approval-md 0.1.0 → 0.3.0

package/dist/src/channels/contract.js

@@ -49,8 +49,11 @@
  * `channels/conformance.ts`.
  */
 import { recordRefusedDecision } from "../core/decision-refusal.js";
-import { decide } from "../core/gate.js";
-import { attestationKeySha256, decideAttestation, isAttestationActionKey, openProposalFor, proposalPolicyPath, } from "../core/policy-proposal.js";
+import { decide, readGatePolicy, } from "../core/gate.js";
+import { actorForSender, isChannelDecisionRefusalCode, mapsSendersFor, recordedSenderFor, senderKeyFrom, senderRefusalLine, sendersDiffer, } from "../core/sender-identity.js";
+import { attestationKeySha256, decideAttestation, inForcePolicyText, isAttestationActionKey, openProposalFor, proposalPolicyPath, } from "../core/policy-proposal.js";
+import { payloadStoreDirFor } from "../core/payload-store.js";
+import { loadPolicyText } from "../core/policy-load.js";
 import { readVerifiedRecords } from "../core/state.js";
 import { tick } from "../core/clock.js";
 // ---------------------------------------------------------------------------
@@ -125,6 +128,13 @@ export const GLOSS_UNVERIFIED_SUFFIX = "(model, unverified)";
  * The wording of the first three is APRV-206's, moved here unchanged.
  */
 export function refusedDecisionLine(code) {
+    // APRV-324. The two the surface itself makes, worded where they are defined
+    // so one rule about what a refusal may disclose covers every channel: they
+    // name the code and nothing about the mapping — not who is mapped, not how
+    // many are, and not the id that was seen. The id is on the record, where an
+    // operator reads it deliberately; a chat is read by everyone in it.
+    if (isChannelDecisionRefusalCode(code))
+        return senderRefusalLine(code);
     if (code === "already-decided") {
         return "Already decided — the first answer stands; nothing was recorded.";
     }
@@ -137,6 +147,14 @@ export function refusedDecisionLine(code) {
     }
     if (code === "expired")
         return "Expired — the approval window has closed.";
+    // APRV-324 follow-up. The gate has always been able to return this; what
+    // changed is that a checkpoint signature and a review can too, because the
+    // sender mapping they resolve against is only in force once a human has
+    // attested the file it is written in. One sentence, every surface, and it
+    // names the repair rather than the check.
+    if (code === "policy-not-attested") {
+        return "Not recorded — APPROVAL.md has changed and nobody has attested it yet, so its rules are not in force. Re-attest it, or do this from a terminal.";
+    }
     // APRV-235, and the reason this helper exists. The distinction the line has to
     // carry is that nothing is wrong with the ACTION: the policy was re-attested
     // after the question was asked, so the rules on the approver's screen are not
@@ -340,7 +358,42 @@ export function recordChannelDecision(logPath, decision, actorOptions, gateOptio
     if (decision.batchDeliveryId !== undefined) {
         options.batchDeliveryId = decision.batchDeliveryId;
     }
-    const result = decide(logPath, decision.action_key, decision.decision, actorOptions.actor, options);
+    // APRV-324. Every surface names itself on the record it writes, so a reader
+    // of a grant can tell a tap on a phone from a line typed into a terminal. The
+    // fallback matches `noteRefusedDecision`'s below.
+    options.channel = actorOptions.channel ?? "cli";
+    // APRV-324, and before anything is decided: the actor a decision is recorded
+    // under is chosen HERE, from the sender the transport authenticated and the
+    // mapping the operator attested, and the gate's own authorization logic is
+    // untouched by it. `namesApprover` and `actor-not-approver` then run exactly
+    // as they always have, over an identity that is better evidenced.
+    const resolution = actorForSender(readGatePolicy(gateOptions), actorOptions.actor, decision.sender, 
+    // APRV-370. The operator's sender key, where the policy's mapping is keyed.
+    // `null` when it is unset, which is a REFUSAL of the whole channel rather
+    // than a fallback to the raw comparison; `sender-key-unavailable` carries
+    // the reasoning.
+    senderKeyFrom());
+    if (!resolution.ok) {
+        const refusal = {
+            ok: false,
+            code: resolution.code,
+            message: `decision on ${decision.action_key} refused: ${resolution.message}`,
+        };
+        // The refusal is the record. Nothing is decided, no token is minted, and
+        // the one append is the audit-tier statement that somebody tapped from an
+        // account this policy names nobody for — carrying the observed id, because
+        // an operator investigating who tried needs the number, and a transport
+        // account id is not a credential.
+        noteRefusedDecision(logPath, decision, { ...actorOptions, actor: null }, gateOptions, refusal, { sender: resolution.sender });
+        return { outcome: refusal };
+    }
+    const actor = resolution.actor;
+    if (resolution.sender !== undefined) {
+        options.sender = resolution.sender;
+        if (resolution.source !== undefined)
+            options.senderSource = resolution.source;
+    }
+    const result = decide(logPath, decision.action_key, decision.decision, actor, options);
     if (!result.ok) {
         // APRV-235. A human tapped and the gate would not take it. The gate itself
         // appends nothing on a refusal, by design; this surface knows something the
@@ -351,7 +404,24 @@ export function recordChannelDecision(logPath, decision, actorOptions, gateOptio
         // Best effort, deliberately last, and it changes nothing about what the
         // channel is handed back: the decision has already been refused, and a
         // failed audit append must not turn one refusal into two.
-        noteRefusedDecision(logPath, decision, actorOptions, gateOptions, result);
+        noteRefusedDecision(logPath, decision, { ...actorOptions, actor }, gateOptions, result, 
+        // APRV-324, and §11.1 invariant 9 is the reason for the exception. A
+        // `class-human-only` refusal says the policy does not transact in this
+        // class at all, so the runtime records no identity resolution for it: a
+        // refusal record naming the account a human-only tap came from would read
+        // afterwards as a class this gate resolves senders for. Every other
+        // refusal names the account, because the attention it accounts for was
+        // spent by whoever holds it.
+        // APRV-370: `resolution.sender`, never `decision.sender`. The resolution
+        // carries the sender in the form the record takes, which under a keyed
+        // mapping is the digest; writing the observed id here would put the raw
+        // account back in the log on exactly the refusals nobody looks at.
+        result.code === "class-human-only" || resolution.sender === undefined
+            ? {}
+            : {
+                sender: resolution.sender,
+                ...(resolution.source === undefined ? {} : { senderSource: resolution.source }),
+            });
         return { outcome: result };
     }
     const outcome = {
@@ -375,7 +445,7 @@ export function recordChannelDecision(logPath, decision, actorOptions, gateOptio
  * answer away from the human who is waiting for it. What a failure costs is the
  * record, which is exactly what the caller had before this existed.
  */
-function noteRefusedDecision(logPath, decision, actorOptions, gateOptions, refusal) {
+function noteRefusedDecision(logPath, decision, actorOptions, gateOptions, refusal, sender = {}) {
     try {
         recordRefusedDecision(logPath, {
             actionKey: decision.action_key,
@@ -385,10 +455,13 @@ function noteRefusedDecision(logPath, decision, actorOptions, gateOptions, refus
             // local process, which is what a decision that reached the runtime
             // through no channel at all came through.
             channel: actorOptions.channel ?? "cli",
+            ...sender,
         }, {
             code: refusal.code,
             message: refusal.message,
-            ...(refusal.drift === undefined ? {} : { drift: refusal.drift }),
+            // A surface-side refusal has made no policy comparison, so it carries no
+            // hashes; `in` rather than a cast, so the narrowing is the type system's.
+            ...("drift" in refusal && refusal.drift !== undefined ? { drift: refusal.drift } : {}),
         }, gateOptions);
     }
     catch {
@@ -437,6 +510,103 @@ function listenerPolicyPath(options) {
         return policy.file;
     return policy.dir === undefined ? null : proposalPolicyPath(policy.dir);
 }
+/**
+ * Who may attest, from a phone, and under whose rules (APRV-324 follow-up,
+ * amended SPEC.md §10.3).
+ *
+ * ## Why this is not the decision rule
+ *
+ * A decision is resolved against the policy in force, and so is this — but for
+ * an attestation the two candidate policies are different documents, and the
+ * difference is the whole problem. The tap answers a prompt about the LIVE
+ * file, which is the amendment; the amendment may add, remove or repoint the
+ * `senders` mapping itself. Resolving against the proposed file would let
+ * whoever edited it name their own account as the approver of their own edit,
+ * which is a gate that authorizes its own widening. So the oracle is the policy
+ * IN FORCE — the bytes the latest attestation names — and never the bytes being
+ * attested.
+ *
+ * ## The ladder
+ *
+ * 1. **No sender.** The terminal and the web page, which authenticate nobody.
+ *    Unchanged, and this is the path that keeps a repository recoverable: a
+ *    `policy.core` edit happens at a terminal anyway, so no mapping, however
+ *    broken, can strand the repair.
+ * 2. **In-force bytes recovered, and the amendment changes the mapping.** Only
+ *    an account the IN-FORCE policy maps may answer. Where the policy in force
+ *    maps nobody on this channel, nobody qualifies and the answer is
+ *    `attest-requires-terminal`: an amendment that introduces the identity
+ *    system cannot be signed for by the identity system it introduces.
+ * 3. **In-force bytes recovered, mapping unchanged.** The ordinary rule, run
+ *    against the policy in force: mapped answers, unmapped is refused.
+ * 4. **In-force bytes NOT recovered.** They frequently are not — an attestation
+ *    records only a digest, and a terminal attestation stores nothing
+ *    ({@link inForcePolicyText} says so in full). Then the runtime cannot tell
+ *    whether this amendment touches the mapping, so it refuses
+ *    `attest-requires-terminal` whenever the PROPOSED policy maps senders for
+ *    this channel, and otherwise behaves exactly as it did before this rule.
+ *
+ * The residual, stated rather than hidden: in case 4 an amendment that REMOVES
+ * a mapping is indistinguishable from a policy that never had one, so it falls
+ * to the pre-mapping behaviour. Closing that would need the in-force bytes,
+ * which is case 2; and reaching it requires an attacker who can already write
+ * `APPROVAL.md`, whom SPEC.md §11 already places inside the trust boundary.
+ */
+function resolveAttestationSender(logPath, records, decision, actorOptions, gateOptions, policyPath) {
+    const sender = decision.sender;
+    if (sender === undefined)
+        return { ok: true, actor: actorOptions.actor };
+    // APRV-370. Resolved ONCE for this whole ladder: the operator's sender key,
+    // and with it the form the refusals below record the account in. The form
+    // follows the FILE and the mapping follows the ATTESTATION
+    // (`recordedSenderFor` carries the reasoning), so a refusal that never
+    // reaches the in-force mapping still honours the disclosure preference the
+    // operator wrote down, and grants nobody anything by doing so.
+    const key = senderKeyFrom();
+    const proposed = readGatePolicy(gateOptions);
+    // The same store `proposeAttestation` wrote the policy text to, resolved the
+    // same way, so the bytes a prompt displayed and the bytes this reads back are
+    // never two different files.
+    const inForce = inForcePolicyText(records, gateOptions.payloadStoreDir ?? payloadStoreDirFor(logPath));
+    if (!inForce.ok) {
+        if (!mapsSendersFor(proposed.ok ? proposed.policy.approvers : undefined, sender.channel)) {
+            return { ok: true, actor: actorOptions.actor };
+        }
+        return {
+            ok: false,
+            code: "attest-requires-terminal",
+            sender: recordedSenderFor(proposed, sender, key),
+            message: `the policy being attested maps ${sender.channel} senders and the policy IN FORCE cannot be read to check who may sign for that: ${inForce.reason}. Resolving this tap against the file it is attesting would let whoever wrote that file name the account that approves it, so nothing was attested. Attest from a terminal, which authenticates no sender and is where a policy.core edit happens anyway.`,
+        };
+    }
+    const before = loadPolicyText(policyPath ?? "APPROVAL.md", inForce.text, gateOptions.schemaDir === undefined ? {} : { schemaDir: gateOptions.schemaDir });
+    if (sendersDiffer(before, proposed)) {
+        if (!mapsSendersFor(before.ok ? before.policy.approvers : undefined, sender.channel)) {
+            return {
+                ok: false,
+                code: "attest-requires-terminal",
+                sender: recordedSenderFor(before, sender, key),
+                message: `this amendment changes the sender mapping, and the policy in force maps no ${sender.channel} sender, so there is no account it could recognize as entitled to sign for that change. An amendment that introduces the identity system cannot be signed for by the identity system it introduces. Nothing was attested; attest from a terminal.`,
+            };
+        }
+        const resolution = actorForSender(before, actorOptions.actor, sender, key);
+        if (!resolution.ok)
+            return resolution;
+        // A mapped account under the policy in force. Belt and braces on the mode
+        // the ladder above already excluded: an amendment that changes the mapping
+        // is never answered on the configured identity.
+        if (resolution.sender === undefined) {
+            return {
+                ok: false,
+                code: "attest-requires-terminal",
+                sender: recordedSenderFor(before, sender, key),
+                message: `this amendment changes the sender mapping and this tap resolved to no account under the policy in force. Nothing was attested; attest from a terminal.`,
+            };
+        }
+        return resolution;
+    }
+    return actorForSender(before, actorOptions.actor, sender, key);
+}
 export function recordAttestationDecision(logPath, decision, actorOptions, gateOptions = {}) {
     const sha256 = attestationKeySha256(decision.action_key);
     if (sha256 === null) {
@@ -477,7 +647,30 @@ export function recordAttestationDecision(logPath, decision, actorOptions, gateO
     const policyPath = listenerPolicyPath(gateOptions);
     if (policyPath !== null)
         options.policyPath = policyPath;
-    const result = decideAttestation(logPath, proposal.seq, decision.decision === "grant" ? "attest" : "decline", actorOptions.actor, options);
+    // APRV-324 follow-up. The privileged gesture, resolved last and most
+    // carefully: an attestation decides which rules are in force, and the rules
+    // it can decide include the sender mapping itself.
+    const resolved = resolveAttestationSender(logPath, read.records, decision, actorOptions, gateOptions, policyPath);
+    if (!resolved.ok) {
+        const refusal = {
+            ok: false,
+            code: resolved.code,
+            message: `attestation of ${sha256} refused: ${resolved.message}`,
+        };
+        // The same audit-tier record a refused decision writes, and it fits without
+        // straining: the attestation prompt HAS an action key the log carries
+        // (`policy.attest:<sha256>`), and the gesture IS one of the two decision
+        // words this event's payload admits, because that is exactly how a tap on a
+        // prompt is routed to `attest` or `decline` above.
+        noteRefusedDecision(logPath, decision, { ...actorOptions, actor: null }, gateOptions, refusal, { sender: resolved.sender });
+        return { outcome: refusal };
+    }
+    if (resolved.sender !== undefined) {
+        options.sender = resolved.sender;
+        if (resolved.source !== undefined)
+            options.senderSource = resolved.source;
+    }
+    const result = decideAttestation(logPath, proposal.seq, decision.decision === "grant" ? "attest" : "decline", resolved.actor, options);
     if (!result.ok)
         return { outcome: result };
     return {

package/dist/src/channels/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/channels/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,MAAM,EAAwC,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yDAAyD;IACzD,KAAK;IACL,0FAA0F;IAC1F,cAAc;IACd,sDAAsD;IACtD,SAAS;IACT,kEAAkE;IAClE,aAAa;IACb;;;;OAIG;IACH,aAAa;IACb,4EAA4E;IAC5E,iBAAiB;IACjB;;;;;;;;;OASG;IACH,YAAY;IACZ,8DAA8D;IAC9D,OAAO;CACC,CAAC;AAsBX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,mBAAmB;IACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,2CAA2C,CAAC;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,kNAAkN,CAAC;IAC5N,CAAC;IACD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAI,KAAQ,EAAE,MAA+B;IACnE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAI,KAAQ,EAAE,MAAc;IACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AA2MD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,4EAA4E;IAC5E,yBAAyB;IACzB,0DAA0D;IAC1D,gBAAgB;CACR,CAAC;AAcX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+MAA+M;aACtQ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,CAAC,KAAK,wXAAwX;SACna,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8CAA8C,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,eAA2B,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,GAAG,0BAA0B,GAAG,eAAe,EAAE,CAAC;IAC/D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AA2ID,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAQ,OAA2B,CAAC,YAAY,KAAK,UAAU,CAAC;AACzE,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,8EAA8E;IAC9E,+EAA+E;IAC/E,iEAAiE;IACjE,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,EAAE;IACF,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,GAAG,WAAW,EAAE,CAAC;IAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CACnB,OAAO,EACP,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,QAAQ,EACjB,YAAY,CAAC,KAAK,EAClB,OAAO,CACR,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,0DAA0D;QAC1D,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS;KACxC,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAA0B,EAC1B,OAAoB;IAEpB,IAAI,CAAC;QACH,qBAAqB,CACnB,OAAO,EACP;YACE,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,0CAA0C;YAC1C,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,KAAK;SACvC,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SACjE,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAsB;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAClD,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,0IAA0I;aAC1L;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAExF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,2CAA2C,MAAM,iGAAiG;aAC5J;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA6B,EAAE,GAAG,WAAW,EAAE,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC/F,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAEzD,MAAM,MAAM,GAAG,iBAAiB,CAC9B,OAAO,EACP,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EACpD,YAAY,CAAC,KAAK,EAClB,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE3C,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAC7D,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/channels/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,MAAM,EACN,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,4BAA4B,EAC5B,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,aAAa,GAKd,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yDAAyD;IACzD,KAAK;IACL,0FAA0F;IAC1F,cAAc;IACd,sDAAsD;IACtD,SAAS;IACT,kEAAkE;IAClE,aAAa;IACb;;;;OAIG;IACH,aAAa;IACb,4EAA4E;IAC5E,iBAAiB;IACjB;;;;;;;;;OASG;IACH,YAAY;IACZ,8DAA8D;IAC9D,OAAO;CACC,CAAC;AAsBX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,4BAA4B,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,mBAAmB;IACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,2CAA2C,CAAC;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1C,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,OAAO,iJAAiJ,CAAC;IAC3J,CAAC;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,kNAAkN,CAAC;IAC5N,CAAC;IACD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAI,KAAQ,EAAE,MAA+B;IACnE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAI,KAAQ,EAAE,MAAc;IACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AA2MD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,4EAA4E;IAC5E,yBAAyB;IACzB,0DAA0D;IAC1D,gBAAgB;CACR,CAAC;AAcX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+MAA+M;aACtQ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,CAAC,KAAK,wXAAwX;SACna,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8CAA8C,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,eAA2B,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,GAAG,0BAA0B,GAAG,eAAe,EAAE,CAAC;IAC/D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AA6KD,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAQ,OAA2B,CAAC,YAAY,KAAK,UAAU,CAAC;AACzE,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,8EAA8E;IAC9E,+EAA+E;IAC/E,iEAAiE;IACjE,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,EAAE;IACF,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,GAAG,WAAW,EAAE,CAAC;IAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,kDAAkD;IAClD,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,IAAI,KAAK,CAAC;IAEhD,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,UAAU,GAAG,cAAc,CAC/B,cAAc,CAAC,WAAW,CAAC,EAC3B,YAAY,CAAC,KAAK,EAClB,QAAQ,CAAC,MAAM;IACf,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,iBAAiB;IACjB,aAAa,EAAE,CAChB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,aAAa,UAAU,CAAC,OAAO,EAAE;SAC7E,CAAC;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,kCAAkC;QAClC,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAChC,WAAW,EACX,OAAO,EACP,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAC9B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAEvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,0DAA0D;QAC1D,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,EAC1B,WAAW,EACX,MAAM;QACN,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,6BAA6B;QAC7B,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YACnE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;aAChF,CACN,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS;KACxC,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,QAAyB,EACzB,YAA2E,EAC3E,WAA0B,EAC1B,OAA6C,EAC7C,MAAM,GAA4D,EAAE;IAEpE,IAAI,CAAC;QACH,qBAAqB,CACnB,OAAO,EACP;YACE,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,0CAA0C;YAC1C,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,KAAK;YACtC,GAAG,MAAM;SACV,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,yEAAyE;YACzE,0EAA0E;YAC1E,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAsB;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAClD,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAS,wBAAwB,CAC/B,OAAe,EACf,OAA+B,EAC/B,QAAyB,EACzB,YAAiC,EACjC,WAA0B,EAC1B,UAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;IAEzE,4EAA4E;IAC5E,0EAA0E;IAC1E,2DAA2D;IAC3D,uEAAuE;IACvE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,OAAO,GAAG,iBAAiB,CAC/B,OAAO,EACP,WAAW,CAAC,eAAe,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAC3D,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC;YAChD,OAAO,EAAE,kCAAkC,MAAM,CAAC,OAAO,mFAAmF,OAAO,CAAC,MAAM,2PAA2P;SACtZ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAC3B,UAAU,IAAI,aAAa,EAC3B,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC9C,OAAO,EAAE,8EAA8E,MAAM,CAAC,OAAO,mPAAmP;aACzV,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,0EAA0E;QAC1E,2EAA2E;QAC3E,gDAAgD;QAChD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC9C,OAAO,EAAE,wJAAwJ;aAClK,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,0IAA0I;aAC1L;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAExF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,2CAA2C,MAAM,iGAAiG;aAC5J;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA6B,EAAE,GAAG,WAAW,EAAE,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC/F,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAEzD,qEAAqE;IACrE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CACvC,OAAO,EACP,IAAI,CAAC,OAAO,EACZ,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,kBAAkB,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;SACjE,CAAC;QACF,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,mDAAmD;QACnD,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAChC,WAAW,EACX,OAAO,EACP,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,OAAO,EACP,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EACpD,QAAQ,CAAC,KAAK,EACd,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE3C,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAC7D,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;AACJ,CAAC"}

package/dist/src/channels/payload-view.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The channel-side facade over the canonical renderer (APRV-119).
+ *
+ * Everything this module used to hold — the email view (APRV-100), the diff view
+ * (APRV-124), the command view and its injective escape marking (APRV-126), the
+ * classifier-derived breakdown and protected-path lines (APRV-143, APRV-144) —
+ * now lives in `core/wysiwys.ts`, absorbed into {@link canonicalRender}. It
+ * moved because the gate consults it: `core/gate.ts` computes the
+ * `display_hash` a request records at the write boundary from the same function
+ * the channels render with, and core cannot import channels.
+ *
+ * What is left here is the one function that needs a channel type, plus the
+ * re-exports that keep every existing import path working. A channel imports
+ * this; nothing else does.
+ */
+import type { PayloadRendering } from "./contract.js";
+export * from "../core/wysiwys.js";
+/**
+ * The text a channel puts inside its payload region (SPEC.md §10.4, §9).
+ *
+ * For a whole payload this is {@link canonicalRender}'s text verbatim, so the
+ * three channels present the same reading of the same bytes and the log's
+ * `display_hash` names it. Claimed material — the summary, the estimate, the
+ * rationale, a model's gloss — is never inside this region; each channel renders
+ * it above, under its own claimed heading.
+ *
+ * A **truncated** rendering has no canonical form and does not get one. The
+ * tagging layer cut `text` short at the caller's `maxPayloadChars`, so the bytes
+ * on screen are not the bytes the token will execute, and giving a partial
+ * payload the canonical block's authority is exactly the substitution WYSIWYS
+ * forbids. The pre-existing truncated text is returned unchanged, the channel's
+ * own "TRUNCATED — do not grant on it" marker still surrounds it, and
+ * `channels/batch.ts` still refuses to fold such a member into a batch.
+ */
+export declare function payloadRegionText(rendering: PayloadRendering, actionClass: string): string;

package/dist/src/channels/render-queue.d.ts

@@ -0,0 +1,149 @@
+/**
+ * `.approval/QUEUE.md` — the queue projection of SPEC.md §9.1.
+ *
+ * > **The queue** (`.approval/QUEUE.md`): a rendered, read-only markdown view of
+ * > pending requests (task, actions, declared effects, cost, TTL countdown) plus
+ * > the sampled-audit backlog. Regenerated on every relevant event. This is the
+ * > screenshot; it is never the truth.
+ *
+ * Three properties are the whole point of this module.
+ *
+ * **It is a pure function of (verified log, policy, `now`).** No ambient clock,
+ * no locale, no hostname, no environment, no random temp name in the bytes. The
+ * evaluation instant is a parameter — the same discipline `channels/tagging.ts`
+ * already keeps — so an identical log rendered at an identical `now` produces
+ * identical bytes, and a rendering can be reproduced later from the log alone.
+ * Every number here is formatted by hand with integer arithmetic for the same
+ * reason: `toLocaleString` would make the output depend on the machine.
+ *
+ * **It re-derives nothing.** Entries come from
+ * {@link buildPendingQueue}, which is the one place a {@link ChannelRequest} is
+ * built. So the class, the autonomy, the provenance, the budgets, the
+ * attestation and the TTL a reader sees in QUEUE.md are the same answers the
+ * gate itself would give — not a second implementation that could drift. This
+ * module's entire job is text.
+ *
+ * **It never writes the log.** {@link writeQueue} writes exactly one file, and
+ * it is `QUEUE.md`.
+ *
+ * ## Why this lives in `src/channels/`, not `src/core/`
+ *
+ * It consumes `channels/contract.ts`'s tagged requests through
+ * `channels/tagging.ts`. Putting it in `core/` would make core import channels,
+ * inverting the dependency the codebase is built on: core decides, channels
+ * display, and this file is display — a read-only markdown surface that collects
+ * no gesture and holds no authority. It sits beside `tagging.ts` and `batch.ts`
+ * because it is the third consumer of the same tagged data, and it deliberately
+ * does not implement {@link ../channels/contract.js Channel}: QUEUE.md notifies
+ * nobody and answers nothing.
+ *
+ * ## B3: computed vs claimed
+ *
+ * SPEC.md §9: "Every displayed field is one of two kinds and MUST be visibly
+ * distinguished". Here that is structural, not typographic: computed fields are
+ * rendered as `computed · <source>` lines under **Computed by the runtime**, and
+ * claimed fields under a separate **Claimed by `<actor>` (not verified)** block
+ * that names its author. A reader skimming the file cannot mistake an agent's
+ * cost estimate for a budget verdict, because they are not in the same list.
+ *
+ * ## The full payload is NOT in this file — flagged for human review
+ *
+ * SPEC.md §10.4 requires channels to present the full payload before collecting
+ * a decision. QUEUE.md collects no decision: it is a read-only summary, and the
+ * decision surfaces are the channels (`approval grant`, the web page, Telegram),
+ * each of which presents the bytes at decision time. Inlining payloads here
+ * would put every pending payload — recipients, bodies, argv — into a file that
+ * is regenerated on every event, checked into nothing, and read by anyone with
+ * the working directory, with no gesture ever collected from it. So the queue
+ * carries the **binding** (`payload_hash`) and points at the channels for the
+ * bytes, and the rendered header says exactly that to the human reading it.
+ *
+ * Which is a different statement from "the renderer cannot see the payload".
+ * Since APRV-28 it can: `channels/tagging.ts` reads the payload store beside the
+ * log (SPEC.md §6.2's "the payload itself is stored or referenced by the request
+ * so channels can display it"), so a request whose bytes were supplied at intake
+ * is *summarizable* here and appears in the pending section — which is why this
+ * file's pending count now agrees with the queue every channel shows, where
+ * before it silently disagreed. The bytes still do not appear in this file.
+ * Requests whose material nobody holds remain in {@link QueueRender.skipped},
+ * rendered in their own section with the reason, never silently dropped.
+ */
+import type { LogHead } from "../core/log.js";
+import { type TagOptions } from "./tagging.js";
+/**
+ * Rendering options. A superset of {@link TagOptions} with nothing added: the
+ * renderer's inputs are exactly the tagger's inputs, plus `now`, because it
+ * derives nothing the tagger does not already derive.
+ */
+export type RenderQueueOptions = TagOptions;
+/**
+ * Why the renderer refused.
+ *
+ * The three log codes are `channels/tagging.ts`'s and `core/state.ts`'s,
+ * verbatim, so a corrupt log is reported as corruption by every layer with one
+ * vocabulary. `write-failed` is {@link writeQueue}'s alone — the renderer itself
+ * cannot fail for any other reason, because it is a pure function.
+ */
+export declare const RENDER_QUEUE_REFUSAL_CODES: readonly ["log-unreadable", "log-torn-tail", "log-corrupt", "write-failed"];
+export type RenderQueueRefusalCode = (typeof RENDER_QUEUE_REFUSAL_CODES)[number];
+export interface RenderQueueRefusal {
+    ok: false;
+    code: RenderQueueRefusalCode;
+    message: string;
+}
+/** A successful render: the bytes, plus what went into them. */
+export interface QueueRender {
+    ok: true;
+    /** The complete file contents. Deterministic for a given (log, policy, now). */
+    markdown: string;
+    /** The chain head the render derives from; `null` for an empty log. */
+    head: LogHead | null;
+    /** Pending requests rendered, in log order. */
+    pending: number;
+    /** Live requests that could not be tagged, listed with their reason. */
+    skipped: number;
+    /** `audit.sampled` events with no later `audit.reviewed`. */
+    auditBacklog: number;
+}
+export type RenderQueueResult = QueueRender | RenderQueueRefusal;
+export interface QueueWrite extends Omit<QueueRender, "markdown"> {
+    /** Where the file was written. */
+    path: string;
+    /** Bytes written (UTF-8). */
+    bytes: number;
+}
+export type WriteQueueResult = QueueWrite | RenderQueueRefusal;
+/**
+ * Render the queue.
+ *
+ * Deterministic in the strong sense: for a fixed log, policy and `now`, the
+ * returned string is byte-identical across processes and machines. Nothing here
+ * reads a clock, a locale, an environment variable, or a hostname.
+ *
+ * Expiry is not this module's judgment: `channels/tagging.ts` derives state
+ * through `core/state.ts` with the policy TTL and the same `now`, so a request
+ * whose TTL has elapsed is `expired`, not `requested`, and never reaches the
+ * pending section. The countdown a reader sees therefore never reaches zero on
+ * a listed entry.
+ *
+ * The verified read happens twice — once here for the head and the audit
+ * records, once inside {@link buildPendingQueue} — which is a deliberate trade:
+ * a second walk of the chain costs a few milliseconds on a rendering path, and
+ * the alternative is widening the tagger's public result to carry records it
+ * has no other reason to expose.
+ */
+export declare function renderQueue(logPath: string, options: RenderQueueOptions, now: string): RenderQueueResult;
+/**
+ * Render and write `.approval/QUEUE.md` atomically.
+ *
+ * Temp file in the destination directory, `fsync`, then `rename` — a reader
+ * either sees the previous complete rendering or the new one, never a half-
+ * written queue. The temp name is the only non-deterministic byte anywhere in
+ * this module and it never reaches the file's contents; it is removed on every
+ * failure path, so a failed render leaves no debris beside the queue.
+ *
+ * Writes this one file and nothing else. In particular it does not touch the
+ * log: the log is opened read-only by the verified read and is not reopened
+ * here.
+ */
+export declare function writeQueue(logPath: string, queuePath: string, options: RenderQueueOptions, now: string): WriteQueueResult;