grokbot-control 0.0.0-stage → 0.1.3

package/dist/ops/session.js

@@ -0,0 +1,34 @@
+import { mapConnectError } from "../connect/client.js";
+import { failResult, newRequestId, okResult } from "../dto/result.js";
+import { GbcError } from "../errors.js";
+import { mapSession } from "./map.js";
+export class SessionOps {
+    client;
+    flags;
+    constructor(client, flags = {}) {
+        this.client = client;
+        this.flags = flags;
+    }
+    async list(agentId) {
+        const request_id = newRequestId();
+        try {
+            const res = await this.client.listGrokBotAgentSessions({ agentId });
+            return {
+                ...okResult({ sessions: (res.sessions ?? []).map(mapSession) }, { request_id }),
+                simulated: this.flags.simulated,
+            };
+        }
+        catch (e) {
+            const err = e instanceof GbcError ? e : mapConnectError(e, request_id);
+            return {
+                ...failResult(err.code, err.message, {
+                    outcome: err.outcome,
+                    retryable: err.retryable,
+                    hint: err.hint,
+                    request_id,
+                }),
+                simulated: this.flags.simulated,
+            };
+        }
+    }
+}

package/dist/ops/sidebar.d.ts

@@ -0,0 +1,70 @@
+import type { GrokBotClient } from "../connect/client.js";
+import { type ResultEnvelope } from "../dto/result.js";
+import type { SidebarSection } from "../dto/types.js";
+/**
+ * SidebarSections via Get/UpdateGrokBotUserRuntimeSettings.
+ * Only patches sidebar_sections (+ base). Not a cross-App transaction.
+ * Delete section ≠ delete bot. Room is separate (unsupported here).
+ */
+export declare class SidebarOps {
+    private client;
+    private flags;
+    private processLock;
+    constructor(client: GrokBotClient, flags?: {
+        simulated?: boolean;
+    });
+    private sim;
+    private locked;
+    list(): Promise<ResultEnvelope<{
+        sections: SidebarSection[];
+        note: string;
+    }>>;
+    patch(mutate: (sections: SidebarSection[]) => SidebarSection[], write?: {
+        dryRun?: boolean;
+        allowWrite?: boolean;
+        verify?: boolean;
+    }): Promise<ResultEnvelope<{
+        sections: SidebarSection[];
+        verified?: boolean;
+        note: string;
+    }>>;
+    createSection(name: string, write?: {
+        dryRun?: boolean;
+        allowWrite?: boolean;
+    }): Promise<ResultEnvelope<{
+        sections: SidebarSection[];
+        verified?: boolean;
+        note: string;
+    }>>;
+    renameSection(sectionId: string, name: string, write?: {
+        dryRun?: boolean;
+        allowWrite?: boolean;
+    }): Promise<ResultEnvelope<{
+        sections: SidebarSection[];
+        verified?: boolean;
+        note: string;
+    }>>;
+    deleteSection(sectionId: string, write?: {
+        dryRun?: boolean;
+        allowWrite?: boolean;
+        confirm?: string;
+    }): Promise<ResultEnvelope<{
+        sections: SidebarSection[];
+        verified?: boolean;
+        note: string;
+    }>>;
+    moveBot(agentId: string, toSectionId: string, write?: {
+        dryRun?: boolean;
+        allowWrite?: boolean;
+    }): Promise<ResultEnvelope<{
+        sections: SidebarSection[];
+        verified?: boolean;
+        note: string;
+    }>>;
+    private fromErr;
+}
+/**
+ * Semantic diff: section order (by id) and names are meaningful; agent_ids are
+ * compared as a set (in-section ordering changes are not treated as mismatch).
+ */
+export declare function diffSections(expected: SidebarSection[], actual: SidebarSection[]): string[];

package/dist/ops/sidebar.js

@@ -0,0 +1,205 @@
+import { mapConnectError } from "../connect/client.js";
+import { failResult, newRequestId, okResult } from "../dto/result.js";
+import { GbcError } from "../errors.js";
+import { mapSection } from "./map.js";
+/**
+ * SidebarSections via Get/UpdateGrokBotUserRuntimeSettings.
+ * Only patches sidebar_sections (+ base). Not a cross-App transaction.
+ * Delete section ≠ delete bot. Room is separate (unsupported here).
+ */
+export class SidebarOps {
+    client;
+    flags;
+    processLock = Promise.resolve();
+    constructor(client, flags = {}) {
+        this.client = client;
+        this.flags = flags;
+    }
+    sim(r) {
+        if (this.flags.simulated)
+            r.simulated = true;
+        return r;
+    }
+    async locked(fn) {
+        let release;
+        const next = new Promise((r) => {
+            release = r;
+        });
+        const prev = this.processLock;
+        this.processLock = next;
+        await prev;
+        try {
+            return await fn();
+        }
+        finally {
+            release();
+        }
+    }
+    async list() {
+        const request_id = newRequestId();
+        try {
+            const res = await this.client.getGrokBotUserRuntimeSettings({});
+            const sections = (res.settings?.sidebarSections?.sections ?? []).map(mapSection);
+            return this.sim(okResult({
+                sections,
+                note: "Read of SidebarSections only. Room/TeamGroup are not sidebar.",
+            }, { request_id }));
+        }
+        catch (e) {
+            return this.fromErr(e, request_id);
+        }
+    }
+    async patch(mutate, write) {
+        return this.locked(async () => {
+            const request_id = newRequestId();
+            try {
+                const current = await this.client.getGrokBotUserRuntimeSettings({});
+                const baseSections = (current.settings?.sidebarSections?.sections ?? []).map(mapSection);
+                const next = mutate(structuredClone(baseSections));
+                if (write?.dryRun) {
+                    return this.sim(okResult({
+                        sections: next,
+                        note: "dry-run: would UpdateGrokBotUserRuntimeSettings with sections+base only",
+                    }, { request_id, code: "dry_run" }));
+                }
+                if (!write?.allowWrite && process.env.GBT_ALLOW_WRITES !== "1") {
+                    return this.sim(failResult("denied", "need --allow-writes for sidebar write", { request_id }));
+                }
+                let writeSent = false;
+                try {
+                    writeSent = true;
+                    await this.client.updateGrokBotUserRuntimeSettings({
+                        sidebarSections: { sections: toWire(next) },
+                        sidebarSectionsBase: { sections: toWire(baseSections) },
+                    });
+                }
+                catch (e) {
+                    const err = e instanceof GbcError ? e : mapConnectError(e, request_id, { write: true });
+                    if (err.code === "failed_precondition" || /SidebarSectionsSaveConflict|conflict/i.test(err.message) && err.code !== "unknown") {
+                        return this.sim(failResult("sidebar_conflict", err.message, {
+                            request_id,
+                            hint: "Re-list sidebar, re-apply minimal patch, write again. No strong cross-App guarantee.",
+                        }));
+                    }
+                    return this.fromErr(err, request_id);
+                }
+                if (write?.verify === false) {
+                    return this.sim(okResult({ sections: next, note: "Wrote sections+base; verify skipped" }, { request_id }));
+                }
+                let got;
+                try {
+                    const again = await this.client.getGrokBotUserRuntimeSettings({});
+                    got = (again.settings?.sidebarSections?.sections ?? []).map(mapSection);
+                }
+                catch (e) {
+                    const err = e instanceof GbcError ? e : mapConnectError(e, request_id);
+                    return this.sim(failResult("sidebar_unverified", `write sent but read-back failed: ${err.message}`, {
+                        request_id,
+                        outcome: "unknown",
+                        hint: "Re-run `gbc sidebar list` and compare before retrying.",
+                        details: { write_sent: writeSent, expected: next },
+                    }));
+                }
+                const diff = diffSections(next, got);
+                if (diff.length > 0) {
+                    return this.sim(failResult("sidebar_unverified", "sidebar read-back does not match the intended state", {
+                        request_id,
+                        outcome: "unknown",
+                        hint: "Write may have been dropped or overwritten concurrently. Re-list and re-apply; do not blindly retry.",
+                        details: { diff, expected: next, actual: got },
+                    }));
+                }
+                return this.sim(okResult({
+                    sections: got,
+                    verified: true,
+                    note: "Verified: section order, names and agent membership match (agent_ids order not compared). Best-effort base CAS only; not cross-App transactional.",
+                }, { request_id }));
+            }
+            catch (e) {
+                return this.fromErr(e, request_id);
+            }
+        });
+    }
+    createSection(name, write) {
+        return this.patch((sections) => {
+            sections.push({ id: crypto.randomUUID(), name, agent_ids: [] });
+            return sections;
+        }, write);
+    }
+    renameSection(sectionId, name, write) {
+        return this.patch((sections) => {
+            const s = sections.find((x) => x.id === sectionId);
+            if (!s)
+                throw new GbcError("not_found", `section ${sectionId} not found`, { exitCode: 5 });
+            s.name = name;
+            return sections;
+        }, write);
+    }
+    deleteSection(sectionId, write) {
+        if (!write?.dryRun && write?.confirm !== sectionId) {
+            return Promise.resolve(this.sim(failResult("denied", "delete section requires --confirm=<section_id> matching --section-id", {
+                request_id: newRequestId(),
+                hint: `gbc sidebar delete --section-id ${sectionId} --confirm=${sectionId} --allow-writes`,
+            })));
+        }
+        return this.patch((sections) => {
+            const next = sections.filter((x) => x.id !== sectionId);
+            if (next.length === sections.length) {
+                throw new GbcError("not_found", `section ${sectionId} not found`, { exitCode: 5 });
+            }
+            return next;
+        }, write);
+    }
+    moveBot(agentId, toSectionId, write) {
+        return this.patch((sections) => {
+            for (const s of sections) {
+                s.agent_ids = s.agent_ids.filter((id) => id !== agentId);
+            }
+            const dest = sections.find((s) => s.id === toSectionId);
+            if (!dest)
+                throw new GbcError("not_found", `section ${toSectionId} not found`, { exitCode: 5 });
+            dest.agent_ids.push(agentId);
+            return sections;
+        }, write);
+    }
+    fromErr(e, request_id) {
+        const err = e instanceof GbcError ? e : mapConnectError(e, request_id);
+        return this.sim(failResult(err.code, err.message, {
+            outcome: err.outcome,
+            retryable: err.retryable,
+            hint: err.hint,
+            request_id,
+        }));
+    }
+}
+function toWire(sections) {
+    return sections.map((s) => ({ id: s.id, name: s.name, agentIds: s.agent_ids }));
+}
+/**
+ * Semantic diff: section order (by id) and names are meaningful; agent_ids are
+ * compared as a set (in-section ordering changes are not treated as mismatch).
+ */
+export function diffSections(expected, actual) {
+    const out = [];
+    const eIds = expected.map((s) => s.id);
+    const aIds = actual.map((s) => s.id);
+    if (eIds.join("\u0000") !== aIds.join("\u0000")) {
+        out.push(`section order/ids differ: expected [${eIds.join(",")}] got [${aIds.join(",")}]`);
+    }
+    const byId = new Map(actual.map((s) => [s.id, s]));
+    for (const e of expected) {
+        const a = byId.get(e.id);
+        if (!a)
+            continue;
+        if (a.name !== e.name)
+            out.push(`section ${e.id} name: expected "${e.name}" got "${a.name}"`);
+        const want = new Set(e.agent_ids);
+        const have = new Set(a.agent_ids);
+        const missing = [...want].filter((x) => !have.has(x));
+        const extra = [...have].filter((x) => !want.has(x));
+        if (missing.length || extra.length) {
+            out.push(`section ${e.id} agents: missing [${missing.join(",")}] extra [${extra.join(",")}]`);
+        }
+    }
+    return out;
+}

package/dist/sync/attachments.d.ts

@@ -0,0 +1,76 @@
+export declare const ATTACHMENT_DOWNLOADER = "resolve-attachment-reads/0.79.3-ondemand-v1";
+export declare const DEFAULT_ATTACH: {
+    readonly maxFileBytes: number;
+    readonly maxBytes: number;
+    readonly timeoutMs: 30000;
+    readonly resolveBatch: 8;
+};
+export declare const HARD_ATTACH: {
+    readonly maxFileBytes: number;
+    readonly maxBytes: number;
+    readonly timeoutMs: 300000;
+    readonly resolveBatch: 32;
+    readonly pathBytes: 4096;
+};
+export type AttachmentLocalStatus = "ok" | "not_in_store" | "no_storage" | "error" | "skipped";
+export type AttachmentLocal = {
+    remote_path: string;
+    status: AttachmentLocalStatus;
+    relative_path?: string;
+    content_sha256?: string;
+    size_bytes?: number;
+    content_type?: string;
+    etag?: string;
+    reason?: string;
+    observed_at_ms: string;
+    live_verified: false;
+};
+export declare function assertRemotePath(value: string): string;
+export declare function pathKey(remotePath: string): string;
+export declare function objectRel(agentId: string, sha256: string): string;
+export declare function refRel(agentId: string, remotePath: string, sessionId?: string): string;
+export declare function mapOutcome(outcome: unknown): AttachmentLocalStatus | "store";
+export type ResolvedStore = {
+    remote_path: string;
+    url: string;
+    expires_at_ms?: number;
+    content_type?: string;
+    size_bytes?: number;
+    etag?: string;
+};
+/** Validate STORE read without exposing the URL to callers' logs. */
+export declare function acceptStoreRead(remotePath: string, read: any, nowMs: number): {
+    ok: true;
+    store: ResolvedStore;
+} | {
+    ok: false;
+    status: AttachmentLocalStatus;
+    reason: string;
+};
+export type FetchFn = (input: string, init?: RequestInit) => Promise<Response>;
+export type TransferBudget = {
+    bytes: number;
+    maxBytes: number;
+    deadline: number;
+};
+/** Stream directly into a private staging sink. Failed network bytes count too. */
+export declare function downloadToStage(url: string, opts: {
+    maxBytes: number;
+    expectedSize?: number;
+    budget: TransferBudget;
+    fetchImpl: FetchFn;
+    etag?: string;
+    sink: {
+        write(bytes: Uint8Array): void;
+        discard(): void;
+    };
+}): Promise<{
+    status: number;
+    digest?: string;
+    size?: number;
+}>;
+export declare function sha256Hex(data: Uint8Array): string;
+export declare function redactAttachmentError(e: unknown): {
+    status: AttachmentLocalStatus;
+    reason: string;
+};

package/dist/sync/attachments.js

@@ -0,0 +1,274 @@
+/** On-demand user-attachment download (App 0.79.3 ResolveGrokBotAttachmentReads evidence).
+ * Not transcript blob_hash hydration. Signed URLs are never persisted or echoed.
+ */
+import { createHash } from "node:crypto";
+import { GbcError } from "../errors.js";
+import { component } from "./fs.js";
+export const ATTACHMENT_DOWNLOADER = "resolve-attachment-reads/0.79.3-ondemand-v1";
+export const DEFAULT_ATTACH = {
+    maxFileBytes: 32 * 1024 * 1024,
+    maxBytes: 64 * 1024 * 1024,
+    timeoutMs: 30000,
+    resolveBatch: 8,
+};
+export const HARD_ATTACH = {
+    maxFileBytes: 128 * 1024 * 1024,
+    maxBytes: 256 * 1024 * 1024,
+    timeoutMs: 300000,
+    resolveBatch: 32,
+    pathBytes: 4096,
+};
+// App main-core: /home/box/agent-data (model alias), /home/box/sand-data.
+// These strings are REMOTE references, never paths read from this computer.
+export function assertRemotePath(value) {
+    if (typeof value !== "string" ||
+        !value ||
+        Buffer.byteLength(value) > 4096 ||
+        /[\x00-\x1f\x7f\\]/.test(value))
+        throw new GbcError("invalid_argument", "invalid remote attachment reference");
+    let p = value;
+    if (p.startsWith("file:")) {
+        let u;
+        try {
+            u = new URL(p);
+        }
+        catch {
+            throw new GbcError("invalid_argument", "invalid remote file URL");
+        }
+        if (u.host ||
+            u.search ||
+            u.hash ||
+            p !== `file://${u.pathname}` ||
+            /%2f|%5c/i.test(u.pathname))
+            throw new GbcError("invalid_argument", "invalid remote file URL");
+        try {
+            p = decodeURIComponent(u.pathname);
+        }
+        catch {
+            throw new GbcError("invalid_argument", "invalid remote file URL encoding");
+        }
+    }
+    if (/[\x00-\x1f\x7f\\]/.test(p) ||
+        p.split("/").some((x) => x === "." || x === ".."))
+        throw new GbcError("invalid_argument", "unsafe remote attachment reference");
+    const m = /^\/home\/box\/(?:agent-data|sand-data)\/agents\/([A-Za-z0-9._-]{1,128})\/(attachments|assets)\/([0-9a-f]{64}\.[0-9a-z]{1,16})$/.exec(p);
+    if (!m || m[1] === "." || m[1] === "..")
+        throw new GbcError("unsupported", "not a supported App store attachment alias");
+    return `/home/box/agent-data/agents/${m[1]}/${m[2]}/${m[3]}`;
+}
+export function pathKey(remotePath) {
+    return createHash("sha256")
+        .update(assertRemotePath(remotePath))
+        .digest("hex");
+}
+export function objectRel(agentId, sha256) {
+    if (!/^[0-9a-f]{64}$/.test(sha256))
+        throw new GbcError("invalid_argument", "invalid content hash");
+    return `bots/${component(agentId)}/attachments/objects/sha256-${sha256}`;
+}
+export function refRel(agentId, remotePath, sessionId = "") {
+    const sk = createHash("sha256").update(sessionId).digest("hex");
+    return `bots/${component(agentId)}/attachments/refs-v2/${sk}/${pathKey(remotePath)}.json`;
+}
+export function mapOutcome(outcome) {
+    const n = typeof outcome === "number"
+        ? outcome
+        : typeof outcome === "bigint"
+            ? Number(outcome)
+            : undefined;
+    const s = typeof outcome === "string" ? outcome : undefined;
+    if (n === 1 ||
+        s === "STORE" ||
+        s === "GROK_BOT_ATTACHMENT_READ_OUTCOME_STORE")
+        return "store";
+    if (n === 2 ||
+        s === "NOT_IN_STORE" ||
+        s === "GROK_BOT_ATTACHMENT_READ_OUTCOME_NOT_IN_STORE")
+        return "not_in_store";
+    if (n === 3 ||
+        s === "NO_STORAGE" ||
+        s === "GROK_BOT_ATTACHMENT_READ_OUTCOME_NO_STORAGE")
+        return "no_storage";
+    return "error";
+}
+function int64Ms(v) {
+    if (v === undefined || v === null || v === "")
+        return undefined;
+    if (typeof v === "bigint") {
+        if (v > BigInt(Number.MAX_SAFE_INTEGER) || v < 0n)
+            return undefined;
+        return Number(v);
+    }
+    if (typeof v === "number" && Number.isSafeInteger(v) && v >= 0)
+        return v;
+    if (typeof v === "string" && /^\d+$/.test(v)) {
+        const n = Number(v);
+        return Number.isSafeInteger(n) ? n : undefined;
+    }
+    return undefined;
+}
+function int64Size(v) {
+    return int64Ms(v);
+}
+/** Validate STORE read without exposing the URL to callers' logs. */
+export function acceptStoreRead(remotePath, read, nowMs) {
+    const path = String(read?.path ?? "");
+    if (path !== remotePath)
+        return {
+            ok: false,
+            status: "error",
+            reason: "resolve_path_mismatch",
+        };
+    const mapped = mapOutcome(read?.outcome);
+    if (mapped !== "store")
+        return {
+            ok: false,
+            status: mapped === "error" ? "error" : mapped,
+            reason: mapped === "error" ? "resolve_outcome_unusable" : mapped,
+        };
+    const url = read?.url;
+    if (typeof url !== "string" || !url)
+        return { ok: false, status: "error", reason: "store_missing_url" };
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return { ok: false, status: "error", reason: "store_url_unusable" };
+    }
+    if (parsed.protocol !== "https:" ||
+        parsed.username ||
+        parsed.password ||
+        parsed.hash ||
+        (parsed.port && parsed.port !== "443"))
+        return { ok: false, status: "error", reason: "store_url_not_https" };
+    const expires = int64Ms(read?.expiresAtMs ?? read?.expires_at_ms);
+    if (expires === undefined || expires <= nowMs + 1000)
+        return { ok: false, status: "error", reason: "store_url_expired" };
+    const size = int64Size(read?.sizeBytes ?? read?.size_bytes);
+    const contentType = typeof read?.contentType === "string"
+        ? read.contentType
+        : typeof read?.content_type === "string"
+            ? read.content_type
+            : undefined;
+    const etag = typeof read?.etag === "string" ? read.etag : undefined;
+    if (size === undefined ||
+        !etag ||
+        etag.length > 512 ||
+        /[\x00-\x20\x7f]/.test(etag))
+        return { ok: false, status: "error", reason: "invalid_store_metadata" };
+    if (contentType &&
+        (contentType.length > 256 || /[\x00-\x1f\x7f]/.test(contentType)))
+        return { ok: false, status: "error", reason: "invalid_store_metadata" };
+    return {
+        ok: true,
+        store: {
+            remote_path: remotePath,
+            url,
+            expires_at_ms: expires,
+            content_type: contentType,
+            size_bytes: size,
+            etag,
+        },
+    };
+}
+/** Stream directly into a private staging sink. Failed network bytes count too. */
+export async function downloadToStage(url, opts) {
+    const remain = opts.budget.deadline - Date.now();
+    if (remain <= 0)
+        throw new GbcError("deadline_exceeded", "attachment command deadline");
+    if (opts.expectedSize !== undefined &&
+        (opts.expectedSize > opts.maxBytes ||
+            opts.expectedSize > opts.budget.maxBytes - opts.budget.bytes))
+        throw new GbcError("resource_exhausted", "attachment size exceeds remaining budget");
+    const ac = new AbortController(), timer = setTimeout(() => ac.abort(), remain);
+    let reader;
+    let response;
+    const aborted = new Promise((_, reject) => ac.signal.addEventListener("abort", () => reject(new GbcError("deadline_exceeded", "attachment deadline")), { once: true }));
+    try {
+        const headers = {};
+        if (opts.etag)
+            headers["if-none-match"] =
+                opts.etag.startsWith('"') || opts.etag.startsWith("W/")
+                    ? opts.etag
+                    : `"${opts.etag}"`;
+        const res = await Promise.race([
+            opts.fetchImpl(url, {
+                method: "GET",
+                headers,
+                redirect: "error",
+                signal: ac.signal,
+            }),
+            aborted,
+        ]);
+        response = res;
+        if (res.status === 403 || (res.status === 304 && opts.etag)) {
+            await res.body?.cancel();
+            return { status: res.status };
+        }
+        if (res.status !== 200)
+            throw new GbcError("unavailable", "attachment HTTP response rejected");
+        const len = res.headers.get("content-length");
+        if (len !== null &&
+            (!/^\d+$/.test(len) ||
+                !Number.isSafeInteger(Number(len)) ||
+                Number(len) > opts.maxBytes ||
+                Number(len) > opts.budget.maxBytes - opts.budget.bytes ||
+                (opts.expectedSize !== undefined && Number(len) !== opts.expectedSize)))
+            throw new GbcError("failed_precondition", "attachment size header mismatch");
+        const h = createHash("sha256");
+        let size = 0;
+        reader = res.body?.getReader();
+        if (!reader && opts.expectedSize !== 0)
+            throw new GbcError("failed_precondition", "attachment body missing");
+        while (reader) {
+            if (Date.now() >= opts.budget.deadline)
+                throw new GbcError("deadline_exceeded", "attachment command deadline");
+            const { value, done } = await Promise.race([reader.read(), aborted]);
+            if (done)
+                break;
+            size += value.byteLength;
+            opts.budget.bytes += value.byteLength;
+            if (size > opts.maxBytes ||
+                (opts.expectedSize !== undefined && size > opts.expectedSize) ||
+                opts.budget.bytes > opts.budget.maxBytes)
+                throw new GbcError("resource_exhausted", "attachment streaming budget exceeded");
+            h.update(value);
+            opts.sink.write(value);
+        }
+        if ((opts.expectedSize !== undefined && size !== opts.expectedSize) ||
+            (len !== null && size !== Number(len)))
+            throw new GbcError("failed_precondition", "attachment size mismatch");
+        return { status: 200, digest: h.digest("hex"), size };
+    }
+    catch (e) {
+        if (e instanceof GbcError)
+            throw e;
+        throw new GbcError(ac.signal.aborted ? "deadline_exceeded" : "unavailable", "attachment transfer failed (URL suppressed)");
+    }
+    finally {
+        clearTimeout(timer);
+        if (reader) {
+            void reader.cancel().catch(() => { });
+        }
+        else if (response?.body) {
+            void response.body.cancel().catch(() => { });
+        }
+        // Do not reject the already-finished abort promise in finally.
+    }
+}
+export function sha256Hex(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+export function redactAttachmentError(e) {
+    if (e instanceof GbcError) {
+        if (e.code === "resource_exhausted")
+            return { status: "error", reason: "size_or_budget" };
+        if (e.code === "deadline_exceeded")
+            return { status: "error", reason: "timeout" };
+        if (e.code === "unavailable")
+            return { status: "error", reason: "http_or_transport" };
+        return { status: "error", reason: e.code };
+    }
+    return { status: "error", reason: "download_failed" };
+}