baesian 0.0.0-stage → 1.0.1

package/dist/ops.js

@@ -0,0 +1,381 @@
+import { CARD_TEMPLATE } from "./agents.js";
+import { cite, citeIn } from "./cite.js";
+import { agentLabel, byLine, cardAuthor, plain, q, reviewerOf, said } from "./quote.js";
+import { POSITION_NAMES, ROW_NAMES } from "./routing.js";
+import { attention, blank, cmd, dim, errorLines, failure, fields, head, id, indent, level, lit, literal, next, ok, strong, status as statusPiece, table, text, warning, } from "./style.js";
+import { NoCard, NoDeck, NotAllowed, PENDING } from "./store.js";
+import { describeAll, describeBrief, describeOutcome, exitCodeFor, exitCodeForAll, replyHint, ruleHint, waitForAll, waitForVerdict, } from "./wait.js";
+/** Who files a card: the agent, and the model its session runs on, if the plugin's hooks heard one (B-k0w7d). */
+const filer = (s, actor) => {
+    const model = actor.sessions?.length ? s.sessionModel(actor.sessions) : undefined;
+    return { agent: actor.agent, ...(model ? { model } : {}) };
+};
+// ---------------------------------------------------------------- lines
+/** A time as people read it: to the minute, in UTC. */
+export const when = (iso) => (/^\d{4}-\d\d-\d\dT\d\d:\d\d/.test(iso) ? `${iso.slice(0, 10)} ${iso.slice(11, 16)} UTC` : iso);
+/** The card itself: the question, the crux, the options, each text quoted with the agent that wrote it, line by line. */
+export function cardDetails(card) {
+    const m = card.meta;
+    const by = (what, t) => said(what, cardAuthor(m), t);
+    const undo = { cheap: "easy", moderate: "costly", "one-way": "hard" }[m.reverse];
+    const out = [
+        text(by("question", m.question)),
+        text(by("doing", m.doing)),
+        text(`stakes: ${undo} to undo${m.touches.length ? `; touches ${m.touches.join(", ")}` : ""}`),
+        blank,
+        text(`${by("crux", m.crux)}${m.crux_preference ? " (a preference)" : ""}`),
+    ];
+    if (m.crux_fact)
+        out.push(text(by("crux_fact", m.crux_fact)));
+    if (m.answered_in_chat)
+        out.push(text(by(`answered_in_chat (the reviewer's answer in chat, the agent's pick; marked seen${citeIn("B-hswmx")})`, m.answered_in_chat)));
+    out.push(text(`${by("proposal (the agent's pick)", m.proposal)}; if: ${q(m.crux_proposal)}; then: ${q(m.proposal_then)}`));
+    out.push(text(`${by("alternative", m.alternative)}; if: ${q(m.crux_alternative)}; then: ${q(m.alternative_then)}`));
+    if (m.premise)
+        out.push(text(`${by(`premise, unverified, of the ${m.premise_option}`, m.premise)}; check: ${q(m.premise_check ?? "")}`));
+    if (m.acted)
+        out.push(text(by(`acted, already built for the ${m.acted_option}`, m.acted)));
+    if (m.rationale)
+        out.push(text(by("rationale", m.rationale)));
+    if (m.wrong_if)
+        out.push(text(`${by("wrong_if", m.wrong_if)}; check: ${q(m.check ?? "")}`));
+    if (m.secret_reason)
+        out.push(text(by(`secret_reason (filed though it looks like it holds a secret${citeIn("B-jfkv9")})`, m.secret_reason)));
+    if (card.body.trim())
+        out.push(text(by("body", card.body.trim())));
+    return indent(2, out);
+}
+/** An answer, coloured by what it does: resolves, sends the card back, or neither. */
+function response(r) {
+    if (r === "accept" || r === "alternative" || r === "correction")
+        return ok(r);
+    if (r === "reject")
+        return failure(r);
+    if (r === "question" || r === "need_context" || r === "see_it_run" || r === "defer")
+        return attention(r);
+    return r;
+}
+/**
+ * One verdict, naming what it decided (an accept names the proposal it accepted, as `wait` does), and when; then the
+ * reviewer's comment on a line of its own, as `wait` gives it, and the rules it retired.
+ */
+export function verdictLines(s, v) {
+    const proposal = v.response === "accept" ? s.revisions(v.card).find((r) => r.meta.revision === v.revision)?.meta.proposal : undefined;
+    const what = v.choice ?? proposal;
+    const out = [text(id(v.card), ` r${v.revision}  `, response(v.response), ` by ${byLine(reviewerOf(v))}${what !== undefined ? `: ${q(what)}` : ""}${v.seen ? ", answered in chat first" : ""}`, "  ", dim(when(v.at)))];
+    if (v.comment)
+        out.push(indent(2, text(said("Comment", reviewerOf(v), v.comment))));
+    if (v.retire_rules?.length)
+        out.push(indent(2, text(`It retires ${v.retire_rules.join(", ")}.`)));
+    return out;
+}
+/** Why a possible duplicate matched: the same topic, the same title, or a title like it. */
+function matchedBy(m, title) {
+    if (m.by === "topic")
+        return "same topic";
+    const norm = (t) => t.toLowerCase().replace(/\s+/g, " ").trim();
+    return title !== undefined && norm(title) === norm(m.card.meta.title) ? "same title" : "similar title";
+}
+/**
+ * What `baesian file` prints when the decision may already be on file (exit 3), and the server's error text: the cards
+ * it matched, and what to do in each case, with their IDs filled in. `title` is the draft's, to tell the same title from
+ * a similar one.
+ */
+export function duplicateLines(e, title) {
+    const out = [head("attention", attention("not filed"), ": this decision may already be on file")];
+    out.push(...table(undefined, e.matches.map((m) => [id(m.card.meta.id), statusPiece(m.status), matchedBy(m, title ?? e.title), said("title", cardAuthor(m.card.meta), m.card.meta.title)])));
+    const open = e.matches.find((m) => PENDING.has(m.status));
+    const decided = e.matches.find((m) => m.status === "resolved");
+    if (open)
+        out.push(next(`baesian attach ${open.card.meta.id}`, "the same question: wait on that card instead of filing another"));
+    if (decided)
+        out.push(next(`baesian show ${decided.card.meta.id}`, "the same question, decided already: follow that decision"));
+    // A topic is one question (D112): a different question on the same subject is a narrower topic, not a duplicate.
+    const byTopic = e.matches.find((m) => m.by === "topic" && m.card.meta.topic);
+    if (byTopic) {
+        out.push(indent(2, text(`A different question on the same subject: give it a narrower topic of its own, such as ${byTopic.card.meta.topic}/<what it asks>, list what it builds on in depends_on, and file it again.`)));
+    }
+    const against = (decided ?? open ?? e.matches[0]).card.meta.id;
+    out.push(indent(2, text(`An argument against that decision: set supersedes: ${against}, and file it with `, cmd("--new"), ".")));
+    return out;
+}
+/** The level a card is shown at, and why; or that the gate held it back, which means its agent goes ahead with its pick. */
+export function levelField(g, filer = true) {
+    const row = ROW_NAMES[g.row];
+    // No quotation marks: in an agent's lines they mean a text someone else wrote (D169).
+    const at = POSITION_NAMES[g.position];
+    if (g.outcome === "held") {
+        if (g.mode === "shadow")
+            return { label: "level", value: [level(g.level ?? "provisional"), `; in shadow, the repo's preferences would have held it back (${row}: ${at})`] };
+        const go = filer ? "go ahead with your pick, as provisional, whatever level you asked for" : "its agent goes ahead with its pick, as provisional";
+        return { label: "level", value: [attention("held back"), ` (${row}: ${at}): ${go}. It counts as settled at merge; the reviewer may still answer it later`] };
+    }
+    const why = {
+        row: `(${row}: ${at})`,
+        floor: `(${row}: never without me, always)`,
+        "one-way": "(it's one-way, and a one-way card is never held back)",
+        agent: `the level ${filer ? "you" : "its agent"} asked for`,
+        baesian: "(a card Baesian files is always shown)",
+        answer: "(a revision that follows an answer is always shown)",
+        chat: "(a choice the reviewer answered in chat is always shown, for them to confirm)",
+        error: "(the gate couldn't run, so the card is shown)",
+    }[g.reason];
+    return { label: "level", value: [level(g.level ?? "provisional"), g.reason === "agent" ? `, ${why}` : ` ${why}`] };
+}
+/** The trailer a commit that builds on a card carries, at the end of its line, so it copies whole. */
+const carries = (cardId) => indent(2, text("Commits that build on it carry the trailer  ", lit(`Baesian-Card: ${cardId}`)));
+/** What filing or revising printed: the headline, the level, the deck, notes, and what to do next. */
+function filed(result, title) {
+    const { id: cardId, level: lvl, deck, revision } = result.card.meta;
+    const held = result.gate.outcome === "held" && result.gate.mode === "enforce";
+    const out = [head("done", "filed ", id(revision > 1 ? `${cardId} r${revision}` : cardId), " ", title, held ? ", held back" : "")];
+    out.push(...fields([
+        levelField(result.gate),
+        result.card.meta.answered_in_chat !== undefined && { label: "seen", value: `answered in chat: the reviewer confirms it with one tap, and calibration leaves it out${cite("B-hswmx")}` },
+        { label: "deck", value: deck },
+        result.hardBecause && { label: "raised", value: [`to `, level("hard"), ` by what it touches, ${result.hardBecause.join(", ")}: an agent can raise a card's level, never lower it${cite("D42", "D144")}`] },
+        result.nearTopics.length > 0 && { label: "topic", value: `new; did you mean ${result.nearTopics.join(" or ")}?` },
+    ]));
+    for (const w of result.warnings)
+        out.push(indent(2, warning(w)));
+    if (!held && lvl === "blocking")
+        out.push(next(`baesian wait ${cardId}`, "before building on it"));
+    if (!held && lvl === "hard")
+        out.push(next(`baesian wait ${cardId}`, "don't proceed with it until this exits 0"));
+    out.push(carries(cardId));
+    return out;
+}
+// ---------------------------------------------------------------- filing
+/** `baesian file`: file a card, notify for blocking and hard cards, and say what to do next. */
+export function fileOp(s, draft, body, actor) {
+    const result = s.fileCard(draft, body, { ...filer(s, actor), force: actor.force ?? false });
+    actor.notify(result.card);
+    return { lines: filed(result, q(result.card.meta.title)), data: result };
+}
+/** `baesian revise`: the next revision of a returned card. */
+export function reviseOp(s, cardId, draft, body, actor) {
+    const result = s.reviseCard(cardId, draft, body, filer(s, actor));
+    actor.notify(result.card);
+    return { lines: filed(result, q(result.card.meta.title)), data: result };
+}
+/** `baesian reply`: the agent's one reply to an answer against its pick (D89, D104). */
+export function replyOp(s, cardId, reply, actor) {
+    const card = s.replyToCard(cardId, reply, filer(s, actor));
+    actor.notify(card);
+    return {
+        lines: [
+            head("done", "filed ", id(`${cardId} r${card.meta.revision}`), ": your reply goes to the reviewer, and the card is open again"),
+            card.meta.level === "hard"
+                ? next(`baesian wait ${cardId}`, "it's hard: don't commit work that cites it until this exits 0")
+                : indent(2, text("Until they answer again, proceed with their decision; ", cmd("baesian inbox"), " brings the new answer.")),
+        ],
+        data: { card: cardId, revision: card.meta.revision, level: card.meta.level },
+    };
+}
+/** `baesian rule`: draft the rule the reviewer asked for, as a card (D110). */
+export function ruleOp(s, from, rule, covers, actor) {
+    const card = s.draftRule(from, rule, covers, filer(s, actor));
+    actor.notify(card);
+    return { lines: [head("done", "filed ", id(card.meta.id), ": the rule goes to the reviewer as a card, and is saved once they accept it")], data: { card: card.meta.id, from } };
+}
+/** `baesian attach`: wait on an existing card instead of filing a duplicate. */
+export function attachOp(s, cardId, agent) {
+    s.attach(cardId, agent);
+    const waiting = s.waiting(cardId);
+    return {
+        lines: [head("done", "attached to ", id(cardId), `; ${waiting === 1 ? "1 agent is" : `${waiting} agents are`} waiting on it`), next(`baesian wait ${cardId}`, "for its answer")],
+        data: { card: cardId, waiting },
+    };
+}
+/** `baesian withdraw`: withdraw a card this agent filed or attached to. */
+export function withdrawOp(s, cardId, reason, agent) {
+    return { lines: [head("done", "withdrew ", id(cardId))], data: s.withdraw(cardId, reason, agent) };
+}
+// ---------------------------------------------------------------- waiting and the inbox
+/** What to do after a wait, by its exit code (P18): the MCP tool's `next`. */
+export const NEXT = { 0: "use", 4: "read", 5: "proceed", 6: "park", 7: "again", 8: "go" };
+/**
+ * `baesian wait`: one run of at most `SLICE_MS` (D101, D168). An answer it gives is marked delivered, so `inbox` and
+ * the hooks don't hand it over again.
+ */
+export async function waitOp(s, cardId, opts) {
+    const outcome = await waitForVerdict(s, cardId, opts);
+    if (outcome.kind === "resolved" || outcome.kind === "answered")
+        s.markDelivered(cardId, outcome);
+    const exit = exitCodeFor(outcome);
+    return { lines: describeOutcome(outcome), data: { ...outcome, next: NEXT[exit], exit } };
+}
+/**
+ * `baesian wait` on several cards, or a deck's (B-xnae9): one run, until every card is answered, or one comes back or is
+ * held back; or, without `untilAnswered`, until the run's slice or the wait's time is over. Each answer it gives is
+ * marked delivered; a run that ends with "again" gives none yet, so they all come when the wait ends.
+ */
+export async function waitAllOp(s, ids, opts) {
+    const outcome = await waitForAll(s, ids, opts);
+    if (outcome.ended !== "again")
+        for (const c of outcome.cards)
+            if (c.kind === "resolved" || c.kind === "answered")
+                s.markDelivered(c.id, c);
+    const exit = exitCodeForAll(outcome);
+    return { lines: describeAll(outcome), data: { ...outcome, next: NEXT[exit], exit } };
+}
+/**
+ * The cards `baesian wait --deck` waits on (B-xnae9): the deck's cards still with the reviewer (open, or rerouted to
+ * another reviewer) that this agent filed or attached to, on this branch (`Store.branchCards`). This agent's, not every
+ * card in the deck: an agent wakes for the answers it acts on. And on this branch, since agents share names (every
+ * Claude Code session is `claude-code` unless it's named), so the branch tells them apart, as `baesian inbox` does.
+ */
+export function deckWaitIds(s, deck, agent) {
+    s.requireInit();
+    if (!s.deck(deck))
+        throw new NoDeck(`no deck "${deck}"`);
+    return s.view(() => {
+        const attached = new Set(s.attachments().filter((a) => a.agent === agent).map((a) => a.card));
+        const mine = s.branchCards().filter((c) => c.meta.deck === deck && (c.meta.source_agent === agent || attached.has(c.meta.id)));
+        // In the order they were filed, which the agent knows them by; the ID only breaks a tie.
+        const ids = mine
+            .filter((c) => ["open", "rerouted"].includes(s.status(c.meta.id)))
+            .sort((x, y) => x.meta.created.localeCompare(y.meta.created) || x.meta.id.localeCompare(y.meta.id))
+            .map((c) => c.meta.id);
+        if (!ids.length) {
+            throw new NotAllowed(`deck "${deck}" has no cards of yours still with the reviewer (filed or attached to by ${agent}, on this branch): nothing to wait on`, [
+                { command: "baesian inbox", why: "any answers you haven't seen" },
+            ]);
+        }
+        return ids;
+    });
+}
+/** The headline over new verdicts: how many, on this branch's cards. */
+export const verdictsHeadline = (n) => `${n === 1 ? "1 new verdict" : `${n} new verdicts`} on this branch's cards`;
+/** `baesian inbox`: new verdicts on this branch's cards, less those `wait` delivered, inside one view. */
+export function inboxOp(s, opts) {
+    return s.view(() => {
+        const entries = s.inbox(opts).map((item) => {
+            // Only the answer that's standing now: an earlier one, or one already replied to, takes no reply.
+            const latest = s.card(item.card);
+            const standing = item.verdict.card === item.card && latest !== undefined && item.verdict.revision === latest.meta.revision;
+            // A yes to a convention card asks for a rule as the toggle does (D161).
+            const asks = Boolean(item.verdict.make_rule) || (latest?.meta.convention !== undefined && item.verdict.response === "accept");
+            return { ...item, canReply: standing && s.canReply(item.card), ruleAsked: standing && asks && s.ruleAsked(item.card) };
+        });
+        if (!entries.length)
+            return { lines: [head("done", "no new verdicts")], data: entries };
+        const lines = [head("attention", verdictsHeadline(entries.length))];
+        for (const e of entries) {
+            // A dependent returned by its parent's verdict (D80) is listed under its own ID.
+            lines.push(...(e.verdict.card === e.card ? verdictLines(s, e.verdict) : [text(id(e.card), "  ", attention("returned"), `, by a verdict on ${e.verdict.card}`)]));
+            if (e.brief)
+                lines.push(...describeBrief(e.brief));
+            if (e.ruleAsked)
+                lines.push(...indent(2, ruleHint(e.card)));
+            if (e.canReply)
+                lines.push(...indent(2, replyHint(e.card)));
+        }
+        return { lines, data: entries };
+    });
+}
+/** `baesian show`: the card as the client shows it, with who's waiting, its briefs and its verdicts. */
+export function showOp(s, cardId) {
+    s.requireInit();
+    return s.view(() => {
+        const card = s.card(cardId);
+        if (!card)
+            throw new NoCard(cardId);
+        const m = card.meta;
+        const status = s.status(cardId);
+        const decision = s.decision(cardId);
+        const verdicts = s.verdicts(cardId);
+        // Only a card still with the reviewer has agents waiting on it: a marker a wait left when its run ended (exit 7) says
+        // nothing once the card is answered.
+        const waiting = PENDING.has(status) || status === "held" ? s.waitingOn(cardId).map(({ marker, stale }) => ({ agent: marker.agent, since: marker.since, at: marker.at, stale })) : [];
+        const briefs = s.briefs(cardId);
+        const gate = s.gateRecord(cardId);
+        const by = verdicts.filter((v) => v.revision === m.revision).at(-1);
+        const lines = [head(undefined, id(cardId), "  ", statusPiece(status), "  ", said("title", cardAuthor(m), m.title))];
+        lines.push(...fields([
+            m.topic !== undefined && { label: "topic", value: m.topic },
+            { label: "deck", value: m.deck },
+            // The model its agent ran on, as the harness named it to the plugin (B-k0w7d).
+            m.source_model !== undefined && { label: "model", value: plain(m.source_model) },
+            gate ? levelField(gate, false) : { label: "level", value: level(m.level) },
+            decision !== undefined && { label: "decided", value: by ? `by ${byLine(reviewerOf(by))}: ${q(decision)}` : q(decision) },
+            ...waiting.map((w) => ({ label: "waiting", value: `${agentLabel(w.agent)}, ${w.stale ? `stopped (last seen ${when(w.at)})` : `since ${when(w.since)}`}` })),
+        ]));
+        lines.push(blank, ...cardDetails(card));
+        for (const b of briefs)
+            lines.push(...describeBrief(b));
+        if (verdicts.length)
+            lines.push(blank, text("verdicts:"), ...indent(2, verdicts.flatMap((v) => verdictLines(s, v))));
+        return { lines, data: { ...card, status, ...(decision !== undefined ? { decision } : {}), verdicts, waiting, briefs, ...(gate ? { gate } : {}) } };
+    });
+}
+/** Counts by status, in a fixed order: "3 resolved, 1 returned to its agent, 1 withdrawn". */
+function counts(statuses) {
+    const order = ["open", "rerouted", "held", "returned", "deferred", "resolved", "withdrawn", "superseded"];
+    const say = { returned: "returned to its agent", rerouted: "rerouted to another reviewer" };
+    return order
+        .map((st) => [st, statuses.filter((x) => x === st).length])
+        .filter(([, n]) => n > 0)
+        .map(([st, n]) => `${n} ${say[st] && n === 1 ? say[st] : st === "returned" && n > 1 ? "returned to their agents" : st}`)
+        .join(", ");
+}
+/**
+ * `baesian list`: the cards still with the reviewer, or all of them; this branch's, or every branch's. A headline with
+ * the counts, then a row a card, in the order they were filed. What every row shares, the author and the deck, is said
+ * once under the headline (B-gff98); the titles stay quoted, and their author named (D169).
+ */
+export function listOp(s, opts) {
+    s.requireInit();
+    // A card's status reads the others: read the live layer once (Store.view), not once per card.
+    return s.view(() => {
+        const cards = (opts.branch ? s.branchCards() : s.cards())
+            .filter((c) => opts.all || PENDING.has(s.status(c.meta.id)))
+            .sort((x, y) => x.meta.created.localeCompare(y.meta.created) || x.meta.id.localeCompare(y.meta.id));
+        const data = cards.map((c) => ({ ...c.meta, status: s.status(c.meta.id) }));
+        if (!cards.length)
+            return { lines: [head("done", opts.all ? "no cards" : "nothing waiting on the reviewer")], data };
+        const author = (c) => byLine(cardAuthor(c.meta));
+        const oneAuthor = new Set(cards.map(author)).size === 1;
+        const oneDeck = new Set(cards.map((c) => c.meta.deck)).size === 1;
+        const n = cards.length;
+        const what = opts.all ? `${n} card${n === 1 ? "" : "s"}` : `${n} card${n === 1 ? "" : "s"} still with the reviewer`;
+        const lines = [head(undefined, strong(what), ": ", counts(data.map((d) => d.status)))];
+        const shared = [oneAuthor ? `all filed by ${author(cards[0])}` : "", oneDeck ? `${oneAuthor ? "in" : "all in"} deck ${cards[0].meta.deck}` : ""].filter(Boolean).join(", ");
+        if (shared)
+            lines.push(indent(2, text(dim(shared))));
+        const header = ["id", "status", "level", "topic", ...(oneDeck ? [] : ["deck"]), ...(oneAuthor ? ["title"] : ["title, by its author"])];
+        const rows = cards.map((c, i) => [
+            id(c.meta.id),
+            statusPiece(data[i].status),
+            level(c.meta.level),
+            c.meta.topic ?? "",
+            ...(oneDeck ? [] : [c.meta.deck]),
+            oneAuthor ? q(c.meta.title) : `by ${author(c)}: ${q(c.meta.title)}`,
+        ]);
+        lines.push(...table(header, rows));
+        return { lines, data };
+    });
+}
+/** `baesian topics`: the canonical topics in use. Topics are slugs (`Topic`), so they print as they are. */
+export function topicsOp(s) {
+    s.requireInit();
+    const topics = [...s.view(() => s.topics())].sort();
+    if (!topics.length)
+        return { lines: [head(undefined, "no topics yet")], data: topics };
+    return {
+        lines: [head(undefined, `${topics.length} topic${topics.length === 1 ? "" : "s"} in use: reuse one only for the same question`), ...indent(2, topics.map((t) => text(t)))],
+        data: topics,
+    };
+}
+/** `baesian template`: the card draft to fill in, as it is, to save to a file. */
+export function templateOp() {
+    return { lines: CARD_TEMPLATE.trimEnd().split("\n").map(literal), data: { template: CARD_TEMPLATE } };
+}
+/**
+ * An error as the CLI and the MCP server both say it, word for word: its headline and next steps (`errorLines`), and for
+ * a card that isn't there, where to see the ones that are.
+ */
+export function failureLines(e) {
+    return [...errorLines(e), ...(e instanceof NoCard ? [next("baesian list --all", "the cards in this repo")] : [])];
+}
+//# sourceMappingURL=ops.js.map

package/dist/passkey.js

@@ -0,0 +1,86 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+// Passkey proofs (D139, D163): a WebAuthn assertion whose challenge is the SHA-256 digest of the file it proves (P16
+// section 7), so the reviewer's own passkey signed that file's bytes. Or, when one tap confirms several answers (B-a6xpc),
+// an assertion whose challenge is the digest of the list of their files' digests, which every proof of the batch holds,
+// so the passkey signed each file's digest as part of that list. Checked offline against a key pinned in CI (D159).
+// Checking an assertion needs no CBOR: only registration does, and that's the service's (M9c).
+/** User present and user verified: the face, fingerprint or PIN the proof stands for (D139). */
+const UP = 0x01;
+const UV = 0x04;
+const sha256 = (b) => createHash("sha256").update(b).digest();
+/** The challenge a proof of `file` must carry: its bytes' SHA-256 digest, in base64url, as WebAuthn encodes a challenge. */
+export function challengeOf(file) {
+    return sha256(file).toString("base64url");
+}
+/**
+ * What a batch's passkey signs (B-a6xpc): a line naming it, then each file's SHA-256 digest in lowercase hex, one per line.
+ * Its first line keeps it apart from any file a proof could be for: no verdict or preference file reads so.
+ */
+export function batchMessage(digests) {
+    return Buffer.from(`baesian-batch\n${digests.map((d) => `${d}\n`).join("")}`);
+}
+/** The challenge a batch's proofs carry: the SHA-256 digest of `batchMessage()`, in base64url. */
+export function batchChallenge(digests) {
+    return sha256(batchMessage(digests)).toString("base64url");
+}
+/**
+ * Why a passkey proof doesn't prove `file`, or undefined if it does. The proof must be an assertion (`webauthn.get`) for
+ * the service's origin and relying party, made with user verification, signed by `key`, whose challenge is the file's
+ * digest; or, in the batch form, whose challenge is the digest of its list, which must hold the file's digest. A proof
+ * made in a frame of another site doesn't count.
+ */
+export function proofProblem(proof, file, key, service) {
+    if (proof.credential !== key.credential)
+        return "it was made with another passkey";
+    if (proof.batch && !proof.batch.includes(sha256(file).toString("hex")))
+        return "its batch doesn't list the file's digest, so the passkey didn't confirm this file";
+    const clientDataJson = Buffer.from(proof.client_data, "base64url");
+    let client;
+    try {
+        const parsed = JSON.parse(clientDataJson.toString("utf8"));
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return "its client data isn't an object";
+        client = parsed;
+    }
+    catch {
+        return "its client data isn't JSON";
+    }
+    if (client.type !== "webauthn.get")
+        return `it's a ${String(client.type)}, not an assertion (webauthn.get)`;
+    if (proof.batch) {
+        if (client.challenge !== batchChallenge(proof.batch))
+            return "its challenge isn't the digest of its batch";
+    }
+    else if (client.challenge !== challengeOf(file))
+        return "its challenge isn't the file's digest";
+    if (client.origin !== service.origin)
+        return `it was made on ${String(client.origin)}, not ${service.origin}`;
+    if (client.crossOrigin === true)
+        return "it was made in a frame of another site";
+    const auth = Buffer.from(proof.authenticator_data, "base64url");
+    if (auth.length < 37)
+        return "its authenticator data is too short";
+    if (!auth.subarray(0, 32).equals(sha256(service.rp_id)))
+        return `it's for another relying party than ${service.rp_id}`;
+    const flags = auth[32];
+    if (!(flags & UP))
+        return "the passkey didn't see the reviewer present";
+    if (!(flags & UV))
+        return "the passkey didn't verify the reviewer (no face, fingerprint or PIN)";
+    const signed = Buffer.concat([auth, sha256(clientDataJson)]);
+    const signature = Buffer.from(proof.signature, "base64url");
+    try {
+        const pub = createPublicKey({ key: Buffer.from(key.public_key, "base64url"), format: "der", type: "spki" });
+        const ok = key.alg === -7
+            ? // WebAuthn's ECDSA signatures are DER, Node's default; workerd takes no key object inside an options object.
+                pub.asymmetricKeyType === "ec" && pub.asymmetricKeyDetails?.namedCurve === "prime256v1" && verify("sha256", signed, pub, signature)
+            : key.alg === -8
+                ? pub.asymmetricKeyType === "ed25519" && verify(null, signed, pub, signature)
+                : pub.asymmetricKeyType === "rsa" && verify("sha256", signed, pub, signature);
+        return ok ? undefined : "its signature doesn't match the passkey's key";
+    }
+    catch (e) {
+        return `its signature can't be checked (${e instanceof Error ? e.message : String(e)})`;
+    }
+}
+//# sourceMappingURL=passkey.js.map

package/dist/personal.js

@@ -0,0 +1,163 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { git } from "./git.js";
+import { RECORD_DIR } from "./store.js";
+import { parseTrailers } from "./trailers.js";
+// Personal mode (B-4rwyz): one person uses Baesian in a repo they share with collaborators who don't. Nothing of
+// Baesian's is committed: the config is the clone's (`PERSONAL_CONFIG`, in the live layer), the live layer plays the
+// record's part, the gate runs from hooks of the clone's own (src/hooks.ts, `installPersonalHooks()`), and AGENTS.md is
+// left alone. This module holds what the hooks and `baesian init` need for it that isn't the hooks themselves: keeping
+// the trailers out of shared history, and keeping a stray `.baesian/` out of commits.
+// ---------------------------------------------------------------- trailers, kept out of shared history
+/**
+ * The message with its `Baesian-Card` and `Baesian-Ack` trailers taken out (B-4rwyz), where git reads them as trailers:
+ * the lines of the message's last paragraph that are Baesian's, with any continuation lines, and the blank lines before
+ * that paragraph when nothing else was in it. Comment lines, and anything from a `--verbose` scissors line on, are left
+ * as they are: git takes them out itself. A message with no Baesian trailers is returned unchanged.
+ */
+export function withoutBaesianTrailers(raw, cwd) {
+    const t = parseTrailers(raw, cwd);
+    if (!t.cards.length && !t.acks.size && !t.malformed.length)
+        return raw;
+    const lines = raw.split("\n");
+    const blank = (i) => !lines[i].trim();
+    // The message as git records it: indexes of the lines that aren't comments, up to a scissors line (`cleanMessage()`).
+    const kept = [];
+    for (let i = 0; i < lines.length; i++) {
+        if (/^# -+ >8 -+\r?$/.test(lines[i]))
+            break;
+        if (!lines[i].startsWith("#"))
+            kept.push(i);
+    }
+    let end = kept.length;
+    while (end > 0 && blank(kept[end - 1]))
+        end--;
+    let start = end;
+    while (start > 0 && !blank(kept[start - 1]))
+        start--;
+    const drop = new Set();
+    let ours = false;
+    for (let k = start; k < end; k++) {
+        const line = lines[kept[k]];
+        if (/^[ \t]/.test(line)) {
+            if (ours)
+                drop.add(kept[k]);
+            continue;
+        }
+        ours = /^baesian-(card|ack)[ \t]*:/i.test(line);
+        if (ours)
+            drop.add(kept[k]);
+    }
+    if (!drop.size)
+        return raw;
+    if (kept.slice(start, end).every((i) => drop.has(i))) {
+        for (let k = start - 1; k >= 0 && blank(kept[k]); k--)
+            drop.add(kept[k]);
+    }
+    return lines.filter((_, i) => !drop.has(i)).join("\n");
+}
+// ---------------------------------------------------------------- the cards a commit cites, from commit-msg to post-commit
+/**
+ * Where `commit-msg` notes the cards a commit cites once it has taken their trailers out of the message, for
+ * `post-commit` to write the ledger from (D15): this worktree's own git directory, beside its index, as
+ * `baesian-staged.json` is. With the tree being committed, so a note left by a commit that failed after `commit-msg`
+ * is never taken for another's.
+ */
+function citedPath(top) {
+    return git(top, ["rev-parse", "--path-format=absolute", "--git-path", "baesian-cited.json"]);
+}
+/** Forget what an earlier commit attempt noted: `pre-commit` starts each commit afresh. */
+export function clearCited(top) {
+    rmSync(citedPath(top), { force: true });
+}
+/** Note the cards the commit being made cites, with its tree, as the index holds it now (`commit-msg`). */
+export function noteCited(top, cards) {
+    const path = citedPath(top);
+    if (!cards.length)
+        return rmSync(path, { force: true });
+    const tree = execFileSync("git", ["write-tree"], { cwd: top, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    writeFileSync(path, `${JSON.stringify({ tree, cards })}\n`);
+}
+/** The cards `commit-msg` noted for this commit, if its tree is the one noted; the note is gone after. */
+export function takeCited(top, commit) {
+    const path = citedPath(top);
+    if (!existsSync(path))
+        return [];
+    try {
+        const noted = JSON.parse(readFileSync(path, "utf8"));
+        const tree = git(top, ["rev-parse", `${commit}^{tree}`]);
+        return noted.tree === tree && Array.isArray(noted.cards) ? noted.cards.filter((c) => typeof c === "string") : [];
+    }
+    catch {
+        return [];
+    }
+    finally {
+        rmSync(path, { force: true });
+    }
+}
+/** A post-rewrite hook's input: each rewritten commit, and the commit it became. */
+export function rewrites(input) {
+    const out = new Map();
+    for (const line of input.split("\n")) {
+        const [from, to] = line.trim().split(/\s+/);
+        if (from && to && /^[0-9a-f]{40,64}$/.test(from) && /^[0-9a-f]{40,64}$/.test(to))
+            out.set(from, to);
+    }
+    return out;
+}
+// ---------------------------------------------------------------- `.baesian/`, never in a personal clone's commits
+const EXCLUDE_NOTE = "# Baesian, in personal mode (B-4rwyz): nothing of Baesian's is committed from this clone";
+const EXCLUDE_LINE = `/${RECORD_DIR}/`;
+/** The clone's own ignore file, `info/exclude` in git's common directory: never committed. */
+function excludePath(store) {
+    return git(store.repo.toplevel, ["rev-parse", "--path-format=absolute", "--git-path", "info/exclude"]);
+}
+/** Add `/.baesian/` to the clone's `info/exclude`, so a stray record is never committed. Returns whether it was added. */
+export function excludeRecord(store) {
+    const path = excludePath(store);
+    const text = existsSync(path) ? readFileSync(path, "utf8") : "";
+    if (text.split("\n").includes(EXCLUDE_LINE))
+        return false;
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${text}${text && !text.endsWith("\n") ? "\n" : ""}${EXCLUDE_NOTE}\n${EXCLUDE_LINE}\n`);
+    return true;
+}
+/** Take out what `excludeRecord()` added, when the clone switches to shared mode. Returns whether it was there. */
+export function includeRecord(store) {
+    const path = excludePath(store);
+    if (!existsSync(path))
+        return false;
+    const lines = readFileSync(path, "utf8").split("\n");
+    const next = lines.filter((l) => l !== EXCLUDE_NOTE && l !== EXCLUDE_LINE);
+    if (next.length === lines.length)
+        return false;
+    writeFileSync(path, next.join("\n"));
+    return true;
+}
+// ---------------------------------------------------------------- is the repo shared already?
+/**
+ * Why a clone can't be set up in personal mode, or nothing (B-4rwyz): some branch of the repo has committed a record,
+ * so the repo uses Baesian in shared mode already; or this worktree has a `.baesian/`, which `baesian init` wrote for
+ * shared mode and nobody committed.
+ */
+export function sharedAlready(store) {
+    const commit = recordCommit(store);
+    if (commit) {
+        return `this repo uses Baesian in shared mode already: its record, ${RECORD_DIR}/, is committed (in ${commit}), so its decisions travel with the code. Personal mode is for a repo whose collaborators don't use Baesian: run \`baesian init\` here instead.`;
+    }
+    if (existsSync(join(store.repo.toplevel, RECORD_DIR))) {
+        return `this worktree has a ${RECORD_DIR}/ that isn't committed, which \`baesian init\` writes for shared mode. Personal mode writes nothing in the repo: delete ${RECORD_DIR}/ (and Baesian's block in the repo's hooks, and in AGENTS.md, if \`baesian init\` added them), then run \`baesian init --personal\` again.`;
+    }
+    return undefined;
+}
+/** A commit on any branch that holds the record's config, by its short ID: then the repo is shared. */
+export function recordCommit(store) {
+    try {
+        return git(store.repo.toplevel, ["log", "--all", "-1", "--format=%h", "--", `${RECORD_DIR}/config.json`]) || undefined;
+    }
+    catch {
+        return undefined; // no commits yet
+    }
+}
+//# sourceMappingURL=personal.js.map