@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/cli/lib/identity-cards.js

@@ -0,0 +1,261 @@
+/**
+ * The two public cards `oracle init` anchors on the oracle entity — `#dmn` (the domain card the
+ * domain indexer, the portal and the console list) and `#acard` (the Agent Card the portal's
+ * contract flow reads). Pure builders plus the two read-only probes a step's skip decision needs;
+ * no signing, no upload (that is `anchorDoc` in the command, the one path every resource takes).
+ *
+ * Both are VC envelopes around content taken from the RUNNING oracle (`GET <kit-url>/v1/info`), so
+ * "is the live card current?" compares content, never bytes: `validFrom` is the one field that
+ * changes on every build, and it is the one field the comparison ignores.
+ */
+import { Validator } from "@cfworker/json-schema";
+import { readLinkedDoc } from "../../facts/linked-doc.js";
+import { canonicalJson } from "../../lib/hash.js";
+import { AGENT_CARD_SCHEMA_SNAPSHOT } from "./agent-card-schema.js";
+const DOMAIN_CARD_CONTEXT = [
+    "https://www.w3.org/ns/credentials/v2",
+    "https://w3id.org/ixo/context/v1",
+    {
+        attribute: "https://w3id.org/ixo/attributes/v1/",
+        schema: "https://schema.org/",
+        ixo: "https://w3id.org/ixo/vocab/v1",
+        prov: "http://www.w3.org/ns/prov#",
+        proj: "https://linked.data.gov.au/def/project#",
+        xsd: "http://www.w3.org/2001/XMLSchema#",
+        id: "@id",
+        type: "@type",
+        "ixo:vector": { "@container": "@list", "@type": "xsd:double" },
+        "@protected": true,
+    },
+];
+/**
+ * The portal's oracle domain card (impacts-x-web `lib/oracle/entityCreation.ts`
+ * `createDomainCardResource`), field for field, minus the fields an evaluation oracle has no
+ * source for (LLM model, comms style, location). `logo` / `image` appear only with `--logo`: the
+ * portal's own producer writes an empty ImageObject, which the indexer then serves as a
+ * `logo_url` of "" — absent is the honest answer.
+ */
+export function buildDomainCard(src, validFrom = new Date().toISOString()) {
+    const image = (url) => ({ type: "schema:ImageObject", id: url, contentUrl: url });
+    return {
+        "@context": DOMAIN_CARD_CONTEXT,
+        id: `${src.entityDid}#dmn`,
+        type: ["VerifiableCredential", "ixo:DomainCard"],
+        issuer: { id: src.issuerDid },
+        validFrom,
+        credentialSchema: {
+            id: "https://w3id.org/ixo/schemas/ixo-domain-card-1.json",
+            type: "JsonSchema",
+        },
+        credentialSubject: {
+            id: src.entityDid,
+            type: ["ixo:oracle"],
+            additionalType: ["schema:Organization"],
+            name: src.name,
+            description: src.description,
+            url: src.kitUrl,
+            sameAs: [],
+            ...(src.logo ? { logo: image(src.logo), image: [image(src.logo)] } : {}),
+            keywords: ["evaluation oracle"],
+            knowsAbout: ["evaluation oracle"],
+            composition: { type: "schema:Collection", hasPart: [] },
+            makesOffer: [],
+            relationships: { "prov:wasAssociatedWith": [], memberOf: [], funding: [] },
+            agents: [],
+            credentials: [],
+            attributes: [],
+            project: {},
+        },
+    };
+}
+/**
+ * The Agent Card (ixo-oracles-cli `buildAgentCard`; the engine's strict schema, agent-contracts
+ * §A.2), built non-interactively. The schema is closed — no `url` anywhere — so the kit URL lives in
+ * the service text, which is also what the portal shows (`fetchAgentCard` → `parseDisplayCard`
+ * needs `subject.id === entity`, a name, and ≥ 1 service with id/name/deliverables/price.amount).
+ *
+ * `price` is in PAY (1 PAY = 1 USD). The chain lane is paid by the collection's on-chain evaluation
+ * leg, never in PAY, so its PAY price is 0 and the effective fee is named in its description; the
+ * Decision API's per-decision price is a USD price already, so it carries over exactly. A service
+ * with no price behind it is not carded at all — never advertised as free.
+ */
+export function buildAgentCard(src, validFrom = new Date().toISOString()) {
+    const fee = src.evaluationFee;
+    const services = [
+        ...(fee
+            ? [
+                {
+                    id: "claim-evaluation",
+                    name: "Claim evaluation",
+                    description: `Evaluates every claim submitted to a hired IXO claim collection against its protocol's rubric through the IXO decision engine, and signs terminal verdicts on chain. Listing: ${src.kitUrl}/v1/info. Paid on chain per evaluation (at least ${fee.minAmount}${fee.denom}, the collection's evaluation payment).`,
+                    price: { amount: 0, currency: "PAY" },
+                    deliverables: "One decision per claim — approve, reject or review — with the decision engine's signed receipt, and an on-chain MsgEvaluateClaim for every terminal verdict.",
+                    doneMeans: [
+                        "Every claim in the collection receives a decision from the decision engine.",
+                        "Every approve or reject is signed on chain with the receipt CID as its verification proof.",
+                    ],
+                    tags: ["evaluation", "claims"],
+                },
+            ]
+            : []),
+        ...(src.api
+            ? [
+                {
+                    id: "decision-api",
+                    name: "Decision API",
+                    description: `Submit evidence as a claim over HTTP at ${src.kitUrl}/v1/api (OpenAPI: ${src.kitUrl}/v1/api/openapi.json; MCP: ${src.kitUrl}/v1/mcp) and receive the decision engine's verdict.`,
+                    price: {
+                        amount: src.api.amountMicroUsd / 1_000_000,
+                        currency: "PAY",
+                    },
+                    deliverables: "A decision per submitted claim — approve, reject or review — with the decision engine's signed, verifiable receipt.",
+                    doneMeans: [
+                        "Each accepted claim is answered with a decision and a receipt that verifies against the engine's published key.",
+                    ],
+                    tags: ["decision-api", "mcp"],
+                },
+            ]
+            : []),
+        // The OpenHands app's marker: it lists an oracle as an OpenHands checker by this id, and reads
+        // `{currency: "PAY"}` prices only. Field for field openhands-oracles' `CARD_SERVICES` entry
+        // (`scripts/lib/card.ts`), so both producers card the same service.
+        ...(src.openhands
+            ? [
+                {
+                    id: "check-openhands",
+                    name: "OpenHands check",
+                    description: "Checks OpenHands asks against the rubric the OpenHands app writes for them",
+                    price: { amount: src.openhands.amountMicroUsd / 1_000_000, currency: "PAY" },
+                    deliverables: "a decision receipt",
+                    doneMeans: [
+                        "every line of the ask's rubric holds",
+                        "the receipt is signed by the decision engine",
+                    ],
+                },
+            ]
+            : []),
+    ];
+    return {
+        "@context": ["https://www.w3.org/ns/credentials/v2", "https://w3id.org/ixo/ns/agent-card/v1"],
+        id: `${src.entityDid}#acard`,
+        type: ["VerifiableCredential", "ixo:AgentCard"],
+        issuer: { id: src.issuerDid },
+        validFrom,
+        credentialSubject: {
+            id: src.entityDid,
+            name: src.name,
+            description: src.description || `${src.name} — an IXO evaluation oracle at ${src.kitUrl}`,
+            version: "1.0.0",
+            services,
+        },
+    };
+}
+/** The Agent Card services the kit generates — every other service id is the provider's own. */
+const KIT_SERVICES = ["claim-evaluation", "decision-api"];
+/** The ids the kit owns for a card it builds: `check-openhands` only when `--openhands` carded it,
+ *  so a hand-added one survives a run without the flag. */
+const kitServices = (ours) => new Set([
+    ...KIT_SERVICES,
+    ...servicesOf(subjectOf(ours))
+        .map((svc) => String(svc.id))
+        .filter((id) => id === "check-openhands"),
+]);
+const subjectOf = (card) => card.credentialSubject !== null && typeof card.credentialSubject === "object"
+    ? card.credentialSubject
+    : {};
+const servicesOf = (subject) => Array.isArray(subject.services) ? subject.services : [];
+/**
+ * The part of a card the KIT owns: what `/v1/info`, `--kit-url` and the kit's prices say, plus the
+ * logo when `--logo` is given. Everything else on a live card — a logo set by hand, images,
+ * keywords, a location, extra services — is the provider's, so it neither triggers a replace nor is
+ * lost by one.
+ */
+function owned(fragment, card, logo, kit) {
+    const sub = subjectOf(card);
+    if (fragment === "#dmn") {
+        return {
+            name: sub.name,
+            description: sub.description,
+            url: sub.url,
+            ...(logo ? { logo: sub.logo, image: sub.image } : {}),
+        };
+    }
+    const services = servicesOf(sub)
+        .filter((svc) => kit.has(String(svc.id)))
+        .sort((a, b) => String(a.id).localeCompare(String(b.id)));
+    return { name: sub.name, description: sub.description, services };
+}
+/** Whether a kit-owned field differs between the live card and the one the kit would write. */
+export function cardDrifted(fragment, live, ours, logo) {
+    const kit = kitServices(ours);
+    return (canonicalJson(owned(fragment, live, logo, kit)) !==
+        canonicalJson(owned(fragment, ours, logo, kit)));
+}
+/**
+ * The kit's fields laid onto the live card: the envelope's id/issuer/validFrom and the owned
+ * subject fields are ours, the rest is the live card's — so a replace never drops the provider's
+ * additions (on the Agent Card, their services follow the kit's).
+ */
+export function mergeCard(fragment, live, ours, logo) {
+    const kit = kitServices(ours);
+    const sub = {
+        ...subjectOf(live),
+        ...owned(fragment, ours, logo, kit),
+        id: subjectOf(ours).id,
+    };
+    if (fragment === "#acard") {
+        sub.services = [
+            ...servicesOf(subjectOf(ours)),
+            ...servicesOf(subjectOf(live)).filter((svc) => !kit.has(String(svc.id))),
+        ];
+    }
+    return {
+        ...live,
+        id: ours.id,
+        issuer: ours.issuer,
+        validFrom: ours.validFrom,
+        credentialSubject: sub,
+    };
+}
+const HTTP_TIMEOUT_MS = 10_000;
+/**
+ * The schema the engine serves at `GET /v1/agent-card-schema` (public), else the bundled snapshot
+ * — ixo-oracles-cli's `fetchAgentCardSchema`, same fallback: validation must never depend on the
+ * engine being reachable, and the snapshot is what the engine's Zod generates.
+ */
+export async function agentCardSchema(engineHost) {
+    const url = `https://${engineHost}/v1/agent-card-schema`;
+    try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(HTTP_TIMEOUT_MS) });
+        if (res.ok)
+            return { schema: (await res.json()), source: url };
+    }
+    catch {
+        // unreachable — the snapshot below
+    }
+    return { schema: AGENT_CARD_SCHEMA_SNAPSHOT, source: "the bundled schema snapshot" };
+}
+/** Human-readable violations; empty = valid. `@cfworker/json-schema`, the validator already in
+ *  this package (Ajv compiles code, which a Worker forbids — one validator everywhere). */
+export function validateAgentCard(card, schema) {
+    const { valid, errors } = new Validator(schema, "2020-12", false).validate(card);
+    return valid ? [] : errors.map((e) => `${e.instanceLocation}: ${e.error}`);
+}
+/** An anchored document as served (`readLinkedDoc`: a Vault, IPFS or Matrix address; its `proof`
+ *  checked when one is passed): its bytes and their JSON — null when it cannot be read, is not
+ *  JSON, or is not the bytes its proof names. */
+export async function fetchDoc(resource) {
+    const read = await readLinkedDoc(resource, { timeoutMs: HTTP_TIMEOUT_MS });
+    return read.ok ? { bytes: read.bytes, json: read.json } : null;
+}
+/** A JSON read whose failure is only a skip or a warning — null when it cannot be read. */
+export async function fetchJson(url) {
+    try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(HTTP_TIMEOUT_MS) });
+        return res.ok ? await res.json() : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=identity-cards.js.map

package/dist/cli/lib/identity-cards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-cards.js","sourceRoot":"","sources":["../../../src/cli/lib/identity-cards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAqB,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAuBjE,MAAM,mBAAmB,GAAG;IAC1B,sCAAsC;IACtC,iCAAiC;IACjC;QACE,SAAS,EAAE,qCAAqC;QAChD,MAAM,EAAE,qBAAqB;QAC7B,GAAG,EAAE,+BAA+B;QACpC,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,yCAAyC;QAC/C,GAAG,EAAE,mCAAmC;QACxC,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,OAAO;QACb,YAAY,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;QAC9D,YAAY,EAAE,IAAI;KACnB;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACnF,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,OAAO;QACL,UAAU,EAAE,mBAAmB;QAC/B,EAAE,EAAE,GAAG,GAAG,CAAC,SAAS,MAAM;QAC1B,IAAI,EAAE,CAAC,sBAAsB,EAAE,gBAAgB,CAAC;QAChD,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE;QAC7B,SAAS;QACT,gBAAgB,EAAE;YAChB,EAAE,EAAE,qDAAqD;YACzD,IAAI,EAAE,YAAY;SACnB;QACD,iBAAiB,EAAE;YACjB,EAAE,EAAE,GAAG,CAAC,SAAS;YACjB,IAAI,EAAE,CAAC,YAAY,CAAC;YACpB,cAAc,EAAE,CAAC,qBAAqB,CAAC;YACvC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,GAAG,EAAE,GAAG,CAAC,MAAM;YACf,MAAM,EAAE,EAAE;YACV,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,CAAC,mBAAmB,CAAC;YACjC,WAAW,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE;YACvD,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1E,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,EAAE;SACZ;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAClF,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,CAAC;IAC9B,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,GAAG;YACL,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,kBAAkB;oBACtB,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,iLAAiL,GAAG,CAAC,MAAM,oDAAoD,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK,yCAAyC;oBAC9T,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;oBACrC,YAAY,EACV,8JAA8J;oBAChK,SAAS,EAAE;wBACT,6EAA6E;wBAC7E,4FAA4F;qBAC7F;oBACD,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;iBAC/B;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,GAAG;YACT,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,cAAc;oBAClB,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,2CAA2C,GAAG,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAM,8BAA8B,GAAG,CAAC,MAAM,qDAAqD;oBAC9L,KAAK,EAAE;wBACL,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS;wBAC1C,QAAQ,EAAE,KAAK;qBAChB;oBACD,YAAY,EACV,qHAAqH;oBACvH,SAAS,EAAE;wBACT,iHAAiH;qBAClH;oBACD,IAAI,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC;iBAC9B;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,+FAA+F;QAC/F,4FAA4F;QAC5F,oEAAoE;QACpE,GAAG,CAAC,GAAG,CAAC,SAAS;YACf,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EACT,4EAA4E;oBAC9E,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc,GAAG,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC5E,YAAY,EAAE,oBAAoB;oBAClC,SAAS,EAAE;wBACT,sCAAsC;wBACtC,8CAA8C;qBAC/C;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO;QACL,UAAU,EAAE,CAAC,sCAAsC,EAAE,uCAAuC,CAAC;QAC7F,EAAE,EAAE,GAAG,GAAG,CAAC,SAAS,QAAQ;QAC5B,IAAI,EAAE,CAAC,sBAAsB,EAAE,eAAe,CAAC;QAC/C,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE;QAC7B,SAAS;QACT,iBAAiB,EAAE;YACjB,EAAE,EAAE,GAAG,CAAC,SAAS;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,GAAG,CAAC,IAAI,kCAAkC,GAAG,CAAC,MAAM,EAAE;YACzF,OAAO,EAAE,OAAO;YAChB,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AAKD,gGAAgG;AAChG,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAE1D;2DAC2D;AAC3D,MAAM,WAAW,GAAG,CAAC,IAAU,EAAe,EAAE,CAC9C,IAAI,GAAG,CAAC;IACN,GAAG,YAAY;IACf,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC5B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,iBAAiB,CAAC;CAC5C,CAAC,CAAC;AAEL,MAAM,SAAS,GAAG,CAAC,IAAU,EAAW,EAAE,CACxC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;IAC3E,CAAC,CAAE,IAAI,CAAC,iBAA6B;IACrC,CAAC,CAAC,EAAE,CAAC;AAET,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAsB,EAAE,CAC1D,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,QAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;AAElF;;;;;GAKG;AACH,SAAS,KAAK,CAAC,QAAgB,EAAE,IAAU,EAAE,IAAa,EAAE,GAAgB;IAC1E,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC;SAC7B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAU,EAAE,IAAU,EAAE,IAAa;IACjF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CACL,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/C,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAU,EAAE,IAAU,EAAE,IAAa;IAC/E,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAY;QACnB,GAAG,SAAS,CAAC,IAAI,CAAC;QAClB,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACnC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE;KACvB,CAAC;IACF,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,GAAG,CAAC,QAAQ,GAAG;YACb,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;SACzE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,iBAAiB,EAAE,GAAG;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB;IAElB,MAAM,GAAG,GAAG,WAAW,UAAU,uBAAuB,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;AACvF,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,IAAa,EAAE,MAA+B;IAC9E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;iDAEiD;AACjD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cli/lib/matrix-account.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The oracle's OWN Matrix account — the producer of `ORACLE_MATRIX_ACCESS_TOKEN`, without which the
+ * review-card lane (`lib/matrix/deliver.ts`) silently no-ops.
+ *
+ * A `did-ixo-…` account cannot be registered on the homeserver directly: registration is closed and
+ * IXO's ROOMS BOT is the only thing that may mint one. Its `POST /user/create` authenticates the
+ * caller with a secp256k1 signature over a challenge naming the address, and takes the account's
+ * password ECIES-encrypted to a key the bot publishes — so the password (and therefore the account)
+ * never crosses the wire in the clear, and the bot never has to be trusted with a mnemonic.
+ *
+ * Every field, endpoint and derivation here is ported from qiforge-cli, which is what created every
+ * oracle Matrix account that exists today: `src/utils/account/matrix.ts:172-336` (public key,
+ * challenge, ECIES, the request), `:571-586` (username + password), `src/utils/common.ts:214-225`
+ * (the bot URL convention), `src/utils/account/utils.ts:236-262` (what the signature covers),
+ * `simplifiedRegistration.ts:149` (the display name). Anything that drifts from those lines is a
+ * bug: the bot is the verifier, and the password IS the account — a changed derivation locks the
+ * oracle out of an account that already exists.
+ *
+ * The access token this mints is a full account credential: it is written straight to the project's
+ * `.dev.vars` and is never printed, logged, or put in an error message.
+ */
+/**
+ * The Matrix password for a mnemonic: `base64(md5hex(mnemonic sans spaces))[:24]` — qiforge
+ * `generatePasswordFromMnemonic` (matrix.ts:583-586), and the derivation the portal applies to the
+ * AuthHub session's own `matrixMnemonic` (chain.ts `matrixLoginFromSession`, which calls this).
+ * npm `md5` returns a hex STRING and `Buffer.from(<string>)` takes its utf8 bytes, so the base64 is
+ * over the 32 hex characters — not over the 16 digest bytes.
+ */
+export declare function matrixPassword(mnemonic: string): string;
+/**
+ * The rooms bot for a homeserver — qiforge `deriveMatrixUrls` (common.ts:214-225): every IXO bot is
+ * a subdomain of the homeserver's host, so `https://devmx.ixo.earth` → `https://rooms.bot.devmx…`.
+ * The same family as the worker's `https://claim.bot.{domain}` (lib/ixo/claim-bot.ts).
+ */
+export declare function roomsBotUrl(homeserverUrl: string): string;
+export interface MatrixAccountDeps {
+    /** Progress for the terminal — three round trips otherwise go by in silence. Never the secrets. */
+    log?: (message: string) => void;
+}
+export interface CreateMatrixAccountInput {
+    homeserverUrl: string;
+    /** The oracle's bech32 address — `ORACLE_ADDRESS`, and what the challenge claims to speak for. */
+    address: string;
+    /** `ORACLE_SECP_MNEMONIC` — signs the challenge; must derive `address`. */
+    secpMnemonic: string;
+    password: string;
+}
+/**
+ * Create the oracle's Matrix account through the rooms bot. Idempotent: an account that already
+ * exists is reported as `created: false` (the caller logs in to it), never re-created.
+ */
+export declare function createMatrixAccount(deps: MatrixAccountDeps, input: CreateMatrixAccountInput): Promise<{
+    userId: string;
+    created: boolean;
+}>;
+/**
+ * `m.login.password` against the raw Client-Server API (no SDK — chain.ts's session login does the
+ * same). The returned token is the oracle's account credential: it is never logged or printed.
+ */
+export declare function matrixLogin(homeserverUrl: string, userId: string, password: string): Promise<string>;
+/**
+ * Whose token this is (`lib/matrix/api.ts` `whoami`) — the skip check for a `.dev.vars` that
+ * already holds one. A token the homeserver rejects is the EXPECTED negative (rotated, expired,
+ * from another homeserver), so it answers `null` rather than throwing: the caller logs in again.
+ */
+export declare function matrixWhoami(homeserverUrl: string, token: string): Promise<string | null>;
+/** The name the oracle shows up as on its review cards — qiforge simplifiedRegistration.ts:149. */
+export declare function setDisplayName(homeserverUrl: string, token: string, userId: string, name: string): Promise<void>;
+/**
+ * Write `KEY="value"` into a provider's secrets file, replacing the line for KEY when there is one
+ * and leaving every other line — their other secrets, their comments — exactly where it was.
+ * Creates the file when absent, mode 0600: it holds credentials, the same reason `saveSession`
+ * (session.ts) writes the AuthHub session that way. Quoted because that is the form `readDevVars`
+ * (devvars.ts) and `wrangler dev` both strip — and since neither unescapes anything, a value
+ * carrying a quote, a backslash or a newline is REFUSED rather than written as a line that would
+ * read back as something else (or silently truncate the file's meaning).
+ */
+export declare function appendDevVar(envFilePath: string, key: string, value: string): void;
+//# sourceMappingURL=matrix-account.d.ts.map

package/dist/cli/lib/matrix-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matrix-account.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/matrix-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiBH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED,MAAM,WAAW,iBAAiB;IAChC,mGAAmG;IACnG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoF/C;AAuBD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO/F;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAkBlF"}

package/dist/cli/lib/matrix-account.js

@@ -0,0 +1,228 @@
+/**
+ * The oracle's OWN Matrix account — the producer of `ORACLE_MATRIX_ACCESS_TOKEN`, without which the
+ * review-card lane (`lib/matrix/deliver.ts`) silently no-ops.
+ *
+ * A `did-ixo-…` account cannot be registered on the homeserver directly: registration is closed and
+ * IXO's ROOMS BOT is the only thing that may mint one. Its `POST /user/create` authenticates the
+ * caller with a secp256k1 signature over a challenge naming the address, and takes the account's
+ * password ECIES-encrypted to a key the bot publishes — so the password (and therefore the account)
+ * never crosses the wire in the clear, and the bot never has to be trusted with a mnemonic.
+ *
+ * Every field, endpoint and derivation here is ported from qiforge-cli, which is what created every
+ * oracle Matrix account that exists today: `src/utils/account/matrix.ts:172-336` (public key,
+ * challenge, ECIES, the request), `:571-586` (username + password), `src/utils/common.ts:214-225`
+ * (the bot URL convention), `src/utils/account/utils.ts:236-262` (what the signature covers),
+ * `simplifiedRegistration.ts:149` (the display name). Anything that drifts from those lines is a
+ * bug: the bot is the verifier, and the password IS the account — a changed derivation locks the
+ * oracle out of an account that already exists.
+ *
+ * The access token this mints is a full account credential: it is written straight to the project's
+ * `.dev.vars` and is never printed, logged, or put in an error message.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { secp256k1 } from "@noble/curves/secp256k1";
+import { sha256 } from "@noble/hashes/sha2";
+import { encrypt as eciesEncrypt } from "eciesjs";
+import { deriveOracleKey } from "../../lib/engine/adr36.js";
+import { mxidFromDid } from "../../lib/matrix/mxid.js";
+const V3 = "/_matrix/client/v3";
+/** The device this token belongs to, as the homeserver shows it — the same string chain.ts uses. */
+const DEVICE_NAME = "decision-oracle CLI";
+/** `${base(home)}/_matrix/…` is never `//_matrix` (chain.ts's session login strips the same way). */
+const base = (homeserverUrl) => homeserverUrl.replace(/\/+$/, "");
+/**
+ * The Matrix password for a mnemonic: `base64(md5hex(mnemonic sans spaces))[:24]` — qiforge
+ * `generatePasswordFromMnemonic` (matrix.ts:583-586), and the derivation the portal applies to the
+ * AuthHub session's own `matrixMnemonic` (chain.ts `matrixLoginFromSession`, which calls this).
+ * npm `md5` returns a hex STRING and `Buffer.from(<string>)` takes its utf8 bytes, so the base64 is
+ * over the 32 hex characters — not over the 16 digest bytes.
+ */
+export function matrixPassword(mnemonic) {
+    const md5hex = createHash("md5").update(mnemonic.replace(/ /g, "")).digest("hex");
+    return Buffer.from(md5hex).toString("base64").slice(0, 24);
+}
+/**
+ * The rooms bot for a homeserver — qiforge `deriveMatrixUrls` (common.ts:214-225): every IXO bot is
+ * a subdomain of the homeserver's host, so `https://devmx.ixo.earth` → `https://rooms.bot.devmx…`.
+ * The same family as the worker's `https://claim.bot.{domain}` (lib/ixo/claim-bot.ts).
+ */
+export function roomsBotUrl(homeserverUrl) {
+    const url = new URL(base(homeserverUrl));
+    return `${url.protocol}//rooms.bot.${url.hostname}`;
+}
+/**
+ * Create the oracle's Matrix account through the rooms bot. Idempotent: an account that already
+ * exists is reported as `created: false` (the caller logs in to it), never re-created.
+ */
+export async function createMatrixAccount(deps, input) {
+    const home = base(input.homeserverUrl);
+    // One MXID rule for the whole package (lib/matrix/mxid.ts), so the account the bot creates IS the
+    // `ORACLE_MATRIX_USER_ID` the worker posts as; its localpart is qiforge's
+    // `generateUsernameFromAddress` (`did-ixo-<address>`, matrix.ts:571-576), taken off the MXID
+    // rather than re-derived so the two can never drift.
+    const userId = mxidFromDid(`did:ixo:${input.address}`, new URL(home).hostname);
+    const username = userId.slice(1, userId.indexOf(":"));
+    // qiforge checks availability BEFORE creating (simplifiedRegistration.ts:108-115); here that is
+    // the idempotency gate — re-running `oracle init` must log in, not fail on a duplicate.
+    if (!(await usernameAvailable(home, username))) {
+        deps.log?.(`Matrix account ${userId} already exists`);
+        return { userId, created: false };
+    }
+    // The bot verifies the signature against the key behind `address`; a mnemonic deriving a
+    // different one fails there as an opaque 401, so it fails here saying which address it is.
+    const key = deriveOracleKey(input.secpMnemonic);
+    if (key.address !== input.address) {
+        throw new Error(`ORACLE_SECP_MNEMONIC derives ${key.address}, not ${input.address}`);
+    }
+    const botUrl = roomsBotUrl(home);
+    const encryptionKey = await getJson(`${botUrl}/public-key`);
+    // qiforge `createUserCreationChallenge` (matrix.ts:196-212) — these exact four fields, base64 of
+    // the JSON. The bot re-parses it and checks the address, the type, and the timestamp's freshness.
+    const challenge = JSON.stringify({
+        timestamp: new Date().toISOString(),
+        address: input.address,
+        service: "matrix",
+        type: "create-account",
+    });
+    const challengeBase64 = Buffer.from(challenge).toString("base64");
+    // What qiforge's wallet signs (utils.ts:236-262): sha256 of the base64-DECODED challenge bytes,
+    // as a 64-byte compact r‖s signature (cosmjs's recovery byte is dropped), base64. NOT an ADR-36
+    // amino doc — that is a different proof, for the engine (lib/engine/adr36.ts), whose @noble
+    // primitives this reuses so the CLI needs no cosmjs on this path.
+    const signature = Buffer.from(secp256k1
+        .sign(sha256(new Uint8Array(Buffer.from(challengeBase64, "base64"))), key.privkey)
+        .toCompactRawBytes()).toString("base64");
+    // qiforge `encryptPasswordWithECIES` (matrix.ts:218-224) with the same library the bot decrypts
+    // with (`eciesjs`, also what `@ixo/oracles-chain-client` depends on): hex in, hex out.
+    const encryptedPassword = Buffer.from(eciesEncrypt(new Uint8Array(Buffer.from(encryptionKey.publicKey, "hex")), new Uint8Array(Buffer.from(input.password, "utf8")))).toString("hex");
+    const res = await fetch(`${botUrl}/user/create`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            address: input.address,
+            encryptedPassword,
+            publicKeyFingerprint: encryptionKey.fingerprint,
+            secpResult: { signature, challenge: challengeBase64 },
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        // The availability check above loses only to a concurrent run; the bot's conflict is then the
+        // same answer — the account is there, log in to it. Narrow on purpose: any other failure
+        // (a rejected signature, an undecryptable password) must surface, not become a silent skip.
+        if (res.status === 409 || (res.status === 400 && /already exist|taken|in use/i.test(text))) {
+            deps.log?.(`Matrix account ${userId} already exists`);
+            return { userId, created: false };
+        }
+        throw new Error(`rooms bot POST /user/create failed (${res.status}): ${text}`);
+    }
+    const body = (await res.json());
+    if (!body.success)
+        throw new Error(`rooms bot did not create ${userId}`);
+    // The MXID is pinned in the project's config — a bot that made a different one is a config lie.
+    if (body.matrixUserId && body.matrixUserId !== userId) {
+        throw new Error(`rooms bot created ${body.matrixUserId}, not ${userId}`);
+    }
+    deps.log?.(`Matrix account ${userId} created`);
+    return { userId, created: true };
+}
+/**
+ * Synapse's own availability check — what matrix-js-sdk's `isUsernameAvailable` calls, and what
+ * qiforge gates registration on (matrix.ts:337-351). `M_USER_IN_USE` is the only conclusive
+ * answer: anything else (the endpoint is rate-limited, and some deployments gate it) is treated as
+ * available, leaving `POST /user/create` as the authority.
+ */
+async function usernameAvailable(home, username) {
+    const res = await fetch(`${home}${V3}/register/available?username=${encodeURIComponent(username)}`);
+    if (res.ok)
+        return true;
+    const body = (await res.json().catch(() => ({})));
+    return body.errcode !== "M_USER_IN_USE";
+}
+async function getJson(url) {
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`GET ${url} failed (${res.status}): ${await res.text()}`);
+    return (await res.json());
+}
+/**
+ * `m.login.password` against the raw Client-Server API (no SDK — chain.ts's session login does the
+ * same). The returned token is the oracle's account credential: it is never logged or printed.
+ */
+export async function matrixLogin(homeserverUrl, userId, password) {
+    const res = await fetch(`${base(homeserverUrl)}${V3}/login`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            type: "m.login.password",
+            identifier: { type: "m.id.user", user: userId },
+            password,
+            initial_device_display_name: DEVICE_NAME,
+        }),
+    });
+    if (!res.ok) {
+        throw new Error(`Matrix login as ${userId} failed (${res.status}): ${await res.text()}`);
+    }
+    const { access_token } = (await res.json());
+    if (!access_token)
+        throw new Error(`Matrix login as ${userId} returned no access token`);
+    return access_token;
+}
+/**
+ * Whose token this is (`lib/matrix/api.ts` `whoami`) — the skip check for a `.dev.vars` that
+ * already holds one. A token the homeserver rejects is the EXPECTED negative (rotated, expired,
+ * from another homeserver), so it answers `null` rather than throwing: the caller logs in again.
+ */
+export async function matrixWhoami(homeserverUrl, token) {
+    const res = await fetch(`${base(homeserverUrl)}${V3}/account/whoami`, {
+        headers: { authorization: `Bearer ${token}` },
+    });
+    if (!res.ok)
+        return null;
+    const { user_id } = (await res.json());
+    return user_id ?? null;
+}
+/** The name the oracle shows up as on its review cards — qiforge simplifiedRegistration.ts:149. */
+export async function setDisplayName(homeserverUrl, token, userId, name) {
+    const res = await fetch(`${base(homeserverUrl)}${V3}/profile/${encodeURIComponent(userId)}/displayname`, {
+        method: "PUT",
+        headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+        body: JSON.stringify({ displayname: name }),
+    });
+    if (!res.ok) {
+        throw new Error(`Matrix set display name for ${userId} failed (${res.status})`);
+    }
+}
+/**
+ * Write `KEY="value"` into a provider's secrets file, replacing the line for KEY when there is one
+ * and leaving every other line — their other secrets, their comments — exactly where it was.
+ * Creates the file when absent, mode 0600: it holds credentials, the same reason `saveSession`
+ * (session.ts) writes the AuthHub session that way. Quoted because that is the form `readDevVars`
+ * (devvars.ts) and `wrangler dev` both strip — and since neither unescapes anything, a value
+ * carrying a quote, a backslash or a newline is REFUSED rather than written as a line that would
+ * read back as something else (or silently truncate the file's meaning).
+ */
+export function appendDevVar(envFilePath, key, value) {
+    if (/["\\\r\n]/.test(value)) {
+        throw new Error(`${key} value contains a quote, backslash or newline — refusing to write it`);
+    }
+    const line = `${key}="${value}"`;
+    if (!existsSync(envFilePath)) {
+        writeFileSync(envFilePath, `${line}\n`, { mode: 0o600 });
+        return;
+    }
+    const lines = readFileSync(envFilePath, "utf8").split("\n");
+    // Trailing blank lines go first, so the file ends in exactly one newline either way: a file
+    // without one would otherwise glue the new var onto its last line, and one with it would grow a
+    // blank line per write.
+    while (lines.length > 0 && lines[lines.length - 1]?.trim() === "")
+        lines.pop();
+    const index = lines.findIndex((l) => l.trim().startsWith(`${key}=`));
+    if (index >= 0)
+        lines[index] = line;
+    else
+        lines.push(line);
+    writeFileSync(envFilePath, `${lines.join("\n")}\n`);
+}
+//# sourceMappingURL=matrix-account.js.map

package/dist/cli/lib/matrix-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matrix-account.js","sourceRoot":"","sources":["../../../src/cli/lib/matrix-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,EAAE,GAAG,oBAAoB,CAAC;AAChC,oGAAoG;AACpG,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAE1C,qGAAqG;AACrG,MAAM,IAAI,GAAG,CAAC,aAAqB,EAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,aAAqB;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACzC,OAAO,GAAG,GAAG,CAAC,QAAQ,eAAe,GAAG,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC;AAsBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAuB,EACvB,KAA+B;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvC,kGAAkG;IAClG,0EAA0E;IAC1E,6FAA6F;IAC7F,qDAAqD;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtD,gGAAgG;IAChG,wFAAwF;IACxF,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,MAAM,iBAAiB,CAAC,CAAC;QACtD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,yFAAyF;IACzF,2FAA2F;IAC3F,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,OAAO,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAgB,GAAG,MAAM,aAAa,CAAC,CAAC;IAE3E,iGAAiG;IACjG,kGAAkG;IAClG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,gBAAgB;KACvB,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAElE,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,kEAAkE;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,SAAS;SACN,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC;SACjF,iBAAiB,EAAE,CACvB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErB,gGAAgG;IAChG,uFAAuF;IACvF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CACnC,YAAY,CACV,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAC3D,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CACpD,CACF,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE;QAC/C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB;YACjB,oBAAoB,EAAE,aAAa,CAAC,WAAW;YAC/C,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE;SACtD,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,8FAA8F;QAC9F,yFAAyF;QACzF,4FAA4F;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,MAAM,iBAAiB,CAAC,CAAC;YACtD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiD,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;IACzE,gGAAgG;IAChG,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,YAAY,SAAS,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,MAAM,UAAU,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,GAAG,EAAE,gCAAgC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAC3E,CAAC;IACF,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAyB,CAAC;IAC1E,OAAO,IAAI,CAAC,OAAO,KAAK,eAAe,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,GAAW;IACnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAAqB,EACrB,MAAc,EACd,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;YAC/C,QAAQ;YACR,2BAA2B,EAAE,WAAW;SACzC,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,YAAY,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;IACzE,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,2BAA2B,CAAC,CAAC;IACzF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,aAAqB,EAAE,KAAa;IACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE;QACpE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;IAC/D,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,EACrB,KAAa,EACb,MAAc,EACd,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,kBAAkB,CAAC,MAAM,CAAC,cAAc,EAC/E;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;KAC5C,CACF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,YAAY,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,GAAW,EAAE,KAAa;IAC1E,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sEAAsE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,KAAK,GAAG,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,aAAa,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,4FAA4F;IAC5F,gGAAgG;IAChG,wBAAwB;IACxB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,IAAI,CAAC;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;;QAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,aAAa,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC"}