@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/act.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The ACT seam — the provider's say over what the act lane does with a decided verdict.
+ *
+ * Everything up to the verdict is the kit's business: pull, freeze facts, ask the engine, record
+ * the decision. SIGNING is where oracles legitimately differ. An oracle whose payout is pooled
+ * across several claims (a site paid once every patch on it is done) must be able to HOLD an
+ * approved claim instead of signing it the moment the engine answers, and to sign it later for an
+ * amount the kit could never compute. `policies.act` (oracle.ts) is that hook: the act lane
+ * (lib/ixo/chain-write.ts) calls it once every one of its own guards has passed and immediately
+ * before it reads the authz grant, hands it everything the decision rested on — the frozen facts,
+ * the claim's payment plane, the amount the lane would otherwise send — and does what it says.
+ *
+ * Types only: the hook is a function the provider writes, so there is nothing to validate at
+ * registration and nothing here imports a runtime value. A `hold` parks the row `held` — a status
+ * the delivered-once guard deliberately does NOT treat as final — and `signEvaluation`
+ * (chain-write.ts, re-exposed env-first by the `@ixo/decision-oracle/runtime` subpath) is the release
+ * pass that signs a held row later.
+ */
+import type { OracleEnv } from "./env.js";
+import type { Decision } from "./lib/engine/types.js";
+import type { AiFact, ExtFact } from "./lib/facts/factset.js";
+import type { ClaimNode } from "./lib/ixo/blocksync/types.js";
+import type { ClaimPayment } from "./lib/ixo/payment.js";
+import type { Logger } from "./lib/logger.js";
+/** Frozen facts by name, as sent to the engine — `ext.<name>` / `ai.<name>` only, never answers. */
+export interface ActFacts {
+    ext: Record<string, ExtFact>;
+    ai: Record<string, AiFact>;
+}
+/** Everything the lane knows about the claim it is about to sign for, at the moment it asks. */
+export interface ActContext {
+    claimId: string;
+    collectionId: string;
+    /** 1 approve · 2 reject — the chain's EvaluationStatus the lane is about to sign. */
+    evaluationStatus: 1 | 2;
+    verdict: string | null;
+    /** The engine's decision object verbatim (decisions.decision). */
+    decision: Decision;
+    receiptCid: string;
+    /** The facts the decision was made on, frozen on the decision row (decisions.facts). */
+    facts: ActFacts;
+    /** The claim's payment plane (lib/ixo/payment.ts): its own coins and whether an intent governs. */
+    payment: ClaimPayment | undefined;
+    /** What the lane would put on MsgEvaluateClaim without the policy (undefined ⇒ chain default). */
+    defaultAmount: {
+        denom: string;
+        amount: string;
+    } | undefined;
+    /**
+     * Whether a `sign` amount will stand here: `allowed` only while the collection's CURRENT chain
+     * owner opted in (`PATCH /v1/collections/:id/settings`); `off` ⇒ the lane pays `defaultAmount`
+     * whatever you return. A policy whose payout is not the default can `hold` or `skip` instead.
+     */
+    operatorAmounts: "off" | "allowed";
+    /** The on-chain claim as Blocksync returns it (lib/ixo/blocksync `getClaimById`). */
+    claim: ClaimNode;
+    env: OracleEnv;
+    logger: Logger;
+}
+/**
+ * What the lane does next. `sign` proceeds (its `amount`, when given, REPLACES what the lane would
+ * have sent — denom included — but only where the collection's owner set `operatorAmounts:
+ * allowed`; otherwise, and on an intent claim where the chain overwrites it anyway, it is ignored
+ * and logged);
+ * `hold` parks the row `held` for a later `signEvaluation`; `skip` leaves the row untouched, the
+ * same clean no-op as `AUTO_SIGN` being off.
+ */
+export type ActDecision = {
+    mode: "sign";
+    amount?: {
+        denom: string;
+        amount: string;
+    };
+    reason?: string;
+} | {
+    mode: "hold";
+    reason?: string;
+} | {
+    mode: "skip";
+    reason?: string;
+};
+/**
+ * The hook itself. It runs inside the act step's own retry, so a throw is a retry — never a silent
+ * signature: the lane records the error on the row and rethrows.
+ */
+export type ActPolicy = (ctx: ActContext) => Promise<ActDecision> | ActDecision;
+//# sourceMappingURL=act.d.ts.map

package/dist/act.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"act.d.ts","sourceRoot":"","sources":["../src/act.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,oGAAoG;AACpG,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,gGAAgG;AAChG,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kEAAkE;IAClE,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,KAAK,EAAE,QAAQ,CAAC;IAChB,mGAAmG;IACnG,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,kGAAkG;IAClG,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC7D;;;;OAIG;IACH,eAAe,EAAE,KAAK,GAAG,SAAS,CAAC;IACnC,qFAAqF;IACrF,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC"}

package/dist/act.js

@@ -0,0 +1,20 @@
+/**
+ * The ACT seam — the provider's say over what the act lane does with a decided verdict.
+ *
+ * Everything up to the verdict is the kit's business: pull, freeze facts, ask the engine, record
+ * the decision. SIGNING is where oracles legitimately differ. An oracle whose payout is pooled
+ * across several claims (a site paid once every patch on it is done) must be able to HOLD an
+ * approved claim instead of signing it the moment the engine answers, and to sign it later for an
+ * amount the kit could never compute. `policies.act` (oracle.ts) is that hook: the act lane
+ * (lib/ixo/chain-write.ts) calls it once every one of its own guards has passed and immediately
+ * before it reads the authz grant, hands it everything the decision rested on — the frozen facts,
+ * the claim's payment plane, the amount the lane would otherwise send — and does what it says.
+ *
+ * Types only: the hook is a function the provider writes, so there is nothing to validate at
+ * registration and nothing here imports a runtime value. A `hold` parks the row `held` — a status
+ * the delivered-once guard deliberately does NOT treat as final — and `signEvaluation`
+ * (chain-write.ts, re-exposed env-first by the `@ixo/decision-oracle/runtime` subpath) is the release
+ * pass that signs a held row later.
+ */
+export {};
+//# sourceMappingURL=act.js.map

package/dist/act.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"act.js","sourceRoot":"","sources":["../src/act.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/app.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Application assembly.
+ *
+ * Middleware order matters:
+ *   1. observability   — must be first so requestId/trace/logger/metrics exist
+ *                        for every downstream handler AND for onError.
+ *      inProcessOAuth  — the `/v1/mcp` OAuth mark, before anything can swap the raw request.
+ *   2. secureHeaders   — safe defaults on every response.
+ *   3. cors            — origins driven by validated config (an upload link's PUT: any origin).
+ *   4. rateLimit       — coarse per-IP guard on the whole API (after cors so 429s are CORS-safe,
+ *                        before bodyLimit so limited requests are shed without reading their body).
+ *   5. bodyLimit       — reject oversized payloads before they hit handlers.
+ *   6. prettyJSON      — opt-in via `?pretty`, safe in production.
+ *   ...routes...
+ *   onError / notFound — consistent JSON envelopes.
+ */
+import { Hono } from "hono";
+import type { AppEnv } from "./context.js";
+export declare function createApp(): Hono<AppEnv, import("hono/types").BlankSchema, "/">;
+declare const app: Hono<AppEnv, import("hono/types").BlankSchema, "/">;
+export default app;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAmDxC,wBAAgB,SAAS,wDAuExB;AAED,QAAA,MAAM,GAAG,qDAAc,CAAC;eACT,GAAG"}

package/dist/app.js

@@ -0,0 +1,128 @@
+/**
+ * Application assembly.
+ *
+ * Middleware order matters:
+ *   1. observability   — must be first so requestId/trace/logger/metrics exist
+ *                        for every downstream handler AND for onError.
+ *      inProcessOAuth  — the `/v1/mcp` OAuth mark, before anything can swap the raw request.
+ *   2. secureHeaders   — safe defaults on every response.
+ *   3. cors            — origins driven by validated config (an upload link's PUT: any origin).
+ *   4. rateLimit       — coarse per-IP guard on the whole API (after cors so 429s are CORS-safe,
+ *                        before bodyLimit so limited requests are shed without reading their body).
+ *   5. bodyLimit       — reject oversized payloads before they hit handlers.
+ *   6. prettyJSON      — opt-in via `?pretty`, safe in production.
+ *   ...routes...
+ *   onError / notFound — consistent JSON envelopes.
+ */
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { cors } from "hono/cors";
+import { prettyJSON } from "hono/pretty-json";
+import { secureHeaders } from "hono/secure-headers";
+import { corsOrigins } from "./config.js";
+import { AppError } from "./lib/errors.js";
+import { apiNotFound, apiOnError, isApiPath } from "./middleware/api/errors.js";
+import { inProcessOAuth } from "./middleware/api/oauth.js";
+import { database } from "./middleware/database.js";
+import { notFound, onError } from "./middleware/error-handler.js";
+import { observability } from "./middleware/observability.js";
+import { rateLimit } from "./middleware/rate-limit.js";
+import { health } from "./routes/health.js";
+import { v1 } from "./routes/v1/index.js";
+import { api, llms } from "./routes/v1/api/index.js";
+import { mcp } from "./routes/v1/mcp/index.js";
+import { wellKnown } from "./routes/well-known.js";
+/** 1 MiB default request body cap. */
+const MAX_BODY_BYTES = 1024 * 1024;
+/**
+ * What a cross-origin caller (the Decision Console, go-prod §12) must be able to READ on an answer:
+ * the lane's limits, idempotency, wait and payment headers. CORS hides every other header.
+ */
+const EXPOSED_HEADERS = [
+    "x-request-id",
+    "RateLimit-Limit",
+    "RateLimit-Remaining",
+    "RateLimit-Reset",
+    "Retry-After",
+    "Location",
+    "Preference-Applied",
+    "Idempotent-Replayed",
+    "PAYMENT-REQUIRED",
+    "PAYMENT-RESPONSE",
+];
+/** `PUT /v1/api/uploads/<uploadId>` — an upload link (v1.7), public and signed. */
+const LINK_UPLOAD = /^\/v1\/api\/uploads\/upl_[^/]+$/;
+/** The routes whose body is not JSON: an upload streams up to 25 MB and caps itself. */
+const isUpload = (method, path) => method === "PUT" && (path === "/v1/api/uploads" || LINK_UPLOAD.test(path));
+/**
+ * An upload link's PUT — or its preflight. The link is made for a sandboxed iframe (an AI app's
+ * widget), whose `Origin` is `null` or a host's sandbox origin no allow-list can name; the signed
+ * URL is the whole credential and no cookie is ever read, so this one path answers `*` without
+ * credentials. `GET` on the same path is the console's and keeps the configured origins.
+ */
+const isLinkUpload = (method, path, preflightMethod) => LINK_UPLOAD.test(path) &&
+    (method === "PUT" || (method === "OPTIONS" && preflightMethod?.toUpperCase() === "PUT"));
+export function createApp() {
+    const app = new Hono();
+    app.use("*", observability);
+    // The MCP handler's in-process mark for an OAuth caller, read before any middleware (bodyLimit)
+    // can replace `c.req.raw` — it is keyed on that very request (`middleware/api/oauth.ts`).
+    app.use("*", inProcessOAuth);
+    // Lazy DB access: installs `c.var.db()` but only connects when a handler uses it.
+    app.use("*", database);
+    // A signed upload read (`/v1/api/files/:uploadId`) is shown as an <img> on the console's origin,
+    // so it alone is cross-origin readable; it stays `attachment` + `nosniff` (uploads.ts), and an
+    // <img> runs no script. secureHeaders writes after `next()`, so the route cannot override it.
+    const headers = secureHeaders();
+    const fileHeaders = secureHeaders({ crossOriginResourcePolicy: "cross-origin" });
+    app.use("*", (c, next) => c.req.path.startsWith("/v1/api/files/") ? fileHeaders(c, next) : headers(c, next));
+    const apiCors = cors({
+        origin: (origin, c) => {
+            const allowed = corsOrigins(c.get("config"));
+            if (allowed === "*")
+                return origin || "*";
+            return allowed.includes(origin) ? origin : null;
+        },
+        credentials: true,
+        maxAge: 86_400,
+        exposeHeaders: EXPOSED_HEADERS,
+    });
+    const linkCors = cors({ origin: "*", maxAge: 86_400, exposeHeaders: EXPOSED_HEADERS });
+    app.use("*", (c, next) => isLinkUpload(c.req.method, c.req.path, c.req.header("Access-Control-Request-Method"))
+        ? linkCors(c, next)
+        : apiCors(c, next));
+    app.use("*", rateLimit);
+    const jsonBodyLimit = bodyLimit({
+        maxSize: MAX_BODY_BYTES,
+        onError: () => {
+            throw new AppError(`The request body is larger than ${MAX_BODY_BYTES / (1024 * 1024)} MB. Send a smaller body; large files go through uploads.`, {
+                code: "BAD_REQUEST",
+                status: 413,
+            });
+        },
+    });
+    app.use("*", (c, next) => (isUpload(c.req.method, c.req.path) ? next() : jsonBodyLimit(c, next)));
+    app.use("*", prettyJSON());
+    app.get("/", (c) => {
+        const config = c.get("config");
+        return c.json({
+            name: config.SERVICE_NAME,
+            version: config.SERVICE_VERSION,
+            status: "ok",
+        });
+    });
+    app.route("/health", health);
+    app.route("/.well-known", wellKnown);
+    // The API lane first: its router owns `/v1/api/*` whole (its own auth, its own envelope).
+    app.route("/v1/api", api);
+    app.route("/llms.txt", llms);
+    // Before `/v1`: the MCP server authenticates with the lane's API keys, never a UCAN.
+    app.route("/v1/mcp", mcp);
+    app.route("/v1", v1);
+    app.notFound((c) => (isApiPath(c.req.path) ? apiNotFound(c) : notFound(c)));
+    app.onError((err, c) => (isApiPath(c.req.path) ? apiOnError(err, c) : onError(err, c)));
+    return app;
+}
+const app = createApp();
+export default app;
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,sCAAsC;AACtC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnC;;;GAGG;AACH,MAAM,eAAe,GAAG;IACtB,cAAc;IACd,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;IACjB,aAAa;IACb,UAAU;IACV,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC;AAEF,mFAAmF;AACnF,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD,wFAAwF;AACxF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CAChD,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,eAAmC,EAAE,EAAE,CACzF,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;IACtB,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,eAAe,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC;AAE3F,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAE/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5B,gGAAgG;IAChG,0FAA0F;IAC1F,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7B,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvB,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,yBAAyB,EAAE,cAAc,EAAE,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACvB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAClF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC;QACnB,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACpB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,GAAG;gBAAE,OAAO,MAAM,IAAI,GAAG,CAAC;YAC1C,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;QACD,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,eAAe;KAC/B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACvF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACvB,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QACnF,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC;QACnB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CACrB,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,IAAI,QAAQ,CAChB,mCAAmC,cAAc,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,2DAA2D,EAC5H;gBACE,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,GAAG;aACZ,CACF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAClG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,MAAM,CAAC,eAAe;YAC/B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACrC,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1B,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC7B,qFAAqF;IACrF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1B,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAExF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;AACxB,eAAe,GAAG,CAAC"}

package/dist/cli/commands/api.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `decision-oracle api …` — the Decision API lane's operator surface (go-prod spec §3.2, §12.2), for
+ * whoever runs an oracle with `API_LANE` on and has no console in front of it yet. Every call is a
+ * console invocation signed as the AuthHub session `decision-oracle login` saved: `{ with:
+ * ixo:oracle/<oracle did:web>, can: <the route's action> }` for the account and operator routes,
+ * `…/source/<id>` + `X-Source-Id` for a source's own (`middleware/api/console.ts`; the action is
+ * the route's `API_ACTIONS` entry, named by its op at each call), 120 s, audience read off the
+ * oracle's did.json. The session invokes as itself, with no grant — so on a source it must be a
+ * current controller (admin) of the source's organisation (D10); on `/admin` its DID must be in the
+ * oracle's `ORACLE_ADMIN_DIDS`.
+ *
+ *   api source create --name <n> --contact <email> --entity <did:ixo:entity:…>
+ *                                                         add this oracle to an organisation you
+ *                                                         control (pending-link; secret shown once)
+ *   api source link <sourceId> [--engine-url <url>] [--yes]
+ *                                                         finish it as the console's "Add oracle"
+ *                                                         does: sign the organisation's link, PUT
+ *                                                         it to the ENGINE (`company/link` on
+ *                                                         `ixo:eval-engine`), then the oracle's
+ *                                                         company sync → active
+ *   api source delete <sourceId> [--yes]                 remove this oracle from the organisation:
+ *                                                         the source and every row off it (the
+ *                                                         undo for a wrong link; root only)
+ *   api sources [--entity <did:ixo:entity:…>]            the session's memberships on this oracle;
+ *                                                         with --entity, every source of an
+ *                                                         organisation it controls (pending too)
+ *   api key create --source <id> --scopes <s,…> [--name <n>] [--max-spend-cents <n>]
+ *   api keys --source <id>
+ *   api key revoke --source <id> <prefix|masked key> [--grace-days <n>] [--yes]
+ *   api admin sources
+ *   api admin pause <sourceId> [--note <text>] [--yes]
+ *   api admin resume <sourceId> [--yes]
+ *   api admin protocols <sourceId> <did,…>|--none [--yes]  replaces the allow-list whole
+ *   api admin billing-mode <sourceId> x402|none [--yes]    operator-only by design (§3.2)
+ *   api review-billing enable --source <id> [--cap <PAY>] [--yes]
+ *                                                         "Pay for reviews" (contracts 1.22.0): the
+ *                                                         organisation's chain owner signs the x402
+ *                                                         payment delegation and stores it here
+ *   api review-billing status --source <id>
+ *   api review-billing disable --source <id> [--yes]     drop it here, then revoke it in the UCAN store
+ *
+ * Common: `--kit <url>` (else the project's `ORACLE_HOSTNAME`), `--env-file`, `--network`
+ * (which saved session; else the project's `IXO_NETWORK`, else devnet), `--json` (the response body
+ * as the API answered it — stdout is that JSON and nothing else: a gate's plan goes to stderr, so a
+ * dry run under `--json` prints nothing on stdout). A refusal prints the §4.1 envelope's code,
+ * message and requestId and exits 1. Every write carries a fresh `Idempotency-Key`.
+ */
+export declare const API_USAGE = "usage: decision-oracle api <subcommand> [options]\n\n  source create --name <n> --contact <email> --entity <did>\n                                                 add this oracle to an organisation you control \u2014\n                                                 pending-link until its link syncs; secret shown ONCE\n  source link <sourceId> [--engine-url <url>]    sign the organisation's link, store it at the\n                                                 engine and sync it: pending-link \u2192 active\n  source delete <sourceId>                       remove this oracle from the organisation: the\n                                                 source, its keys, members, webhooks and claims\n  sources [--entity <did>]                      the sources your login belongs to; with --entity,\n                                                 every source of an organisation you control\n                                                 (pending-link ones included)\n  key create --source <id> --scopes <s,\u2026> [--name <n>] [--max-spend-cents <n>]\n                                                 mint an API key \u2014 shown ONCE\n  keys --source <id>                             a source's keys, masked\n  key revoke --source <id> <prefix|masked key> [--grace-days <n>]\n  admin sources                                  every source (your DID in ORACLE_ADMIN_DIDS)\n  admin pause <sourceId> [--note <text>]\n  admin resume <sourceId>\n  admin protocols <sourceId> <did,\u2026>|--none      replace a source's allowed protocols (--none: no\n                                                 protocol at all)\n  admin billing-mode <sourceId> x402|none\n  review-billing enable --source <id> [--cap <PAY>]\n                                                 \"Pay for reviews\": sign, as the organisation's\n                                                 chain owner, a payment delegation for this oracle's\n                                                 reviews (a lifetime cap, default 1000 PAY;\n                                                 ~100 years) and store it; enable again with a higher\n                                                 --cap replaces it\n  review-billing status --source <id>            the stored delegation: state, cap, spent, credits\n  review-billing disable --source <id>           drop it here, then revoke it in the UCAN store\n\ncommon: --kit <url> (else ORACLE_HOSTNAME from the project), --env-file <path>,\n--network devnet|testnet|mainnet (else the project's IXO_NETWORK, else devnet), --json (the API's\nanswer, alone on stdout), --yes (a source link or delete, a key revoke, every admin change and a\nreview-billing enable or disable are dry runs without it)\n";
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=api.d.ts.map

package/dist/cli/commands/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAsEH,eAAO,MAAM,SAAS,sqFAmCrB,CAAC;AAEF,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAmFzD"}