@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/cli/lib/session.js

@@ -0,0 +1,354 @@
+/**
+ * The saved ixo AuthHub session — the ONLY signing identity the CLI's chain commands use. `login`
+ * (authhub.ts) writes `~/.ixo/publish-session-<network>.json`; everything else loads it here and
+ * signs with it.
+ *
+ * The session shape and the smart-account signing quirks below are transcribed from impacts-x-web
+ * (`lib/authHub/index.ts`, `lib/authHub/signAndBroadcastWithSessionKey.ts`) — the portal's own
+ * AuthHub client — not re-derived, because every quirk here is load-bearing and silently wrong if
+ * guessed:
+ *
+ *   - `getAccounts()` on the signing wallet MUST report the smart-account address with an EMPTY
+ *     pubkey. That emptiness is the signal the chain reads to authenticate via the smart-account's
+ *     selected authenticator instead of a standard secp256k1 signature check.
+ *   - The real messages go into `txBodyBytes` (hand-encoded, carrying a
+ *     `/ixo.smartaccount.v1beta1.TxExtension` `nonCriticalExtensionOption` naming the session's
+ *     `sessionAuthenticatorId`) — `signAndBroadcast` is then called with an EMPTY message array and
+ *     `txBodyBytes` as its last argument, never both.
+ *   - Fee simulation (`getUsedFee`) MUST be called with the plain messages, NEVER `txBodyBytes` —
+ *     the chain can't simulate a tx carrying `nonCriticalExtensionOptions` yet, and passing it throws.
+ *
+ * Nothing here touches the wallet or the network until a command actually broadcasts (`--yes`): both
+ * `getPubkey()` and `client.signAndBroadcast()` are lazy so a dry-run plan-print never derives a
+ * key or opens an RPC connection — see `buildSessionSigner`.
+ */
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+// `long` is a small, dependency-free package (unlike the SDK/cosmjs imports below, which stay
+// dynamic to avoid dragging heavy proto/crypto deps into commands that never sign) — a plain static
+// import here is simpler and gives the real `Long` class type (`fromString` etc.) directly.
+import Long from "long";
+import { API_ACTIONS } from "../../contracts/capabilities.js";
+import { canonicalJson } from "../../lib/hash.js";
+import { actionFor } from "../../middleware/capability.js";
+import { NETWORKS } from "../../networks.js";
+import { fail } from "./chain.js";
+/** One file per network, mode 0600 — the same path the portal-side publish tooling uses, so a
+ *  provider who has logged in once anywhere is logged in here too. */
+export function sessionPath(network) {
+    return join(homedir(), ".ixo", `publish-session-${network}.json`);
+}
+/** Written only by `login`; every other command reads it. */
+export async function saveSession(network, session) {
+    const path = sessionPath(network);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(session, null, 2), { mode: 0o600 });
+    await chmod(path, 0o600); // belt & suspenders — writeFile's mode is subject to umask
+    return path;
+}
+/** Reads and minimally validates the saved session — fails with the exact re-login command on any
+ *  problem (missing file, bad JSON, missing the fields signing needs). Login is meant to run ONCE
+ *  per network: whenever this file exists and is well-formed, every command reuses it silently —
+ *  this function never triggers a login itself, it only reads what `login` already saved. */
+export async function loadSession(network) {
+    const path = sessionPath(network);
+    const loginHint = `bunx decision-oracle login --network ${network}`;
+    const noSessionMessage = `no AuthHub session for ${network} — log in ONCE with: ${loginHint}\n` +
+        "  (after that, this and every other chain command reuses the saved session automatically — " +
+        "no repeated logins).";
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch {
+        fail(noSessionMessage);
+    }
+    let session;
+    try {
+        session = JSON.parse(raw);
+    }
+    catch {
+        fail(`${path} is not valid JSON — re-run: ${loginHint}`);
+    }
+    if (!session.address || !session.did) {
+        fail(`${path} is missing address/did — re-run: ${loginHint}`);
+    }
+    return session;
+}
+/** `network → loadSession → buildSessionSigner` — the ONE signer builder every chain command uses. */
+export async function buildSigner(network) {
+    return buildSessionSigner(network, await loadSession(network));
+}
+// --- session signer ---------------------------------------------------------------------------------
+/**
+ * The mnemonic-driven twin of the passkey/SignX signers in impacts-x-web's `useSignX` — the
+ * difference is only where the key lives (a session mnemonic here vs. the device enclave for a
+ * passkey). `getAccounts()` MUST report the smart-account address with an EMPTY pubkey; that's what
+ * tells the chain to authenticate via the selected authenticator instead of standard sig
+ * verification. Ported from impacts-x-web's `SessionKeySigner`.
+ */
+class SmartAccountSessionSigner {
+    wallet;
+    smartAccountAddress;
+    constructor(wallet, smartAccountAddress) {
+        this.wallet = wallet;
+        this.smartAccountAddress = smartAccountAddress;
+    }
+    async getAccounts() {
+        return [{ address: this.smartAccountAddress, algo: "secp256k1", pubkey: new Uint8Array() }];
+    }
+    async signDirect(_signerAddress, signDoc) {
+        const [account] = await this.wallet.getAccounts();
+        if (!account)
+            throw new Error("session wallet yielded no account");
+        return this.wallet.signDirect(account.address, signDoc);
+    }
+}
+/** Sequence/signer-data cache `createSigningClient` needs — an in-memory replacement for the
+ *  portal's localStorage-backed store (`lib/cosmos/signerSequenceStore.ts`). No JSON
+ *  serialization round-trip is needed (unlike localStorage, a `Map` holds the object directly), so
+ *  the "poisoned by a stringified object" bug that store works around can't happen here. Scoped to
+ *  one command invocation: intentionally forgotten when the process exits. */
+function createInMemorySignerStore() {
+    const memory = new Map();
+    return {
+        getLocalData: async (key) => memory.get(key) ?? null,
+        setLocalData: (key, data) => {
+            memory.set(key, data);
+        },
+    };
+}
+/** The `uixo`-denominated amount from a Coin[] spend-limit array, or `undefined` when there's no
+ *  such limit (an empty/missing array, or one with no `uixo` entry) — mirrors the portal's
+ *  `decodeGrants` extraction (`utils/feegrant.ts`), which treats "no limit found" as unlimited. */
+function uixoSpendLimit(coins) {
+    const coin = coins?.find((c) => c.denom === "uixo");
+    return coin ? Number(coin.amount) : undefined;
+}
+/** Ported from impacts-x-web's `isAllowanceLimitReached` (`utils/feegrant.ts`): `undefined` (no
+ *  limit found at all) is never "reached" — an unlimited allowance is always usable. A defined
+ *  limit counts as drained at effectively zero (`<= 0.0005`), the portal's own threshold, not
+ *  strictly `=== 0`. */
+function isSpendLimitReached(limit) {
+    return limit !== undefined && limit <= 0.0005;
+}
+/**
+ * Best-effort feegrant lookup (ported from impacts-x-web's `getAddressFeegrantGranter`, minus the
+ * faucet top-up the portal does alongside it — out of scope for a chain-authoring command). Returns
+ * the granter of the first unexpired allowance found, or `undefined` on no grant / any failure — a
+ * chain-read hiccup here must never block a real broadcast.
+ */
+async function lookupFeegrantGranter(network, granteeAddress) {
+    try {
+        const { createQueryClient, createRegistry } = await import("@ixo/impactxclient-sdk");
+        const queryClient = await createQueryClient(NETWORKS[network].rpc);
+        const { allowances } = await queryClient.cosmos.feegrant.v1beta1.allowances({
+            grantee: granteeAddress,
+        });
+        if (!allowances || allowances.length === 0)
+            return undefined;
+        const registry = createRegistry();
+        const now = Date.now();
+        for (const grant of allowances) {
+            try {
+                // biome-ignore lint/suspicious/noExplicitAny: decoded shape varies by allowance type (Basic/Periodic/...)
+                const decoded = registry.decode(grant.allowance);
+                const expiration = decoded?.expiration ?? decoded?.basic?.expiration;
+                if (expiration) {
+                    const expiresAtMs = Number(expiration.seconds) * 1000 + Math.floor((expiration.nanos ?? 0) / 1e6);
+                    if (expiresAtMs < now)
+                        continue; // expired — try the next allowance
+                }
+                // Periodic allowances cap spend per-period (periodCanSpend) ON TOP OF the lifetime cap
+                // (basic.spendLimit) — prefer the per-period figure when present, the same priority the
+                // portal's decodeGrants uses, since it's the tighter, more current number.
+                const periodCoins = decoded?.periodCanSpend;
+                const spendLimitCoins = periodCoins?.length
+                    ? periodCoins
+                    : (decoded?.spendLimit ?? decoded?.basic?.spendLimit);
+                if (isSpendLimitReached(uixoSpendLimit(spendLimitCoins)))
+                    continue; // drained — try the next
+                if (grant.granter)
+                    return grant.granter;
+            }
+            catch {
+                // an allowance type this lookup doesn't decode — skip it, not fatal
+            }
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The actual signing + broadcast, built fresh per call (never cached) — this is the ONLY place a
+ *  session mnemonic gets turned into a live wallet + RPC connection, and it only runs from inside
+ *  `client.signAndBroadcast`, i.e. after `confirm()`'s `--yes` gate has already passed. */
+async function signAndBroadcastWithSession(network, session, msgs, memo) {
+    const mnemonic = session.sessionMnemonic ?? fail("AuthHub session has no sessionMnemonic — re-run login");
+    const authenticatorId = session.sessionAuthenticatorId ??
+        fail("AuthHub session has no sessionAuthenticatorId — re-run login");
+    const [{ createSigningClient, ixo }, { DirectSecp256k1HdWallet }, { GasPrice }] = await Promise.all([
+        import("@ixo/impactxclient-sdk"),
+        import("@cosmjs/proto-signing"),
+        import("@cosmjs/stargate"),
+    ]);
+    const wallet = await DirectSecp256k1HdWallet.fromMnemonic(mnemonic, { prefix: "ixo" });
+    const offlineSigner = new SmartAccountSessionSigner(wallet, session.address);
+    const client = await createSigningClient(NETWORKS[network].rpc, offlineSigner, false, { gasPrice: GasPrice.fromString("0.025uixo") }, createInMemorySignerStore());
+    const sigAuthId = Long.fromString(authenticatorId);
+    const txBodyBytes = client.registry.encodeTxBody({
+        messages: msgs,
+        memo,
+        nonCriticalExtensionOptions: [
+            {
+                typeUrl: "/ixo.smartaccount.v1beta1.TxExtension",
+                value: ixo.smartaccount.v1beta1.TxExtension.encode({
+                    selectedAuthenticators: msgs.map(() => sigAuthId),
+                }).finish(),
+            },
+        ],
+    });
+    // NEVER pass txBodyBytes here — the chain can't simulate a tx carrying
+    // nonCriticalExtensionOptions yet, and doing so throws. Plain messages only.
+    let usedFee = await client.getUsedFee(session.address, msgs, "auto", memo);
+    const granter = await lookupFeegrantGranter(network, session.address);
+    if (granter)
+        usedFee = { ...usedFee, granter };
+    // Empty message array — the real messages already live inside txBodyBytes (with the
+    // TxExtension); passing them again here would double-encode the tx body.
+    return client.signAndBroadcast(session.address, [], usedFee, memo, undefined, txBodyBytes);
+}
+/**
+ * `session → PublishSigner`. Deliberately does NOT touch the wallet or the network here — both
+ * `getPubkey()` and `client.signAndBroadcast()` defer everything session-mnemonic-related until
+ * actually called, which only happens after `confirm()`'s `--yes` gate. A dry-run invocation that
+ * only ever calls `confirm()` (and exits before it returns) never constructs a wallet, never opens
+ * an RPC connection — even with a garbage `sessionMnemonic` in the session file.
+ */
+export async function buildSessionSigner(network, session) {
+    let cachedPubkey;
+    return {
+        network,
+        address: session.address,
+        did: session.did,
+        session,
+        async getPubkey() {
+            if (cachedPubkey)
+                return cachedPubkey;
+            const mnemonic = session.sessionMnemonic ?? fail("AuthHub session has no sessionMnemonic — re-run login");
+            const { DirectSecp256k1HdWallet } = await import("@cosmjs/proto-signing");
+            const wallet = await DirectSecp256k1HdWallet.fromMnemonic(mnemonic, { prefix: "ixo" });
+            const [account] = await wallet.getAccounts();
+            if (!account)
+                fail("session mnemonic yielded no account");
+            cachedPubkey = account.pubkey;
+            return cachedPubkey;
+        },
+        client: {
+            async signAndBroadcast(_address, msgs, _fee, memo = "") {
+                return signAndBroadcastWithSession(network, session, msgs, memo);
+            },
+        },
+    };
+}
+// --- calling this oracle's own API as the session -------------------------------------------------
+/**
+ * One self-signed `@ixo/ucan` invocation from the session's DID to the oracle's did:web (read off
+ * its own `/.well-known/did.json`), `{ can: <the route's action>, with: "ixo:eval-oracle" }` — the
+ * action from the chain lane's own table (`middleware/capability.ts` `ROUTE_ACTIONS`), exactly what
+ * the oracle verifies, with a fresh nonce per call so two calls never share a CID. This is the
+ * COMMISSIONER's identity (the wallet that created the collection), which is what `register` and
+ * `scan` are gated on.
+ *
+ * `api` makes it a Decision API console invocation (`middleware/api/console.ts`): the `with` is
+ * derived from the oracle's did:web (`ixo:oracle/<did:web>[/source/<id>]`) and the `can` is the
+ * route's `op` action from the lane's own table (`contracts/capabilities.ts` `API_ACTIONS`).
+ */
+export async function kitFetch(session, kitUrl, path, init = {}, api) {
+    const method = init.method ?? "POST";
+    // A path with no chain-lane action is a CLI bug, never a reason to sign `*`.
+    const route = api ? null : actionFor(method, path.split("?")[0] ?? path);
+    if (!api && !route) {
+        throw new Error(`no chain-lane action for ${method} ${path} (middleware/capability.ts)`);
+    }
+    const can = api ? API_ACTIONS[api.op] : route?.action;
+    const { token, did } = await sessionInvocation(session, kitUrl, "oracle", (audience) => ({
+        can,
+        with: api?.resource(audience) ?? "ixo:eval-oracle",
+    }));
+    const res = await fetch(`${kitUrl}${path}`, {
+        ...init,
+        method,
+        headers: {
+            ...(init.headers ?? {}),
+            authorization: `Bearer ${token}`,
+            "x-auth-type": "ucan",
+            "content-type": "application/json",
+        },
+    });
+    return { res, did };
+}
+/**
+ * One self-signed invocation from the session's DID to the service at `serviceUrl` — the oracle
+ * (`kitFetch`) or the engine (`api source link`'s `company/link`): audience its did:web, read off
+ * its own `/.well-known/did.json`, the ONE capability the caller names, 120 s, no proofs (the
+ * session invokes as itself), a fresh nonce so two calls never share a CID.
+ */
+export async function sessionInvocation(session, serviceUrl, label, capability) {
+    const edSigningMnemonic = session.edSigningMnemonic ?? fail("AuthHub session has no edSigningMnemonic — re-run login");
+    const { createInvocation, serializeInvocation, signerFromMnemonic } = await import("@ixo/ucan");
+    const { signer, did } = await signerFromMnemonic(edSigningMnemonic, session.did);
+    // Reading the service's own did.json is also the reachability check — naming the URL here is
+    // the whole diagnostic when a provider points this at something that isn't running.
+    const audience = await fetch(`${serviceUrl}/.well-known/did.json`)
+        .then(async (res) => (await res.json()).id)
+        .catch((err) => fail(`${label} unreachable at ${serviceUrl} — is it running? (${err instanceof Error ? err.message : String(err)})`));
+    const { can, with: resource } = capability(audience);
+    const invocation = await createInvocation({
+        issuer: signer,
+        audience,
+        capability: { can: can, with: resource },
+        proofs: [],
+        expiration: Math.floor(Date.now() / 1000) + 120,
+        facts: [{ nonce: crypto.randomUUID() }],
+    });
+    return { token: await serializeInvocation(invocation), did, audience };
+}
+/**
+ * The organisation's company link (docs/ENGINE-CONTRACT.md "The company link"), signed as the
+ * session — a current controller of `entityDid` — the way the Decision Console's "Add oracle" does
+ * it (eval-engine-dashboard `lib/companyLink.ts`): a compact JWS in the review-attestation format,
+ * `kid` the did:key of the session's Ed25519 key (the one its IID publishes, the same key every
+ * invocation signs with), the payload canonical JSON (the engine re-serializes it and refuses any
+ * other bytes). `payeeField` null: the console's "Add oracle" names none either.
+ */
+export async function signCompanyLink(session, link, now = new Date()) {
+    const edSigningMnemonic = session.edSigningMnemonic ?? fail("AuthHub session has no edSigningMnemonic — re-run login");
+    const { signerFromMnemonic } = await import("@ixo/ucan");
+    const { signer } = await signerFromMnemonic(edSigningMnemonic, session.did);
+    const issuedAt = now.toISOString();
+    const header = { alg: "EdDSA", typ: "vc+jwt", cty: "vc", kid: signer.toDIDKey() };
+    const payload = {
+        "@context": ["https://www.w3.org/ns/credentials/v2"],
+        type: ["VerifiableCredential", "SourceCompanyLink"],
+        issuer: session.did,
+        validFrom: issuedAt,
+        credentialSubject: {
+            id: link.entityDid,
+            entityDid: link.entityDid,
+            oracleDid: link.oracleDid,
+            sourceId: link.sourceId,
+            payeeField: null,
+            issuedAt,
+            nonce: b64url(crypto.getRandomValues(new Uint8Array(16))),
+        },
+    };
+    const utf8 = (s) => new TextEncoder().encode(s);
+    const input = `${b64url(utf8(canonicalJson(header)))}.${b64url(utf8(canonicalJson(payload)))}`;
+    const signature = await signer.sign(utf8(input));
+    return `${input}.${b64url(signature.raw)}`;
+}
+const b64url = (bytes) => Buffer.from(bytes).toString("base64url");
+//# sourceMappingURL=session.js.map

package/dist/cli/lib/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/cli/lib/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAU1C,8FAA8F;AAC9F,oGAAoG;AACpG,4FAA4F;AAC5F,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,WAAW,EAAc,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAmB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AA6C/B;sEACsE;AACtE,MAAM,UAAU,WAAW,CAAC,OAAmB;IAC7C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,OAAO,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAmB,EAAE,OAAuB;IAC5E,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,2DAA2D;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAmB;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,wCAAwC,OAAO,EAAE,CAAC;IACpE,MAAM,gBAAgB,GACpB,0BAA0B,OAAO,wBAAwB,SAAS,IAAI;QACtE,6FAA6F;QAC7F,sBAAsB,CAAC;IAEzB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,GAAG,IAAI,gCAAgC,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,qCAAqC,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAmB;IACnD,OAAO,kBAAkB,CAAC,OAAO,EAAE,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,uGAAuG;AAEvG;;;;;;GAMG;AACH,MAAM,yBAAyB;IAEV,MAAM;IACN,mBAAmB;IAFtC,YACmB,MAA+B,EAC/B,mBAA2B;sBAD3B,MAAM;mCACN,mBAAmB;IACnC,CAAC;IAEJ,KAAK,CAAC,WAAW;QACf,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,UAAU,CACd,cAAsB,EACtB,OAA6D;QAE7D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;;;8EAI8E;AAC9E,SAAS,yBAAyB;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,OAAO;QACL,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACpD,YAAY,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;mGAEmG;AACnG,SAAS,cAAc,CACrB,KAAsD;IAEtD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;wBAGwB;AACxB,SAAS,mBAAmB,CAAC,KAAyB;IACpD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,MAAM,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,qBAAqB,CAClC,OAAmB,EACnB,cAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1E,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE7D,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,0GAA0G;gBAC1G,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,SAAgB,CAAQ,CAAC;gBAC/D,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;gBACrE,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,WAAW,GACf,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;oBAChF,IAAI,WAAW,GAAG,GAAG;wBAAE,SAAS,CAAC,mCAAmC;gBACtE,CAAC;gBACD,uFAAuF;gBACvF,wFAAwF;gBACxF,2EAA2E;gBAC3E,MAAM,WAAW,GAAG,OAAO,EAAE,cAEhB,CAAC;gBACd,MAAM,eAAe,GAAG,WAAW,EAAE,MAAM;oBACzC,CAAC,CAAC,WAAW;oBACb,CAAC,CAAE,CAAC,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,KAAK,EAAE,UAAU,CAErC,CAAC;gBACnB,IAAI,mBAAmB,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;oBAAE,SAAS,CAAC,yBAAyB;gBAC7F,IAAI,KAAK,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAC,OAAO,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;2FAE2F;AAC3F,KAAK,UAAU,2BAA2B,CACxC,OAAmB,EACnB,OAAuB,EACvB,IAA6B,EAC7B,IAAY;IAEZ,MAAM,QAAQ,GACZ,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAC3F,MAAM,eAAe,GACnB,OAAO,CAAC,sBAAsB;QAC9B,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAEvE,MAAM,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAC7E,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,wBAAwB,CAAC;QAChC,MAAM,CAAC,uBAAuB,CAAC;QAC/B,MAAM,CAAC,kBAAkB,CAAC;KAC3B,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,IAAI,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EACrB,aAAa,EACb,KAAK,EACL,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,EAC9C,yBAAyB,EAAE,CAC5B,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/C,QAAQ,EAAE,IAAsB;QAChC,IAAI;QACJ,2BAA2B,EAAE;YAC3B;gBACE,OAAO,EAAE,uCAAuC;gBAChD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;oBACjD,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;iBAClD,CAAC,CAAC,MAAM,EAAE;aACZ;SACF;KACF,CAAC,CAAC;IAEH,uEAAuE;IACvE,6EAA6E;IAC7E,IAAI,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAsB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAE7F,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;IAE/C,oFAAoF;IACpF,yEAAyE;IACzE,OAAO,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAmB,EACnB,OAAuB;IAEvB,IAAI,YAAoC,CAAC;IAEzC,OAAO;QACL,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO;QACP,KAAK,CAAC,SAAS;YACb,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;YACtC,MAAM,QAAQ,GACZ,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,uDAAuD,CAAC,CAAC;YAC3F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;YAC1D,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,MAAM,EAAE;YACN,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,IAA6B,EAC7B,IAAY,EACZ,IAAI,GAAG,EAAE;gBAET,OAAO,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACnE,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,qGAAqG;AAErG;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAuB,EACvB,MAAc,EACd,IAAY,EACZ,IAAI,GAAgB,EAAE,EACtB,GAA4D;IAE5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACrC,6EAA6E;IAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,IAAI,IAAI,6BAA6B,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,KAAK,EAAE,MAAiB,CAAC;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvF,GAAG;QACH,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,iBAAiB;KACnD,CAAC,CAAC,CAAC;IACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;QAC1C,GAAG,IAAI;QACP,MAAM;QACN,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACvB,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,UAAkB,EAClB,KAAa,EACb,UAA+D;IAE/D,MAAM,iBAAiB,GACrB,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC/F,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAChG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,kBAAkB,CAC9C,iBAAiB,EACjB,OAAO,CAAC,GAA0B,CACnC,CAAC;IACF,6FAA6F;IAC7F,oFAAoF;IACpF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,uBAAuB,CAAC;SAC/D,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC,EAAE,CAAC;SAC9D,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CACtB,IAAI,CACF,GAAG,KAAK,mBAAmB,UAAU,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAC/G,CACF,CAAC;IACJ,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;QACxC,MAAM,EAAE,MAAM;QACd,QAAQ;QACR,UAAU,EAAE,EAAE,GAAG,EAAE,GAA4B,EAAE,IAAI,EAAE,QAAiC,EAAE;QAC1F,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;QAC/C,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAuB,EACvB,IAAgE,EAChE,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,iBAAiB,GACrB,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC/F,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CACzC,iBAAiB,EACjB,OAAO,CAAC,GAA0B,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG;QACd,UAAU,EAAE,CAAC,sCAAsC,CAAC;QACpD,IAAI,EAAE,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;QACnD,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,SAAS,EAAE,QAAQ;QACnB,iBAAiB,EAAE;YACjB,EAAE,EAAE,IAAI,CAAC,SAAS;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI;YAChB,QAAQ;YACR,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;SAC1D;KACF,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC"}

package/dist/cli/lib/workorder.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The rubric's work order sorted into the only two piles a provider cares about: names the STOCK
+ * lane can answer as declared, and names that need a handler of their own. Pure — manifest in,
+ * classification out — so `protocol review` prints it and `facts scaffold` writes files from it,
+ * and the two can never disagree about which is which.
+ *
+ * There is exactly one MECHANICAL "needs a handler": a `send` map that quotes a `~derived` value.
+ * The engine computes derived values and this oracle never binds a rubric, so the stock lane can
+ * only ever answer such a source with an error — that is a fact about the format, not a guess.
+ *
+ * And one mechanical REFUSAL, which no handler fixes: a source whose audience is not its
+ * endpoint's own did:web. The stock lane never signs for it (stock/ext-source.ts), and a handler
+ * signing for the URL it calls would not be answering the source the rubric declared — the
+ * rubric is wrong, so its author fixes it. Nothing is scaffolded for it.
+ * Everything else is a judgement the provider has to make about their own endpoint or judge, and it
+ * rides in `why` as a caveat rather than as a false certainty either way.
+ */
+import type { Manifest, ManifestExt } from "../../lib/engine/types.js";
+/** What the kit's own lane does with a declared rule: answers it, was never asked, or can't run it. */
+export type RuleCoverage = "none" | "stock" | "unrunnable";
+export interface FactWork {
+    kind: "ext" | "ai";
+    name: string;
+    /** false ⇒ nothing but a handler can answer this name (unless `refused`). */
+    stock: boolean;
+    /** The rubric declares a source the oracle will not call (audience ≠ endpoint) — fix the rubric. */
+    refused: boolean;
+    /** The `~derived` refs its `send` map quotes — empty unless `stock` is false. */
+    derived: string[];
+    /** One sentence: what makes it stock-shaped, or what a handler has to do instead. */
+    why: string;
+    /** The rules that read the fact — `gate:<code>` / `criterion:<code>`. */
+    usedBy: string[];
+}
+export interface WorkOrder {
+    /** The verified rubric id the engine bound — sha256 of its bytes. */
+    rubricId: string;
+    /** The pinned `#vct` proof no longer matches the live form (the engine's call, informational). */
+    formDrifted: boolean;
+    ext: FactWork[];
+    ai: FactWork[];
+    unique: RuleCoverage;
+    frequency: RuleCoverage;
+    /** `ext.<name>` / `ai.<name>` for every name a handler must answer — what `facts scaffold` writes. */
+    handlersNeeded: string[];
+    /** `ext.<name>` for every source the oracle refuses to call — the rubric must change. */
+    refused: string[];
+}
+/** The endpoint's own did:web when the source's audience is NOT it — the stock lane refuses to sign. */
+export declare function audienceMismatch(source: ManifestExt): string | null;
+/**
+ * What the oracle will sign and send for one source, plus what it refuses from the rubric — the
+ * lines `protocol review` and `rubric validate` print under each ext name.
+ */
+export declare function extCallLines(source: ManifestExt): string[];
+export declare function classify(manifest: Manifest): WorkOrder;
+//# sourceMappingURL=workorder.d.ts.map

package/dist/cli/lib/workorder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workorder.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/workorder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAc,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIhF,uGAAuG;AACvG,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,YAAY,CAAC;AAE3D,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,kGAAkG;IAClG,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,QAAQ,EAAE,CAAC;IAChB,EAAE,EAAE,QAAQ,EAAE,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,YAAY,CAAC;IACxB,sGAAsG;IACtG,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,yFAAyF;IACzF,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAID,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAQnE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAa1D;AAoCD,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAqBtD"}

package/dist/cli/lib/workorder.js

@@ -0,0 +1,101 @@
+/**
+ * The rubric's work order sorted into the only two piles a provider cares about: names the STOCK
+ * lane can answer as declared, and names that need a handler of their own. Pure — manifest in,
+ * classification out — so `protocol review` prints it and `facts scaffold` writes files from it,
+ * and the two can never disagree about which is which.
+ *
+ * There is exactly one MECHANICAL "needs a handler": a `send` map that quotes a `~derived` value.
+ * The engine computes derived values and this oracle never binds a rubric, so the stock lane can
+ * only ever answer such a source with an error — that is a fact about the format, not a guess.
+ *
+ * And one mechanical REFUSAL, which no handler fixes: a source whose audience is not its
+ * endpoint's own did:web. The stock lane never signs for it (stock/ext-source.ts), and a handler
+ * signing for the URL it calls would not be answering the source the rubric declared — the
+ * rubric is wrong, so its author fixes it. Nothing is scaffolded for it.
+ * Everything else is a judgement the provider has to make about their own endpoint or judge, and it
+ * rides in `why` as a caveat rather than as a false certainty either way.
+ */
+import { DEFAULT_CAPABILITY, urlAudience } from "../../lib/facts/stock/capability.js";
+import { derivedSendRefs } from "../../lib/facts/stock/send.js";
+const CONTRACT = { boolean: "{ valid: boolean }", score: "{ score: 0..10000 }" };
+/** The endpoint's own did:web when the source's audience is NOT it — the stock lane refuses to sign. */
+export function audienceMismatch(source) {
+    let expected;
+    try {
+        expected = urlAudience(source.endpoint);
+    }
+    catch {
+        return null; // the endpoint policy refuses it first, with its own detail
+    }
+    return source.audience === expected ? null : expected;
+}
+/**
+ * What the oracle will sign and send for one source, plus what it refuses from the rubric — the
+ * lines `protocol review` and `rubric validate` print under each ext name.
+ */
+export function extCallLines(source) {
+    const expected = audienceMismatch(source);
+    const lines = [
+        expected
+            ? `ERROR: this source will not be called: its audience ${source.audience} is not the endpoint's own did:web (${expected}) — the oracle signs only for the host it calls`
+            : `calls POST ${source.endpoint} — UCAN from this oracle's did:web to ${source.audience}, capability ${DEFAULT_CAPABILITY.with} (a handler may set its own)`,
+    ];
+    if (source.capability) {
+        lines.push(`WARNING: the rubric declares capability ${JSON.stringify(source.capability)} — ignored: the oracle's developer owns the capability`);
+    }
+    return lines;
+}
+function extWork(name, source) {
+    const derived = derivedSendRefs(source.send);
+    const expected = audienceMismatch(source);
+    return {
+        kind: "ext",
+        name,
+        stock: derived.length === 0 && expected === null,
+        refused: expected !== null,
+        derived,
+        why: expected
+            ? `audience ${source.audience} is not the endpoint's did:web ${expected}`
+            : derived.length > 0
+                ? `reads ${derived.join(", ")}`
+                : `stock-coverable IF ${source.endpoint} accepts a self-signed UCAN POST (audience ${source.audience}) and answers the strict ${CONTRACT[source.expect]} contract — a vendor API with another shape or auth needs a handler`,
+        usedBy: source.usedBy,
+    };
+}
+function aiWork(name, check) {
+    const derived = derivedSendRefs(check.send);
+    return {
+        kind: "ai",
+        name,
+        stock: derived.length === 0,
+        refused: false,
+        derived,
+        why: derived.length > 0
+            ? `reads ${derived.join(", ")}`
+            : "stock-coverable: an AI check against these instructions (needs the AI provider configured — AI_PROVIDER + its binding/key — and policies.allowAiChecks) — only a vendor-specific model or vision API needs a handler",
+        usedBy: check.usedBy,
+    };
+}
+export function classify(manifest) {
+    const ext = Object.entries(manifest.ext).map(([name, source]) => extWork(name, source));
+    const ai = Object.entries(manifest.ai).map(([name, check]) => aiWork(name, check));
+    return {
+        rubricId: manifest.rubricId,
+        formDrifted: manifest.formProof.drifted,
+        ext,
+        ai,
+        unique: manifest.unique ? "stock" : "none",
+        // A frequency rule the engine sent without `max`/`per` cannot be run by anyone — the stock lane
+        // produces nothing and the build is refused (lib/facts/stock/rule-defaults.ts).
+        frequency: manifest.frequency
+            ? manifest.frequency.max !== undefined && manifest.frequency.per !== undefined
+                ? "stock"
+                : "unrunnable"
+            : "none",
+        handlersNeeded: [...ext, ...ai]
+            .filter((w) => !w.stock && !w.refused)
+            .map((w) => `${w.kind}.${w.name}`),
+        refused: ext.filter((w) => w.refused).map((w) => `${w.kind}.${w.name}`),
+    };
+}
+//# sourceMappingURL=workorder.js.map

package/dist/cli/lib/workorder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workorder.js","sourceRoot":"","sources":["../../../src/cli/lib/workorder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAmC7D,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,qBAAqB,EAAW,CAAC;AAE1F,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,4DAA4D;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG;QACZ,QAAQ;YACN,CAAC,CAAC,uDAAuD,MAAM,CAAC,QAAQ,uCAAuC,QAAQ,iDAAiD;YACxK,CAAC,CAAC,cAAc,MAAM,CAAC,QAAQ,yCAAyC,MAAM,CAAC,QAAQ,gBAAgB,kBAAkB,CAAC,IAAI,8BAA8B;KAC/J,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,2CAA2C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,wDAAwD,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAmB;IAChD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,IAAI;QAChD,OAAO,EAAE,QAAQ,KAAK,IAAI;QAC1B,OAAO;QACP,GAAG,EAAE,QAAQ;YACX,CAAC,CAAC,YAAY,MAAM,CAAC,QAAQ,kCAAkC,QAAQ,EAAE;YACzE,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClB,CAAC,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC/B,CAAC,CAAC,sBAAsB,MAAM,CAAC,QAAQ,8CAA8C,MAAM,CAAC,QAAQ,4BAA4B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,qEAAqE;QAChO,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAiB;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI,EAAE,IAAI;QACV,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC3B,OAAO,EAAE,KAAK;QACd,OAAO;QACP,GAAG,EACD,OAAO,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/B,CAAC,CAAC,sNAAsN;QAC5N,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO;QACvC,GAAG;QACH,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC1C,gGAAgG;QAChG,gFAAgF;QAChF,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC3B,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS;gBAC5E,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,YAAY;YAChB,CAAC,CAAC,MAAM;QACV,cAAc,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC"}