@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/lib/api-lane/claim-list.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The claim list both lanes share (Go Prod §4.2, contracts v1.2): `GET /v1/api/claims` — a source's
+ * API claims plus its linked collections' chain claims — and the operator's `GET /v1/api/admin/claims`
+ * — every source's and every watched collection's. One builder, so the two cannot page differently.
+ *
+ * ONE keyset stream: a `UNION ALL` of the API branch (`api_claims`, whose ledger row may not exist
+ * yet — the list must still show it `queued`) and the chain branch (`claim_ingests` rows of lane
+ * `chain` whose collection has a protocol — what `claimRecordsFor` can show, so a page is never
+ * shorter than its ids). The branches are disjoint (an API claim's ledger row is lane `api`). The
+ * time is the record's own `createdAt` — an API claim's `receivedAt`, a chain claim's ledger
+ * `createdAt` — so the cursor is the shared (time, claimId) pair: one position in the merged order,
+ * never one per lane. Every filter is pushed into both branches, so each still rides its index.
+ *
+ * D1 binds at most 100 parameters per statement, so nothing here binds one per list element: a
+ * source's linked collections are a subquery on `api_source_collections`, and `nb.protocols` is ONE
+ * JSON parameter read through `json_each` (in each branch). The statement binds ~25 parameters
+ * whatever the number of links or protocols.
+ */
+import type { ClaimRecord, ListClaimsQuery } from "../../contracts/index.js";
+import type { Database } from "../../db/client.js";
+/** Which claims a list may show. A null branch is left out of the stream entirely. */
+export interface ClaimScope {
+    /** API claims: of one source, or (no `sourceId`) of every source. */
+    api: {
+        sourceId?: string;
+    } | null;
+    /**
+     * Chain claims: of the collections linked to `linkedTo` (a source — every live link: only the
+     * re-check's positive drop hides one, never a stale `verifiedAt`), or of every watched one; `collectionId` narrows either to one collection.
+     */
+    chain: {
+        linkedTo?: string;
+        collectionId?: string;
+    } | null;
+    /** A console member's `nb.protocols` over both branches; null = every protocol. */
+    protocols: readonly string[] | null;
+    /** Stamped on the chain records' `sourceId` (a source reading its linked collections). */
+    sourceId?: string;
+}
+export declare function claimPage(db: Database, q: ListClaimsQuery, scope: ClaimScope): Promise<{
+    items: ClaimRecord[];
+    nextCursor: string | null;
+}>;
+//# sourceMappingURL=claim-list.d.ts.map

package/dist/lib/api-lane/claim-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-list.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/claim-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAWhD,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,GAAG,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3D,mFAAmF;IACnF,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpC,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,QAAQ,EACZ,CAAC,EAAE,eAAe,EAClB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA8F9D"}

package/dist/lib/api-lane/claim-list.js

@@ -0,0 +1,92 @@
+/**
+ * The claim list both lanes share (Go Prod §4.2, contracts v1.2): `GET /v1/api/claims` — a source's
+ * API claims plus its linked collections' chain claims — and the operator's `GET /v1/api/admin/claims`
+ * — every source's and every watched collection's. One builder, so the two cannot page differently.
+ *
+ * ONE keyset stream: a `UNION ALL` of the API branch (`api_claims`, whose ledger row may not exist
+ * yet — the list must still show it `queued`) and the chain branch (`claim_ingests` rows of lane
+ * `chain` whose collection has a protocol — what `claimRecordsFor` can show, so a page is never
+ * shorter than its ids). The branches are disjoint (an API claim's ledger row is lane `api`). The
+ * time is the record's own `createdAt` — an API claim's `receivedAt`, a chain claim's ledger
+ * `createdAt` — so the cursor is the shared (time, claimId) pair: one position in the merged order,
+ * never one per lane. Every filter is pushed into both branches, so each still rides its index.
+ *
+ * D1 binds at most 100 parameters per statement, so nothing here binds one per list element: a
+ * source's linked collections are a subquery on `api_source_collections`, and `nb.protocols` is ONE
+ * JSON parameter read through `json_each` (in each branch). The statement binds ~25 parameters
+ * whatever the number of links or protocols.
+ */
+import { and, eq, gte, inArray, isNotNull, isNull, lt, or, sql } from "drizzle-orm";
+import { unionAll } from "drizzle-orm/sqlite-core";
+import { apiClaims, apiSourceCollections, claimIngests, decisions, watchedCollections, } from "../../db/schema.js";
+import { decodeCursor, encodeCursor } from "../cursor.js";
+import { claimRecordsFor } from "./record.js";
+export async function claimPage(db, q, scope) {
+    const after = q.cursor ? decodeCursor(q.cursor) : null;
+    // The filters every branch shares, over that branch's own protocol / time / id columns.
+    const shared = (protocol, time, id) => [
+        // One JSON parameter, not one per protocol (the header's parameter bound).
+        scope.protocols
+            ? sql `${protocol} in (select value from json_each(${JSON.stringify(scope.protocols)}))`
+            : undefined,
+        q.protocol ? eq(protocol, q.protocol) : undefined,
+        // The record's status, not the ledger's: a missing or `skipped` ingest reads as `queued`
+        // (record.ts), so the filter must find those too.
+        q.status === "queued"
+            ? or(isNull(claimIngests.status), inArray(claimIngests.status, ["queued", "skipped"]))
+            : q.status
+                ? eq(claimIngests.status, q.status)
+                : undefined,
+        q.decision ? eq(decisions.status, q.decision) : undefined,
+        q.verdict ? eq(decisions.verdict, q.verdict) : undefined,
+        // `since` inclusive, `until` exclusive: consecutive windows never count a claim twice.
+        q.since ? gte(time, new Date(q.since)) : undefined,
+        q.until ? lt(time, new Date(q.until)) : undefined,
+        after
+            ? or(lt(time, after.createdAt), and(eq(time, after.createdAt), lt(id, after.claimId)))
+            : undefined,
+    ].filter((w) => w !== undefined);
+    const api = scope.api
+        ? db
+            .select({
+            id: sql `${apiClaims.claimId}`.as("id"),
+            at: sql `${apiClaims.receivedAt}`.as("at"),
+        })
+            .from(apiClaims)
+            .leftJoin(claimIngests, eq(claimIngests.claimId, apiClaims.claimId))
+            .leftJoin(decisions, eq(decisions.claimId, apiClaims.claimId))
+            .where(and(scope.api.sourceId ? eq(apiClaims.sourceId, scope.api.sourceId) : undefined, ...shared(apiClaims.protocolDid, apiClaims.receivedAt, apiClaims.claimId)))
+        : null;
+    const chain = scope.chain
+        ? db
+            .select({
+            id: sql `${claimIngests.claimId}`.as("id"),
+            at: sql `${claimIngests.createdAt}`.as("at"),
+        })
+            .from(claimIngests)
+            .innerJoin(watchedCollections, eq(watchedCollections.collectionId, claimIngests.collectionId))
+            .leftJoin(decisions, eq(decisions.claimId, claimIngests.claimId))
+            .where(and(eq(claimIngests.lane, "chain"), isNotNull(watchedCollections.protocolDid), scope.chain.collectionId
+            ? eq(claimIngests.collectionId, scope.chain.collectionId)
+            : undefined, scope.chain.linkedTo
+            ? inArray(claimIngests.collectionId, db
+                .select({ id: apiSourceCollections.collectionId })
+                .from(apiSourceCollections)
+                .where(eq(apiSourceCollections.sourceId, scope.chain.linkedTo)))
+            : undefined, ...shared(watchedCollections.protocolDid, claimIngests.createdAt, claimIngests.claimId)))
+        : null;
+    const stream = api && chain ? unionAll(api, chain) : (api ?? chain);
+    if (!stream)
+        return { items: [], nextCursor: null };
+    // Ids only, one more than the page to know there is a next one; the records are then built in
+    // one read per table (`claimRecordsFor`). Ordered by the result's own aliases — a compound
+    // SELECT can order by nothing else.
+    const rows = await stream.orderBy(sql `"at" desc`, sql `"id" desc`).limit(q.limit + 1);
+    const page = rows.slice(0, q.limit);
+    const last = page.at(-1);
+    return {
+        items: await claimRecordsFor(db, page.map((r) => r.id), { sourceId: scope.sourceId }),
+        nextCursor: rows.length > q.limit && last ? encodeCursor(new Date(Number(last.at)), last.id) : null,
+    };
+}
+//# sourceMappingURL=claim-list.js.map

package/dist/lib/api-lane/claim-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-list.js","sourceRoot":"","sources":["../../../src/lib/api-lane/claim-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAqB,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,SAAS,EACT,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAiB3C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAY,EACZ,CAAkB,EAClB,KAAiB;IAEjB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvD,wFAAwF;IACxF,MAAM,MAAM,GAAG,CAAC,QAAsB,EAAE,IAAkB,EAAE,EAAgB,EAAS,EAAE,CACrF;QACE,2EAA2E;QAC3E,KAAK,CAAC,SAAS;YACb,CAAC,CAAC,GAAG,CAAA,GAAG,QAAQ,oCAAoC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;YACvF,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACjD,yFAAyF;QACzF,kDAAkD;QAClD,CAAC,CAAC,MAAM,KAAK,QAAQ;YACnB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAC,SAAS;QACf,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACzD,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QACxD,uFAAuF;QACvF,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAClD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACjD,KAAK;YACH,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACtF,CAAC,CAAC,SAAS;KACd,CAAC,MAAM,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAE7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG;QACnB,CAAC,CAAC,EAAE;aACC,MAAM,CAAC;YACN,EAAE,EAAE,GAAG,CAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YAC9C,EAAE,EAAE,GAAG,CAAQ,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;SAClD,CAAC;aACD,IAAI,CAAC,SAAS,CAAC;aACf,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;aACnE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;aAC7D,KAAK,CACJ,GAAG,CACD,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAC3E,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,CAC1E,CACF;QACL,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK;QACvB,CAAC,CAAC,EAAE;aACC,MAAM,CAAC;YACN,EAAE,EAAE,GAAG,CAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACjD,EAAE,EAAE,GAAG,CAAQ,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;SACpD,CAAC;aACD,IAAI,CAAC,YAAY,CAAC;aAClB,SAAS,CACR,kBAAkB,EAClB,EAAE,CAAC,kBAAkB,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAC/D;aACA,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;aAChE,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAC9B,SAAS,CAAC,kBAAkB,CAAC,WAAW,CAAC,EACzC,KAAK,CAAC,KAAK,CAAC,YAAY;YACtB,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;YACzD,CAAC,CAAC,SAAS,EACb,KAAK,CAAC,KAAK,CAAC,QAAQ;YAClB,CAAC,CAAC,OAAO,CACL,YAAY,CAAC,YAAY,EACzB,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,CAAC,YAAY,EAAE,CAAC;iBACjD,IAAI,CAAC,oBAAoB,CAAC;iBAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAClE;YACH,CAAC,CAAC,SAAS,EACb,GAAG,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,CACxF,CACF;QACL,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpD,8FAA8F;IAC9F,2FAA2F;IAC3F,oCAAoC;IACpC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAA,WAAW,EAAE,GAAG,CAAA,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO;QACL,KAAK,EAAE,MAAM,eAAe,CAC1B,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAC7B;QACD,UAAU,EACR,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1F,CAAC;AACJ,CAAC"}

package/dist/lib/api-lane/company.d.ts

@@ -0,0 +1,56 @@
+/**
+ * A source's organisation (company authority D1, D10; ENGINE-CONTRACT "The company link (API
+ * sources)"). An organisation IS its on-chain entity, and a source never exists without one: it is
+ * the organisation's access to this oracle, created by a current controller of the entity
+ * (`companyEntityDid`, set at insert, never changed). Its ROOTS are that entity's CURRENT
+ * controllers, read live from Blocksync on every check — uncached, so a removed controller loses the
+ * source at once and a new one gains it with nothing from anyone else (G13). There is no personal
+ * root: `ownerDid` is only the paying account.
+ *
+ * The link lives at the ENGINE (its only home): the controller signs a `SourceCompanyLink`, the
+ * Console PUTs it there, and `POST /v1/api/sources/:id/company/sync` mirrors what the engine then
+ * says. This oracle never verifies a link JWS — the engine's stored state is the authority. A source
+ * is `pending-link` until the engine holds a link for its own entity, and takes no claims and no
+ * keys until then; a link for ANOTHER entity, or the engine's `disputed`, makes it `disputed`.
+ */
+import type { Database } from "../../db/client.js";
+import { type ApiSource } from "../../db/schema.js";
+import type { CompanyLinkState } from "../engine/types.js";
+import type { BlocksyncDeps } from "../ixo/blocksync/types.js";
+export declare function setEntityControllersForTests(fn: ((entityDid: string) => Promise<string[]>) | null): void;
+/** The entity's current account controllers (Blocksync, uncached; trouble is a 503, never []). */
+export declare function entityControllers(chain: BlocksyncDeps, entityDid: string): Promise<string[]>;
+/** Who administers the source NOW: its entity's current controllers (possibly none). */
+export declare function sourceRoots(chain: BlocksyncDeps, source: Pick<ApiSource, "companyEntityDid">): Promise<string[]>;
+/**
+ * A `pending-link` source's id must not reach anyone but its organisation's controllers (owner,
+ * 2026-10-10: no squatting on a source before its link lands) — not in a log line, a metric label,
+ * an alert or an email. Logs carry this instead: the first 12 hex chars of its sha256.
+ */
+export declare function sourceIdHash(sourceId: string): Promise<string>;
+/**
+ * What a log line, a metric or an alert may say about a source: its id once it has EVER been active
+ * (its members have seen it then), else only its hash — a `pending-link` source, and a `disputed`
+ * one that never went active, are known only to their organisation's controllers.
+ */
+export declare function sourceLogId(source: Pick<ApiSource, "sourceId" | "activatedAt">): Promise<{
+    sourceId: string;
+} | {
+    sourceIdHash: string;
+}>;
+/**
+ * Mirror the engine's answer onto the source; null when the source is gone. ONE statement each,
+ * and neither ever writes `pausedReason` — a pause is the operator's or the billing lane's, not the
+ * link's:
+ *   - `linked` for the source's own entity ⇒ `active`, or `paused` while the ROW (read in the same
+ *     statement, so a pause racing the sync stands) has a reason — with the link, its `issuedAt`
+ *     and `payeeField`, and `activatedAt` the first time — unless the stored link is
+ *     NEWER: a stale read (two syncs racing, an engine replica behind) never rolls a link back;
+ *   - `linked` for another entity, or `disputed` ⇒ `disputed`: no authority, so no `payeeField`, no
+ *     claims, no keys — the organisation deletes the source and adds the oracle again;
+ *   - `unlinked` ⇒ nothing changes. A pending source stays pending; a linked one reading it is the
+ *     engine's transient state (a replica behind, a link being replaced), never a reason to drop
+ *     a live source — the route logs and alerts it.
+ */
+export declare function mirrorCompanyLink(db: Database, source: ApiSource, link: CompanyLinkState): Promise<ApiSource | null>;
+//# sourceMappingURL=company.d.ts.map

package/dist/lib/api-lane/company.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/company.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAI5D,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,GACpD,IAAI,CAEN;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAI5F;AAED,wFAAwF;AACxF,wBAAsB,WAAW,CAC/B,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,GAC1C,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,aAAa,CAAC,GAClD,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAI1D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAqC3B"}

package/dist/lib/api-lane/company.js

@@ -0,0 +1,103 @@
+/**
+ * A source's organisation (company authority D1, D10; ENGINE-CONTRACT "The company link (API
+ * sources)"). An organisation IS its on-chain entity, and a source never exists without one: it is
+ * the organisation's access to this oracle, created by a current controller of the entity
+ * (`companyEntityDid`, set at insert, never changed). Its ROOTS are that entity's CURRENT
+ * controllers, read live from Blocksync on every check — uncached, so a removed controller loses the
+ * source at once and a new one gains it with nothing from anyone else (G13). There is no personal
+ * root: `ownerDid` is only the paying account.
+ *
+ * The link lives at the ENGINE (its only home): the controller signs a `SourceCompanyLink`, the
+ * Console PUTs it there, and `POST /v1/api/sources/:id/company/sync` mirrors what the engine then
+ * says. This oracle never verifies a link JWS — the engine's stored state is the authority. A source
+ * is `pending-link` until the engine holds a link for its own entity, and takes no claims and no
+ * keys until then; a link for ANOTHER entity, or the engine's `disputed`, makes it `disputed`.
+ */
+import { and, eq, isNull, lte, or, sql } from "drizzle-orm";
+import { apiSources } from "../../db/schema.js";
+import { sha256Hex } from "../hash.js";
+import { getEntityControllers } from "../ixo/blocksync/index.js";
+/** Where the tests install the chain's answer (it belongs to the read it fakes). */
+let controllersForTests = null;
+export function setEntityControllersForTests(fn) {
+    controllersForTests = fn;
+}
+/** The entity's current account controllers (Blocksync, uncached; trouble is a 503, never []). */
+export function entityControllers(chain, entityDid) {
+    return controllersForTests
+        ? controllersForTests(entityDid)
+        : getEntityControllers(chain, entityDid);
+}
+/** Who administers the source NOW: its entity's current controllers (possibly none). */
+export async function sourceRoots(chain, source) {
+    // Null only on a row the D10 migration should have deleted: nobody administers it.
+    if (!source.companyEntityDid)
+        return [];
+    return entityControllers(chain, source.companyEntityDid);
+}
+/**
+ * A `pending-link` source's id must not reach anyone but its organisation's controllers (owner,
+ * 2026-10-10: no squatting on a source before its link lands) — not in a log line, a metric label,
+ * an alert or an email. Logs carry this instead: the first 12 hex chars of its sha256.
+ */
+export async function sourceIdHash(sourceId) {
+    return (await sha256Hex(sourceId)).slice(0, 12);
+}
+/**
+ * What a log line, a metric or an alert may say about a source: its id once it has EVER been active
+ * (its members have seen it then), else only its hash — a `pending-link` source, and a `disputed`
+ * one that never went active, are known only to their organisation's controllers.
+ */
+export async function sourceLogId(source) {
+    return source.activatedAt === null
+        ? { sourceIdHash: await sourceIdHash(source.sourceId) }
+        : { sourceId: source.sourceId };
+}
+/**
+ * Mirror the engine's answer onto the source; null when the source is gone. ONE statement each,
+ * and neither ever writes `pausedReason` — a pause is the operator's or the billing lane's, not the
+ * link's:
+ *   - `linked` for the source's own entity ⇒ `active`, or `paused` while the ROW (read in the same
+ *     statement, so a pause racing the sync stands) has a reason — with the link, its `issuedAt`
+ *     and `payeeField`, and `activatedAt` the first time — unless the stored link is
+ *     NEWER: a stale read (two syncs racing, an engine replica behind) never rolls a link back;
+ *   - `linked` for another entity, or `disputed` ⇒ `disputed`: no authority, so no `payeeField`, no
+ *     claims, no keys — the organisation deletes the source and adds the oracle again;
+ *   - `unlinked` ⇒ nothing changes. A pending source stays pending; a linked one reading it is the
+ *     engine's transient state (a replica behind, a link being replaced), never a reason to drop
+ *     a live source — the route logs and alerts it.
+ */
+export async function mirrorCompanyLink(db, source, link) {
+    const { sourceId } = source;
+    const current = async () => (await db.query.apiSources.findFirst({ where: eq(apiSources.sourceId, sourceId) })) ?? null;
+    if (link.state === "unlinked")
+        return current();
+    if (link.state !== "linked" || link.entityDid !== source.companyEntityDid) {
+        const [row] = await db
+            .update(apiSources)
+            .set({
+            status: "disputed",
+            companyLink: null,
+            companyLinkIssuedAt: null,
+            payeeField: null,
+        })
+            .where(eq(apiSources.sourceId, sourceId))
+            .returning();
+        return row ?? null;
+    }
+    const issuedAt = new Date(link.issuedAt);
+    const [row] = await db
+        .update(apiSources)
+        .set({
+        status: sql `CASE WHEN ${apiSources.pausedReason} IS NOT NULL THEN 'paused' ELSE 'active' END`,
+        activatedAt: sql `COALESCE(${apiSources.activatedAt}, ${Date.now()})`,
+        companyLink: link.link,
+        companyLinkIssuedAt: issuedAt,
+        payeeField: link.payeeField,
+    })
+        .where(and(eq(apiSources.sourceId, sourceId), or(isNull(apiSources.companyLinkIssuedAt), lte(apiSources.companyLinkIssuedAt, issuedAt))))
+        .returning();
+    // Stale (or gone): what is stored stands.
+    return row ?? current();
+}
+//# sourceMappingURL=company.js.map

package/dist/lib/api-lane/company.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.js","sourceRoot":"","sources":["../../../src/lib/api-lane/company.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EAAkB,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGxD,oFAAoF;AACpF,IAAI,mBAAmB,GAAsD,IAAI,CAAC;AAClF,MAAM,UAAU,4BAA4B,CAC1C,EAAqD;IAErD,mBAAmB,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAAC,KAAoB,EAAE,SAAiB;IACvE,OAAO,mBAAmB;QACxB,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAoB,EACpB,MAA2C;IAE3C,mFAAmF;IACnF,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO,EAAE,CAAC;IACxC,OAAO,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,OAAO,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAmD;IAEnD,OAAO,MAAM,CAAC,WAAW,KAAK,IAAI;QAChC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAY,EACZ,MAAiB,EACjB,IAAsB;IAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CACzB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9F,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,OAAO,EAAE,CAAC;IAChD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,IAAI;YACjB,mBAAmB,EAAE,IAAI;YACzB,UAAU,EAAE,IAAI;SACjB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACxC,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC;QACH,MAAM,EAAE,GAAG,CAAA,aAAa,UAAU,CAAC,YAAY,8CAA8C;QAC7F,WAAW,EAAE,GAAG,CAAA,YAAY,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG;QACpE,WAAW,EAAE,IAAI,CAAC,IAAI;QACtB,mBAAmB,EAAE,QAAQ;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACjC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAC1F,CACF;SACA,SAAS,EAAE,CAAC;IACf,0CAA0C;IAC1C,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1B,CAAC"}

package/dist/lib/api-lane/events.d.ts

@@ -0,0 +1,21 @@
+/**
+ * A claim's timeline as `GET …/events` shows it (Go Prod §4.2, contracts v1.2), for either lane.
+ *
+ * An API claim's is its `api_events` rows, written as things happened (notify.ts, webhooks.ts,
+ * review.ts, retention.ts). A chain claim has no such rows — the chain lane never wrote a timeline —
+ * so its events are DERIVED from the timestamps the ledger already keeps: `claim_ingests`,
+ * `decisions`, `claim_reviews`. Derived ids come from `eventIdFor` (ids.ts) over the claim and the
+ * event type, so the same step reads back with the same id on every call. Like the API lane's,
+ * `data` is names, codes and digests — never an answer.
+ */
+import { type ClaimEvent } from "../../contracts/index.js";
+import type { Database } from "../../db/client.js";
+/** An API claim's stored timeline, oldest first (`evt_<ULID>`: id order is time order). */
+export declare function apiClaimEvents(db: Database, claimId: string): Promise<ClaimEvent[]>;
+/**
+ * A chain claim's timeline, derived (see header), oldest first — empty for an id the ledger does
+ * not hold. The FULL history, unlike notify's "what the current state owes": a folded claim reads
+ * `review_required` → `review_answered` → `folded`, its row now holding only the folded decision.
+ */
+export declare function chainClaimEvents(db: Database, claimId: string): Promise<ClaimEvent[]>;
+//# sourceMappingURL=events.d.ts.map

package/dist/lib/api-lane/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,KAAK,UAAU,EAAkB,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAMhD,2FAA2F;AAC3F,wBAAsB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAezF;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CA4E3F"}

package/dist/lib/api-lane/events.js

@@ -0,0 +1,111 @@
+/**
+ * A claim's timeline as `GET …/events` shows it (Go Prod §4.2, contracts v1.2), for either lane.
+ *
+ * An API claim's is its `api_events` rows, written as things happened (notify.ts, webhooks.ts,
+ * review.ts, retention.ts). A chain claim has no such rows — the chain lane never wrote a timeline —
+ * so its events are DERIVED from the timestamps the ledger already keeps: `claim_ingests`,
+ * `decisions`, `claim_reviews`. Derived ids come from `eventIdFor` (ids.ts) over the claim and the
+ * event type, so the same step reads back with the same id on every call. Like the API lane's,
+ * `data` is names, codes and digests — never an answer.
+ */
+import { asc, eq } from "drizzle-orm";
+import { ClaimEventType } from "../../contracts/index.js";
+import { apiEvents, claimIngests, claimReviews, decisions } from "../../db/schema.js";
+import { eventIdFor } from "./ids.js";
+import { factCost } from "./notify.js";
+import { claimErrorCode, decisionFailure } from "./record.js";
+/** An API claim's stored timeline, oldest first (`evt_<ULID>`: id order is time order). */
+export async function apiClaimEvents(db, claimId) {
+    const rows = await db.query.apiEvents.findMany({
+        where: eq(apiEvents.claimId, claimId),
+        orderBy: asc(apiEvents.eventId),
+        columns: { eventId: true, type: true, data: true, createdAt: true },
+    });
+    // The timeline writers store the wire's type names already. A type the published enum does not
+    // know — a later writer's, read by an older build — is dropped rather than failing the whole
+    // timeline. `data` is theirs as written: names, codes, durations, never an answer.
+    return rows.flatMap((r) => {
+        const type = ClaimEventType.safeParse(r.type);
+        return type.success
+            ? [{ id: r.eventId, type: type.data, at: r.createdAt.toISOString(), data: r.data ?? null }]
+            : [];
+    });
+}
+/**
+ * A chain claim's timeline, derived (see header), oldest first — empty for an id the ledger does
+ * not hold. The FULL history, unlike notify's "what the current state owes": a folded claim reads
+ * `review_required` → `review_answered` → `folded`, its row now holding only the folded decision.
+ */
+export async function chainClaimEvents(db, claimId) {
+    const [ingest, decision, review] = await Promise.all([
+        db.query.claimIngests.findFirst({ where: eq(claimIngests.claimId, claimId) }),
+        db.query.decisions.findFirst({ where: eq(decisions.claimId, claimId) }),
+        db.query.claimReviews.findFirst({
+            where: eq(claimReviews.claimId, claimId),
+            columns: { answeredAt: true, foldedAt: true },
+        }),
+    ]);
+    if (!ingest)
+        return [];
+    const steps = [];
+    const step = (type, at, data = null) => steps.push({ type, at, data });
+    step("accepted", ingest.createdAt, { collectionId: ingest.collectionId });
+    const failed = decisionFailure(decision?.status);
+    if (decision && failed) {
+        step("failed", decision.createdAt, { code: failed });
+    }
+    else if (decision) {
+        // Stamped a millisecond before the decision it fed, as notify.ts does.
+        if (decision.facts) {
+            step("facts_produced", new Date(decision.createdAt.getTime() - 1), {
+                ext: Object.keys(decision.facts.ext),
+                ai: Object.keys(decision.facts.ai),
+                ...factCost(decision.facts),
+            });
+        }
+        const summary = {
+            status: decision.status,
+            verdict: decision.verdict,
+            resultDigest: decision.resultDigest,
+            receiptCid: decision.receiptCid,
+        };
+        if (review || decision.status === "pending_review") {
+            // The row's `createdAt` is the PRE-review decision; after a fold its body is the folded one,
+            // so the tasks asked are known only while they are still pending.
+            step("review_required", decision.createdAt, decision.status === "pending_review"
+                ? { pendingTasks: decision.decision?.pendingTasks ?? [] }
+                : null);
+            if (review)
+                step("review_answered", review.answeredAt);
+            if (review?.foldedAt) {
+                step(decision.status === "unusable" ? "unusable" : "folded", review.foldedAt, summary);
+            }
+        }
+        else {
+            step(decision.status === "unusable" ? "unusable" : "decided", decision.createdAt, summary);
+        }
+        // The chain's own step: the `MsgEvaluateClaim` landed — ours, or someone else's first. The
+        // row's last write is the delivery (the fold precedes it), so `updatedAt` is when.
+        if (decision.chainStatus === "submitted" || decision.chainStatus === "owner_submitted") {
+            step("chain_submitted", decision.updatedAt, {
+                chainStatus: decision.chainStatus,
+                txHash: decision.txHash,
+            });
+        }
+    }
+    if (ingest.status === "failed" && !failed) {
+        // The code, never the stored message (it can quote answer values — record.ts).
+        step("failed", ingest.updatedAt, {
+            code: claimErrorCode(ingest.error, decision?.status ?? null),
+        });
+    }
+    // Stable: equal instants keep the order above, which is the order they happened in.
+    steps.sort((a, b) => a.at.getTime() - b.at.getTime());
+    return Promise.all(steps.map(async (s) => ({
+        id: await eventIdFor(`${claimId}:chain:${s.type}`, s.at),
+        type: s.type,
+        at: s.at.toISOString(),
+        data: s.data,
+    })));
+}
+//# sourceMappingURL=events.js.map

package/dist/lib/api-lane/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../src/lib/api-lane/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAmB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3D,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAY,EAAE,OAAe;IAChE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC7C,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;QACrC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KACpE,CAAC,CAAC;IACH,+FAA+F;IAC/F,6FAA6F;IAC7F,mFAAmF;IACnF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,OAAO;YACjB,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YAC3F,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,OAAe;IAClE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7E,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACvE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;YAC9B,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;YACxC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC9C,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAA+E,EAAE,CAAC;IAC7F,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,EAAQ,EAAE,IAAI,GAAmC,IAAI,EAAE,EAAE,CAC3F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,uEAAuE;QACvE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC,gBAAgB,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE;gBACjE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;gBACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC;QACF,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACnD,6FAA6F;YAC7F,kEAAkE;YAClE,IAAI,CACF,iBAAiB,EACjB,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,MAAM,KAAK,gBAAgB;gBAClC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE;gBACzD,CAAC,CAAC,IAAI,CACT,CAAC;YACF,IAAI,MAAM;gBAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7F,CAAC;QACD,2FAA2F;QAC3F,mFAAmF;QACnF,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;YACvF,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,SAAS,EAAE;gBAC1C,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,+EAA+E;QAC/E,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE;YAC/B,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,EAAE,EAAE,MAAM,UAAU,CAAC,GAAG,OAAO,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC"}

package/dist/lib/api-lane/ids.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The API lane's ids (Go Prod §4.6, §6.1): the scope id every reused table carries in its
+ * `collectionId`, and the `<prefix>_<ULID>` ids of the lane's own rows.
+ *
+ * Event ids are DERIVED, not drawn: a workflow step that writes a timeline row or enqueues a webhook
+ * may run again (a retry, an operator rerun), and the id is what makes the second write a no-op —
+ * `api_events` PK and the `wh:<eventId>:<target>` delivery key both `onConflictDoNothing`. The ULID
+ * time part is the event's own instant (so the timeline still sorts by id) and the rest is a hash
+ * of what the event is about.
+ */
+/**
+ * A path with every lane id (`src_…`, `apc_…`, `upl_…`) masked as `:id` — what a log line or Sentry
+ * may carry of a concrete `/v1/api` path, where a pending source's id can sit (D10).
+ */
+export declare const maskIds: (path: string) => string;
+/** `api:<sourceId>:<protocolDid>` — an API claim's `collectionId` everywhere the chain lane's goes. */
+export declare function apiScopeId(sourceId: string, protocolDid: string): string;
+/** The scope id back into its parts; null for anything that is not one (a chain collection). */
+export declare function parseApiScopeId(scopeId: string): {
+    sourceId: string;
+    protocolDid: string;
+} | null;
+/**
+ * Where a row's bytes live in `API_UPLOADS`: `uploads/<sourceId>/<ULID>` for a file a claim may
+ * name, `exports/<sourceId>/<ULID>` for a data export. Both are `api_uploads` rows the files route
+ * serves alike; only the prefix tells them apart, and a claim may bind an `uploads/` key alone — an
+ * export (the source's whole personal data) must never become a claim's attachment.
+ */
+export declare const UPLOAD_KEY_PREFIX = "uploads/";
+export declare const EXPORT_KEY_PREFIX = "exports/";
+/** A fresh `<prefix>_<ULID>`. */
+export declare function newId(prefix: string, at?: Date): string;
+/**
+ * The `evt_<ULID>` of one event: `at` is when it happened (the decision's `createdAt`, the fold's
+ * `foldedAt`, …) and `key` names it (`<claimId>:decided:<resultDigest>`) — the same event always
+ * gets the same id, a different one never does.
+ */
+export declare function eventIdFor(key: string, at: Date): Promise<string>;
+//# sourceMappingURL=ids.d.ts.map

package/dist/lib/api-lane/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/ids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;;GAGG;AACH,eAAO,MAAM,OAAO,SAAU,MAAM,KAAG,MACwB,CAAC;AAEhE,uGAAuG;AACvG,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMjG;AAyBD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAC5C,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAE5C,iCAAiC;AACjC,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAMvE"}

package/dist/lib/api-lane/ids.js

@@ -0,0 +1,78 @@
+/**
+ * The API lane's ids (Go Prod §4.6, §6.1): the scope id every reused table carries in its
+ * `collectionId`, and the `<prefix>_<ULID>` ids of the lane's own rows.
+ *
+ * Event ids are DERIVED, not drawn: a workflow step that writes a timeline row or enqueues a webhook
+ * may run again (a retry, an operator rerun), and the id is what makes the second write a no-op —
+ * `api_events` PK and the `wh:<eventId>:<target>` delivery key both `onConflictDoNothing`. The ULID
+ * time part is the event's own instant (so the timeline still sorts by id) and the rest is a hash
+ * of what the event is about.
+ */
+import { sha256Hex } from "../hash.js";
+const SCOPE_PREFIX = "api:";
+/** Crockford base32, the ULID alphabet. */
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+/**
+ * A path with every lane id (`src_…`, `apc_…`, `upl_…`) masked as `:id` — what a log line or Sentry
+ * may carry of a concrete `/v1/api` path, where a pending source's id can sit (D10).
+ */
+export const maskIds = (path) => path.replace(/\/[a-z]{2,5}_[0-9A-Za-z]{8,}(?=\/|$)/g, "/:id");
+/** `api:<sourceId>:<protocolDid>` — an API claim's `collectionId` everywhere the chain lane's goes. */
+export function apiScopeId(sourceId, protocolDid) {
+    return `${SCOPE_PREFIX}${sourceId}:${protocolDid}`;
+}
+/** The scope id back into its parts; null for anything that is not one (a chain collection). */
+export function parseApiScopeId(scopeId) {
+    if (!scopeId.startsWith(SCOPE_PREFIX))
+        return null;
+    const rest = scopeId.slice(SCOPE_PREFIX.length);
+    const colon = rest.indexOf(":");
+    if (colon <= 0)
+        return null;
+    return { sourceId: rest.slice(0, colon), protocolDid: rest.slice(colon + 1) };
+}
+/** 48 bits of time + 80 bits of entropy (from `tail`), 26 Crockford chars. */
+function encodeUlid(ms, tail) {
+    let out = "";
+    let time = ms;
+    for (let i = 0; i < 10; i++) {
+        out = CROCKFORD[time % 32] + out;
+        time = Math.floor(time / 32);
+    }
+    // 80 bits = 16 chars of 5 bits, read big-endian off the first 10 bytes.
+    let bits = 0;
+    let value = 0;
+    for (let i = 0; i < 10; i++) {
+        value = (value << 8) | tail[i];
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            out += CROCKFORD[(value >> bits) & 31];
+        }
+        value &= (1 << bits) - 1;
+    }
+    return out;
+}
+/**
+ * Where a row's bytes live in `API_UPLOADS`: `uploads/<sourceId>/<ULID>` for a file a claim may
+ * name, `exports/<sourceId>/<ULID>` for a data export. Both are `api_uploads` rows the files route
+ * serves alike; only the prefix tells them apart, and a claim may bind an `uploads/` key alone — an
+ * export (the source's whole personal data) must never become a claim's attachment.
+ */
+export const UPLOAD_KEY_PREFIX = "uploads/";
+export const EXPORT_KEY_PREFIX = "exports/";
+/** A fresh `<prefix>_<ULID>`. */
+export function newId(prefix, at = new Date()) {
+    return `${prefix}_${encodeUlid(at.getTime(), crypto.getRandomValues(new Uint8Array(10)))}`;
+}
+/**
+ * The `evt_<ULID>` of one event: `at` is when it happened (the decision's `createdAt`, the fold's
+ * `foldedAt`, …) and `key` names it (`<claimId>:decided:<resultDigest>`) — the same event always
+ * gets the same id, a different one never does.
+ */
+export async function eventIdFor(key, at) {
+    const hex = await sha256Hex(key);
+    const tail = Uint8Array.from(hex.slice(0, 20).match(/../g), (h) => Number.parseInt(h, 16));
+    return `evt_${encodeUlid(at.getTime(), tail)}`;
+}
+//# sourceMappingURL=ids.js.map

package/dist/lib/api-lane/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../../src/lib/api-lane/ids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,2CAA2C;AAC3C,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAC9C,IAAI,CAAC,OAAO,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC;AAEhE,uGAAuG;AACvG,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,WAAmB;IAC9D,OAAO,GAAG,YAAY,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC;AACrD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,EAAU,EAAE,IAAgB;IAC9C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,GAAG,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QACjC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,wEAAwE;IACxE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAI,IAAI,CAAC,CAAC,CAAY,CAAC;QAC3C,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,GAAG,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,iCAAiC;AACjC,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE;IACzD,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,EAAQ;IACpD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAC5E,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CACvB,CAAC;IACF,OAAO,OAAO,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/lib/api-lane/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The Decision API lane's core (Go Prod §4.6, §6, §7): what the router (S3), the payment gate and
+ * its reconcile job (S4) call into. The HTTP surface lives in `routes/v1/api/`; this is the durable
+ * side — accept, the claim source, the record, the timeline, pauses.
+ */
+export { claimContent, recordApiClaims, startApiClaims } from "./accept.js";
+export { apiScopeId, eventIdFor, newId, parseApiScopeId } from "./ids.js";
+export { pauseSource, resumeCreditPausedSources } from "./pause.js";
+export { CLAIM_ERROR_MESSAGES, claimErrorCode, claimRecord, claimRecordsFor } from "./record.js";
+export { eraseClaimBody, sweepHousekeeping } from "./retention.js";
+export { type AnswerReviewResult, answerApiReview } from "./review.js";
+export { apiSource, bodyDigest } from "./source.js";
+export { recordEvents, type TimelineEvent } from "./timeline.js";
+export { decryptWebhookSecret, encryptWebhookSecret, newWebhookSecret, signatureHeader, verifySignature, } from "./webhook-crypto.js";
+export { deliverDueWebhooks, emitBalanceLow, emitPaymentSettled, redeliverWebhook, sendTestEvent, type WebhookDeps, } from "./webhooks.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/api-lane/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,KAAK,kBAAkB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}