@miadi/connector 0.1.19 → 0.1.21

package/dist/model-preflight.js

@@ -7,6 +7,9 @@
  *   is kept (no switching without a person), Claude Code only when named, an
  *   uninstalled or sign-in-less provider is ineligible, and a reported launch on
  *   another provider fails closed as provider_mismatch before anything is asked.
+ * - Codex is eligible only with its requester's own choice for the mission or
+ *   their own policy (provider-policy.ts, jgwill/Miadi#926); a reported Codex
+ *   launch without either fails closed as provider_not_authorized.
  * - Jev is consulted only when the caller asks (consult_jev) and the connector's
  *   environment holds a Jev key. The state sent holds the task type, the
  *   criticality and the candidates: no task text, mission id, repository name or
@@ -25,6 +28,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { PROVIDERS } from "./providers.js";
+import { needsPersonChoice } from "./provider-policy.js";
 export const PREFLIGHT_CONTRACT = "miadi.mission_model_preflight";
 export const PREFLIGHT_VERSION = 1;
 /** Below this, a Jev choice is not acted on (the ≥0.8 practice of jgwill/Miadi#770). */
@@ -52,7 +56,7 @@ export function configuredModel(provider, home = homedir()) {
     }
     return null;
 }
-export function candidatesFor(found, approved, modelOf = (p) => configuredModel(p), basis = "approved") {
+export function candidatesFor(found, approved, modelOf = (p) => configuredModel(p), basis = "approved", authorization) {
     return PROVIDERS.map((spec) => {
         const a = found.find((p) => p.id === spec.id);
         const installed = Boolean(a?.installed);
@@ -68,6 +72,9 @@ export function candidatesFor(found, approved, modelOf = (p) => configuredModel(
             [eligible, reason] = [false, `Not the ${basis} provider (${approved}); switching needs a person's approval.`];
         else if (!approved && !spec.selectable_by_default)
             [eligible, reason] = [false, `${spec.name} runs only when a request names it.`];
+        else if (needsPersonChoice(spec.id) && !(authorization?.authorized && authorization.provider === spec.id)) {
+            [eligible, reason] = [false, `${spec.name} runs only when ${authorization?.requester.name ?? "the requester"} chooses it for this mission, or their own policy allows it (jgwill/Miadi#926).`];
+        }
         return {
             option: model ? `${spec.id}:${model}` : spec.id,
             provider: spec.id,
@@ -212,6 +219,7 @@ export async function modelPreflight(input) {
         approved_provider,
         provider_basis: input.provider_basis ?? "approved",
         candidates,
+        ...(input.provider_authorization ? { provider_authorization: input.provider_authorization } : {}),
         evidence: { model_cost: "unknown", quota: "unknown" },
         policy: {
             deterministic: true,
@@ -223,6 +231,20 @@ export async function modelPreflight(input) {
         ? { approved_provider, actual: { ...input.launch, source: "reported" }, mismatch: approved_provider ? input.launch.provider !== approved_provider : null }
         : { approved_provider, actual: "unverified", mismatch: null };
     // Fail closed before anything is asked or spent.
+    if (input.launch && needsPersonChoice(input.launch.provider) && !(input.provider_authorization?.authorized && approved_provider === input.launch.provider)) {
+        return {
+            ...base,
+            state: "provider_not_authorized",
+            decider: { source: "static_fallback", router: "not_requested", calibration: "not_applicable", derivation: "deterministic policy: Codex launched without its requester's own choice or policy (jgwill/Miadi#926)" },
+            recommendation: {
+                confidence: null,
+                review_tier: floor,
+                explanation: `Reported running on ${input.launch.provider}, which no choice of the requester's authorizes for this mission. Nothing proceeds on it; the requester chooses it on the approval page, or the mission runs on another provider.`,
+                abstain_reasons: ["provider_not_authorized"],
+            },
+            launch,
+        };
+    }
     if (launch.mismatch) {
         return {
             ...base,

package/dist/provider-policy.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Codex runs only on its requester's own choice for that one mission (jgwill/Miadi#926).
+ *
+ * The assistant that asks (ChatGPT or any MCP client) may name provider "codex", but that
+ * name is the caller's, not the person's. The connector cannot read the chat, so it never
+ * treats the provider field as the person's choice. Codex is authorized for a run only by:
+ *
+ * - a `provider_choice` record the requester made themself on the request's approval page,
+ *   a browser form signed in with their own Miadi person token, outside the MCP channel
+ *   (an OAuth client never holds the person token). The choice is bound to the request id,
+ *   its version and its content hash, and must be fresh (CHOICE_TTL_MS) when the request
+ *   is approved. A revision makes it stale. It covers that mission only;
+ * - or the requester's own provider policy, set by them on the connector's /providers page,
+ *   saying Codex may be named for their requests without a per-mission choice.
+ *
+ * A generic approval (page or card), the caller's provider field, the host's preference
+ * order, a Jev recommendation, and a choice made by anyone other than the requester
+ * authorize nothing. Other providers keep their regular policy (jgwill/Miadi#893, #913).
+ * The check runs when a request is made or revised, when it is approved, when its brief
+ * is written (approval and every rerun), and the factory runner checks the brief again
+ * before it launches anything.
+ */
+import type { ConnectorRecord } from "./records.js";
+/** Providers a request may name only with the requester's own per-mission choice. */
+export declare const CHOICE_PROVIDERS: readonly string[];
+export declare const CODEX_POLICIES: readonly ["per_mission_choice", "selectable"];
+export type CodexPolicy = (typeof CODEX_POLICIES)[number];
+export declare const DEFAULT_CODEX_POLICY: CodexPolicy;
+/** How long a per-mission choice stays good for the approval that follows it. */
+export declare const CHOICE_TTL_MS: number;
+export declare function needsPersonChoice(provider: string | null | undefined): boolean;
+/** Whether a person id may make a choice or set a policy: a person, never a service token. */
+export declare function isPersonId(personId: string | undefined): boolean;
+export interface ProviderPolicy {
+    person_id: string;
+    codex: CodexPolicy;
+    source: "default" | "person";
+    record?: string;
+    set_at?: string;
+}
+/** A person's provider policy: the latest one they set themself, else the default. */
+export declare function providerPolicyOf(records: ConnectorRecord[], personId: string): ProviderPolicy;
+export interface ProviderChoiceView {
+    record: string;
+    provider: string;
+    by: {
+        person_id: string;
+        name: string;
+    };
+    at: string;
+    version: number;
+    content_hash: string;
+    via?: string;
+}
+export type AuthorizationState = "not_required" | "person_choice" | "policy_selectable" | "needs_person_choice";
+export interface ProviderAuthorization {
+    state: AuthorizationState;
+    authorized: boolean;
+    /** The provider the run would launch with (the resolved one), or null when the runner's default applies. */
+    provider: string | null;
+    /** The provider field as the caller wrote it: evidence of what was asked, never of who chose it. */
+    requested: string | null;
+    requester: {
+        person_id: string;
+        name: string;
+        client?: string;
+    };
+    policy: {
+        codex: CodexPolicy;
+        source: ProviderPolicy["source"];
+        record?: string;
+        set_at?: string;
+    };
+    choice?: ProviderChoiceView;
+    /** Choices recorded for this request that do not bind it (another version, another person, too old). */
+    not_binding?: Array<{
+        record: string;
+        why: string;
+    }>;
+    explanation: string;
+}
+/**
+ * Whether the provider a request names may launch, and why. Pure: the ledger is read,
+ * nothing is written. `requireFresh` (the approval) also refuses a choice older than
+ * CHOICE_TTL_MS; the brief written for an approved request checks the binding only.
+ */
+export declare function authorizeProvider(record: ConnectorRecord, records: ConnectorRecord[], opts?: {
+    now?: number;
+    requireFresh?: boolean;
+}): ProviderAuthorization;
+/** The authorization as the brief carries it to the factory runner: attributes it checks before launching. */
+export declare function briefAttributes(a: ProviderAuthorization): Record<string, string>;
+/** The authorization as a receipt keeps it: no body text, only who, what and which record. */
+export declare function authorizationReceipt(a: ProviderAuthorization): Record<string, unknown>;

package/dist/provider-policy.js

@@ -0,0 +1,150 @@
+import { contentHash, versionOf } from "./revisions.js";
+/** Providers a request may name only with the requester's own per-mission choice. */
+export const CHOICE_PROVIDERS = ["codex"];
+export const CODEX_POLICIES = ["per_mission_choice", "selectable"];
+export const DEFAULT_CODEX_POLICY = "per_mission_choice";
+/** How long a per-mission choice stays good for the approval that follows it. */
+export const CHOICE_TTL_MS = 24 * 60 * 60 * 1000;
+export function needsPersonChoice(provider) {
+    return typeof provider === "string" && CHOICE_PROVIDERS.includes(provider);
+}
+/** Whether a person id may make a choice or set a policy: a person, never a service token. */
+export function isPersonId(personId) {
+    return typeof personId === "string" && personId.length > 0 && !personId.startsWith("system:");
+}
+/** A person's provider policy: the latest one they set themself, else the default. */
+export function providerPolicyOf(records, personId) {
+    let latest;
+    for (const r of records) {
+        if (r.kind !== "provider_policy" || r.actor.person_id !== personId || !isPersonId(r.actor.person_id))
+            continue;
+        if (!CODEX_POLICIES.includes(String(r.body.codex)))
+            continue;
+        latest = r;
+    }
+    if (!latest)
+        return { person_id: personId, codex: DEFAULT_CODEX_POLICY, source: "default" };
+    return { person_id: personId, codex: latest.body.codex, source: "person", record: latest.id, set_at: latest.created_at };
+}
+function str(v) {
+    return typeof v === "string" && v ? v : null;
+}
+/**
+ * Whether the provider a request names may launch, and why. Pure: the ledger is read,
+ * nothing is written. `requireFresh` (the approval) also refuses a choice older than
+ * CHOICE_TTL_MS; the brief written for an approved request checks the binding only.
+ */
+export function authorizeProvider(record, records, opts = {}) {
+    const body = (record.body ?? {});
+    const requested = str(body.provider);
+    const provider = str(body.resolved_provider) ?? requested;
+    const requester = {
+        person_id: record.actor.person_id,
+        name: record.actor.name,
+        ...(record.actor.client_name ? { client: record.actor.client_name } : {}),
+    };
+    const policy = providerPolicyOf(records, record.actor.person_id);
+    const policyView = { codex: policy.codex, source: policy.source, ...(policy.record ? { record: policy.record, set_at: policy.set_at } : {}) };
+    const base = { provider, requested, requester, policy: policyView };
+    if (!needsPersonChoice(provider)) {
+        return {
+            ...base,
+            state: "not_required",
+            authorized: true,
+            explanation: provider
+                ? `${provider} needs no per-mission choice; it was ${requested ? "named in the request" : "picked by the host's preference order"} and verified installed.`
+                : "No provider is named: the factory runner's configured default launches, and the runner never starts Codex for a connector brief without the brief's own authorization.",
+        };
+    }
+    if (policy.codex === "selectable" && isPersonId(record.actor.person_id)) {
+        return {
+            ...base,
+            state: "policy_selectable",
+            authorized: true,
+            explanation: `${record.actor.name}'s own provider policy (set ${policy.set_at}) lets their requests name Codex without a per-mission choice. They can change it on the connector's providers page.`,
+        };
+    }
+    const now = opts.now ?? Date.now();
+    const version = versionOf(record);
+    const hash = contentHash(record);
+    const notBinding = [];
+    let choice;
+    for (const r of records) {
+        if (r.kind !== "provider_choice")
+            continue;
+        const b = (r.body ?? {});
+        if (b.request_id !== record.id)
+            continue;
+        const why = b.provider !== provider
+            ? `it chose ${String(b.provider)}, not ${provider}`
+            : r.actor.person_id !== record.actor.person_id || !isPersonId(r.actor.person_id)
+                ? `${r.actor.name} is not the requester`
+                : b.version !== version || b.content_hash !== hash
+                    ? `it was made for version ${String(b.version)}; the request is at version ${version}`
+                    : opts.requireFresh && now - Date.parse(r.created_at) > CHOICE_TTL_MS
+                        ? `it is older than ${CHOICE_TTL_MS / 3_600_000} hours`
+                        : null;
+        if (why)
+            notBinding.push({ record: r.id, why });
+        else
+            choice = r;
+    }
+    const extra = notBinding.length ? { not_binding: notBinding } : {};
+    if (choice) {
+        const b = choice.body;
+        return {
+            ...base,
+            ...extra,
+            state: "person_choice",
+            authorized: true,
+            choice: {
+                record: choice.id,
+                provider: String(b.provider),
+                by: { person_id: choice.actor.person_id, name: choice.actor.name },
+                at: choice.created_at,
+                version: Number(b.version),
+                content_hash: String(b.content_hash),
+                ...(choice.actor.client_id ? { via: choice.actor.client_id } : {}),
+            },
+            explanation: `${choice.actor.name} chose Codex for this mission (version ${version}) on its approval page at ${choice.created_at}. The choice covers this mission only.`,
+        };
+    }
+    if (!isPersonId(record.actor.person_id)) {
+        return {
+            ...base,
+            ...extra,
+            state: "needs_person_choice",
+            authorized: false,
+            explanation: `The request names Codex and was made with a service token (${record.actor.name}). Only a person chooses Codex, for a request of their own, so this request cannot run Codex. Name another provider.`,
+        };
+    }
+    return {
+        ...base,
+        ...extra,
+        state: "needs_person_choice",
+        authorized: false,
+        explanation: `The request names Codex${requester.client ? `, asked through ${requester.client}` : ""}. Codex runs only when ${record.actor.name} chooses it for this mission on its approval page; approving the request, on the page or on a card, does not choose it. Name another provider to run without that step.`,
+    };
+}
+/** The authorization as the brief carries it to the factory runner: attributes it checks before launching. */
+export function briefAttributes(a) {
+    if (!needsPersonChoice(a.provider))
+        return {};
+    if (a.state === "person_choice" && a.choice)
+        return { provider_authorization: "person_choice", provider_choice: a.choice.record };
+    if (a.state === "policy_selectable" && a.policy.record)
+        return { provider_authorization: "policy_selectable", provider_policy: a.policy.record };
+    return {};
+}
+/** The authorization as a receipt keeps it: no body text, only who, what and which record. */
+export function authorizationReceipt(a) {
+    return {
+        state: a.state,
+        authorized: a.authorized,
+        provider: a.provider,
+        requested: a.requested,
+        requester: a.requester,
+        policy: a.policy,
+        ...(a.choice ? { choice: a.choice } : {}),
+    };
+}

package/dist/providers.d.ts

@@ -8,7 +8,11 @@ export interface ProviderSpec {
     /** Config paths whose existence suggests a sign-in; contents are never read. */
     auth_evidence: string[];
 }
-/** Preference order when a run request names no provider (jgwill/Miadi#893). */
+/**
+ * Preference order when a run request names no provider (jgwill/Miadi#893). Codex is never
+ * picked by default: a request names it, and it runs only on the requester's own choice for
+ * that mission or their own policy (provider-policy.ts, jgwill/Miadi#926).
+ */
 export declare const PROVIDERS: ProviderSpec[];
 export interface ProviderAvailability {
     id: ProviderId;
@@ -38,8 +42,8 @@ export type ProviderResolution = {
 /**
  * Resolve the provider a run will ask the intake for. A requested provider must
  * be known and installed; with no request the first installed provider in the
- * preference order that may be selected by default wins — Claude Code only ever
- * by an explicit request.
+ * preference order that may be selected by default wins. Codex and Claude Code
+ * only ever by name; whether a named Codex may run is provider-policy.ts's answer.
  */
 export declare function resolveProvider(requested: string | undefined, found: ProviderAvailability[]): ProviderResolution;
 /**

package/dist/providers.js

@@ -4,9 +4,11 @@
  * The connector never assumes a provider works because a task text names one:
  * it reports what is installed on this host, what sign-in evidence exists (the
  * presence of the provider's own config directory — never its contents), and
- * applies an explicit preference order. Claude Code is never selected silently:
- * it requires an explicit request. When nothing safe is configured the answer
- * is `provider_unavailable` and the mission is left unstarted.
+ * applies an explicit preference order. Codex and Claude Code are never selected
+ * silently: each requires the request to name it, and Codex also needs the
+ * requester's own choice for that mission (provider-policy.ts, jgwill/Miadi#926).
+ * When nothing safe is configured the answer is `provider_unavailable` and the
+ * mission is left unstarted.
  *
  * No bearer token is read, logged or returned here. Version probes run the
  * provider's own `--version` with a short timeout.
@@ -15,9 +17,13 @@ import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-/** Preference order when a run request names no provider (jgwill/Miadi#893). */
+/**
+ * Preference order when a run request names no provider (jgwill/Miadi#893). Codex is never
+ * picked by default: a request names it, and it runs only on the requester's own choice for
+ * that mission or their own policy (provider-policy.ts, jgwill/Miadi#926).
+ */
 export const PROVIDERS = [
-    { id: "codex", cli: "codex", name: "Codex CLI", selectable_by_default: true, auth_evidence: [".codex"] },
+    { id: "codex", cli: "codex", name: "Codex CLI", selectable_by_default: false, auth_evidence: [".codex"] },
     { id: "pi", cli: "pi", name: "Pi coding agent", selectable_by_default: true, auth_evidence: [".pi", ".config/pi"] },
     { id: "copilot", cli: "copilot", name: "GitHub Copilot CLI", selectable_by_default: true, auth_evidence: [".copilot"] },
     { id: "claude", cli: "claude", name: "Claude Code", selectable_by_default: false, auth_evidence: [".claude"] },
@@ -59,8 +65,8 @@ export function discoverProviders(probe = {}, specs = PROVIDERS) {
 /**
  * Resolve the provider a run will ask the intake for. A requested provider must
  * be known and installed; with no request the first installed provider in the
- * preference order that may be selected by default wins — Claude Code only ever
- * by an explicit request.
+ * preference order that may be selected by default wins. Codex and Claude Code
+ * only ever by name; whether a named Codex may run is provider-policy.ts's answer.
  */
 export function resolveProvider(requested, found) {
     const installed = found.filter((p) => p.installed);

package/dist/queue-state.js

@@ -1,5 +1,5 @@
 /** Shared, read-only factory queue evidence for every request-state surface. */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 export function factoryDir(env = process.env) {
     // The factory's data folder, beside the connector's own /srv/miadi/connector: never a home directory (jgwill/Miadi#911).
@@ -18,6 +18,17 @@ export function readQueueState(record, dir = factoryDir()) {
         return { state: "delivered", file };
     if (existsSync(join(queue, "cancelled", file)))
         return { state: "cancelled", file };
+    if (existsSync(join(queue, "refused", file))) {
+        // The factory runner would not launch its provider (jgwill/Miadi#926): the reason it wrote beside the brief.
+        let why = "";
+        try {
+            why = readFileSync(join(queue, "refused", `${file}.why`), "utf8").trim().slice(0, 500);
+        }
+        catch {
+            /* no reason written */
+        }
+        return { state: "refused", file, note: `The factory runner refused to launch it${why ? `: ${why}` : "."}` };
+    }
     if (existsSync(join(queue, "stale", file)))
         return { state: "stale", file, note: "Its seat did not take it in time; the intake moved it aside." };
     return { state: record.approval_state === "approved" ? "missing" : "not_queued", file };

package/dist/reading/adapters.d.ts

@@ -0,0 +1,18 @@
+import { type ReadingScope } from "./contract.js";
+import type { ReadingAdapters, ReviewBase } from "./workflow.js";
+export declare function reviewAdapter(baseUrl: string, token: string | undefined, fetchImpl?: typeof fetch): {
+    lookup(video: string): Promise<ReviewBase | null>;
+    readExact: (id: string, version: number) => Promise<ReviewBase>;
+    atomicImport: boolean;
+    /** Future v0 contract; enable only from an authenticated live handshake, never a caller flag. */
+    discoverAtomicImport(): Promise<boolean>;
+    importExact(input: Parameters<ReadingAdapters["importExact"]>[0]): Promise<{
+        id: any;
+        version: any;
+    }>;
+    storeTranscript(id: string, text: string): Promise<any>;
+};
+/** Public literature GETs only: allowlisted HTTPS hosts, no credentials, redirects or private IPs. */
+export declare function literatureVerifier(hosts: string[], fetchImpl?: typeof fetch): ReadingAdapters["verifySource"];
+/** Human-readable factory task; its scope is data in the approved record, never shell interpolation. */
+export declare function readingTask(scope: ReadingScope): string;

package/dist/reading/adapters.js

@@ -0,0 +1,90 @@
+/** The real service adapter deliberately refuses the legacy unconditional import endpoint. */
+import { ReviewClient, reviewIdOf } from "../reviews.js";
+import { block, canonicalVideo } from "./contract.js";
+export function reviewAdapter(baseUrl, token, fetchImpl = fetch) {
+    const client = new ReviewClient(baseUrl, token, fetchImpl);
+    const request = async (path, init = {}) => {
+        const res = await fetchImpl(`${baseUrl}${path}`, { ...init, redirect: "error", signal: AbortSignal.timeout(30000), headers: { accept: "application/json", ...(token ? { authorization: `Bearer ${token}` } : {}), ...init.headers } });
+        if (res.status === 401 || res.status === 403)
+            block("blocked_permission", "Refresh the review service credential in its configured environment; do not paste it into chat.");
+        if (res.status === 409 || res.status === 412)
+            block("blocked_permission", "The review changed after staging. Rebase and obtain approval for a new candidate.");
+        if (!res.ok)
+            block("failed_retryable", `Review service answered ${res.status}; retry the same operation key after recovery.`);
+        return res.json();
+    };
+    const readExact = async (id, version) => {
+        if (reviewIdOf(id) !== id)
+            block("blocked_permission", "Review service returned an invalid review id.");
+        const body = await client.get(id, version);
+        if (!body || body.version?.version !== version)
+            block("failed_retryable", "Pinned review version is unavailable; fallback-to-latest is refused.");
+        const raw = await fetchImpl(`${baseUrl}/review/${id}/raw?v=${version}`, { redirect: "error", signal: AbortSignal.timeout(30000) });
+        if (!raw.ok)
+            block("failed_retryable", "Pinned raw Markdown could not be read.");
+        const markdown = await raw.text();
+        if (markdown !== body.version.markdown)
+            block("failed_retryable", "Raw and JSON Markdown differ; inspect the service before importing.");
+        return { id, version, markdown, video_id: canonicalVideo(body.video_id) };
+    };
+    return {
+        async lookup(video) {
+            if (!token)
+                block("blocked_permission", "Configure the review search token on the host before generating a potentially duplicate V1.");
+            const response = await request(`/api/reviews/search?${new URLSearchParams({ q: canonicalVideo(video), limit: "100" })}`);
+            const rows = response.reviews ?? response.results;
+            if (!Array.isArray(rows))
+                block("failed_retryable", "Review search returned malformed data; do not infer that no review exists.");
+            const matches = rows.filter(r => r.video_id === video);
+            if (matches.length > 1)
+                block("blocked_permission", "Multiple reviews exist for this video; the author must select the base.");
+            if (!matches.length)
+                return null;
+            if (!matches[0].latest_version)
+                block("failed_retryable", "Existing review is pending generation; no duplicate V1 will be generated.");
+            return readExact(matches[0].id, matches[0].latest_version);
+        },
+        readExact,
+        atomicImport: false,
+        /** Future v0 contract; enable only from an authenticated live handshake, never a caller flag. */
+        async discoverAtomicImport() {
+            const res = await fetchImpl(`${baseUrl}/api/reviews/capabilities`, { redirect: "error", signal: AbortSignal.timeout(15000), headers: token ? { authorization: `Bearer ${token}` } : {} });
+            if (!res.ok)
+                return false;
+            const c = await res.json();
+            return c.conditional_import === "sha256-cas-v1" && c.idempotency === "durable-transactional-v1" && c.publication === "explicit";
+        },
+        async importExact(input) {
+            // Kept on the real /import path, with a negotiated extension. Never send a legacy write.
+            if (!await this.discoverAtomicImport())
+                block("blocked_permission", "Atomic import is not implemented by the review service. Apply the v0 prompt first.");
+            const result = await request("/api/reviews/import", { method: "POST", headers: { "content-type": "application/json", "idempotency-key": input.idempotency_key }, body: JSON.stringify({ url: `https://youtu.be/${input.video_id}`, markdown: input.markdown, review_id: input.review_id, expected_version: input.expected_version, expected_sha256: input.expected_sha256, sha256: input.sha256, public_release: true, contract: "sha256-cas-v1" }) });
+            return { id: result.id, version: result.version };
+        },
+        async storeTranscript(id, text) {
+            // No generation-on-empty, trimming, or overwrite. Connector source-part remains canonical.
+            if (!text.trim() || reviewIdOf(id) !== id)
+                block("blocked_transcript", "An existing review id and nonempty exact transcript are required.");
+            return request(`/api/reviews/${id}/transcript`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ transcript: text, overwrite: false }) });
+        },
+    };
+}
+/** Public literature GETs only: allowlisted HTTPS hosts, no credentials, redirects or private IPs. */
+export function literatureVerifier(hosts, fetchImpl = fetch) {
+    return async (source) => {
+        const u = new URL(source.url);
+        if (u.protocol !== "https:" || u.username || u.password || u.port || !hosts.includes(u.hostname) || /^[\d.]+$/.test(u.hostname) || u.hostname.includes(":"))
+            block("blocked_citations", "Literature source is outside the host's public-source allowlist.");
+        const res = await fetchImpl(u, { redirect: "error", signal: AbortSignal.timeout(15000), headers: { accept: "text/plain, text/html, application/json" } });
+        if (!res.ok)
+            block("blocked_citations", "Public source could not be retrieved; no citation was marked verified.");
+        const text = await res.text();
+        if (Buffer.byteLength(text) > 2 * 1024 * 1024)
+            block("blocked_citations", "Public source exceeds the bounded verification size.");
+        return { url: source.url, text: text.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<[^>]+>/g, " "), fetched_at: new Date().toISOString() };
+    };
+}
+/** Human-readable factory task; its scope is data in the approved record, never shell interpolation. */
+export function readingTask(scope) {
+    return `Run the bounded transcript-first reading worker for THIS approved connector record:\nnode packages/connector/scripts/reading.mjs run <this-run-request-id>\nThe typed reading grant in this record is the only processing authority. Read packages/connector/scripts/READING.md.\nReturn stage receipts and staged V1/V2/V3 with hashes, insertion diff and provenance. Stop at editorial approval. No public import, Deep Diver, Chronicle, paid fallback or media upload beyond the grant.\nKind: ${scope.kind}; language: ${scope.language}; total provider ceiling USD ${scope.max_cost_usd}. Missing capabilities are explicit blockers, never permission to generate from memory.`;
+}