@dreamforgestudiollc/emet 0.2.4 → 0.2.6

package/src/guides.js

@@ -22,14 +22,36 @@ import crypto from 'crypto';
 import { resolveModulePath } from './module-path.js';
 
 export const GUIDES_DIR = resolveModulePath(import.meta.url, ['..', 'guides']);
+const GEMS_DIR = resolveModulePath(import.meta.url, ['..', 'gems']);
 const GUIDE_ID = /^guides\/([A-Za-z0-9_-]+\.md)$/;
 
+/**
+ * One release: the old neurodivergent guide id resolves to the Neurendipity
+ * copy. There is one file. This map is not a second copy of the text.
+ */
+const GUIDE_ALIAS = Object.freeze({
+  'guides/NEURODIVERGENT_SUPPORT.md': resolveModulePath(import.meta.url, ['..', 'gems', 'neurendipity', 'guides', 'NEURODIVERGENT_SUPPORT.md'])
+});
+
 /** The shipped guide for this doc_id, or null when it is not a shipped guide. */
 export function readShippedGuide(doc_id, { dir = GUIDES_DIR } = {}) {
   const m = typeof doc_id === 'string' ? GUIDE_ID.exec(doc_id) : null;
   if (!m) return null;
+  const file = Object.prototype.hasOwnProperty.call(GUIDE_ALIAS, doc_id) ? GUIDE_ALIAS[doc_id] : path.join(dir, m[1]);
   let content;
-  try { content = fs.readFileSync(path.join(dir, m[1]), 'utf8'); } catch { return null; }
+  try { content = fs.readFileSync(file, 'utf8'); } catch {
+    // A bundled GEM's own guide (2026-10-12: Neurendipity's floor points to
+    // read_doc('guides/AUTISTIC_BURNOUT.md'), which no folder served). Only the
+    // default shipped dir falls through, and only to bundled gems/<id>/guides/.
+    if (dir !== GUIDES_DIR) return null;
+    content = null;
+    let gems = [];
+    try { gems = fs.readdirSync(GEMS_DIR).filter((g) => /^[a-z0-9-]+$/.test(g)).sort(); } catch { gems = []; }
+    for (const g of gems) {
+      try { content = fs.readFileSync(path.join(GEMS_DIR, g, 'guides', m[1]), 'utf8'); break; } catch { /* next */ }
+    }
+    if (content === null) return null;
+  }
   return {
     doc_id,
     content,
@@ -41,8 +63,13 @@ export function readShippedGuide(doc_id, { dir = GUIDES_DIR } = {}) {
   };
 }
 
-/** Names of the guides this release ships. */
+/** Names of the guides this release ships. The one-release alias is included. */
 export function shippedGuides({ dir = GUIDES_DIR } = {}) {
-  try { return fs.readdirSync(dir).filter(f => /\.md$/.test(f)).map(f => `guides/${f}`).sort(); }
-  catch { return []; }
+  let names = [];
+  try { names = fs.readdirSync(dir).filter(f => /\.md$/.test(f)).map(f => `guides/${f}`); }
+  catch { names = []; }
+  for (const id of Object.keys(GUIDE_ALIAS)) {
+    if (!names.includes(id) && fs.existsSync(GUIDE_ALIAS[id])) names.push(id);
+  }
+  return names.sort();
 }

package/src/host-reach.js

@@ -0,0 +1,23 @@
+/**
+ * EMET - Enduring Memory & Epistemic Tiers
+ * Copyright (c) 2026 Dreamforge Studio LLC
+ *
+ * Licensed under the MIT License - see LICENSE
+ *
+ * The RUNE load gate lives in verification/load-gate/load-gate.mjs so
+ * EMET-GEMs can vendor that file and its corpus byte-for-byte. This module
+ * is the import path gem-check already uses. There is no second scan.
+ */
+
+export {
+  refuseHostAccess,
+  scanSource,
+  hostRules,
+  runeSpecifierReason,
+  runeExtensionReason,
+  MAX_SOURCE_BYTES,
+  HOST_GLOBALS,
+  OBJECT_METHODS,
+  MEMBER_NAMES,
+  MATH_MEMBERS
+} from '../verification/load-gate/load-gate.mjs';

package/src/http-remote.js

@@ -82,7 +82,9 @@ function buildServer() {
     const { scopesAllow } = await import('./scopes.js');
     const auth = extra && extra.authInfo;
     const scopes = (auth && auth.scopes) || [];
-    return { tools: t.TOOLS.filter((tool) => scopesAllow(scopes, tool.name, { http: true, authenticated: Boolean(auth), args: null })) };
+    const { runeToolList } = await import('./rune-registry.js');
+    const tools = [...t.TOOLS, ...runeToolList()];
+    return { tools: tools.filter((tool) => scopesAllow(scopes, tool.name, { http: true, authenticated: Boolean(auth), args: null })) };
   });
   server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
     const { name, arguments: args = {} } = request.params;
@@ -95,6 +97,7 @@ function buildServer() {
       scopes: (auth && auth.scopes) || [],
       transport: 'http',
       sourceTag: (auth && auth.extra && auth.extra.sourceTag) || null,
+      grantId: (auth && auth.extra && auth.extra.grantId) || null,
       authenticated: Boolean(auth)
     };
     const bucket = t.rateBucket(actor);
@@ -104,8 +107,24 @@ function buildServer() {
     // Every tool call leaves one audit entry (H6). callTool never throws: it
     // returns either a success response or handleError's isError response.
     const t0 = Date.now();
-    // Parameter NAMES, never values (the owner, 2026-09-27, code audit 1.6).
+    // Parameter NAMES, never values (Alex, 2026-09-27, code audit 1.6).
     const paramNames = Object.keys(args || {}).sort();
+    try {
+      const att = await import('./attribution.js');
+      const { resolveTokenSubject } = await import('./persons.js');
+      actor.ownerId = await resolveTokenSubject(dbManager.db).catch(() => null);
+      await actorStore.run(actor, () => att.preflight({
+        db: dbManager.db, prefix: provider.prefix, ownerId: actor.ownerId, deps: t.approvalsDeps,
+        layerCollections: ['episodic', 'semantic', 'procedural', 'meta', 'identity', 'working'].map((l) => { try { return dbManager.collectionFor(l); } catch { return null; } }).filter(Boolean),
+        registry: t.sourceRegistry()
+      }, actor, args, name));
+    } catch (e) {
+      if (e && e.attributionRefusal) {
+        const { ValidationError } = await import('./validation.js');
+        return actorStore.run(actor, () => t.handleError(new ValidationError('source', e.message), name, logger));
+      }
+      throw e;
+    }
     const result = await actorStore.run(actor, () => callTool(name, args));
     logger.audit(AuditOperation.TOOL_CALL, { tool: name, success: result.isError !== true, durationMs: Date.now() - t0, params: paramNames });
     return result;
@@ -136,6 +155,20 @@ app.use(requestLogger({ enabled: process.env.EMET_REQUEST_LOG !== '0' }));
 
 app.get('/health', (_req, res) => res.json({ ok: true, service: 'emet', tools: t.TOOLS.length, cimd: provider.cimdEnabled }));
 
+// Pending sub-keys. Same passphrase and the same per-address failure throttle
+// as /oauth/approve. The routes are not mounted unless EMET_SUBKEYS=1, so a
+// flag-off process answers these paths the way it answers any other unknown path.
+if (setting('SUBKEYS') === '1') {
+  const { mountOwnerApprovals } = await import('./owner-approvals.js');
+  const { resolveTokenSubject } = await import('./persons.js');
+  mountOwnerApprovals(app, {
+    checkPassphrase: (input) => provider.checkPassphrase(input),
+    throttle: approveThrottle,
+    deps: t.approvalsDeps,
+    ownerId: () => resolveTokenSubject(dbManager.db)
+  });
+}
+
 // OAuth 2.1 authorization server + protected-resource metadata:
 //   /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource/mcp,
 //   /register, /authorize, /token, /revoke
@@ -265,5 +298,16 @@ app.post('/mcp', requireBearerAuth({ verifier: provider, resourceMetadataUrl: PR
   if (!PASSPHRASE) console.error('[emet] WARNING: EMET_OAUTH_PASSPHRASE unset — all authorization attempts will be rejected.');
   try { await dbManager.ensureClient(); console.error('[emet] Mongo connected'); }
   catch (e) { console.error('[emet] Mongo connect FAILED:', e.message); }
+  try {
+    const { seatGems } = await import('./socket.js');
+    const seated = await seatGems({ log: logger });
+    // The structured line keeps the id in the middle of a JSON object. This
+    // line ends with the id so the image boot can anchor it.
+    for (const row of seated.gems_available || []) {
+      if (row.loadable) console.error(`GEM seated: ${row.id}`);
+    }
+  }
+  catch (e) { console.error('[emet] GEM socket failed closed'); }
   app.listen(PORT, HOST, () => console.error(`[emet] listening ${PUBLIC_URL} (bind ${HOST}:${PORT}); /mcp OAuth-protected; PRM ${PRM_URL}`));
+  import('./subkeys.js').then((m) => m.startFlagOffSweep((msg) => console.error(`[emet] ${msg}`))).catch(() => console.error('[emet] sub-key flag-off sweep failed'));
 })();

package/src/index.js

@@ -57,6 +57,8 @@ import {
 } from './database.js';
 
 import { dispatchTool } from './dispatch.js';
+import { seatGems } from './socket.js';
+import { runeToolList } from './rune-registry.js';
 // Import tools module (the per-tool handlers are reached through dispatch.js)
 import {
   TOOLS,
@@ -124,7 +126,7 @@ const server = new Server(
  * List available tools
  */
 server.setRequestHandler(ListToolsRequestSchema, async () => {
-  return { tools: TOOLS };
+  return { tools: [...TOOLS, ...runeToolList()] };
 });
 
 /**
@@ -169,7 +171,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
   // Every tool call leaves one audit entry (H6, 2026-09-19). callTool never
   // throws: it returns either a success response or handleError's response.
   const t0 = Date.now();
-  // Parameter NAMES, never values (the owner, 2026-09-27, code audit 1.6): the next
+  // Parameter NAMES, never values (Alex, 2026-09-27, code audit 1.6): the next
   // audit can measure which parameters hosts use; nothing a host sent is stored.
   const paramNames = Object.keys(args || {}).sort();
   const result = await actorStore.run(actor, () => callTool(name, args));
@@ -256,6 +258,11 @@ async function main() {
     }
   }
 
+  try { await seatGems({ log: logger }); }
+  catch (e) { logger.error('GEM socket failed closed', { error: e && e.message }); }
+
+  import('./subkeys.js').then((m) => m.startFlagOffSweep((msg) => logger.error(msg))).catch((e) => logger.error('sub-key flag-off sweep failed', { error: e && e.message }));
+
   const startupDurationMs = Date.now() - startTime;
 
   logger.audit(AuditOperation.SERVER_START, {

package/src/layers.js

@@ -247,7 +247,7 @@ export function bandFor(layer) {
 
 /** Named importance buckets. The word is the differentiator; the range is
  *  compatibility for the stored float. Degree (low/mid/high) is the only
- *  reason to pick a number other than the midpoint. The owner 2026-09-26. */
+ *  reason to pick a number other than the midpoint. Alex 2026-09-26. */
 export const IMPORTANCE_BUCKETS = Object.freeze({
   constitutive: { range: [0.9, 1.0], layers: ['identity'] },
   durable: { range: [0.6, 0.9], layers: ['semantic', 'meta'] },

package/src/lessons-to-checks.js

@@ -32,7 +32,7 @@
  *
  * Source of the three-attempt rule and the scope line: Hanako, "Loops and
  * Graphs" (2026-08-23), read in full 2026-09-27; the user's decisions are in
- * the owner's store.
+ * staging/emet-lessons-to-checks.md.
  */
 
 // ---------------------------------------------------------------------------
@@ -244,7 +244,7 @@ function familyEntry(members, key) {
  * One detector, the explicit key (2026-09-29). Rows carrying metadata.lesson
  * are grouped by that key - the writer says "same lesson" at save time and
  * nothing is inferred. The tag-family heuristic that ran beside it in shadow
- * from 2026-09-27 was DROPPED on the owner's ruling: "that's
+ * from 2026-09-27 was DROPPED on the owner's ruling (procedural ref 397): "that's
  * just another instance of forking... I would rather the original be more
  * heavily, better enforced, than having a backup that can rot or fork." The
  * enforcement moved to the write: checkLessonFields below refuses a malformed
@@ -292,7 +292,7 @@ export function pendingLessons(rows, { threshold = LESSON_REPEAT_THRESHOLD } = {
 }
 
 // ---------------------------------------------------------------------------
-// 4. The lesson fields are checked at the door (2026-09-29, a decision record)
+// 4. The lesson fields are checked at the door (2026-09-29, procedural ref 397)
 // ---------------------------------------------------------------------------
 
 /** A lesson key is a lowercase slug: letters and digits in hyphen-joined

package/src/logger.js

@@ -51,7 +51,8 @@ const AuditOperation = Object.freeze({
   VALIDATION_FAIL: 'VALIDATION_FAIL',
   SERVER_START: 'SERVER_START',
   SERVER_STOP: 'SERVER_STOP',
-  CONFIG_CHANGE: 'CONFIG_CHANGE'
+  CONFIG_CHANGE: 'CONFIG_CHANGE',
+  GEM_SERVE: 'GEM_SERVE'
 });
 
 /**

package/src/mongo-connect.js

@@ -1,7 +1,7 @@
 /**
  * EMET - the one way to open a MongoDB connection (2026-09-29).
  *
- * Some local resolvers (home routers, VPN DNS) refuse
+ * Some local resolvers (home routers, VPN DNS - STUDIO's among them) refuse
  * the SRV queries a mongodb+srv:// URI needs, and the driver fails with
  * "querySrv ECONNREFUSED". Until today the public-DNS fallback lived only in
  * EmetDatabase.ensureClient; nine other connections in src/ and
@@ -31,9 +31,52 @@ export function isSrvRefusal(error) {
  * with no database. Never set outside tests; null means the real driver.
  */
 let testClient = null;
-export function useTestClient(Client) { testClient = Client || null; }
+let sharedClient = null;
+let sharedToken = null;
+let sharedConnect = null;
+
+/** The server's Mongo client, reused by stores that would otherwise connect per call. */
+export function bindSharedClient(client) {
+  if (!client) return;
+  sharedClient = client;
+  sharedToken = testClient || 'live';
+}
+
+function resetSharedClient() {
+  sharedClient = null;
+  sharedToken = null;
+  sharedConnect = null;
+}
+
+export function useTestClient(Client) {
+  testClient = Client || null;
+  resetSharedClient();
+}
 export function testClientActive() { return testClient != null; }
 
+/**
+ * One client for this process (or for the installed test client). A second
+ * call does not open another connection.
+ */
+export async function acquireSharedClient(uri, options = {}) {
+  const token = testClient || 'live';
+  if (sharedClient && sharedToken === token) return sharedClient;
+  if (!sharedConnect) {
+    let resolve;
+    let reject;
+    // Assign before connectMongo yields, so a second caller waits on this promise.
+    sharedConnect = new Promise((res, rej) => { resolve = res; reject = rej; });
+    connectMongo(uri, options).then((client) => {
+      if ((testClient || 'live') === token && sharedConnect) {
+        sharedClient = client;
+        sharedToken = token;
+      }
+      resolve(client);
+    }, reject).finally(() => { sharedConnect = null; });
+  }
+  return sharedConnect;
+}
+
 /** Connect and return the client. `onFallback(message)` is told when the retry happens. */
 export async function connectMongo(uri, options = {}, { onFallback = null, _Client = testClient || MongoClient, _dns = dns } = {}) {
   const attempt = async () => { const c = new _Client(uri, options); await c.connect(); return c; };

package/src/oauth-provider.js

@@ -83,7 +83,7 @@ function escapeHtml(s) {
   return String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
 }
 
-function timingSafeEqualStr(a, b) {
+export function timingSafeEqualStr(a, b) {
   const ab = Buffer.from(String(a));
   const bb = Buffer.from(String(b));
   if (ab.length !== bb.length) {
@@ -824,7 +824,7 @@ export class MongoOAuthProvider {
       clientId: doc.client_id,
       scopes: doc.scopes || [],
       expiresAt: doc.expiresAt,
-      extra: { subject: doc.subject || 'owner', sourceTag: doc.source_tag || null },
+      extra: { subject: doc.subject || 'owner', sourceTag: doc.source_tag || null, grantId: doc.family || null },
     };
   }
 

package/src/owner-approvals.js

@@ -0,0 +1,281 @@
+/**
+ * Owner page for pending sub-key requests.
+ *
+ * Mounted only when EMET_SUBKEYS=1. The passphrase is the one the OAuth
+ * consent page already checks (MongoOAuthProvider.checkPassphrase against
+ * EMET_OAUTH_PASSPHRASE), and a wrong guess shares that form's per-address
+ * lockout. A correct passphrase opens a session that lasts 15 minutes.
+ * Approve and Deny post that session's CSRF token and call
+ * decideSubkeyIfPending for the posted key_id. The history event records
+ * the real owner id and via owner_page. emet_client_approve is unchanged.
+ */
+
+import crypto from 'node:crypto';
+import express from 'express';
+import { timingSafeEqualStr } from './oauth-provider.js';
+import { decideSubkeyIfPending, loadSubkeyRecords } from './subkeys.js';
+
+const COOKIE_NAME = 'emet_owner';
+export const SESSION_MS = 15 * 60 * 1000;
+const SESSION_MAX = 200;
+const REASON_MAX = 500;
+const STORE_MESSAGE = 'The sub-key store is unavailable.';
+const NOT_PENDING = 'That sub-key is not awaiting approval. Nothing was changed.';
+
+function esc(s) {
+  return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+}
+
+function readCookie(req, name) {
+  const raw = req.headers.cookie;
+  if (!raw || typeof raw !== 'string') return null;
+  for (const part of raw.split(';')) {
+    const i = part.indexOf('=');
+    if (i < 0) continue;
+    if (part.slice(0, i).trim() !== name) continue;
+    return part.slice(i + 1).trim();
+  }
+  return null;
+}
+
+function ownerActor(personId) {
+  return {
+    transport: 'http',
+    authenticated: true,
+    personId,
+    ownerId: personId,
+    sourceTag: 'owner',
+    sourceBasis: 'login',
+    clientId: null,
+    grantId: null
+  };
+}
+
+function page(body) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>EMET owner approvals</title>
+<style>
+  body { font-family: system-ui, sans-serif; background: #12141a; color: #e8e6e0; margin: 0; padding: 24px; }
+  button { font: inherit; margin-right: 8px; }
+</style>
+</head>
+<body>
+${body}
+</body>
+</html>`;
+}
+
+function sendHtml(res, status, body) {
+  res.status(status);
+  res.setHeader('Content-Type', 'text/html; charset=utf-8');
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'");
+  res.send(page(body));
+}
+
+function pendingRows(data) {
+  return Object.values((data && data.keys) || {})
+    .filter((k) => k && k.status === 'pending' && k.key_id && k.tag)
+    .sort((a, b) => String(a.requested_at || '').localeCompare(String(b.requested_at || '')) || String(a.key_id).localeCompare(String(b.key_id)));
+}
+
+function listHtml(rows, csrf, note) {
+  const noteHtml = note ? `<p>${esc(note)}</p>` : '';
+  if (!rows.length) return `${noteHtml}<h1>Pending sub-keys</h1><p>No pending sub-key requests.</p>`;
+  const body = rows.map((row) => {
+    const prefix = esc(String(row.key_id).slice(0, 8));
+    return `<tr><td>${esc(row.tag)}</td><td>${prefix}</td><td>${esc(row.requested_at || '')}</td><td>
+<form method="post" action="/owner/approvals/decide">
+<input type="hidden" name="csrf" value="${esc(csrf)}">
+<input type="hidden" name="key_id" value="${esc(row.key_id)}">
+<input type="text" name="reason" maxlength="${REASON_MAX}" placeholder="Reason (optional)">
+<button type="submit" name="decision" value="approve">Approve</button>
+<button type="submit" name="decision" value="deny">Deny</button>
+</form>
+</td></tr>`;
+  }).join('\n');
+  return `${noteHtml}<h1>Pending sub-keys</h1>
+<table>
+<thead><tr><th>Tag</th><th>Key</th><th>Requested</th><th></th></tr></thead>
+<tbody>
+${body}
+</tbody>
+</table>`;
+}
+
+function notPending(res) {
+  res.locals.reason = 'not_pending';
+  sendHtml(res, 400, `<p>${NOT_PENDING}</p>`);
+}
+
+/**
+ * @param {import('express').Express} app
+ * @param {{ checkPassphrase: (input: string) => boolean, throttle: { check: Function, recordFailure: Function, recordSuccess: Function }, deps: object | Function, ownerId: string | Function, now?: () => number }} options
+ */
+export function mountOwnerApprovals(app, options = {}) {
+  const checkPassphrase = options.checkPassphrase;
+  const throttle = options.throttle;
+  const now = options.now || Date.now;
+  const sessions = new Map();
+  const parseBody = express.urlencoded({ extended: false });
+  const depsOf = () => (typeof options.deps === 'function' ? options.deps() : options.deps);
+
+  async function resolveOwner() {
+    try { const id = await (typeof options.ownerId === 'function' ? options.ownerId() : options.ownerId); return (typeof id === 'string' && id.trim()) || null; }
+    catch { return null; }
+  }
+
+  function sweep() {
+    const t = now();
+    for (const [id, row] of sessions) if (!row || row.expires <= t) sessions.delete(id);
+    while (sessions.size > SESSION_MAX) sessions.delete(sessions.keys().next().value);
+  }
+
+  function sessionOf(req) {
+    sweep();
+    const raw = readCookie(req, COOKIE_NAME);
+    if (!raw || !/^[0-9a-f]{64}$/.test(raw)) return null;
+    return sessions.get(raw) || null;
+  }
+
+  async function renderList(req, res, note) {
+    const session = sessionOf(req);
+    if (!session) {
+      sendHtml(res, 200, `<h1>Owner approvals</h1>
+<p>Enter the owner passphrase.</p>
+<form method="post" action="/owner/approvals/login">
+<label>Passphrase <input type="password" name="passphrase" autocomplete="current-password"></label>
+<button type="submit">Continue</button>
+</form>`);
+      return;
+    }
+    let rows = [];
+    try {
+      rows = pendingRows(await loadSubkeyRecords(depsOf()));
+    } catch {
+      res.locals.reason = 'subkey_store';
+      sendHtml(res, 503, `<p>${STORE_MESSAGE}</p>`);
+      return;
+    }
+    sendHtml(res, 200, listHtml(rows, session.csrf, note));
+  }
+
+  app.get('/owner/approvals', (req, res) => {
+    renderList(req, res).catch((e) => {
+      console.error('[emet] owner approvals', e && e.message ? e.message : e);
+      if (!res.headersSent) {
+        res.locals.reason = 'owner_approvals_error';
+        sendHtml(res, 500, '<p>Something went wrong.</p>');
+      }
+    });
+  });
+
+  app.post('/owner/approvals/login', parseBody, (req, res) => {
+    const limit = throttle.check(req.ip);
+    if (!limit.allowed) {
+      res.locals.reason = 'throttled';
+      res.setHeader('Retry-After', String(limit.retryAfterS));
+      sendHtml(res, 429, '<p>Too many attempts. Try again later.</p>');
+      return;
+    }
+    const passphrase = (req.body && req.body.passphrase) || '';
+    let ok = false;
+    try { ok = checkPassphrase(passphrase) === true; }
+    catch (e) {
+      console.error('[emet] owner passphrase check', e && e.message ? e.message : e);
+      res.locals.reason = 'passphrase_check_error';
+      sendHtml(res, 500, '<p>Something went wrong.</p>');
+      return;
+    }
+    if (!ok) {
+      throttle.recordFailure(req.ip);
+      res.locals.reason = 'bad_passphrase';
+      sendHtml(res, 401, '<p>Incorrect passphrase.</p>');
+      return;
+    }
+    throttle.recordSuccess(req.ip);
+    sweep();
+    const id = crypto.randomBytes(32).toString('hex');
+    const csrf = crypto.randomBytes(32).toString('hex');
+    sessions.set(id, { csrf, expires: now() + SESSION_MS });
+    res.cookie(COOKIE_NAME, id, {
+      httpOnly: true,
+      sameSite: 'strict',
+      path: '/owner',
+      maxAge: SESSION_MS,
+      secure: req.secure === true
+    });
+    res.locals.reason = 'owner_session';
+    res.redirect(303, '/owner/approvals');
+  });
+
+  app.post('/owner/approvals/decide', parseBody, (req, res) => {
+    const session = sessionOf(req);
+    if (!session) {
+      res.locals.reason = 'no_owner_session';
+      sendHtml(res, 401, '<p>Sign in again.</p>');
+      return;
+    }
+    const posted = (req.body && req.body.csrf) || '';
+    if (!timingSafeEqualStr(posted, session.csrf)) {
+      res.locals.reason = 'bad_csrf';
+      sendHtml(res, 403, '<p>The form expired. Reload the page and try again.</p>');
+      return;
+    }
+    const decision = req.body && req.body.decision;
+    const keyId = typeof (req.body && req.body.key_id) === 'string' ? req.body.key_id.trim() : '';
+    const reason = typeof (req.body && req.body.reason) === 'string' ? req.body.reason.trim() : '';
+    if (decision !== 'approve' && decision !== 'deny') {
+      res.locals.reason = 'bad_decision';
+      sendHtml(res, 400, '<p>Decision must be approve or deny. Nothing was changed.</p>');
+      return;
+    }
+    if (reason.length > REASON_MAX) {
+      res.locals.reason = 'reason_too_long';
+      sendHtml(res, 400, '<p>The reason is too long. Nothing was changed.</p>');
+      return;
+    }
+    finishDecide(req, res, keyId, decision, reason).catch((e) => {
+      console.error('[emet] owner decide', e && e.message ? e.message : e);
+      if (!res.headersSent) {
+        res.locals.reason = 'owner_decide_error';
+        sendHtml(res, 500, '<p>Something went wrong. Nothing was changed.</p>');
+      }
+    });
+  });
+
+  async function finishDecide(req, res, keyId, decision, reason) {
+    const personId = await resolveOwner();
+    if (!personId) {
+      res.locals.reason = 'owner_unavailable';
+      sendHtml(res, 400, '<p>The owner id is unavailable. Nothing was changed.</p>');
+      return;
+    }
+    let result = null;
+    try {
+      result = await decideSubkeyIfPending(depsOf(), ownerActor(personId), personId, {
+        key_id: keyId, decision, reason, via: 'owner_page'
+      }, new Date(now()));
+    } catch (e) {
+      if (e && e.attributionRefusal && !/sub-key store/.test(String(e.message))) {
+        res.locals.reason = 'decide_refused';
+        sendHtml(res, 400, `<p>${esc(e.message)}</p>`);
+        return;
+      }
+      res.locals.reason = 'subkey_store';
+      sendHtml(res, 503, `<p>${STORE_MESSAGE}</p>`);
+      return;
+    }
+    if (!result) {
+      notPending(res);
+      return;
+    }
+    res.locals.reason = decision === 'approve' ? 'subkey_approved' : 'subkey_denied';
+    const verb = decision === 'approve' ? 'Approved' : 'Denied';
+    await renderList(req, res, `${verb} ${result.tag}.`);
+  }
+}

package/src/persons.js

@@ -63,6 +63,26 @@ export function boundSourceTag() {
   return tag || null;
 }
 
+/** The raw per-request actor (HTTP object), or null. Read only. */
+export function rawActor() {
+  const s = actorStore.getStore();
+  return s && typeof s === 'object' ? s : null;
+}
+
+/** Per-request attribution set by attribution.preflight (HTTP only). */
+export function declaredAttribution() {
+  const s = actorStore.getStore();
+  if (!s || typeof s !== 'object' || s.transport !== 'http') return null;
+  const login = typeof s.sourceTag === 'string' && s.sourceTag.trim() ? s.sourceTag.trim() : null;
+  return {
+    declared: s.declaredTag || null, basis: s.sourceBasis || null, login,
+    effective: s.effectiveTag || null, clientId: s.clientId || null,
+    approval: s.approvalState || null,
+    rememberedTags: Array.isArray(s.rememberedTags) ? s.rememberedTags : [],
+    ...(s.subkeyId ? { keyId: s.subkeyId } : {})
+  };
+}
+
 export function displayNameFromUserDoc(text) {
   const heading = String(text || '').match(/^#\s+User Profile\s+[\u2014\u2013-]\s+(.+)$/im);
   if (heading) return heading[1].trim();