@sigrun/sigrun 0.1.6 → 0.2.0

package/dist/harness/identity/users.js

@@ -15,15 +15,55 @@ import { MutationQueue, readRecords, writeJson } from "./json-store.js";
 /** The username rule (spec §5.8): lowercase-first, then `[a-z0-9._-]`. */
 const USERNAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 /**
- * The file-backed user directory. Reads are synchronous (mtime reload
- * per access); every mutation is a whole-file read-modify-write that
- * serializes on the store's {@link MutationQueue}.
+ * Strip the retired C8 field at every write boundary. A legacy on-disk
+ * value is readable for compatibility, but never survives another write
+ * and never participates in effective-admin derivation.
  */
+function withoutLegacyGroupAdmin(record) {
+    const clean = { ...record };
+    delete clean.groupAdmin;
+    return clean;
+}
+export class AdmissionRefusedError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "AdmissionRefusedError";
+    }
+}
+/** The one multi-user admission policy shared by server boot and the CLI. */
+export function createAdmissionGuard(opts) {
+    return () => {
+        if (!opts.isolation.available || opts.mode === "off") {
+            throw new AdmissionRefusedError("isolation_required", `isolation_required: ${opts.isolation.reason ?? "isolation mode is off"}`);
+        }
+        if (opts.methods.length === 0) {
+            throw new AdmissionRefusedError("auth_required", "auth_required: configure token or proxy authentication before adding another user");
+        }
+        if (opts.methods.includes("proxy") && opts.proxySecretHeader === undefined) {
+            throw new AdmissionRefusedError("isolation_required", "isolation_required: proxy authentication requires server.auth.proxy.secretHeader before isolation can activate");
+        }
+    };
+}
 export class UserDirectory {
     path;
+    options;
     mutations = new MutationQueue();
-    constructor(path) {
+    constructor(path, options = {}) {
         this.path = path;
+        this.options = options;
+    }
+    /** Attach the process's admission policy (boot/CLI), preserving existing rows. */
+    configureAdmission(options) {
+        this.options = { ...this.options, ...options };
+    }
+    async writeRecords(records) {
+        await writeJson(this.path, records.map(withoutLegacyGroupAdmin));
+    }
+    /** Run the same admission guard used by add, before consuming an invite. */
+    checkAdmission() {
+        this.options.admit?.(this.list().length);
     }
     /** Every user, insertion order (the first add is the onboarding claim). */
     list() {
@@ -55,16 +95,21 @@ export class UserDirectory {
             if (records.some((record) => record.user === user.user)) {
                 throw new Error(`user "${user.user}" already exists`);
             }
-            const record = { ...user, createdAt: Date.now() };
-            await writeJson(this.path, [...records, record]);
+            if (records.length >= 1) {
+                this.options.admit?.(records.length);
+                if (records.length === 1 && records[0].workspace === undefined && this.options.firstWorkspace !== undefined) {
+                    records[0] = { ...records[0], workspace: this.options.firstWorkspace };
+                }
+            }
+            const record = withoutLegacyGroupAdmin({ ...user, createdAt: Date.now() });
+            await this.writeRecords([...records, record]);
             return record;
         });
     }
     /**
      * Patch one user's mutable fields (`name`/`email`/`admin` — the
-     * username itself is immutable; `groupAdmin` is the pipeline's own
-     * write-through field, never the PATCH route's surface). Absent user
-     * throws; the file is rewritten atomically.
+     * username itself is immutable). Absent user throws; the file is
+     * rewritten atomically and any legacy `groupAdmin` value is dropped.
      */
     update(user, patch) {
         return this.mutations.run(async () => {
@@ -73,12 +118,66 @@ export class UserDirectory {
             if (index === -1) {
                 throw new Error(`unknown user "${user}"`);
             }
-            const updated = { ...records[index], ...patch };
+            const updated = withoutLegacyGroupAdmin({ ...records[index], ...patch });
+            records[index] = updated;
+            await this.writeRecords(records);
+            return updated;
+        });
+    }
+    /**
+     * Replace one source's groups. Identical values are a true no-op:
+     * neither the file nor its mtime changes (busy proxy requests must
+     * not rewrite the directory). Other sources are preserved.
+     */
+    setGroups(user, source, values, now = Date.now()) {
+        return this.mutations.run(async () => {
+            const records = this.list();
+            const index = records.findIndex((record) => record.user === user);
+            if (index === -1)
+                throw new Error(`unknown user "${user}"`);
+            const current = records[index];
+            const groups = [...(current.groups ?? [])];
+            const sourceIndex = groups.findIndex((entry) => entry.source === source);
+            const previous = sourceIndex === -1 ? undefined : groups[sourceIndex];
+            if (previous !== undefined &&
+                previous.values.length === values.length &&
+                previous.values.every((value, i) => value === values[i])) {
+                return current;
+            }
+            const entry = { source, values: [...values], updatedAt: now };
+            if (sourceIndex === -1)
+                groups.push(entry);
+            else
+                groups[sourceIndex] = entry;
+            const updated = withoutLegacyGroupAdmin({ ...current, groups });
             records[index] = updated;
-            await writeJson(this.path, records);
+            await this.writeRecords(records);
             return updated;
         });
     }
+    /**
+     * Remove one user and append a transfer grant to the recipient in one
+     * serialized read-modify-write. Current recipient grants are read inside
+     * the mutation, so a queued concurrent update cannot be clobbered.
+     */
+    removeWithGrant(user, to, grant) {
+        return this.mutations.run(async () => {
+            const records = this.list();
+            const sourceIndex = records.findIndex((record) => record.user === user);
+            if (sourceIndex === -1)
+                throw new Error(`unknown user "${user}"`);
+            const recipientIndex = records.findIndex((record) => record.user === to);
+            if (recipientIndex === -1)
+                throw new Error(`unknown user "${to}"`);
+            const recipient = records[recipientIndex];
+            records[recipientIndex] = {
+                ...recipient,
+                grants: [...(recipient.grants ?? []), grant],
+            };
+            records.splice(sourceIndex, 1);
+            await this.writeRecords(records);
+        });
+    }
     /** Remove one user (their tokens are NOT revoked here — caller's job). */
     remove(user) {
         return this.mutations.run(async () => {
@@ -88,7 +187,7 @@ export class UserDirectory {
                 throw new Error(`unknown user "${user}"`);
             }
             records.splice(index, 1);
-            await writeJson(this.path, records);
+            await this.writeRecords(records);
         });
     }
 }

package/dist/harness/interactions.js

@@ -1,8 +1,8 @@
 /**
- * The interaction seam (spec: docs/approval-ux-seams.md): core-owned,
- * channel-neutral records for "this conversation is waiting on a human
- * decision", written by extensions through the host context and answered
- * by channels through one generic route.
+ * The interaction seam (spec: docs/approval-ux-seams.md; the block
+ * mapping: UI-blocks design §9.1): core-owned, channel-neutral records for "this conversation is
+ * waiting on a human decision", written by extensions through the host
+ * context and answered by channels through one generic route.
  *
  * SPLIT (build-and-webui Task 1): the canonical TYPE declarations live in
  * the `@sigrun/shared` package (`shared/src/interactions.ts` — the records
@@ -10,12 +10,13 @@
  * this module owns the docs, validation, and index RUNTIME, importing the
  * types (type-only — no runtime dependency on the built package).
  *
- * Layering (strict envelope / closed primitives / opaque details):
+ * Layering (strict envelope / block-tree body / opaque details):
  *
  * - envelope: kind, callId, status, timestamps, answer — load-bearing for
  *   joining tool slots and lifecycle arbitration. Strictly validated.
- * - body: composed ONLY from the closed primitives (text, options,
- *   fields, diff). Structurally validated; unknown body keys quarantine.
+ * - body: a block tree (placement `interaction` — a root `form` whose
+ *   submit is the answer). Validated with `validateTree`; legacy-shaped
+ *   bodies FAIL with paths (ruling 16 — no compatibility layer).
  * - details: opaque extension-owned JSON. Never interpreted.
  *
  * Answer transport: the generic route commits `answer` into the record.
@@ -32,6 +33,30 @@
  * read the list route, which snapshots the index and then the records.
  */
 import { defineDoc, defineDocFamily } from "@earendil-works/pi-durable";
+import { validateTree } from "../blocks/validate.js";
+/**
+ * Narrow a stored record to the public wire record. SAFETY: the two
+ * shapes are identical at runtime — a stored body passed `validateTree`
+ * (placement `interaction`) at write time, and a validated tree IS the
+ * JSON the mirror describes; the cast only restores the type-level
+ * naming `JsonObject`-erasure removed.
+ */
+export function asInteractionRecord(value) {
+    // SAFETY: see the doc comment — the mirror differs only in the erased
+    // body's structural naming; a validated tree is that JSON.
+    return value;
+}
+/**
+ * Widen the public wire record to the stored shape (the seed path's
+ * `Object.assign` input). SAFETY: same runtime shape as
+ * `asInteractionRecord` — the body was validated as a tree moments
+ * before this cast in `validateInteraction`.
+ */
+export function asStoredInteractionRecord(value) {
+    // SAFETY: see the doc comment — the mirror differs only in the erased
+    // body's structural naming; a validated tree is that JSON.
+    return value;
+}
 /** The interaction record doc family: one record per callId, per conversation. */
 export const InteractionDoc = defineDocFamily({
     kind: "sigrun.interaction",
@@ -63,19 +88,11 @@ export const TERMINAL = new Set([
     "expired",
     "cancelled",
 ]);
-const TONES = new Set([
-    "danger",
-    "warn",
-    "ok",
-    "neutral",
-]);
-const FIELD_TYPES = new Set([
-    "string",
-    "number",
-    "boolean",
-    "secret",
-]);
-/** Structural validation of one interaction record. Returns the error text or null. */
+/**
+ * Structural validation of one interaction record: the envelope's own
+ * checks, then the body tree through `validateTree({placement:
+ * "interaction"})`. Returns the error text (with the tree paths) or null.
+ */
 export function validateInteraction(value) {
     if (typeof value !== "object" || value === null) {
         return "interaction record must be an object";
@@ -108,125 +125,43 @@ export function validateInteraction(value) {
     if (r.answeredBy !== undefined && r.answeredBy !== "human" && r.answeredBy !== "extension") {
         return "answeredBy must be 'human' or 'extension'";
     }
-    const body = r.body;
-    if (body !== undefined) {
-        if (typeof body !== "object" || body === null) {
-            return "body must be an object";
-        }
-        const b = body;
-        const known = new Set(["text", "options", "fields", "diff"]);
-        const unknownKey = Object.keys(b).find((k) => !known.has(k));
-        if (unknownKey !== undefined) {
-            return `body.${unknownKey} is outside the closed primitives (move it to details)`;
-        }
-        if (b.text !== undefined && typeof b.text !== "string") {
-            return "body.text must be a string";
-        }
-        if (b.options !== undefined) {
-            if (!Array.isArray(b.options))
-                return "body.options must be an array";
-            for (const o of b.options) {
-                const problem = validateOption(o);
-                if (problem !== null)
-                    return problem;
-            }
-        }
-        if (b.fields !== undefined) {
-            if (!Array.isArray(b.fields))
-                return "body.fields must be an array";
-            for (const f of b.fields) {
-                const problem = validateField(f);
-                if (problem !== null)
-                    return problem;
-            }
-        }
-        if (b.diff !== undefined) {
-            const problem = validateDiff(b.diff);
-            if (problem !== null)
-                return problem;
+    if (r.body !== undefined) {
+        // Ruling 16 (no compatibility layer): legacy-shaped bodies (objects
+        // keyed text/options/fields/diff rather than {v, root}) fail HERE,
+        // with the path — a tree is {v, root}.
+        const result = validateTree(r.body, { placement: "interaction" });
+        if (!result.ok) {
+            const first = result.errors[0];
+            if (first === undefined)
+                return "body must be a block tree";
+            // The tree-relative path joins the record's field ("body.root…")
+            // so the error names where the record is wrong, not just the tree.
+            return `body is not a valid interaction tree: body.${first.path} ${first.message}`;
         }
     }
     return null;
 }
-function validateAnswer(value) {
+/**
+ * An answer is `{values}` ONLY (ruling 20): every field's value under its
+ * name. The legacy `{ids, text}` (and the string/number/boolean-only
+ * `values`) are rejected — no compatibility layer.
+ */
+export function validateAnswer(value) {
     if (typeof value !== "object" || value === null) {
         return "answer must be an object";
     }
     const a = value;
-    const known = new Set(["ids", "values", "text"]);
+    const known = new Set(["values"]);
     const unknownKey = Object.keys(a).find((k) => !known.has(k));
-    if (unknownKey !== undefined)
-        return `answer.${unknownKey} is not a valid field`;
-    if (a.ids !== undefined && !Array.isArray(a.ids)) {
-        return "answer.ids must be an array of strings";
-    }
-    if (Array.isArray(a.ids) && a.ids.some((id) => typeof id !== "string")) {
-        return "answer.ids must be an array of strings";
+    if (unknownKey !== undefined) {
+        return `answer.${unknownKey} is not a valid field (an answer is {values})`;
     }
-    if (a.values !== undefined) {
-        if (typeof a.values !== "object" || a.values === null) {
-            return "answer.values must be an object";
-        }
-        const bad = Object.entries(a.values).find(([, v]) => typeof v !== "string" && typeof v !== "number" && typeof v !== "boolean");
-        if (bad !== undefined) {
-            return `answer.values.${bad[0]} must be string, number, or boolean`;
-        }
-    }
-    if (a.text !== undefined && typeof a.text !== "string") {
-        return "answer.text must be a string";
-    }
-    return null;
-}
-function validateOption(value) {
-    if (typeof value !== "object" || value === null)
-        return "option must be an object";
-    const o = value;
-    if (typeof o.id !== "string" || o.id.length === 0)
-        return "option.id must be a non-empty string";
-    if (typeof o.label !== "string" || o.label.length === 0) {
-        return "option.label must be a non-empty string";
-    }
-    if (o.description !== undefined && typeof o.description !== "string") {
-        return "option.description must be a string";
-    }
-    if (o.tone !== undefined && !TONES.has(String(o.tone))) {
-        return `option.tone must be one of danger|warn|ok|neutral (got ${String(o.tone)})`;
-    }
-    if (o.recommended !== undefined && typeof o.recommended !== "boolean") {
-        return "option.recommended must be a boolean";
-    }
-    return null;
-}
-function validateField(value) {
-    if (typeof value !== "object" || value === null)
-        return "field must be an object";
-    const f = value;
-    if (typeof f.name !== "string" || f.name.length === 0) {
-        return "field.name must be a non-empty string";
-    }
-    if (typeof f.type !== "string" || !FIELD_TYPES.has(f.type)) {
-        return `field.type must be one of string|number|boolean|secret (got ${String(f.type)})`;
+    if (a.values === undefined) {
+        return "answer.values is required";
     }
-    if (f.label !== undefined && typeof f.label !== "string") {
-        return "field.label must be a string";
+    if (typeof a.values !== "object" || a.values === null || Array.isArray(a.values)) {
+        return "answer.values must be an object";
     }
-    if (f.required !== undefined && typeof f.required !== "boolean") {
-        return "field.required must be a boolean";
-    }
-    return null;
-}
-function validateDiff(value) {
-    if (typeof value !== "object" || value === null)
-        return "diff must be an object";
-    const d = value;
-    if (typeof d.before !== "string")
-        return "diff.before must be a string";
-    if (typeof d.after !== "string")
-        return "diff.after must be a string";
-    if (d.path !== undefined && typeof d.path !== "string")
-        return "diff.path must be a string";
-    if (d.lang !== undefined && typeof d.lang !== "string")
-        return "diff.lang must be a string";
     return null;
 }
 /**
@@ -255,23 +190,196 @@ export function indexSettled(draft, conversationId, callId) {
         draft.pending[key] = next;
     }
 }
+/** A JSON value that is structurally valid in an answer's `values`. */
+function isJsonValue(value) {
+    if (value === null)
+        return true;
+    const t = typeof value;
+    if (t === "string" || t === "number" || t === "boolean")
+        return true;
+    if (t !== "object")
+        return false;
+    if (Array.isArray(value))
+        return value.every(isJsonValue);
+    for (const child of Object.values(value)) {
+        if (!isJsonValue(child))
+            return false;
+    }
+    return true;
+}
+/**
+ * The literal that replaces a `secret` field's value in every STORED answer
+ * (Review Focus 4, U6 Task 2): the stored record, every HTTP read, and the
+ * wire only ever carry this marker. The extension receives the true value
+ * exactly once, transiently, through the host-side read (the delivery
+ * table below).
+ */
+export const SECRET_MASK = "[secret]";
+/**
+ * The transient full-answer delivery table (supervisor ruling, U6 Task 2):
+ * in-memory, runtime-owned, keyed (conversationId, callId). A `secret`
+ * field's value never lands in the stored record — the answer commit
+ * writes the MASK into the record and records the TRUE answer here, and
+ * the extension-only read path (`host.snapshotInteraction`) merges the true
+ * values back once, then deletes the entry (one-shot delivery; the
+ * extension is expected to persist the secret in its own scoped stores).
+ * The table is deliberately NOT durable: a crash between the answer commit
+ * and the extension's poll loses the value and the human re-answers — the
+ * safe failure mode (a raw secret must never survive a restart in the DB).
+ */
+/**
+ * Delivery TTL (minor 5): a delivery whose interaction never settles and
+ * is never polled (the host crashed mid-round-trip, the extension was
+ * uninstalled) must not hold a raw secret forever — expire after an hour.
+ */
+const SECRET_DELIVERY_TTL_MS = 60 * 60 * 1000;
+class SecretDeliveries {
+    /** conversationId|callId → the true answer (+ recordedAt), waiting for one read. */
+    #pending = new Map();
+    /** Drop entries older than the TTL (a never-settled secret has a bound). */
+    #expire(now) {
+        for (const [key, entry] of this.#pending) {
+            if (now - entry.recordedAt > SECRET_DELIVERY_TTL_MS) {
+                this.#pending.delete(key);
+            }
+        }
+    }
+    /** Record the true answer for one settled interaction (answer path). */
+    record(conversationId, callId, answer) {
+        const now = Date.now();
+        this.#expire(now);
+        this.#pending.set(`${String(conversationId)}|${callId}`, {
+            answer,
+            recordedAt: now,
+        });
+    }
+    /**
+     * Take the delivery once, if present: the true answer, then delete.
+     * Returns `undefined` when nothing was recorded (no secret, or already
+     * delivered, or swept, or past the TTL).
+     */
+    take(conversationId, callId) {
+        const now = Date.now();
+        this.#expire(now);
+        const key = `${String(conversationId)}|${callId}`;
+        const entry = this.#pending.get(key);
+        if (entry === undefined)
+            return undefined;
+        this.#pending.delete(key);
+        return entry.answer;
+    }
+    /** Drop the entry without reading it (settle/expiry sweep — no leak). */
+    sweep(conversationId, callId) {
+        this.#pending.delete(`${String(conversationId)}|${callId}`);
+    }
+}
+/** The session-singleton delivery table (one per boot). */
+const secretDeliveries = new SecretDeliveries();
+/**
+ * The names of the `secret` fields in an interaction's form tree: every
+ * `field` node with `type: "secret"`, from the root form and its sections.
+ * Used by the answer path to strip values before they land in the record.
+ */
+function secretFieldNames(body) {
+    const names = new Set();
+    if (typeof body !== "object" || body === null)
+        return names;
+    const root = body.root;
+    if (typeof root !== "object" || root === null)
+        return names;
+    /**
+     * The block schema's child slots: every place a nested block or field
+     * can live (schema.ts:17-22). A generic descent that walks ONLY these
+     * slots — recursing over every record/array value would trip on data
+     * props (rows, series) that happen to carry a `{type, name}` record.
+     */
+    const walkNode = (node) => {
+        if (typeof node !== "object" || node === null)
+            return;
+        const rec = node;
+        if (rec.type === "secret" && typeof rec.name === "string") {
+            names.add(rec.name);
+        }
+        walkNodeList(rec.children);
+        walkNodeList(rec.main);
+        walkNodeList(rec.sidebar);
+        walkNodeList(rec.detail);
+        walkNode(rec.item);
+        walkNode(rec.switcher);
+        if (Array.isArray(rec.bulkActions)) {
+            for (const bulk of rec.bulkActions) {
+                if (typeof bulk !== "object" || bulk === null)
+                    continue;
+                walkNode(bulk.form?.root);
+            }
+        }
+    };
+    const walkNodeList = (nodes) => {
+        if (!Array.isArray(nodes))
+            return;
+        for (const child of nodes) {
+            if (typeof child !== "object" || child === null)
+                continue;
+            // columns/grid children are `{weight?, block}` wrappers. Walk
+            // BOTH: unknown props pass validation, so a stray `block` prop
+            // on a real node must not shadow the node's own children.
+            const rec = child;
+            walkNode(child);
+            if (rec.block !== undefined)
+                walkNode(rec.block);
+        }
+    };
+    walkNode(root);
+    return names;
+}
+/**
+ * The ONE masking rule (minor 3): secret names map to {@link SECRET_MASK},
+ * every other value passes through. Shared by `applyAnswer` (the stored
+ * write) and `maskedAnswerValues` (the route's response projection) so the
+ * two can never drift. `dropNonJson` mirrors applyAnswer's belt: values
+ * failing `isJsonValue` are skipped (the projection's inputs are already
+ * validated, so it passes false and keeps every value).
+ */
+function maskValues(secrets, values, dropNonJson = true) {
+    const masked = {};
+    for (const [key, value] of Object.entries(values)) {
+        if (dropNonJson && !isJsonValue(value))
+            continue;
+        masked[key] = secrets.has(key) ? SECRET_MASK : value;
+    }
+    return masked;
+}
 /**
  * The committed answer for one record, or `undefined` when the record was
  * already terminal (first-answer-wins: the caller must NOT overwrite).
  * The draft is mutated in place — this runs inside the caller's commit.
+ *
+ * Review Focus 4: when the interaction's form carries `secret` fields, the
+ * stored answer's values for those names are replaced by
+ * {@link SECRET_MASK} and the TRUE answer is recorded in the delivery
+ * table for the extension's one-shot read (`opts.conversationId` — the
+ * table is keyed (conversation, callId), and only the caller knows the
+ * conversation; omitting it skips the delivery).
  */
-export function applyAnswer(draft, answer, answeredBy, now, answeredByUser) {
+export function applyAnswer(draft, answer, answeredBy, now, answeredByUser, opts) {
     if (draft.status !== "pending")
         return false;
-    const clean = {};
-    if (answer.ids !== undefined)
-        clean.ids = [...answer.ids];
-    if (answer.values !== undefined)
-        clean.values = { ...answer.values };
-    if (answer.text !== undefined)
-        clean.text = answer.text;
+    // Review Focus 4: the SECRET rule. The tree's secret field names decide
+    // which values never persist: the stored copy carries the MASK, the
+    // true copy rides the one-shot delivery table (extension-only read).
+    const secrets = secretFieldNames(draft.body);
+    const values = maskValues(secrets, answer.values ?? {});
+    const hasSecret = Object.values(values).some((value) => value === SECRET_MASK);
+    if (hasSecret && opts?.conversationId !== undefined) {
+        secretDeliveries.record(opts.conversationId, draft.callId, {
+            values: answer.values,
+        });
+    }
+    // SAFETY: the draft's declared shape is readonly; the doc family's
+    // tracked-draft write pattern mutates through a structural record view
+    // (every key below exists on the stored record by construction).
     const mutable = draft;
-    mutable.answer = clean;
+    mutable.answer = { values };
     mutable.answeredBy = answeredBy;
     // The answering USER rides alongside the actor class (spec §5.9): who
     // answered matters to every participant a conversation is shared with.
@@ -281,3 +389,51 @@ export function applyAnswer(draft, answer, answeredBy, now, answeredByUser) {
     mutable.settledAt = now;
     return true;
 }
+/**
+ * Take one interaction's secret delivery (the extension-only read path):
+ * the TRUE answer when a secret was answered and never yet read — the
+ * entry is deleted by this very read (one-shot). The HTTP GETs NEVER call
+ * this: only `host.snapshotInteraction` merges it back.
+ */
+export function takeSecretDelivery(conversationId, callId) {
+    return secretDeliveries.take(conversationId, callId);
+}
+/**
+ * Drop one interaction's unread secret delivery without reading it (the
+ * settle/expiry sweep: terminal transitions the extension never polled
+ * must not leave raw values in the table).
+ */
+export function sweepSecretDelivery(conversationId, callId) {
+    secretDeliveries.sweep(conversationId, callId);
+}
+/**
+ * The stored-answer projection of an input answer (the route's response
+ * body): the values with every secret-field name replaced by
+ * {@link SECRET_MASK} — EXACTLY what `applyAnswer` writes, computed
+ * without a commit so the route can project it after the commit without
+ * re-reading the mutated draft (the chord settled-overlay rule).
+ */
+export function maskedAnswerValues(body, answer) {
+    const secrets = secretFieldNames(body);
+    return { values: maskValues(secrets, answer.values, false) };
+}
+/** Narrow an unvalidated route body to `{values: JsonObject}`, or null. */
+export function answerFromBody(body) {
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+        return null;
+    }
+    const b = body;
+    for (const key of Object.keys(b)) {
+        if (key !== "values")
+            return null;
+    }
+    const values = b.values;
+    if (typeof values !== "object" || values === null || Array.isArray(values)) {
+        return null;
+    }
+    for (const value of Object.values(values)) {
+        if (!isJsonValue(value))
+            return null;
+    }
+    return { values: values };
+}