@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/lib/api-lane/index.js

@@ -0,0 +1,16 @@
+/**
+ * The Decision API lane's core (Go Prod §4.6, §6, §7): what the router (S3), the payment gate and
+ * its reconcile job (S4) call into. The HTTP surface lives in `routes/v1/api/`; this is the durable
+ * side — accept, the claim source, the record, the timeline, pauses.
+ */
+export { claimContent, recordApiClaims, startApiClaims } from "./accept.js";
+export { apiScopeId, eventIdFor, newId, parseApiScopeId } from "./ids.js";
+export { pauseSource, resumeCreditPausedSources } from "./pause.js";
+export { CLAIM_ERROR_MESSAGES, claimErrorCode, claimRecord, claimRecordsFor } from "./record.js";
+export { eraseClaimBody, sweepHousekeeping } from "./retention.js";
+export { answerApiReview } from "./review.js";
+export { apiSource, bodyDigest } from "./source.js";
+export { recordEvents } from "./timeline.js";
+export { decryptWebhookSecret, encryptWebhookSecret, newWebhookSecret, signatureHeader, verifySignature, } from "./webhook-crypto.js";
+export { deliverDueWebhooks, emitBalanceLow, emitPaymentSettled, redeliverWebhook, sendTestEvent, } from "./webhooks.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/api-lane/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/api-lane/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAA2B,eAAe,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,YAAY,EAAsB,MAAM,YAAY,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,GAEd,MAAM,YAAY,CAAC"}

package/dist/lib/api-lane/linked.d.ts

@@ -0,0 +1,264 @@
+/**
+ * Collections an organisation links to its source (Go Prod S3 M6): a console member who is, ON
+ * CHAIN, the collection entity's owner links it, and the source's claim reads then include that
+ * collection's chain claims. Billing for them stays the collection owner's on-chain evaluation
+ * payment — nothing is charged here.
+ *
+ * Owner only (company authority D9, F15): linking exposes the collection's claims to everyone the
+ * source lets read, which is the owner's call — an evaluator (a reviewer, another oracle) holds a
+ * grant to judge the claims, not to publish them. The standing check is `getCollection` →
+ * `getEntityOwner`, read uncached: a transfer a minute ago must not meet a pinned answer.
+ *
+ * A link rides on its linker's standing twice over — on the source (a member who may still link:
+ * `settings/manage`, i.e. the owner preset or the source's root) and on chain (the owner).
+ * The hourly re-check (`recheckCollectionLinks`, `cron/api-lane.ts`) holds every link to both; a
+ * revoke or removal of the member drops their links at once (`dropLinksOf`, routes/v1/api/members.ts).
+ *
+ * A link goes ONLY on a positive change (owner, 2026-10-14): the linker is confirmed no longer a
+ * member who may link or no longer the owner, the engine names another company or `disputed`, or
+ * the collection is not found twice in a row. Silence never hides one — a Blocksync or engine
+ * error, a timeout, a pass that did not run: the link stays and the reads keep showing it.
+ * `verifiedAt` records the last confirmation (for operators); no read filters on its age. Before
+ * this a link not verified within two hours vanished from the reads, and a pass that never ran
+ * (spongy-oracle devnet, 2026-10-14) hid every claim of an organisation's linked collections.
+ *
+ * COMPANY links (`linkCompanySources`): register links a collection to every active source of the
+ * collection's COMPANY as the engine derives it (contract "Company authority" → "Read it") — a
+ * poster's deed collection belongs to the org it is linked to both ways, and that org's reviewers
+ * should see its claims without a member re-linking each one by hand. No member made such a link,
+ * so `linkedBy` is the company's entity DID: the one standing the link rides on, and what the
+ * re-check verifies instead of a member's — the engine still names that company for the collection.
+ * A member's grant cannot hold it (no member linked it), nor can the chain owner (on a deed that is
+ * the poster, never a member of the org's source). `dropLinksOf` never matches one (it drops a
+ * member DID's links).
+ */
+import type { Config } from "../../config.js";
+import type { Database } from "../../db/client.js";
+import type { CollectionCompany } from "../engine/types.js";
+import type { Logger } from "../logger.js";
+import type { TraceContext } from "../tracing.js";
+export interface ChainReadDeps {
+    config: Config;
+    trace: TraceContext;
+}
+/** One link: its PK. */
+export declare const linkWhere: (sourceId: string, collectionId: string) => import("drizzle-orm").SQL<unknown> | undefined;
+/**
+ * The most links one hourly pass re-checks. A pass runs until every link was checked this hour, so
+ * under the cap every link is re-verified hourly; over it the least recently checked go first and
+ * the rest wait for the next pass (still shown — only a drop hides a link). Chain reads are shared
+ * per (collection, linker), so the subrequests are at most 3 × the distinct pairs.
+ */
+export declare const RECHECK_CAP = 500;
+/** The re-check's audit actor, under `actorKind: "system"`. */
+export declare const RECHECK_ACTOR = "system:link-recheck";
+/** The audit actor of a link register made from the engine's company answer. */
+export declare const COMPANY_LINK_ACTOR = "system:company-link";
+export type UnlinkReason = "linker_not_member" | "not_owner" | "not_company" | "collection_not_found";
+/** A company link (`linkCompanySources`): `linkedBy` is an entity DID, never a member's account. */
+export declare const isCompanyLink: (linkedBy: string) => boolean;
+/** The engine's company for a collection: null when it knows none (404); trouble throws. */
+export type CompanyOf = (collectionId: string) => Promise<CollectionCompany | null>;
+/**
+ * Whether an `active` source exists that is not yet linked to the collection — the only case the
+ * engine's company answer could add a link. One D1 read, so a register or a backfill pass that
+ * could link nothing (the lane off, no sources, every one linked) never asks the engine.
+ */
+export declare function hasUnlinkedActiveSource(db: Database, collectionId: string): Promise<boolean>;
+/**
+ * Link the collection to every `active` source of `company` (the engine's `ok` answer — anything
+ * else links nothing), `linkedBy` the company's entity DID (header). Idempotent: an existing link is
+ * left as it is (`onConflictDoNothing`), so a re-register or a re-run of the backfill adds only
+ * what is missing. Each new link gets a `source.collection_linked` audit row (actor
+ * `COMPANY_LINK_ACTOR`). Returns the sources newly linked.
+ */
+export declare function linkCompanySources(db: Database, collectionId: string, protocolDid: string, company: CollectionCompany): Promise<string[]>;
+/**
+ * Whether `did` owns the collection, read off the chain now: null when the collection does not
+ * exist (or names no protocol). Chain trouble throws (`AppError.unavailable`) — never a silent
+ * "not the owner".
+ */
+export declare function collectionStanding(deps: ChainReadDeps, collectionId: string, did: string): Promise<{
+    protocolDid: string;
+    owner: boolean;
+} | null>;
+/**
+ * The delete of every link `did` made on the source, returning what went — for the member routes
+ * to put in the SAME batch as the revoke / removal, so no read after it still shows those claims.
+ */
+export declare const dropLinksOf: (db: Database, sourceId: string, did: string) => Omit<import("drizzle-orm/sqlite-core").SQLiteDeleteBase<import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "api_source_collections";
+    schema: undefined;
+    columns: {
+        sourceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "sourceId";
+            tableName: "api_source_collections";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: undefined;
+        }>;
+        collectionId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "collectionId";
+            tableName: "api_source_collections";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: undefined;
+        }>;
+        protocolDid: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "protocolDid";
+            tableName: "api_source_collections";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: undefined;
+        }>;
+        linkedBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "linkedBy";
+            tableName: "api_source_collections";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: undefined;
+        }>;
+        linkedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "linkedAt";
+            tableName: "api_source_collections";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        checkedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "checkedAt";
+            tableName: "api_source_collections";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        verifiedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "verifiedAt";
+            tableName: "api_source_collections";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        missCount: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "missCount";
+            tableName: "api_source_collections";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'sqlite';
+}>, "async", D1Result<unknown>, {
+    collectionId: string;
+}, false, "returning" | "where">, "returning" | "where">;
+/**
+ * One hourly pass: re-verify every link not yet checked at `now`, least recently checked first, up
+ * to `RECHECK_CAP`. Per link:
+ *   - its linker no longer a member who may link ⇒ dropped (`linker_not_member`), no chain read;
+ *   - a chain read fails (the source's roots, the collection, its owner) ⇒ kept, `checkedAt`
+ *     advanced (one collection that always fails cannot starve the rotation) but NOT `verifiedAt`;
+ *   - no such collection ⇒ dropped on the SECOND such pass in a row (`collection_not_found`), kept
+ *     unverified on the first;
+ *   - the linker no longer owns the collection ⇒ dropped (`not_owner`);
+ *   - else verified: `verifiedAt`, `missCount` reset.
+ * A company link (`isCompanyLink`) is held to the engine's company answer instead (`companyOf`,
+ * one read per collection): still `ok` for that entity ⇒ verified; a 404 ⇒ the `missCount` path
+ * above; `disputed` or another company ⇒ dropped (`not_company`); engine trouble ⇒ kept unverified.
+ * Nothing but a drop changes what the reads show (header).
+ * A drop is the delete plus a `source.collection_unlinked` audit row, in the round's one batch.
+ * Returns how many links were dropped.
+ */
+export declare function recheckCollectionLinks(deps: ChainReadDeps & {
+    db: Database;
+    logger: Logger;
+    companyOf: CompanyOf;
+}, now?: Date): Promise<number>;
+//# sourceMappingURL=linked.d.ts.map

package/dist/lib/api-lane/linked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linked.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/linked.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAOhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,wBAAwB;AACxB,eAAO,MAAM,SAAS,aAAc,MAAM,gBAAgB,MAAM,mDAI7D,CAAC;AAIJ;;;;;GAKG;AACH,eAAO,MAAM,WAAW,MAAM,CAAC;AAC/B,+DAA+D;AAC/D,eAAO,MAAM,aAAa,wBAAwB,CAAC;AAEnD,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,MAAM,MAAM,YAAY,GACpB,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,sBAAsB,CAAC;AAE3B,oGAAoG;AACpG,eAAO,MAAM,aAAa,aAAc,MAAM,YAA2C,CAAC;AAE1F,4FAA4F;AAC5F,MAAM,MAAM,SAAS,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;AAEpF;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAuB/E;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,QAAQ,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCnB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,aAAa,EACnB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAOzD;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,OAAQ,QAAQ,YAAY,MAAM,OAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAIJ,CAAC;AAYpE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,aAAa,GAAG;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,EAC5E,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA6GjB"}

package/dist/lib/api-lane/linked.js

@@ -0,0 +1,272 @@
+/**
+ * Collections an organisation links to its source (Go Prod S3 M6): a console member who is, ON
+ * CHAIN, the collection entity's owner links it, and the source's claim reads then include that
+ * collection's chain claims. Billing for them stays the collection owner's on-chain evaluation
+ * payment — nothing is charged here.
+ *
+ * Owner only (company authority D9, F15): linking exposes the collection's claims to everyone the
+ * source lets read, which is the owner's call — an evaluator (a reviewer, another oracle) holds a
+ * grant to judge the claims, not to publish them. The standing check is `getCollection` →
+ * `getEntityOwner`, read uncached: a transfer a minute ago must not meet a pinned answer.
+ *
+ * A link rides on its linker's standing twice over — on the source (a member who may still link:
+ * `settings/manage`, i.e. the owner preset or the source's root) and on chain (the owner).
+ * The hourly re-check (`recheckCollectionLinks`, `cron/api-lane.ts`) holds every link to both; a
+ * revoke or removal of the member drops their links at once (`dropLinksOf`, routes/v1/api/members.ts).
+ *
+ * A link goes ONLY on a positive change (owner, 2026-10-14): the linker is confirmed no longer a
+ * member who may link or no longer the owner, the engine names another company or `disputed`, or
+ * the collection is not found twice in a row. Silence never hides one — a Blocksync or engine
+ * error, a timeout, a pass that did not run: the link stays and the reads keep showing it.
+ * `verifiedAt` records the last confirmation (for operators); no read filters on its age. Before
+ * this a link not verified within two hours vanished from the reads, and a pass that never ran
+ * (spongy-oracle devnet, 2026-10-14) hid every claim of an organisation's linked collections.
+ *
+ * COMPANY links (`linkCompanySources`): register links a collection to every active source of the
+ * collection's COMPANY as the engine derives it (contract "Company authority" → "Read it") — a
+ * poster's deed collection belongs to the org it is linked to both ways, and that org's reviewers
+ * should see its claims without a member re-linking each one by hand. No member made such a link,
+ * so `linkedBy` is the company's entity DID: the one standing the link rides on, and what the
+ * re-check verifies instead of a member's — the engine still names that company for the collection.
+ * A member's grant cannot hold it (no member linked it), nor can the chain owner (on a deed that is
+ * the poster, never a member of the org's source). `dropLinksOf` never matches one (it drops a
+ * member DID's links).
+ */
+import { and, asc, eq, isNotNull, lt, notExists } from "drizzle-orm";
+import { covers } from "../../contracts/capabilities.js";
+import { apiAudit, apiSourceCollections, apiSources, } from "../../db/schema.js";
+import { getCollection, getEntityOwner } from "../ixo/blocksync/index.js";
+import { newId } from "./ids.js";
+import { liveGrant } from "./members.js";
+/** One link: its PK. */
+export const linkWhere = (sourceId, collectionId) => and(eq(apiSourceCollections.sourceId, sourceId), eq(apiSourceCollections.collectionId, collectionId));
+/** Links read and written per round of a pass (one select, one `db.batch`). */
+const RECHECK_CHUNK = 50;
+/**
+ * The most links one hourly pass re-checks. A pass runs until every link was checked this hour, so
+ * under the cap every link is re-verified hourly; over it the least recently checked go first and
+ * the rest wait for the next pass (still shown — only a drop hides a link). Chain reads are shared
+ * per (collection, linker), so the subrequests are at most 3 × the distinct pairs.
+ */
+export const RECHECK_CAP = 500;
+/** The re-check's audit actor, under `actorKind: "system"`. */
+export const RECHECK_ACTOR = "system:link-recheck";
+/** The audit actor of a link register made from the engine's company answer. */
+export const COMPANY_LINK_ACTOR = "system:company-link";
+/** A company link (`linkCompanySources`): `linkedBy` is an entity DID, never a member's account. */
+export const isCompanyLink = (linkedBy) => linkedBy.startsWith("did:ixo:entity:");
+/**
+ * Whether an `active` source exists that is not yet linked to the collection — the only case the
+ * engine's company answer could add a link. One D1 read, so a register or a backfill pass that
+ * could link nothing (the lane off, no sources, every one linked) never asks the engine.
+ */
+export async function hasUnlinkedActiveSource(db, collectionId) {
+    const [row] = await db
+        .select({ sourceId: apiSources.sourceId })
+        .from(apiSources)
+        .where(and(eq(apiSources.status, "active"), isNotNull(apiSources.companyEntityDid), notExists(db
+        .select({ one: apiSourceCollections.sourceId })
+        .from(apiSourceCollections)
+        .where(and(eq(apiSourceCollections.sourceId, apiSources.sourceId), eq(apiSourceCollections.collectionId, collectionId))))))
+        .limit(1);
+    return row !== undefined;
+}
+/**
+ * Link the collection to every `active` source of `company` (the engine's `ok` answer — anything
+ * else links nothing), `linkedBy` the company's entity DID (header). Idempotent: an existing link is
+ * left as it is (`onConflictDoNothing`), so a re-register or a re-run of the backfill adds only
+ * what is missing. Each new link gets a `source.collection_linked` audit row (actor
+ * `COMPANY_LINK_ACTOR`). Returns the sources newly linked.
+ */
+export async function linkCompanySources(db, collectionId, protocolDid, company) {
+    if (company.state !== "ok")
+        return [];
+    const sources = await db
+        .select({ sourceId: apiSources.sourceId })
+        .from(apiSources)
+        .where(and(eq(apiSources.companyEntityDid, company.entityDid), eq(apiSources.status, "active")));
+    if (sources.length === 0)
+        return [];
+    const linked = await db
+        .insert(apiSourceCollections)
+        .values(sources.map(({ sourceId }) => ({
+        sourceId,
+        collectionId,
+        protocolDid,
+        linkedBy: company.entityDid,
+    })))
+        .onConflictDoNothing()
+        .returning({ sourceId: apiSourceCollections.sourceId });
+    if (linked.length > 0) {
+        await db.insert(apiAudit).values(linked.map(({ sourceId }) => ({
+            auditId: newId("aud"),
+            sourceId,
+            actor: COMPANY_LINK_ACTOR,
+            actorKind: "system",
+            action: "source.collection_linked",
+            target: collectionId,
+            details: { protocolDid, company: company.entityDid },
+        })));
+    }
+    return linked.map((l) => l.sourceId);
+}
+/**
+ * Whether `did` owns the collection, read off the chain now: null when the collection does not
+ * exist (or names no protocol). Chain trouble throws (`AppError.unavailable`) — never a silent
+ * "not the owner".
+ */
+export async function collectionStanding(deps, collectionId, did) {
+    const collection = await getCollection(deps, collectionId);
+    if (!collection?.protocol)
+        return null;
+    // `did:ixo:<address>` — a console member is always an account DID (`AccountDid`).
+    const address = did.split(":").at(2) ?? "";
+    const owner = collection.entity ? await getEntityOwner(deps, collection.entity) : null;
+    return { protocolDid: collection.protocol, owner: owner !== null && owner === address };
+}
+/**
+ * The delete of every link `did` made on the source, returning what went — for the member routes
+ * to put in the SAME batch as the revoke / removal, so no read after it still shows those claims.
+ */
+export const dropLinksOf = (db, sourceId, did) => db
+    .delete(apiSourceCollections)
+    .where(and(eq(apiSourceCollections.sourceId, sourceId), eq(apiSourceCollections.linkedBy, did)))
+    .returning({ collectionId: apiSourceCollections.collectionId });
+/** A per-pass memo: each key is read once however many links share it. */
+function memo(cache, key, read) {
+    let hit = cache.get(key);
+    if (!hit) {
+        hit = read();
+        cache.set(key, hit);
+    }
+    return hit;
+}
+/**
+ * One hourly pass: re-verify every link not yet checked at `now`, least recently checked first, up
+ * to `RECHECK_CAP`. Per link:
+ *   - its linker no longer a member who may link ⇒ dropped (`linker_not_member`), no chain read;
+ *   - a chain read fails (the source's roots, the collection, its owner) ⇒ kept, `checkedAt`
+ *     advanced (one collection that always fails cannot starve the rotation) but NOT `verifiedAt`;
+ *   - no such collection ⇒ dropped on the SECOND such pass in a row (`collection_not_found`), kept
+ *     unverified on the first;
+ *   - the linker no longer owns the collection ⇒ dropped (`not_owner`);
+ *   - else verified: `verifiedAt`, `missCount` reset.
+ * A company link (`isCompanyLink`) is held to the engine's company answer instead (`companyOf`,
+ * one read per collection): still `ok` for that entity ⇒ verified; a 404 ⇒ the `missCount` path
+ * above; `disputed` or another company ⇒ dropped (`not_company`); engine trouble ⇒ kept unverified.
+ * Nothing but a drop changes what the reads show (header).
+ * A drop is the delete plus a `source.collection_unlinked` audit row, in the round's one batch.
+ * Returns how many links were dropped.
+ */
+export async function recheckCollectionLinks(deps, now = new Date()) {
+    const { db, logger } = deps;
+    const companies = new Map();
+    const companyOf = (collectionId) => memo(companies, collectionId, () => deps.companyOf(collectionId));
+    const standings = new Map();
+    // `undefined`: the roots read failed (Blocksync) — not a "no", so the link is kept unverified.
+    const linkers = new Map();
+    const mayLink = (sourceId, did) => memo(linkers, `${sourceId} ${did}`, async () => {
+        const grant = await liveGrant({ db, chain: deps }, sourceId, did, now).catch((err) => {
+            logger.warn("cron.collection-links.roots-unreadable", { sourceId, detail: String(err) });
+            return undefined;
+        });
+        return grant === undefined
+            ? undefined
+            : grant !== null && covers(grant.capabilities, "settings/manage");
+    });
+    const standingOf = (collectionId, did) => memo(standings, `${collectionId} ${did}`, () => collectionStanding(deps, collectionId, did));
+    let seen = 0;
+    let dropped = 0;
+    while (seen < RECHECK_CAP) {
+        const links = await db
+            .select()
+            .from(apiSourceCollections)
+            .where(lt(apiSourceCollections.checkedAt, now))
+            .orderBy(asc(apiSourceCollections.checkedAt))
+            .limit(Math.min(RECHECK_CHUNK, RECHECK_CAP - seen));
+        if (links.length === 0)
+            break;
+        seen += links.length;
+        const writes = [];
+        const drop = (link, reason) => {
+            writes.push(db.delete(apiSourceCollections).where(linkWhere(link.sourceId, link.collectionId)), db.insert(apiAudit).values({
+                auditId: newId("aud"),
+                sourceId: link.sourceId,
+                actor: RECHECK_ACTOR,
+                actorKind: "system",
+                action: "source.collection_unlinked",
+                target: link.collectionId,
+                details: { reason, linkedBy: link.linkedBy },
+            }));
+            logger.info("cron.collection-links.dropped", {
+                sourceId: link.sourceId,
+                collectionId: link.collectionId,
+                reason,
+            });
+            dropped++;
+        };
+        const keep = (link, set) => writes.push(db
+            .update(apiSourceCollections)
+            .set({ checkedAt: now, ...set })
+            .where(linkWhere(link.sourceId, link.collectionId)));
+        for (const link of links) {
+            if (isCompanyLink(link.linkedBy)) {
+                const company = await companyOf(link.collectionId).catch((err) => {
+                    logger.warn("cron.collection-links.company-unreadable", {
+                        sourceId: link.sourceId,
+                        collectionId: link.collectionId,
+                        detail: String(err),
+                    });
+                    return undefined;
+                });
+                if (company === undefined)
+                    keep(link, {});
+                else if (company === null) {
+                    if (link.missCount >= 1)
+                        drop(link, "collection_not_found");
+                    else
+                        keep(link, { missCount: link.missCount + 1 });
+                }
+                else if (company.state !== "ok" || company.entityDid !== link.linkedBy) {
+                    drop(link, "not_company");
+                }
+                else
+                    keep(link, { verifiedAt: now, missCount: 0 });
+                continue;
+            }
+            const member = await mayLink(link.sourceId, link.linkedBy);
+            if (member === undefined) {
+                keep(link, {});
+                continue;
+            }
+            if (!member) {
+                drop(link, "linker_not_member");
+                continue;
+            }
+            const standing = await standingOf(link.collectionId, link.linkedBy).catch((err) => {
+                logger.warn("cron.collection-links.unreadable", {
+                    sourceId: link.sourceId,
+                    collectionId: link.collectionId,
+                    detail: String(err),
+                });
+                return undefined;
+            });
+            if (standing === undefined)
+                keep(link, {});
+            else if (standing === null) {
+                if (link.missCount >= 1)
+                    drop(link, "collection_not_found");
+                else
+                    keep(link, { missCount: link.missCount + 1 });
+            }
+            else if (!standing.owner)
+                drop(link, "not_owner");
+            else
+                keep(link, { verifiedAt: now, missCount: 0 });
+        }
+        // Never empty: every link read pushed at least one write.
+        await db.batch(writes);
+    }
+    return dropped;
+}
+//# sourceMappingURL=linked.js.map

package/dist/lib/api-lane/linked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linked.js","sourceRoot":"","sources":["../../../src/lib/api-lane/linked.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEtD,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,UAAU,GACX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAOtC,wBAAwB;AACxB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,YAAoB,EAAE,EAAE,CAClE,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC3C,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,YAAY,CAAC,CACpD,CAAC;AAEJ,+EAA+E;AAC/E,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAC/B,+DAA+D;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAEnD,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAQxD,oGAAoG;AACpG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAK1F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,YAAoB;IAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;SACzC,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC/B,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,EACtC,SAAS,CACP,EAAE;SACC,MAAM,CAAC,EAAE,GAAG,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC;SAC9C,IAAI,CAAC,oBAAoB,CAAC;SAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,EACtD,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,YAAY,CAAC,CACpD,CACF,CACJ,CACF,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAY,EACZ,YAAoB,EACpB,WAAmB,EACnB,OAA0B;IAE1B,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;SACzC,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CACzF,CAAC;IACJ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,oBAAoB,CAAC;SAC5B,MAAM,CACL,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7B,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,QAAQ,EAAE,OAAO,CAAC,SAAS;KAC5B,CAAC,CAAC,CACJ;SACA,mBAAmB,EAAE;SACrB,SAAS,CAAC,EAAE,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;YACrB,QAAQ;YACR,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,QAAiB;YAC5B,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;SACrD,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmB,EACnB,YAAoB,EACpB,GAAW;IAEX,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,kFAAkF;IAClF,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAY,EAAE,QAAgB,EAAE,GAAW,EAAE,EAAE,CACzE,EAAE;KACC,MAAM,CAAC,oBAAoB,CAAC;KAC5B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;KAC/F,SAAS,CAAC,EAAE,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;AAEpE,0EAA0E;AAC1E,SAAS,IAAI,CAAI,KAA8B,EAAE,GAAW,EAAE,IAAsB;IAClF,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAI,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4E,EAC5E,GAAG,GAAS,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6C,CAAC;IACvE,MAAM,SAAS,GAAG,CAAC,YAAoB,EAAE,EAAE,CACzC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;IAC3E,+FAA+F;IAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwC,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAE,EAAE,CAChD,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,IAAI,GAAG,EAAE,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnF,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzF,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,CAAC,YAAoB,EAAE,GAAW,EAAE,EAAE,CACvD,IAAI,CAAC,SAAS,EAAE,GAAG,YAAY,IAAI,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;IAE/F,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,IAAI,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;aAC9C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;aAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAC9B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QAErB,MAAM,MAAM,GAA0B,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,IAAyB,EAAE,MAAoB,EAAE,EAAE;YAC/D,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAClF,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;gBACzB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aAC7C,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,MAAM;aACP,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,IAAyB,EAAE,GAAiC,EAAE,EAAE,CAC5E,MAAM,CAAC,IAAI,CACT,EAAE;aACC,MAAM,CAAC,oBAAoB,CAAC;aAC5B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;aAC/B,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CACtD,CAAC;QAEJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC/D,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;wBACtD,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;qBACpB,CAAC,CAAC;oBACH,OAAO,SAAS,CAAC;gBACnB,CAAC,CAAC,CAAC;gBACH,IAAI,OAAO,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;qBACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC1B,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC;wBAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;;wBACvD,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrD,CAAC;qBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACzE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAC5B,CAAC;;oBAAM,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;gBACrD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChF,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;iBACpB,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,IAAI,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBACtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;;oBACvD,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,KAAK;gBAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;;gBAC/C,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,0DAA0D;QAC1D,MAAM,EAAE,CAAC,KAAK,CAAC,MAAyD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/api-lane/media-type.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A URL attachment's `mediaType`, when the caller left it out — an AI app over MCP, or a REST
+ * caller, sends a photo as `{ question, url }` and nothing else, and the evaluate step's
+ * octet-stream default then fails a rubric's `mediaTypeIn ["image/*"]` on a real JPEG.
+ *
+ * Detected ONCE, at accept, and stored on the claim's attachment: the evaluate step, its retries
+ * and the review fold all read the same frozen value (the FactSet must be deterministic — a HEAD at
+ * evaluate time could answer differently on a retry). The caller's own `mediaType` always wins.
+ * Order: the URL path's extension, else one guarded `HEAD`, else nothing (the octet-stream default
+ * stands). Detection never fails the submit: the price is already reserved when this runs.
+ */
+import type { Attachment } from "../../contracts/index.js";
+/** Each claim's attachments with a detected `mediaType` filled in where the caller sent none. */
+export declare function withMediaTypes(claims: readonly (readonly Attachment[])[]): Promise<Attachment[][]>;
+//# sourceMappingURL=media-type.d.ts.map

package/dist/lib/api-lane/media-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-type.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/media-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA+ClD,iGAAiG;AACjG,wBAAsB,cAAc,CAClC,MAAM,EAAE,SAAS,CAAC,SAAS,UAAU,EAAE,CAAC,EAAE,GACzC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAyBzB"}