@mikeargento/bitgraph-mcp 0.5.2 → 0.7.0

package/src/api.ts

@@ -1,170 +0,0 @@
-// Copyright (c) 2024-2026 Argento Computing Inc. Licensed under the MIT License. See LICENSE.
-
-/**
- * @mikeargento/bitgraph-mcp: HTTP client for the hosted BitGraph API.
- *
- * The reads: the batch lookup, the proof detail, the number search. Making a
- * BitGraph goes through the core package's own transport against the same
- * site (its /api/fuse routes), which is what maintains the per-position
- * by-digest index that makes every member of a set discoverable afterward;
- * the one write here is a set/2's member evidence, indexed after the commit.
- */
-
-import { mapConcurrent } from "./encoding.js";
-import type { BatchCheckResponse, ProofDetailResponse, SearchResponse, SetIndexResponse } from "./types.js";
-
-export interface ApiConfig {
-  baseUrl: string;
-  apiKey?: string;
-}
-
-/** Read configuration from the environment at call time (testable via env). */
-export function configFromEnv(): ApiConfig {
-  const baseUrl = (process.env["BITGRAPH_API_URL"] ?? "https://bitgraph.ing").replace(/\/+$/, "");
-  const apiKey = process.env["BITGRAPH_API_KEY"];
-  return apiKey ? { baseUrl, apiKey } : { baseUrl };
-}
-
-/** Matches the batch endpoint's MAX_DIGESTS. */
-export const BATCH_CHECK_LIMIT = 500;
-/** Batch lookups in flight at once: a large folder is many pages. */
-const BATCH_CHECK_CONCURRENCY = 4;
-
-const CHECK_TIMEOUT_MS = 30_000;
-const SET_INDEX_TIMEOUT_MS = 60_000;
-
-export class ApiError extends Error {
-  readonly status: number;
-  readonly retryAfterSec: number | null;
-
-  constructor(status: number, message: string, retryAfterSec: number | null = null) {
-    super(message);
-    this.status = status;
-    this.retryAfterSec = retryAfterSec;
-  }
-}
-
-async function parseError(res: Response): Promise<ApiError> {
-  let message = res.statusText || `HTTP ${res.status}`;
-  try {
-    const body = (await res.json()) as { error?: string };
-    if (typeof body.error === "string" && body.error.length > 0) message = body.error;
-  } catch {
-    /* non-JSON error body */
-  }
-  const retryAfterRaw = res.headers.get("retry-after");
-  const retryAfterSec = retryAfterRaw !== null ? Number.parseInt(retryAfterRaw, 10) : null;
-  return new ApiError(res.status, message, Number.isFinite(retryAfterSec) ? retryAfterSec : null);
-}
-
-/**
- * Redirects are refused everywhere: an Authorization header must never follow
- * one to a different host, and the canonical endpoint serves without them.
- */
-function redirectHint(err: unknown): never {
-  if (err instanceof TypeError && /redirect/i.test(err.message)) {
-    throw new Error(
-      "The BitGraph endpoint redirected. Set BITGRAPH_API_URL to the canonical https://bitgraph.ing (apex, no www)."
-    );
-  }
-  throw err;
-}
-
-async function getJson<T>(config: ApiConfig, path: string, timeoutMs: number): Promise<T> {
-  const res = await fetch(`${config.baseUrl}${path}`, {
-    method: "GET",
-    redirect: "error",
-    signal: AbortSignal.timeout(timeoutMs),
-  }).catch(redirectHint);
-  if (!res.ok) throw await parseError(res);
-  return (await res.json()) as T;
-}
-
-async function postJson<T>(
-  config: ApiConfig,
-  path: string,
-  body: unknown,
-  timeoutMs: number,
-  authenticated: boolean
-): Promise<T> {
-  const headers: Record<string, string> = { "Content-Type": "application/json" };
-  if (authenticated && config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
-  const res = await fetch(`${config.baseUrl}${path}`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(body),
-    redirect: "error",
-    signal: AbortSignal.timeout(timeoutMs),
-  }).catch(redirectHint);
-  if (!res.ok) throw await parseError(res);
-  return (await res.json()) as T;
-}
-
-/**
- * Look up which digests are on record. Input digests must be URL-safe base64;
- * the response is keyed by the exact strings sent. Pages of up to 500, a few
- * in flight at once.
- */
-export async function batchCheck(
-  config: ApiConfig,
-  urlSafeDigests: readonly string[]
-): Promise<BatchCheckResponse> {
-  const chunks: string[][] = [];
-  for (let offset = 0; offset < urlSafeDigests.length; offset += BATCH_CHECK_LIMIT) {
-    chunks.push(urlSafeDigests.slice(offset, offset + BATCH_CHECK_LIMIT));
-  }
-  const pages = await mapConcurrent(chunks, BATCH_CHECK_CONCURRENCY, (chunk) =>
-    postJson<BatchCheckResponse>(config, "/api/proofs/batch", { digests: chunk }, CHECK_TIMEOUT_MS, false)
-  );
-  const merged: BatchCheckResponse = { results: {} };
-  for (const page of pages) Object.assign(merged.results, page.results);
-  return merged;
-}
-
-/** One request's worth of a set/2's member evidence, for the site to index. */
-export interface SetIndexRequest {
-  /** The set proof's artifact digest, URL-safe base64. */
-  setDigest: string;
-  /** The set proof's epoch id, URL-safe base64. */
-  epoch: string;
-  /** The set proof's commit counter. */
-  counter: string;
-  members: unknown[];
-}
-
-/**
- * Index members of a set/2 from their evidence. The site reads the set proof
- * from its own position, binds the root document, and checks every member's
- * path before writing a key; a row that does not bind is rejected, never
- * written.
- */
-export async function indexSetMembers(config: ApiConfig, body: SetIndexRequest): Promise<SetIndexResponse> {
-  return postJson<SetIndexResponse>(config, "/api/fuse/set-index", body, SET_INDEX_TIMEOUT_MS, false);
-}
-
-/** Full detail for one digest: proof, all causal positions, anchor window. */
-export async function getProofDetail(
-  config: ApiConfig,
-  urlSafeDigest: string,
-  counter?: string,
-  urlSafeEpoch?: string
-): Promise<ProofDetailResponse> {
-  const params = new URLSearchParams();
-  if (counter !== undefined) params.set("counter", counter);
-  if (urlSafeEpoch !== undefined) params.set("epoch", urlSafeEpoch);
-  const query = params.size > 0 ? `?${params.toString()}` : "";
-  return getJson<ProofDetailResponse>(
-    config,
-    `/api/proofs/digest/${encodeURIComponent(urlSafeDigest)}${query}`,
-    CHECK_TIMEOUT_MS
-  );
-}
-
-/** Resolve a BitGraph number (or digest string) to a digest via /api/search. */
-export async function search(config: ApiConfig, q: string): Promise<SearchResponse> {
-  return getJson<SearchResponse>(
-    config,
-    `/api/search?q=${encodeURIComponent(q)}`,
-    CHECK_TIMEOUT_MS
-  );
-}

package/src/encoding.ts

@@ -1,72 +0,0 @@
-// Copyright (c) 2024-2026 Argento Computing Inc. Licensed under the MIT License. See LICENSE.
-
-/**
- * @mikeargento/bitgraph-mcp: digest encoding and file hashing.
- *
- * BitGraph uses two base64 forms for the same SHA-256 digest:
- * standard base64 with padding inside proof objects and commit requests,
- * URL-safe unpadded base64 in API lookups, S3 keys, and proof page URLs.
- */
-
-import { createHash } from "node:crypto";
-import { createReadStream } from "node:fs";
-import { stat } from "node:fs/promises";
-
-/** Standard base64 → URL-safe unpadded base64. */
-export function toUrlSafeB64(b64: string): string {
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-
-/**
- * URL-safe base64 → standard base64 with padding.
- * A no-op (apart from re-padding) when the input is already standard base64,
- * so it is safe to call on either form.
- */
-export function fromUrlSafeB64(urlSafe: string): string {
-  let b64 = urlSafe.replace(/-/g, "+").replace(/_/g, "/");
-  while (b64.length % 4 !== 0) b64 += "=";
-  return b64;
-}
-
-/** True if the string plausibly encodes 32 bytes of SHA-256 in either base64 form. */
-export function looksLikeDigest(s: string): boolean {
-  const normalized = fromUrlSafeB64(s.trim());
-  if (!/^[A-Za-z0-9+/]{43}=$/.test(normalized)) return false;
-  return Buffer.from(normalized, "base64").length === 32;
-}
-
-/**
- * SHA-256 of a file's bytes as standard base64.
- * Streams from disk, so file size is not a memory concern. Only this digest
- * ever leaves the machine; file contents are never uploaded.
- */
-export async function sha256FileB64(path: string): Promise<string> {
-  const info = await stat(path);
-  if (!info.isFile()) {
-    throw new Error(`Not a regular file: ${path}`);
-  }
-  const hash = createHash("sha256");
-  for await (const chunk of createReadStream(path)) {
-    hash.update(chunk as Buffer);
-  }
-  return hash.digest("base64");
-}
-
-/** Run an async mapper over items with bounded concurrency, preserving order. */
-export async function mapConcurrent<T, R>(
-  items: readonly T[],
-  concurrency: number,
-  fn: (item: T, index: number) => Promise<R>
-): Promise<R[]> {
-  const results: R[] = new Array(items.length);
-  let next = 0;
-  async function worker(): Promise<void> {
-    while (next < items.length) {
-      const index = next++;
-      results[index] = await fn(items[index] as T, index);
-    }
-  }
-  const workers = Array.from({ length: Math.min(concurrency, items.length) }, () => worker());
-  await Promise.all(workers);
-  return results;
-}

package/src/scan.ts

@@ -1,173 +0,0 @@
-// Copyright (c) 2024-2026 Argento Computing Inc. Licensed under the MIT License. See LICENSE.
-
-/**
- * @mikeargento/bitgraph-mcp: the scan.
- *
- * One pass over each file yields its SHA-256 (the member's origin) and a
- * hasher left open after the placement's prefix and the file's last byte, so
- * the member's fused digest can be finished later, for whatever slot the set
- * is made under, without reading the file again. A placement is prefix,
- * original, suffix (its frame): trailer/1 has no prefix and container/2's is
- * the original's tar header, which depends on the size alone; the suffix
- * carries the commitment and is hashed at BitGraph time. Node's SHA-256 is
- * the platform's own, and a Hash can be copied mid-stream, which is the whole
- * trick: the copy takes the suffix, so no file is read twice or held in
- * memory, and the original is never touched.
- */
-
-import { createHash, type Hash } from "node:crypto";
-import { createReadStream } from "node:fs";
-import { readdir, stat } from "node:fs/promises";
-import { basename, join } from "node:path";
-import { placementForBytes } from "@mikeargento/bitgraph";
-import { getPlacement } from "@mikeargento/bitgraph-verify";
-
-/** The placements the scan makes: chosen from the bytes by the core, never from the name. */
-export type ScanPlacement = "trailer/1" | "container/2";
-
-export interface ScannedFile {
-  path: string;
-  name: string;
-  size: number;
-  /** SHA-256 of the file, standard base64: the member's origin. */
-  digestB64: string;
-  originDigest: Uint8Array;
-  placement: ScanPlacement;
-  /**
-   * The hasher after the placement's prefix and the file's bytes, still open.
-   * Null when the file's length changed while it was read: its fused digest
-   * then needs the bytes again.
-   */
-  state: Hash | null;
-}
-
-/** Bytes the placement decision reads: every magic number sits in the first 16. */
-const SNIFF = 64;
-
-/** Hash one file in a single pass. Throws, before any network call, when the path is not a regular file. */
-export async function scanFile(path: string): Promise<ScannedFile> {
-  const info = await stat(path);
-  if (!info.isFile()) throw new Error(`Not a regular file: ${path}`);
-  const size = info.size;
-  const origin = createHash("sha256");
-  // Held in one object: the closures below assign to it.
-  const run: { fused: Hash | null; placement: ScanPlacement | null } = { fused: null, placement: null };
-  let head: Buffer | null = null;
-  let bytes = 0;
-  const start = (p: ScanPlacement) => {
-    run.placement = p;
-    // A second hasher runs over prefix and bytes when the prefix is not
-    // empty; with an empty prefix the origin hasher's own state is the fused state.
-    const prefix = getPlacement(p)?.scanPrefix?.(size) ?? null;
-    if (prefix !== null && prefix.length > 0) run.fused = createHash("sha256").update(prefix);
-  };
-  const feed = (chunk: Buffer) => {
-    origin.update(chunk);
-    if (run.fused !== null) run.fused.update(chunk);
-  };
-  for await (const raw of createReadStream(path)) {
-    const chunk = raw as Buffer;
-    if (run.placement === null) {
-      head = head === null ? chunk : Buffer.concat([head, chunk]);
-      if (head.length >= SNIFF) {
-        start(placementForBytes(new Uint8Array(head.subarray(0, SNIFF))));
-        feed(head);
-        head = null;
-      }
-    } else {
-      feed(chunk);
-    }
-    bytes += chunk.length;
-  }
-  if (run.placement === null) {
-    // A short file: decide from what there is, then hash it.
-    start(placementForBytes(new Uint8Array(head ?? Buffer.alloc(0))));
-    if (head !== null) feed(head);
-  }
-  const placement = run.placement as ScanPlacement;
-  const state = bytes !== size ? null : (run.fused ?? origin);
-  // When the origin hasher is the state its digest is taken from a copy, so it stays open.
-  const digest = state === origin ? origin.copy().digest() : origin.digest();
-  return {
-    path,
-    name: basename(path),
-    size,
-    digestB64: digest.toString("base64"),
-    originDigest: Uint8Array.from(digest),
-    placement,
-    state,
-  };
-}
-
-/**
- * A member's fused digest for a slot: the open hasher, copied, finished with
- * the placement's suffix for that slot's commitment. The hash of prefix,
- * original, suffix is exactly the hash of the placement's own build, which
- * a test pins.
- */
-export function fusedDigestFor(file: ScannedFile, commitment: Uint8Array): Uint8Array {
-  if (file.state === null) throw new Error(`${file.path}: the file changed while it was read`);
-  const placement = getPlacement(file.placement);
-  if (placement?.frame === undefined) throw new Error(`placement ${file.placement} has no frame`);
-  const { suffix } = placement.frame({ originalSize: file.size, originDigest: file.originDigest, commitment });
-  return Uint8Array.from(file.state.copy().update(suffix).digest());
-}
-
-export interface Expansion {
-  /** Regular files in the order given; a directory contributes its files sorted by name, depth first. */
-  files: string[];
-  /** How many of the inputs were directories. */
-  directories: number;
-}
-
-/**
- * Paths to files: a regular file is itself; a directory is every regular
- * file under it, recursively, with hidden entries (names starting with a
- * dot) and symbolic links left out. The same file twice is one file. A path
- * that is missing or neither kind, or more than `limit` files in all, throws
- * before any network call; the message names every path that failed.
- */
-export async function expandPaths(paths: readonly string[], limit: number): Promise<Expansion> {
-  const files: string[] = [];
-  const seen = new Set<string>();
-  const failures: string[] = [];
-  let directories = 0;
-  const push = (p: string) => {
-    if (seen.has(p)) return;
-    seen.add(p);
-    files.push(p);
-    if (files.length > limit) throw new Error(`more than ${limit} files; BitGraph fewer at a time`);
-  };
-  const walk = async (dir: string): Promise<void> => {
-    const entries = (await readdir(dir, { withFileTypes: true }))
-      .filter((e) => !e.name.startsWith("."))
-      .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-    for (const e of entries) {
-      const full = join(dir, e.name);
-      if (e.isSymbolicLink()) continue;
-      if (e.isDirectory()) await walk(full);
-      else if (e.isFile()) push(full);
-    }
-  };
-  for (const p of paths) {
-    try {
-      const info = await stat(p);
-      if (info.isDirectory()) {
-        directories += 1;
-        await walk(p);
-      } else if (info.isFile()) {
-        push(p);
-      } else {
-        throw new Error("not a regular file or a directory");
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (message.startsWith("more than ")) throw err;
-      failures.push(`${p}: ${message}`);
-    }
-  }
-  if (failures.length > 0) {
-    throw new Error(`Could not read ${failures.length} path(s); nothing was BitGraphed.\n${failures.join("\n")}\nUse absolute paths to existing regular files or directories.`);
-  }
-  return { files, directories };
-}

package/src/task.ts

@@ -1,187 +0,0 @@
-// Copyright (c) 2024-2026 Argento Computing Inc. Licensed under the MIT License. See LICENSE.
-
-/**
- * A position BEFORE the work: the task form of the stdio server.
- *
- * bitgraph_open with no files asks the site's own /api/fuse/allocate for a
- * slot and returns its commitment, and nothing else. The caller puts the
- * commitment into the task it is about to run (the prompt, the request, a
- * seed, a line in the document) and, within the slot's life, commits the
- * digest of those task bytes under the slot with the inline marker
- * (bitgraph-fuse/1, title base64url): a verifier recomputes the commitment
- * from the slot record and finds its base64url text inside the bytes.
- * Outputs are recorded afterwards with bitgraph_record and sit later.
- *
- * The slot allocation and the commit go through the same two site routes
- * the core package's fuse() uses; the recovery rule is the core's (read back
- * by digest, refuse a proof under any other slot).
- */
-import { readFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { bytesToBase64, computeSlotCommitment, findCommitment, inlineAttribution, verifyProofIntegrity, ENCODING_BASE64URL } from "@mikeargento/bitgraph-verify";
-import type { BitGraphProof, SlotAllocation } from "@mikeargento/bitgraph-verify";
-import { ApiError, type ApiConfig } from "./api.js";
-import { toUrlSafeB64 } from "./encoding.js";
-
-export const SLOT_TTL_SECONDS = 120;
-const CHAIN = "bitgraph:main";
-const B64_32 = /^[A-Za-z0-9+/]{43}=$/;
-const B64_64 = /^[A-Za-z0-9+/]{86}==$/;
-
-export interface TaskState {
-  v: 1;
-  task: true;
-  slot: SlotAllocation;
-}
-
-function isSlotRecord(x: unknown): x is SlotAllocation {
-  if (x === null || typeof x !== "object" || Array.isArray(x)) return false;
-  const s = x as Record<string, unknown>;
-  return s.version === "bitgraph/slot/1" && typeof s.nonceB64 === "string" && B64_32.test(s.nonceB64) && typeof s.counter === "string" && /^(0|[1-9][0-9]*)$/.test(s.counter)
-    && typeof s.epochId === "string" && typeof s.publicKeyB64 === "string" && typeof s.signatureB64 === "string" && B64_64.test(s.signatureB64) && s.chainId === CHAIN;
-}
-
-export function encodeTaskToken(state: TaskState): string {
-  return Buffer.from(JSON.stringify(state), "utf8").toString("base64url");
-}
-
-export function decodeTaskToken(token: string): TaskState | null {
-  let parsed: unknown;
-  try { parsed = JSON.parse(Buffer.from(token, "base64url").toString("utf8")); } catch { return null; }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const s = parsed as Record<string, unknown>;
-  if (s.v !== 1 || s.task !== true || !isSlotRecord(s.slot)) return null;
-  return { v: 1, task: true, slot: s.slot };
-}
-
-async function post(config: ApiConfig, path: string, body: unknown, timeoutMs: number): Promise<{ status: number; json: unknown; retryAfterSec: number | null }> {
-  const headers: Record<string, string> = { "content-type": "application/json", accept: "application/json" };
-  if (config.apiKey) headers["authorization"] = `Bearer ${config.apiKey}`;
-  const res = await fetch(`${config.baseUrl}${path}`, { method: "POST", headers, body: JSON.stringify(body), signal: AbortSignal.timeout(timeoutMs) });
-  let json: unknown = null;
-  try { json = await res.json(); } catch { /* non-JSON */ }
-  const raw = res.headers.get("retry-after");
-  const retry = raw !== null ? Number.parseInt(raw, 10) : NaN;
-  return { status: res.status, json, retryAfterSec: Number.isFinite(retry) ? retry : null };
-}
-
-const messageOf = (json: unknown, fallback: string): string => {
-  const e = (json as { error?: unknown } | null)?.error;
-  return typeof e === "string" ? e : fallback;
-};
-
-export interface Begun {
-  token: string;
-  /** Unpadded base64url: the string to put into the task. */
-  commitment: string;
-  commitmentB64: string;
-  slotCounter: string;
-  epoch: string;
-  floor: { block: number } | null;
-}
-
-/** Step one of the task form: a held slot and its commitment, before any work exists. */
-export async function beginTask(config: ApiConfig): Promise<Begun> {
-  const r = await post(config, "/api/fuse/allocate", {}, 20_000);
-  if (r.status !== 200) throw new ApiError(r.status, messageOf(r.json, `allocation refused (${r.status})`), r.retryAfterSec);
-  const slot = (r.json as { slot?: unknown } | null)?.slot;
-  if (!isSlotRecord(slot)) throw new ApiError(502, "the allocation response is not a slot record on bitgraph:main");
-  const commitmentB64 = bytesToBase64(computeSlotCommitment(slot));
-  let floor: Begun["floor"] = null;
-  try {
-    const res = await fetch(`${config.baseUrl}/api/proofs/anchors?counter=${encodeURIComponent(slot.counter)}&epoch=${encodeURIComponent(slot.epochId)}&before=1`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10_000) });
-    const data = res.status === 200 ? ((await res.json()) as { anchors?: Array<{ commit?: { anchor?: { blockNumber?: number } } }> }) : null;
-    const b = data?.anchors?.[0]?.commit?.anchor?.blockNumber;
-    if (typeof b === "number") floor = { block: b };
-  } catch { floor = null; }
-  return { token: encodeTaskToken({ v: 1, task: true, slot }), commitment: toUrlSafeB64(commitmentB64), commitmentB64, slotCounter: slot.counter, epoch: toUrlSafeB64(slot.epochId), floor };
-}
-
-export interface SealedTask {
-  proof: BitGraphProof;
-  artifactDigestB64: string;
-  /** Byte offsets of the commitment string inside the task bytes, when the bytes were given. */
-  offsets: number[] | null;
-}
-
-/**
- * Step two: the task bytes (a path, or the bytes themselves) sealed under
- * the held slot with the inline marker. When the bytes are in hand the
- * commitment is looked for BEFORE the commit, so a task that does not carry
- * it is refused without spending the slot.
- */
-export async function sealTask(config: ApiConfig, state: TaskState, task: { path: string } | { bytes: Uint8Array } | { digestB64: string }): Promise<SealedTask> {
-  const { slot } = state;
-  const commitment = computeSlotCommitment(slot);
-  let bytes: Uint8Array | null = null;
-  let artifactDigestB64: string;
-  if ("digestB64" in task) {
-    if (!B64_32.test(task.digestB64)) throw new ApiError(400, "artifact digest must be a base64 SHA-256");
-    artifactDigestB64 = task.digestB64;
-  } else {
-    bytes = "path" in task ? new Uint8Array(await readFile(task.path)) : task.bytes;
-    artifactDigestB64 = createHash("sha256").update(bytes).digest("base64");
-  }
-  const offsets = bytes === null ? null : findCommitment(bytes, commitment, ENCODING_BASE64URL);
-  if (offsets !== null && offsets.length === 0) {
-    throw new ApiError(400, `the task bytes do not contain the commitment string ${toUrlSafeB64(bytesToBase64(commitment))}; put it in before sealing. Nothing was committed and the slot is still held.`);
-  }
-  const attribution = inlineAttribution();
-  const r = await post(config, "/api/fuse/commit", { digests: [{ digestB64: artifactDigestB64, hashAlg: "sha256" }], slotId: slot.nonceB64, slot, chainId: CHAIN, attribution }, 40_000);
-  let proof: BitGraphProof | null = null;
-  if (r.status === 200) proof = ((r.json as { proof?: BitGraphProof } | null)?.proof ?? null);
-  else if (r.status === 409 || r.status === 503) proof = await recover(config, artifactDigestB64, slot);
-  if (proof === null) throw new ApiError(r.status, messageOf(r.json, `commit refused (${r.status})`), r.retryAfterSec);
-  if (proof.artifact?.digestB64 !== artifactDigestB64 || proof.commit?.nonceB64 !== slot.nonceB64 || proof.slotAllocation?.nonceB64 !== slot.nonceB64) throw new ApiError(502, "the boundary returned a proof under a different slot; nothing is labelled sealed");
-  const a = proof.attribution;
-  if (a?.name !== attribution.name || a?.title !== attribution.title || a?.message !== undefined) throw new ApiError(502, "the returned proof does not carry the inline marker that was sent; nothing is labelled sealed");
-  const integrity = await verifyProofIntegrity({ proof });
-  if (!integrity.valid) throw new ApiError(502, `the returned proof does not verify: ${integrity.reason ?? "unknown reason"}`);
-  return { proof, artifactDigestB64, offsets };
-}
-
-async function recover(config: ApiConfig, artifactDigestB64: string, slot: SlotAllocation): Promise<BitGraphProof | null> {
-  for (let attempt = 0; attempt < 4; attempt++) {
-    if (attempt > 0) await new Promise((r) => setTimeout(r, 1500));
-    try {
-      const res = await fetch(`${config.baseUrl}/api/proofs/${encodeURIComponent(toUrlSafeB64(artifactDigestB64))}`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(15_000) });
-      if (res.status !== 200) continue;
-      const j = (await res.json()) as { proofs?: Array<{ proof?: BitGraphProof }> } | null;
-      for (const e of j?.proofs ?? []) {
-        const p = e.proof;
-        if (p && p.artifact?.digestB64 === artifactDigestB64 && p.commit?.nonceB64 === slot.nonceB64) return p;
-      }
-    } catch { /* try again */ }
-  }
-  return null;
-}
-
-export const TASK_INSTRUCTIONS =
-  "You hold a position and its commitment, and no work exists yet. Put the commitment string INSIDE THE OUTPUT you are about to make whenever its format can hold text (SVG, HTML, code, JSON, Markdown, CSV, a document): as a comment, a field, a line that stays in the file. " +
-  `When the output exists, call bitgraph_commit with this fuse_token and the output file's path, within ${SLOT_TTL_SECONDS} seconds of opening: the output itself is sealed under the position, and the proof is written beside it. ` +
-  "If the output cannot hold text (a PNG, audio, video) or will take longer than that to make, put the commitment into a task file instead (the exact prompt or request you send), seal that file the same way, and when the output exists record it with bitgraph_record: the task is sealed before the output existed, and the output is recorded after. " +
-  "Keep the exact bytes that were sealed unchanged: a verifier recomputes the commitment from the proof and looks for the string inside them. " +
-  "Leave the proof file as written, whole, every field, environment.attestation.reportB64 included: a proof missing slotAllocation, environment, or the attestation cannot be verified.";
-
-/**
- * Write a sealed task's proof beside the file it is about, whole, and say
- * where. `make_task.txt` gets `make_task.proof.json`; a name already taken
- * gets the position's counter in it rather than being overwritten.
- *
- * ⚠️ THE SERVER WRITES IT, NOT THE AGENT. Handed the JSON to save, an agent
- * tidied it and dropped slotAllocation and environment, and the signature
- * had no body left to be checked against (Grok, 2026-09-13). A file this
- * process writes is the proof exactly as the boundary returned it.
- */
-export async function writeProofBeside(sealedPath: string, proof: BitGraphProof): Promise<string> {
-  const { writeFile, access } = await import("node:fs/promises");
-  const { basename, dirname, extname, join } = await import("node:path");
-  const dir = dirname(sealedPath);
-  const base = basename(sealedPath);
-  const stem = extname(base) === "" ? base : base.slice(0, -extname(base).length);
-  const counter = proof.commit?.counter ?? "0";
-  let target = join(dir, `${stem}.proof.json`);
-  if (await access(target).then(() => true).catch(() => false)) target = join(dir, `${stem}.proof.${counter}.json`);
-  await writeFile(target, JSON.stringify(proof, null, 2) + "\n", { flag: "wx" });
-  return target;
-}