@sekiban/dcb-runtime 0.2.1 → 0.2.2

package/README.md

@@ -12,6 +12,33 @@ The experimental Cosmos provider is never selected by environment values. A
 consumer must import `createCosmosStoreProvider` from `/cosmos` and pass it as
 `createRuntimeWorker({ storeProvider })`.
 
+## Query parameters
+
+A scalar query accepts only a parsed empty object. A list query accepts only
+`PageNumber`, `PageSize`, `NewestFirst`, and `consistency`. Any other parsed
+scalar value, and any unknown list key, is HTTP 400 `query_params_unsupported`
+with the message "The selected query does not support these parameters." The
+check runs after JSON parsing and endpoint matching and before projector
+lookup or a store read, on every backing. The V1 response envelope is
+unchanged. Typed query handlers are planned for `0.3.0`; their API is not
+defined here.
+
+## Configured bearer checks
+
+`checkConfiguredBearer(request, binding, options?)` is exported from
+`@sekiban/dcb-runtime` and `@sekiban/dcb-runtime/cloudflare`. `binding` is
+`unknown`. The result is `"unconfigured" | "missing" | "invalid" | "authorized"`.
+Callers choose the HTTP status. A binding is configured only when it is a
+string containing a non-whitespace character. The default normalization keeps
+the original bytes. `{ tokenNormalization: "trim" }` is the only other mode
+and is reserved for incident maintenance, which already trimmed its token.
+
+The helper hashes the complete expected `Bearer ` credential and the complete
+supplied `Authorization` header with global WebCrypto SHA-256, then compares
+every digest byte. It does not use Node crypto. Scheme spelling and case are
+exact. Treat `unconfigured` as disabled on every exposed shared-secret route.
+Do not compare a blank binding as if it were a credential.
+
 ## License
 
 Elastic License 2.0. See [LICENSE](./LICENSE).

package/dist/bootstrap/OperatorBootstrap.d.ts

@@ -1,5 +1,7 @@
 import type { BootstrapManifest } from "./types";
 import type { StoreProvider, StoreProviderEnvironment } from "../store/provider";
+/** Missing and unconfigured stay indistinguishable from an unknown path. */
+export declare function authenticateOperatorBootstrap(request: Request, binding: unknown): Promise<Response | undefined>;
 export interface OperatorBootstrapEnv extends StoreProviderEnvironment {
     readonly BOOTSTRAP: DurableObjectNamespace;
     readonly ALLOCATOR: DurableObjectNamespace;
@@ -16,5 +18,7 @@ export interface OperatorBootstrapHooks {
         readonly manifest: BootstrapManifest;
     }) => Promise<void>;
 }
-/** Bearer-only operator lane. Incoming headers are never forwarded to a DO. */
+/** Authorized continuation. Authentication runs before this function. */
+export declare function handleAuthorizedOperatorBootstrap(request: Request, env: OperatorBootstrapEnv, storeProvider: StoreProvider, hooks?: OperatorBootstrapHooks): Promise<Response>;
+/** Bearer-only bootstrap lane. Incoming headers are never forwarded to a DO. */
 export declare function handleOperatorBootstrap(request: Request, env: OperatorBootstrapEnv, storeProvider: StoreProvider, hooks?: OperatorBootstrapHooks): Promise<Response>;

package/dist/bootstrap/OperatorBootstrap.js

@@ -1,22 +1,22 @@
 import { parseBootstrapDump } from "./manifest";
 import { createBootstrapStoreAdapter } from "./BootstrapStoreAdapter";
+import { checkConfiguredBearer } from "../http/ConfiguredBearer";
 import { scopeIdFor } from "../scope/ScopeName";
 function json(body, status = 200) { return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8" } }); }
 function object(value) { return typeof value === "object" && value !== null && !Array.isArray(value); }
-function bearer(request, token) {
-    const supplied = request.headers.get("authorization");
-    // Keep absence indistinguishable from an undiscovered management surface.
-    if (supplied === null)
+/** Missing and unconfigured stay indistinguishable from an unknown path. */
+export async function authenticateOperatorBootstrap(request, binding) {
+    const decision = await checkConfiguredBearer(request, binding);
+    if (decision === "unconfigured" || decision === "missing") {
         return json({ code: "not_found", error: "not found" }, 404);
-    if (supplied !== `Bearer ${token}`)
+    }
+    if (decision === "invalid") {
         return json({ code: "operator_auth_required", error: "valid bearer required" }, 403);
+    }
     return undefined;
 }
-/** Bearer-only operator lane. Incoming headers are never forwarded to a DO. */
-export async function handleOperatorBootstrap(request, env, storeProvider, hooks = {}) {
-    const denied = bearer(request, env.REPAIR_OPERATOR_TOKEN);
-    if (denied !== undefined)
-        return denied;
+/** Authorized continuation. Authentication runs before this function. */
+export async function handleAuthorizedOperatorBootstrap(request, env, storeProvider, hooks = {}) {
     const url = new URL(request.url);
     const match = url.pathname.match(/^\/operator\/bootstrap\/([^/]+)\/(plan|import|status|abort|export)$/);
     if (match === null)
@@ -102,3 +102,10 @@ export async function handleOperatorBootstrap(request, env, storeProvider, hooks
     }
     return invoke("/ready", body);
 }
+/** Bearer-only bootstrap lane. Incoming headers are never forwarded to a DO. */
+export async function handleOperatorBootstrap(request, env, storeProvider, hooks = {}) {
+    const denied = await authenticateOperatorBootstrap(request, env.REPAIR_OPERATOR_TOKEN);
+    if (denied !== undefined)
+        return denied;
+    return handleAuthorizedOperatorBootstrap(request, env, storeProvider, hooks);
+}

package/dist/cli/OperatorRepairCli.d.ts

@@ -7,5 +7,10 @@ export interface OperatorRepairEnv {
     REPAIR_EXCLUSION_LOOKUP?: Fetcher;
     SDT_SERVICE_ID?: string;
 }
-/** Authenticated, bounded control-plane command; it is not a V1 public wire endpoint. */
+/** Non-POST stays a route miss for every binding state, before authentication. */
+export declare function nonPostOperatorRepairResponse(request: Request): Response | undefined;
+export declare function authenticateOperatorRepair(request: Request, binding: unknown): Promise<Response | undefined>;
+/** Authorized continuation. Authentication and the POST check run before this. */
+export declare function handleAuthorizedOperatorRepair(request: Request, env: OperatorRepairEnv, nativeTracing?: NativeTracing, serviceIdentityProvider?: ServiceIdentityProvider): Promise<Response>;
+/** Authenticated, bounded repair command; it is not a V1 public wire endpoint. */
 export declare function handleOperatorRepair(request: Request, env: OperatorRepairEnv, nativeTracing?: NativeTracing, serviceIdentityProvider?: ServiceIdentityProvider): Promise<Response>;

package/dist/cli/OperatorRepairCli.js

@@ -1,4 +1,5 @@
 import { BindingExclusionLookupClient } from "../downstream/ExclusionLookup";
+import { checkConfiguredBearer } from "../http/ConfiguredBearer";
 import { RepairWorker, RepairWorkerFailure } from "../repair/RepairWorker";
 import { noOpNativeTracing } from "../trace/CommitTrace";
 import { envServiceIdentity, requireServiceIdentity } from "../service/ServiceIdentityProvider";
@@ -74,15 +75,24 @@ function testFaultFromRequest(request) {
         ? value
         : undefined;
 }
-/** Authenticated, bounded control-plane command; it is not a V1 public wire endpoint. */
-export async function handleOperatorRepair(request, env, nativeTracing = noOpNativeTracing, serviceIdentityProvider) {
-    if (request.method !== "POST") {
-        return error(404, "operator_repair_route_not_found", "Operator repair requires POST");
+/** Non-POST stays a route miss for every binding state, before authentication. */
+export function nonPostOperatorRepairResponse(request) {
+    if (request.method === "POST")
+        return undefined;
+    return error(404, "operator_repair_route_not_found", "Operator repair requires POST");
+}
+export async function authenticateOperatorRepair(request, binding) {
+    const decision = await checkConfiguredBearer(request, binding);
+    if (decision === "unconfigured") {
+        return error(404, "operator_repair_route_not_found", "Operator repair route not found");
     }
-    const token = env.REPAIR_OPERATOR_TOKEN;
-    if (!isNonEmptyString(token) || request.headers.get("authorization") !== `Bearer ${token}`) {
+    if (decision === "missing" || decision === "invalid") {
         return error(401, "operator_auth_required", "A valid operator repair bearer token is required");
     }
+    return undefined;
+}
+/** Authorized continuation. Authentication and the POST check run before this. */
+export async function handleAuthorizedOperatorRepair(request, env, nativeTracing = noOpNativeTracing, serviceIdentityProvider) {
     let body;
     try {
         body = await request.json();
@@ -106,3 +116,13 @@ export async function handleOperatorRepair(request, env, nativeTracing = noOpNat
         return error(500, "operator_repair_failed", message);
     }
 }
+/** Authenticated, bounded repair command; it is not a V1 public wire endpoint. */
+export async function handleOperatorRepair(request, env, nativeTracing = noOpNativeTracing, serviceIdentityProvider) {
+    const methodDenied = nonPostOperatorRepairResponse(request);
+    if (methodDenied !== undefined)
+        return methodDenied;
+    const denied = await authenticateOperatorRepair(request, env.REPAIR_OPERATOR_TOKEN);
+    if (denied !== undefined)
+        return denied;
+    return handleAuthorizedOperatorRepair(request, env, nativeTracing, serviceIdentityProvider);
+}

package/dist/cloudflare.d.ts

@@ -30,6 +30,8 @@ export { buildScopeName, DURABLE_OBJECT_SCOPE_CLASSES, isScopeServiceId, parseSc
 export type { DurableObjectScope, DurableObjectScopeClass, ScopeNameNamespace } from "./scope/ScopeName";
 export { envServiceIdentity, G11_SERVICE_ID_HEADER, injectableServiceIdentity, requestServiceIdentity, requireServiceIdentity, ServiceIdentityMissingError, TEST_SERVICE_ID_HEADER, } from "./service/ServiceIdentityProvider";
 export type { ServiceIdentityBehavior, ServiceIdentityEnvironment, ServiceIdentityProvider, ServiceIdentityRequestOptions, ServiceIdentityResolution, } from "./service/ServiceIdentityProvider";
+export { checkConfiguredBearer } from "./http/ConfiguredBearer";
+export type { CheckConfiguredBearerOptions, ConfiguredBearerResult, ConfiguredBearerTokenNormalization, } from "./http/ConfiguredBearer";
 export interface CloudflareOnlyEnv {
     ALLOCATOR: DurableObjectNamespace;
     BOOTSTRAP: DurableObjectNamespace;

package/dist/cloudflare.js

@@ -5458,15 +5458,15 @@ var BootstrapCoordinatorDurableObject = class {
   async permit(serviceId, body) {
     if (!object(body) || !string(body.commandId) || !string(body.digest)) return reject("bootstrap_permit_invalid", "commandId and digest are required", 400);
     const commandId = body.commandId;
-    const digest2 = body.digest;
+    const digest = body.digest;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const control = await txn.get(CONTROL) ?? empty(serviceId);
       const active2 = permits(control);
       if (active2[commandId] !== void 0) {
-        return active2[commandId] === digest2 ? { control } : { digestMismatch: true };
+        return active2[commandId] === digest ? { control } : { digestMismatch: true };
       }
       if (control.status !== "EMPTY" && control.status !== "READY") return { rejected: true };
-      const updated = { ...control, writePermits: { ...active2, [commandId]: digest2 } };
+      const updated = { ...control, writePermits: { ...active2, [commandId]: digest } };
       await txn.put(CONTROL, updated);
       return { control: updated };
     });
@@ -5477,11 +5477,11 @@ var BootstrapCoordinatorDurableObject = class {
   async permitRelease(serviceId, body) {
     if (!object(body) || !string(body.commandId)) return reject("bootstrap_permit_invalid", "commandId is required", 400);
     const commandId = body.commandId;
-    const digest2 = string(body.digest) ? body.digest : void 0;
+    const digest = string(body.digest) ? body.digest : void 0;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const control = await txn.get(CONTROL) ?? empty(serviceId);
       const active2 = permits(control);
-      if (active2[commandId] !== void 0 && digest2 !== void 0 && active2[commandId] !== digest2) {
+      if (active2[commandId] !== void 0 && digest !== void 0 && active2[commandId] !== digest) {
         return { digestMismatch: true };
       }
       if (active2[commandId] === void 0) return { control };
@@ -5667,8 +5667,8 @@ function eventDigestBytes(input) {
 async function eventDigestHex(input) {
   const bytes2 = eventDigestBytes(input);
   const source = bytes2.buffer.slice(bytes2.byteOffset, bytes2.byteOffset + bytes2.byteLength);
-  const digest2 = await crypto.subtle.digest("SHA-256", source);
-  return [...new Uint8Array(digest2)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const digest = await crypto.subtle.digest("SHA-256", source);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
 // src/bootstrap/BootstrapStoreAdapter.ts
@@ -5814,6 +5814,34 @@ function createBootstrapStoreAdapter(provider, store, identityGuard) {
   return new BootstrapStoreAdapter(provider, store, identityGuard);
 }
 
+// src/http/ConfiguredBearer.ts
+async function sha256(value) {
+  const encoded = new TextEncoder().encode(value);
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", encoded));
+}
+function digestsMatch(expected, supplied) {
+  let difference = expected.length ^ supplied.length;
+  const length = Math.max(expected.length, supplied.length);
+  for (let index = 0; index < length; index += 1) {
+    difference |= (expected[index] ?? 0) ^ (supplied[index] ?? 0);
+  }
+  return difference === 0;
+}
+async function checkConfiguredBearer(request, binding, options) {
+  if (typeof binding !== "string" || binding.trim().length === 0) {
+    return "unconfigured";
+  }
+  const effectiveToken = options?.tokenNormalization === "trim" ? binding.trim() : binding;
+  const supplied = request.headers.get("authorization");
+  if (supplied === null) return "missing";
+  const expected = `Bearer ${effectiveToken}`;
+  const [expectedDigest, suppliedDigest] = await Promise.all([
+    sha256(expected),
+    sha256(supplied)
+  ]);
+  return digestsMatch(expectedDigest, suppliedDigest) ? "authorized" : "invalid";
+}
+
 // src/bootstrap/OperatorBootstrap.ts
 function json2(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8" } });
@@ -5821,15 +5849,17 @@ function json2(body, status = 200) {
 function object2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function bearer(request, token) {
-  const supplied = request.headers.get("authorization");
-  if (supplied === null) return json2({ code: "not_found", error: "not found" }, 404);
-  if (supplied !== `Bearer ${token}`) return json2({ code: "operator_auth_required", error: "valid bearer required" }, 403);
+async function authenticateOperatorBootstrap(request, binding) {
+  const decision = await checkConfiguredBearer(request, binding);
+  if (decision === "unconfigured" || decision === "missing") {
+    return json2({ code: "not_found", error: "not found" }, 404);
+  }
+  if (decision === "invalid") {
+    return json2({ code: "operator_auth_required", error: "valid bearer required" }, 403);
+  }
   return void 0;
 }
-async function handleOperatorBootstrap(request, env, storeProvider, hooks = {}) {
-  const denied = bearer(request, env.REPAIR_OPERATOR_TOKEN);
-  if (denied !== void 0) return denied;
+async function handleAuthorizedOperatorBootstrap(request, env, storeProvider, hooks = {}) {
   const url = new URL(request.url);
   const match = url.pathname.match(/^\/operator\/bootstrap\/([^/]+)\/(plan|import|status|abort|export)$/);
   if (match === null) return json2({ code: "not_found", error: "not found" }, 404);
@@ -6728,14 +6758,21 @@ function testFaultFromRequest(request) {
   const value = request.headers.get("x-sdt-g6-test-fault");
   return value === "after-lease-before-prepare" || value === "after-prepare-before-apply" || value === "after-apply-before-observation" || value === "after-verify-before-audit" || value === "after-audit-before-clear" || value === "after-clear-before-final-observation" ? value : void 0;
 }
-async function handleOperatorRepair(request, env, nativeTracing = noOpNativeTracing, serviceIdentityProvider) {
-  if (request.method !== "POST") {
-    return error2(404, "operator_repair_route_not_found", "Operator repair requires POST");
+function nonPostOperatorRepairResponse(request) {
+  if (request.method === "POST") return void 0;
+  return error2(404, "operator_repair_route_not_found", "Operator repair requires POST");
+}
+async function authenticateOperatorRepair(request, binding) {
+  const decision = await checkConfiguredBearer(request, binding);
+  if (decision === "unconfigured") {
+    return error2(404, "operator_repair_route_not_found", "Operator repair route not found");
   }
-  const token = env.REPAIR_OPERATOR_TOKEN;
-  if (!isNonEmptyString3(token) || request.headers.get("authorization") !== `Bearer ${token}`) {
+  if (decision === "missing" || decision === "invalid") {
     return error2(401, "operator_auth_required", "A valid operator repair bearer token is required");
   }
+  return void 0;
+}
+async function handleAuthorizedOperatorRepair(request, env, nativeTracing = noOpNativeTracing, serviceIdentityProvider) {
   let body;
   try {
     body = await request.json();
@@ -7358,7 +7395,7 @@ var CommitWorker = class {
       identity: "coordinator"
     }));
   }
-  async bootstrapPermitAcquire(commandId, digest2) {
+  async bootstrapPermitAcquire(commandId, digest) {
     const stub = this.bootstrapStub();
     if (stub === void 0) return { ok: true };
     try {
@@ -7367,7 +7404,7 @@ var CommitWorker = class {
       const response3 = await stub.fetch(new Request(url, {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ commandId, digest: digest2 })
+        body: JSON.stringify({ commandId, digest })
       }));
       if (response3.ok) return { ok: true };
       const body = await response3.clone().json().catch(() => void 0);
@@ -7376,7 +7413,7 @@ var CommitWorker = class {
       return { ok: false };
     }
   }
-  async bootstrapPermitRelease(commandId, digest2) {
+  async bootstrapPermitRelease(commandId, digest) {
     const stub = this.bootstrapStub();
     if (stub === void 0) return;
     try {
@@ -7385,7 +7422,7 @@ var CommitWorker = class {
       await stub.fetch(new Request(url, {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ commandId, digest: digest2 })
+        body: JSON.stringify({ commandId, digest })
       }));
     } catch {
     }
@@ -13899,6 +13936,33 @@ function parseRequest(value) {
     }
   };
 }
+var QUERY_PARAMS_UNSUPPORTED_MESSAGE = "The selected query does not support these parameters.";
+var LIST_QUERY_PARAM_KEYS = /* @__PURE__ */ new Set(["PageNumber", "PageSize", "NewestFirst", "consistency"]);
+function unsupportedQueryParams(endpoint, queryParams) {
+  if (endpoint === "query") {
+    if (isObject9(queryParams) && Object.keys(queryParams).length === 0) {
+      return void 0;
+    }
+    return {
+      status: 400,
+      code: "query_params_unsupported",
+      error: QUERY_PARAMS_UNSUPPORTED_MESSAGE
+    };
+  }
+  if (!isObject9(queryParams)) {
+    return void 0;
+  }
+  for (const key of Object.keys(queryParams)) {
+    if (!LIST_QUERY_PARAM_KEYS.has(key)) {
+      return {
+        status: 400,
+        code: "query_params_unsupported",
+        error: QUERY_PARAMS_UNSUPPORTED_MESSAGE
+      };
+    }
+  }
+  return void 0;
+}
 function paginationFrom(value) {
   if (!isObject9(value)) {
     return { error: "list-query queryParamsJson must contain an object" };
@@ -14079,6 +14143,10 @@ async function handleSerializedQuery(request, env, options = {}) {
   if (definition === void 0 || definition.endpoint !== endpoint) {
     return error6(400, "validation_error", "queryType is not mapped for this endpoint");
   }
+  const unsupported = unsupportedQueryParams(endpoint, parsed.value.queryParams);
+  if (unsupported !== void 0) {
+    return error6(unsupported.status, unsupported.code, unsupported.error);
+  }
   if (!definition.enabled || (options.projectors ?? DEPLOYED_PROJECTOR_REGISTRY).resolve(definition.tagProjector) === void 0) {
     return error6(503, "projection_unavailable", "The mapped query projection is unavailable");
   }
@@ -14567,11 +14635,11 @@ function normalizeCorrection(value) {
     throw new IncidentLifecycleError("incident_invalid_request", 400, "correction.kind must be event or receipt");
   }
   const reference = boundedString(value.reference, "correction.reference", MAX_LONG_TEXT_BYTES);
-  const digest2 = boundedString(value.digest, "correction.digest", MAX_IDENTITY_BYTES);
-  if (reference === null || digest2 === null || !SHA256_DIGEST.test(digest2)) {
+  const digest = boundedString(value.digest, "correction.digest", MAX_IDENTITY_BYTES);
+  if (reference === null || digest === null || !SHA256_DIGEST.test(digest)) {
     throw new IncidentLifecycleError("incident_invalid_request", 400, "correction.digest must be lowercase sha256");
   }
-  return { kind: value.kind, reference, digest: digest2 };
+  return { kind: value.kind, reference, digest };
 }
 function normalizeRequest(value) {
   if (!isObject11(value) || !hasOnlyKeys(value, ["action", "incidentIdentity", "transitionKey", "expectedVersion", "reason", "ownerId", "deadlineAt", "correction", "resolution"])) {
@@ -14627,8 +14695,8 @@ function canonicalize(value) {
 async function digestFor(request, actorId) {
   const envelope = canonicalize({ action: request, actor: actorId });
   const encoded = new TextEncoder().encode(JSON.stringify(envelope));
-  const digest2 = await crypto.subtle.digest("SHA-256", encoded);
-  return `sha256:${Array.from(new Uint8Array(digest2), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+  const digest = await crypto.subtle.digest("SHA-256", encoded);
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 function projectionFromRow(row, finding2) {
   if (row === null) {
@@ -14855,13 +14923,13 @@ var IncidentLifecycle = class {
     }
     if (actorId === null) throw new IncidentLifecycleError("incident_invalid_actor", 400, "x-sdt-maintainer must be non-empty");
     const finding2 = await this.finding(serviceId, request.incidentIdentity);
-    const digest2 = await digestFor(request, actorId);
+    const digest = await digestFor(request, actorId);
     const existing = await this.database.prepare(
       `SELECT * FROM serialized_dcb_incident_transitions
         WHERE service_id = ? AND incident_identity = ? AND transition_key = ?`
     ).bind(serviceId, request.incidentIdentity, request.transitionKey).first();
     if (existing !== null && existing !== void 0) {
-      if (existing.request_digest !== digest2) {
+      if (existing.request_digest !== digest) {
         throw new IncidentLifecycleError("incident_idempotency_conflict", 409, "The transition key was already used with different content");
       }
       return { projection: transitionFromRow(existing).after, transition: transitionFromRow(existing), idempotent: true };
@@ -14924,7 +14992,7 @@ var IncidentLifecycle = class {
       serviceId,
       request.incidentIdentity,
       request.transitionKey,
-      digest2,
+      digest,
       request.action,
       before.lifecycleState,
       before.version,
@@ -14953,7 +15021,7 @@ var IncidentLifecycle = class {
         `SELECT * FROM serialized_dcb_incident_transitions
           WHERE service_id = ? AND incident_identity = ? AND transition_key = ?`
       ).bind(serviceId, request.incidentIdentity, request.transitionKey).first();
-      if (competing !== null && competing !== void 0 && competing.request_digest !== digest2) {
+      if (competing !== null && competing !== void 0 && competing.request_digest !== digest) {
         throw new IncidentLifecycleError("incident_idempotency_conflict", 409, "The transition key was already used with different content");
       }
       if (competing !== null && competing !== void 0) {
@@ -15055,29 +15123,6 @@ function json10(body, status = 200) {
 function error8(status, code, message) {
   return json10({ error: message, code }, status);
 }
-function configuredToken(value) {
-  if (typeof value !== "string") return void 0;
-  const token = value.trim();
-  return token.length === 0 ? void 0 : token;
-}
-async function digest(value) {
-  const bytes2 = new TextEncoder().encode(value);
-  return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes2));
-}
-function fixedLengthEqual(left, right) {
-  let difference = left.length ^ right.length;
-  const length = Math.max(left.length, right.length);
-  for (let index = 0; index < length; index += 1) {
-    difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
-  }
-  return difference === 0;
-}
-async function authenticated(request, token) {
-  const credential = request.headers.get("authorization") ?? "";
-  const suppliedToken = credential.startsWith("Bearer ") ? credential.slice("Bearer ".length) : "";
-  const [expectedDigest, suppliedDigest] = await Promise.all([digest(token), digest(suppliedToken)]);
-  return fixedLengthEqual(expectedDigest, suppliedDigest);
-}
 function boolFilter(value, name) {
   if (value === null) return void 0;
   if (value === "true") return true;
@@ -15131,11 +15176,13 @@ function isIncidentMaintenancePath(pathname) {
   return pathname === "/maintenance/incidents" || pathname.startsWith("/maintenance/incidents/");
 }
 async function handleIncidentMaintenance(request, env, serviceIdentityProvider) {
-  const token = configuredToken(env.INCIDENT_MAINTAINER_TOKEN);
-  if (token === void 0) {
+  const decision = await checkConfiguredBearer(request, env.INCIDENT_MAINTAINER_TOKEN, {
+    tokenNormalization: "trim"
+  });
+  if (decision === "unconfigured") {
     return error8(503, "incident_maintenance_unavailable", "Incident maintenance is not configured");
   }
-  if (!await authenticated(request, token)) {
+  if (decision === "missing" || decision === "invalid") {
     return error8(401, "incident_auth_required", "A valid incident maintenance bearer token is required");
   }
   let serviceId;
@@ -20248,6 +20295,18 @@ function createCloudflareOnlyRuntimeWorker(options = {}) {
       if (isIncidentMaintenancePath(url.pathname)) {
         return handleIncidentMaintenance(request, env, options.serviceIdentityProvider ?? envServiceIdentity(env));
       }
+      const operatorRepair = url.pathname === "/operator/repair";
+      const operatorBootstrap = url.pathname.startsWith("/operator/bootstrap/");
+      if (operatorRepair) {
+        const methodDenied = nonPostOperatorRepairResponse(request);
+        if (methodDenied !== void 0) return methodDenied;
+        const denied = await authenticateOperatorRepair(request, env.REPAIR_OPERATOR_TOKEN);
+        if (denied !== void 0) return denied;
+      }
+      if (operatorBootstrap) {
+        const denied = await authenticateOperatorBootstrap(request, env.REPAIR_OPERATOR_TOKEN);
+        if (denied !== void 0) return denied;
+      }
       const serviceIdentity = options.serviceIdentityProvider ?? envServiceIdentity(env);
       const requestIdentityOptions = { allowG11Verification: env.G11_VERIFICATION_ENABLED === "true" };
       let requestServiceId;
@@ -20300,11 +20359,11 @@ function createCloudflareOnlyRuntimeWorker(options = {}) {
           serviceIdentityProvider: serviceIdentity
         });
       }
-      if (url.pathname === "/operator/repair") {
-        return handleOperatorRepair(request, env, cloudflareTracing(ctx), serviceIdentity);
+      if (operatorRepair) {
+        return handleAuthorizedOperatorRepair(request, env, cloudflareTracing(ctx), serviceIdentity);
       }
-      if (url.pathname.startsWith("/operator/bootstrap/")) {
-        return handleOperatorBootstrap(request, env, storeProvider, {
+      if (operatorBootstrap) {
+        return handleAuthorizedOperatorBootstrap(request, env, storeProvider, {
           afterVerifyBeforeReady: options.afterBootstrapVerify === void 0 ? void 0 : ({ serviceId }) => options.afterBootstrapVerify({ serviceId, env })
         });
       }
@@ -20478,6 +20537,7 @@ export {
   assertNoSilentLedgerMerge,
   assertStrictlyBefore,
   buildScopeName,
+  checkConfiguredBearer,
   classifyDirectDoorbellFailure,
   cleanupG42JournalProbeTrial,
   createCloudflareOnlyRuntimeWorker,

package/dist/http/ConfiguredBearer.d.ts

@@ -0,0 +1,12 @@
+export type ConfiguredBearerResult = "unconfigured" | "missing" | "invalid" | "authorized";
+export type ConfiguredBearerTokenNormalization = "exact" | "trim";
+export interface CheckConfiguredBearerOptions {
+    readonly tokenNormalization?: ConfiguredBearerTokenNormalization;
+}
+/**
+ * Decide whether a configured shared secret admits this request.
+ * Callers map the four results onto their own HTTP responses.
+ * The binding is configured only when it is a string with a non-whitespace
+ * character. Exact mode keeps those bytes; trim mode is opt-in.
+ */
+export declare function checkConfiguredBearer(request: Request, binding: unknown, options?: CheckConfiguredBearerOptions): Promise<ConfiguredBearerResult>;

package/dist/http/ConfiguredBearer.js

@@ -0,0 +1,33 @@
+async function sha256(value) {
+    const encoded = new TextEncoder().encode(value);
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", encoded));
+}
+function digestsMatch(expected, supplied) {
+    let difference = expected.length ^ supplied.length;
+    const length = Math.max(expected.length, supplied.length);
+    for (let index = 0; index < length; index += 1) {
+        difference |= (expected[index] ?? 0) ^ (supplied[index] ?? 0);
+    }
+    return difference === 0;
+}
+/**
+ * Decide whether a configured shared secret admits this request.
+ * Callers map the four results onto their own HTTP responses.
+ * The binding is configured only when it is a string with a non-whitespace
+ * character. Exact mode keeps those bytes; trim mode is opt-in.
+ */
+export async function checkConfiguredBearer(request, binding, options) {
+    if (typeof binding !== "string" || binding.trim().length === 0) {
+        return "unconfigured";
+    }
+    const effectiveToken = options?.tokenNormalization === "trim" ? binding.trim() : binding;
+    const supplied = request.headers.get("authorization");
+    if (supplied === null)
+        return "missing";
+    const expected = `Bearer ${effectiveToken}`;
+    const [expectedDigest, suppliedDigest] = await Promise.all([
+        sha256(expected),
+        sha256(supplied),
+    ]);
+    return digestsMatch(expectedDigest, suppliedDigest) ? "authorized" : "invalid";
+}

package/dist/http/IncidentMaintenance.js

@@ -1,5 +1,6 @@
 import { IncidentLifecycle, IncidentLifecycleError, normalizeIncidentIdentity, } from "../completeness/IncidentLifecycle";
 import { requestServiceIdentity, } from "../service/ServiceIdentityProvider";
+import { checkConfiguredBearer } from "./ConfiguredBearer";
 function json(body, status = 200) {
     return new Response(JSON.stringify(body), {
         status,
@@ -9,30 +10,6 @@ function json(body, status = 200) {
 function error(status, code, message) {
     return json({ error: message, code }, status);
 }
-function configuredToken(value) {
-    if (typeof value !== "string")
-        return undefined;
-    const token = value.trim();
-    return token.length === 0 ? undefined : token;
-}
-async function digest(value) {
-    const bytes = new TextEncoder().encode(value);
-    return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
-}
-function fixedLengthEqual(left, right) {
-    let difference = left.length ^ right.length;
-    const length = Math.max(left.length, right.length);
-    for (let index = 0; index < length; index += 1) {
-        difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
-    }
-    return difference === 0;
-}
-async function authenticated(request, token) {
-    const credential = request.headers.get("authorization") ?? "";
-    const suppliedToken = credential.startsWith("Bearer ") ? credential.slice("Bearer ".length) : "";
-    const [expectedDigest, suppliedDigest] = await Promise.all([digest(token), digest(suppliedToken)]);
-    return fixedLengthEqual(expectedDigest, suppliedDigest);
-}
 function boolFilter(value, name) {
     if (value === null)
         return undefined;
@@ -92,11 +69,13 @@ export function isIncidentMaintenancePath(pathname) {
     return pathname === "/maintenance/incidents" || pathname.startsWith("/maintenance/incidents/");
 }
 export async function handleIncidentMaintenance(request, env, serviceIdentityProvider) {
-    const token = configuredToken(env.INCIDENT_MAINTAINER_TOKEN);
-    if (token === undefined) {
+    const decision = await checkConfiguredBearer(request, env.INCIDENT_MAINTAINER_TOKEN, {
+        tokenNormalization: "trim",
+    });
+    if (decision === "unconfigured") {
         return error(503, "incident_maintenance_unavailable", "Incident maintenance is not configured");
     }
-    if (!(await authenticated(request, token))) {
+    if (decision === "missing" || decision === "invalid") {
         return error(401, "incident_auth_required", "A valid incident maintenance bearer token is required");
     }
     let serviceId;

package/dist/http/SerializedQueryWorker.js

@@ -57,6 +57,39 @@ function parseRequest(value) {
         },
     };
 }
+const QUERY_PARAMS_UNSUPPORTED_MESSAGE = "The selected query does not support these parameters.";
+const LIST_QUERY_PARAM_KEYS = new Set(["PageNumber", "PageSize", "NewestFirst", "consistency"]);
+/**
+ * Scalar queries have no parameter interpreter, so only an empty plain object
+ * is a supported no-parameter call. List queries keep the four existing
+ * controls and leave their value checks to paginationFrom. Non-object list
+ * input is also left to paginationFrom so that validation response stays put.
+ */
+function unsupportedQueryParams(endpoint, queryParams) {
+    if (endpoint === "query") {
+        if (isObject(queryParams) && Object.keys(queryParams).length === 0) {
+            return undefined;
+        }
+        return {
+            status: 400,
+            code: "query_params_unsupported",
+            error: QUERY_PARAMS_UNSUPPORTED_MESSAGE,
+        };
+    }
+    if (!isObject(queryParams)) {
+        return undefined;
+    }
+    for (const key of Object.keys(queryParams)) {
+        if (!LIST_QUERY_PARAM_KEYS.has(key)) {
+            return {
+                status: 400,
+                code: "query_params_unsupported",
+                error: QUERY_PARAMS_UNSUPPORTED_MESSAGE,
+            };
+        }
+    }
+    return undefined;
+}
 function paginationFrom(value) {
     if (!isObject(value)) {
         return { error: "list-query queryParamsJson must contain an object" };
@@ -295,6 +328,10 @@ export async function handleSerializedQuery(request, env, options = {}) {
     if (definition === undefined || definition.endpoint !== endpoint) {
         return error(400, "validation_error", "queryType is not mapped for this endpoint");
     }
+    const unsupported = unsupportedQueryParams(endpoint, parsed.value.queryParams);
+    if (unsupported !== undefined) {
+        return error(unsupported.status, unsupported.code, unsupported.error);
+    }
     if (!definition.enabled || (options.projectors ?? DEPLOYED_PROJECTOR_REGISTRY).resolve(definition.tagProjector) === undefined) {
         return error(503, "projection_unavailable", "The mapped query projection is unavailable");
     }

package/dist/index.d.ts

@@ -55,6 +55,8 @@ export type { SerializedEventMetadata } from "./eventRecord";
 export type { DeliveryCoreEnvironment, DeliveryCoreFailure, DeliveryCoreOptions, DeliveryCoreResult, DeliverySource, DeliveryViewApplyResult, DeliveryViewFailureClass, DeliveryViewHandler, DeliveryViewInput, DeliveryViewResult, } from "./downstream/DeliveryCore";
 export type { DeliveryClass, DirectDoorbellDegradation, DirectDoorbellDeploymentConfig, DirectDoorbellPreflightResult, DirectDoorbellReceiverMode, DirectDoorbellFailureKind, DownstreamDoorbellBinding, } from "./downstream/Doorbell";
 export type { JsonValue, MaterializedViewRowPatch } from "@sekiban/dcb-core";
+export { checkConfiguredBearer } from "./http/ConfiguredBearer";
+export type { CheckConfiguredBearerOptions, ConfiguredBearerResult, ConfiguredBearerTokenNormalization, } from "./http/ConfiguredBearer";
 export { composeRuntime, createRuntimeCommitPort, registeredEventParsers, RuntimeCommandRegistry, } from "./composition";
 export type { RuntimeCommitAllocationLike, RuntimeCommitCandidateLike, RuntimeCommitPort, RuntimeCommitPortOptions, RuntimeCommitPortResult, RuntimeCommandLike, RuntimeDomainLike, RuntimeQueryDefinition, RuntimeWorkerConfig, } from "./composition";
 export { POSTGRES_STORE_PROVIDER, createPostgresBootstrapAdapter, createPostgresStoreProvider } from "./store/provider";

package/dist/index.js

@@ -5542,15 +5542,15 @@ var BootstrapCoordinatorDurableObject = class {
   async permit(serviceId, body) {
     if (!object(body) || !string(body.commandId) || !string(body.digest)) return reject("bootstrap_permit_invalid", "commandId and digest are required", 400);
     const commandId = body.commandId;
-    const digest2 = body.digest;
+    const digest = body.digest;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const control = await txn.get(CONTROL) ?? empty(serviceId);
       const active2 = permits(control);
       if (active2[commandId] !== void 0) {
-        return active2[commandId] === digest2 ? { control } : { digestMismatch: true };
+        return active2[commandId] === digest ? { control } : { digestMismatch: true };
       }
       if (control.status !== "EMPTY" && control.status !== "READY") return { rejected: true };
-      const updated = { ...control, writePermits: { ...active2, [commandId]: digest2 } };
+      const updated = { ...control, writePermits: { ...active2, [commandId]: digest } };
       await txn.put(CONTROL, updated);
       return { control: updated };
     });
@@ -5561,11 +5561,11 @@ var BootstrapCoordinatorDurableObject = class {
   async permitRelease(serviceId, body) {
     if (!object(body) || !string(body.commandId)) return reject("bootstrap_permit_invalid", "commandId is required", 400);
     const commandId = body.commandId;
-    const digest2 = string(body.digest) ? body.digest : void 0;
+    const digest = string(body.digest) ? body.digest : void 0;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const control = await txn.get(CONTROL) ?? empty(serviceId);
       const active2 = permits(control);
-      if (active2[commandId] !== void 0 && digest2 !== void 0 && active2[commandId] !== digest2) {
+      if (active2[commandId] !== void 0 && digest !== void 0 && active2[commandId] !== digest) {
         return { digestMismatch: true };
       }
       if (active2[commandId] === void 0) return { control };
@@ -5751,8 +5751,8 @@ function eventDigestBytes(input) {
 async function eventDigestHex(input) {
   const bytes2 = eventDigestBytes(input);
   const source = bytes2.buffer.slice(bytes2.byteOffset, bytes2.byteOffset + bytes2.byteLength);
-  const digest2 = await crypto.subtle.digest("SHA-256", source);
-  return [...new Uint8Array(digest2)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const digest = await crypto.subtle.digest("SHA-256", source);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
 // src/bootstrap/BootstrapStoreAdapter.ts
@@ -5898,6 +5898,34 @@ function createBootstrapStoreAdapter(provider, store, identityGuard) {
   return new BootstrapStoreAdapter(provider, store, identityGuard);
 }
 
+// src/http/ConfiguredBearer.ts
+async function sha256(value) {
+  const encoded = new TextEncoder().encode(value);
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", encoded));
+}
+function digestsMatch(expected, supplied) {
+  let difference = expected.length ^ supplied.length;
+  const length = Math.max(expected.length, supplied.length);
+  for (let index = 0; index < length; index += 1) {
+    difference |= (expected[index] ?? 0) ^ (supplied[index] ?? 0);
+  }
+  return difference === 0;
+}
+async function checkConfiguredBearer(request, binding, options) {
+  if (typeof binding !== "string" || binding.trim().length === 0) {
+    return "unconfigured";
+  }
+  const effectiveToken = options?.tokenNormalization === "trim" ? binding.trim() : binding;
+  const supplied = request.headers.get("authorization");
+  if (supplied === null) return "missing";
+  const expected = `Bearer ${effectiveToken}`;
+  const [expectedDigest, suppliedDigest] = await Promise.all([
+    sha256(expected),
+    sha256(supplied)
+  ]);
+  return digestsMatch(expectedDigest, suppliedDigest) ? "authorized" : "invalid";
+}
+
 // src/bootstrap/OperatorBootstrap.ts
 function json2(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8" } });
@@ -5905,15 +5933,17 @@ function json2(body, status = 200) {
 function object2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function bearer(request, token) {
-  const supplied = request.headers.get("authorization");
-  if (supplied === null) return json2({ code: "not_found", error: "not found" }, 404);
-  if (supplied !== `Bearer ${token}`) return json2({ code: "operator_auth_required", error: "valid bearer required" }, 403);
+async function authenticateOperatorBootstrap(request, binding) {
+  const decision = await checkConfiguredBearer(request, binding);
+  if (decision === "unconfigured" || decision === "missing") {
+    return json2({ code: "not_found", error: "not found" }, 404);
+  }
+  if (decision === "invalid") {
+    return json2({ code: "operator_auth_required", error: "valid bearer required" }, 403);
+  }
   return void 0;
 }
-async function handleOperatorBootstrap(request, env, storeProvider, hooks = {}) {
-  const denied = bearer(request, env.REPAIR_OPERATOR_TOKEN);
-  if (denied !== void 0) return denied;
+async function handleAuthorizedOperatorBootstrap(request, env, storeProvider, hooks = {}) {
   const url = new URL(request.url);
   const match = url.pathname.match(/^\/operator\/bootstrap\/([^/]+)\/(plan|import|status|abort|export)$/);
   if (match === null) return json2({ code: "not_found", error: "not found" }, 404);
@@ -6812,14 +6842,21 @@ function testFaultFromRequest(request) {
   const value = request.headers.get("x-sdt-g6-test-fault");
   return value === "after-lease-before-prepare" || value === "after-prepare-before-apply" || value === "after-apply-before-observation" || value === "after-verify-before-audit" || value === "after-audit-before-clear" || value === "after-clear-before-final-observation" ? value : void 0;
 }
-async function handleOperatorRepair(request, env, nativeTracing = noOpNativeTracing, serviceIdentityProvider) {
-  if (request.method !== "POST") {
-    return error2(404, "operator_repair_route_not_found", "Operator repair requires POST");
+function nonPostOperatorRepairResponse(request) {
+  if (request.method === "POST") return void 0;
+  return error2(404, "operator_repair_route_not_found", "Operator repair requires POST");
+}
+async function authenticateOperatorRepair(request, binding) {
+  const decision = await checkConfiguredBearer(request, binding);
+  if (decision === "unconfigured") {
+    return error2(404, "operator_repair_route_not_found", "Operator repair route not found");
   }
-  const token = env.REPAIR_OPERATOR_TOKEN;
-  if (!isNonEmptyString3(token) || request.headers.get("authorization") !== `Bearer ${token}`) {
+  if (decision === "missing" || decision === "invalid") {
     return error2(401, "operator_auth_required", "A valid operator repair bearer token is required");
   }
+  return void 0;
+}
+async function handleAuthorizedOperatorRepair(request, env, nativeTracing = noOpNativeTracing, serviceIdentityProvider) {
   let body;
   try {
     body = await request.json();
@@ -7442,7 +7479,7 @@ var CommitWorker = class {
       identity: "coordinator"
     }));
   }
-  async bootstrapPermitAcquire(commandId, digest2) {
+  async bootstrapPermitAcquire(commandId, digest) {
     const stub = this.bootstrapStub();
     if (stub === void 0) return { ok: true };
     try {
@@ -7451,7 +7488,7 @@ var CommitWorker = class {
       const response3 = await stub.fetch(new Request(url, {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ commandId, digest: digest2 })
+        body: JSON.stringify({ commandId, digest })
       }));
       if (response3.ok) return { ok: true };
       const body = await response3.clone().json().catch(() => void 0);
@@ -7460,7 +7497,7 @@ var CommitWorker = class {
       return { ok: false };
     }
   }
-  async bootstrapPermitRelease(commandId, digest2) {
+  async bootstrapPermitRelease(commandId, digest) {
     const stub = this.bootstrapStub();
     if (stub === void 0) return;
     try {
@@ -7469,7 +7506,7 @@ var CommitWorker = class {
       await stub.fetch(new Request(url, {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ commandId, digest: digest2 })
+        body: JSON.stringify({ commandId, digest })
       }));
     } catch {
     }
@@ -12191,6 +12228,33 @@ function parseRequest(value) {
     }
   };
 }
+var QUERY_PARAMS_UNSUPPORTED_MESSAGE = "The selected query does not support these parameters.";
+var LIST_QUERY_PARAM_KEYS = /* @__PURE__ */ new Set(["PageNumber", "PageSize", "NewestFirst", "consistency"]);
+function unsupportedQueryParams(endpoint, queryParams) {
+  if (endpoint === "query") {
+    if (isObject9(queryParams) && Object.keys(queryParams).length === 0) {
+      return void 0;
+    }
+    return {
+      status: 400,
+      code: "query_params_unsupported",
+      error: QUERY_PARAMS_UNSUPPORTED_MESSAGE
+    };
+  }
+  if (!isObject9(queryParams)) {
+    return void 0;
+  }
+  for (const key of Object.keys(queryParams)) {
+    if (!LIST_QUERY_PARAM_KEYS.has(key)) {
+      return {
+        status: 400,
+        code: "query_params_unsupported",
+        error: QUERY_PARAMS_UNSUPPORTED_MESSAGE
+      };
+    }
+  }
+  return void 0;
+}
 function paginationFrom(value) {
   if (!isObject9(value)) {
     return { error: "list-query queryParamsJson must contain an object" };
@@ -12371,6 +12435,10 @@ async function handleSerializedQuery(request, env, options = {}) {
   if (definition === void 0 || definition.endpoint !== endpoint) {
     return error6(400, "validation_error", "queryType is not mapped for this endpoint");
   }
+  const unsupported = unsupportedQueryParams(endpoint, parsed.value.queryParams);
+  if (unsupported !== void 0) {
+    return error6(unsupported.status, unsupported.code, unsupported.error);
+  }
   if (!definition.enabled || (options.projectors ?? DEPLOYED_PROJECTOR_REGISTRY).resolve(definition.tagProjector) === void 0) {
     return error6(503, "projection_unavailable", "The mapped query projection is unavailable");
   }
@@ -12859,11 +12927,11 @@ function normalizeCorrection(value) {
     throw new IncidentLifecycleError("incident_invalid_request", 400, "correction.kind must be event or receipt");
   }
   const reference = boundedString(value.reference, "correction.reference", MAX_LONG_TEXT_BYTES);
-  const digest2 = boundedString(value.digest, "correction.digest", MAX_IDENTITY_BYTES);
-  if (reference === null || digest2 === null || !SHA256_DIGEST.test(digest2)) {
+  const digest = boundedString(value.digest, "correction.digest", MAX_IDENTITY_BYTES);
+  if (reference === null || digest === null || !SHA256_DIGEST.test(digest)) {
     throw new IncidentLifecycleError("incident_invalid_request", 400, "correction.digest must be lowercase sha256");
   }
-  return { kind: value.kind, reference, digest: digest2 };
+  return { kind: value.kind, reference, digest };
 }
 function normalizeRequest(value) {
   if (!isObject11(value) || !hasOnlyKeys(value, ["action", "incidentIdentity", "transitionKey", "expectedVersion", "reason", "ownerId", "deadlineAt", "correction", "resolution"])) {
@@ -12919,8 +12987,8 @@ function canonicalize(value) {
 async function digestFor(request, actorId) {
   const envelope = canonicalize({ action: request, actor: actorId });
   const encoded = new TextEncoder().encode(JSON.stringify(envelope));
-  const digest2 = await crypto.subtle.digest("SHA-256", encoded);
-  return `sha256:${Array.from(new Uint8Array(digest2), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+  const digest = await crypto.subtle.digest("SHA-256", encoded);
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 function projectionFromRow(row, finding2) {
   if (row === null) {
@@ -13147,13 +13215,13 @@ var IncidentLifecycle = class {
     }
     if (actorId === null) throw new IncidentLifecycleError("incident_invalid_actor", 400, "x-sdt-maintainer must be non-empty");
     const finding2 = await this.finding(serviceId, request.incidentIdentity);
-    const digest2 = await digestFor(request, actorId);
+    const digest = await digestFor(request, actorId);
     const existing = await this.database.prepare(
       `SELECT * FROM serialized_dcb_incident_transitions
         WHERE service_id = ? AND incident_identity = ? AND transition_key = ?`
     ).bind(serviceId, request.incidentIdentity, request.transitionKey).first();
     if (existing !== null && existing !== void 0) {
-      if (existing.request_digest !== digest2) {
+      if (existing.request_digest !== digest) {
         throw new IncidentLifecycleError("incident_idempotency_conflict", 409, "The transition key was already used with different content");
       }
       return { projection: transitionFromRow(existing).after, transition: transitionFromRow(existing), idempotent: true };
@@ -13216,7 +13284,7 @@ var IncidentLifecycle = class {
       serviceId,
       request.incidentIdentity,
       request.transitionKey,
-      digest2,
+      digest,
       request.action,
       before.lifecycleState,
       before.version,
@@ -13245,7 +13313,7 @@ var IncidentLifecycle = class {
         `SELECT * FROM serialized_dcb_incident_transitions
           WHERE service_id = ? AND incident_identity = ? AND transition_key = ?`
       ).bind(serviceId, request.incidentIdentity, request.transitionKey).first();
-      if (competing !== null && competing !== void 0 && competing.request_digest !== digest2) {
+      if (competing !== null && competing !== void 0 && competing.request_digest !== digest) {
         throw new IncidentLifecycleError("incident_idempotency_conflict", 409, "The transition key was already used with different content");
       }
       if (competing !== null && competing !== void 0) {
@@ -13347,29 +13415,6 @@ function json10(body, status = 200) {
 function error8(status, code, message) {
   return json10({ error: message, code }, status);
 }
-function configuredToken(value) {
-  if (typeof value !== "string") return void 0;
-  const token = value.trim();
-  return token.length === 0 ? void 0 : token;
-}
-async function digest(value) {
-  const bytes2 = new TextEncoder().encode(value);
-  return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes2));
-}
-function fixedLengthEqual(left, right) {
-  let difference = left.length ^ right.length;
-  const length = Math.max(left.length, right.length);
-  for (let index = 0; index < length; index += 1) {
-    difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
-  }
-  return difference === 0;
-}
-async function authenticated(request, token) {
-  const credential = request.headers.get("authorization") ?? "";
-  const suppliedToken = credential.startsWith("Bearer ") ? credential.slice("Bearer ".length) : "";
-  const [expectedDigest, suppliedDigest] = await Promise.all([digest(token), digest(suppliedToken)]);
-  return fixedLengthEqual(expectedDigest, suppliedDigest);
-}
 function boolFilter(value, name) {
   if (value === null) return void 0;
   if (value === "true") return true;
@@ -13423,11 +13468,13 @@ function isIncidentMaintenancePath(pathname) {
   return pathname === "/maintenance/incidents" || pathname.startsWith("/maintenance/incidents/");
 }
 async function handleIncidentMaintenance(request, env, serviceIdentityProvider) {
-  const token = configuredToken(env.INCIDENT_MAINTAINER_TOKEN);
-  if (token === void 0) {
+  const decision = await checkConfiguredBearer(request, env.INCIDENT_MAINTAINER_TOKEN, {
+    tokenNormalization: "trim"
+  });
+  if (decision === "unconfigured") {
     return error8(503, "incident_maintenance_unavailable", "Incident maintenance is not configured");
   }
-  if (!await authenticated(request, token)) {
+  if (decision === "missing" || decision === "invalid") {
     return error8(401, "incident_auth_required", "A valid incident maintenance bearer token is required");
   }
   let serviceId;
@@ -20735,6 +20782,18 @@ function createRuntimeWorker(options = {}) {
       if (isIncidentMaintenancePath(url.pathname)) {
         return handleIncidentMaintenance(request, env, options.serviceIdentityProvider ?? envServiceIdentity(env));
       }
+      const operatorRepair = url.pathname === "/operator/repair";
+      const operatorBootstrap = url.pathname.startsWith("/operator/bootstrap/");
+      if (operatorRepair) {
+        const methodDenied = nonPostOperatorRepairResponse(request);
+        if (methodDenied !== void 0) return methodDenied;
+        const denied = await authenticateOperatorRepair(request, env.REPAIR_OPERATOR_TOKEN);
+        if (denied !== void 0) return denied;
+      }
+      if (operatorBootstrap) {
+        const denied = await authenticateOperatorBootstrap(request, env.REPAIR_OPERATOR_TOKEN);
+        if (denied !== void 0) return denied;
+      }
       const serviceIdentity = options.serviceIdentityProvider ?? envServiceIdentity(env);
       const requestIdentityOptions = { allowG11Verification: env.G11_VERIFICATION_ENABLED === "true" };
       let requestServiceId;
@@ -20764,11 +20823,16 @@ function createRuntimeWorker(options = {}) {
           serviceIdentityProvider: serviceIdentity
         });
       }
-      if (url.pathname === "/operator/repair") {
-        return handleOperatorRepair(request, env, nativeTracingFromContext(ctx), serviceIdentity);
+      if (operatorRepair) {
+        return handleAuthorizedOperatorRepair(
+          request,
+          env,
+          nativeTracingFromContext(ctx),
+          serviceIdentity
+        );
       }
-      if (url.pathname.startsWith("/operator/bootstrap/")) {
-        return handleOperatorBootstrap(request, env, storeProvider);
+      if (operatorBootstrap) {
+        return handleAuthorizedOperatorBootstrap(request, env, storeProvider);
       }
       if (url.pathname === "/internal/downstream/drain" && request.method === "POST") {
         return handleOutboxDrainRequest(request, env, { serviceIdentityProvider: serviceIdentity });
@@ -20946,6 +21010,7 @@ export {
   buildScopeName,
   calculateUnattributedRatio,
   canonicalEventType,
+  checkConfiguredBearer,
   chooseQueryBacking,
   classifyDirectDoorbellFailure,
   classifyReactivationCause,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sekiban/dcb-runtime",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "private": false,
   "description": "Cloudflare Durable Object and HTTP runtime for Serialized DCB V1.",
   "license": "Elastic-2.0",
@@ -52,7 +52,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@sekiban/dcb-core": "0.2.1"
+    "@sekiban/dcb-core": "0.2.2"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && esbuild src/index.ts --bundle --format=esm --platform=neutral --external:postgres --external:cloudflare:workers --outfile=dist/index.js && esbuild src/cosmos.ts --bundle --format=esm --platform=neutral --external:postgres --external:cloudflare:workers --outfile=dist/cosmos.js && esbuild src/d1.ts --bundle --format=esm --platform=neutral --external:postgres --external:cloudflare:workers --outfile=dist/d1.js && esbuild src/d1-mv.ts --bundle --format=esm --platform=neutral --external:postgres --external:cloudflare:workers --outfile=dist/d1-mv.js && esbuild src/cloudflare.ts --bundle --format=esm --platform=neutral --external:cloudflare:workers --outfile=dist/cloudflare.js && esbuild src/mv/index.ts --bundle --format=esm --platform=neutral --external:postgres --external:cloudflare:workers --outfile=dist/mv/index.js",