approval-md 0.2.0 → 0.3.0

package/dist/src/channels/contract.d.ts

@@ -51,6 +51,7 @@
 import type { AttestationStatus } from "../core/attest.js";
 import type { BudgetVerdict } from "../core/budgets.js";
 import { type DecideOptions, type GateRefusal } from "../core/gate.js";
+import { type ChannelDecisionRefusalCode, type ChannelSender } from "../core/sender-identity.js";
 import type { EventRecord } from "../core/log.js";
 import type { Autonomy } from "../core/policy-load.js";
 import type { Provenance } from "../core/policy-match.js";
@@ -450,6 +451,27 @@ export declare function batchDeliveryIdOf(record: EventRecord): DeliveryId | nul
 /** A human gesture, as reported by a channel. Never an authorization. */
 export interface ChannelDecision {
     action_key: string;
+    /**
+     * The sender the channel's own transport authenticated for THIS gesture
+     * (APRV-324, `design/channel-sender-identity.md` §3.2).
+     *
+     * The design put this on {@link ChannelActorOptions}; it lives here instead,
+     * because the sender is a property of one tap and that object is a property of
+     * the listener. `onDecision` registers one handler for the process, and the
+     * only thing that varies per gesture is this value — a per-listener field
+     * could not carry it, and giving each listener a mutable slot to stash it in
+     * would be exactly the channel-held state SPEC.md §10.3 forbids.
+     *
+     * It is an OBSERVATION and never an assertion of authority. The channel does
+     * not resolve it, cannot choose the actor with it, and must read it from the
+     * transport's own attribution: Telegram's `callback_query.from.id`, and
+     * nothing a message body, a callback payload or a username says (§11.1
+     * invariant 4). A channel that authenticates nobody — the web page, the
+     * terminal — sets nothing here, and a `sender` field arriving in one of their
+     * request bodies is ignored rather than honoured, because a surface that
+     * cannot authenticate a person must not be able to claim one.
+     */
+    sender?: ChannelSender;
     /**
      * What the human did. `revoke` is deliberately absent: withdrawing a standing
      * authorization is a considered act performed against the log through the
@@ -471,6 +493,17 @@ export interface ChannelDecision {
  * {@link recordChannelDecision} in {@link ChannelDecisionResult.token}, never in
  * this value. A channel learns that a grant landed, not how to spend it.
  */
+/**
+ * A refusal made by the decision SURFACE, before the gate is called
+ * (APRV-324). Its codes are {@link CHANNEL_DECISION_REFUSAL_CODES}, a union of
+ * its own: `decide` cannot emit them, and folding them into the gate's
+ * vocabulary would tell a second implementation that its gate must.
+ */
+export interface ChannelDecisionRefusal {
+    ok: false;
+    code: ChannelDecisionRefusalCode;
+    message: string;
+}
 export type DecisionOutcome = {
     ok: true;
     action_key: string;
@@ -489,7 +522,7 @@ export type DecisionOutcome = {
      * whose token was never this surface's to hold.
      */
     tokenIssued: boolean;
-} | GateRefusal;
+} | GateRefusal | ChannelDecisionRefusal;
 /** A channel's self-report. `detail` explains a `false`; SPEC.md §10.2 polls it. */
 export interface ChannelHealth {
     ok: boolean;

package/dist/src/channels/contract.js

@@ -49,8 +49,11 @@
  * `channels/conformance.ts`.
  */
 import { recordRefusedDecision } from "../core/decision-refusal.js";
-import { decide } from "../core/gate.js";
-import { attestationKeySha256, decideAttestation, isAttestationActionKey, openProposalFor, proposalPolicyPath, } from "../core/policy-proposal.js";
+import { decide, readGatePolicy, } from "../core/gate.js";
+import { actorForSender, isChannelDecisionRefusalCode, mapsSendersFor, recordedSenderFor, senderKeyFrom, senderRefusalLine, sendersDiffer, } from "../core/sender-identity.js";
+import { attestationKeySha256, decideAttestation, inForcePolicyText, isAttestationActionKey, openProposalFor, proposalPolicyPath, } from "../core/policy-proposal.js";
+import { payloadStoreDirFor } from "../core/payload-store.js";
+import { loadPolicyText } from "../core/policy-load.js";
 import { readVerifiedRecords } from "../core/state.js";
 import { tick } from "../core/clock.js";
 // ---------------------------------------------------------------------------
@@ -125,6 +128,13 @@ export const GLOSS_UNVERIFIED_SUFFIX = "(model, unverified)";
  * The wording of the first three is APRV-206's, moved here unchanged.
  */
 export function refusedDecisionLine(code) {
+    // APRV-324. The two the surface itself makes, worded where they are defined
+    // so one rule about what a refusal may disclose covers every channel: they
+    // name the code and nothing about the mapping — not who is mapped, not how
+    // many are, and not the id that was seen. The id is on the record, where an
+    // operator reads it deliberately; a chat is read by everyone in it.
+    if (isChannelDecisionRefusalCode(code))
+        return senderRefusalLine(code);
     if (code === "already-decided") {
         return "Already decided — the first answer stands; nothing was recorded.";
     }
@@ -137,6 +147,14 @@ export function refusedDecisionLine(code) {
     }
     if (code === "expired")
         return "Expired — the approval window has closed.";
+    // APRV-324 follow-up. The gate has always been able to return this; what
+    // changed is that a checkpoint signature and a review can too, because the
+    // sender mapping they resolve against is only in force once a human has
+    // attested the file it is written in. One sentence, every surface, and it
+    // names the repair rather than the check.
+    if (code === "policy-not-attested") {
+        return "Not recorded — APPROVAL.md has changed and nobody has attested it yet, so its rules are not in force. Re-attest it, or do this from a terminal.";
+    }
     // APRV-235, and the reason this helper exists. The distinction the line has to
     // carry is that nothing is wrong with the ACTION: the policy was re-attested
     // after the question was asked, so the rules on the approver's screen are not
@@ -340,7 +358,42 @@ export function recordChannelDecision(logPath, decision, actorOptions, gateOptio
     if (decision.batchDeliveryId !== undefined) {
         options.batchDeliveryId = decision.batchDeliveryId;
     }
-    const result = decide(logPath, decision.action_key, decision.decision, actorOptions.actor, options);
+    // APRV-324. Every surface names itself on the record it writes, so a reader
+    // of a grant can tell a tap on a phone from a line typed into a terminal. The
+    // fallback matches `noteRefusedDecision`'s below.
+    options.channel = actorOptions.channel ?? "cli";
+    // APRV-324, and before anything is decided: the actor a decision is recorded
+    // under is chosen HERE, from the sender the transport authenticated and the
+    // mapping the operator attested, and the gate's own authorization logic is
+    // untouched by it. `namesApprover` and `actor-not-approver` then run exactly
+    // as they always have, over an identity that is better evidenced.
+    const resolution = actorForSender(readGatePolicy(gateOptions), actorOptions.actor, decision.sender, 
+    // APRV-370. The operator's sender key, where the policy's mapping is keyed.
+    // `null` when it is unset, which is a REFUSAL of the whole channel rather
+    // than a fallback to the raw comparison; `sender-key-unavailable` carries
+    // the reasoning.
+    senderKeyFrom());
+    if (!resolution.ok) {
+        const refusal = {
+            ok: false,
+            code: resolution.code,
+            message: `decision on ${decision.action_key} refused: ${resolution.message}`,
+        };
+        // The refusal is the record. Nothing is decided, no token is minted, and
+        // the one append is the audit-tier statement that somebody tapped from an
+        // account this policy names nobody for — carrying the observed id, because
+        // an operator investigating who tried needs the number, and a transport
+        // account id is not a credential.
+        noteRefusedDecision(logPath, decision, { ...actorOptions, actor: null }, gateOptions, refusal, { sender: resolution.sender });
+        return { outcome: refusal };
+    }
+    const actor = resolution.actor;
+    if (resolution.sender !== undefined) {
+        options.sender = resolution.sender;
+        if (resolution.source !== undefined)
+            options.senderSource = resolution.source;
+    }
+    const result = decide(logPath, decision.action_key, decision.decision, actor, options);
     if (!result.ok) {
         // APRV-235. A human tapped and the gate would not take it. The gate itself
         // appends nothing on a refusal, by design; this surface knows something the
@@ -351,7 +404,24 @@ export function recordChannelDecision(logPath, decision, actorOptions, gateOptio
         // Best effort, deliberately last, and it changes nothing about what the
         // channel is handed back: the decision has already been refused, and a
         // failed audit append must not turn one refusal into two.
-        noteRefusedDecision(logPath, decision, actorOptions, gateOptions, result);
+        noteRefusedDecision(logPath, decision, { ...actorOptions, actor }, gateOptions, result, 
+        // APRV-324, and §11.1 invariant 9 is the reason for the exception. A
+        // `class-human-only` refusal says the policy does not transact in this
+        // class at all, so the runtime records no identity resolution for it: a
+        // refusal record naming the account a human-only tap came from would read
+        // afterwards as a class this gate resolves senders for. Every other
+        // refusal names the account, because the attention it accounts for was
+        // spent by whoever holds it.
+        // APRV-370: `resolution.sender`, never `decision.sender`. The resolution
+        // carries the sender in the form the record takes, which under a keyed
+        // mapping is the digest; writing the observed id here would put the raw
+        // account back in the log on exactly the refusals nobody looks at.
+        result.code === "class-human-only" || resolution.sender === undefined
+            ? {}
+            : {
+                sender: resolution.sender,
+                ...(resolution.source === undefined ? {} : { senderSource: resolution.source }),
+            });
         return { outcome: result };
     }
     const outcome = {
@@ -375,7 +445,7 @@ export function recordChannelDecision(logPath, decision, actorOptions, gateOptio
  * answer away from the human who is waiting for it. What a failure costs is the
  * record, which is exactly what the caller had before this existed.
  */
-function noteRefusedDecision(logPath, decision, actorOptions, gateOptions, refusal) {
+function noteRefusedDecision(logPath, decision, actorOptions, gateOptions, refusal, sender = {}) {
     try {
         recordRefusedDecision(logPath, {
             actionKey: decision.action_key,
@@ -385,10 +455,13 @@ function noteRefusedDecision(logPath, decision, actorOptions, gateOptions, refus
             // local process, which is what a decision that reached the runtime
             // through no channel at all came through.
             channel: actorOptions.channel ?? "cli",
+            ...sender,
         }, {
             code: refusal.code,
             message: refusal.message,
-            ...(refusal.drift === undefined ? {} : { drift: refusal.drift }),
+            // A surface-side refusal has made no policy comparison, so it carries no
+            // hashes; `in` rather than a cast, so the narrowing is the type system's.
+            ...("drift" in refusal && refusal.drift !== undefined ? { drift: refusal.drift } : {}),
         }, gateOptions);
     }
     catch {
@@ -437,6 +510,103 @@ function listenerPolicyPath(options) {
         return policy.file;
     return policy.dir === undefined ? null : proposalPolicyPath(policy.dir);
 }
+/**
+ * Who may attest, from a phone, and under whose rules (APRV-324 follow-up,
+ * amended SPEC.md §10.3).
+ *
+ * ## Why this is not the decision rule
+ *
+ * A decision is resolved against the policy in force, and so is this — but for
+ * an attestation the two candidate policies are different documents, and the
+ * difference is the whole problem. The tap answers a prompt about the LIVE
+ * file, which is the amendment; the amendment may add, remove or repoint the
+ * `senders` mapping itself. Resolving against the proposed file would let
+ * whoever edited it name their own account as the approver of their own edit,
+ * which is a gate that authorizes its own widening. So the oracle is the policy
+ * IN FORCE — the bytes the latest attestation names — and never the bytes being
+ * attested.
+ *
+ * ## The ladder
+ *
+ * 1. **No sender.** The terminal and the web page, which authenticate nobody.
+ *    Unchanged, and this is the path that keeps a repository recoverable: a
+ *    `policy.core` edit happens at a terminal anyway, so no mapping, however
+ *    broken, can strand the repair.
+ * 2. **In-force bytes recovered, and the amendment changes the mapping.** Only
+ *    an account the IN-FORCE policy maps may answer. Where the policy in force
+ *    maps nobody on this channel, nobody qualifies and the answer is
+ *    `attest-requires-terminal`: an amendment that introduces the identity
+ *    system cannot be signed for by the identity system it introduces.
+ * 3. **In-force bytes recovered, mapping unchanged.** The ordinary rule, run
+ *    against the policy in force: mapped answers, unmapped is refused.
+ * 4. **In-force bytes NOT recovered.** They frequently are not — an attestation
+ *    records only a digest, and a terminal attestation stores nothing
+ *    ({@link inForcePolicyText} says so in full). Then the runtime cannot tell
+ *    whether this amendment touches the mapping, so it refuses
+ *    `attest-requires-terminal` whenever the PROPOSED policy maps senders for
+ *    this channel, and otherwise behaves exactly as it did before this rule.
+ *
+ * The residual, stated rather than hidden: in case 4 an amendment that REMOVES
+ * a mapping is indistinguishable from a policy that never had one, so it falls
+ * to the pre-mapping behaviour. Closing that would need the in-force bytes,
+ * which is case 2; and reaching it requires an attacker who can already write
+ * `APPROVAL.md`, whom SPEC.md §11 already places inside the trust boundary.
+ */
+function resolveAttestationSender(logPath, records, decision, actorOptions, gateOptions, policyPath) {
+    const sender = decision.sender;
+    if (sender === undefined)
+        return { ok: true, actor: actorOptions.actor };
+    // APRV-370. Resolved ONCE for this whole ladder: the operator's sender key,
+    // and with it the form the refusals below record the account in. The form
+    // follows the FILE and the mapping follows the ATTESTATION
+    // (`recordedSenderFor` carries the reasoning), so a refusal that never
+    // reaches the in-force mapping still honours the disclosure preference the
+    // operator wrote down, and grants nobody anything by doing so.
+    const key = senderKeyFrom();
+    const proposed = readGatePolicy(gateOptions);
+    // The same store `proposeAttestation` wrote the policy text to, resolved the
+    // same way, so the bytes a prompt displayed and the bytes this reads back are
+    // never two different files.
+    const inForce = inForcePolicyText(records, gateOptions.payloadStoreDir ?? payloadStoreDirFor(logPath));
+    if (!inForce.ok) {
+        if (!mapsSendersFor(proposed.ok ? proposed.policy.approvers : undefined, sender.channel)) {
+            return { ok: true, actor: actorOptions.actor };
+        }
+        return {
+            ok: false,
+            code: "attest-requires-terminal",
+            sender: recordedSenderFor(proposed, sender, key),
+            message: `the policy being attested maps ${sender.channel} senders and the policy IN FORCE cannot be read to check who may sign for that: ${inForce.reason}. Resolving this tap against the file it is attesting would let whoever wrote that file name the account that approves it, so nothing was attested. Attest from a terminal, which authenticates no sender and is where a policy.core edit happens anyway.`,
+        };
+    }
+    const before = loadPolicyText(policyPath ?? "APPROVAL.md", inForce.text, gateOptions.schemaDir === undefined ? {} : { schemaDir: gateOptions.schemaDir });
+    if (sendersDiffer(before, proposed)) {
+        if (!mapsSendersFor(before.ok ? before.policy.approvers : undefined, sender.channel)) {
+            return {
+                ok: false,
+                code: "attest-requires-terminal",
+                sender: recordedSenderFor(before, sender, key),
+                message: `this amendment changes the sender mapping, and the policy in force maps no ${sender.channel} sender, so there is no account it could recognize as entitled to sign for that change. An amendment that introduces the identity system cannot be signed for by the identity system it introduces. Nothing was attested; attest from a terminal.`,
+            };
+        }
+        const resolution = actorForSender(before, actorOptions.actor, sender, key);
+        if (!resolution.ok)
+            return resolution;
+        // A mapped account under the policy in force. Belt and braces on the mode
+        // the ladder above already excluded: an amendment that changes the mapping
+        // is never answered on the configured identity.
+        if (resolution.sender === undefined) {
+            return {
+                ok: false,
+                code: "attest-requires-terminal",
+                sender: recordedSenderFor(before, sender, key),
+                message: `this amendment changes the sender mapping and this tap resolved to no account under the policy in force. Nothing was attested; attest from a terminal.`,
+            };
+        }
+        return resolution;
+    }
+    return actorForSender(before, actorOptions.actor, sender, key);
+}
 export function recordAttestationDecision(logPath, decision, actorOptions, gateOptions = {}) {
     const sha256 = attestationKeySha256(decision.action_key);
     if (sha256 === null) {
@@ -477,7 +647,30 @@ export function recordAttestationDecision(logPath, decision, actorOptions, gateO
     const policyPath = listenerPolicyPath(gateOptions);
     if (policyPath !== null)
         options.policyPath = policyPath;
-    const result = decideAttestation(logPath, proposal.seq, decision.decision === "grant" ? "attest" : "decline", actorOptions.actor, options);
+    // APRV-324 follow-up. The privileged gesture, resolved last and most
+    // carefully: an attestation decides which rules are in force, and the rules
+    // it can decide include the sender mapping itself.
+    const resolved = resolveAttestationSender(logPath, read.records, decision, actorOptions, gateOptions, policyPath);
+    if (!resolved.ok) {
+        const refusal = {
+            ok: false,
+            code: resolved.code,
+            message: `attestation of ${sha256} refused: ${resolved.message}`,
+        };
+        // The same audit-tier record a refused decision writes, and it fits without
+        // straining: the attestation prompt HAS an action key the log carries
+        // (`policy.attest:<sha256>`), and the gesture IS one of the two decision
+        // words this event's payload admits, because that is exactly how a tap on a
+        // prompt is routed to `attest` or `decline` above.
+        noteRefusedDecision(logPath, decision, { ...actorOptions, actor: null }, gateOptions, refusal, { sender: resolved.sender });
+        return { outcome: refusal };
+    }
+    if (resolved.sender !== undefined) {
+        options.sender = resolved.sender;
+        if (resolved.source !== undefined)
+            options.senderSource = resolved.source;
+    }
+    const result = decideAttestation(logPath, proposal.seq, decision.decision === "grant" ? "attest" : "decline", resolved.actor, options);
     if (!result.ok)
         return { outcome: result };
     return {

package/dist/src/channels/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/channels/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,MAAM,EAAwC,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yDAAyD;IACzD,KAAK;IACL,0FAA0F;IAC1F,cAAc;IACd,sDAAsD;IACtD,SAAS;IACT,kEAAkE;IAClE,aAAa;IACb;;;;OAIG;IACH,aAAa;IACb,4EAA4E;IAC5E,iBAAiB;IACjB;;;;;;;;;OASG;IACH,YAAY;IACZ,8DAA8D;IAC9D,OAAO;CACC,CAAC;AAsBX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,mBAAmB;IACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,2CAA2C,CAAC;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,kNAAkN,CAAC;IAC5N,CAAC;IACD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAI,KAAQ,EAAE,MAA+B;IACnE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAI,KAAQ,EAAE,MAAc;IACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AA2MD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,4EAA4E;IAC5E,yBAAyB;IACzB,0DAA0D;IAC1D,gBAAgB;CACR,CAAC;AAcX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+MAA+M;aACtQ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,CAAC,KAAK,wXAAwX;SACna,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8CAA8C,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,eAA2B,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,GAAG,0BAA0B,GAAG,eAAe,EAAE,CAAC;IAC/D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AA2ID,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAQ,OAA2B,CAAC,YAAY,KAAK,UAAU,CAAC;AACzE,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,8EAA8E;IAC9E,+EAA+E;IAC/E,iEAAiE;IACjE,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,EAAE;IACF,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,GAAG,WAAW,EAAE,CAAC;IAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CACnB,OAAO,EACP,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,QAAQ,EACjB,YAAY,CAAC,KAAK,EAClB,OAAO,CACR,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,0DAA0D;QAC1D,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS;KACxC,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAA0B,EAC1B,OAAoB;IAEpB,IAAI,CAAC;QACH,qBAAqB,CACnB,OAAO,EACP;YACE,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,0CAA0C;YAC1C,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,KAAK;SACvC,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SACjE,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAsB;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAClD,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,0IAA0I;aAC1L;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAExF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,2CAA2C,MAAM,iGAAiG;aAC5J;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA6B,EAAE,GAAG,WAAW,EAAE,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC/F,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAEzD,MAAM,MAAM,GAAG,iBAAiB,CAC9B,OAAO,EACP,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EACpD,YAAY,CAAC,KAAK,EAClB,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE3C,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAC7D,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/channels/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,MAAM,EACN,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,4BAA4B,EAC5B,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,aAAa,GAKd,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yDAAyD;IACzD,KAAK;IACL,0FAA0F;IAC1F,cAAc;IACd,sDAAsD;IACtD,SAAS;IACT,kEAAkE;IAClE,aAAa;IACb;;;;OAIG;IACH,aAAa;IACb,4EAA4E;IAC5E,iBAAiB;IACjB;;;;;;;;;OASG;IACH,YAAY;IACZ,8DAA8D;IAC9D,OAAO;CACC,CAAC;AAsBX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,4BAA4B,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,mBAAmB;IACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,2CAA2C,CAAC;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1C,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,OAAO,iJAAiJ,CAAC;IAC3J,CAAC;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,kNAAkN,CAAC;IAC5N,CAAC;IACD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAI,KAAQ,EAAE,MAA+B;IACnE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAI,KAAQ,EAAE,MAAc;IACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AA2MD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,4EAA4E;IAC5E,yBAAyB;IACzB,0DAA0D;IAC1D,gBAAgB;CACR,CAAC;AAcX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+MAA+M;aACtQ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,CAAC,KAAK,wXAAwX;SACna,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8CAA8C,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,eAA2B,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,GAAG,0BAA0B,GAAG,eAAe,EAAE,CAAC;IAC/D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AA6KD,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAQ,OAA2B,CAAC,YAAY,KAAK,UAAU,CAAC;AACzE,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,8EAA8E;IAC9E,+EAA+E;IAC/E,iEAAiE;IACjE,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,EAAE;IACF,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,GAAG,WAAW,EAAE,CAAC;IAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,kDAAkD;IAClD,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,IAAI,KAAK,CAAC;IAEhD,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,UAAU,GAAG,cAAc,CAC/B,cAAc,CAAC,WAAW,CAAC,EAC3B,YAAY,CAAC,KAAK,EAClB,QAAQ,CAAC,MAAM;IACf,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,iBAAiB;IACjB,aAAa,EAAE,CAChB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,aAAa,UAAU,CAAC,OAAO,EAAE;SAC7E,CAAC;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,kCAAkC;QAClC,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAChC,WAAW,EACX,OAAO,EACP,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAC9B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAEvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,0DAA0D;QAC1D,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,EAC1B,WAAW,EACX,MAAM;QACN,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,6BAA6B;QAC7B,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YACnE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;aAChF,CACN,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS;KACxC,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,QAAyB,EACzB,YAA2E,EAC3E,WAA0B,EAC1B,OAA6C,EAC7C,MAAM,GAA4D,EAAE;IAEpE,IAAI,CAAC;QACH,qBAAqB,CACnB,OAAO,EACP;YACE,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,0CAA0C;YAC1C,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,KAAK;YACtC,GAAG,MAAM;SACV,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,yEAAyE;YACzE,0EAA0E;YAC1E,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAsB;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAClD,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAS,wBAAwB,CAC/B,OAAe,EACf,OAA+B,EAC/B,QAAyB,EACzB,YAAiC,EACjC,WAA0B,EAC1B,UAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;IAEzE,4EAA4E;IAC5E,0EAA0E;IAC1E,2DAA2D;IAC3D,uEAAuE;IACvE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,OAAO,GAAG,iBAAiB,CAC/B,OAAO,EACP,WAAW,CAAC,eAAe,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAC3D,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC;YAChD,OAAO,EAAE,kCAAkC,MAAM,CAAC,OAAO,mFAAmF,OAAO,CAAC,MAAM,2PAA2P;SACtZ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAC3B,UAAU,IAAI,aAAa,EAC3B,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC9C,OAAO,EAAE,8EAA8E,MAAM,CAAC,OAAO,mPAAmP;aACzV,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,0EAA0E;QAC1E,2EAA2E;QAC3E,gDAAgD;QAChD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC9C,OAAO,EAAE,wJAAwJ;aAClK,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,0IAA0I;aAC1L;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAExF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,2CAA2C,MAAM,iGAAiG;aAC5J;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA6B,EAAE,GAAG,WAAW,EAAE,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC/F,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAEzD,qEAAqE;IACrE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CACvC,OAAO,EACP,IAAI,CAAC,OAAO,EACZ,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,kBAAkB,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;SACjE,CAAC;QACF,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,mDAAmD;QACnD,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAChC,WAAW,EACX,OAAO,EACP,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,OAAO,EACP,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EACpD,QAAQ,CAAC,KAAK,EACd,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE3C,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAC7D,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;AACJ,CAAC"}

package/dist/src/channels/telegram.d.ts

@@ -40,16 +40,35 @@
  * > flag); the trust boundary is the local machine, and anyone who can set that
  * > configuration and write to the log is inside it.
  *
- * This channel does **not** authenticate the person who tapped the button. It
- * checks that the callback arrived from the configured chat id, and the
- * decision is then recorded against the human actor the *runtime* was
- * configured with (`APPROVAL_HUMAN` / `--as`), not against anything the
- * callback carried. So the guarantee is "someone with access to the configured
- * chat, on a runtime configured by someone with local control, tapped Approve"
- * — not "alice tapped Approve". Anyone in that chat can approve as the
- * configured actor. Use a private chat with the bot, and treat the chat's
- * membership as part of the trust boundary. Cryptographic identity is future
- * work and is not a v0.1 claim.
+ * What this channel authenticates, exactly: that the callback arrived **from
+ * the configured chat id**, and which **Telegram account** the Bot API
+ * attributes the tap to (`callback_query.from.id`). It authenticates no
+ * person, because no transport can: an account id is evidence about an
+ * account.
+ *
+ * What is done with the second fact is the operator's to decide, and since
+ * APRV-324 there are two settings:
+ *
+ * - **No `senders` block in the policy.** Nothing changes from every build
+ *   before it. The decision is recorded against the human actor the *runtime*
+ *   was configured with (`APPROVAL_HUMAN` / `--as`), so the guarantee is
+ *   "someone with access to the configured chat, on a runtime configured by
+ *   someone with local control, tapped Approve" — not "alice tapped Approve".
+ *   Anyone in that chat can approve as the configured actor. Use a private chat
+ *   with the bot, and treat the chat's membership as part of the trust
+ *   boundary.
+ * - **A `senders` block mapping account ids to approvers.** The decision is
+ *   recorded against the person the operator attested that account to, and a
+ *   tap from an account the policy does not name is REFUSED rather than
+ *   recorded under the listener's identity. The guarantee becomes "the account
+ *   the operator attested to alice tapped Approve", which is a statement about
+ *   Telegram's session handling and the operator's assertion, and still not a
+ *   proof of personhood. Cryptographic identity is future work and is not a
+ *   v0.1 claim.
+ *
+ * The channel itself resolves nothing either way. It reports the account it
+ * saw; `channels/contract.ts` resolves it against the attested policy, and
+ * `core/gate.ts` decides. See `design/channel-sender-identity.md`.
  *
  * ## Formatting: HTML, not MarkdownV2 — a deliberate choice
  *
@@ -183,6 +202,7 @@
  * and the log is not opened.
  */
 import type { ChannelBatch, ChannelDecision, ChannelHealth, ChannelRequest, DecisionOutcome, DeliveryId, RenderedRequest, TaggedField, TestableChannel } from "./contract.js";
+import type { ChannelSender } from "../core/sender-identity.js";
 import { type Reaction, type ReviewVerdict } from "../core/audit.js";
 import { type PromptLayout } from "../core/prompt-layout.js";
 export { TELEGRAM_CHAT_ENV, TELEGRAM_TOKEN_ENV, telegramChatEnvFor, telegramTokenEnvFor, } from "../core/telegram-config.js";
@@ -556,6 +576,13 @@ export type CheckpointTapHandler = (tap: {
         seq: number;
         hash: string;
     };
+    /**
+     * The account the transport authenticated (APRV-324 follow-up), when it
+     * authenticated one. The channel resolves nothing: the runtime's handler
+     * asks the attested policy who this is, refuses an account it does not name,
+     * and signs as the person it does.
+     */
+    sender?: ChannelSender;
 }) => CheckpointTapResponse | Promise<CheckpointTapResponse>;
 export declare const TELEGRAM_COMMANDS: readonly ["queue", "skip", "next"];
 export type TelegramCommand = (typeof TELEGRAM_COMMANDS)[number];
@@ -904,6 +931,30 @@ export declare function parseCheckpointCallback(data: unknown): {
     sign: boolean;
     nonce: string;
 } | null;
+/**
+ * The account the Bot API attributes a callback to (APRV-324, amended SPEC.md
+ * §10.3).
+ *
+ * `callback_query.from.id` and nothing else. Telegram assembles the `from`
+ * object itself, from the session the tap arrived on, which is why it is the
+ * one field on an update this channel treats as evidence about a person. Three
+ * neighbours are deliberately not read:
+ *
+ * - **`from.username`.** Mutable and reusable, so a mapping keyed on it would
+ *   hand an identity over with a handle. Never a key here and never recorded
+ *   (`core/sender-identity.ts` states the argument in full).
+ * - **`message.from`.** The author of the message the button sits on — this bot
+ *   — rather than the person who pressed it.
+ * - **`data`, and any text.** What the sender says about themselves, which
+ *   §11.1 invariant 4 says may raise scrutiny and never lower it. A callback
+ *   whose payload names a user id names it about itself; the id here comes from
+ *   the transport, and the two disagreeing changes nothing.
+ *
+ * `undefined` when the update carries no usable id: a sender this channel could
+ * not read is not a sender it may guess at, and the decision then travels with
+ * none, which the contract reads as today's configured attribution.
+ */
+export declare function senderOf(query: Record<string, unknown>, channel: string): ChannelSender | undefined;
 interface ParsedCallback {
     decision: "grant" | "reject";
     /** `all` for a digest's "all" button; `one` for every per-request button. */
@@ -978,6 +1029,18 @@ export interface ReviewTap {
     reaction?: Reaction;
     /** The human's words, when a note prompt collected any. */
     note?: string;
+    /**
+     * The account the transport authenticated (APRV-324 follow-up), when it
+     * authenticated one.
+     *
+     * A review confers no authority, which is why it took the paragraph above so
+     * long to stop being true. It is still recorded as a HUMAN's observation and
+     * `approval feedback` presents it to agents as human-authored guidance, so a
+     * review attributed to the wrong person is guidance in somebody else's name.
+     * The channel resolves nothing; the runtime's handler asks the attested
+     * policy, refuses an account it does not name, and records the one it does.
+     */
+    sender?: ChannelSender;
 }
 /** What the runtime did with a review tap, as it reports it back. */
 export interface ReviewTapResponse {
@@ -1051,11 +1114,20 @@ export interface ReviewCardState {
         headline: string;
         lines: string[];
     } | null;
-    /** The outstanding note prompt, and what its reply will record. */
+    /**
+     * The outstanding note prompt, and what its reply will record.
+     *
+     * `sender` is the account that asked for the prompt (APRV-324 follow-up),
+     * when the transport authenticated one. A ForceReply prompt is addressed to
+     * the person who tapped, and the words it collects are recorded as theirs, so
+     * a reply from a different account is not the answer to this question: it is
+     * left unrecorded and the prompt stays live for whoever armed it.
+     */
     awaitingNote: {
         promptId: DeliveryId;
         verdict: ReviewVerdict;
         reaction: Reaction;
+        sender?: ChannelSender;
     } | null;
     /** When this process delivered the card, on {@link TelegramConfig.now}'s clock. */
     deliveredAtMs: number;
@@ -1161,6 +1233,17 @@ export declare class TelegramApiError extends Error {
  * that goes unreported.
  */
 export declare function isMessageNotModified(cause: unknown): boolean;
+/**
+ * Whether a failed poll is the Bot API saying another process holds this bot
+ * (APRV-390).
+ *
+ * It is the one poll failure that is not transient and not the network's
+ * fault: retrying it forever produces an identical line every few seconds and
+ * never recovers, because the other poller is not going to stop. {@link
+ * TelegramChannel.listen} reports it once, with whatever the caller knows
+ * about who the other process is, and then stops repeating itself.
+ */
+export declare function isPollConflict(cause: unknown): boolean;
 /** What one `pollOnce()` did, for tests and for programmatic drivers. */
 export interface TelegramPollResult {
     /** Updates received in this batch. */
@@ -1206,6 +1289,17 @@ export interface TelegramListenOptions {
      * failure mode this loop exists to rule out.
      */
     beforePoll?: () => Promise<void>;
+    /**
+     * What the caller knows about who else might be polling this bot (APRV-390).
+     *
+     * Consulted only when a poll fails with the Bot API's 409, and appended to
+     * the one line that failure produces. The CLI builds it from the per-machine
+     * ownership registry (`core/channel-owner.ts`), so this class keeps no
+     * knowledge of instances, directories or files — it asks the question and
+     * prints the caller's answer, the same arrangement {@link
+     * TelegramConfig.describeAction} uses for the log.
+     */
+    conflictAdvice?: () => string | null;
 }
 /**
  * What {@link TelegramChannel.notifyBatch} did with a set (APRV-115).
@@ -1563,6 +1657,24 @@ export declare class TelegramChannel implements TestableChannel {
      * HTML-mode message is.
      */
     announce(lines: string[]): Promise<DeliveryId>;
+    /**
+     * Which bot this token is, from one `getMe` (APRV-390).
+     *
+     * `getMe` is the only Bot API call that answers it, and it is the call
+     * `approval doctor` and `approval setup channel telegram` already make for
+     * the same reason: it mutates nothing, sends nothing, and acknowledges
+     * nothing. In particular it is NOT `getUpdates`, so asking who this bot is
+     * consumes no update and steals no pending tap from a listener that is
+     * already running — which matters here above all, because the answer is
+     * what decides whether this process is allowed to poll at all.
+     *
+     * Throws {@link TelegramApiError} like every other call; the caller decides
+     * whether an unreachable Bot API is a refusal or a shrug.
+     */
+    identify(): Promise<{
+        id: string;
+        username: string;
+    }>;
     /**
      * Long-poll `getUpdates` until {@link stop} is called (or one batch, with
      * `once`).