@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/routes/v1/shared.js

@@ -0,0 +1,229 @@
+/**
+ * What the v1 route files share: the gates every collection-scoped read/write runs, and the
+ * row → response projections (dates as ISO strings, and nothing that shouldn't leave).
+ */
+import { eq, getTableColumns, sql } from "drizzle-orm";
+import { watchedCollections, } from "../../db/schema.js";
+import { AppError } from "../../lib/errors.js";
+import { hasEvaluateGrant } from "../../lib/ixo/authz.js";
+import { getClaimById, getCollection, getEntityOwner } from "../../lib/ixo/blocksync/index.js";
+import { readCache } from "../../lib/metrics.js";
+import { liveReviewerGrants } from "../../lib/review/reviewer-grant.js";
+/** How long the read gate trusts a chain-owner read (F2: ≤ 5 min, like the grant read beside it). */
+const OWNER_CACHE_TTL_SEC = 300;
+/** A claim's submitter never changes on chain, so its read is cached long (a portal polls it). */
+const AGENT_CACHE_TTL_SEC = 86_400;
+/**
+ * Who may READ (and scan) a watched collection — the same surface that may register it, as the
+ * chain says it is NOW (ownership review F2): the current chain owner (who pays the fees), or any
+ * holder of an active on-chain `EvaluateClaimAuthorization` for it (the portal's "Grant Role" flow —
+ * the enroller included, but only while it is still hired). Never the row's memory alone: an
+ * ex-owner or a revoked enroller reads nothing. `reviewers` also lets in a live reviewer of the
+ * collection (company authority D2) — on the claim and review reads they answer from, not on scan.
+ * `agentOf` lets in the named claim's own SUBMITTER (its on-chain agent) — on that one claim's
+ * record only, never the list, reviews, pause/resume or scan; `asAgent` says that is the only
+ * door that opened, so the route can keep others' answers back. It is tried last: the readers above
+ * never pay its Blocksync read, and an outage there is a 503, never a grant.
+ * The chain reads are KV-cached: a stale answer costs a reader five minutes, not a registration.
+ * 404 (not 403) when we don't watch it at all, on purpose: the portal needs to tell "not hired"
+ * apart from "no rights". Returns the gate's projection (callers need cursor/status).
+ */
+export async function assertCanRead(c, collectionId, opts = {}) {
+    const watched = await watchedOr404(c, collectionId);
+    const asAgent = await assertReader(c, watched, opts);
+    return { ...watched, asAgent };
+}
+/**
+ * Who may PAUSE or RESUME a watched collection: the chain owner, an `ORACLE_ADMIN_DIDS` invoker, or the
+ * current enroller WHILE it still holds a live evaluate grant (a revoked enroller is no longer
+ * hired, whatever the row remembers). A plain grant holder may read it but not stall it or lift a
+ * stop — a competing oracle hired on the same collection holds a grant by definition, so either
+ * direction would hand it the collection. 404 unwatched, 403 otherwise. The owner is the row's
+ * `ownerDid` (the chain owner, resolved at register; an entity transfer needs a re-register), so
+ * this costs no chain read beyond the read gate's KV-cached grant read.
+ */
+export async function assertCanManage(c, collectionId) {
+    const { did, address } = c.get("principal");
+    const watched = await watchedOr404(c, collectionId);
+    // F2 residual: the owner is the row's `ownerDid` (as of register), not the chain owner now.
+    if (did === watched.ownerDid || c.get("config").ORACLE_ADMIN_DIDS.includes(did))
+        return watched;
+    const holds = await holdsGrant(c, address, collectionId);
+    if (holds && did === watched.enrolledByDid)
+        return watched;
+    if (!holds && did !== watched.enrolledByDid) {
+        throw AppError.forbidden("Evaluate rights on this collection are required to access it");
+    }
+    throw AppError.forbidden(`Only the owner of collection ${collectionId}, whoever registered it (while it holds an evaluate grant), or an operator may pause or resume it`);
+}
+/**
+ * Who may change a watched collection's SETTINGS (company authority D7) or erase its claims' data
+ * (F14): its CURRENT chain owner only — no enroller, grant holder or operator, since these are the
+ * owner's say over money and data on their collection. Read live off the chain (the collection's entity → its owner), never
+ * the row's `ownerDid`, which an entity transfer leaves stale until a re-register. 404 unwatched,
+ * 403 otherwise; chain trouble throws (a 503), never a silent "not the owner". Answers the owner's
+ * address too: a setting records who set it, so the act lane can tell when the owner has changed.
+ */
+export async function assertChainOwner(c, collectionId, 
+/** What the refusal says the owner alone may do. */
+what = "change its settings") {
+    const watched = await watchedOr404(c, collectionId);
+    const deps = { config: c.get("config"), trace: c.get("trace") };
+    const collection = await getCollection(deps, collectionId);
+    const owner = collection?.entity ? await getEntityOwner(deps, collection.entity) : null;
+    if (!owner || owner !== c.get("principal").address) {
+        throw AppError.forbidden(`Only the owner of collection ${collectionId} on chain may ${what}`);
+    }
+    return { ...watched, owner };
+}
+const holdsGrant = (c, address, collectionId) => hasEvaluateGrant({ config: c.get("config"), trace: c.get("trace"), cache: c.env.CACHE_KV }, address, collectionId);
+/**
+ * What the gates read off the row — never the whole row: it carries the owner's delegation CAR (up
+ * to 64 KB), which no identity or status check needs.
+ */
+const gateColumns = {
+    collectionId: watchedCollections.collectionId,
+    ownerDid: watchedCollections.ownerDid,
+    enrolledByDid: watchedCollections.enrolledByDid,
+    status: watchedCollections.status,
+    cursor: watchedCollections.cursor,
+};
+export async function watchedOr404(c, collectionId) {
+    const db = await c.var.db();
+    const [watched] = await db
+        .select(gateColumns)
+        .from(watchedCollections)
+        .where(eq(watchedCollections.collectionId, collectionId));
+    if (!watched) {
+        throw AppError.notFound(`Collection ${collectionId} is not watched by this oracle`);
+    }
+    return watched;
+}
+/** Throws unless the invoker may read; true when only `agentOf` let them in. */
+async function assertReader(c, watched, { reviewers, agentOf }) {
+    const { did, address } = c.get("principal");
+    const { collectionId } = watched;
+    if (await holdsGrant(c, address, collectionId))
+        return false;
+    if ((await liveOwner(c, collectionId)) === address)
+        return false;
+    if (reviewers && (await isLiveReviewer(c, collectionId, did)))
+        return false;
+    if (agentOf && (await isClaimAgent(c, agentOf, collectionId)))
+        return true;
+    throw AppError.forbidden("Only the collection's owner, an evaluator it hired, or a reviewer it granted may access it");
+}
+/**
+ * The invoker submitted `claimId` to `collectionId` on chain — matched by EITHER the claim's
+ * Blocksync `agentDid` or its `agentAddress`. Neither `claim_ingests` nor `decisions` stores the
+ * agent (only the duplicate registries do, and only when a rubric declares `unique`), so this is one
+ * Blocksync read, KV-cached by claim since the submitter is immutable. The cache holds the claim's
+ * own collection, compared here at read time, so it never depends on the request that filled it. A
+ * claim Blocksync does not know is not cached: it may just not be indexed yet.
+ */
+async function isClaimAgent(c, claimId, collectionId) {
+    const key = `claim-agent:${claimId}`;
+    const cached = await readCache("claim-agent", () => c.env.CACHE_KV.get(key));
+    let agent = cached ? JSON.parse(cached) : null;
+    if (!agent) {
+        const claim = await getClaimById({ config: c.get("config"), trace: c.get("trace") }, claimId);
+        if (!claim)
+            return false;
+        agent = { collectionId: claim.collectionId, did: claim.agentDid, address: claim.agentAddress };
+        await c.env.CACHE_KV.put(key, JSON.stringify(agent), {
+            expirationTtl: AGENT_CACHE_TTL_SEC,
+        }).catch(() => { });
+    }
+    const { did, address } = c.get("principal");
+    return (agent.collectionId === collectionId &&
+        ((!!agent.did && agent.did === did) || (!!agent.address && agent.address === address)));
+}
+/** The collection entity's owner address on chain, cached `OWNER_CACHE_TTL_SEC`; null = none. */
+async function liveOwner(c, collectionId) {
+    const key = `owner:${collectionId}`;
+    const cached = await readCache("owner", () => c.env.CACHE_KV.get(key));
+    if (cached !== null)
+        return cached || null;
+    const deps = { config: c.get("config"), trace: c.get("trace") };
+    const collection = await getCollection(deps, collectionId);
+    const owner = collection?.entity ? await getEntityOwner(deps, collection.entity) : null;
+    await c.env.CACHE_KV.put(key, owner ?? "", { expirationTtl: OWNER_CACHE_TTL_SEC }).catch(() => { });
+    return owner;
+}
+/**
+ * A grant to `did` on the collection that stands now (`liveReviewerGrants`): unrevoked, in its
+ * window, and from a root still controlling the collection's entity — read live, so a controller
+ * removed on chain takes their reviewers' reads with them at once. Blocksync down is a 503.
+ */
+async function isLiveReviewer(c, collectionId, did) {
+    const live = await liveReviewerGrants({ config: c.get("config"), trace: c.get("trace") }, await c.var.db(), collectionId, { memberDid: did });
+    return live.length > 0;
+}
+/**
+ * The watched row as the API returns it, selected without the delegation CAR: the CAR never leaves
+ * (the read path is its only consumer), and `hasDelegation` + the expiry tell the owner everything
+ * they can act on — computed in SQL, so a list never loads a 64 KB column per row to test it.
+ */
+const { delegationCar, ...viewColumns } = getTableColumns(watchedCollections);
+export const collectionColumns = {
+    ...viewColumns,
+    hasDelegation: sql `${delegationCar} IS NOT NULL`.mapWith(Boolean),
+};
+/** A full row (the register route's) as a `CollectionView`. */
+export function viewOf({ delegationCar: car, ...rest }) {
+    return { ...rest, hasDelegation: car !== null };
+}
+export function collectionBody(row) {
+    return {
+        ...row,
+        delegationExpiresAt: row.delegationExpiresAt?.toISOString() ?? null,
+        lastScannedAt: row.lastScannedAt?.toISOString() ?? null,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+    };
+}
+export function ingestBody(row) {
+    return {
+        status: row.status,
+        instanceId: row.instanceId,
+        error: row.error,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+    };
+}
+/** The engine's answer verbatim — codes, scores and identifiers; the row never held answer values. */
+export function decisionBody(row) {
+    return {
+        rubricId: row.rubricId,
+        factsDigest: row.factsDigest,
+        verdict: row.verdict,
+        status: row.status,
+        resultDigest: row.resultDigest,
+        receiptCid: row.receiptCid,
+        receiptJws: row.receiptJws,
+        decision: row.decision,
+        explanation: row.explanation,
+        chainStatus: row.chainStatus,
+        txHash: row.txHash,
+        chainError: row.chainError,
+        /** Which facts errored and why (engine `erroredFacts`) — null when none did. */
+        erroredFacts: row.erroredFacts,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+    };
+}
+export function reviewBody(row) {
+    return {
+        answers: row.answers,
+        reviewerDid: row.reviewerDid,
+        /** Whether `reviewerDid` is backed by the reviewer's own signature (design §B.3). The JWS
+         *  itself never leaves: it carries the answer VALUES signed, and a read route has no business
+         *  handing that to anyone who can read the collection. */
+        signed: row.attestationJws !== null,
+        answeredAt: row.answeredAt.toISOString(),
+        foldedAt: row.foldedAt?.toISOString() ?? null,
+        /** Why the fold did not land (e.g. the engine's STALE_REVIEW) — null until it fails, cleared by a re-POST. */
+        foldError: row.foldError,
+    };
+}
+//# sourceMappingURL=shared.js.map

package/dist/routes/v1/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/routes/v1/shared.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAKL,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,qGAAqG;AACrG,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,CAAa,EACb,YAAoB,EACpB,IAAI,GAA8C,EAAE;IAEpD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAa,EAAE,YAAoB;IACvE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,4FAA4F;IAC5F,IAAI,GAAG,KAAK,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAChG,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,GAAG,KAAK,OAAO,CAAC,aAAa;QAAE,OAAO,OAAO,CAAC;IAC3D,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,QAAQ,CAAC,SAAS,CAAC,8DAA8D,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,CAAC,SAAS,CACtB,gCAAgC,YAAY,mGAAmG,CAChJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,CAAa,EACb,YAAoB;AACpB,oDAAoD;AACpD,IAAI,GAAG,qBAAqB;IAE5B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;QACnD,MAAM,QAAQ,CAAC,SAAS,CAAC,gCAAgC,YAAY,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,OAAe,EAAE,YAAoB,EAAE,EAAE,CAC1E,gBAAgB,CACd,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EACzE,OAAO,EACP,YAAY,CACb,CAAC;AAEJ;;;GAGG;AACH,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,kBAAkB,CAAC,YAAY;IAC7C,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;IACrC,aAAa,EAAE,kBAAkB,CAAC,aAAa;IAC/C,MAAM,EAAE,kBAAkB,CAAC,MAAM;IACjC,MAAM,EAAE,kBAAkB,CAAC,MAAM;CAClC,CAAC;AAGF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAa,EAAE,YAAoB;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,WAAW,CAAC;SACnB,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,YAAY,gCAAgC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,YAAY,CACzB,CAAa,EACb,OAAoB,EACpB,EAAE,SAAS,EAAE,OAAO,EAA6C;IAEjE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACjC,IAAI,MAAM,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,SAAS,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,OAAO,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,QAAQ,CAAC,SAAS,CACtB,4FAA4F,CAC7F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CACzB,CAAa,EACb,OAAe,EACf,YAAoB;IAEpB,MAAM,GAAG,GAAG,eAAe,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,GAAsB,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,KAAK,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QAC/F,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACnD,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,CACL,KAAK,CAAC,YAAY,KAAK,YAAY;QACnC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CACvF,CAAC;AACJ,CAAC;AAID,iGAAiG;AACjG,KAAK,UAAU,SAAS,CAAC,CAAa,EAAE,YAAoB;IAC1D,MAAM,GAAG,GAAG,SAAS,YAAY,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,IAAI,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC,KAAK,CACtF,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,CAAa,EAAE,YAAoB,EAAE,GAAW;IAC5E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CACnC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAClD,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAChB,YAAY,EACZ,EAAE,SAAS,EAAE,GAAG,EAAE,CACnB,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,GAAG,WAAW;IACd,aAAa,EAAE,GAAG,CAAS,GAAG,aAAa,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;CAC3E,CAAC;AAGF,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,EAAqB;IACvE,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAmB;IAChD,OAAO;QACL,GAAG,GAAG;QACN,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,WAAW,EAAE,IAAI,IAAI;QACnE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,IAAI;QACvD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAgB;IACzC,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,gFAAgF;QAChF,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAgB;IACzC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B;;kEAE0D;QAC1D,MAAM,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI;QACnC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,IAAI;QAC7C,8GAA8G;QAC9G,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC"}

package/dist/routes/well-known.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `GET /.well-known/did.json` — this oracle's did:web document, so callers (the portal, the eval
+ * engine, every IXO service) can resolve the audience their invocations must target. Public. Derived
+ * from SERVICE_ED25519_MNEMONIC + ORACLE_HOSTNAME (memoized), exactly like the engine/store/bot
+ * serve theirs.
+ *
+ * `GET /.well-known/oauth-protected-resource/v1/mcp` — RFC 9728 metadata for the hosted MCP server
+ * (MCP over OAuth, spec 2026-10-06): an AI client that met `/v1/mcp`'s 401 reads it to find AuthHub.
+ * Public, cacheable, readable from any origin (AuthHub and the console fetch it); only with the API
+ * lane on, since `/v1/mcp` exists only then.
+ */
+import { Hono } from "hono";
+import type { AppEnv } from "../context.js";
+export declare const wellKnown: Hono<AppEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=well-known.d.ts.map

package/dist/routes/well-known.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/routes/well-known.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAKzC,eAAO,MAAM,SAAS,qDAAqB,CAAC"}

package/dist/routes/well-known.js

@@ -0,0 +1,35 @@
+/**
+ * `GET /.well-known/did.json` — this oracle's did:web document, so callers (the portal, the eval
+ * engine, every IXO service) can resolve the audience their invocations must target. Public. Derived
+ * from SERVICE_ED25519_MNEMONIC + ORACLE_HOSTNAME (memoized), exactly like the engine/store/bot
+ * serve theirs.
+ *
+ * `GET /.well-known/oauth-protected-resource/v1/mcp` — RFC 9728 metadata for the hosted MCP server
+ * (MCP over OAuth, spec 2026-10-06): an AI client that met `/v1/mcp`'s 401 reads it to find AuthHub.
+ * Public, cacheable, readable from any origin (AuthHub and the console fetch it); only with the API
+ * lane on, since `/v1/mcp` exists only then.
+ */
+import { Hono } from "hono";
+import { AppError } from "../lib/errors.js";
+import { getDIDWeb } from "../lib/ixo/identity.js";
+import { protectedResource } from "../lib/oauth/token.js";
+export const wellKnown = new Hono();
+wellKnown.get("/did.json", async (c) => {
+    const config = c.get("config");
+    if (!config.SERVICE_ED25519_MNEMONIC) {
+        throw AppError.internal("SERVICE_ED25519_MNEMONIC not configured");
+    }
+    const { didDocument } = await getDIDWeb(config.SERVICE_ED25519_MNEMONIC, config.ORACLE_HOSTNAME);
+    return c.json(didDocument);
+});
+wellKnown.get("/oauth-protected-resource/v1/mcp", (c) => {
+    const config = c.get("config");
+    if (!config.API_LANE)
+        throw AppError.notFound("No MCP server on this oracle");
+    // Any origin may read it, with no credentials — the app's CORS echoes allowed origins only.
+    c.header("Access-Control-Allow-Origin", "*");
+    c.res.headers.delete("Access-Control-Allow-Credentials");
+    c.header("Cache-Control", "public, max-age=300");
+    return c.json(protectedResource(config));
+});
+//# sourceMappingURL=well-known.js.map

package/dist/routes/well-known.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/routes/well-known.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAU,CAAC;AAE5C,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE;IACtD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IAC9E,4FAA4F;IAC5F,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACzD,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC"}

package/dist/runtime.d.ts

@@ -0,0 +1,100 @@
+/**
+ * `@ixo/decision-oracle/runtime` — the WORKER-ONLY seam: what a provider calls from inside their own
+ * worker (a route, a queue consumer, their own cron, their own Workflow) when they need the kit to
+ * do something the lanes do not do by themselves.
+ *
+ * Separate from the package root because the root is what a provider's entry module imports and
+ * `/facts` is what their node test suite imports; this subpath pulls in D1, the signer and the
+ * sequence-manager DO, so it can only ever be loaded inside a Worker. It takes `env` rather than
+ * the kit's internal deps for the same reason `defineOracle()` takes a config: the worker's env is
+ * the only thing a provider has in their hand, and everything else — the config, the logger, the
+ * metrics, the trace, the database handle — is assembled from it here exactly as the cron does it
+ * (cron/scan.ts, cron/funding.ts).
+ *
+ * Four functions, today:
+ *   - `signEvaluation` releases a decision the oracle's act policy (src/act.ts) held back.
+ *   - `scanCollection` runs the cron's per-collection discovery pass on demand (a provider's own
+ *     webhook, the moment a claim is submitted, with the cron itself as the backstop that still
+ *     visits every collection on a schedule).
+ *   - `registerCollection` runs the marketplace "hire" handshake (lib/register.ts,
+ *     routes/v1/collections.ts) as a function rather than an HTTP route — for a provider's own
+ *     Workflow that registers a collection AS the oracle's own principal (after minting its own
+ *     evaluate grant), where there is no inbound request to authenticate or body to validate.
+ *   - `broadcastAsOracle` signs and broadcasts arbitrary messages as this oracle's account
+ *     (lib/ixo/chain.ts `getOracleSigner`) — for a provider composing its own `MsgExec` around
+ *     kit-issued messages with the same sequence-managed signer the act lane uses.
+ *
+ * Also re-exports, verbatim, the chain/db plumbing a provider's own Workflow needs to build the
+ * inputs above (a query client, the D1 handle, the config, the schema) — the package's `exports`
+ * block only opens the root, `/facts` and this subpath, so a deep import is not an option.
+ */
+import type { WatchedCollection } from "./db/schema.js";
+import type { OracleEnv } from "./env.js";
+import { type ChainWriteOutcome } from "./lib/ixo/chain-write.js";
+import { type RegisterInput } from "./lib/register.js";
+export type { Config } from "./config.js";
+export { loadConfig } from "./config.js";
+export type { Database } from "./db/client.js";
+export { getDb } from "./db/client.js";
+export type { DecisionRow, WatchedCollection } from "./db/schema.js";
+export { decisions, watchedCollections } from "./db/schema.js";
+export { AppError } from "./lib/errors.js";
+export type { BlocksyncDeps, CollectionNode } from "./lib/ixo/blocksync/index.js";
+export { getCollection } from "./lib/ixo/blocksync/index.js";
+export type { OracleSigner } from "./lib/ixo/chain.js";
+export { getIxoSdk, getOracleSigner, getQueryClient } from "./lib/ixo/chain.js";
+export type { ChainWriteOutcome } from "./lib/ixo/chain-write.js";
+export type { RegisterInput } from "./lib/register.js";
+/**
+ * Sign a decision the act policy `held` — the release pass (lib/ixo/chain-write.ts). `amount` is
+ * the payout to put on `MsgEvaluateClaim`, denom included: the provider owns that choice, which is
+ * the whole point of holding (a payout pooled across several claims). Omitted ⇒ the lane's own
+ * default (the claim's coins); ignored on an intent claim, where the escrow governs.
+ *
+ * Every guard of the lane still applies, so this is safe to call twice: an already-`submitted` row
+ * answers `"skipped"`, never a second signature.
+ */
+export declare function signEvaluation(env: OracleEnv, claimId: string, amount?: {
+    denom: string;
+    amount: string;
+}): Promise<ChainWriteOutcome>;
+/**
+ * Run the cron's per-collection discovery pass (cron/collection.ts `processCollection`) for ONE
+ * collection, right now — the webhook counterpart to `runCronTick` (cron/scan.ts), for a provider
+ * who wants to react to a submission immediately rather than wait for the collection's next turn
+ * in the tick's rotation. Builds its `CronCtx` with `cronContext(env)`, the SAME helper the tick
+ * itself uses, so the two share every dedupe/cursor rule: a webhook and the cron racing on one
+ * claim start it exactly once (`filterUnseen` in collection.ts, and `createBatch`'s own
+ * idempotency). Returns the number of instances started.
+ *
+ * Mirrors the HTTP nudge `POST /v1/collections/:collectionId/scan` (routes/v1/collections.ts) —
+ * same notFound/conflict semantics, without the UCAN read gate a route needs and a worker-internal
+ * caller doesn't.
+ */
+export declare function scanCollection(env: OracleEnv, collectionId: string): Promise<number>;
+/**
+ * Register (or re-register) a collection with this oracle — the SAME four gates
+ * (WHO/HIRED/PROTOCOL/PAID), delegation resolution, upsert and paused→active notice
+ * `POST /v1/collections/register` runs (lib/register.ts, routes/v1/collections.ts), for a
+ * provider's own Workflow registering a collection AS the oracle's own principal (after minting
+ * its own evaluate grant) — there is no inbound request to authenticate or a body to validate.
+ *
+ * `input.cursor` is the one thing the HTTP route never exposes — see `RegisterInput` (lib/register.ts).
+ */
+export declare function registerCollection(env: OracleEnv, input: RegisterInput): Promise<WatchedCollection>;
+/**
+ * Sign and broadcast arbitrary messages as THIS oracle's account (lib/ixo/chain.ts
+ * `getOracleSigner`) — the same sequence-managed signer the act lane uses, for a provider composing
+ * its own `MsgExec` around kit-issued messages. Unlike `signEvaluation`, this is a raw broadcast
+ * primitive, not a decision lane: it does NOT inspect `res.code` — a non-zero code is the caller's
+ * to interpret, for its own message.
+ */
+export declare function broadcastAsOracle(env: OracleEnv, msgs: readonly {
+    typeUrl: string;
+    value: unknown;
+}[], memo?: string): Promise<{
+    code: number;
+    transactionHash: string;
+    rawLog?: string;
+}>;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAGvC,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,gBAAgB,CAAC;AAIxB,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAIpD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAO5B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,EAAE,EACpD,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAOrE"}

package/dist/runtime.js

@@ -0,0 +1,144 @@
+/**
+ * `@ixo/decision-oracle/runtime` — the WORKER-ONLY seam: what a provider calls from inside their own
+ * worker (a route, a queue consumer, their own cron, their own Workflow) when they need the kit to
+ * do something the lanes do not do by themselves.
+ *
+ * Separate from the package root because the root is what a provider's entry module imports and
+ * `/facts` is what their node test suite imports; this subpath pulls in D1, the signer and the
+ * sequence-manager DO, so it can only ever be loaded inside a Worker. It takes `env` rather than
+ * the kit's internal deps for the same reason `defineOracle()` takes a config: the worker's env is
+ * the only thing a provider has in their hand, and everything else — the config, the logger, the
+ * metrics, the trace, the database handle — is assembled from it here exactly as the cron does it
+ * (cron/scan.ts, cron/funding.ts).
+ *
+ * Four functions, today:
+ *   - `signEvaluation` releases a decision the oracle's act policy (src/act.ts) held back.
+ *   - `scanCollection` runs the cron's per-collection discovery pass on demand (a provider's own
+ *     webhook, the moment a claim is submitted, with the cron itself as the backstop that still
+ *     visits every collection on a schedule).
+ *   - `registerCollection` runs the marketplace "hire" handshake (lib/register.ts,
+ *     routes/v1/collections.ts) as a function rather than an HTTP route — for a provider's own
+ *     Workflow that registers a collection AS the oracle's own principal (after minting its own
+ *     evaluate grant), where there is no inbound request to authenticate or body to validate.
+ *   - `broadcastAsOracle` signs and broadcasts arbitrary messages as this oracle's account
+ *     (lib/ixo/chain.ts `getOracleSigner`) — for a provider composing its own `MsgExec` around
+ *     kit-issued messages with the same sequence-managed signer the act lane uses.
+ *
+ * Also re-exports, verbatim, the chain/db plumbing a provider's own Workflow needs to build the
+ * inputs above (a query client, the D1 handle, the config, the schema) — the package's `exports`
+ * block only opens the root, `/facts` and this subpath, so a deep import is not an option.
+ */
+import { loadConfig } from "./config.js";
+import { processCollection } from "./cron/collection.js";
+import { cronContext } from "./cron/scan.js";
+import { getDb } from "./db/client.js";
+import { AppError } from "./lib/errors.js";
+import { getOracleSigner } from "./lib/ixo/chain.js";
+import { signEvaluation as signEvaluationWithDeps, } from "./lib/ixo/chain-write.js";
+import { createLogger } from "./lib/logger.js";
+import { createMetrics } from "./lib/metrics.js";
+import { registerCollection as registerCollectionWithDeps, } from "./lib/register.js";
+import { generateTraceContext } from "./lib/tracing.js";
+import { getOracle } from "./oracle.js";
+export { loadConfig } from "./config.js";
+export { getDb } from "./db/client.js";
+export { decisions, watchedCollections } from "./db/schema.js";
+export { AppError } from "./lib/errors.js";
+export { getCollection } from "./lib/ixo/blocksync/index.js";
+// --- plumbing, verbatim from the modules that assemble it, for a provider's own Workflow ---------
+// No wrappers, no behaviour change — just what a deep import would have reached if the package's
+// `exports` block allowed one.
+export { getIxoSdk, getOracleSigner, getQueryClient } from "./lib/ixo/chain.js";
+/**
+ * Sign a decision the act policy `held` — the release pass (lib/ixo/chain-write.ts). `amount` is
+ * the payout to put on `MsgEvaluateClaim`, denom included: the provider owns that choice, which is
+ * the whole point of holding (a payout pooled across several claims). Omitted ⇒ the lane's own
+ * default (the claim's coins); ignored on an intent claim, where the escrow governs.
+ *
+ * Every guard of the lane still applies, so this is safe to call twice: an already-`submitted` row
+ * answers `"skipped"`, never a second signature.
+ */
+export async function signEvaluation(env, claimId, amount) {
+    const config = loadConfig(env);
+    const trace = generateTraceContext();
+    const logger = createLogger({
+        level: config.LOG_LEVEL,
+        pretty: config.LOG_PRETTY,
+        base: {
+            service: config.SERVICE_NAME,
+            version: config.SERVICE_VERSION,
+            env: config.ENVIRONMENT,
+            traceId: trace.traceId,
+        },
+    });
+    return signEvaluationWithDeps({
+        config,
+        logger,
+        metrics: createMetrics(logger, { dataset: env.METRICS, network: config.IXO_NETWORK }),
+        trace,
+        db: getDb(env),
+        sequenceManager: env.SEQUENCE_MANAGER,
+        cache: env.CACHE_KV,
+        email: env.EMAIL,
+        env,
+    }, claimId, amount);
+}
+/**
+ * Run the cron's per-collection discovery pass (cron/collection.ts `processCollection`) for ONE
+ * collection, right now — the webhook counterpart to `runCronTick` (cron/scan.ts), for a provider
+ * who wants to react to a submission immediately rather than wait for the collection's next turn
+ * in the tick's rotation. Builds its `CronCtx` with `cronContext(env)`, the SAME helper the tick
+ * itself uses, so the two share every dedupe/cursor rule: a webhook and the cron racing on one
+ * claim start it exactly once (`filterUnseen` in collection.ts, and `createBatch`'s own
+ * idempotency). Returns the number of instances started.
+ *
+ * Mirrors the HTTP nudge `POST /v1/collections/:collectionId/scan` (routes/v1/collections.ts) —
+ * same notFound/conflict semantics, without the UCAN read gate a route needs and a worker-internal
+ * caller doesn't.
+ */
+export async function scanCollection(env, collectionId) {
+    const ctx = cronContext(env);
+    const row = await ctx.db.query.watchedCollections.findFirst({
+        where: (t, { eq }) => eq(t.collectionId, collectionId),
+    });
+    if (!row) {
+        throw AppError.notFound(`Collection ${collectionId} is not registered with this oracle`);
+    }
+    if (row.status === "paused") {
+        throw AppError.conflict(`Collection ${collectionId} is paused — resume it first`);
+    }
+    return processCollection(ctx, { collectionId, cursor: row.cursor });
+}
+/**
+ * Register (or re-register) a collection with this oracle — the SAME four gates
+ * (WHO/HIRED/PROTOCOL/PAID), delegation resolution, upsert and paused→active notice
+ * `POST /v1/collections/register` runs (lib/register.ts, routes/v1/collections.ts), for a
+ * provider's own Workflow registering a collection AS the oracle's own principal (after minting
+ * its own evaluate grant) — there is no inbound request to authenticate or a body to validate.
+ *
+ * `input.cursor` is the one thing the HTTP route never exposes — see `RegisterInput` (lib/register.ts).
+ */
+export async function registerCollection(env, input) {
+    const { db, logger, metrics, deps } = cronContext(env);
+    // `deps.config` is `BlocksyncDeps`' narrow slice (cron/collection.ts) — register needs the full
+    // `Config`, reloaded (cached — `cronContext` above already built it once) from `env`, the same
+    // widening `cron/scan.ts`'s `runCronTick` does for the tick size.
+    const config = loadConfig(env);
+    return registerCollectionWithDeps({ config, trace: deps.trace, logger, metrics, db, env }, input);
+}
+/**
+ * Sign and broadcast arbitrary messages as THIS oracle's account (lib/ixo/chain.ts
+ * `getOracleSigner`) — the same sequence-managed signer the act lane uses, for a provider composing
+ * its own `MsgExec` around kit-issued messages. Unlike `signEvaluation`, this is a raw broadcast
+ * primitive, not a decision lane: it does NOT inspect `res.code` — a non-zero code is the caller's
+ * to interpret, for its own message.
+ */
+export async function broadcastAsOracle(env, msgs, memo) {
+    const config = loadConfig(env);
+    if (!config.ORACLE_SECP_MNEMONIC) {
+        throw AppError.unavailable("ORACLE_SECP_MNEMONIC not configured");
+    }
+    const signer = await getOracleSigner(config, env.SEQUENCE_MANAGER);
+    return signer.signAndBroadcast(msgs, memo ?? getOracle().config.name);
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGpC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAEL,cAAc,IAAI,sBAAsB,GACzC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAEL,kBAAkB,IAAI,0BAA0B,GACjD,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,oGAAoG;AACpG,iGAAiG;AACjG,+BAA+B;AAC/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAI7E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAc,EACd,OAAe,EACf,MAA0C;IAE1C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,IAAI,EAAE;YACJ,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,OAAO,EAAE,MAAM,CAAC,eAAe;YAC/B,GAAG,EAAE,MAAM,CAAC,WAAW;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB;KACF,CAAC,CAAC;IACH,OAAO,sBAAsB,CAC3B;QACE,MAAM;QACN,MAAM;QACN,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACrF,KAAK;QACL,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC;QACd,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,KAAK,EAAE,GAAG,CAAC,QAAQ;QACnB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG;KACJ,EACD,OAAO,EACP,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAc,EAAE,YAAoB;IACvE,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC;QAC1D,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,YAAY,qCAAqC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,YAAY,8BAA8B,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAc,EACd,KAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACvD,gGAAgG;IAChG,+FAA+F;IAC/F,kEAAkE;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,0BAA0B,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc,EACd,IAAoD,EACpD,IAAa;IAEb,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}