approval-md 0.3.0 → 0.4.1

package/dist/src/channels/relay.js

@@ -0,0 +1,564 @@
+/**
+ * The authenticated relay channel: its protocol (SPEC.md §10.3, APRV-455).
+ *
+ * Agent Village residents review their approval.md settings in the Edge City
+ * onboarding app, and that review is meant to be the attestation of the policy
+ * in force. The app signs the resident in through EdgeOS, and the operator's
+ * control plane is what holds that session. This module is the daemon's side
+ * of the hop from there: a gesture the control plane carries, attributed to the
+ * EdgeOS `/humans/me` id of the session that made it, arriving over an
+ * authenticated HTTP post (`channels/relay-server.ts`) and turned into a log
+ * event by the SAME function a Telegram tap goes through.
+ *
+ * ## What the relay is trusted for, and what it is not
+ *
+ * The daemon trusts the relay's report of WHO acted, exactly as it trusts the
+ * Telegram Bot API's report of `callback_query.from.id`. That is operator
+ * trust (APRV-422: no hosted service has authority over decisions), and it is
+ * the whole of what the shared secret buys: a post that carries it is a report
+ * from the operator's relay, and a post that does not is nothing. Every
+ * question of AUTHORITY is answered here, by the runtime, from the verified log
+ * and the attested policy:
+ *
+ * - which approver the account is, by `core/sender-identity.ts` against the
+ *   attested mapping, exactly as a tap is resolved;
+ * - whether that approver may decide this request, attest this policy, or
+ *   neither, by `core/gate.ts` and `core/policy-proposal.ts`, unchanged;
+ * - whether the request is still answerable (expiry, policy drift, an earlier
+ *   answer), by the same gate, with the same codes.
+ *
+ * The relay holds NO human identity of its own. A Telegram listener launched
+ * `--as human:carter` falls back to that identity for a channel the policy maps
+ * no sender for; this surface does not, ever (`requireSenderMapping`). A post
+ * naming an account the attested policy does not map is refused
+ * `sender-unmapped` with one `audit.decision_refused`, and a policy that maps
+ * nobody on `edgeos` refuses every gesture the same way.
+ *
+ * ## The body, closed
+ *
+ * ```json
+ * { "gesture": "attest" | "decline", "policy_sha256": "<64 hex>",
+ *   "sender": { "channel": "edgeos", "id": "<EdgeOS /humans/me id>" },
+ *   "nonce": "<16..128 of A-Z a-z 0-9 _ ->", "issued_at": "<RFC 3339 UTC>" }
+ * { "gesture": "grant" | "reject", "action_key": "<the request's key>",
+ *   "sender": { ... }, "nonce": "...", "issued_at": "..." }
+ * { "gesture": "propose", "policy_sha256": "<64 hex>",
+ *   "nonce": "...", "issued_at": "..." }
+ * ```
+ *
+ * Unknown keys are refused rather than ignored, so a field that looks like it
+ * carries authority (an `actor`, a second sender, a `ts`) cannot ride along on
+ * a valid post and be read by something later. `issued_at` is used for one
+ * thing only, the freshness window that bounds how long a nonce must be
+ * remembered; it is never recorded, and every record's `ts` is still the
+ * runtime's own (SPEC.md §11.1 invariant 2).
+ *
+ * ## Why `propose` exists here
+ *
+ * The control plane renders the resident's policy and writes it into the
+ * store; somebody then has to append the `policy.proposed` an acceptance
+ * answers. The existing route for that is `approval policy amend`, which is a
+ * git-aware terminal ceremony that blocks for its own `--wait`. `propose` is the
+ * same `core/policy-proposal.ts` call, under the same secret, recorded under the
+ * actor the operator started the relay with (`--proposer`), and it returns at
+ * once. It binds the hash the control plane rendered: bytes on disk that are not
+ * the bytes it names are refused, so the prompt the resident answers is the file
+ * the control plane showed them.
+ *
+ * It also admits the one proposal `policy amend` refuses: bytes that are
+ * ALREADY the policy in force (`ProposeInput.reaffirm`). The onboarding review
+ * most residents make is "accept, unchanged", and the operator attested those
+ * bytes at provisioning (APRV-449). The reaffirmation changes the attester of
+ * record and nothing else: same hash, a diff that reads "no semantic change",
+ * and an acceptance resolved against the policy in force like any other.
+ *
+ * ## No token leaves this surface
+ *
+ * A grant may mint a single-use execution token for the deciding surface
+ * (manual delivery). A relay is not a place a token can go: the control plane
+ * is not the requester and the HTTP response is not a secrets channel. The
+ * token `recordChannelDecision` returns is dropped here, unread, and the
+ * response says only whether one was minted. The deployments this exists for
+ * mint none (a harness-executed request) or seal it to the requester's own
+ * key, so nothing is lost in practice, and the residual is stated rather than
+ * hidden: a manual-delivery request granted through the relay has a token
+ * nobody holds, and its requester asks again.
+ */
+import { createHash } from "node:crypto";
+import { linkSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { POLICY_HASH_FIELD, policyBytesHash } from "../core/attest.js";
+import { payloadStoreDirFor } from "../core/payload-store.js";
+import { attestationActionKey, inForcePolicyText, isAttestationActionKey, openProposalFor, proposalPolicyPath, proposeAttestation, } from "../core/policy-proposal.js";
+import { isEdgeosSenderId } from "../core/sender-identity.js";
+import { readVerifiedRecords } from "../core/state.js";
+import { tick } from "../core/clock.js";
+import { recordChannelDecision } from "./contract.js";
+/** The channel name every relay gesture is recorded under, and its senders' namespace. */
+export const RELAY_CHANNEL = "edgeos";
+/** The header the shared secret travels in, lowercased as Node presents it. */
+export const RELAY_SECRET_HEADER = "x-approval-relay-secret";
+/** The one path this transport answers. */
+export const RELAY_PATH = "/relay/gesture";
+/** The interface it binds when the operator names none. Loopback, always. */
+export const RELAY_DEFAULT_HOST = "127.0.0.1";
+/** The port it binds when the operator names none: `serve` is 4682, the webhook 4683. */
+export const RELAY_DEFAULT_PORT = 4684;
+/** Largest body accepted. A gesture is a handful of short strings. */
+export const RELAY_MAX_BODY_BYTES = 16 * 1024;
+/** How much of an oversized body is drained before the socket is dropped. */
+export const RELAY_DRAIN_LIMIT_BYTES = 1024 * 1024;
+/**
+ * How far `issued_at` may sit from this process's clock, either side.
+ *
+ * Five minutes: a control plane and a sandbox on the same platform agree to
+ * well under a second, and a gesture older than this was not made by a person
+ * who is still looking at the screen that made it.
+ */
+export const RELAY_GESTURE_WINDOW_MS = 5 * 60_000;
+/**
+ * How long a claimed nonce is remembered.
+ *
+ * Longer than the whole window a fresh gesture can occupy (issued up to one
+ * window in the future, accepted up to one window late), with a minute of
+ * margin, so a replay is refused by the nonce while it is still fresh and by
+ * the window once the nonce is forgotten. There is no instant at which neither
+ * holds.
+ */
+export const RELAY_NONCE_RETENTION_MS = 2 * RELAY_GESTURE_WINDOW_MS + 60_000;
+/**
+ * How long a relay proposal stays open (APRV-455 refuter L2).
+ *
+ * The onboarding review is answered in the screen that rendered it, so an hour
+ * is generous; past it the prompt retires from every channel queue by
+ * derivation, and a control plane whose resident came back later proposes
+ * again. Until a proposal is attested the bytes on disk are not the policy in
+ * force, so the control plane restores the in-force bytes when a proposal is
+ * declined or lapses.
+ */
+export const RELAY_PROPOSAL_TTL_MS = 60 * 60_000;
+/** The actor a proposal is recorded under when the operator names none. */
+export const RELAY_DEFAULT_PROPOSER = "agent:edgeos-relay";
+/**
+ * What {@link recordChannelDecision} is handed as the configured actor.
+ *
+ * Never recorded. `requireSenderMapping` refuses every path that would fall
+ * back to it, and it is an `agent:` id on purpose, so that if any such path
+ * existed the gate would refuse it `actor-not-human` rather than record a
+ * decision under it.
+ */
+const RELAY_UNMAPPED_ACTOR = "agent:edgeos-relay";
+/** The gestures, closed. */
+export const RELAY_GESTURES = ["propose", "attest", "decline", "grant", "reject"];
+/**
+ * Every refusal THIS transport makes, and nothing else. Frozen, per SPEC.md
+ * §11.1 invariant 6, and pinned by `conformance/vectors/refusal-unions.v1.json`
+ * because the control plane on the other side of the hop is a second
+ * implementation that branches on these strings.
+ *
+ * Refusals the GATE or the decision surface makes (`sender-unmapped`,
+ * `expired`, `policy-drift`, `already-decided`, `proposal-stale`,
+ * `proposal-not-found`, ...) are not here: they arrive verbatim under
+ * `refusal` in the response body, from their own unions, exactly as a Telegram
+ * tap would surface them.
+ *
+ * None of these appends to the log. A post the relay refuses is a fact about
+ * the transport and is counted and reported on stderr, because an endpoint
+ * that wrote its refusals into the approval log would let anyone who can reach
+ * it grow the record a human is asked to trust.
+ */
+export const RELAY_REFUSAL_CODES = [
+    /** No secret header, or one that is not the launch environment's secret. */
+    "relay-secret-mismatch",
+    /** More than one secret header. Malformed, and not resolvable by choosing. */
+    "relay-duplicate-secret-header",
+    /** The request line and the Host header do not form a URL. */
+    "relay-malformed-request",
+    /** A path this transport does not serve. */
+    "relay-unknown-path",
+    /** The right path, a method other than POST. */
+    "relay-method-not-allowed",
+    /** Larger than {@link RELAY_MAX_BODY_BYTES}. */
+    "relay-body-too-large",
+    /** The body could not be read off the socket, or is not JSON. */
+    "relay-body-unreadable",
+    /** JSON that is not a gesture of the closed shape. */
+    "relay-body-invalid",
+    /**
+     * The sender is not an EdgeOS account this transport can report: a channel
+     * other than `edgeos`, or an id outside the grammar `senders.edgeos` pins.
+     */
+    "relay-sender-invalid",
+    /** `issued_at` is further than {@link RELAY_GESTURE_WINDOW_MS} from now. */
+    "relay-gesture-stale",
+    /** This nonce was already used within {@link RELAY_NONCE_RETENTION_MS}. */
+    "relay-nonce-replayed",
+    /**
+     * The nonce ledger could not be written, so a replay could not be refused.
+     * Fails closed: nothing is decided without it.
+     */
+    "relay-nonce-unavailable",
+    /**
+     * `propose` named a hash that is not the hash of the policy file on disk.
+     * Distinct from the gate's `proposal-stale`, which is the same fact found at
+     * ACCEPTANCE: this one is found before anything is proposed.
+     */
+    "relay-policy-mismatch",
+    /** The gesture threw while being applied. Nothing is claimed about the log. */
+    "relay-handler-failed",
+];
+const NONCE_PATTERN = /^[A-Za-z0-9_-]{16,128}$/u;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/u;
+/** RFC 3339 in UTC, `Z` only: one spelling, so two implementations agree on it. */
+const ISSUED_AT_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u;
+const ACTION_KEY_MAX = 512;
+/** The keys each gesture admits. Anything else is `relay-body-invalid`. */
+const ALLOWED_KEYS = {
+    propose: ["gesture", "policy_sha256", "nonce", "issued_at"],
+    attest: ["gesture", "policy_sha256", "sender", "nonce", "issued_at"],
+    decline: ["gesture", "policy_sha256", "sender", "nonce", "issued_at"],
+    grant: ["gesture", "action_key", "sender", "nonce", "issued_at"],
+    reject: ["gesture", "action_key", "sender", "nonce", "issued_at"],
+};
+function invalid(message) {
+    return { ok: false, code: "relay-body-invalid", message };
+}
+function isGestureName(value) {
+    return typeof value === "string" && RELAY_GESTURES.includes(value);
+}
+/**
+ * Check one decoded body against the closed shape.
+ *
+ * Pure: no clock, no file, no log. Freshness and the nonce are the server's,
+ * because both need state this function deliberately does not hold.
+ */
+export function parseRelayGesture(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return invalid("the body is not a JSON object");
+    }
+    const body = value;
+    const name = body["gesture"];
+    if (!isGestureName(name)) {
+        return invalid(`gesture must be one of ${RELAY_GESTURES.join(", ")}`);
+    }
+    const allowed = ALLOWED_KEYS[name];
+    for (const key of Object.keys(body)) {
+        if (!allowed.includes(key)) {
+            return invalid(`${JSON.stringify(key)} is not a field of a ${name} gesture (${allowed.join(", ")}). Unknown fields are refused rather than ignored, so nothing that looks like authority can ride along on a valid post`);
+        }
+    }
+    for (const key of allowed) {
+        if (!(key in body))
+            return invalid(`a ${name} gesture requires ${JSON.stringify(key)}`);
+    }
+    const nonce = body["nonce"];
+    if (typeof nonce !== "string" || !NONCE_PATTERN.test(nonce)) {
+        return invalid("nonce must be 16 to 128 characters of A-Z, a-z, 0-9, underscore and hyphen");
+    }
+    const issuedAt = body["issued_at"];
+    const issuedAtMs = typeof issuedAt === "string" && ISSUED_AT_PATTERN.test(issuedAt) ? Date.parse(issuedAt) : Number.NaN;
+    if (Number.isNaN(issuedAtMs)) {
+        return invalid("issued_at must be an RFC 3339 instant in UTC, ending in Z");
+    }
+    if (name === "propose") {
+        const sha = body["policy_sha256"];
+        if (typeof sha !== "string" || !SHA256_PATTERN.test(sha)) {
+            return invalid("policy_sha256 must be 64 lowercase hex characters");
+        }
+        return { ok: true, gesture: { gesture: name, policySha256: sha, nonce, issuedAtMs } };
+    }
+    const senderValue = body["sender"];
+    if (typeof senderValue !== "object" || senderValue === null || Array.isArray(senderValue)) {
+        return invalid("sender must be an object {channel, id}");
+    }
+    const senderBody = senderValue;
+    for (const key of Object.keys(senderBody)) {
+        if (key !== "channel" && key !== "id") {
+            return invalid(`${JSON.stringify(key)} is not a field of sender (channel, id)`);
+        }
+    }
+    if (senderBody["channel"] !== RELAY_CHANNEL) {
+        return {
+            ok: false,
+            code: "relay-sender-invalid",
+            message: `sender.channel must be ${JSON.stringify(RELAY_CHANNEL)}: this transport reports EdgeOS sessions and nothing else, and a gesture naming another channel's account would borrow that channel's attribution`,
+        };
+    }
+    const id = senderBody["id"];
+    if (typeof id !== "string" || !isEdgeosSenderId(id)) {
+        return {
+            ok: false,
+            code: "relay-sender-invalid",
+            message: "sender.id is not an EdgeOS id this runtime compares: an ASCII letter or digit, then up to 127 letters, digits, '.', '_' or '-'. It is the raw /humans/me id, never a digest and never an email address",
+        };
+    }
+    const sender = { channel: RELAY_CHANNEL, id };
+    if (name === "attest" || name === "decline") {
+        const sha = body["policy_sha256"];
+        if (typeof sha !== "string" || !SHA256_PATTERN.test(sha)) {
+            return invalid("policy_sha256 must be 64 lowercase hex characters");
+        }
+        return { ok: true, gesture: { gesture: name, policySha256: sha, sender, nonce, issuedAtMs } };
+    }
+    const actionKey = body["action_key"];
+    if (typeof actionKey !== "string" || actionKey.length === 0 || actionKey.length > ACTION_KEY_MAX) {
+        return invalid(`action_key must be a non-empty string of at most ${String(ACTION_KEY_MAX)} characters`);
+    }
+    if (isAttestationActionKey(actionKey)) {
+        // The gate would route it to the attestation path, which is a door this
+        // shape does not offer under that name: an attestation is `attest` with a
+        // policy hash, so the gesture a person made and the gesture recorded are
+        // never two different words.
+        return invalid("a policy.attest: key is answered with the attest or decline gesture, not grant or reject");
+    }
+    return { ok: true, gesture: { gesture: name, actionKey, sender, nonce, issuedAtMs } };
+}
+/** Is `issuedAtMs` within the window of `nowMs`? */
+export function relayGestureFresh(issuedAtMs, nowMs) {
+    return Math.abs(nowMs - issuedAtMs) <= RELAY_GESTURE_WINDOW_MS;
+}
+let tempCounter = 0;
+/** How often the ledger prunes, at most. */
+const PRUNE_INTERVAL_MS = 60_000;
+/** The file ledger described at {@link NonceLedger}. */
+export function fileNonceLedger(dir) {
+    let lastPrune = Number.NEGATIVE_INFINITY;
+    function prune(nowMs) {
+        if (nowMs - lastPrune < PRUNE_INTERVAL_MS)
+            return;
+        lastPrune = nowMs;
+        let names;
+        try {
+            names = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of names) {
+            const path = join(dir, name);
+            try {
+                if (/^[a-f0-9]{64}$/u.test(name)) {
+                    // The claim time is the file's own content rather than its mtime, so
+                    // a copy or a restore that touched every file does not extend them
+                    // all. A claim file is linked into place already holding its content
+                    // (see `claim`), so it is never seen empty; anything that does not
+                    // parse as a positive time is judged by mtime instead, which is the
+                    // strict direction for a file this pass did not write.
+                    const text = readFileSync(path, "utf8").trim();
+                    const claimed = /^[1-9][0-9]*$/u.test(text) ? Number(text) : Number.NaN;
+                    const age = Number.isFinite(claimed) ? nowMs - claimed : nowMs - statSync(path).mtimeMs;
+                    if (age > RELAY_NONCE_RETENTION_MS)
+                        unlinkSync(path);
+                }
+                else if (name.endsWith(".tmp") && nowMs - statSync(path).mtimeMs > RELAY_NONCE_RETENTION_MS) {
+                    // A temp left by a claim that died between write and link.
+                    unlinkSync(path);
+                }
+            }
+            catch {
+                // Another process pruned it first, or it is mid-write: either way it
+                // is not this pass's to judge.
+            }
+        }
+    }
+    return {
+        claim(nonce, nowMs) {
+            try {
+                mkdirSync(dir, { recursive: true, mode: 0o700 });
+            }
+            catch (cause) {
+                return { error: cause instanceof Error ? cause.message : String(cause) };
+            }
+            prune(nowMs);
+            const path = join(dir, createHash("sha256").update(nonce, "utf8").digest("hex"));
+            // Written whole to a private temp, then LINKED into place: `link` fails
+            // with EEXIST exactly as `O_EXCL` does, so one claimant wins, and the
+            // claim file never exists without its content, so a concurrent prune can
+            // never judge a half-made claim (APRV-455 refuter M1).
+            tempCounter += 1;
+            const temp = `${path}.${String(process.pid)}.${String(tempCounter)}.tmp`;
+            try {
+                writeFileSync(temp, `${String(nowMs)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            }
+            catch (cause) {
+                return { error: cause instanceof Error ? cause.message : String(cause) };
+            }
+            try {
+                linkSync(temp, path);
+                return "claimed";
+            }
+            catch (cause) {
+                if (cause.code !== "EEXIST") {
+                    return { error: cause instanceof Error ? cause.message : String(cause) };
+                }
+            }
+            finally {
+                try {
+                    unlinkSync(temp);
+                }
+                catch {
+                    // Already gone; its absence is the desired state.
+                }
+            }
+            // It exists. A file left by a claim older than the retention is a nonce
+            // this ledger is no longer obliged to remember, and the window has
+            // already refused anything that old, so reaching here with one means
+            // the prune has not run yet; it is still refused, which is the strict
+            // direction and costs a legitimate caller nothing (nonces are fresh).
+            return "replayed";
+        },
+    };
+}
+/** A transport refusal as a response. Never appended. */
+export function relayRefusal(status, code, message) {
+    return { status, body: { error: { code, message } } };
+}
+/** The policy file this process enforces, resolved as the gate resolves it. */
+function relayPolicyPath(options) {
+    const policy = options.policy;
+    if (policy?.file !== undefined)
+        return policy.file;
+    return proposalPolicyPath(policy?.dir ?? process.cwd());
+}
+/**
+ * Turn one checked gesture into a log event, or into the refusal that replaces
+ * one.
+ *
+ * Decisions and attestations go through {@link recordChannelDecision}, the one
+ * place a reported gesture becomes a log event, with `requireSenderMapping` set
+ * and the channel named `edgeos`. A proposal goes through `proposeAttestation`.
+ * Nothing here decides anything those two do not already decide.
+ */
+export function applyRelayGesture(logPath, gesture, options) {
+    if (gesture.gesture === "propose")
+        return applyPropose(logPath, gesture, options);
+    let decision;
+    if ("policySha256" in gesture) {
+        decision = {
+            action_key: attestationActionKey(gesture.policySha256),
+            decision: gesture.gesture === "attest" ? "grant" : "reject",
+            deliveryId: `relay:${gesture.nonce}`,
+            sender: gesture.sender,
+        };
+    }
+    else {
+        decision = {
+            action_key: gesture.actionKey,
+            decision: gesture.gesture,
+            deliveryId: `relay:${gesture.nonce}`,
+            sender: gesture.sender,
+        };
+    }
+    const result = recordChannelDecision(logPath, decision, { actor: RELAY_UNMAPPED_ACTOR, channel: RELAY_CHANNEL, requireSenderMapping: true }, options.gateOptions);
+    // `result.token` is deliberately never read: see the module doc. A raw token
+    // has no route off this surface, into a response, a log line or stderr.
+    const outcome = result.outcome;
+    if (!outcome.ok) {
+        return {
+            status: 409,
+            body: {
+                ok: false,
+                gesture: gesture.gesture,
+                refusal: { code: outcome.code, message: outcome.message },
+            },
+        };
+    }
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            gesture: gesture.gesture,
+            action_key: outcome.action_key,
+            event: outcome.record.event,
+            seq: outcome.record.seq,
+            actor: outcome.record.actor,
+            state: outcome.state,
+            token_issued: outcome.tokenIssued,
+        },
+    };
+}
+function applyPropose(logPath, gesture, options) {
+    const policyPath = relayPolicyPath(options.gateOptions);
+    let bytes;
+    try {
+        bytes = readFileSync(policyPath);
+    }
+    catch (cause) {
+        return relayRefusal(409, "relay-policy-mismatch", `the policy file ${policyPath} could not be read to confirm it is the bytes this proposal names (${cause instanceof Error ? cause.message : String(cause)}); nothing was proposed`);
+    }
+    const live = policyBytesHash(bytes);
+    if (live !== gesture.policySha256) {
+        return relayRefusal(409, "relay-policy-mismatch", `this proposal names ${gesture.policySha256} and the policy file on disk hashes ${live}. A proposal binds the bytes a person will be asked to accept, and these are not the bytes the caller rendered; nothing was proposed. Write the rendered policy first, then propose its hash`);
+    }
+    const schemaOptions = options.gateOptions.schemaDir === undefined ? {} : { schemaDir: options.gateOptions.schemaDir };
+    const read = readVerifiedRecords(logPath, schemaOptions);
+    if (!read.ok) {
+        return {
+            status: 409,
+            body: { ok: false, gesture: "propose", refusal: { code: read.code, message: read.message } },
+        };
+    }
+    // Idempotent on a retry: an open proposal of exactly these bytes is the
+    // answer, and a second record asking the same question would only make two
+    // prompts for one acceptance to answer.
+    const existing = openProposalFor(read.records, live, tick(options.gateOptions));
+    if (existing !== null) {
+        return {
+            status: 200,
+            body: { ok: true, gesture: "propose", sha256: live, seq: existing.seq, existing: true },
+        };
+    }
+    // The baseline for the semantic diff: the in-force text, recovered from the
+    // payload store and verified against the attested digest by the module that
+    // recovers it, and verified AGAIN by `summarizeDiff` before it is used. No
+    // caller material is a baseline here.
+    const storeDir = options.gateOptions.payloadStoreDir ?? payloadStoreDirFor(logPath);
+    const inForce = inForcePolicyText(read.records, storeDir);
+    const baseline = inForce.ok ? Buffer.from(inForce.text, "utf8") : null;
+    const proposed = proposeAttestation(logPath, {
+        policyPath,
+        baseline,
+        reaffirm: true,
+        waitUntil: new Date(Date.parse(tick(options.gateOptions)) + RELAY_PROPOSAL_TTL_MS).toISOString(),
+    }, options.proposer, {
+        ...schemaOptions,
+        ...(options.gateOptions.clock === undefined ? {} : { clock: options.gateOptions.clock }),
+        ...(options.gateOptions.payloadStoreDir === undefined
+            ? {}
+            : { payloadStoreDir: options.gateOptions.payloadStoreDir }),
+    });
+    if (!proposed.ok) {
+        return {
+            status: 409,
+            body: {
+                ok: false,
+                gesture: "propose",
+                refusal: { code: proposed.code, message: proposed.message },
+            },
+        };
+    }
+    if (proposed.sha256 !== gesture.policySha256) {
+        // The file changed between the relay's hash check and the proposal's own
+        // read. The proposal already appended names bytes the caller never
+        // rendered; nothing can be attested unseen (acceptance re-hashes, and the
+        // caller attests by the hash IT named, which this proposal is not), and
+        // the caller is told rather than handed a hash it did not ask for.
+        return relayRefusal(409, "relay-policy-mismatch", `the policy file changed while this proposal was being made: it names ${gesture.policySha256} and the proposal recorded at seq ${String(proposed.record.seq)} is of ${proposed.sha256}. Write the rendered policy again and propose its hash; an acceptance of ${gesture.policySha256} finds no open proposal and attests nothing`);
+    }
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            gesture: "propose",
+            sha256: proposed.sha256,
+            seq: proposed.record.seq,
+            existing: false,
+            // A reaffirmation is a proposal whose bytes are the attested bytes: the
+            // record says so itself, by naming the same hash twice.
+            reaffirm: proposed.record.payload?.[POLICY_HASH_FIELD] === proposed.sha256,
+            changes: proposed.diff.headline,
+            loads: proposed.load.ok,
+        },
+    };
+}
+//# sourceMappingURL=relay.js.map

package/dist/src/channels/relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../../src/channels/relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9G,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAsB,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAwB,MAAM,eAAe,CAAC;AAE5E,0FAA0F;AAC1F,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAEtC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAE7D,2CAA2C;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAE3C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE9C,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,MAAM,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,uBAAuB,GAAG,MAAM,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEjD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAElD,4BAA4B;AAC5B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAI3F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,4EAA4E;IAC5E,uBAAuB;IACvB,8EAA8E;IAC9E,+BAA+B;IAC/B,8DAA8D;IAC9D,yBAAyB;IACzB,4CAA4C;IAC5C,oBAAoB;IACpB,gDAAgD;IAChD,0BAA0B;IAC1B,gDAAgD;IAChD,sBAAsB;IACtB,iEAAiE;IACjE,uBAAuB;IACvB,sDAAsD;IACtD,oBAAoB;IACpB;;;OAGG;IACH,sBAAsB;IACtB,4EAA4E;IAC5E,qBAAqB;IACrB,2EAA2E;IAC3E,sBAAsB;IACtB;;;OAGG;IACH,yBAAyB;IACzB;;;;OAIG;IACH,uBAAuB;IACvB,+EAA+E;IAC/E,sBAAsB;CACd,CAAC;AA0BX,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,uDAAuD,CAAC;AAClF,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,YAAY,GAAgD;IAChE,OAAO,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC;IAC3D,MAAM,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC;IACpE,OAAO,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC;IACrE,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC;IAChE,MAAM,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC;CAClE,CAAC;AAEF,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,0BAA0B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CACZ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wBAAwB,IAAI,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wHAAwH,CAC1M,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,IAAI,qBAAqB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,OAAO,CAAC,4EAA4E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACxH,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,2DAA2D,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,mDAAmD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,WAAsC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,mJAAmJ;SACpN,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EACL,wMAAwM;SAC3M,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAE7D,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,mDAAmD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACjG,OAAO,OAAO,CAAC,oDAAoD,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,6BAA6B;QAC7B,OAAO,OAAO,CAAC,0FAA0F,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;AACxF,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,KAAa;IACjE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,uBAAuB,CAAC;AACjE,CAAC;AAyBD,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,wDAAwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACzC,SAAS,KAAK,CAAC,KAAa;QAC1B,IAAI,KAAK,GAAG,SAAS,GAAG,iBAAiB;YAAE,OAAO;QAClD,SAAS,GAAG,KAAK,CAAC;QAClB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjC,qEAAqE;oBACrE,mEAAmE;oBACnE,qEAAqE;oBACrE,mEAAmE;oBACnE,oEAAoE;oBACpE,uDAAuD;oBACvD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACxE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;oBACxF,IAAI,GAAG,GAAG,wBAAwB;wBAAE,UAAU,CAAC,IAAI,CAAC,CAAC;gBACvD,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,wBAAwB,EAAE,CAAC;oBAC9F,2DAA2D;oBAC3D,UAAU,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,+BAA+B;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,CAAC,KAAa,EAAE,KAAa;YAChC,IAAI,CAAC;gBACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjF,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,uDAAuD;YACvD,WAAW,IAAI,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;YACzE,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3E,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,UAAU,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,kDAAkD;gBACpD,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,UAAU,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAmBD,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAsB,EAAE,OAAe;IAClF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,OAAsB;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACnD,OAAO,kBAAkB,CAAC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAqB,EACrB,OAA0B;IAE1B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAElF,IAAI,QAAyB,CAAC;IAC9B,IAAI,cAAc,IAAI,OAAO,EAAE,CAAC;QAC9B,QAAQ,GAAG;YACT,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC;YACtD,QAAQ,EAAE,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YAC3D,UAAU,EAAE,SAAS,OAAO,CAAC,KAAK,EAAE;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG;YACT,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,UAAU,EAAE,SAAS,OAAO,CAAC,KAAK,EAAE;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAClC,OAAO,EACP,QAAQ,EACR,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,EACnF,OAAO,CAAC,WAAW,CACpB,CAAC;IACF,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;aAC1D;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YACvB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,WAAW;SAClC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,OAAe,EACf,OAAsD,EACtD,OAA0B;IAE1B,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,YAAY,CACjB,GAAG,EACH,uBAAuB,EACvB,mBAAmB,UAAU,sEAAsE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CACnL,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;QAClC,OAAO,YAAY,CACjB,GAAG,EACH,uBAAuB,EACvB,uBAAuB,OAAO,CAAC,YAAY,uCAAuC,IAAI,8LAA8L,CACrR,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GACjB,OAAO,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;SACxF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAG,kBAAkB,CACjC,OAAO,EACP;QACE,UAAU;QACV,QAAQ;QACR,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC,WAAW,EAAE;KACjG,EACD,OAAO,CAAC,QAAQ,EAChB;QACE,GAAG,aAAa;QAChB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,KAAK,SAAS;YACnD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;KAC9D,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;aAC5D;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7C,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,YAAY,CACjB,GAAG,EACH,uBAAuB,EACvB,wEAAwE,OAAO,CAAC,YAAY,qCAAqC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,MAAM,4EAA4E,OAAO,CAAC,YAAY,6CAA6C,CACnU,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;YACxB,QAAQ,EAAE,KAAK;YACf,wEAAwE;YACxE,wDAAwD;YACxD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,MAAM;YAC1E,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;YAC/B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;SACxB;KACF,CAAC;AACJ,CAAC"}

package/dist/src/channels/tagging.d.ts

@@ -41,6 +41,7 @@
  * Determinism: no clock. `now` is a parameter, so a queue rendering is
  * replayable exactly as it was rendered.
  */
+import { type PromptSay, type PromptStyle } from "../core/prompt-layout.js";
 import { type ChannelRequest } from "./contract.js";
 /**
  * Where the payload material for an action comes from.
@@ -185,6 +186,30 @@ export type PendingQueueResult = {
      */
     skipped: SkippedRequest[];
 } | ChannelTagRefusal;
+/**
+ * The prompt style and `say` map a channel may draw with RIGHT NOW, taken only
+ * from attested policy bytes (APRV-489, fix round 2, S4 and its security
+ * follow-up).
+ *
+ * The policy file is read ONCE, and those bytes are both checked and used:
+ * they must hash to the latest attestation in the verified log (the digest the
+ * gate decides under), and the style and `say` are parsed from the very same
+ * buffer. There is no second read for the bytes to change between, so an edit
+ * to the file that nobody attested (by the agent the policy governs, in some
+ * deployments) can never switch a card to minimal or reword a class's phrase.
+ *
+ * Anything short of "these bytes are the attested policy" is the technical
+ * card: an unreadable file or log, a file that differs from the attestation, a
+ * log with no attestation. When the attested policy in force (its stored bytes)
+ * does ask for minimal, the answer carries `fallback: "policy-unattested"`, so
+ * the decision record says why the approver saw the technical card; under an
+ * attested technical policy nothing is added, so its records stay unchanged.
+ */
+export declare function attestedPromptOf(logPath: string, options: TagOptions, channel: string): {
+    style: PromptStyle;
+    say: PromptSay;
+    fallback?: "policy-unattested";
+};
 /**
  * Build the pending queue: every action key with a live `approval.requested`.
  *