@reclaimprotocol/agent 0.1.35 → 0.1.37

package/src/mcp/tools/verification/proxy-callback-events.ts

@@ -17,6 +17,12 @@ const POLL_MS = 2_000
 const MAX_BACKOFF_MS = 30_000
 const FORWARD_TIMEOUT_MS = 10_000
 const BATCH = 50
+/**
+ * Pages read per poll. A page is `BATCH` events, so a poll can look past up to
+ * 500 pending events. That is enough to reach other sessions behind several
+ * held ones, and still bounds the work of one poll.
+ */
+const MAX_PAGES = 10
 const RECENT = 10
 /** Loopback addresses, in the order tried. Dev servers often bind only one. */
 const HOSTS = ['127.0.0.1', '[::1]']
@@ -42,7 +48,25 @@ type Recent = {
 	at: string
 }
 
+/** A session whose oldest pending event the app has not accepted. */
+type Blocked = {
+	sessionId: string
+	event: string
+	eventId: string
+	httpStatus?: number
+	attempts: number
+	lastError?: string
+	/** When the first attempt failed, as an ISO timestamp. */
+	since: string
+}
+
+type Held = { blocked: Blocked, retryAt: number, delay: number }
+
+type Outcome = { ok: true } | { ok: false, httpStatus?: number, error: string }
+
 export interface ProxyDeps extends CallbackDeps {
+	/** The clock, in milliseconds. Defaults to `Date.now`. */
+	now?: () => number
 	/** Delivers an event to the app. Defaults to global `fetch`. */
 	forwardFetch?: typeof globalThis.fetch
 	/** Waits between polls. Resolves early, without error, on abort. */
@@ -53,9 +77,13 @@ export interface ProxyDeps extends CallbackDeps {
 /**
  * Polls the org's pending pull events and POSTs each envelope to a local
  * route, like `stripe listen --forward-to`. 2xx responses are acknowledged;
- * anything else (redirects included) stays pending and is retried with
- * exponential backoff. After a failure the batch stops, so events reach the
- * app in order.
+ * anything else (redirects included) stays pending.
+ *
+ * Order holds per session. When an event fails, its session is held: its later
+ * events are not sent or acknowledged, and the failed event is retried with
+ * exponential backoff (2 s, 4 s, ... 30 s). Other sessions keep flowing at the
+ * normal poll rate. Held sessions appear in `status().blocked`, and clear when
+ * the app accepts the event.
  */
 class Forwarder {
 	target: Target
@@ -69,6 +97,8 @@ class Forwarder {
 	#recent: Recent[] = []
 	/** Delivered to the app but not yet acknowledged; never POSTed twice. */
 	#unacked = new Set<string>()
+	/** Held sessions by session id, with the time of their next attempt. */
+	#held = new Map<string, Held>()
 	#host = HOSTS[0]
 	#running: Promise<void>
 
@@ -94,6 +124,7 @@ class Forwarder {
 			failed: this.#failed,
 			...(this.#lastError ? { lastError: this.#lastError } : {}),
 			recent: [...this.#recent],
+			blocked: [...this.#held.values()].map((h) => h.blocked),
 		}
 	}
 
@@ -109,9 +140,9 @@ class Forwarder {
 		while(!signal.aborted) {
 			let wait = POLL_MS
 			try {
-				const { ok, count } = await this.#tick()
-				backoff = ok ? 0 : nextBackoff(backoff)
-				wait = ok ? (count >= BATCH ? 0 : POLL_MS) : backoff
+				const more = await this.#tick()
+				backoff = 0
+				wait = more ? 0 : POLL_MS
 			} catch(err) {
 				this.#lastError = err instanceof Error ? err.message : String(err)
 				LOGGER.warn({ err }, 'callback proxy poll failed')
@@ -125,43 +156,113 @@ class Forwarder {
 		}
 	}
 
+	/**
+	 * Forwards one poll's worth of pending events. Returns whether to poll again
+	 * at once: the page limit was hit with events still unread, and progress was
+	 * made (so held sessions alone never cause a busy loop).
+	 */
 	async #tick() {
-		const { data } = await this.#client.call('ListCallbackEvents', {
-			query: { pending: true, limit: BATCH },
-		})
-		const ack: string[] = []
-		let ok = true
-		for(const item of data.items) {
-			if(this.#abort.signal.aborted) {
-				break
-			}
+		const now = (this.#deps.now || Date.now)()
+		// Sessions whose later events are skipped in this poll.
+		const skip = new Set<string>()
+		const seen = new Set<string>()
+		let after: string | undefined
+		let page = 0
+		let full = false
+		let progress = false
+		do {
+			const { data } = await this.#client.call('ListCallbackEvents', {
+				query: { pending: true, limit: BATCH, ...(after ? { after } : {}) },
+			})
+			const ack: string[] = []
+			for(const item of data.items) {
+				if(this.#abort.signal.aborted) {
+					break
+				}
+
+				seen.add(item.sessionId)
+				const held = this.#held.get(item.sessionId)
+				if(
+					skip.has(item.sessionId)
+					|| (held && held.retryAt > now && !this.#unacked.has(item.id))
+				) {
+					skip.add(item.sessionId)
+					continue
+				}
+
+				if(this.#unacked.has(item.id)) {
+					ack.push(item.id)
+					continue
+				}
 
-			if(this.#unacked.has(item.id) || await this.#forward(item)) {
-				ack.push(item.id)
-			} else {
-				// Stop the batch so later events don't overtake the failed one.
-				ok = false
-				break
+				const outcome = await this.#forward(item)
+				if(outcome.ok) {
+					this.#held.delete(item.sessionId)
+					ack.push(item.id)
+				} else {
+					// Hold the session so its later events don't overtake this one.
+					this.#hold(item, outcome, now)
+					skip.add(item.sessionId)
+				}
 			}
-		}
 
-		if(ack.length) {
-			for(const id of ack) {
-				this.#unacked.add(id)
+			if(ack.length) {
+				progress = true
+				for(const id of ack) {
+					this.#unacked.add(id)
+				}
+
+				await this.#client.call('AcknowledgeCallbackEvents', {
+					body: { ids: ack },
+				})
+				for(const id of ack) {
+					this.#unacked.delete(id)
+				}
 			}
 
-			await this.#client.call('AcknowledgeCallbackEvents', {
-				body: { ids: ack },
-			})
-			for(const id of ack) {
-				this.#unacked.delete(id)
+			// `next` skips what this page returned, including held events.
+			after = data.next
+			full = data.items.length >= BATCH
+			page += 1
+		} while(full && page < MAX_PAGES && !this.#abort.signal.aborted)
+
+		if(!full) {
+			// The listing was read to its end: forget sessions with nothing pending.
+			for(const sessionId of this.#held.keys()) {
+				if(!seen.has(sessionId)) {
+					this.#held.delete(sessionId)
+				}
 			}
 		}
 
-		return { ok, count: data.items.length }
+		return full && progress
+	}
+
+	#hold(
+		item: CallbackEvent,
+		outcome: Extract<Outcome, { ok: false }>,
+		now: number,
+	) {
+		const prev = this.#held.get(item.sessionId)
+		const delay = nextBackoff(prev?.delay || 0)
+		this.#held.set(item.sessionId, {
+			blocked: {
+				sessionId: item.sessionId,
+				event: item.event,
+				eventId: item.id,
+				...(outcome.httpStatus === undefined
+					? {}
+					: { httpStatus: outcome.httpStatus }),
+				attempts: (prev?.blocked.attempts || 0) + 1,
+				lastError: outcome.error,
+				since: prev?.blocked.since || new Date(now).toISOString(),
+			},
+			retryAt: now + delay,
+			delay,
+		})
 	}
 
-	async #forward(item: CallbackEvent) {
+	async #forward(item: CallbackEvent): Promise<Outcome> {
 		const doFetch = this.#deps.forwardFetch || globalThis.fetch
 		const record = (status: Recent['status'], httpStatus?: number) => {
 			this.#recent.push({
@@ -191,7 +292,7 @@ class Forwarder {
 				if(res.ok) {
 					this.#forwarded += 1
 					record('delivered', res.status)
-					return true
+					return { ok: true }
 				}
 
 				this.#failed += 1
@@ -201,7 +302,7 @@ class Forwarder {
 						+ 'followed; call again with the redirect target\'s `path`.'
 					: `${url} returned HTTP ${res.status}`
 				record('failed', res.status)
-				return false
+				return { ok: false, httpStatus: res.status, error: this.#lastError }
 			} catch(err) {
 				this.#lastError = err instanceof Error ? err.message : String(err)
 			}
@@ -210,7 +311,7 @@ class Forwarder {
 		// No loopback address accepted the connection.
 		this.#failed += 1
 		record('failed')
-		return false
+		return { ok: false, error: this.#lastError || 'Connection failed' }
 	}
 }
 
@@ -257,17 +358,26 @@ export function proxyCallbackEventsTool(deps: ProxyDeps = {}): RegisteredTool {
 				+ 'to a local route, like `stripe listen --forward-to`. Call it '
 				+ 'when the app\'s callback route runs locally. It POSTs each '
 				+ 'envelope as JSON to `http://127.0.0.1:<port><path>` (loopback '
-				+ 'only; also tries `[::1]`) in order, acknowledges 2xx '
-				+ 'responses, and retries anything else, redirects included, '
-				+ 'with backoff. Creates the listener on first use, so it is not '
+				+ 'only; also tries `[::1]`) and acknowledges 2xx responses. '
+				+ 'Events of one session arrive in order. When the app rejects '
+				+ 'an event, including with a redirect, that session is held and '
+				+ 'retried with backoff (2 s up to 30 s) while other sessions '
+				+ 'keep flowing. Creates the listener on first use, so it is not '
 				+ 'read-only. One forwarder runs per org: call again to read '
 				+ 'status, or with another `port` or `path` to retarget. '
 				+ '`stop: true` stops forwarding only. Forwarding lasts only '
 				+ 'while this MCP server runs; production needs '
 				+ '`create_org_callback_subscription`. Returns `{ forwarding, '
-				+ 'target, listener, forwarded, failed, lastError?, recent }`; '
-				+ '`listener.expiresAt` is the lease end, and `recent` lists the '
-				+ 'last events with `status` and `httpStatus`.',
+				+ 'target, listener, forwarded, failed, lastError?, recent, '
+				+ 'blocked }`. `listener.expiresAt` is the lease end, and '
+				+ '`recent` lists the last events with `status` and '
+				+ '`httpStatus`. `blocked` lists each held session as '
+				+ '`{ sessionId, event, eventId, httpStatus?, attempts, '
+				+ 'lastError?, since }`, and is `[]` when none is held. When '
+				+ '`blocked` is not empty, check the app\'s response and logs '
+				+ 'for that session. The app must return 2xx for a result that '
+				+ 'failed verification, and 5xx only for a temporary error. '
+				+ 'Fix the app, and the session resumes on the next retry.',
 			inputSchema: {
 				type: 'object',
 				properties: {

package/src/old/login-cdp.ts

@@ -1,7 +1,7 @@
 import { connectCdp } from '../cdp/client.ts'
 import {
 	defaultProfileDir,
-	launchChrome,
+	launchLocalBrowser,
 	waitForCdpReady,
 } from '../cdp/launcher.ts'
 import { ConfigStore } from '../config/store.ts'
@@ -160,8 +160,7 @@ export async function captureFirebaseTokenViaCdp(opts: {
 			)
 		}
 
-		launchChrome({ port, profileDir: defaultProfileDir() })
-		await waitForCdpReady(port, 10_000)
+		await launchLocalBrowser({ port, profileDir: defaultProfileDir() })
 		launchedByUs = true
 	}
 

package/src/proof/attestor.ts

@@ -218,9 +218,8 @@ export async function runAttestorProof(
 				verified: false,
 				error:
 					'No eth proof-owner key available (no RECLAIM_PRIVATE_KEY in env, ' +
-					'.env, or RECLAIM_PRIVATE_KEY_FILE). Call resolve_owner_key, then ' +
-					'issue_credentials (generate) or import_credentials (provide one), ' +
-					'and retry run_proof.',
+					'.env, or RECLAIM_PRIVATE_KEY_FILE). Call resolve_owner_key, ' +
+					'which creates a local test key, and retry run_proof.',
 				errorKind: 'missing-owner-key',
 			}
 		}

package/src/proof/check-attestor.ts

@@ -12,7 +12,7 @@ import {
 	parseClaim,
 	resolveAttestorUrl,
 } from './proof-core.ts'
-import { ensureZkFiles } from './zk-files.ts'
+import { ensureZkFiles, type ZkFilesState, zkFilesState } from './zk-files.ts'
 
 /**
  * Default time budget for one check. A live run takes about 8 s; a longer
@@ -63,11 +63,16 @@ const COIN_GECKO_SECRET_HEADERS = {
 }
 
 export type AttestorCheckErrorKind =
-	/** Socket, connection, DNS, TLS, or timeout failure. */
+	/** Socket, connection, DNS, TLS, or timeout failure, with the proof files
+	 *  ready: the attestor itself didn't answer. */
 	| 'attestor-unreachable'
 	/** The attestor answered and rejected or failed the claim. */
 	| 'attestor-error'
-	/** Local setup (ZK files) failed before the attestor was contacted. */
+	/** The proof files are still downloading; the attestor wasn't contacted. */
+	| 'proof-files-downloading'
+	/** The proof file download failed; the attestor wasn't contacted. */
+	| 'proof-files-failed'
+	/** Other local setup failed before the attestor was contacted. */
 	| 'setup-failed'
 
 export interface AttestorCheckResult {
@@ -77,6 +82,8 @@ export interface AttestorCheckResult {
 	extractedParameters?: Record<string, string>
 	error?: string
 	errorKind?: AttestorCheckErrorKind
+	/** The proof file download state when the check finished. */
+	proofFiles?: ZkFilesState
 }
 
 /** Creates the claim on the attestor (`createClaimOnAttestor` by default). */
@@ -91,6 +98,8 @@ export interface CheckAttestorOptions {
 	createClaim?: CreateClaim
 	/** Replaces the ZK file download in tests. */
 	prepare?: () => Promise<void>
+	/** Reports the ZK file download state (`zkFilesState` by default). */
+	proofFilesState?: () => ZkFilesState
 }
 
 /** Prefix of the error raised when the check exceeds its time budget. */
@@ -135,11 +144,17 @@ export async function checkAttestor(
 		ensureAttestorCrypto()
 		await ensureZkFiles()
 	})
+	const proofFilesState = opts.proofFilesState ?? zkFilesState
 	const startedAt = Date.now()
 	const finish = (
 		outcome: Omit<AttestorCheckResult, 'attestorUrl' | 'durationMs'>,
 	): AttestorCheckResult => {
-		return { ...outcome, attestorUrl, durationMs: Date.now() - startedAt }
+		return {
+			...outcome,
+			attestorUrl,
+			durationMs: Date.now() - startedAt,
+			proofFiles: proofFilesState(),
+		}
 	}
 
 	let timer: NodeJS.Timeout | undefined
@@ -153,14 +168,7 @@ export async function checkAttestor(
 		try {
 			await Promise.race([prepare(), timeout])
 		} catch(err) {
-			const error = messageOf(err)
-			return finish({
-				ok: false,
-				error,
-				errorKind: error.startsWith(CHECK_TIMEOUT_MESSAGE)
-					? 'attestor-unreachable'
-					: 'setup-failed',
-			})
+			return finish({ ok: false, ...setupFailure(messageOf(err)) })
 		}
 
 		const claim = await Promise.race([
@@ -202,6 +210,41 @@ export async function checkAttestor(
 	} finally {
 		clearTimeout(timer)
 	}
+
+	/** Classify a failure before the attestor was contacted by the proof
+	 *  file download state, so a slow or failed download never reads as an
+	 *  unreachable attestor. */
+	function setupFailure(error: string) {
+		const files = proofFilesState()
+		if(files.status === 'downloading') {
+			const done = files.bytesDownloaded !== undefined
+				? `, ${files.bytesDownloaded}`
+					+ (files.totalBytes !== undefined ? `/${files.totalBytes}` : '')
+					+ ' bytes'
+				: ''
+			return {
+				error:
+					`proof files are still downloading (${files.method}, `
+					+ `${Math.round(files.elapsedMs / 1000)}s${done}); the attestor `
+					+ 'was not contacted. Run check_attestor again shortly.',
+				errorKind: 'proof-files-downloading' as const,
+			}
+		}
+
+		if(files.status === 'failed') {
+			return {
+				error: `proof file download failed: ${files.reason}`,
+				errorKind: 'proof-files-failed' as const,
+			}
+		}
+
+		return {
+			error,
+			errorKind: error.startsWith(CHECK_TIMEOUT_MESSAGE)
+				? 'attestor-unreachable' as const
+				: 'setup-failed' as const,
+		}
+	}
 }
 
 function messageOf(err: unknown): string {

package/src/proof/check-matchers.ts

@@ -0,0 +1,227 @@
+/**
+ * Offline matcher check: run a recipe's `responseRedactions` +
+ * `responseMatches` against a captured response with attestor-core's own HTTP
+ * provider, without a network call or a TLS session.
+ *
+ * It replays the two halves of a real proof on a synthetic transcript:
+ *   1. prover side: `providers.http.createRequest` builds the request and
+ *      `getResponseRedactions` picks the response slices to reveal (xPath /
+ *      jsonPath / regex, exactly as at proof time);
+ *   2. attestor side: `providers.http.assertValidProviderReceipt` checks the
+ *      redacted transcript against `responseMatches` and extracts params.
+ *
+ * Hashed (OPRF) slices stay in plaintext here: OPRF needs the attestor, so the
+ * check treats the value as its own nullifier. Everything else is the same
+ * engine the attestor runs.
+ */
+import {
+	CURRENT_ATTESTOR_VERSION,
+	type Logger,
+	PROVIDER_CTX,
+	providers,
+	type RedactedOrHashedArraySlice,
+	redactSlices,
+} from '@reclaimprotocol/attestor-core'
+// Side-effect: make external domhandler nodes DOM-like so attestor-core's
+// bundled `xpath` accepts them (see patch-domhandler.ts).
+import './patch-domhandler.ts'
+import { LOGGER } from '../logger.ts'
+import type { CapturedRequest, ReclaimProvider } from '../provider/schema.ts'
+import { buildHttpParams } from './proof-core.ts'
+
+/** Longest revealed slice returned; the full slice is still checked. */
+const MAX_SLICE_CHARS = 400
+/** Most revealed slices returned. */
+const MAX_SLICES = 10
+/** Longest error message returned (attestor errors can embed the base64 of
+ *  a whole element). */
+const MAX_REASON_CHARS = 600
+
+export interface RevealedSlice {
+	/** Byte offsets in the response body. */
+	from: number
+	to: number
+	/** Revealed text, truncated to {@link MAX_SLICE_CHARS}. */
+	text: string
+	/** Set when the slice is an OPRF-hashed value (plaintext here). */
+	hashed?: true
+}
+
+export interface MatcherCheckResult {
+	/** True when the attestor would accept this response. */
+	ok: boolean
+	/** Where it failed: building the request, selecting what to reveal, or
+	 *  checking `responseMatches` on the revealed bytes. */
+	failedAt?: 'request' | 'redaction' | 'match'
+	/** Attestor-core's error, truncated. */
+	reason?: string
+	/** Params the attestor would extract (regex groups + `paramValues` the
+	 *  matches use). */
+	extractedParameters: Record<string, string>
+	/** The response body slices revealed to the attestor. */
+	revealed: RevealedSlice[]
+	revealedSliceCount: number
+	revealedBytes: number
+	bodyBytes: number
+	/** Set when an OPRF-hashed redaction was checked in plaintext. */
+	note?: string
+}
+
+/** Placeholder secret header: the request builder needs one secret, and the
+ *  check never sends the request. */
+const OFFLINE_SECRET = { 'X-Reclaim-Offline-Check': '1' }
+
+/**
+ * Check `provider`'s matchers against `captured`'s response body, offline.
+ * Uses the captured status and content type, so a non-2xx capture fails the
+ * same way it would at proof time.
+ */
+export function checkMatchersOffline(
+	provider: ReclaimProvider,
+	captured: Pick<CapturedRequest, 'status' | 'contentType' | 'responseBody'>,
+): MatcherCheckResult {
+	const http = providers.http
+	const params = buildHttpParams(provider)
+	const logger = silentLogger()
+	const body = Buffer.from(captured.responseBody ?? '', 'utf8')
+	const head = Buffer.from(
+		`HTTP/1.1 ${captured.status} ${captured.status < 300 ? 'OK' : 'ERR'}\r\n`
+		+ `Content-Type: ${captured.contentType || 'text/plain'}\r\n`
+		+ `Content-Length: ${body.length}\r\n\r\n`,
+	)
+	const response = new Uint8Array(Buffer.concat([head, body]))
+	const empty = {
+		extractedParameters: {},
+		revealed: [],
+		revealedSliceCount: 0,
+		revealedBytes: 0,
+		bodyBytes: body.length,
+	}
+
+	let request: Uint8Array
+	try {
+		const req = http.createRequest(
+			{ headers: OFFLINE_SECRET }, structuredClone(params), logger,
+		)
+		const data = typeof req.data === 'string'
+			? new Uint8Array(Buffer.from(req.data))
+			: req.data
+		request = redactSlices(data, req.redactions)
+	} catch(err) {
+		return { ...empty, ok: false, failedAt: 'request', reason: reasonOf(err) }
+	}
+
+	let slices: RedactedOrHashedArraySlice[]
+	try {
+		slices = http.getResponseRedactions?.({
+			response, params: structuredClone(params), logger, ctx: PROVIDER_CTX,
+		}) ?? []
+	} catch(err) {
+		return { ...empty, ok: false, failedAt: 'redaction', reason: reasonOf(err) }
+	}
+
+	const hidden = slices.filter((s) => !s.hash)
+	const hashed = slices.filter((s) => s.hash)
+	const view = revealedSlices(head.length, response.length, hidden, hashed)
+	const redacted = redactSlices(response, hidden)
+	const seen = {
+		revealed: view.slice(0, MAX_SLICES).map((s) => ({
+			from: s.from,
+			to: s.to,
+			text: truncate(
+				Buffer.from(response.subarray(head.length + s.from, head.length + s.to))
+					.toString('utf8'),
+				MAX_SLICE_CHARS,
+			),
+			...(s.hashed ? { hashed: true as const } : {}),
+		})),
+		revealedSliceCount: view.length,
+		revealedBytes: view.reduce((n, s) => n + s.to - s.from, 0),
+		bodyBytes: body.length,
+		...(hashed.length
+			? {
+				note: 'OPRF-hashed values were checked in plaintext; at proof time '
+					+ 'the attestor sees their nullifier instead.',
+			}
+			: {}),
+	}
+
+	try {
+		const out = http.assertValidProviderReceipt({
+			clientVersion: CURRENT_ATTESTOR_VERSION,
+			receipt: [
+				{ sender: 'client', message: request },
+				{ sender: 'server', message: redacted },
+			],
+			params: structuredClone(params),
+			logger,
+			ctx: PROVIDER_CTX,
+		})
+		// The http provider validates synchronously; a thenable here would mean
+		// a provider we don't run offline.
+		const extracted = out instanceof Promise ? undefined : out
+		return {
+			ok: true,
+			extractedParameters: extracted?.extractedParameters ?? {},
+			...seen,
+		}
+	} catch(err) {
+		return {
+			ok: false,
+			failedAt: 'match',
+			reason: reasonOf(err),
+			extractedParameters: {},
+			...seen,
+		}
+	}
+}
+
+/** Body-relative revealed ranges: the complement of `hidden` within the body,
+ *  merged with the hashed slices (revealed as their nullifier at proof time).
+ */
+function revealedSlices(
+	bodyStart: number,
+	total: number,
+	hidden: RedactedOrHashedArraySlice[],
+	hashed: RedactedOrHashedArraySlice[],
+): { from: number, to: number, hashed?: true }[] {
+	const out: { from: number, to: number, hashed?: true }[] = []
+	let cursor = bodyStart
+	const sorted = [...hidden].sort((a, b) => a.fromIndex - b.fromIndex)
+	for(const s of sorted) {
+		if(s.fromIndex > cursor) {
+			out.push({ from: cursor - bodyStart, to: s.fromIndex - bodyStart })
+		}
+
+		cursor = Math.max(cursor, s.toIndex)
+	}
+
+	if(cursor < total) {
+		out.push({ from: cursor - bodyStart, to: total - bodyStart })
+	}
+
+	for(const h of hashed) {
+		out.push({
+			from: h.fromIndex - bodyStart, to: h.toIndex - bodyStart, hashed: true,
+		})
+	}
+
+	return out
+		.filter((s) => s.to > s.from && s.from >= 0)
+		.sort((a, b) => a.from - b.from)
+}
+
+function reasonOf(err: unknown): string {
+	return truncate(err instanceof Error ? err.message : String(err),
+		MAX_REASON_CHARS)
+}
+
+function truncate(s: string, max: number): string {
+	return s.length > max ? `${s.slice(0, max)}… (${s.length} chars)` : s
+}
+
+/** A logger for attestor-core calls that records nothing: the check reports
+ *  its outcome in the result, and the provider logs whole responses. */
+function silentLogger(): Logger {
+	return LOGGER.child({ scope: 'check-matchers' }, { level: 'silent' })
+}