@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/oracle.js

@@ -0,0 +1,245 @@
+/**
+ * YOUR oracle — the shape a provider passes to `defineOracle()` (define-oracle.ts), and the
+ * one-per-worker registry the rest of the kit reads it through.
+ *
+ * Everything else in this package is the machinery every evaluation oracle shares (pull, facts,
+ * decide-via-engine, act). What makes it *your* oracle is here: what it is called, which protocols'
+ * claims it knows how to produce facts for, HOW it produces the facts a rubric asks for, and the
+ * policies it acts under. Deployment-specific values (hosts, DIDs, keys) are NOT here — those are
+ * your wrangler.jsonc `vars` and `.dev.vars` secrets, validated by src/config.ts.
+ */
+import { z } from "zod";
+import { Iso4217, PayoutPath } from "./lib/engine/types.js";
+/** A per-evaluation fee: `minAmount` is an integer base-unit string, compared with BigInt. */
+const FeeSchema = z.object({
+    denom: z.string().min(1),
+    minAmount: z.string().regex(/^\d+$/, "minAmount is an integer base-unit string"),
+});
+/** Protocol entity DIDs, wherever this config names one — `supportedProtocols` and the keys of
+ *  `pricing.byProtocol` / `pricing.api.byProtocol`, compared against the same value. */
+const ProtocolDid = z.string().startsWith("did:ixo:entity:");
+/**
+ * An API-lane price in micro-USD: a whole number of cents, at least 1¢ (owner, 2026-09-28) — so
+ * the cents a key's daily cap sums are exact and the upay the facilitator checks never has to be
+ * rebuilt from them. A price like 1.5¢ is a config error at startup, not a rounding at runtime.
+ */
+const MicroUsdPrice = z
+    .int()
+    .min(10_000, "a price is at least 1 cent (10000 µUSD)")
+    .multipleOf(10_000, "a price is a whole number of cents (a multiple of 10000 µUSD)");
+/**
+ * S16 (payouts design §4.7) — where a protocol's claims carry the amount to pay, and in what. The
+ * oracle forwards this to the engine as the `payout` block; the ENGINE reads and validates the
+ * amount and binds the payment into the decision's receipt (typed `DecisionToPayCredential` on an
+ * approved payout). The oracle never computes money.
+ */
+const PayoutConfigSchema = z.strictObject({
+    /** The answer that holds the amount: a decimal string or a plain JSON number. */
+    amount: PayoutPath,
+    /** An ISO 4217 code, the answer that names one, or an on-chain asset (CAIP-19) with its decimals. */
+    currency: z.union([
+        Iso4217,
+        z.strictObject({ path: PayoutPath }),
+        z.strictObject({
+            asset: z.string().regex(/^eip155:\d+\/erc20:0x[0-9a-fA-F]{40}$/, "a CAIP-19 ERC-20 asset id"),
+            decimals: z.int().min(0).max(18),
+        }),
+    ]),
+    // No payee and no readers: the engine derives both (ENGINE-CONTRACT "Company authority") — the
+    // payee from the claim, the one reader from the company entity's `#payouts` service.
+});
+const BaseConfigSchema = z.object({
+    /** The marketplace label — and the memo on every `MsgEvaluateClaim` this oracle signs. */
+    name: z.string().min(1),
+    description: z.string(),
+    /**
+     * Protocol entity DIDs (`did:ixo:entity:…`) this oracle evaluates claims for — the marketplace
+     * listing served publicly at `GET /v1/info` and enforced at register (gate 3,
+     * `routes/v1/collections.ts`): a collection whose protocol isn't in this list is refused (409).
+     * Empty ⇒ no restriction — the unconfigured default watches whatever passes the money/grant
+     * gates, whatever its protocol.
+     * Convention: in practice this holds exactly one entry — one oracle owns one protocol.
+     */
+    supportedProtocols: z.array(ProtocolDid),
+    /**
+     * The fee this oracle requires per evaluation. A collection can be registered here only if its
+     * on-chain evaluation payment (`Payments.evaluation`) is in this denom and at least this amount,
+     * because the chain's 80/10/10 split of THAT payment — paid on every `MsgEvaluateClaim` — is how
+     * the oracle earns; anything less is evaluating for free, so the register is refused (402).
+     */
+    pricing: z.object({
+        /**
+         * The default fee — what every protocol not listed in `byProtocol` is held to. The
+         * `EVALUATION_DENOM` / `EVALUATION_MIN_AMOUNT` vars replace it per network when set (required
+         * on mainnet — `effectivePricing` below), so the coin can differ between devnet and mainnet.
+         */
+        evaluation: FeeSchema,
+        /**
+         * Per-protocol override of `evaluation`, keyed by protocol entity DID. Register's gate 4
+         * (`routes/v1/collections.ts`) resolves the collection's own protocol against this map first,
+         * falling back to `evaluation` when the protocol isn't listed. `minAmount: "0"` lets that
+         * protocol's collections register with an EMPTY `Payments.evaluation` leg — for an oracle whose
+         * income for it isn't the evaluation split (`requireEvaluationPayment`'s zero rule,
+         * `lib/ixo/payment.ts`). A capability any oracle can use, not just one serving a single
+         * protocol at a zero fee. `GET /v1/info` advertises this map alongside `evaluation`.
+         */
+        byProtocol: z.record(ProtocolDid, FeeSchema).optional(),
+        /**
+         * The Decision API's price per decision, in micro-USD (1 upay = 1 µUSD; $1.20 = 1_200_000) —
+         * a different thing from the chain fees above. Published at `GET /v1/api/protocols/:did`
+         * (payments spec §3.1), quoted in every 402, and checked by the facilitator against every
+         * offer: a function of the PROTOCOL alone, never the source. `byProtocol` first, then
+         * `amountMicroUsd`; absent ⇒ the `API_PRICE_USD_CENTS` var (× 10 000), and with neither the
+         * protocol has no price (`price: null`, nothing is offered for it).
+         */
+        api: z
+            .object({
+            amountMicroUsd: MicroUsdPrice,
+            byProtocol: z.record(ProtocolDid, MicroUsdPrice).optional(),
+        })
+            .optional(),
+    }),
+    /**
+     * S16 Decision Payouts: per protocol (keyed by protocol DID), where a claim's payout amount and
+     * currency live. Every claim of a listed protocol sends the block; the engine derives the payee.
+     * Absent ⇒ no payout block is ever sent, nothing changes. Submitter ids should be opaque (never
+     * a name, email or phone): the receipt's payment binding names the payee by that id, and the
+     * receipt is public.
+     */
+    payouts: z.record(ProtocolDid, PayoutConfigSchema).optional(),
+    policies: z.object({
+        /** Mirrors the `AUTO_SIGN` var: sign `MsgEvaluateClaim` on a terminal verdict unattended. */
+        autoSign: z.boolean(),
+        /**
+         * Run `aiChecks` at all. `false` ⇒ every AI fact freezes as `error / ai-checks-disabled` with
+         * NO model call, and the rubric's own `onError` (review/reject) carries — never approve on a
+         * check that didn't run.
+         */
+        allowAiChecks: z.boolean(),
+        /**
+         * Screen an AI check's image inputs for C2PA Content Credentials before the model call (needs
+         * the `C2PA_IMAGE_CHECK` var on too). Fail-safe: a trusted AI-generated manifest can only ever
+         * ADD a rejection.
+         */
+        allowImageChecks: z.boolean(),
+        /**
+         * The act seam (act.ts) — what to do with a decided verdict at signing time: sign it (with an
+         * amount of the provider's own choosing, which stands only on a collection whose owner set
+         * `operatorAmounts: allowed`), HOLD it for a later `signEvaluation`, or skip it.
+         * Zod only carries it through, like `facts` below; the TYPE is the contract. Absent ⇒ the lane
+         * signs every terminal verdict it can, as it always did.
+         */
+        act: z.custom().optional(),
+        /**
+         * How `act` picks an amount, in the operator's own plain words — published on `GET /v1/info`
+         * as `payouts.operatorAmount.summary` so a company sees how it is paid before opting in to
+         * `operatorAmounts`. Shown only alongside an `act` policy; the oracle never derives one.
+         */
+        actSummary: z.string().min(1).max(500).optional(),
+        /**
+         * Let an AI app's STANDING approval (the user's own auto-approve limits on the hosted MCP
+         * server) pay for a submit without a per-claim approval (company authority D8). Off ⇒ AuthHub
+         * cannot set one here (`403 standing_approvals_off`), a standing already stored never pays,
+         * and every OAuth submit needs the user's approval of that claim.
+         */
+        allowStandingApprovals: z.boolean(),
+    }),
+    /**
+     * HOW this oracle produces facts — the provider seam. Zod only carries it through; the TYPE
+     * below is the contract. Absent ⇒ the stock lanes for everything (lib/facts/stock/): every
+     * source as a self-signed UCAN POST, every AI check via OpenRouter.
+     */
+    facts: z.custom().optional(),
+    /** The answer archive's hooks (`ArchiveHooks` below) — Zod only carries them, like `facts`. */
+    archive: z.custom().optional(),
+});
+/**
+ * A per-protocol price this oracle could never charge is refused at module evaluation, not
+ * discovered as a surprise 402/409 the first time that protocol's collection registers: with a
+ * non-empty `supportedProtocols`, register's PROTOCOL gate (gate 3) turns away every collection
+ * whose protocol is not on the list, so gate 4 never reaches the price keyed under it.
+ */
+export const OracleConfigSchema = BaseConfigSchema.superRefine((config, ctx) => {
+    const supported = config.supportedProtocols;
+    if (supported.length === 0)
+        return; // no restriction ⇒ every key is reachable
+    for (const protocol of Object.keys(config.pricing.byProtocol ?? {})) {
+        if (!supported.includes(protocol)) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["pricing", "byProtocol", protocol],
+                message: `${protocol} is not in supportedProtocols — its collections are refused at register, so this price can never be charged`,
+            });
+        }
+    }
+    for (const protocol of Object.keys(config.pricing.api?.byProtocol ?? {})) {
+        if (!supported.includes(protocol)) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["pricing", "api", "byProtocol", protocol],
+                message: `${protocol} is not in supportedProtocols — it is not in this oracle's catalogue, so this price can never be charged`,
+            });
+        }
+    }
+    for (const protocol of Object.keys(config.payouts ?? {})) {
+        if (!supported.includes(protocol)) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["payouts", protocol],
+                message: `${protocol} is not in supportedProtocols — no claim of it is ever evaluated here, so this payout can never be sent`,
+            });
+        }
+    }
+});
+/**
+ * The evaluation fee a collection of `protocolDid` is held to — `pricing.byProtocol[protocolDid]`
+ * (own keys only: an inherited name is not a protocol), else `pricing.evaluation`. Register's gate 4
+ * charges by it, and `oracle init` advertises the same number on the Agent Card.
+ */
+export function evaluationFeeFor(pricing, protocolDid) {
+    return pricing.byProtocol && Object.hasOwn(pricing.byProtocol, protocolDid)
+        ? pricing.byProtocol[protocolDid]
+        : pricing.evaluation;
+}
+/**
+ * The pricing this deployment charges by: `pricing` with `evaluation` replaced by the per-network
+ * `EVALUATION_DENOM` / `EVALUATION_MIN_AMOUNT` vars when they are set (config.ts — both or neither,
+ * required on mainnet), else exactly what `defineOracle` was given. Register's gate 4 and
+ * `/v1/info` both read it, so `oracle init` cards the same fee the gate charges.
+ */
+export function effectivePricing(pricing, vars) {
+    return vars.EVALUATION_DENOM && vars.EVALUATION_MIN_AMOUNT
+        ? {
+            ...pricing,
+            evaluation: { denom: vars.EVALUATION_DENOM, minAmount: vars.EVALUATION_MIN_AMOUNT },
+        }
+        : pricing;
+}
+/**
+ * ONE oracle per worker. `defineOracle()` (the provider's entry module) registers it at module
+ * evaluation — before any request, cron tick or workflow run — and the four places that used to
+ * read a static config module read it here. A registry rather than dependency injection because
+ * Workflow classes are instantiated by the runtime, not by us, and the alternative was threading
+ * the oracle through every step's deps.
+ */
+let current = null;
+export function setOracle(o) {
+    // Identity of the PROVIDER's own object, not deep equality and not the parsed copy: re-registering
+    // the same config is the module graph being evaluated twice (bundlers, the vitest pool), which is
+    // harmless — but Zod's `parse` returns a fresh object every call, so comparing `config` would
+    // read that harmless double evaluation as a second oracle. A different `source` IS two oracles.
+    if (current && current.source !== o.source) {
+        throw new Error("defineOracle() was already called — one oracle per worker");
+    }
+    current = o;
+}
+export function getOracle() {
+    if (!current) {
+        throw new Error("defineOracle() was never called — export it from your worker entry");
+    }
+    return current;
+}
+export function resetOracleForTests() {
+    current = null;
+}
+//# sourceMappingURL=oracle.js.map

package/dist/oracle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracle.js","sourceRoot":"","sources":["../src/oracle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGzD,8FAA8F;AAC9F,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,0CAA0C,CAAC;CACjF,CAAC,CAAC;AAEH;wFACwF;AACxF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAE7D;;;;GAIG;AACH,MAAM,aAAa,GAAG,CAAC;KACpB,GAAG,EAAE;KACL,GAAG,CAAC,MAAM,EAAE,yCAAyC,CAAC;KACtD,UAAU,CAAC,MAAM,EAAE,+DAA+D,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC;IACxC,iFAAiF;IACjF,MAAM,EAAE,UAAU;IAClB,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;QAChB,OAAO;QACP,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACpC,CAAC,CAAC,YAAY,CAAC;YACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uCAAuC,EAAE,2BAA2B,CAAC;YAC7F,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SACjC,CAAC;KACH,CAAC;IACF,+FAA+F;IAC/F,qFAAqF;CACtF,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,0FAA0F;IAC1F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;;;OAOG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB;;;;WAIG;QACH,UAAU,EAAE,SAAS;QACrB;;;;;;;;WAQG;QACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE;QACvD;;;;;;;WAOG;QACH,GAAG,EAAE,CAAC;aACH,MAAM,CAAC;YACN,cAAc,EAAE,aAAa;YAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE;SAC5D,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;IACF;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC7D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,6FAA6F;QAC7F,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB;;;;WAIG;QACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1B;;;;WAIG;QACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC7B;;;;;;WAMG;QACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAW,CAAC,QAAQ,EAAE;QACnC;;;;WAIG;QACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACjD;;;;;WAKG;QACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE;KACpC,CAAC;IACF;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAW,CAAC,QAAQ,EAAE;IACrC,+FAA+F;IAC/F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAW,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAC5C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,0CAA0C;IAC9E,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC;gBACzC,OAAO,EAAE,GAAG,QAAQ,6GAA6G;aAClI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC;gBAChD,OAAO,EAAE,GAAG,QAAQ,0GAA0G;aAC/H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC3B,OAAO,EAAE,GAAG,QAAQ,yGAAyG;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAyFH;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA8D,EAC9D,WAAmB;IAEnB,OAAO,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC;QACzE,CAAC,CAAE,OAAO,CAAC,UAAU,CAAC,WAAW,CAAS;QAC1C,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAU,EACV,IAAgE;IAEhE,OAAO,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,qBAAqB;QACxD,CAAC,CAAC;YACE,GAAG,OAAO;YACV,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,EAAE;SACpF;QACH,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAaD;;;;;;GAMG;AACH,IAAI,OAAO,GAA0B,IAAI,CAAC;AAE1C,MAAM,UAAU,SAAS,CAAC,CAAiB;IACzC,mGAAmG;IACnG,kGAAkG;IAClG,8FAA8F;IAC9F,gGAAgG;IAChG,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC"}

package/dist/routes/health.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Liveness and readiness.
+ *
+ *   GET /health        -> process is up (cheap, no dependency checks, rate-limit exempt).
+ *   GET /health/ready  -> can it serve: `{ ok }` only, 200 or 503 (lib/readiness.ts) — what an
+ *                         uptime monitor should hit. The earlier readiness probe was removed as an
+ *                         unauthenticated, unthrottled lever on resources every authenticated route
+ *                         shares (SEC-07); this one answers that: it stays behind the per-IP limiter
+ *                         (middleware/rate-limit.ts exempts `/health` exactly), its result is cached
+ *                         per isolate for 15 s, and it names no dependency — the per-check detail
+ *                         is the operator's, on `GET /v1/admin/status`.
+ */
+import { Hono } from "hono";
+import type { AppEnv } from "../context.js";
+export declare const health: Hono<AppEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=health.d.ts.map

package/dist/routes/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,eAAO,MAAM,MAAM,qDAAqB,CAAC"}

package/dist/routes/health.js

@@ -0,0 +1,29 @@
+/**
+ * Liveness and readiness.
+ *
+ *   GET /health        -> process is up (cheap, no dependency checks, rate-limit exempt).
+ *   GET /health/ready  -> can it serve: `{ ok }` only, 200 or 503 (lib/readiness.ts) — what an
+ *                         uptime monitor should hit. The earlier readiness probe was removed as an
+ *                         unauthenticated, unthrottled lever on resources every authenticated route
+ *                         shares (SEC-07); this one answers that: it stays behind the per-IP limiter
+ *                         (middleware/rate-limit.ts exempts `/health` exactly), its result is cached
+ *                         per isolate for 15 s, and it names no dependency — the per-check detail
+ *                         is the operator's, on `GET /v1/admin/status`.
+ */
+import { Hono } from "hono";
+import { readiness } from "../lib/readiness.js";
+export const health = new Hono();
+health.get("/", (c) => {
+    const config = c.get("config");
+    return c.json({
+        status: "ok",
+        service: config.SERVICE_NAME,
+        version: config.SERVICE_VERSION,
+        environment: config.ENVIRONMENT,
+    });
+});
+health.get("/ready", async (c) => {
+    const { ok } = await readiness(c.env, c.get("config"), c.get("metrics"));
+    return c.json({ ok }, ok ? 200 : 503);
+});
+//# sourceMappingURL=health.js.map

package/dist/routes/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,IAAI,EAAU,CAAC;AAEzC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;IACpB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,OAAO,EAAE,MAAM,CAAC,eAAe;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC"}

package/dist/routes/v1/admin.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `GET /v1/admin/status` — the operator's one look at this oracle (observability spec §6): the
+ * readiness detail `/health/ready` withholds from the public, the backlog the tick's gauges report
+ * (read live, the same queries — cron/backlog.ts), and the engine's word on our billing.
+ *
+ * Readers are `ORACLE_ADMIN_DIDS ∪ STATUS_READER_DIDS` (config.ts), matched on the acting principal;
+ * both unset ⇒ nobody, so the route is 403 for every caller until the deployer names one. A status
+ * reader (a monitoring service) gets this route only — never an operator's. Read-only and never a
+ * 5xx for a sick dependency: that is exactly what it exists to report.
+ *
+ * `POST /v1/admin/collections/relink` — the operator's backfill of register's company links
+ * (`lib/register.ts` `relinkCollections`): collections watched before register linked them to their
+ * company's Decision API sources get the same links now. `ORACLE_ADMIN_DIDS` only — it writes.
+ */
+import { Hono } from "hono";
+import type { AppEnv } from "../../context.js";
+export declare const admin: Hono<AppEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=admin.d.ts.map

package/dist/routes/v1/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAU5C,eAAO,MAAM,KAAK,qDAAqB,CAAC"}

package/dist/routes/v1/admin.js

@@ -0,0 +1,101 @@
+/**
+ * `GET /v1/admin/status` — the operator's one look at this oracle (observability spec §6): the
+ * readiness detail `/health/ready` withholds from the public, the backlog the tick's gauges report
+ * (read live, the same queries — cron/backlog.ts), and the engine's word on our billing.
+ *
+ * Readers are `ORACLE_ADMIN_DIDS ∪ STATUS_READER_DIDS` (config.ts), matched on the acting principal;
+ * both unset ⇒ nobody, so the route is 403 for every caller until the deployer names one. A status
+ * reader (a monitoring service) gets this route only — never an operator's. Read-only and never a
+ * 5xx for a sick dependency: that is exactly what it exists to report.
+ *
+ * `POST /v1/admin/collections/relink` — the operator's backfill of register's company links
+ * (`lib/register.ts` `relinkCollections`): collections watched before register linked them to their
+ * company's Decision API sources get the same links now. `ORACLE_ADMIN_DIDS` only — it writes.
+ */
+import { Hono } from "hono";
+import { z } from "zod";
+import { CollectionId } from "../../contracts/index.js";
+import { readApiBacklog, readChainBacklog } from "../../cron/backlog.js";
+import { createEngineClient } from "../../lib/engine/client.js";
+import { AppError } from "../../lib/errors.js";
+import { readiness } from "../../lib/readiness.js";
+import { RELINK_CAP, relinkCollections } from "../../lib/register.js";
+import { validate } from "../../lib/validator.js";
+export const admin = new Hono();
+/**
+ * The engine read is best-effort: a slow engine answers `engine: null`, never a slow status. 1 s,
+ * not 2: a monitoring service reading this route (STATUS_READER_DIDS) gives the whole read a few
+ * seconds, and a slow engine must not cost it the rest of the answer.
+ */
+const ENGINE_TIMEOUT_MS = 1000;
+admin.get("/status", async (c) => {
+    const config = c.get("config");
+    const did = c.get("principal").did;
+    if (!config.ORACLE_ADMIN_DIDS.includes(did) && !config.STATUS_READER_DIDS.includes(did)) {
+        throw AppError.forbidden("Operators or status readers only (ORACLE_ADMIN_DIDS, STATUS_READER_DIDS)");
+    }
+    const db = await c.var.db();
+    const logger = c.get("logger");
+    const engine = createEngineClient({
+        config,
+        logger,
+        trace: c.get("trace"),
+        cache: c.env.CACHE_KV,
+    });
+    const [ready, chain, api, me] = await Promise.all([
+        readiness(c.env, config, c.get("metrics")),
+        readChainBacklog(db),
+        config.API_LANE ? readApiBacklog(db, new Date()) : null,
+        withTimeout(engine.me(), ENGINE_TIMEOUT_MS).catch((err) => {
+            logger.warn("admin.status.engine-unreadable", { detail: String(err) });
+            return null;
+        }),
+    ]);
+    return c.json({
+        readiness: ready,
+        backlog: {
+            review: { pending: chain.reviewPending },
+            collections: { paused: chain.collectionsPaused },
+            // The Decision API lane's share only where the lane runs.
+            ...(api && {
+                sources: { paused: api.sourcesPaused },
+                webhooks: { due: api.webhookDue, oldestAgeS: api.webhookOldestAgeS },
+            }),
+        },
+        engine: me,
+    });
+});
+/** Absent `collectionIds` ⇒ every watched collection, up to `RELINK_CAP`. */
+const RelinkBody = z.strictObject({
+    collectionIds: z.array(CollectionId).min(1).max(RELINK_CAP).optional(),
+});
+admin.post("/collections/relink", validate("json", RelinkBody), async (c) => {
+    const config = c.get("config");
+    if (!config.ORACLE_ADMIN_DIDS.includes(c.get("principal").did)) {
+        throw AppError.forbidden("Operators only (ORACLE_ADMIN_DIDS)");
+    }
+    const { collectionIds } = c.req.valid("json");
+    const result = await relinkCollections({
+        config,
+        trace: c.get("trace"),
+        logger: c.get("logger"),
+        db: await c.var.db(),
+        env: c.env,
+    }, collectionIds && [...new Set(collectionIds)]);
+    return c.json(result);
+});
+async function withTimeout(p, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            p,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error("timeout")), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=admin.js.map

package/dist/routes/v1/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../src/routes/v1/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAU,CAAC;AAExC;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,MAAM,QAAQ,CAAC,SAAS,CACtB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,MAAM;QACN,MAAM;QACN,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;KACtB,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,gBAAgB,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QACvD,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAmB,EAAE;YACzE,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE;YACxC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,0DAA0D;YAC1D,GAAG,CAAC,GAAG,IAAI;gBACT,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE;gBACtC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,iBAAiB,EAAE;aACrE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAEH,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1E,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC;QACE,MAAM;QACN,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,EAAE,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACpB,GAAG,EAAE,CAAC,CAAC,GAAG;KACX,EACD,aAAa,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAC7C,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,WAAW,CAAI,CAAa,EAAE,EAAU;IACrD,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/routes/v1/api/admin-claims.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The operator's claims (go-prod spec §12.2, contracts v1.2): `ORACLE_ADMIN_DIDS` invokers read EVERY
+ * claim this oracle holds — every source's API claims and every watched collection's chain claims —
+ * in the source routes' shapes (the record, the timeline, the receipt, the report). Read-only: an
+ * operator never answers a review here.
+ *
+ * The list is the source list's own stream (`claimPage`, lib/api-lane/claim-list.ts) with no
+ * source or collection scope: every API claim and every watched collection's chain claim, merged
+ * newest first through one cursor.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const adminClaims: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=admin-claims.d.ts.map

package/dist/routes/v1/api/admin-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-claims.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/admin-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAI5D,eAAO,MAAM,WAAW,qDAAqB,CAAC"}

package/dist/routes/v1/api/admin-claims.js

@@ -0,0 +1,82 @@
+/**
+ * The operator's claims (go-prod spec §12.2, contracts v1.2): `ORACLE_ADMIN_DIDS` invokers read EVERY
+ * claim this oracle holds — every source's API claims and every watched collection's chain claims —
+ * in the source routes' shapes (the record, the timeline, the receipt, the report). Read-only: an
+ * operator never answers a review here.
+ *
+ * The list is the source list's own stream (`claimPage`, lib/api-lane/claim-list.ts) with no
+ * source or collection scope: every API claim and every watched collection's chain claim, merged
+ * newest first through one cursor.
+ */
+import { inArray } from "drizzle-orm";
+import { Hono } from "hono";
+import { AdminListClaimsQuery } from "../../../contracts/index.js";
+import { apiSources } from "../../../db/schema.js";
+import { claimPage } from "../../../lib/api-lane/claim-list.js";
+import { apiClaimEvents, chainClaimEvents } from "../../../lib/api-lane/events.js";
+import { claimRecord } from "../../../lib/api-lane/record.js";
+import { validate } from "../../../lib/validator.js";
+import { access } from "../../../middleware/api/auth.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { ClaimParam, receiptOf } from "./claims-read.js";
+import { reportResponse } from "./review.js";
+export const adminClaims = new Hono();
+/** D1 binds at most 100 parameters per statement. */
+const CHUNK = 99;
+/** v1.2.1: each record with its source's display name — an operator is no member of the source,
+ *  so the console cannot look it up. `null` for a chain claim (no source). */
+async function withSourceNames(db, records) {
+    const ids = [...new Set(records.flatMap((r) => (r.sourceId ? [r.sourceId] : [])))];
+    const names = new Map();
+    for (let i = 0; i < ids.length; i += CHUNK) {
+        const rows = await db
+            .select({ sourceId: apiSources.sourceId, name: apiSources.name })
+            .from(apiSources)
+            .where(inArray(apiSources.sourceId, ids.slice(i, i + CHUNK)));
+        for (const row of rows)
+            names.set(row.sourceId, row.name);
+    }
+    return records.map((r) => ({ ...r, sourceName: (r.sourceId && names.get(r.sourceId)) ?? null }));
+}
+/** The claim's record, or `404` — the record, not the ledger, decides what exists and its lane:
+ *  an API claim may have no `claim_ingests` row yet and still reads as `queued` (record.ts). */
+async function recordOr404(db, claimId) {
+    const record = await claimRecord(db, claimId);
+    if (!record)
+        throw new ApiError("NOT_FOUND", `Claim ${claimId} was not found.`);
+    return record;
+}
+adminClaims.get("/admin/claims", access({ op: "adminListClaims", scope: "none", capability: "operator" }), validate("query", AdminListClaimsQuery), async (c) => {
+    const q = c.req.valid("query");
+    // A source's claims are API claims; a collection's are chain claims (an API claim's ledger
+    // `collectionId` is its internal scope id, never shown).
+    const db = await c.var.db();
+    const page = await claimPage(db, q, {
+        api: q.lane !== "chain" && !q.collectionId ? { sourceId: q.sourceId } : null,
+        chain: q.lane !== "api" && !q.sourceId ? { collectionId: q.collectionId } : null,
+        protocols: null,
+    });
+    return c.json({ ...page, items: await withSourceNames(db, page.items) });
+});
+adminClaims.get("/admin/claims/:claimId", access({ op: "adminGetClaim", scope: "none", capability: "operator" }), validate("param", ClaimParam), async (c) => {
+    const db = await c.var.db();
+    const [record] = await withSourceNames(db, [
+        await recordOr404(db, c.req.valid("param").claimId),
+    ]);
+    return c.json(record);
+});
+adminClaims.get("/admin/claims/:claimId/events", access({ op: "adminGetClaimEvents", scope: "none", capability: "operator" }), validate("param", ClaimParam), async (c) => {
+    const { claimId } = c.req.valid("param");
+    const db = await c.var.db();
+    const { lane } = await recordOr404(db, claimId);
+    const items = lane === "api" ? await apiClaimEvents(db, claimId) : await chainClaimEvents(db, claimId);
+    return c.json({ claimId, items });
+});
+adminClaims.get("/admin/claims/:claimId/receipt", access({ op: "adminGetClaimReceipt", scope: "none", capability: "operator" }), validate("param", ClaimParam), async (c) => {
+    // No decision row (an unknown id, or nothing decided yet) is the receipt route's own 404.
+    return c.json(await receiptOf(c, c.req.valid("param").claimId));
+});
+adminClaims.get("/admin/claims/:claimId/report", access({ op: "adminGetClaimReport", scope: "none", capability: "operator" }), validate("param", ClaimParam), async (c) => {
+    return reportResponse(c, c.req.valid("param").claimId);
+});
+//# sourceMappingURL=admin-claims.js.map

package/dist/routes/v1/api/admin-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-claims.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/admin-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAyB,oBAAoB,EAAoB,MAAM,oBAAoB,CAAC;AAEnG,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,IAAI,EAAU,CAAC;AAE9C,qDAAqD;AACrD,MAAM,KAAK,GAAG,EAAE,CAAC;AAEjB;8EAC8E;AAC9E,KAAK,UAAU,eAAe,CAAC,EAAY,EAAE,OAAsB;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;aAChE,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;gGACgG;AAChG,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,OAAe;IACtD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,SAAS,OAAO,iBAAiB,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,WAAW,CAAC,GAAG,CACb,eAAe,EACf,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACxE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC,EACvC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,2FAA2F;IAC3F,yDAAyD;IACzD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE;QAClC,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5E,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QAChF,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC,CACF,CAAC;AAEF,WAAW,CAAC,GAAG,CACb,wBAAwB,EACxB,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACtE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE;QACzC,MAAM,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;KACpD,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CACF,CAAC;AAEF,WAAW,CAAC,GAAG,CACb,+BAA+B,EAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAC5E,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GACT,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AACpC,CAAC,CACF,CAAC;AAEF,WAAW,CAAC,GAAG,CACb,gCAAgC,EAChC,MAAM,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAC7E,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,0FAA0F;IAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAClE,CAAC,CACF,CAAC;AAEF,WAAW,CAAC,GAAG,CACb,+BAA+B,EAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAC5E,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,OAAO,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC,CACF,CAAC"}

package/dist/routes/v1/api/admin-facilitator.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The operator's facilitator delegation (contracts v1.3.2, S6 console + S10 card facilitator): an
+ * `ORACLE_ADMIN_DIDS` invoker gets a short-lived UCAN delegation, signed by this oracle's did:web (the
+ * key `/.well-known/did.json` publishes), granting exactly the requested `operators/*` actions on
+ * `ixo:ixo-pay-facilitator` — one capability each, never `*` (CLAUDE.md "Capabilities") — to
+ * their own did:ixo. The facilitator roots its operator actions in this oracle, so the console
+ * mints one here and presents it there.
+ *
+ * Every call is a NEW credential — a nonce each, `Cache-Control: no-store`, never cached here —
+ * and every mint is audited (who, to whom, which actions, until when, its CID; never the token).
+ * A GET, so no `idempotent()`: there is nothing to replay, only something to mint again.
+ *
+ * Never a `payouts/*` action (CA-M8): the payouts facilitator holds each company's payout team
+ * itself (the controllers of its company entity, `GET /v1/payouts/info`) and takes no grant rooted
+ * in an oracle, so one minted here would be refused there.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const adminFacilitator: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=admin-facilitator.d.ts.map

package/dist/routes/v1/api/admin-facilitator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-facilitator.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/admin-facilitator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAa5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAE5D,eAAO,MAAM,gBAAgB,qDAAqB,CAAC"}