@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/cli/commands/rubric-fetch-form.js

@@ -0,0 +1,83 @@
+/**
+ * `decision-oracle rubric fetch-form` — download a protocol's live claim form (`#vct` LinkedResource)
+ * from Blocksync so a rubric can be bound against the REAL form and pinned to the REAL chain proof.
+ * Prints the `claimSchema` block to paste into the rubric. Read-only; no chain writes.
+ *
+ *   decision-oracle rubric fetch-form --protocol <did:ixo:entity:…> --out <form.json>
+ *     [--rub <existing-rubric.json>] [--network devnet|testnet|mainnet] [--blocksync <graphql url>]
+ *
+ * `--rub` also downloads the protocol's CURRENT #rub bytes (to edit an existing rubric rather than
+ * start blank) — validate them unchanged first; their sha256 must equal the chain's #rub proof.
+ *
+ * The proof is copied VERBATIM: for `#vct` it is the template lane's CID, and the engine compares it
+ * as a string — never recompute it.
+ */
+import { writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { readLinkedDoc } from "../../facts/linked-doc.js";
+import { NETWORKS } from "../../networks.js";
+import { parse, UsageError } from "../lib/args.js";
+import { gqlFetch, resolveNetwork } from "../lib/chain.js";
+// The same query the engine uses (its lib/ixo/blocksync/queries.ts).
+const LINKED_RESOURCES_QUERY = `query EntityLinkedResources($ids: [String!]) {
+  entities(filter: { id: { in: $ids } }) { nodes { id linkedResource } }
+}`;
+/** The bytes behind a LinkedResource, exactly as anchored — never re-encoded. `readLinkedDoc`
+ *  resolves a Vault, IPFS or Matrix address and refuses bytes that are not the resource's proof. */
+async function download(resource, what) {
+    const read = await readLinkedDoc(resource, {
+        headers: { accept: "application/ld+json, application/json" },
+    });
+    if (!read.ok)
+        throw new Error(`${what}: ${read.message}`);
+    return read.bytes;
+}
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            protocol: { type: "string" },
+            out: { type: "string" },
+            rub: { type: "string" },
+            network: { type: "string" },
+            blocksync: { type: "string" },
+        },
+    });
+    const protocol = values.protocol;
+    const out = values.out;
+    if (!protocol || !out) {
+        throw new UsageError("rubric fetch-form needs --protocol <did> and --out <form.json>");
+    }
+    const network = resolveNetwork(values.network);
+    const blocksync = values.blocksync ?? NETWORKS[network].blocksync;
+    const data = await gqlFetch(blocksync, LINKED_RESOURCES_QUERY, { ids: [protocol] });
+    const node = data.entities?.nodes[0];
+    if (!node) {
+        console.error(`protocol ${protocol} not found on ${network} Blocksync`);
+        return 1;
+    }
+    const resources = node.linkedResource ?? [];
+    console.log(`linked resources on ${protocol}:`);
+    for (const r of resources) {
+        console.log(`  ${r.id.slice(r.id.indexOf("#"))}  type=${r.type}  ${r.mediaType}`);
+    }
+    const vct = resources.find((r) => r.id.endsWith("#vct"));
+    if (!vct) {
+        console.error("no #vct claim form on this protocol — author the form first (see the create-rubric skill's templates/)");
+        return 1;
+    }
+    const bytes = await download(vct, "form");
+    writeFileSync(resolve(out), bytes);
+    console.log(`\nwrote ${out} (${bytes.byteLength} bytes) from ${vct.serviceEndpoint}`);
+    const rub = resources.find((r) => r.id.endsWith("#rub"));
+    if (values.rub && rub) {
+        const rubBytes = await download(rub, "rubric");
+        writeFileSync(resolve(values.rub), rubBytes);
+        console.log(`wrote ${values.rub} (${rubBytes.byteLength} bytes) — the current #rub (proof ${rub.proof})`);
+    }
+    console.log(`existing #rub: ${rub ? `${rub.type} proof=${rub.proof} (a new rubric REPLACES it when anchored)` : "none"}`);
+    console.log("\nclaimSchema block for the rubric (proof copied verbatim — never recompute it):");
+    console.log(JSON.stringify({ "@type": "ClaimSchemaBinding", protocol, resource: "#vct", proof: vct.proof }, null, 2));
+    console.log(`\nvalidate with: --form ${out} --proof ${vct.proof}`);
+    return 0;
+}
+//# sourceMappingURL=rubric-fetch-form.js.map

package/dist/cli/commands/rubric-fetch-form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubric-fetch-form.js","sourceRoot":"","sources":["../../../src/cli/commands/rubric-fetch-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAuB,cAAc,EAAE,MAAM,cAAc,CAAC;AAE7E,qEAAqE;AACrE,MAAM,sBAAsB,GAAG;;EAE7B,CAAC;AAEH;oGACoG;AACpG,KAAK,UAAU,QAAQ,CAAC,QAAwB,EAAE,IAAY;IAC5D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE;QACzC,OAAO,EAAE,EAAE,MAAM,EAAE,uCAAuC,EAAE;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC9B;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,gEAAgE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC;IAElE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAExB,SAAS,EAAE,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,YAAY,QAAQ,iBAAiB,OAAO,YAAY,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CACX,wGAAwG,CACzG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1C,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,KAAK,KAAK,CAAC,UAAU,gBAAgB,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;IAEtF,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CACT,SAAS,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,UAAU,qCAAqC,GAAG,CAAC,KAAK,GAAG,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,kBAAkB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,KAAK,2CAA2C,CAAC,CAAC,CAAC,MAAM,EAAE,CAC7G,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAC/E,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,YAAY,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/rubric-validate.d.ts

@@ -0,0 +1,72 @@
+/**
+ * `decision-oracle rubric validate` — the authoring safety net. Sends a rubric and the claim form it
+ * binds against to the ENGINE, which parses it with its own schema and binds it with its own
+ * binder, and prints the work order that comes back (what an oracle will have to produce for it).
+ * This package never parses a rubric itself — the engine owns that format — so validation is one
+ * public HTTP call, not a copy of the engine's schema.
+ *
+ *   decision-oracle rubric validate --rubric <rubric.json> --form <form.json> [--proof <chain #vct proof>]
+ *     [--json] [--engine-url <url>] [--network devnet|testnet|mainnet] [--env-file <path>]
+ *
+ * Exit codes: 0 valid + binds · 2 the engine reports it unusable (its issues are printed) · 1 the
+ * engine refused the call or is unreachable, or a source is refused (its audience is not its
+ * endpoint's did:web — an ERROR line) · 64 usage.
+ *
+ * A rubric's id is sha256 of the bytes anchored, and `publish-protocol` anchors THIS FILE verbatim
+ * when its `claimSchema` already pins the protocol it is going on and that protocol's live `#vct`
+ * proof — so a pinned, validated file anchors under the id printed here, and re-formatting it
+ * changes that id. When publish has to repin `claimSchema` (a placeholder proof, another protocol),
+ * it re-serializes the patched document as `JSON.stringify(doc, null, 2)` and THAT is the id
+ * instead. Both rules are printed below.
+ */
+import { type Manifest, type ManifestUnusable } from "../../lib/engine/types.js";
+export interface RubricValidateOptions {
+    /** Path to the rubric document — read as RAW BYTES, since its sha256 is its id. */
+    rubricPath: string;
+    formPath: string;
+    /** The chain's live `#vct` proof; defaults to the proof the rubric pins. */
+    proof?: string;
+    engineUrl: string;
+}
+export interface RubricValidation {
+    manifest: Manifest | ManifestUnusable;
+    /** The rubric file's raw bytes — what `publish-protocol` anchors when the file is already pinned. */
+    bytes: Uint8Array;
+    /** sha256 of `bytes` — the id it is anchored under unless publish has to repin `claimSchema`. */
+    rubricId: string;
+    /** The rubric's own `claimSchema` block, for the caller's summary lines. */
+    claimSchema: {
+        protocol: string;
+        proof: string;
+    };
+    /** The proof actually sent as the form's live one. */
+    live: string;
+    doc: RubricDoc;
+}
+/** The slice of the envelope this command reads. Legality is the ENGINE's call, never ours. */
+export interface RubricDoc {
+    rubric: {
+        claimSchema: {
+            protocol: string;
+            proof: string;
+        };
+        gates?: unknown[];
+        scoring?: {
+            criteria: unknown[];
+        };
+        review?: {
+            tasks?: unknown[];
+        };
+    };
+}
+/**
+ * The one call: `POST <engine>/v1/rubrics/manifest` with both documents by value. Public on the
+ * engine (no invocation), so this works from a machine that holds no oracle identity at all.
+ * Throws on anything that is not a 200 the engine's own contract can parse — an unreachable engine
+ * and a refused call are the same class of answer: "we don't know yet", never "unusable".
+ */
+export declare function rubricValidate(opts: RubricValidateOptions): Promise<RubricValidation>;
+/** The warnings the old authoring script earned the hard way — none of them make a rubric invalid. */
+export declare function validationWarnings(v: RubricValidation, proofGiven: boolean): string[];
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=rubric-validate.d.ts.map

package/dist/cli/commands/rubric-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubric-validate.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/rubric-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAEL,KAAK,QAAQ,EAEb,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAOhC,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,GAAG,gBAAgB,CAAC;IACtC,qGAAqG;IACrG,KAAK,EAAE,UAAU,CAAC;IAClB,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE;QACN,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACjD,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;SAAE,CAAC;QAClC,MAAM,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAA;SAAE,CAAC;KAChC,CAAC;CACH;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoC3F;AAED,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE,CAmBrF;AAED,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4FzD"}

package/dist/cli/commands/rubric-validate.js

@@ -0,0 +1,163 @@
+/**
+ * `decision-oracle rubric validate` — the authoring safety net. Sends a rubric and the claim form it
+ * binds against to the ENGINE, which parses it with its own schema and binds it with its own
+ * binder, and prints the work order that comes back (what an oracle will have to produce for it).
+ * This package never parses a rubric itself — the engine owns that format — so validation is one
+ * public HTTP call, not a copy of the engine's schema.
+ *
+ *   decision-oracle rubric validate --rubric <rubric.json> --form <form.json> [--proof <chain #vct proof>]
+ *     [--json] [--engine-url <url>] [--network devnet|testnet|mainnet] [--env-file <path>]
+ *
+ * Exit codes: 0 valid + binds · 2 the engine reports it unusable (its issues are printed) · 1 the
+ * engine refused the call or is unreachable, or a source is refused (its audience is not its
+ * endpoint's did:web — an ERROR line) · 64 usage.
+ *
+ * A rubric's id is sha256 of the bytes anchored, and `publish-protocol` anchors THIS FILE verbatim
+ * when its `claimSchema` already pins the protocol it is going on and that protocol's live `#vct`
+ * proof — so a pinned, validated file anchors under the id printed here, and re-formatting it
+ * changes that id. When publish has to repin `claimSchema` (a placeholder proof, another protocol),
+ * it re-serializes the patched document as `JSON.stringify(doc, null, 2)` and THAT is the id
+ * instead. Both rules are printed below.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { isManifestUnusable, ManifestResponse, } from "../../lib/engine/types.js";
+import { parse, UsageError } from "../lib/args.js";
+import { resolveNetwork } from "../lib/chain.js";
+import { tryProjectConfig } from "../lib/devvars.js";
+import { engineUrlFor, summarizeManifest } from "../lib/engine.js";
+import { audienceMismatch, extCallLines } from "../lib/workorder.js";
+/**
+ * The one call: `POST <engine>/v1/rubrics/manifest` with both documents by value. Public on the
+ * engine (no invocation), so this works from a machine that holds no oracle identity at all.
+ * Throws on anything that is not a 200 the engine's own contract can parse — an unreachable engine
+ * and a refused call are the same class of answer: "we don't know yet", never "unusable".
+ */
+export async function rubricValidate(opts) {
+    const rubricBytes = new Uint8Array(readFileSync(resolve(opts.rubricPath)));
+    const doc = JSON.parse(new TextDecoder().decode(rubricBytes));
+    const claimSchema = doc.rubric?.claimSchema;
+    if (!claimSchema)
+        throw new Error(`${opts.rubricPath} has no rubric.claimSchema block`);
+    const live = opts.proof ?? claimSchema.proof;
+    const formDoc = JSON.parse(readFileSync(resolve(opts.formPath), "utf8"));
+    const url = `${opts.engineUrl}/v1/rubrics/manifest`;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify({ rubric: { doc }, form: { doc: formDoc, proof: live } }),
+        });
+    }
+    catch (err) {
+        throw new Error(`engine unreachable at ${opts.engineUrl} — is it running? (${err instanceof Error ? err.message : String(err)})`);
+    }
+    if (!res.ok) {
+        throw new Error(`engine answered ${res.status} from ${url}: ${(await res.text()).slice(0, 300)}`);
+    }
+    const manifest = ManifestResponse.parse(await res.json());
+    return {
+        manifest,
+        bytes: rubricBytes,
+        rubricId: createHash("sha256").update(rubricBytes).digest("hex"),
+        claimSchema,
+        live,
+        doc,
+    };
+}
+/** The warnings the old authoring script earned the hard way — none of them make a rubric invalid. */
+export function validationWarnings(v, proofGiven) {
+    const warnings = [];
+    const pinned = v.claimSchema.proof;
+    if (/replace|todo|placeholder/i.test(pinned) || pinned.length < 16) {
+        warnings.push(`claimSchema.proof looks like a placeholder ("${pinned}") — set it to the chain's #vct proof (rubric fetch-form prints it)`);
+    }
+    if (!proofGiven) {
+        warnings.push("proof not checked against chain — pass --proof <value from rubric fetch-form> before anchoring");
+    }
+    if (!isManifestUnusable(v.manifest) && v.manifest.formProof.drifted) {
+        warnings.push(`form DRIFT: pinned ${pinned} ≠ live ${v.live} — the engine will report the form as drifted; pin the live value`);
+    }
+    return warnings;
+}
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            rubric: { type: "string" },
+            form: { type: "string" },
+            proof: { type: "string" },
+            json: { type: "boolean" },
+            "engine-url": { type: "string" },
+            network: { type: "string" },
+            "env-file": { type: "string" },
+        },
+    });
+    const rubricPath = values.rubric;
+    const formPath = values.form;
+    if (!rubricPath || !formPath) {
+        throw new UsageError("rubric validate needs --rubric <file> and --form <file>");
+    }
+    const engineUrl = engineUrlFor({
+        network: resolveNetwork(values.network),
+        engineUrl: values["engine-url"],
+        devVars: tryProjectConfig({ envFile: values["env-file"] }),
+    });
+    let validation;
+    try {
+        validation = await rubricValidate({ rubricPath, formPath, proof: values.proof, engineUrl });
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        return 1;
+    }
+    const { manifest, doc } = validation;
+    if (isManifestUnusable(manifest)) {
+        console.error("BIND ISSUES — the engine would decide `unusable` under this rubric:");
+        for (const issue of manifest.issues) {
+            console.error(`  ${issue.code} ${issue.path}: ${issue.message}`);
+        }
+        for (const w of validationWarnings(validation, values.proof !== undefined)) {
+            console.error(`  warning: ${w}`);
+        }
+        return 2;
+    }
+    // A source the oracle will not call (audience ≠ endpoint) fails the gate: no oracle can answer it.
+    const exit = Object.values(manifest.ext).some((s) => audienceMismatch(s) !== null) ? 1 : 0;
+    if (values.json) {
+        console.log(JSON.stringify(manifest, null, 2));
+        return exit;
+    }
+    console.log(exit === 0
+        ? `OK — the engine's schema and binder accept ${rubricPath} against ${formPath}`
+        : `REFUSED — the engine binds ${rubricPath} against ${formPath}, but a source below will never be called (see ERROR)`);
+    console.log(`rubricId (sha256 of the raw file bytes): ${validation.rubricId}`);
+    console.log("  that IS the anchored id while claimSchema already pins the protocol it goes on and that " +
+        "protocol's live #vct proof — publish-protocol uploads this file verbatim. If it has to repin " +
+        "claimSchema, the id becomes sha256 of JSON.stringify(<repinned doc>, null, 2) instead.");
+    console.log(`claimSchema.protocol: ${validation.claimSchema.protocol}`);
+    console.log(`formProof: pinned=${validation.claimSchema.proof} live=${validation.live} drifted=${manifest.formProof.drifted}`);
+    console.log(`gates: ${doc.rubric.gates?.length ?? 0} · criteria: ${doc.rubric.scoring?.criteria.length ?? 0} · review tasks: ${doc.rubric.review?.tasks?.length ?? 0}`);
+    console.log(`engine ${engineUrl}`);
+    console.log(summarizeManifest(manifest));
+    if (manifest.rubricId !== validation.rubricId) {
+        // The engine hashes the document as POSTED (its own serialization), which is neither of the two
+        // ids above — it is an artefact of this call, never something to anchor.
+        console.log("note: the manifest's rubricId is the engine's hash of the document as sent — not an id to anchor; see the rubricId line above");
+    }
+    console.log(`fields read: ${manifest.fields.map((f) => `${f.path}:${f.kind}`).join(", ") || "(none)"}`);
+    console.log(`ctx read: ${manifest.ctx.join(", ") || "(none)"}`);
+    console.log(`derived: ${manifest.derived.map((d) => d.name).join(", ") || "(none)"}`);
+    console.log(`ext sources the oracle must call: ${Object.keys(manifest.ext).join(", ") || "(none)"}`);
+    for (const [name, source] of Object.entries(manifest.ext)) {
+        for (const line of extCallLines(source))
+            console.log(`  ext.${name}: ${line}`);
+    }
+    console.log(`ai checks the oracle must run: ${Object.keys(manifest.ai).join(", ") || "(none)"}`);
+    for (const w of validationWarnings(validation, values.proof !== undefined)) {
+        console.log(`warning: ${w}`);
+    }
+    return exit;
+}
+//# sourceMappingURL=rubric-validate.js.map

package/dist/cli/commands/rubric-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubric-validate.js","sourceRoot":"","sources":["../../../src/cli/commands/rubric-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,kBAAkB,EAElB,gBAAgB,GAEjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAkClE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAc,CAAC;IAC3E,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAC5C,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,kCAAkC,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,sBAAsB,CAAC;IACpD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;SAC/E,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,GAAG,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAE1D,OAAO;QACL,QAAQ;QACR,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAChE,WAAW;QACX,IAAI;QACJ,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,kBAAkB,CAAC,CAAmB,EAAE,UAAmB;IACzE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC;IACnC,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CACX,gDAAgD,MAAM,qEAAqE,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CACX,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CACX,sBAAsB,MAAM,WAAW,CAAC,CAAC,IAAI,mEAAmE,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC/B;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,yDAAyD,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;QACvC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IAEH,IAAI,UAA4B,CAAC;IACjC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC;IACrC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACrF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,mGAAmG;IACnG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,CACT,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,8CAA8C,UAAU,YAAY,QAAQ,EAAE;QAChF,CAAC,CAAC,8BAA8B,UAAU,YAAY,QAAQ,uDAAuD,CACxH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,4CAA4C,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CACT,4FAA4F;QAC1F,+FAA+F;QAC/F,wFAAwF,CAC3F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,yBAAyB,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CACT,qBAAqB,UAAU,CAAC,WAAW,CAAC,KAAK,SAAS,UAAU,CAAC,IAAI,YAAY,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAClH,CAAC;IACF,OAAO,CAAC,GAAG,CACT,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,gBAAgB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,CAC3J,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC9C,gGAAgG;QAChG,yEAAyE;QACzE,OAAO,CAAC,GAAG,CACT,+HAA+H,CAChI,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,gBAAgB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAC3F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CACT,qCAAqC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CACxF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACjG,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/commands/scan.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `decision-oracle scan --collection <id>` — nudge the oracle to scan an enrolled collection now
+ * (`POST /v1/collections/:id/scan`) instead of waiting for its cron tick. Signed as the AuthHub
+ * session `decision-oracle login` saved, which must pass the oracle's read gate (the enroller, or an
+ * address holding the collection's evaluate grant).
+ *
+ *   decision-oracle scan --collection <id> [--network devnet|testnet|mainnet] [--kit <url>] [--env-file <path>]
+ *
+ * Also the rerun path for a claim whose failed ledger row was deleted (create-oracle skill,
+ * "Common mistakes").
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/cli/commands/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzD"}

package/dist/cli/commands/scan.js

@@ -0,0 +1,39 @@
+/**
+ * `decision-oracle scan --collection <id>` — nudge the oracle to scan an enrolled collection now
+ * (`POST /v1/collections/:id/scan`) instead of waiting for its cron tick. Signed as the AuthHub
+ * session `decision-oracle login` saved, which must pass the oracle's read gate (the enroller, or an
+ * address holding the collection's evaluate grant).
+ *
+ *   decision-oracle scan --collection <id> [--network devnet|testnet|mainnet] [--kit <url>] [--env-file <path>]
+ *
+ * Also the rerun path for a claim whose failed ledger row was deleted (create-oracle skill,
+ * "Common mistakes").
+ */
+import { parse, UsageError } from "../lib/args.js";
+import { resolveNetwork } from "../lib/chain.js";
+import { oracleUrlFor, tryProjectConfig } from "../lib/devvars.js";
+import { kitFetch, loadSession } from "../lib/session.js";
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            collection: { type: "string" },
+            network: { type: "string" },
+            kit: { type: "string" },
+            "env-file": { type: "string" },
+        },
+    });
+    const collectionId = values.collection;
+    if (!collectionId)
+        throw new UsageError("scan needs --collection <id>");
+    const kitUrl = oracleUrlFor({
+        kit: values.kit,
+        devVars: tryProjectConfig({ envFile: values["env-file"] }),
+    });
+    const session = await loadSession(resolveNetwork(values.network));
+    const path = `/v1/collections/${encodeURIComponent(collectionId)}/scan`;
+    const { res, did } = await kitFetch(session, kitUrl, path);
+    console.log(`scan as ${did} → ${kitUrl}${path}`);
+    console.log(`${res.status} ${await res.text()}`);
+    return res.ok ? 0 : 1;
+}
+//# sourceMappingURL=scan.js.map

package/dist/cli/commands/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC/B;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAExE,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,mBAAmB,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC;IAExE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/cli/commands/skills.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `decision-oracle skills sync` — re-copy the skills shipped with the installed package into a
+ * project's `.claude/skills/`. Upgrading the package is what changes them, so this is how a
+ * provider picks up a rewritten runbook without re-running `init`.
+ */
+export interface SkillsSyncOptions {
+    dir: string;
+}
+/** Returns the skills refreshed — everything else in the directory is left alone. */
+export declare function runSkillsSync({ dir }: SkillsSyncOptions): Promise<string[]>;
+//# sourceMappingURL=skills.d.ts.map

package/dist/cli/commands/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/skills.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQjF"}

package/dist/cli/commands/skills.js

@@ -0,0 +1,19 @@
+/**
+ * `decision-oracle skills sync` — re-copy the skills shipped with the installed package into a
+ * project's `.claude/skills/`. Upgrading the package is what changes them, so this is how a
+ * provider picks up a rewritten runbook without re-running `init`.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { copySkills, packageRoot } from "../lib/project.js";
+/** Returns the skills refreshed — everything else in the directory is left alone. */
+export async function runSkillsSync({ dir }) {
+    const from = join(packageRoot(), "skills");
+    copySkills(from, resolve(dir));
+    // `reference/` ships beside the skills as shared background and is copied like everything else,
+    // but it is not a skill — only a directory with a SKILL.md is one, and only those are reported.
+    return readdirSync(from, { withFileTypes: true })
+        .filter((e) => e.isDirectory() && existsSync(join(from, e.name, "SKILL.md")))
+        .map((e) => e.name);
+}
+//# sourceMappingURL=skills.js.map

package/dist/cli/commands/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../../src/cli/commands/skills.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMzD,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAE,GAAG,EAAqB;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3C,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gGAAgG;IAChG,gGAAgG;IAChG,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/cli/commands/submit-claim.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `decision-oracle submit-claim` — submit a claim into a collection as the AuthHub session: the
+ * SUBMITTER's side of the loop, the way the portal does it, so a freshly wired collection can be
+ * exercised end to end without the portal.
+ *
+ *   decision-oracle submit-claim --collection <id> --answers <answers.json> \
+ *     [--file <question>=<path> …] [--network devnet] [--yes]
+ *
+ * Three steps, the first two gated together and the third on its own (lib/chain.ts `confirm`):
+ *   1. every `--file` → claim-bot `POST /media/upload` (session UCAN) → the `mediaAttachment`
+ *      content the pull lane resolves to an attachment descriptor (src/lib/ixo/attachments.ts);
+ *      it lands in the answers as the SurveyJS file answer `[{ name, type, content }]`
+ *   2. the answers → claim-bot `save-claim` into the collection ENTITY's room
+ *      (`matrixBots().saveClaim`) → the returned cid IS the claimId
+ *   3. `MsgExec(MsgSubmitClaim{ collectionId, claimId, agentDid, agentAddress, adminAddress })`
+ *      signed by the session — which must hold a `SubmitClaimAuthorization` from the collection's
+ *      admin (`create-collection --submit`, or the portal); `useIntent` false, no custom amount.
+ *
+ * The body is stored as the plain answers object (no VC wrap) — the pull lane takes either.
+ * Deliberately dumb: no prerequisite checking beyond the collection existing; a missing grant or
+ * room surfaces as the chain/bot error. Then `decision-oracle scan --collection <id>` (or the cron)
+ * picks it up.
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=submit-claim.d.ts.map

package/dist/cli/commands/submit-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submit-claim.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/submit-claim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkCH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8HzD"}

package/dist/cli/commands/submit-claim.js

@@ -0,0 +1,155 @@
+/**
+ * `decision-oracle submit-claim` — submit a claim into a collection as the AuthHub session: the
+ * SUBMITTER's side of the loop, the way the portal does it, so a freshly wired collection can be
+ * exercised end to end without the portal.
+ *
+ *   decision-oracle submit-claim --collection <id> --answers <answers.json> \
+ *     [--file <question>=<path> …] [--network devnet] [--yes]
+ *
+ * Three steps, the first two gated together and the third on its own (lib/chain.ts `confirm`):
+ *   1. every `--file` → claim-bot `POST /media/upload` (session UCAN) → the `mediaAttachment`
+ *      content the pull lane resolves to an attachment descriptor (src/lib/ixo/attachments.ts);
+ *      it lands in the answers as the SurveyJS file answer `[{ name, type, content }]`
+ *   2. the answers → claim-bot `save-claim` into the collection ENTITY's room
+ *      (`matrixBots().saveClaim`) → the returned cid IS the claimId
+ *   3. `MsgExec(MsgSubmitClaim{ collectionId, claimId, agentDid, agentAddress, adminAddress })`
+ *      signed by the session — which must hold a `SubmitClaimAuthorization` from the collection's
+ *      admin (`create-collection --submit`, or the portal); `useIntent` false, no custom amount.
+ *
+ * The body is stored as the plain answers object (no VC wrap) — the pull lane takes either.
+ * Deliberately dumb: no prerequisite checking beyond the collection existing; a missing grant or
+ * room surfaces as the chain/bot error. Then `decision-oracle scan --collection <id>` (or the cron)
+ * picks it up.
+ */
+import { readFile } from "node:fs/promises";
+import { basename, extname } from "node:path";
+import { NETWORKS } from "../../networks.js";
+import { parse } from "../lib/args.js";
+import { broadcast, confirm, fail, matrixBots, resolveCollectionById, resolveNetwork, STANDARD_FEE, } from "../lib/chain.js";
+import { buildSigner } from "../lib/session.js";
+const MEDIA_TYPES = {
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".png": "image/png",
+    ".webp": "image/webp",
+    ".pdf": "application/pdf",
+};
+/** `--file q=path`, repeatable. */
+function fileArgs(specs) {
+    return specs.map((spec) => {
+        const eq = spec.indexOf("=");
+        if (eq < 1)
+            fail(`--file ${spec}: expected <question>=<path>`);
+        return { question: spec.slice(0, eq), path: spec.slice(eq + 1) };
+    });
+}
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            collection: { type: "string" },
+            answers: { type: "string" },
+            file: { type: "string", multiple: true },
+            network: { type: "string" },
+            yes: { type: "boolean" },
+        },
+    });
+    const collectionId = values.collection ?? fail("--collection <id> is required");
+    const answersPath = values.answers ?? fail("--answers <answers.json> is required");
+    const network = resolveNetwork(values.network);
+    const yes = values.yes === true;
+    const files = fileArgs(values.file ?? []);
+    const answers = JSON.parse(await readFile(answersPath, "utf8"));
+    const collection = (await resolveCollectionById(NETWORKS[network].blocksync, collectionId)) ??
+        fail(`collection ${collectionId} not found on ${network} blocksync`);
+    const entityDid = collection.entity ?? fail(`collection ${collectionId} has no entity`);
+    const adminAddress = collection.admin ?? fail(`collection ${collectionId} has no admin`);
+    const signer = await buildSigner(network);
+    console.log(`submitter: ${signer.address} (${network})`);
+    confirm({
+        network,
+        signer: signer.did,
+        action: "upload attachments + save the claim body to the collection's room (claim bot)",
+        lines: [
+            `collection: ${collectionId} (entity ${entityDid})`,
+            `answers: ${Object.keys(answers).join(", ")}`,
+            `files: ${files.map((f) => `${f.question}=${f.path}`).join(", ") || "(none)"}`,
+            "mints a self-signed UCAN (the AuthHub session's edSigningMnemonic) for the claim bot",
+        ],
+    }, yes);
+    const bots = await matrixBots(signer);
+    const { claimBot } = await bots.urls(entityDid);
+    const ucan = await bots.ucan(entityDid, "claimBot");
+    for (const { question, path } of files) {
+        const name = basename(path);
+        const type = MEDIA_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream";
+        const form = new FormData();
+        form.append("collection", collectionId);
+        form.append("file", new File([await readFile(path)], name, { type }));
+        const res = await fetch(`${claimBot}/media/upload`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${ucan}`, "x-auth-type": "ucan" },
+            body: form,
+        });
+        if (!res.ok)
+            fail(`media upload ${name}: ${res.status} ${await res.text()}`);
+        const { data } = (await res.json());
+        const cid = data?.cid ?? fail(`media upload ${name} returned no cid`);
+        // The portal's `mediaAttachment` content, verbatim (its matrixClaims.ts `uploadFile`).
+        answers[question] = [
+            {
+                name,
+                type,
+                content: JSON.stringify({
+                    id: `{id}#${cid}`,
+                    type: "mediaAttachment",
+                    proof: cid,
+                    encrypted: true,
+                    mediaType: type,
+                    description: "",
+                    serviceEndpoint: `${claimBot}/media/collections/${collectionId}/${cid}`,
+                }),
+            },
+        ];
+        console.log(`✓ uploaded ${name} → ${cid}`);
+    }
+    const saved = await bots.saveClaim(entityDid, collectionId, answers);
+    const claimId = saved.data.cid;
+    console.log(`✓ claim body saved to the collection room: claimId ${claimId}`);
+    const { cosmos, ixo } = await import("@ixo/impactxclient-sdk");
+    const msg = {
+        typeUrl: "/cosmos.authz.v1beta1.MsgExec",
+        value: cosmos.authz.v1beta1.MsgExec.fromPartial({
+            grantee: signer.address,
+            msgs: [
+                {
+                    typeUrl: "/ixo.claims.v1beta1.MsgSubmitClaim",
+                    value: ixo.claims.v1beta1.MsgSubmitClaim.encode(ixo.claims.v1beta1.MsgSubmitClaim.fromPartial({
+                        collectionId,
+                        claimId,
+                        agentDid: signer.did,
+                        agentAddress: signer.address,
+                        adminAddress,
+                        useIntent: false,
+                        amount: [],
+                    })).finish(),
+                },
+            ],
+        }),
+    };
+    confirm({
+        network,
+        signer: signer.address,
+        action: "MsgExec(MsgSubmitClaim)",
+        lines: [`collection: ${collectionId}`, `claimId: ${claimId}`, `admin: ${adminAddress}`],
+        fee: STANDARD_FEE,
+    }, yes);
+    const { hash } = await broadcast(signer, [msg], "submit-claim");
+    console.log(`✓ claim submitted (tx ${hash})`);
+    console.log("\n════ claim ════");
+    console.log(`collection : ${collectionId}`);
+    console.log(`claimId    : ${claimId}`);
+    console.log(`submitter  : ${signer.did}`);
+    console.log(`next       : decision-oracle scan --collection ${collectionId}   (or wait for the cron)\n`);
+    return 0;
+}
+//# sourceMappingURL=submit-claim.js.map