string):Promise{\n const pepper=Deno.env.get(\"R2_SETUP_PEPPER\")||\"\";\n if(!pepper)throw new Error(\"SETUP_PEPPER_NOT_CONFIGURED\");\n return await sha256Text(`${sessionId}:${pepper}`);\n}\nfunction manifestFor(sessionId:string,state:string){\n return {\n name:`RUMBO-R2-Control-Gate-${sessionId.slice(0,8)}`,\n url:BASE,\n hook_attributes:{url:`${BASE}/github/webhook`,active:false},\n redirect_url:`${BASE}/github/manifest/callback`,\n setup_url:`${BASE}/github/install/setup`,\n description:\"RUMBO R2 least-privilege private repository control gate\",\n public:false,\n default_permissions:{\n contents:\"read\",\n pull_requests:\"write\",\n administration:\"read\"\n },\n default_events:[],\n request_oauth_on_install:false,\n setup_on_update:false\n };\n}\nfunction htmlEscape(s:string):string{\n return s.replaceAll(\"&\",\"&\").replaceAll(\"<\",\"<\").replaceAll(\">\",\">\").replaceAll('\"',\""\");\n}\nasync function githubAppRequest(appId:number,pem:string,path:string,method=\"GET\",body?:unknown){\n const jwt=appJwtFromPem(appId,pem);\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${jwt}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-github-app-broker/1\",\n \"Content-Type\":\"application/json\"\n },\n body:body===undefined?undefined:JSON.stringify(body)\n });\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n}\nasync function custody(){\n const c=await sqlite.execute(\"SELECT * FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(!c.rows.length)return null;\n const row:any=c.rows[0];\n const pem=await decryptSecret(String(row.encrypted_private_key));\n return {app_id:Number(row.app_id),app_slug:String(row.app_slug),pem};\n}\nasync function installation(){\n const r=await sqlite.execute(\"SELECT * FROM app_installation WHERE singleton_id=1 LIMIT 1\");\n return r.rows.length?r.rows[0]:null;\n}\n\nfunction exactAppPermissionSet(perms:any):boolean{\n if(!perms||typeof perms!==\"object\")return false;\n if(perms.contents!==\"read\"||perms.pull_requests!==\"write\"||perms.administration!==\"read\")return false;\n for(const [key,value] of Object.entries(perms)){\n if(key===\"metadata\"){\n if(value!==\"read\")return false;\n continue;\n }\n if(key===\"contents\"&&value===\"read\")continue;\n if(key===\"pull_requests\"&&value===\"write\")continue;\n if(key===\"administration\"&&value===\"read\")continue;\n return false;\n }\n return true;\n}\n\nasync function validateAppConfiguration(cust:{app_id:number;app_slug:string;pem:string}){\n const r=await githubAppRequest(cust.app_id,cust.pem,\"/app\");\n if(r.status!==200||!r.json)return {ok:false,error:`APP_METADATA_${r.status}`};\n const j=r.json;\n if(Number(j.id)!==cust.app_id)return {ok:false,error:\"APP_ID_MISMATCH\"};\n if(String(j.slug||\"\")!==cust.app_slug)return {ok:false,error:\"APP_SLUG_MISMATCH\"};\n if(Number(j.owner?.id)!==OWNER_ID||String(j.owner?.login||\"\")!==REPO_OWNER)return {ok:false,error:\"APP_OWNER_MISMATCH\"};\n if(!exactAppPermissionSet(j.permissions))return {ok:false,error:\"APP_PERMISSION_DRIFT\"};\n if(!Array.isArray(j.events)||j.events.length!==0)return {ok:false,error:\"APP_EVENT_DRIFT\"};\n return {ok:true};\n}\n\nasync function validateInstallationMetadata(cust:{app_id:number;app_slug:string;pem:string},installationId:number){\n const r=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${installationId}`);\n if(r.status!==200||!r.json)return {ok:false,error:`INSTALLATION_METADATA_${r.status}`,json:r.json};\n const j=r.json;\n if(Number(j.id)!==installationId||Number(j.app_id)!==cust.app_id)return {ok:false,error:\"INSTALLATION_APP_MISMATCH\",json:j};\n if(Number(j.account?.id)!==OWNER_ID||String(j.account?.login||\"\")!==REPO_OWNER||String(j.target_type||\"\")!==\"User\"){\n return {ok:false,error:\"INSTALLATION_OWNER_MISMATCH\",json:j};\n }\n if(String(j.repository_selection||\"\")!==\"selected\")return {ok:false,error:\"INSTALLATION_NOT_SELECTED_REPOS_ONLY\",json:j};\n if(j.suspended_at!==null&&j.suspended_at!==undefined)return {ok:false,error:\"INSTALLATION_SUSPENDED\",json:j};\n if(!exactAppPermissionSet(j.permissions))return {ok:false,error:\"INSTALLATION_PERMISSION_DRIFT\",json:j};\n if(!Array.isArray(j.events)||j.events.length!==0)return {ok:false,error:\"INSTALLATION_EVENT_DRIFT\",json:j};\n return {ok:true,json:j};\n}\n\nasync function installationTokenRequest(token:string,path:string,method=\"GET\"){\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${token}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-github-app-broker/1\"\n }\n });\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n}\n\nasync function validateInstallationTokenRepoScope(token:string){\n const r=await installationTokenRequest(token,\"/installation/repositories?per_page=100\");\n if(r.status!==200||!r.json)return {ok:false,error:`INSTALLATION_REPOSITORIES_${r.status}`};\n const repos=Array.isArray(r.json.repositories)?r.json.repositories:[];\n const exact=\n Number(r.json.total_count)===1&&repos.length===1&&\n Number(repos[0]?.id)===REPOSITORY_ID&&\n String(repos[0]?.full_name||\"\")===REPO_FULL&&\n Number(repos[0]?.owner?.id)===OWNER_ID&&\n repos[0]?.private===true;\n return exact?{ok:true}:{ok:false,error:\"INSTALLATION_REPOSITORY_SCOPE_DRIFT\"};\n}\n\nasync function revokeInstallationToken(token:string){\n try{await installationTokenRequest(token,\"/installation/token\",\"DELETE\");}catch{}\n}\n\nasync function createInstallationToken(role:\"observer\"|\"deployer\"){\n const cust=await custody();\n const inst:any=await installation();\n if(!cust||!inst)throw new Error(\"CUSTODY_NOT_READY\");\n\n const appValidation=await validateAppConfiguration(cust);\n if(!appValidation.ok)throw new Error(appValidation.error);\n\n const installValidation=await validateInstallationMetadata(cust,Number(inst.installation_id));\n if(!installValidation.ok)throw new Error(installValidation.error);\n\n const permissions=role===\"observer\"\n ? {contents:\"read\",pull_requests:\"read\",administration:\"read\"}\n : {contents:\"read\",pull_requests:\"write\",administration:\"read\"};\n const r=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${inst.installation_id}/access_tokens`,\"POST\",{\n repository_ids:[REPOSITORY_ID],\n permissions\n });\n if(r.status!==201||!r.json?.token||!r.json?.expires_at){\n throw new Error(`INSTALLATION_TOKEN_FAILED_${r.status}_${r.json?.message||\"UNKNOWN\"}`);\n }\n\n const token=String(r.json.token);\n const scopeValidation=await validateInstallationTokenRepoScope(token);\n if(!scopeValidation.ok){\n await revokeInstallationToken(token);\n throw new Error(scopeValidation.error);\n }\n\n await appendAudit(\"INSTALLATION_TOKEN_ISSUED\",role,await sha256Text(canonical({\n role,expires_at:r.json.expires_at,repository_id:REPOSITORY_ID,permissions,\n app_id:cust.app_id,installation_id:Number(inst.installation_id)\n })));\n return {token,expires_at:String(r.json.expires_at),permissions,repository_id:REPOSITORY_ID};\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-github-app-broker\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\n\napp.get(\"/health\",async c=>{\n const cust=await sqlite.execute(\"SELECT app_id,app_slug,created_at FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n const inst=await sqlite.execute(\"SELECT installation_id,account_id,account_login,repository_id,verified_at FROM app_installation WHERE singleton_id=1 LIMIT 1\");\n const appCreated=cust.rows.length===1;\n const installationVerified=inst.rows.length===1&&Number(inst.rows[0].repository_id)===REPOSITORY_ID;\n return c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_BROKER_ROOT_TOKEN\"),\n custody_encryption_key_configured:!!Deno.env.get(\"R2_CUSTODY_AES_KEY_B64URL\"),\n setup_pepper_configured:!!Deno.env.get(\"R2_SETUP_PEPPER\"),\n observer_role_hash_configured:!!Deno.env.get(\"R2_OBSERVER_ROLE_TOKEN_SHA256\"),\n deployer_role_hash_configured:!!Deno.env.get(\"R2_DEPLOYER_ROLE_TOKEN_SHA256\"),\n app_created:appCreated,\n app_slug:appCreated?cust.rows[0].app_slug:null,\n installation_verified:installationVerified,\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID},\n broker_ready:appCreated&&installationVerified,\n app_max_permissions:{contents:\"read\",pull_requests:\"write\",administration:\"read\"},\n observer_token_permissions:{contents:\"read\",pull_requests:\"read\",administration:\"read\"},\n deployer_token_permissions:{contents:\"read\",pull_requests:\"write\",administration:\"read\"},\n tokens_persisted:false,\n private_key_plaintext_persisted:false,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/setup-session\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const existing=await sqlite.execute(\"SELECT app_id FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(existing.rows.length)return c.json({error:\"APP_CUSTODY_ALREADY_EXISTS\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n const session_id=crypto.randomUUID();\n const created=new Date();\n const expires=new Date(created.getTime()+MAX_SETUP_AGE_MS);\n await sqlite.execute({sql:\"INSERT INTO setup_sessions(session_id,status,created_at,expires_at) VALUES(?,'CREATED',?,?)\",args:[session_id,created.toISOString(),expires.toISOString()]});\n await appendAudit(\"SETUP_SESSION_CREATED\",session_id,await sha256Text(session_id));\n return c.json({\n created:true,\n session_id,\n browser_url:`${BASE}/setup/${session_id}`,\n expires_at:expires.toISOString(),\n human_github_confirmation_required:true,\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/setup/:session\",async c=>{\n const sessionId=String(c.req.param(\"session\")||\"\");\n const rs=await sqlite.execute({sql:\"SELECT * FROM setup_sessions WHERE session_id=? LIMIT 1\",args:[sessionId]});\n if(!rs.rows.length)return c.text(\"Unknown setup session\",404);\n const row:any=rs.rows[0];\n if(String(row.status)!==\"CREATED\"||Date.parse(String(row.expires_at))<=Date.now())return c.text(\"Setup session expired or already used\",410);\n const state=await setupState(sessionId);\n const manifest=JSON.stringify(manifestFor(sessionId,state));\n const action=`https://github.com/settings/apps/new?state=${encodeURIComponent(state)}`;\n return c.html(`RUMBO R2 GitHub App\n

RUMBO R2 GitHub App custody setup

This creates one private GitHub App with only Contents read, Pull requests write, and Administration read.

GitHub will show the final permissions before creation. No billing or plan change is performed.

\n `);\n});\n\napp.get(\"/github/manifest/callback\",async c=>{\n const code=String(c.req.query(\"code\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!code||!state)return c.text(\"Missing code/state\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }\n if(!matched)return c.text(\"Invalid or expired setup state\",403);\n\n const existing=await sqlite.execute(\"SELECT app_id FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(existing.rows.length)return c.text(\"App custody already initialized\",409);\n\n const res=await fetch(`https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`,{\n method:\"POST\",\n headers:{Accept:\"application/vnd.github+json\",\"X-GitHub-Api-Version\":API_VERSION,\"User-Agent\":\"rumbo-r2-github-app-broker/1\"}\n });\n const text=await res.text();\n let data:any=null;try{data=text?JSON.parse(text):null;}catch{}\n if(res.status!==201||!data?.id||!data?.slug||!data?.pem){\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='FAILED',failure_reason=? WHERE session_id=?\",args:[`MANIFEST_CONVERSION_${res.status}`,matched.session_id]});\n return c.text(\"GitHub App manifest conversion failed\",502);\n }\n\n const encrypted=await encryptSecret(String(data.pem));\n const keySha=await sha256Text(String(data.pem));\n const now=new Date();\n await sqlite.execute({sql:`INSERT INTO app_custody(singleton_id,app_id,app_slug,encrypted_private_key,private_key_sha256,created_at)\n VALUES(1,?,?,?,?,?)`,args:[Number(data.id),String(data.slug),encrypted,keySha,now.toISOString()]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='APP_CREATED',app_id=?,app_slug=?,expires_at=? WHERE session_id=?\",\n args:[Number(data.id),String(data.slug),new Date(now.getTime()+MAX_INSTALL_AGE_MS).toISOString(),matched.session_id]});\n await appendAudit(\"GITHUB_APP_MANIFEST_CONVERTED\",String(data.id),keySha);\n\n const install=`https://github.com/apps/${encodeURIComponent(String(data.slug))}/installations/new?state=${encodeURIComponent(state)}`;\n return c.html(`Install RUMBO R2 App\n

GitHub App created and private key sealed

Install it on exactly ${REPO_FULL}. The broker will reject any other repository.

\n Install RUMBO R2 App on the repository`);\n});\n\napp.get(\"/github/install/setup\",async c=>{\n const installationId=Number(c.req.query(\"installation_id\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!Number.isSafeInteger(installationId)||installationId<=0)return c.text(\"Missing installation_id\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='APP_CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n if(state){\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }else if(!matched){\n matched=row;\n }\n }\n if(!matched)return c.text(\"No live pending installation session\",403);\n\n const cust=await custody();\n if(!cust||cust.app_id!==Number(matched.app_id))return c.text(\"Custody/app mismatch\",409);\n\n const appValidation=await validateAppConfiguration(cust);\n if(!appValidation.ok)return c.text(`GitHub App configuration rejected: ${appValidation.error}`,403);\n\n const installValidation=await validateInstallationMetadata(cust,installationId);\n if(!installValidation.ok)return c.text(`GitHub App installation rejected: ${installValidation.error}`,403);\n\n const tokenRes=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${installationId}/access_tokens`,\"POST\",{\n repository_ids:[REPOSITORY_ID],\n permissions:{contents:\"read\",pull_requests:\"read\",administration:\"read\"}\n });\n if(tokenRes.status!==201||!tokenRes.json?.token)return c.text(\"Could not mint verification token\",502);\n\n const verificationToken=String(tokenRes.json.token);\n const scopeValidation=await validateInstallationTokenRepoScope(verificationToken);\n await revokeInstallationToken(verificationToken);\n if(!scopeValidation.ok){\n return c.text(`Installation repository scope rejected: ${scopeValidation.error}`,403);\n }\n\n const accountId=Number(installValidation.json?.account?.id||0);\n const accountLogin=String(installValidation.json?.account?.login||\"\");\n const verifiedAt=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO app_installation(singleton_id,installation_id,account_id,account_login,repository_id,verified_at)\n VALUES(1,?,?,?,?,?)\n ON CONFLICT(singleton_id) DO UPDATE SET installation_id=excluded.installation_id,account_id=excluded.account_id,\n account_login=excluded.account_login,repository_id=excluded.repository_id,verified_at=excluded.verified_at`,\n args:[installationId,accountId,accountLogin,REPOSITORY_ID,verifiedAt]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='INSTALLED',installation_id=? WHERE session_id=?\",args:[installationId,matched.session_id]});\n await appendAudit(\"GITHUB_APP_INSTALLATION_VERIFIED\",String(installationId),await sha256Text(canonical({installationId,accountId,accountLogin,repositoryId:REPOSITORY_ID})));\n\n return c.html(`RUMBO R2 Ready\n

Dedicated GitHub App custody is ready

The private key is encrypted at rest. Installation tokens are minted just-in-time and are never persisted.

Repository identity verified: ${REPO_FULL}.

`);\n});\n\napp.post(\"/v1/token/observer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"observer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"observer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"observer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/token/deployer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"deployer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"deployer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"deployer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/manifest-preview\",c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n return c.json({\n schema:\"rumbo-r2-github-app-manifest-preview/v1\",\n manifest:manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\"),\n repository_install_scope:{mode:\"ONLY_SELECTED_REPOSITORY\",required_repository_id:REPOSITORY_ID,required_full_name:REPO_FULL},\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/selftest\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const sample=\"rumbo-r2-custody-selftest:\"+crypto.randomUUID();\n const enc=await encryptSecret(sample);\n const dec=await decryptSecret(enc);\n const {privateKey}=generateKeyPairSync(\"rsa\",{modulusLength:2048});\n const pem=privateKey.export({type:\"pkcs8\",format:\"pem\"}).toString();\n const jwt=appJwtFromPem(123456,pem);\n const jwtShape=jwt.split(\".\").length===3;\n const manifest=manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\");\n const permissionsExact=canonical(manifest.default_permissions)===canonical({contents:\"read\",pull_requests:\"write\",administration:\"read\"});\n const expectedPermissionSet=exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const extraPermissionRejected=!exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\",issues:\"read\"});\n const upgradedPermissionRejected=!exactAppPermissionSet({contents:\"write\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const pass=dec===sample&&jwtShape&&permissionsExact&&expectedPermissionSet&&extraPermissionRejected&&upgradedPermissionRejected&&manifest.public===false&&manifest.hook_attributes.active===false;\n return c.json({\n selftest:pass?\"PASS\":\"FAIL\",\n aes_gcm_roundtrip:dec===sample,\n rsa_app_jwt_shape:jwtShape,\n manifest_permissions_exact:permissionsExact,\n exact_permission_set_accepts_expected:expectedPermissionSet,\n exact_permission_set_rejects_extra:extraPermissionRejected,\n exact_permission_set_rejects_upgrade:upgradedPermissionRejected,\n manifest_private:manifest.public===false,\n webhook_inactive:manifest.hook_attributes.active===false,\n tokens_persisted:false,\n production_go:false\n },pass?200:500,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM broker_audit ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256Text(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-github-app-broker-audit/v1\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/github/webhook\",c=>c.body(null,204));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n",[144],"7ac1b599-8775-43ee-995f-bb07ce946a6d",["D",1787980225131],[27],"pulls","branches","forks","envVars",{"_161":163,"_164":60},"connections",{"_161":60,"_162":60},"count","unfilledCount",7,"emptyCount",{"_40":151,"_31":27,"_29":30,"_134":-5,"_38":39,"_37":14,"_136":56,"_35":175,"_13":60,"_32":20,"_33":34,"_23":24,"_141":-5,"_169":176,"_26":177},{"_40":143,"_31":144,"_29":54,"_134":-5,"_38":39,"_37":145,"_136":24,"_35":172,"_13":147,"_32":148,"_33":149,"_23":24,"_141":-5,"_169":173,"_26":174},{"_40":131,"_31":132,"_29":133,"_134":-5,"_38":39,"_37":135,"_136":24,"_35":168,"_13":138,"_32":139,"_33":140,"_23":24,"_141":-5,"_169":170,"_26":171},["D",1787979657605],"children",[],[132],["D",1787979641614],[],[144],["D",1787980225131],[],[27],["D",1787978449051],["D",1789455078571],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":52,"_102":103,"_104":24},{"_13":86,"_31":87,"_40":39,"_88":41,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":42,"_95":96},"ctx",{"_79":-5,"_125":216,"_217":218,"_219":220,"_221":24,"_222":24,"_223":24,"_224":56,"_225":-5,"_226":-7,"_227":-7,"_228":60,"_229":24,"_230":24,"_231":-5,"_232":24,"_233":24,"_234":24,"_235":-5},"ENV",{"_187":188,"_189":190,"_191":87,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v14