@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/cli/commands/protocol-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-review.js","sourceRoot":"","sources":["../../../src/cli/commands/protocol-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAiC,MAAM,kBAAkB,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC1C,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC/B;KACF,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;QACvC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IAEH,IAAI,QAAmD,CAAC;IACxD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,gBAAgB,SAAS,GAAG,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,CACX,+EAA+E,CAChF,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,2FAA2F;IAC3F,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,kHAAkH,CACnH,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,uCAAuC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC7F,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CACT,cAAc,MAAM,EAAE,QAAQ,cAAc,MAAM,EAAE,QAAQ,cAAc,MAAM,EAAE,MAAM,cAAc,MAAM,EAAE,OAAO,EAAE,CACxH,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,MAAM;gBAAE,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3C,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;YACvF,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CACT,wJAAwJ,CACzJ,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,iCAAiC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,SAAS,KAAK,OAAO;YACzB,CAAC,CAAC,sEAAsE,QAAQ,CAAC,SAAS,CAAC,GAAG,QAAQ,QAAQ,CAAC,SAAS,CAAC,GAAG,uBAAuB;YACnJ,CAAC,CAAC,sIAAsI,CAC3I,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CACT,6BAA6B,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAS,QAAQ,CAAC,IAAc;IAC9B,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,8BAA8B,IAAI,CAAC,GAAG,GAAG,CAAC;IAC5F,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,OAAO,CAAC,KAAgB,EAAE,GAAW;IAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,MAAM,OAAO,GAAG;QACd,YAAY,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D;QACnG,qGAAqG;KACtG,CAAC;IACF,OAAO,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,eAAe,CAAC,KAAgB,EAAE,GAAW;IACpD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,qHAAqH,CAAC;IAC/H,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,iGAAiG;YACjG,8FAA8F;YAC9F,yCAAyC,GAAG,QAAQ;SACrD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO;QACL,0BAA0B,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,4DAA4D;QACrH,yCAAyC,GAAG,EAAE;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/cli/commands/publish-protocol.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `decision-oracle publish-protocol` — publish a protocol entity + its claim form + its rubric to chain,
+ * end to end: `MsgCreateEntity` → IXO Vault upload (else the IPFS gateway) → `MsgAddLinkedResource` (`#vct`/`#rub`) +
+ * `MsgAddService` → rooms-bot source-and-join, resumable. Signs REAL transactions — see lib/chain.ts
+ * for the `--yes` confirm gate every write goes through.
+ *
+ *   decision-oracle publish-protocol --rubric rubric.json --form form.json \
+ *     [--network devnet] [--phase entity|resources|rub|room|all] [--entity did:ixo:entity:…] \
+ *     [--engine-url <url>] [--yes]
+ *
+ * …or, to ADOPT a protocol that already carries its form (`#rub` alone, nothing else touched):
+ *
+ *   decision-oracle publish-protocol --phase rub --protocol did:ixo:entity:… \
+ *     --rubric rubric.json --form form.json [--network devnet] [--yes]
+ *
+ * Requires an AuthHub session (`decision-oracle login --network <n>` first) — it is the ONLY identity
+ * here: chain signing, the Vault and rooms-bot UCANs, AND the Matrix access token the `room` phase
+ * uses (lib/chain.ts `matrixLoginFromSession`: the session's `matrixMnemonic` → the portal's password
+ * derivation → `m.login.password`). No env file: the token has to belong to the entity OWNER's
+ * Matrix user — the rooms-bot invites the UCAN issuer and the claim-bot invite sets power levels —
+ * so an oracle's bot token could never do this job.
+ *
+ * Phases (default `all`, run in this order): `entity` (create the protocol entity — skipped, using
+ * `--entity`, when one already exists), `resources` (store form + rubric on the Vault, patch the
+ * rubric's `claimSchema` to the real protocol/proof, anchor `#vct` + `#rub` + the Matrix service),
+ * `room` (source the entity's Matrix room and invite the claim bot — required or the claim bot
+ * returns IXO_ROOM_NOT_FOUND). Resuming a half-finished run: pass `--entity <did>` and `--phase
+ * resources` (or `room`, or `all`).
+ *
+ * `rub` is the ODD ONE OUT and never runs under `all`: it anchors (or replaces) `#rub` ALONE on a
+ * protocol that already has its `#vct` and its room — somebody else's published protocol this oracle
+ * is adopting. `resources` cannot do that job: it re-anchors `#vct` too, which the chain refuses for
+ * an id that already exists. See `anchorRubric` for the rest.
+ *
+ * Validation runs BEFORE any chain write, every invocation, regardless of `--phase`: the rubric must
+ * parse and bind against the form with the ENGINE's own schema + binder, asked over HTTP (`rubric
+ * validate`, same function, in-process) because this package carries no rubric code. A rubric whose
+ * rules don't resolve against its own claim form is refused here, not anchored on chain and
+ * discovered broken later. No `--proof`: pre-anchoring the placeholder proof is expected —
+ * `resources` patches the real one in.
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=publish-protocol.d.ts.map

package/dist/cli/commands/publish-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-protocol.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/publish-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA+TH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqGzD"}

package/dist/cli/commands/publish-protocol.js

@@ -0,0 +1,345 @@
+/**
+ * `decision-oracle publish-protocol` — publish a protocol entity + its claim form + its rubric to chain,
+ * end to end: `MsgCreateEntity` → IXO Vault upload (else the IPFS gateway) → `MsgAddLinkedResource` (`#vct`/`#rub`) +
+ * `MsgAddService` → rooms-bot source-and-join, resumable. Signs REAL transactions — see lib/chain.ts
+ * for the `--yes` confirm gate every write goes through.
+ *
+ *   decision-oracle publish-protocol --rubric rubric.json --form form.json \
+ *     [--network devnet] [--phase entity|resources|rub|room|all] [--entity did:ixo:entity:…] \
+ *     [--engine-url <url>] [--yes]
+ *
+ * …or, to ADOPT a protocol that already carries its form (`#rub` alone, nothing else touched):
+ *
+ *   decision-oracle publish-protocol --phase rub --protocol did:ixo:entity:… \
+ *     --rubric rubric.json --form form.json [--network devnet] [--yes]
+ *
+ * Requires an AuthHub session (`decision-oracle login --network <n>` first) — it is the ONLY identity
+ * here: chain signing, the Vault and rooms-bot UCANs, AND the Matrix access token the `room` phase
+ * uses (lib/chain.ts `matrixLoginFromSession`: the session's `matrixMnemonic` → the portal's password
+ * derivation → `m.login.password`). No env file: the token has to belong to the entity OWNER's
+ * Matrix user — the rooms-bot invites the UCAN issuer and the claim-bot invite sets power levels —
+ * so an oracle's bot token could never do this job.
+ *
+ * Phases (default `all`, run in this order): `entity` (create the protocol entity — skipped, using
+ * `--entity`, when one already exists), `resources` (store form + rubric on the Vault, patch the
+ * rubric's `claimSchema` to the real protocol/proof, anchor `#vct` + `#rub` + the Matrix service),
+ * `room` (source the entity's Matrix room and invite the claim bot — required or the claim bot
+ * returns IXO_ROOM_NOT_FOUND). Resuming a half-finished run: pass `--entity <did>` and `--phase
+ * resources` (or `room`, or `all`).
+ *
+ * `rub` is the ODD ONE OUT and never runs under `all`: it anchors (or replaces) `#rub` ALONE on a
+ * protocol that already has its `#vct` and its room — somebody else's published protocol this oracle
+ * is adopting. `resources` cannot do that job: it re-anchors `#vct` too, which the chain refuses for
+ * an id that already exists. See `anchorRubric` for the rest.
+ *
+ * Validation runs BEFORE any chain write, every invocation, regardless of `--phase`: the rubric must
+ * parse and bind against the form with the ENGINE's own schema + binder, asked over HTTP (`rubric
+ * validate`, same function, in-process) because this package carries no rubric code. A rubric whose
+ * rules don't resolve against its own claim form is refused here, not anchored on chain and
+ * discovered broken later. No `--proof`: pre-anchoring the placeholder proof is expected —
+ * `resources` patches the real one in.
+ */
+import { readFile } from "node:fs/promises";
+import { isManifestUnusable } from "../../lib/engine/types.js";
+import { NETWORKS } from "../../networks.js";
+import { parse } from "../lib/args.js";
+import { addLinkedResourceMsg, addServiceMsg, broadcast, confirm, createEntity, deleteLinkedResourceMsg, fail, matrixLoginFromSession, resolveEntity, resolveNetwork, STANDARD_FEE, sessionDocSigner, sha256Hex, sourceEntityRoom, uploadDoc, } from "../lib/chain.js";
+import { tryProjectConfig } from "../lib/devvars.js";
+import { engineUrlFor } from "../lib/engine.js";
+import { buildSigner } from "../lib/session.js";
+import { audienceMismatch } from "../lib/workorder.js";
+import { rubricValidate } from "./rubric-validate.js";
+function resolvePhase(value) {
+    const phase = value ?? "all";
+    if (phase !== "entity" &&
+        phase !== "resources" &&
+        phase !== "rub" &&
+        phase !== "room" &&
+        phase !== "all") {
+        fail(`unknown --phase '${phase}' (entity|resources|rub|room|all)`);
+    }
+    return phase;
+}
+const RUNS = {
+    entity: (p) => p === "entity" || p === "all",
+    resources: (p) => p === "resources" || p === "all",
+    // Deliberately NOT part of `all`: `rub` adopts an EXISTING protocol, the opposite of publishing a
+    // new one, and running both in one invocation would double-anchor `#rub`.
+    rub: (p) => p === "rub",
+    room: (p) => p === "room" || p === "all",
+};
+/**
+ * THE rubric canonicalisation — one recipe, both anchoring phases. These exact bytes are what gets
+ * uploaded AND what gets hashed into the `#rub` proof, so the two phases have to agree on them byte
+ * for byte: a rubric anchored by `resources` and then re-anchored by `rub` must land on the same id,
+ * or `anchorRubric`'s "already anchored" check never fires and every run re-anchors.
+ * `test/cli/publish-protocol.test.ts` holds the cross-phase tripwire.
+ *
+ * A file whose `claimSchema` ALREADY pins this protocol and this `#vct` proof is anchored VERBATIM.
+ * That is what makes the id `rubric validate` prints (sha256 of the file's raw bytes) the id the
+ * rubric actually lands under — re-serializing a correctly pinned file would anchor it under an id
+ * the author never saw, for no gain. Only a document that must be repinned is re-serialized, one
+ * way: `JSON.stringify(patched, null, 2)`.
+ */
+function canonicalizeRubric(rubric, protocol, proof, 
+/** The rubric file's own bytes, as read and validated. */
+raw) {
+    const pinned = rubric.rubric.claimSchema;
+    if (pinned.protocol === protocol && pinned.proof === proof)
+        return raw;
+    const patched = structuredClone(rubric);
+    patched.rubric.claimSchema.protocol = protocol;
+    patched.rubric.claimSchema.proof = proof;
+    return new TextEncoder().encode(JSON.stringify(patched, null, 2));
+}
+/** The `#rub` LinkedResource both phases anchor — one shape, so an adopted protocol's rubric is
+ *  indistinguishable from a freshly published one. The id IS the content commitment. */
+function rubResource(serviceEndpoint, proof) {
+    return {
+        id: "{id}#rub",
+        type: "rubric",
+        description: "",
+        mediaType: "application/ld+json",
+        serviceEndpoint,
+        proof,
+        encrypted: "false",
+        right: "",
+    };
+}
+async function publishResources(signer, entityDid, rubric, formBytes, yes) {
+    // Matrix endpoint comes ONLY from `NETWORKS[network]` (the `--network` flag) — see the identical
+    // note in `create-collection`.
+    const matrixBase = NETWORKS[signer.network].matrix.replace(/\/+$/, "");
+    confirm({
+        network: signer.network,
+        signer: signer.did,
+        action: "upload form.json + rubric.json to the IXO Vault (else the IPFS gateway)",
+        lines: [
+            `form: ${formBytes.byteLength} bytes`,
+            "rubric: patched with entity DID + form proof, then uploaded",
+        ],
+    }, yes);
+    const docSigner = sessionDocSigner(signer);
+    const { url: formUrl } = await uploadDoc(signer.network, docSigner, formBytes, "form.json", "application/json");
+    // The chain proof is sha256 HEX of the bytes exactly as anchored — the engine string-compares,
+    // never recomputes.
+    const vctProof = await sha256Hex(formBytes);
+    const rubricBytes = canonicalizeRubric(rubric.doc, entityDid, vctProof, rubric.bytes);
+    const { url: rubricUrl } = await uploadDoc(signer.network, docSigner, rubricBytes, "rubric.json", "application/ld+json");
+    const rubricProof = await sha256Hex(rubricBytes);
+    console.log(`✓ form:   ${formUrl}\n  proof:  ${vctProof}`);
+    console.log(`✓ rubric: ${rubricUrl}\n  proof:  ${rubricProof}`);
+    const svc = await addServiceMsg(entityDid, { id: "{id}#matrix", type: "Matrix", serviceEndpoint: matrixBase }, signer.address);
+    const msgs = [
+        await addLinkedResourceMsg(entityDid, {
+            id: "{id}#vct",
+            type: "surveyTemplate",
+            description: "",
+            mediaType: "application/json",
+            serviceEndpoint: formUrl,
+            proof: vctProof,
+            encrypted: "false",
+            right: "",
+        }, signer.address),
+        await addLinkedResourceMsg(entityDid, rubResource(rubricUrl, rubricProof), signer.address),
+        svc,
+    ];
+    confirm({
+        network: signer.network,
+        signer: signer.address,
+        action: "MsgAddLinkedResource #vct + #rub + MsgAddService Matrix",
+        lines: [`entity: ${entityDid}`, `#vct proof: ${vctProof}`, `#rub proof: ${rubricProof}`],
+        fee: STANDARD_FEE,
+    }, yes);
+    const { hash } = await broadcast(signer, msgs, "publish-protocol: resources");
+    console.log(`✓ #vct + #rub + Matrix service added (tx ${hash})`);
+    return { vctProof, rubricProof };
+}
+/**
+ * `--phase rub` — anchor, or REPLACE, `#rub` alone on a protocol that already carries its `#vct`.
+ *
+ * Three differences from `publishResources`, each load-bearing:
+ *
+ *  1. **The `#vct` proof is read off the chain and copied VERBATIM** into the rubric's
+ *     `claimSchema`, never recomputed from `--form`: on a protocol published through the portal it
+ *     is the template lane's CID, not a sha256 of the bytes, and the engine string-compares it.
+ *     (Same rule `rubric fetch-form` prints.) `--form` is still required — it is what the engine's
+ *     binder validates the rubric against, upstream of here.
+ *  2. **Replacing is delete-then-add in ONE tx.** `MsgAddLinkedResource` is refused for an id that
+ *     already exists (`duplicated resource id`), and two txs would leave the protocol rubric-less in
+ *     between. The delete names the stored id verbatim — see `deleteLinkedResourceMsg`.
+ *  3. **Idempotent by content.** When the anchored proof already equals the id these bytes hash to,
+ *     nothing is uploaded and nothing is signed.
+ *
+ * The messages are composed for the protocol's OWNER, because the chain checks the signer against
+ * the DID's authentication relationship. When that isn't this session they are printed instead of
+ * broadcast — the rubric is uploaded either way, so the owner has only to sign what is printed.
+ */
+async function anchorRubric(signer, protocolDid, rubric, yes) {
+    const entity = await resolveEntity(NETWORKS[signer.network].blocksync, protocolDid);
+    if (!entity.type) {
+        fail(`${protocolDid} did not resolve on ${signer.network} blocksync (indexer lag? wrong DID?)`);
+    }
+    const vct = entity.linkedResources.find((r) => r.id.endsWith("#vct"));
+    if (!vct) {
+        fail(`${protocolDid} has no #vct claim form — --phase rub adopts a protocol that already has one; ` +
+            "publish both with --phase resources instead");
+    }
+    const pinned = rubric.doc.rubric.claimSchema;
+    if (pinned.protocol !== protocolDid || pinned.proof !== vct.proof) {
+        console.log(`repinned claimSchema: ${pinned.protocol} / ${pinned.proof} → ${protocolDid} / ${vct.proof}` +
+            " — the anchored id is sha256 of the REPINNED document, not of the file as written");
+    }
+    const rubricBytes = canonicalizeRubric(rubric.doc, protocolDid, vct.proof, rubric.bytes);
+    const rubricProof = await sha256Hex(rubricBytes);
+    const existing = entity.linkedResources.find((r) => r.id.endsWith("#rub"));
+    if (existing?.proof === rubricProof) {
+        console.log(`already anchored: ${protocolDid} ${existing.id} is ${rubricProof} — nothing to do`);
+        return { vctProof: vct.proof, rubricProof };
+    }
+    const owner = entity.owner;
+    const owned = owner === signer.address;
+    if (!owned && !owner) {
+        // The messages below have to name a signer the chain will accept for this DID. With no owner to
+        // address them to, the only candidate is this session — which the chain would refuse — so
+        // printing them would hand somebody a plan that cannot be broadcast. Nothing is uploaded.
+        fail(`could not resolve this protocol's owner — ${protocolDid} reports no owner on ${signer.network} ` +
+            "blocksync (indexer lag? an entity created another way?), and messages signed as this " +
+            "session would be refused by the chain. Re-run once the entity resolves with its owner.");
+    }
+    if (!owned) {
+        console.log(`⚠ ${protocolDid} is owned by ${owner}, not this session — the rubric ` +
+            "will be uploaded, then the messages printed for its owner to broadcast.");
+    }
+    confirm({
+        network: signer.network,
+        signer: signer.did,
+        action: "upload rubric.json to the IXO Vault (else the IPFS gateway)",
+        lines: [
+            `protocol: ${protocolDid}`,
+            `rubric: ${rubricBytes.byteLength} bytes, pinned to the live #vct proof ${vct.proof}`,
+            existing ? `replaces the anchored #rub (${existing.proof})` : "no #rub anchored yet",
+        ],
+    }, yes);
+    const { url: rubricUrl } = await uploadDoc(signer.network, sessionDocSigner(signer), rubricBytes, "rubric.json", "application/ld+json");
+    console.log(`✓ rubric: ${rubricUrl}\n  proof:  ${rubricProof}`);
+    const msgSigner = owned ? signer.address : owner;
+    const msgs = [
+        ...(existing ? [await deleteLinkedResourceMsg(protocolDid, existing.id, msgSigner)] : []),
+        await addLinkedResourceMsg(protocolDid, rubResource(rubricUrl, rubricProof), msgSigner),
+    ];
+    if (!owned) {
+        console.log(`\nask ${owner} to broadcast these in ONE tx, in this order:`);
+        for (const msg of msgs)
+            console.log(`  ${msg.typeUrl} ${JSON.stringify(msg.value)}`);
+        console.log("");
+        return { vctProof: vct.proof, rubricProof };
+    }
+    confirm({
+        network: signer.network,
+        signer: signer.address,
+        action: existing
+            ? "MsgDeleteLinkedResource #rub + MsgAddLinkedResource #rub (one tx)"
+            : "MsgAddLinkedResource #rub",
+        lines: [
+            `protocol: ${protocolDid}`,
+            `#rub proof: ${rubricProof}${existing ? ` (was ${existing.proof})` : ""}`,
+        ],
+        fee: STANDARD_FEE,
+    }, yes);
+    const { hash } = await broadcast(signer, msgs, "publish-protocol: rub");
+    console.log(`✓ #rub ${existing ? "replaced" : "added"} on ${protocolDid} (tx ${hash})`);
+    return { vctProof: vct.proof, rubricProof };
+}
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            rubric: { type: "string" },
+            form: { type: "string" },
+            network: { type: "string" },
+            phase: { type: "string" },
+            entity: { type: "string" },
+            // `--protocol` is `--entity` under the name the `rub` phase's target actually has: someone
+            // else's published protocol. One target, either spelling, for every phase.
+            protocol: { type: "string" },
+            "engine-url": { type: "string" },
+            "env-file": { type: "string" },
+            yes: { type: "boolean" },
+        },
+    });
+    const rubricPath = values.rubric ?? fail("--rubric is required");
+    const formPath = values.form ?? fail("--form is required");
+    const network = resolveNetwork(values.network);
+    const phase = resolvePhase(values.phase);
+    const yes = values.yes === true;
+    let entityDid = values.entity ?? values.protocol;
+    // ---- validation — BEFORE any chain write, every invocation, regardless of --phase -------------
+    const engineUrl = engineUrlFor({
+        network,
+        engineUrl: values["engine-url"],
+        devVars: tryProjectConfig({ envFile: values["env-file"] }),
+    });
+    const validated = await rubricValidate({ rubricPath, formPath, engineUrl }).catch((err) => fail(`${err instanceof Error ? err.message : String(err)} — cannot validate, refusing to publish`));
+    if (isManifestUnusable(validated.manifest)) {
+        for (const issue of validated.manifest.issues) {
+            console.error(`  ${issue.code} ${issue.path}: ${issue.message}`);
+        }
+        fail("refusing to publish an unusable rubric — fix the issues above and re-run");
+    }
+    // A source no oracle will call (audience ≠ its endpoint's did:web, stock/ext-source.ts) is a
+    // rubric defect the engine's binder cannot see — refuse it before anything is anchored.
+    const refused = Object.entries(validated.manifest.ext).flatMap(([name, source]) => {
+        const expected = audienceMismatch(source);
+        return expected ? [`  ext.${name}: audience ${source.audience} ≠ ${expected}`] : [];
+    });
+    if (refused.length > 0) {
+        for (const line of refused)
+            console.error(line);
+        fail("refusing to publish: each source's audience must be its endpoint's own did:web (did:web:<endpoint host>) — no oracle will call these as declared");
+    }
+    // The bytes ride along with the document: a file already pinned to its protocol is anchored
+    // verbatim, under the very id `rubric validate` printed (see `canonicalizeRubric`).
+    const rubric = { doc: validated.doc, bytes: validated.bytes };
+    console.log(`✓ validated (engine binder at ${engineUrl}): ${rubric.doc.rubric.gates?.length ?? 0} gates, ` +
+        `${rubric.doc.rubric.scoring?.criteria.length ?? 0} criteria bind against ${formPath}`);
+    const formBytes = new Uint8Array(await readFile(formPath));
+    const signer = await buildSigner(network);
+    console.log(`signer: ${signer.address} (${network})`);
+    // One Matrix login for the room phase, and only once it has passed its confirm gate.
+    let matrixLogin;
+    const matrixToken = () => (matrixLogin ??= matrixLoginFromSession(signer));
+    let vctProof;
+    let rubricProof;
+    let roomId;
+    if (RUNS.entity(phase)) {
+        if (entityDid) {
+            console.log(`using existing entity ${entityDid} (--entity given) — skipping creation`);
+        }
+        else {
+            entityDid = await createEntity(signer, "protocol/verifiableClaim", yes);
+        }
+    }
+    if (RUNS.resources(phase)) {
+        if (!entityDid) {
+            fail("--phase resources needs --entity <did> (or run --phase entity/all first)");
+        }
+        ({ vctProof, rubricProof } = await publishResources(signer, entityDid, rubric, formBytes, yes));
+    }
+    if (RUNS.rub(phase)) {
+        if (!entityDid)
+            fail("--phase rub needs --protocol <did> (the protocol to anchor the rubric on)");
+        ({ vctProof, rubricProof } = await anchorRubric(signer, entityDid, rubric, yes));
+    }
+    if (RUNS.room(phase)) {
+        if (!entityDid)
+            fail("--phase room needs --entity <did> (or run --phase entity/all first)");
+        roomId = await sourceEntityRoom(signer, entityDid, matrixToken, yes);
+    }
+    console.log("\n════ published ════");
+    console.log(`protocol DID : ${entityDid ?? "(not created this run)"}`);
+    console.log(`#vct proof   : ${vctProof ?? "(not run this phase)"}`);
+    console.log(`#rub proof   : ${rubricProof ?? "(not run this phase)"} (= rubric id)`);
+    console.log(`room id      : ${roomId ?? "(not run this phase)"}\n`);
+    return 0;
+}
+//# sourceMappingURL=publish-protocol.js.map

package/dist/cli/commands/publish-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-protocol.js","sourceRoot":"","sources":["../../../src/cli/commands/publish-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,OAAO,EACP,YAAY,EACZ,uBAAuB,EACvB,IAAI,EAEJ,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,gBAAgB,EAChB,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAsB,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAkB,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInE,SAAS,YAAY,CAAC,KAAyB;IAC7C,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC;IAC7B,IACE,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,KAAK;QACf,KAAK,KAAK,MAAM;QAChB,KAAK,KAAK,KAAK,EACf,CAAC;QACD,IAAI,CAAC,oBAAoB,KAAK,mCAAmC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,IAAI,GAAG;IACX,MAAM,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK;IACnD,SAAS,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;IACzD,kGAAkG;IAClG,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK;IAC9B,IAAI,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;CAChD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CACzB,MAAiB,EACjB,QAAgB,EAChB,KAAa;AACb,0DAA0D;AAC1D,GAAe;IAEf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IACvE,MAAM,OAAO,GAAc,eAAe,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC/C,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;wFACwF;AACxF,SAAS,WAAW,CAAC,eAAuB,EAAE,KAAa;IACzD,OAAO;QACL,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,qBAAqB;QAChC,eAAe;QACf,KAAK;QACL,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC;AAQD,KAAK,UAAU,gBAAgB,CAC7B,MAAqB,EACrB,SAAiB,EACjB,MAAuB,EACvB,SAAqB,EACrB,GAAY;IAEZ,iGAAiG;IACjG,+BAA+B;IAC/B,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEvE,OAAO,CACL;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM,EAAE,yEAAyE;QACjF,KAAK,EAAE;YACL,SAAS,SAAS,CAAC,UAAU,QAAQ;YACrC,6DAA6D;SAC9D;KACF,EACD,GAAG,CACJ,CAAC;IACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CACtC,MAAM,CAAC,OAAO,EACd,SAAS,EACT,SAAS,EACT,WAAW,EACX,kBAAkB,CACnB,CAAC;IACF,+FAA+F;IAC/F,oBAAoB;IACpB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CACxC,MAAM,CAAC,OAAO,EACd,SAAS,EACT,WAAW,EACX,aAAa,EACb,qBAAqB,CACtB,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,eAAe,QAAQ,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,eAAe,WAAW,EAAE,CAAC,CAAC;IAEhE,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,SAAS,EACT,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAClE,MAAM,CAAC,OAAO,CACf,CAAC;IACF,MAAM,IAAI,GAAG;QACX,MAAM,oBAAoB,CACxB,SAAS,EACT;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,kBAAkB;YAC7B,eAAe,EAAE,OAAO;YACxB,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,EAAE;SACV,EACD,MAAM,CAAC,OAAO,CACf;QACD,MAAM,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;QAC1F,GAAG;KACJ,CAAC;IACF,OAAO,CACL;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,OAAO;QACtB,MAAM,EAAE,yDAAyD;QACjE,KAAK,EAAE,CAAC,WAAW,SAAS,EAAE,EAAE,eAAe,QAAQ,EAAE,EAAE,eAAe,WAAW,EAAE,CAAC;QACxF,GAAG,EAAE,YAAY;KAClB,EACD,GAAG,CACJ,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,6BAA6B,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,4CAA4C,IAAI,GAAG,CAAC,CAAC;IACjE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,YAAY,CACzB,MAAqB,EACrB,WAAmB,EACnB,MAAuB,EACvB,GAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,WAAW,uBAAuB,MAAM,CAAC,OAAO,sCAAsC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CACF,GAAG,WAAW,gFAAgF;YAC5F,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;IAC7C,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CACT,yBAAyB,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,KAAK,MAAM,WAAW,MAAM,GAAG,CAAC,KAAK,EAAE;YAC1F,mFAAmF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,IAAI,QAAQ,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CACT,qBAAqB,WAAW,IAAI,QAAQ,CAAC,EAAE,OAAO,WAAW,kBAAkB,CACpF,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,gGAAgG;QAChG,0FAA0F;QAC1F,0FAA0F;QAC1F,IAAI,CACF,6CAA6C,WAAW,wBAAwB,MAAM,CAAC,OAAO,GAAG;YAC/F,uFAAuF;YACvF,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACT,KAAK,WAAW,gBAAgB,KAAK,kCAAkC;YACrE,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IAED,OAAO,CACL;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM,EAAE,6DAA6D;QACrE,KAAK,EAAE;YACL,aAAa,WAAW,EAAE;YAC1B,WAAW,WAAW,CAAC,UAAU,yCAAyC,GAAG,CAAC,KAAK,EAAE;YACrF,QAAQ,CAAC,CAAC,CAAC,+BAA+B,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,sBAAsB;SACrF;KACF,EACD,GAAG,CACJ,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CACxC,MAAM,CAAC,OAAO,EACd,gBAAgB,CAAC,MAAM,CAAC,EACxB,WAAW,EACX,aAAa,EACb,qBAAqB,CACtB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,eAAe,WAAW,EAAE,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,oBAAoB,CAAC,WAAW,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC;KACxF,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,+CAA+C,CAAC,CAAC;QAC3E,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IAED,OAAO,CACL;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,OAAO;QACtB,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,mEAAmE;YACrE,CAAC,CAAC,2BAA2B;QAC/B,KAAK,EAAE;YACL,aAAa,WAAW,EAAE;YAC1B,eAAe,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SAC1E;QACD,GAAG,EAAE,YAAY;KAClB,EACD,GAAG,CACJ,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,OAAO,WAAW,QAAQ,IAAI,GAAG,CAAC,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,2FAA2F;YAC3F,2EAA2E;YAC3E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SACzB;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC;IAChC,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC;IAEjD,kGAAkG;IAClG,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACxF,IAAI,CACF,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAC7F,CACF,CAAC;IACF,IAAI,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACnF,CAAC;IACD,6FAA6F;IAC7F,wFAAwF;IACxF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QAChF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,cAAc,MAAM,CAAC,QAAQ,MAAM,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CACF,kJAAkJ,CACnJ,CAAC;IACJ,CAAC;IACD,4FAA4F;IAC5F,oFAAoF;IACpF,MAAM,MAAM,GAAoB,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAC/E,OAAO,CAAC,GAAG,CACT,iCAAiC,SAAS,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,UAAU;QAC5F,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC,0BAA0B,QAAQ,EAAE,CACzF,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,KAAK,OAAO,GAAG,CAAC,CAAC;IACtD,qFAAqF;IACrF,IAAI,WAAwC,CAAC;IAC7C,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,CAAC,WAAW,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,IAAI,QAA4B,CAAC;IACjC,IAAI,WAA+B,CAAC;IACpC,IAAI,MAA0B,CAAC;IAE/B,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,yBAAyB,SAAS,uCAAuC,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,0EAA0E,CAAC,CAAC;QACnF,CAAC;QACD,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS;YACZ,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACpF,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAC5F,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,IAAI,wBAAwB,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,IAAI,sBAAsB,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW,IAAI,sBAAsB,gBAAgB,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,IAAI,sBAAsB,IAAI,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/register.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `decision-oracle register --collection <id>` — the collection OWNER's first call to this oracle
+ * (`POST /v1/collections/register`), the one the portal makes for a real commissioner. Here it is
+ * signed as the AuthHub session `decision-oracle login` saved: the wallet that created the collection,
+ * so it passes the oracle's WHO gate (chain owner).
+ *
+ *   decision-oracle register --collection <id> [--delegation <bot CAR file>] [--contact-email <addr>]
+ *     [--network devnet|testnet|mainnet] [--kit <url>] [--env-file <path>]
+ *
+ * `--delegation` is the owner→oracle claim-bot CAR (`decision-oracle delegation --audience
+ * did:ixo:<ORACLE_ADDRESS>`, the bot form); without it the oracle looks for one in the UCAN Store.
+ * The oracle's URL is `ORACLE_HOSTNAME` from the project's `.dev.vars` (http for localhost) unless
+ * `--kit` says otherwise.
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=register.d.ts.map

package/dist/cli/commands/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAmCzD"}

package/dist/cli/commands/register.js

@@ -0,0 +1,54 @@
+/**
+ * `decision-oracle register --collection <id>` — the collection OWNER's first call to this oracle
+ * (`POST /v1/collections/register`), the one the portal makes for a real commissioner. Here it is
+ * signed as the AuthHub session `decision-oracle login` saved: the wallet that created the collection,
+ * so it passes the oracle's WHO gate (chain owner).
+ *
+ *   decision-oracle register --collection <id> [--delegation <bot CAR file>] [--contact-email <addr>]
+ *     [--network devnet|testnet|mainnet] [--kit <url>] [--env-file <path>]
+ *
+ * `--delegation` is the owner→oracle claim-bot CAR (`decision-oracle delegation --audience
+ * did:ixo:<ORACLE_ADDRESS>`, the bot form); without it the oracle looks for one in the UCAN Store.
+ * The oracle's URL is `ORACLE_HOSTNAME` from the project's `.dev.vars` (http for localhost) unless
+ * `--kit` says otherwise.
+ */
+import { readFile } from "node:fs/promises";
+import { parse, UsageError } from "../lib/args.js";
+import { resolveNetwork } from "../lib/chain.js";
+import { oracleUrlFor, tryProjectConfig } from "../lib/devvars.js";
+import { kitFetch, loadSession } from "../lib/session.js";
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            collection: { type: "string" },
+            delegation: { type: "string" },
+            "contact-email": { type: "string" },
+            network: { type: "string" },
+            kit: { type: "string" },
+            "env-file": { type: "string" },
+        },
+    });
+    const collectionId = values.collection;
+    if (!collectionId)
+        throw new UsageError("register needs --collection <id>");
+    const network = resolveNetwork(values.network);
+    const kitUrl = oracleUrlFor({
+        kit: values.kit,
+        devVars: tryProjectConfig({ envFile: values["env-file"] }),
+    });
+    const session = await loadSession(network);
+    const body = JSON.stringify({
+        collectionId,
+        ...(values.delegation
+            ? { delegationCar: (await readFile(values.delegation, "utf8")).trim() }
+            : {}),
+        // Where the oracle's pause/resume/review notices are emailed; the portal sets it at register,
+        // this CLI otherwise leaves the row's value untouched.
+        ...(values["contact-email"] ? { contactEmail: values["contact-email"] } : {}),
+    });
+    const { res, did } = await kitFetch(session, kitUrl, "/v1/collections/register", { body });
+    console.log(`register as ${did} → ${kitUrl}/v1/collections/register`);
+    console.log(`${res.status} ${await res.text()}`);
+    return res.ok ? 0 : 1;
+}
+//# sourceMappingURL=register.js.map

package/dist/cli/commands/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/cli/commands/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC/B;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAE5E,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,YAAY;QACZ,GAAG,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,8FAA8F;QAC9F,uDAAuD;QACvD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,MAAM,MAAM,0BAA0B,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/cli/commands/relink.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `decision-oracle relink [--collection <id>]…` — the operator's backfill of register's company links
+ * (`POST /v1/admin/collections/relink`): each watched collection (every one, or the `--collection`s
+ * named) is linked to the active Decision API sources of its company, exactly as a register now
+ * does. Idempotent — a re-run links only what is missing. Signed as the AuthHub session `decision-oracle
+ * login` saved, whose DID must be in the oracle's `ORACLE_ADMIN_DIDS`.
+ *
+ *   decision-oracle relink [--collection <id>]… [--network devnet|testnet|mainnet] [--kit <url>] [--env-file <path>]
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=relink.d.ts.map

package/dist/cli/commands/relink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relink.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/relink.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzD"}

package/dist/cli/commands/relink.js

@@ -0,0 +1,36 @@
+/**
+ * `decision-oracle relink [--collection <id>]…` — the operator's backfill of register's company links
+ * (`POST /v1/admin/collections/relink`): each watched collection (every one, or the `--collection`s
+ * named) is linked to the active Decision API sources of its company, exactly as a register now
+ * does. Idempotent — a re-run links only what is missing. Signed as the AuthHub session `decision-oracle
+ * login` saved, whose DID must be in the oracle's `ORACLE_ADMIN_DIDS`.
+ *
+ *   decision-oracle relink [--collection <id>]… [--network devnet|testnet|mainnet] [--kit <url>] [--env-file <path>]
+ */
+import { parse } from "../lib/args.js";
+import { resolveNetwork } from "../lib/chain.js";
+import { oracleUrlFor, tryProjectConfig } from "../lib/devvars.js";
+import { kitFetch, loadSession } from "../lib/session.js";
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            collection: { type: "string", multiple: true },
+            network: { type: "string" },
+            kit: { type: "string" },
+            "env-file": { type: "string" },
+        },
+    });
+    const kitUrl = oracleUrlFor({
+        kit: values.kit,
+        devVars: tryProjectConfig({ envFile: values["env-file"] }),
+    });
+    const session = await loadSession(resolveNetwork(values.network));
+    const path = "/v1/admin/collections/relink";
+    const { res, did } = await kitFetch(session, kitUrl, path, {
+        body: JSON.stringify(values.collection ? { collectionIds: values.collection } : {}),
+    });
+    console.log(`relink as ${did} → ${kitUrl}${path}`);
+    console.log(`${res.status} ${await res.text()}`);
+    return res.ok ? 0 : 1;
+}
+//# sourceMappingURL=relink.js.map

package/dist/cli/commands/relink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relink.js","sourceRoot":"","sources":["../../../src/cli/commands/relink.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC/B;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,8BAA8B,CAAC;IAE5C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;QACzD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/cli/commands/rubric-fetch-form.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `decision-oracle rubric fetch-form` — download a protocol's live claim form (`#vct` LinkedResource)
+ * from Blocksync so a rubric can be bound against the REAL form and pinned to the REAL chain proof.
+ * Prints the `claimSchema` block to paste into the rubric. Read-only; no chain writes.
+ *
+ *   decision-oracle rubric fetch-form --protocol <did:ixo:entity:…> --out <form.json>
+ *     [--rub <existing-rubric.json>] [--network devnet|testnet|mainnet] [--blocksync <graphql url>]
+ *
+ * `--rub` also downloads the protocol's CURRENT #rub bytes (to edit an existing rubric rather than
+ * start blank) — validate them unchanged first; their sha256 must equal the chain's #rub proof.
+ *
+ * The proof is copied VERBATIM: for `#vct` it is the template lane's CID, and the engine compares it
+ * as a string — never recompute it.
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=rubric-fetch-form.d.ts.map

package/dist/cli/commands/rubric-fetch-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubric-fetch-form.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/rubric-fetch-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwBH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEzD"}