@verax-ai/body 0.1.0

package/dist/policy-store.d.ts

@@ -0,0 +1,3 @@
+/** Write <stateDir>/policies/<policyHash>.json once; existing bytes are hash-checked. */
+export declare function persistPolicySnapshot(stateDir: string, hash: string, document: unknown): void;
+export declare function readPolicySnapshots(stateDir: string, hashes: Iterable<string>): Record<string, unknown>;

package/dist/policy-store.js

@@ -0,0 +1,44 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { loadPolicy } from "@verax-ai/proxy";
+const HASH_RE = /^[0-9a-f]{64}$/;
+function snapshotPath(stateDir, hash) {
+    return join(stateDir, "policies", `${hash}.json`);
+}
+/** Write <stateDir>/policies/<policyHash>.json once; existing bytes are hash-checked. */
+export function persistPolicySnapshot(stateDir, hash, document) {
+    if (!HASH_RE.test(hash)) {
+        throw new Error(`policy-hash-invalid:${hash}`);
+    }
+    const dir = join(stateDir, "policies");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = snapshotPath(stateDir, hash);
+    if (existsSync(path)) {
+        const existing = JSON.parse(readFileSync(path, "utf8"));
+        if (loadPolicy(existing).hash !== hash) {
+            throw new Error(`policy-snapshot-mismatch:${hash}`);
+        }
+        return;
+    }
+    writeFileSync(path, `${JSON.stringify(document)}\n`, { encoding: "utf8", mode: 0o600 });
+}
+export function readPolicySnapshots(stateDir, hashes) {
+    const out = {};
+    for (const hash of hashes) {
+        if (!HASH_RE.test(hash))
+            continue;
+        const path = snapshotPath(stateDir, hash);
+        if (!existsSync(path))
+            continue;
+        try {
+            const document = JSON.parse(readFileSync(path, "utf8"));
+            if (loadPolicy(document).hash !== hash)
+                continue;
+            out[hash] = document;
+        }
+        catch {
+            // Omit a bad snapshot so the panel can say the historical policy is unavailable.
+        }
+    }
+    return out;
+}

package/dist/reconcile-cli.d.ts

@@ -0,0 +1,24 @@
+export declare function parseReconcileArgs(argv: string[]): {
+    stateDir: string;
+    channelPath: string;
+    outPath: string;
+    toleranceMs: number;
+    window?: {
+        startMs: number;
+        endMs: number;
+    };
+    channel?: "card";
+    currency?: string;
+    columns?: {
+        date: string;
+        amount: string;
+        description: string;
+        id?: string;
+    };
+    delimiter?: ";" | ",";
+    decimal?: "," | ".";
+    tzOffsetMinutes?: number;
+} | {
+    error: string;
+};
+export declare function runReconcile(argv: string[], writeErr?: (s: string) => void): number;

package/dist/reconcile-cli.js

@@ -0,0 +1,258 @@
+import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { loadApprovalsFromDir, loadEffectsFromDir, loadPolicy, parseCardCsv, parseChannelJsonl, reconcile } from "@verax-ai/proxy";
+const SNAPSHOT_NAME = /^[0-9a-f]{64}\.json$/;
+function descriptorsFromDoc(doc) {
+    const out = {};
+    if (!Array.isArray(doc.rules))
+        return out;
+    for (const rule of doc.rules) {
+        const spend = rule.spend;
+        if (!spend || !Array.isArray(spend.payees) || !Array.isArray(spend.descriptors))
+            continue;
+        const stamps = spend.descriptors.filter((d) => typeof d === "string" && d !== "");
+        if (stamps.length === 0)
+            continue;
+        for (const payee of spend.payees) {
+            if (typeof payee === "string" && payee !== "")
+                out[payee] = stamps;
+        }
+    }
+    return out;
+}
+function loadDescriptorsFromDir(stateDir) {
+    const dir = join(stateDir, "policies");
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return { descriptorsByPayee: {}, policyHash: null };
+    }
+    const candidates = [];
+    for (const name of names) {
+        if (!SNAPSHOT_NAME.test(name))
+            continue;
+        try {
+            const st = statSync(join(dir, name));
+            candidates.push({ name, mtimeMs: st.mtimeMs });
+        }
+        catch {
+            // A missing snapshot is skipped.
+        }
+    }
+    if (candidates.length === 0)
+        return { descriptorsByPayee: {}, policyHash: null };
+    candidates.sort((a, b) => a.mtimeMs - b.mtimeMs || a.name.localeCompare(b.name));
+    const chosen = candidates[candidates.length - 1];
+    const hash = chosen.name.slice(0, 64);
+    try {
+        const doc = JSON.parse(readFileSync(join(dir, chosen.name), "utf8"));
+        if (loadPolicy(doc).hash !== hash)
+            return { descriptorsByPayee: {}, policyHash: null };
+        return { descriptorsByPayee: descriptorsFromDoc(doc), policyHash: hash };
+    }
+    catch {
+        return { descriptorsByPayee: {}, policyHash: null };
+    }
+}
+const CARD_TOLERANCE_MS = 3 * 86_400_000;
+/** UTC-12 .. UTC+14 in minutes. */
+const MAX_TZ_OFFSET_MIN = 840;
+export function parseReconcileArgs(argv) {
+    const rest = argv.slice(1);
+    let tzOffsetMinutes;
+    let toleranceMs;
+    let outPath;
+    let windowStart;
+    let windowEnd;
+    let channel;
+    let currency;
+    let columns;
+    let delimiter;
+    let decimal;
+    const positionals = [];
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === "--tolerance") {
+            const raw = rest[i + 1];
+            const n = Number(raw);
+            if (!Number.isFinite(n) || n < 0)
+                return { error: "tolerance-invalid" };
+            toleranceMs = n;
+            i += 1;
+            continue;
+        }
+        if (a === "--window-start") {
+            const n = Number(rest[i + 1]);
+            if (!Number.isFinite(n))
+                return { error: "window-invalid" };
+            windowStart = n;
+            i += 1;
+            continue;
+        }
+        if (a === "--window-end") {
+            const n = Number(rest[i + 1]);
+            if (!Number.isFinite(n))
+                return { error: "window-invalid" };
+            windowEnd = n;
+            i += 1;
+            continue;
+        }
+        if (a === "--out") {
+            const p = rest[i + 1];
+            if (!p || p.startsWith("-"))
+                return { error: "out-missing" };
+            outPath = p;
+            i += 1;
+            continue;
+        }
+        if (a === "--channel") {
+            const p = rest[i + 1];
+            if (p !== "card")
+                return { error: "channel-invalid" };
+            channel = "card";
+            i += 1;
+            continue;
+        }
+        if (a === "--currency") {
+            const p = rest[i + 1];
+            if (!p || p.startsWith("-"))
+                return { error: "currency-missing" };
+            currency = p;
+            i += 1;
+            continue;
+        }
+        if (a === "--columns") {
+            const p = rest[i + 1];
+            if (!p || p.startsWith("-"))
+                return { error: "columns-invalid" };
+            const parsed = parseColumns(p);
+            if (!parsed)
+                return { error: "columns-invalid" };
+            columns = parsed;
+            i += 1;
+            continue;
+        }
+        if (a === "--delimiter") {
+            const p = rest[i + 1];
+            if (p !== ";" && p !== ",")
+                return { error: "delimiter-invalid" };
+            delimiter = p;
+            i += 1;
+            continue;
+        }
+        if (a === "--tz-offset") {
+            const n = Number(rest[i + 1]);
+            if (!Number.isInteger(n) || Math.abs(n) > MAX_TZ_OFFSET_MIN)
+                return { error: "tz-offset-invalid" };
+            tzOffsetMinutes = n;
+            i += 1;
+            continue;
+        }
+        if (a === "--decimal") {
+            const p = rest[i + 1];
+            if (p !== "," && p !== ".")
+                return { error: "decimal-invalid" };
+            decimal = p;
+            i += 1;
+            continue;
+        }
+        if (a.startsWith("-"))
+            return { error: `flag-unknown:${a}` };
+        positionals.push(a);
+    }
+    const stateDir = positionals[0];
+    const channelPath = positionals[1];
+    if (!stateDir || !channelPath || !outPath) {
+        return { error: "usage" };
+    }
+    if (channel === "card" && !currency)
+        return { error: "currency-missing" };
+    if ((windowStart === undefined) !== (windowEnd === undefined)) {
+        return { error: "window-invalid" };
+    }
+    const window = windowStart !== undefined && windowEnd !== undefined
+        ? { startMs: windowStart, endMs: windowEnd }
+        : undefined;
+    return {
+        stateDir,
+        channelPath,
+        outPath,
+        toleranceMs: toleranceMs ?? (channel === "card" ? CARD_TOLERANCE_MS : 60_000),
+        window,
+        channel,
+        currency,
+        columns,
+        delimiter,
+        decimal,
+        tzOffsetMinutes,
+    };
+}
+function parseColumns(raw) {
+    const map = {};
+    for (const part of raw.split(",")) {
+        const eq = part.indexOf("=");
+        if (eq <= 0)
+            return null;
+        map[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();
+    }
+    if (!map.date || !map.amount || !map.desc)
+        return null;
+    return {
+        date: map.date,
+        amount: map.amount,
+        description: map.desc,
+        ...(map.id ? { id: map.id } : {}),
+    };
+}
+export function runReconcile(argv, writeErr = (s) => process.stderr.write(s)) {
+    const parsed = parseReconcileArgs(argv);
+    if ("error" in parsed) {
+        if (parsed.error === "usage") {
+            writeErr("verax reconcile <stateDir> <channel.jsonl> [--tolerance 60000] [--window-start ms --window-end ms] [--tz-offset 180] --out report.json\n");
+            return 78;
+        }
+        writeErr(`${parsed.error}\n`);
+        return 78;
+    }
+    try {
+        const raw = readFileSync(parsed.channelPath, "utf8");
+        const card = parsed.channel === "card" && parsed.currency
+            ? parseCardCsv(raw, {
+                currency: parsed.currency,
+                columns: parsed.columns,
+                delimiter: parsed.delimiter,
+                decimal: parsed.decimal,
+                tzOffsetMinutes: parsed.tzOffsetMinutes,
+            })
+            : undefined;
+        const channel = card ?? parseChannelJsonl(raw);
+        const effects = loadEffectsFromDir(parsed.stateDir);
+        const loaded = parsed.channel === "card" ? loadDescriptorsFromDir(parsed.stateDir) : undefined;
+        const descriptorsByPayee = loaded?.descriptorsByPayee;
+        const report = reconcile(channel, effects, {
+            toleranceMs: parsed.toleranceMs,
+            window: parsed.window,
+            approvals: parsed.channel === "card" ? loadApprovalsFromDir(parsed.stateDir) : undefined,
+            skipped: card?.skipped,
+            ...(descriptorsByPayee && Object.keys(descriptorsByPayee).length > 0
+                ? { descriptorsByPayee }
+                : {}),
+        });
+        if (loaded?.policyHash)
+            report.scope.policyHash = loaded.policyHash;
+        writeFileSync(parsed.outPath, `${JSON.stringify(report, null, 2)}\n`, { encoding: "utf8" });
+        if (parsed.channel === "card") {
+            const mismatch = report.ghost.filter((g) => g.reason === "amount-mismatch").length;
+            const unknown = report.ghost.filter((g) => g.reason === "amount-unknown").length;
+            writeErr(`matched ${report.matched.length} · ghost ${report.ghost.length} · authorizedUnpaid ${report.authorizedUnpaid.length} · mismatch ${mismatch} · unknown ${unknown}\n`);
+        }
+        return 0;
+    }
+    catch (err) {
+        const code = err.code ?? (err instanceof Error ? err.message : "unknown");
+        writeErr(`reconcile-failed:${code}\n`);
+        return 1;
+    }
+}

package/dist/revoke.d.ts

@@ -0,0 +1 @@
+export declare function isRevokedJti(stateDir: string, jti: string): boolean;

package/dist/revoke.js

@@ -0,0 +1,16 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+export function isRevokedJti(stateDir, jti) {
+    const path = join(stateDir, "revoked-jti.jsonl");
+    if (!existsSync(path))
+        return false;
+    const text = readFileSync(path, "utf8");
+    for (const line of text.split("\n")) {
+        if (line === "")
+            continue;
+        const row = JSON.parse(line);
+        if (row.jti === jti)
+            return true;
+    }
+    return false;
+}

package/dist/rp-config.d.ts

@@ -0,0 +1,15 @@
+export type RpConfig = {
+    rpID: string;
+    origins: string[];
+};
+/**
+ * WebAuthn will not take an IP address as an RP ID. The values come from the
+ * environment so a machine name never has to be written into the source.
+ */
+export declare function readRpConfig(env?: NodeJS.ProcessEnv): {
+    ok: true;
+    config: RpConfig;
+} | {
+    ok: false;
+    reason: string;
+};

package/dist/rp-config.js

@@ -0,0 +1,30 @@
+/**
+ * WebAuthn will not take an IP address as an RP ID. The values come from the
+ * environment so a machine name never has to be written into the source.
+ */
+export function readRpConfig(env = process.env) {
+    const rpID = (env.VERAX_RP_ID ?? "").trim();
+    const rawOrigins = (env.VERAX_RP_ORIGINS ?? "").trim();
+    if (rpID === "") {
+        return { ok: false, reason: "VERAX_RP_ID is unset" };
+    }
+    if (rawOrigins === "") {
+        return { ok: false, reason: "VERAX_RP_ORIGINS is unset" };
+    }
+    const origins = rawOrigins
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s !== "");
+    if (origins.length === 0) {
+        return { ok: false, reason: "VERAX_RP_ORIGINS is empty" };
+    }
+    for (const origin of origins) {
+        try {
+            new URL(origin);
+        }
+        catch {
+            return { ok: false, reason: `VERAX_RP_ORIGINS has an unparsable origin` };
+        }
+    }
+    return { ok: true, config: { rpID, origins } };
+}

package/dist/server.d.ts

@@ -0,0 +1,5 @@
+import { type Server } from "node:http";
+import type { BodyConfig } from "./config.ts";
+import { TOOL_NAMES } from "./wiring.ts";
+export declare function listen(config: BodyConfig): Promise<Server>;
+export { TOOL_NAMES };