@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/dist/senses/telegram-attachments.js

@@ -0,0 +1,186 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_TELEGRAM_ATTACHMENT_BYTES = void 0;
+exports.ingestTelegramAttachments = ingestTelegramAttachments;
+const fs = __importStar(require("node:fs/promises"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const store_1 = require("../heart/attachments/store");
+const store_2 = require("../heart/attachments/store");
+const originals_1 = require("../heart/attachments/originals");
+const originals_2 = require("../heart/attachments/originals");
+const telegram_1 = require("../heart/attachments/sources/telegram");
+const runtime_1 = require("../nerves/runtime");
+exports.MAX_TELEGRAM_ATTACHMENT_BYTES = 20_000_000;
+const MAX_TELEGRAM_ATTACHMENTS_PER_MESSAGE = 8;
+const SAFE_FILE_PATH = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]{1,512}$/u;
+async function readBounded(response, limit) {
+    const advertised = Number(response.headers.get("content-length"));
+    if (Number.isFinite(advertised) && advertised > limit)
+        throw new Error("advertised size exceeds limit");
+    if (!response.body)
+        throw new Error("empty response body");
+    const chunks = [];
+    let total = 0;
+    const reader = response.body.getReader();
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > limit)
+                throw new Error("download exceeds limit");
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+    return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), total);
+}
+async function atomicWrite(filePath, buffer) {
+    const directory = path.dirname(filePath);
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const temporary = `${filePath}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+    let handle;
+    try {
+        handle = await fs.open(temporary, "wx", 0o600);
+        await handle.writeFile(buffer);
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
+        await fs.rename(temporary, filePath);
+        const directoryHandle = await fs.open(directory, "r");
+        try {
+            await directoryHandle.sync();
+        }
+        finally {
+            await directoryHandle.close();
+        }
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+        await fs.unlink(temporary).catch((error) => { if (error.code !== "ENOENT")
+            throw error; });
+    }
+}
+async function ingestTelegramAttachments(input) {
+    const fetchImpl = input.fetch ?? globalThis.fetch;
+    const unique = [...new Map(input.attachments.map((attachment) => [attachment.fileId, attachment])).values()]
+        .slice(0, MAX_TELEGRAM_ATTACHMENTS_PER_MESSAGE);
+    const attachments = [];
+    const notices = [];
+    for (const candidate of unique) {
+        try {
+            if (!/^[A-Za-z0-9_-]{1,512}$/u.test(candidate.fileId))
+                throw new Error("invalid file id");
+            if (candidate.byteCount !== undefined && (!Number.isSafeInteger(candidate.byteCount) || candidate.byteCount < 0 || candidate.byteCount > exports.MAX_TELEGRAM_ATTACHMENT_BYTES))
+                throw new Error("advertised size exceeds limit");
+            const cached = (0, store_2.getRecentAttachment)(input.agentName, `attachment:telegram:${candidate.fileId}`, input.agentRoot);
+            if (cached?.source === "telegram") {
+                const localPath = cached.sourceData.localPath;
+                if (typeof localPath === "string") {
+                    await (0, originals_2.ensureReadableFile)(localPath);
+                    attachments.push(cached);
+                    continue;
+                }
+            }
+            const recoverable = (0, telegram_1.buildTelegramAttachmentRecord)({
+                fileId: candidate.fileId,
+                displayName: candidate.displayName,
+                mimeType: candidate.mimeType,
+                byteCount: candidate.byteCount,
+                localPath: path.resolve(input.agentRoot, "state", "attachments", ".pending", candidate.fileId),
+            });
+            const recoverablePath = (0, originals_1.originalStoragePath)(input.agentRoot, recoverable, recoverable.mimeType);
+            try {
+                const stat = await fs.lstat(recoverablePath);
+                if (!stat.isFile() || stat.size > exports.MAX_TELEGRAM_ATTACHMENT_BYTES)
+                    throw new Error("persisted attachment is invalid");
+                const recovered = (0, store_1.cacheRecentAttachment)(input.agentName, (0, telegram_1.buildTelegramAttachmentRecord)({
+                    fileId: candidate.fileId,
+                    displayName: candidate.displayName,
+                    mimeType: candidate.mimeType,
+                    byteCount: stat.size,
+                    localPath: recoverablePath,
+                }), input.agentRoot);
+                attachments.push(recovered);
+                continue;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            const remote = await input.api.request("getFile", { file_id: candidate.fileId });
+            if (typeof remote.file_path !== "string" || !SAFE_FILE_PATH.test(remote.file_path))
+                throw new Error("invalid remote path");
+            if (remote.file_size !== undefined && (!Number.isSafeInteger(remote.file_size) || remote.file_size < 0 || remote.file_size > exports.MAX_TELEGRAM_ATTACHMENT_BYTES))
+                throw new Error("advertised size exceeds limit");
+            const response = input.downloadFile
+                ? await input.downloadFile(remote.file_path)
+                : input.botToken
+                    ? await fetchImpl(`https://api.telegram.org/file/bot${input.botToken}/${remote.file_path}`, { signal: AbortSignal.timeout(30_000) })
+                    : (() => { throw new Error("attachment transport is unavailable"); })();
+            if (!response.ok)
+                throw new Error(`download failed with HTTP ${response.status}`);
+            const buffer = await readBounded(response, exports.MAX_TELEGRAM_ATTACHMENT_BYTES);
+            const provisional = (0, telegram_1.buildTelegramAttachmentRecord)({
+                fileId: candidate.fileId,
+                displayName: candidate.displayName,
+                mimeType: candidate.mimeType ?? response.headers.get("content-type") ?? undefined,
+                byteCount: buffer.length,
+                localPath: path.resolve(input.agentRoot, "state", "attachments", ".pending", candidate.fileId),
+            });
+            const localPath = (0, originals_1.originalStoragePath)(input.agentRoot, provisional, provisional.mimeType);
+            await atomicWrite(localPath, buffer);
+            const record = (0, store_1.cacheRecentAttachment)(input.agentName, (0, telegram_1.buildTelegramAttachmentRecord)({
+                fileId: candidate.fileId,
+                displayName: candidate.displayName,
+                mimeType: provisional.mimeType,
+                byteCount: buffer.length,
+                localPath,
+            }), input.agentRoot);
+            attachments.push(record);
+            (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.telegram_attachment_ingested", message: "Telegram attachment entered the shared attachment store", meta: { kind: record.kind, byteCount: buffer.length } });
+        }
+        catch (error) {
+            notices.push(`attachment unavailable: ${candidate.displayName}`);
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.telegram_attachment_ingest_error", message: "Telegram attachment ingestion failed", meta: { kind: candidate.kind, reason: error instanceof Error ? error.name : "unknown" } });
+        }
+    }
+    return { attachments, notices };
+}

package/dist/senses/telegram-audit-ledger.js

@@ -0,0 +1,220 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TELEGRAM_ACCEPTANCE_AUDIT_HEAD_RELATIVE_PATH = exports.TELEGRAM_ACCEPTANCE_AUDIT_RELATIVE_PATH = void 0;
+exports.verifyTelegramAuditLedger = verifyTelegramAuditLedger;
+exports.createTelegramAuditLedger = createTelegramAuditLedger;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const redact_1 = require("../nerves/redact");
+const runtime_1 = require("../nerves/runtime");
+const SCHEMA = "sanctuary-telegram-audit-chain-v1";
+const GENESIS_MAC = "0".repeat(64);
+const SHA256 = /^[0-9a-f]{64}$/u;
+const MAX_BYTES = 32 * 1024 * 1024;
+const MAX_ROWS = 100_000;
+const MAX_ROW_BYTES = 64 * 1024;
+const LEVELS = new Set(["debug", "info", "warn", "error"]);
+const ROW_KEYS = ["component", "event", "level", "message", "meta", "previousMac", "rowMac", "schemaVersion", "sequence", "trace_id", "ts"].sort();
+const HEAD_KEYS = ["headMac", "lastMac", "recordCount", "schemaVersion"].sort();
+exports.TELEGRAM_ACCEPTANCE_AUDIT_RELATIVE_PATH = node_path_1.default.join("state", "acceptance", "telegram-audit-chain.ndjson");
+exports.TELEGRAM_ACCEPTANCE_AUDIT_HEAD_RELATIVE_PATH = node_path_1.default.join("state", "acceptance", "telegram-audit-chain.head.json");
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+    }
+    const rendered = JSON.stringify(value);
+    if (rendered === undefined)
+        throw new Error("Telegram audit ledger contains an unsupported value");
+    return rendered;
+}
+function rowMac(identityKey, row) {
+    return (0, node_crypto_1.createHmac)("sha256", identityKey).update(`ouroboros.telegram.audit-row.v1\0${canonicalJson(row)}`, "utf8").digest("hex");
+}
+function headMac(identityKey, recordCount, lastMac) {
+    return (0, node_crypto_1.createHmac)("sha256", identityKey).update(`ouroboros.telegram.audit-head.v1\0${recordCount}\0${lastMac}`, "utf8").digest("hex");
+}
+function canonicalIso(value) {
+    return typeof value === "string" && value.length <= 30 && Number.isFinite(Date.parse(value)) && new Date(Date.parse(value)).toISOString() === value;
+}
+function object(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label} is invalid`);
+    return value;
+}
+function parseJson(raw, label) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`${label} JSON is invalid`, { cause: error });
+    }
+}
+function containsPrivateMaterial(raw, privateValues) {
+    return privateValues.some((value) => value.length >= 5 && raw.includes(value))
+        || /\b\d{5,16}:[A-Za-z0-9_-]{20,}\b/u.test(raw)
+        || /"(?:authorized_?user_?id|authorized_?chat_?id|transport_?user_?id|transport_?chat_?id|user_?id|chat_?id|update_?id|message_?id)"\s*:\s*"?\d{1,20}"?/iu.test(raw);
+}
+function parseHead(raw, identityKey) {
+    if (Buffer.byteLength(raw) > 4 * 1024)
+        throw new Error("Telegram audit head exceeds its bound");
+    const value = object(parseJson(raw, "Telegram audit head"), "Telegram audit head");
+    if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify(HEAD_KEYS)
+        || value.schemaVersion !== SCHEMA
+        || !Number.isSafeInteger(value.recordCount) || Number(value.recordCount) < 0 || Number(value.recordCount) > MAX_ROWS
+        || typeof value.lastMac !== "string" || !SHA256.test(value.lastMac)
+        || typeof value.headMac !== "string" || !SHA256.test(value.headMac)
+        || value.headMac !== headMac(identityKey, Number(value.recordCount), value.lastMac))
+        throw new Error("Telegram audit head MAC is invalid");
+    return value;
+}
+function verifyTelegramAuditLedger(options) {
+    if (Buffer.byteLength(options.ledgerRaw) > MAX_BYTES)
+        throw new Error("Telegram audit ledger exceeds its bound");
+    const lines = options.ledgerRaw.split("\n").filter(Boolean);
+    if (lines.length > MAX_ROWS || lines.some((line) => Buffer.byteLength(line) > MAX_ROW_BYTES))
+        throw new Error("Telegram audit ledger exceeds its bound");
+    const head = parseHead(options.headRaw, options.identityKey);
+    let previousMac = GENESIS_MAC;
+    const events = lines.map((line, index) => {
+        if (containsPrivateMaterial(line, options.privateValues ?? []))
+            throw new Error("Telegram audit ledger contains private material");
+        const value = object(parseJson(line, "Telegram audit ledger row"), "Telegram audit ledger row");
+        if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify(ROW_KEYS)
+            || value.schemaVersion !== SCHEMA || value.sequence !== index + 1 || value.previousMac !== previousMac
+            || !canonicalIso(value.ts) || typeof value.level !== "string" || !LEVELS.has(value.level)
+            || typeof value.event !== "string" || value.event.length < 1 || value.event.length > 256
+            || typeof value.component !== "string" || value.component.length < 1 || value.component.length > 128
+            || typeof value.trace_id !== "string" || value.trace_id.length < 1 || value.trace_id.length > 256
+            || typeof value.message !== "string" || value.message.length > 4_096
+            || !value.meta || typeof value.meta !== "object" || Array.isArray(value.meta)
+            || typeof value.rowMac !== "string" || !SHA256.test(value.rowMac))
+            throw new Error("Telegram audit ledger row is invalid");
+        const unsigned = Object.fromEntries(Object.entries(value).filter(([key]) => key !== "rowMac"));
+        if (value.rowMac !== rowMac(options.identityKey, unsigned))
+            throw new Error("Telegram audit ledger row MAC is invalid");
+        previousMac = value.rowMac;
+        return { event: value.event, at: Date.parse(value.ts), meta: value.meta };
+    });
+    if (head.recordCount !== lines.length || head.lastMac !== previousMac)
+        throw new Error("Telegram audit head does not match the append-only ledger");
+    return events;
+}
+function writeHead(filePath, directory, head) {
+    const temporary = `${filePath}.tmp-${process.pid}-${(0, node_crypto_1.randomUUID)()}`;
+    (0, node_fs_1.writeFileSync)(temporary, `${JSON.stringify(head)}\n`, { flag: "wx", mode: 0o600 });
+    const file = (0, node_fs_1.openSync)(temporary, "r");
+    try {
+        (0, node_fs_1.fsyncSync)(file);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(file);
+    }
+    (0, node_fs_1.renameSync)(temporary, filePath);
+    const directoryHandle = (0, node_fs_1.openSync)(directory, "r");
+    try {
+        (0, node_fs_1.fsyncSync)(directoryHandle);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(directoryHandle);
+    }
+}
+function createTelegramAuditLedger(options) {
+    const directory = node_path_1.default.join(options.root, "state", "acceptance");
+    const ledgerPath = node_path_1.default.join(options.root, exports.TELEGRAM_ACCEPTANCE_AUDIT_RELATIVE_PATH);
+    const headPath = node_path_1.default.join(options.root, exports.TELEGRAM_ACCEPTANCE_AUDIT_HEAD_RELATIVE_PATH);
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+    if ((0, node_fs_1.existsSync)(ledgerPath) !== (0, node_fs_1.existsSync)(headPath))
+        throw new Error("Telegram audit ledger/head presence mismatch");
+    if (!(0, node_fs_1.existsSync)(ledgerPath)) {
+        (0, node_fs_1.writeFileSync)(ledgerPath, "", { flag: "wx", mode: 0o600 });
+        writeHead(headPath, directory, { schemaVersion: SCHEMA, recordCount: 0, lastMac: GENESIS_MAC, headMac: headMac(options.identityKey, 0, GENESIS_MAC) });
+    }
+    let records = verifyTelegramAuditLedger({ ledgerRaw: (0, node_fs_1.readFileSync)(ledgerPath, "utf8"), headRaw: (0, node_fs_1.readFileSync)(headPath, "utf8"), identityKey: options.identityKey, privateValues: options.privateValues });
+    let currentHead = parseHead((0, node_fs_1.readFileSync)(headPath, "utf8"), options.identityKey);
+    const maxBytes = options._maxBytes ?? MAX_BYTES;
+    let failure;
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.telegram_audit_ledger_ready",
+        message: "Telegram acceptance audit ledger is verified",
+        meta: { recordCount: currentHead.recordCount },
+    });
+    return {
+        ledgerPath,
+        headPath,
+        append(event) {
+            if (failure)
+                throw failure;
+            try {
+                const original = JSON.stringify(event);
+                if (containsPrivateMaterial(original, options.privateValues ?? []))
+                    throw new Error("Telegram audit event contains private material");
+                const redacted = JSON.parse((0, redact_1.redactString)(JSON.stringify((0, redact_1.redactLogEntry)(event))));
+                const unsigned = {
+                    schemaVersion: SCHEMA,
+                    sequence: currentHead.recordCount + 1,
+                    previousMac: currentHead.lastMac,
+                    ts: redacted.ts,
+                    level: redacted.level,
+                    event: redacted.event,
+                    component: redacted.component,
+                    trace_id: redacted.trace_id,
+                    message: redacted.message,
+                    meta: redacted.meta,
+                };
+                const row = { ...unsigned, rowMac: rowMac(options.identityKey, unsigned) };
+                const serialized = JSON.stringify(row);
+                if (Buffer.byteLength(serialized) > MAX_ROW_BYTES || currentHead.recordCount >= MAX_ROWS
+                    || Buffer.byteLength((0, node_fs_1.readFileSync)(ledgerPath)) + Buffer.byteLength(serialized) + 1 > maxBytes)
+                    throw new Error("Telegram audit ledger exceeds its bound");
+                (0, node_fs_1.appendFileSync)(ledgerPath, `${serialized}\n`, { encoding: "utf8", mode: 0o600 });
+                const ledgerHandle = (0, node_fs_1.openSync)(ledgerPath, "r");
+                try {
+                    (0, node_fs_1.fsyncSync)(ledgerHandle);
+                }
+                finally {
+                    (0, node_fs_1.closeSync)(ledgerHandle);
+                }
+                currentHead = {
+                    schemaVersion: SCHEMA,
+                    recordCount: row.sequence,
+                    lastMac: row.rowMac,
+                    headMac: headMac(options.identityKey, row.sequence, row.rowMac),
+                };
+                writeHead(headPath, directory, currentHead);
+                records = [...records, { event: row.event, at: Date.parse(row.ts), meta: row.meta }];
+            }
+            catch (error) {
+                failure = error instanceof Error ? error : new Error(String(error));
+                throw failure;
+            }
+        },
+        poison(error) {
+            failure ??= error;
+            throw failure;
+        },
+        assertHealthy() {
+            if (failure)
+                throw failure;
+            records = verifyTelegramAuditLedger({ ledgerRaw: (0, node_fs_1.readFileSync)(ledgerPath, "utf8"), headRaw: (0, node_fs_1.readFileSync)(headPath, "utf8"), identityKey: options.identityKey, privateValues: options.privateValues });
+            currentHead = parseHead((0, node_fs_1.readFileSync)(headPath, "utf8"), options.identityKey);
+        },
+        assertCapacity(additionalRows = 1) {
+            if (!Number.isSafeInteger(additionalRows) || additionalRows < 1)
+                throw new Error("Telegram audit capacity reservation is invalid");
+            if (failure)
+                throw failure;
+            if (currentHead.recordCount + additionalRows > MAX_ROWS
+                || Buffer.byteLength((0, node_fs_1.readFileSync)(ledgerPath)) + additionalRows * (MAX_ROW_BYTES + 1) > maxBytes) {
+                throw new Error("Telegram audit ledger lacks reserved capacity");
+            }
+        },
+    };
+}

package/dist/senses/telegram-authority-transport.js

@@ -0,0 +1,231 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSanctuaryTelegramAuthorityTransport = createSanctuaryTelegramAuthorityTransport;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+const sanctuary_authority_codec_1 = require("../heart/daemon/sanctuary-authority-codec");
+const root_host_approval_port_1 = require("./root-host-approval-port");
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validPollBody(body) {
+    return Object.keys(body).sort().join(",") === "allowed_updates,offset,timeout"
+        && Number.isSafeInteger(body.offset)
+        && body.offset >= 0
+        && body.timeout === 50
+        && Array.isArray(body.allowed_updates)
+        && body.allowed_updates.length === 2
+        && body.allowed_updates[0] === "message"
+        && body.allowed_updates[1] === "callback_query";
+}
+function rawUpdateDigest(update) {
+    return `tgu_${(0, node_crypto_1.createHash)("sha256")
+        .update(`ouroboros.telegram.update.v1\0${JSON.stringify(update)}`, "utf8")
+        .digest("base64url")}`;
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function canonicalTime(value) {
+    if (typeof value !== "string")
+        return false;
+    const instant = new Date(value);
+    return !Number.isNaN(instant.getTime()) && instant.toISOString() === value;
+}
+function verifyObservation(artifact, update, verification) {
+    let payload;
+    try {
+        payload = (0, sanctuary_authority_codec_1.verifyAuthorityPayload)({
+            artifact,
+            expectedDomain: "ouro.sanctuary.telegram-observation.v1",
+            expectedKeyId: verification.expectedKeyId,
+            publicKey: verification.publicKey,
+        });
+    }
+    catch (error) {
+        throw new Error("Sanctuary Telegram authority poll response is invalid", { cause: error });
+    }
+    if (!isObject(payload)
+        || !exactKeys(payload, [
+            "targetHost", "botId", "updateId", "updateClass", "userId", "chatId", "ownerEligible",
+            "messageId", "callbackQueryId", "rawUpdateDigest", "observedAt", "settlement", "nonce", "publicKeyDigest",
+            ...(Object.hasOwn(payload, "deliveryUpdateDigest") ? ["deliveryUpdateDigest"] : []),
+        ])
+        || payload.targetHost !== verification.expectedTargetHost
+        || payload.botId !== verification.expectedBotId
+        || payload.publicKeyDigest !== verification.expectedPublicKeyDigest
+        || payload.updateId !== update.update_id
+        || !["message", "callback"].includes(String(payload.updateClass))
+        || typeof payload.userId !== "string"
+        || typeof payload.chatId !== "string"
+        || typeof payload.ownerEligible !== "boolean"
+        || (payload.messageId !== null && typeof payload.messageId !== "string")
+        || (payload.callbackQueryId !== null && typeof payload.callbackQueryId !== "string")
+        || typeof payload.rawUpdateDigest !== "string"
+        || !/^tgu_[A-Za-z0-9_-]{43}$/u.test(payload.rawUpdateDigest)
+        || (Object.hasOwn(payload, "deliveryUpdateDigest") && typeof payload.deliveryUpdateDigest !== "string")
+        || (payload.deliveryUpdateDigest ?? payload.rawUpdateDigest) !== rawUpdateDigest(update)
+        || !canonicalTime(payload.observedAt)
+        || payload.settlement !== "pending"
+        || typeof payload.nonce !== "string"
+        || !/^[A-Za-z0-9_-]{43}$/u.test(payload.nonce)) {
+        throw new Error("Sanctuary Telegram authority observation payload is invalid");
+    }
+    const callback = update.callback_query;
+    const message = update.message;
+    if ((!callback && !message) || (callback && message) || (callback && (!callback.message || !callback.from)) || (message && !message.from)) {
+        throw new Error("Sanctuary Telegram authority observation update is unsupported");
+    }
+    const updateClass = callback ? "callback" : "message";
+    const userId = String(callback ? callback.from.id : message.from.id);
+    const chatId = String(callback ? callback.message.chat.id : message.chat.id);
+    const messageId = String(callback ? callback.message.message_id : message.message_id);
+    const callbackQueryId = callback ? callback.id : null;
+    if (payload.updateClass !== updateClass
+        || payload.userId !== userId
+        || payload.chatId !== chatId
+        || payload.messageId !== messageId
+        || payload.callbackQueryId !== callbackQueryId
+        || payload.ownerEligible !== (userId === verification.expectedOwnerUserId && chatId === verification.expectedOwnerChatId)) {
+        throw new Error("Sanctuary Telegram authority observation coordinates changed");
+    }
+    return Object.freeze({
+        schemaVersion: 1,
+        observationDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(artifact.domain, payload),
+        targetHost: payload.targetHost,
+        botId: payload.botId,
+        updateId: payload.updateId,
+        updateClass: payload.updateClass,
+        userId: payload.userId,
+        chatId: payload.chatId,
+        ownerEligible: payload.ownerEligible,
+        messageId: payload.messageId,
+        callbackQueryId: payload.callbackQueryId,
+        rawUpdateDigest: payload.rawUpdateDigest,
+        ...(payload.deliveryUpdateDigest ? { deliveryUpdateDigest: payload.deliveryUpdateDigest } : {}),
+        observedAt: payload.observedAt,
+        keyId: artifact.keyId,
+        publicKeyDigest: payload.publicKeyDigest,
+    });
+}
+function createSanctuaryTelegramAuthorityTransport(client, verification) {
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_authority_transport_created", message: "Tokenless Sanctuary Telegram authority transport created" });
+    verification = Object.freeze({ ...verification });
+    const observations = new Map();
+    const metadata = new Map();
+    const callbacks = new Map();
+    let currentObservation = null;
+    let stopped = false;
+    const api = {
+        async request(method, body, signal) {
+            if (signal?.aborted)
+                throw signal.reason;
+            if (stopped)
+                throw new Error("Sanctuary Telegram authority transport is stopped");
+            if (method !== "getUpdates") {
+                return await client.request("telegram.request", {
+                    method,
+                    body,
+                    ...(currentObservation ? {
+                        observation: {
+                            updateId: currentObservation.payload.updateId,
+                            observationDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(currentObservation.domain, currentObservation.payload),
+                        },
+                    } : {}),
+                });
+            }
+            if (!validPollBody(body))
+                throw new Error("Sanctuary Telegram authority poll request is invalid");
+            const result = await client.request("telegram.poll", {});
+            if (result === null)
+                return [];
+            if (!isObject(result)
+                || !isObject(result.observation)
+                || !isObject(result.observation.payload)
+                || !isObject(result.update)
+                || !Number.isSafeInteger(result.update.update_id)
+                || result.observation.payload.updateId !== result.update.update_id) {
+                throw new Error("Sanctuary Telegram authority poll response is invalid");
+            }
+            const update = result.update;
+            const observation = result.observation;
+            const verifiedMetadata = verifyObservation(observation, update, verification);
+            const existing = observations.get(update.update_id);
+            if (existing
+                && (0, sanctuary_authority_codec_1.authorityArtifactDigest)(existing.domain, existing.payload)
+                    !== (0, sanctuary_authority_codec_1.authorityArtifactDigest)(observation.domain, observation.payload)) {
+                throw new Error("Sanctuary Telegram authority observation changed during redelivery");
+            }
+            observations.set(update.update_id, observation);
+            metadata.set(update.update_id, verifiedMetadata);
+            callbacks.set(update.update_id, result.hostCallback);
+            currentObservation = observation;
+            return [update];
+        },
+        stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            client.close();
+        },
+    };
+    const transport = {
+        api,
+        async downloadFile(filePath) {
+            const result = await client.request("telegram.file", { filePath });
+            if (!isObject(result)
+                || typeof result.bodyBase64 !== "string"
+                || (result.contentType !== undefined && typeof result.contentType !== "string")) {
+                throw new Error("Sanctuary Telegram authority file response is invalid");
+            }
+            const body = Buffer.from(result.bodyBase64, "base64");
+            if (body.toString("base64") !== result.bodyBase64 || body.length > 20_000_000) {
+                throw new Error("Sanctuary Telegram authority file response is invalid");
+            }
+            return new Response(body, {
+                headers: result.contentType ? { "content-type": result.contentType } : undefined,
+            });
+        },
+        async admitChat(input) {
+            await client.request("telegram.chat.admit", input);
+        },
+        async revokeChat(input) {
+            await client.request("telegram.chat.revoke", input);
+        },
+        metadataForUpdate(update) {
+            const value = metadata.get(update.update_id);
+            if (!value)
+                return null;
+            if ((value.deliveryUpdateDigest ?? value.rawUpdateDigest) !== rawUpdateDigest(update)) {
+                throw new Error("Sanctuary Telegram authority update changed after verification");
+            }
+            return value;
+        },
+        async settleTransport(update, outcome) {
+            const observation = observations.get(update.update_id);
+            if (!observation)
+                throw new Error("Sanctuary Telegram authority observation is unavailable for settlement");
+            await client.request("telegram.settle", {
+                updateId: update.update_id,
+                observationDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(observation.domain, observation.payload),
+                outcome,
+            });
+            observations.delete(update.update_id);
+            metadata.delete(update.update_id);
+            callbacks.delete(update.update_id);
+            if (currentObservation?.payload.updateId === update.update_id)
+                currentObservation = null;
+        },
+    };
+    transport.hostApproval = (0, root_host_approval_port_1.createRootHostApprovalPort)(client, verification, {
+        current: () => currentObservation ? metadata.get(currentObservation.payload.updateId) : null,
+        lookup: (update) => {
+            const value = transport.metadataForUpdate(update);
+            return value ? { metadata: value, hostCallback: callbacks.get(update.update_id) } : null;
+        },
+        stopped: () => stopped,
+    });
+    return transport;
+}