@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/cli/lib/oracle-account.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The oracle's OWN chain account: funding it, the IID document for `did:ixo:<ORACLE_ADDRESS>`, and
+ * the Ed25519 verification method that makes that DID a UCAN issuer counterparties can verify —
+ * `oracle init` steps 1–3. Until all three land, a provider's oracle has a wallet that can't pay
+ * for `MsgEvaluateClaim`, a DID nothing resolves, and bot/UCAN-Store invocations minted as that DID
+ * that verify against nothing.
+ *
+ * Every message is a port of qiforge-cli, which provisions oracles this way today — cited per
+ * builder by `file:line`, because the field-for-field shape is the whole point: these are writes a
+ * provider cannot repair by hand afterwards.
+ *
+ * The split here is deliberate: the builders are message construction only (no clock, no network,
+ * no signing), so a command can print a plan from them before the `--yes` gate; only
+ * `oracleWalletSigner`, `spendableUixo` and the two IID-document reads touch the chain. Nothing in
+ * this file confirms, prints or broadcasts — `confirm()` and the sequencing belong to the command
+ * (lib/chain.ts is where the ONE safety gate lives).
+ */
+import type { EncodeObject } from "@cosmjs/proto-signing";
+import type { DeliverTxResponse } from "@cosmjs/stargate";
+import { type IxoNetwork } from "../../networks.js";
+import { type IidService, type LinkedEntity, type LinkedResource } from "./chain.js";
+export interface OracleWalletSigner {
+    address: string;
+    /** The 33-byte compressed secp256k1 pubkey the IID document registers — see `iidDocumentMsg`. */
+    pubkey: Uint8Array;
+    /** Signs + broadcasts as the oracle wallet, throwing with the raw log on a non-zero code —
+     *  the same fail-loud contract as `broadcast()` in lib/chain.ts, which signs as the SESSION. */
+    signAndBroadcast(msgs: EncodeObject[], memo: string): Promise<DeliverTxResponse>;
+}
+/**
+ * The ORACLE's wallet (`ORACLE_SECP_MNEMONIC`), not the AuthHub session: steps 2 and 3 modify the
+ * oracle's own IID document, which only its own key may sign for.
+ *
+ * `ORACLE_ADDRESS` is asserted against the mnemonic FIRST, with the pure derivation
+ * (lib/engine/adr36.ts, the same `m/44'/118'/0'/0/0` the Worker asserts at first use in
+ * lib/ixo/chain.ts `assertOracleAddress`) — so a config whose two halves come from different
+ * identities fails offline, before any connection and long before a tx that would write the wrong
+ * DID. Everything after that assertion is deferred to the first real broadcast, the way
+ * session.ts's signer defers its own: a dry run prints its plan without deriving a wallet or
+ * opening an RPC connection.
+ */
+export declare function oracleWalletSigner(network: IxoNetwork, secpMnemonic: string, expectedAddress: string): Promise<OracleWalletSigner>;
+/** `MsgSend` in `uixo` — qiforge funds a new oracle account the same way (`utils/wallet.ts:242-259`,
+ *  called from `utils/entity.ts:618`), and it is the message `create-collection --fund` already
+ *  signs. The denom is fixed: `--fund` is a uixo amount, and no other denom pays chain fees. */
+export declare function fundMsg(from: string, to: string, uixo: string): Promise<EncodeObject>;
+/**
+ * The SPENDABLE `uixo` balance — what the fund step's skip decision reads. Spendable, not total:
+ * vesting/locked coins can't pay a fee, and "spendable balance … is smaller than" is exactly how
+ * the chain refuses (the Worker's `getSpendableBalance`, lib/ixo/chain.ts, reads the same query).
+ * A brand-new address that has never received anything answers with no balances at all ⇒ 0n.
+ */
+export declare function spendableUixo(rpcUrl: string, address: string): Promise<bigint>;
+/**
+ * `MsgCreateIidDocument` for the oracle's account DID — qiforge `utils/account/utils.ts:51-91`
+ * (`createIidDocument`), with the `{did}#matrix` service it passes in from
+ * `utils/account/simplifiedRegistration.ts:84-89`. That service is not decoration: it is how the
+ * rooms/claim bots find WHICH homeserver holds this oracle's account, so it must be created with
+ * the document (adding it later is a second tx nothing triggers).
+ *
+ * qiforge's feegrant lookup is deliberately not ported: step 1 funds this wallet, so it pays its
+ * own fee and there is no granter to find.
+ */
+export declare function iidDocumentMsg(did: string, address: string, secpPubkey: Uint8Array, homeserverUrl: string): Promise<EncodeObject>;
+export interface IidDocumentState {
+    exists: boolean;
+    /** Every verification method id on the document — the key step's skip check, since an Ed25519
+     *  method's id IS its key (see `ed25519VerificationId`). */
+    verificationMethodIds: string[];
+}
+/** Does the IID document exist, and what keys does it already carry? */
+export declare function iidExists(rpcUrl: string, did: string): Promise<IidDocumentState>;
+/**
+ * Not just the oracle's own account DID: an ENTITY's document is the same record (the entity module
+ * writes one per entity), so this is what every `oracle init` step that decides from entity state
+ * reads — `#orz`/`#pro`, the `#eval` service, the protocol edges. Same anti-lag reason as above,
+ * and the only entity question it cannot answer is the entity's owner/type, which live in the
+ * entity module (blocksync) and not in this document.
+ */
+export interface EntityDocument {
+    linkedResource: LinkedResource[];
+    service: IidService[];
+    linkedEntity: LinkedEntity[];
+}
+export declare function entityDocument(rpcUrl: string, did: string): Promise<EntityDocument | null>;
+/**
+ * The id an Ed25519 verification method gets on chain: `{did}#{base58(raw 32-byte key)}`, the
+ * fragment the SDK's `createVerificationMethod` mints (used below). Because the fragment IS the
+ * key, "is this key registered?" is an id lookup against `iidExists().verificationMethodIds` — and
+ * a ROTATED key yields a different id, so it can never be mistaken for already-registered.
+ */
+export declare function ed25519VerificationId(did: string, ed25519PublicKey: Uint8Array): string;
+/**
+ * `MsgAddVerification` adding the oracle's Ed25519 (UCAN-signing) key to its own IID document —
+ * qiforge `utils/composio.ts:146-157`, field for field: `relationships: ['authentication',
+ * 'assertionMethod']`, the method from `customMessages.iid.createVerificationMethod(did, key, did,
+ * 'ed')`, and the wallet ADDRESS as `signer`.
+ *
+ * That SDK helper emits `Ed25519VerificationKey2018` + `publicKeyBase58` (raw key), NOT the
+ * `Ed25519VerificationKey2020` + `z…` multibase pair our did:web document publishes — and the 2018
+ * form is deliberately kept, because it is the only Ed25519 shape that exists on chain today (a
+ * devnet sweep of IID documents finds 17 `Ed25519VerificationKey2018` methods and zero 2020s,
+ * including the one an existing oracle's did:ixo invocations already verify against). `@ixo/ucan`'s
+ * did:ixo resolver decodes base58, hex and multibase alike, so the two are equivalent to us and
+ * only the ported one is proven against the counterparties (claim bot, UCAN Store) we don't own.
+ */
+export declare function verificationMethodMsg(did: string, controllerAddress: string, ed25519PublicKey: Uint8Array): Promise<EncodeObject>;
+//# sourceMappingURL=oracle-account.d.ts.map

package/dist/cli/lib/oracle-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracle-account.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/oracle-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AAIjB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,UAAU,CAAC;IACnB;oGACgG;IAChG,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAClF;AAcD;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAyB7B;AAID;;gGAEgG;AAChG,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAU3F;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKpF;AAID;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,YAAY,CAAC,CAwBvB;AAiBD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB;gEAC4D;IAC5D,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AA0BD,wEAAwE;AACxE,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAItF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,EAAE,CAAC;IACjC,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,EAAE,YAAY,EAAE,CAAC;CAC9B;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQhG;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,GAAG,MAAM,CAEvF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,iBAAiB,EAAE,MAAM,EACzB,gBAAgB,EAAE,UAAU,GAC3B,OAAO,CAAC,YAAY,CAAC,CAavB"}

package/dist/cli/lib/oracle-account.js

@@ -0,0 +1,207 @@
+/**
+ * The oracle's OWN chain account: funding it, the IID document for `did:ixo:<ORACLE_ADDRESS>`, and
+ * the Ed25519 verification method that makes that DID a UCAN issuer counterparties can verify —
+ * `oracle init` steps 1–3. Until all three land, a provider's oracle has a wallet that can't pay
+ * for `MsgEvaluateClaim`, a DID nothing resolves, and bot/UCAN-Store invocations minted as that DID
+ * that verify against nothing.
+ *
+ * Every message is a port of qiforge-cli, which provisions oracles this way today — cited per
+ * builder by `file:line`, because the field-for-field shape is the whole point: these are writes a
+ * provider cannot repair by hand afterwards.
+ *
+ * The split here is deliberate: the builders are message construction only (no clock, no network,
+ * no signing), so a command can print a plan from them before the `--yes` gate; only
+ * `oracleWalletSigner`, `spendableUixo` and the two IID-document reads touch the chain. Nothing in
+ * this file confirms, prints or broadcasts — `confirm()` and the sequencing belong to the command
+ * (lib/chain.ts is where the ONE safety gate lives).
+ */
+import { base58 } from "@scure/base";
+import { deriveOracleKey } from "../../lib/engine/adr36.js";
+import { NETWORKS } from "../../networks.js";
+import { fail, STANDARD_FEE, } from "./chain.js";
+/** No local sequence store is passed: a one-shot CLI process signs a handful of txs in order and
+ *  reads its sequence from the chain — the Worker's SequenceManagerDO exists only because many
+ *  isolates sign concurrently. */
+async function connectOracleWallet(network, secpMnemonic) {
+    const [{ createSigningClient }, { DirectSecp256k1HdWallet }] = await Promise.all([
+        import("@ixo/impactxclient-sdk"),
+        import("@cosmjs/proto-signing"),
+    ]);
+    const wallet = await DirectSecp256k1HdWallet.fromMnemonic(secpMnemonic, { prefix: "ixo" });
+    return createSigningClient(NETWORKS[network].rpc, wallet);
+}
+/**
+ * The ORACLE's wallet (`ORACLE_SECP_MNEMONIC`), not the AuthHub session: steps 2 and 3 modify the
+ * oracle's own IID document, which only its own key may sign for.
+ *
+ * `ORACLE_ADDRESS` is asserted against the mnemonic FIRST, with the pure derivation
+ * (lib/engine/adr36.ts, the same `m/44'/118'/0'/0/0` the Worker asserts at first use in
+ * lib/ixo/chain.ts `assertOracleAddress`) — so a config whose two halves come from different
+ * identities fails offline, before any connection and long before a tx that would write the wrong
+ * DID. Everything after that assertion is deferred to the first real broadcast, the way
+ * session.ts's signer defers its own: a dry run prints its plan without deriving a wallet or
+ * opening an RPC connection.
+ */
+export async function oracleWalletSigner(network, secpMnemonic, expectedAddress) {
+    const { address, pubkey } = deriveOracleKey(secpMnemonic);
+    if (address !== expectedAddress) {
+        fail(`ORACLE_ADDRESS (${expectedAddress}) is not the ORACLE_SECP_MNEMONIC wallet (${address}) — ` +
+            "the two are from different identities; `decision-oracle derive` prints the mnemonic's own vars.");
+    }
+    let client = null;
+    return {
+        address,
+        pubkey,
+        async signAndBroadcast(msgs, memo) {
+            client ??= await connectOracleWallet(network, secpMnemonic);
+            const res = (await client.signAndBroadcast(address, msgs, STANDARD_FEE, memo));
+            if (res.code !== 0)
+                throw new Error(`tx failed (code ${res.code}): ${res.rawLog}`);
+            return res;
+        },
+    };
+}
+// --- step 1: fund ---------------------------------------------------------------------------------
+/** `MsgSend` in `uixo` — qiforge funds a new oracle account the same way (`utils/wallet.ts:242-259`,
+ *  called from `utils/entity.ts:618`), and it is the message `create-collection --fund` already
+ *  signs. The denom is fixed: `--fund` is a uixo amount, and no other denom pays chain fees. */
+export async function fundMsg(from, to, uixo) {
+    const { cosmos } = await import("@ixo/impactxclient-sdk");
+    return {
+        typeUrl: "/cosmos.bank.v1beta1.MsgSend",
+        value: cosmos.bank.v1beta1.MsgSend.fromPartial({
+            fromAddress: from,
+            toAddress: to,
+            amount: [{ denom: "uixo", amount: uixo }],
+        }),
+    };
+}
+/**
+ * The SPENDABLE `uixo` balance — what the fund step's skip decision reads. Spendable, not total:
+ * vesting/locked coins can't pay a fee, and "spendable balance … is smaller than" is exactly how
+ * the chain refuses (the Worker's `getSpendableBalance`, lib/ixo/chain.ts, reads the same query).
+ * A brand-new address that has never received anything answers with no balances at all ⇒ 0n.
+ */
+export async function spendableUixo(rpcUrl, address) {
+    const { createQueryClient } = await import("@ixo/impactxclient-sdk");
+    const client = await createQueryClient(rpcUrl);
+    const { balances } = await client.cosmos.bank.v1beta1.spendableBalances({ address });
+    return BigInt(balances.find((coin) => coin.denom === "uixo")?.amount ?? "0");
+}
+// --- step 2: the IID document ---------------------------------------------------------------------
+/**
+ * `MsgCreateIidDocument` for the oracle's account DID — qiforge `utils/account/utils.ts:51-91`
+ * (`createIidDocument`), with the `{did}#matrix` service it passes in from
+ * `utils/account/simplifiedRegistration.ts:84-89`. That service is not decoration: it is how the
+ * rooms/claim bots find WHICH homeserver holds this oracle's account, so it must be created with
+ * the document (adding it later is a second tx nothing triggers).
+ *
+ * qiforge's feegrant lookup is deliberately not ported: step 1 funds this wallet, so it pays its
+ * own fee and there is no granter to find.
+ */
+export async function iidDocumentMsg(did, address, secpPubkey, homeserverUrl) {
+    const { customMessages, ixo } = await import("@ixo/impactxclient-sdk");
+    return {
+        typeUrl: "/ixo.iid.v1beta1.MsgCreateIidDocument",
+        value: ixo.iid.v1beta1.MsgCreateIidDocument.fromPartial({
+            id: did,
+            verifications: customMessages.iid.createIidVerificationMethods({
+                did,
+                pubkey: secpPubkey,
+                address,
+                controller: did,
+                type: "secp",
+            }),
+            signer: address,
+            controllers: [did],
+            services: [
+                ixo.iid.v1beta1.Service.fromPartial({
+                    id: `${did}#matrix`,
+                    type: "MatrixHomeServer",
+                    serviceEndpoint: homeserverUrl,
+                }),
+            ],
+        }),
+    };
+}
+/**
+ * The document itself, or null when the DID has none. Read from the CHAIN's own iid query (qiforge
+ * `utils/account/utils.ts:15-42`), not from blocksync: the indexer lags — a block or two for the
+ * document, and far longer for an entity's `linkedResource` list — observed live on devnet: the
+ * indexer listed a resource 15+ minutes late while the chain had it, which a re-running `oracle
+ * init` would read as "not anchored yet" and broadcast a duplicate the chain then rejects
+ * (`duplicated resource id {id}#pro: input is invalid`). An unknown DID is
+ * answered by a THROWN gRPC NotFound rather than an empty document — the same two markers qiforge
+ * matches (`utils.ts:37`) are the ones that mean "absent"; anything else is real trouble and is
+ * rethrown.
+ */
+async function queryIidDocument(rpcUrl, did) {
+    const { createQueryClient } = await import("@ixo/impactxclient-sdk");
+    const client = await createQueryClient(rpcUrl);
+    try {
+        const { iidDocument } = await client.ixo.iid.v1beta1.iidDocument({ id: did });
+        return iidDocument?.id ? iidDocument : null;
+    }
+    catch (err) {
+        const message = String(err instanceof Error ? err.message : err);
+        if (message.includes("did document not found") || message.includes("(22)"))
+            return null;
+        throw err;
+    }
+}
+/** Does the IID document exist, and what keys does it already carry? */
+export async function iidExists(rpcUrl, did) {
+    const doc = await queryIidDocument(rpcUrl, did);
+    if (!doc)
+        return { exists: false, verificationMethodIds: [] };
+    return { exists: true, verificationMethodIds: doc.verificationMethod.map((vm) => vm.id) };
+}
+export async function entityDocument(rpcUrl, did) {
+    const doc = await queryIidDocument(rpcUrl, did);
+    if (!doc)
+        return null;
+    return {
+        linkedResource: doc.linkedResource,
+        service: doc.service,
+        linkedEntity: doc.linkedEntity,
+    };
+}
+// --- step 3: the Ed25519 verification method -------------------------------------------------------
+/**
+ * The id an Ed25519 verification method gets on chain: `{did}#{base58(raw 32-byte key)}`, the
+ * fragment the SDK's `createVerificationMethod` mints (used below). Because the fragment IS the
+ * key, "is this key registered?" is an id lookup against `iidExists().verificationMethodIds` — and
+ * a ROTATED key yields a different id, so it can never be mistaken for already-registered.
+ */
+export function ed25519VerificationId(did, ed25519PublicKey) {
+    return `${did}#${base58.encode(ed25519PublicKey)}`;
+}
+/**
+ * `MsgAddVerification` adding the oracle's Ed25519 (UCAN-signing) key to its own IID document —
+ * qiforge `utils/composio.ts:146-157`, field for field: `relationships: ['authentication',
+ * 'assertionMethod']`, the method from `customMessages.iid.createVerificationMethod(did, key, did,
+ * 'ed')`, and the wallet ADDRESS as `signer`.
+ *
+ * That SDK helper emits `Ed25519VerificationKey2018` + `publicKeyBase58` (raw key), NOT the
+ * `Ed25519VerificationKey2020` + `z…` multibase pair our did:web document publishes — and the 2018
+ * form is deliberately kept, because it is the only Ed25519 shape that exists on chain today (a
+ * devnet sweep of IID documents finds 17 `Ed25519VerificationKey2018` methods and zero 2020s,
+ * including the one an existing oracle's did:ixo invocations already verify against). `@ixo/ucan`'s
+ * did:ixo resolver decodes base58, hex and multibase alike, so the two are equivalent to us and
+ * only the ported one is proven against the counterparties (claim bot, UCAN Store) we don't own.
+ */
+export async function verificationMethodMsg(did, controllerAddress, ed25519PublicKey) {
+    const { customMessages, ixo } = await import("@ixo/impactxclient-sdk");
+    return {
+        typeUrl: "/ixo.iid.v1beta1.MsgAddVerification",
+        value: ixo.iid.v1beta1.MsgAddVerification.fromPartial({
+            id: did,
+            verification: ixo.iid.v1beta1.Verification.fromPartial({
+                relationships: ["authentication", "assertionMethod"],
+                method: customMessages.iid.createVerificationMethod(did, ed25519PublicKey, did, "ed"),
+            }),
+            signer: controllerAddress,
+        }),
+    };
+}
+//# sourceMappingURL=oracle-account.js.map

package/dist/cli/lib/oracle-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracle-account.js","sourceRoot":"","sources":["../../../src/cli/lib/oracle-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAmB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,IAAI,EAIJ,YAAY,GACb,MAAM,SAAS,CAAC;AAajB;;kCAEkC;AAClC,KAAK,UAAU,mBAAmB,CAAC,OAAmB,EAAE,YAAoB;IAC1E,MAAM,CAAC,EAAE,mBAAmB,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/E,MAAM,CAAC,wBAAwB,CAAC;QAChC,MAAM,CAAC,uBAAuB,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,OAAO,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAmB,EACnB,YAAoB,EACpB,eAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,IAAI,CACF,mBAAmB,eAAe,6CAA6C,OAAO,MAAM;YAC1F,iGAAiG,CACpG,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,GAA2D,IAAI,CAAC;IAC1E,OAAO;QACL,OAAO;QACP,MAAM;QACN,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI;YAC/B,MAAM,KAAK,MAAM,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CACxC,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,IAAI,CACL,CAAsB,CAAC;YACxB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qGAAqG;AAErG;;gGAEgG;AAChG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY;IAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC1D,OAAO;QACL,OAAO,EAAE,8BAA8B;QACvC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YAC7C,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC1C,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAAe;IACjE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,qGAAqG;AAErG;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAAe,EACf,UAAsB,EACtB,aAAqB;IAErB,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvE,OAAO;QACL,OAAO,EAAE,uCAAuC;QAChD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,GAAG;YACP,aAAa,EAAE,cAAc,CAAC,GAAG,CAAC,4BAA4B,CAAC;gBAC7D,GAAG;gBACH,MAAM,EAAE,UAAU;gBAClB,OAAO;gBACP,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,MAAM;aACb,CAAC;YACF,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,CAAC,GAAG,CAAC;YAClB,QAAQ,EAAE;gBACR,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;oBAClC,EAAE,EAAE,GAAG,GAAG,SAAS;oBACnB,IAAI,EAAE,kBAAkB;oBACxB,eAAe,EAAE,aAAa;iBAC/B,CAAC;aACH;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAwBD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,GAAW;IACzD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,GAAW;IACzD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5F,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,GAAW;IAC9D,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE,GAAG,CAAC,YAAY;KAC/B,CAAC;AACJ,CAAC;AAED,sGAAsG;AAEtG;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,gBAA4B;IAC7E,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,iBAAyB,EACzB,gBAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvE,OAAO;QACL,OAAO,EAAE,qCAAqC;QAC9C,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC;YACpD,EAAE,EAAE,GAAG;YACP,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,CAAC;gBACrD,aAAa,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;gBACpD,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC;aACtF,CAAC;YACF,MAAM,EAAE,iBAAiB;SAC1B,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/cli/lib/project.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The filesystem side of `init` and `skills sync`: where the installed package keeps `templates/`
+ * and `skills/`, and how they land in a provider's directory.
+ */
+/**
+ * The package root — the directory `templates/`, `skills/` and `migrations/` sit in. The CLI's own
+ * directory is two levels below it (`src/cli/` in this repo, `dist/cli/` once published) and tsc
+ * keeps that layout, so the same hop from this file is right either way.
+ */
+export declare function packageRoot(): string;
+/**
+ * Copy a template tree, substituting `{{var}}` in every file. All of them are text by design: a
+ * project template that needed a binary asset would need a different lane, not a special case here.
+ */
+export declare function copyTemplate(templateDir: string, targetDir: string, vars: Record<string, string>): void;
+/**
+ * Refresh the package's skills in `targetDir`, replacing each package-owned entry WHOLESALE — a
+ * merge would leave behind a reference file the newer skill has dropped — and touching nothing
+ * else: a provider's own skills live in that same directory and are not ours to manage.
+ */
+export declare function copySkills(pkgSkillsDir: string, targetDir: string): void;
+//# sourceMappingURL=project.d.ts.map

package/dist/cli/lib/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/project.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAUD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,IAAI,CAWN;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAOxE"}

package/dist/cli/lib/project.js

@@ -0,0 +1,62 @@
+/**
+ * The filesystem side of `init` and `skills sync`: where the installed package keeps `templates/`
+ * and `skills/`, and how they land in a provider's directory.
+ */
+import { cpSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * The package root — the directory `templates/`, `skills/` and `migrations/` sit in. The CLI's own
+ * directory is two levels below it (`src/cli/` in this repo, `dist/cli/` once published) and tsc
+ * keeps that layout, so the same hop from this file is right either way.
+ */
+export function packageRoot() {
+    return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+}
+/**
+ * npm silently drops a file called `.gitignore` from every published tarball (verified with
+ * `npm pack`), so the template stores it under a name that survives and it is renamed on the way
+ * out — otherwise a project generated from the PUBLISHED package would ignore nothing, `*.car`
+ * delegations included. Do not rename the template file back.
+ */
+const RENAME_ON_COPY = { gitignore: ".gitignore" };
+/**
+ * Copy a template tree, substituting `{{var}}` in every file. All of them are text by design: a
+ * project template that needed a binary asset would need a different lane, not a special case here.
+ */
+export function copyTemplate(templateDir, targetDir, vars) {
+    mkdirSync(targetDir, { recursive: true });
+    for (const entry of readdirSync(templateDir, { withFileTypes: true })) {
+        const from = join(templateDir, entry.name);
+        const to = join(targetDir, RENAME_ON_COPY[entry.name] ?? entry.name);
+        if (entry.isDirectory()) {
+            copyTemplate(from, to, vars);
+            continue;
+        }
+        writeFileSync(to, substitute(readFileSync(from, "utf8"), vars, entry.name));
+    }
+}
+/**
+ * Refresh the package's skills in `targetDir`, replacing each package-owned entry WHOLESALE — a
+ * merge would leave behind a reference file the newer skill has dropped — and touching nothing
+ * else: a provider's own skills live in that same directory and are not ours to manage.
+ */
+export function copySkills(pkgSkillsDir, targetDir) {
+    mkdirSync(targetDir, { recursive: true });
+    for (const entry of readdirSync(pkgSkillsDir, { withFileTypes: true })) {
+        const to = join(targetDir, entry.name);
+        rmSync(to, { recursive: true, force: true });
+        cpSync(join(pkgSkillsDir, entry.name), to, { recursive: true });
+    }
+}
+/** A placeholder with no value would ship a broken package.json or wrangler.jsonc — fail loud. */
+function substitute(text, vars, file) {
+    let out = text;
+    for (const [key, value] of Object.entries(vars))
+        out = out.replaceAll(`{{${key}}}`, value);
+    const missing = out.match(/\{\{[^}]+\}\}/);
+    if (missing)
+        throw new Error(`${file}: no value for the template placeholder ${missing[0]}`);
+    return out;
+}
+//# sourceMappingURL=project.js.map

package/dist/cli/lib/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../../src/cli/lib/project.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,cAAc,GAA2B,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAE3E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,WAAmB,EACnB,SAAiB,EACjB,IAA4B;IAE5B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,SAAiB;IAChE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,UAAU,CAAC,IAAY,EAAE,IAA4B,EAAE,IAAY;IAC1E,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli/lib/session.d.ts

@@ -0,0 +1,109 @@
+import { type ApiOp } from "../../contracts/capabilities.js";
+import { type IxoNetwork } from "../../networks.js";
+/** The `/api/auth/exchange` response (impacts-x-web `lib/authHub/index.ts`), plus two fields a real
+ *  exchange returns that the portal's own TS type omits — `matrixHomeserver` and `email`.
+ *  `sessionMnemonic` signs on-chain txs (smart-account auth); `edSigningMnemonic` signs UCAN tokens;
+ *  `matrixMnemonic` logs into Matrix. The root key never leaves the hub. */
+export interface AuthHubSession {
+    address: string;
+    did: string;
+    displayName: string | null;
+    email: string | null;
+    matrixUserId: string | null;
+    matrixRoomId: string | null;
+    matrixHomeserver: string | null;
+    sessionMnemonic: string | null;
+    sessionAuthenticatorId: string | null;
+    edSigningMnemonic: string | null;
+    matrixMnemonic: string | null;
+    /** Stamped by `login` when it saves the session — NOT part of the hub's `/api/auth/exchange`
+     *  response. Makes the on-disk file self-identifying: which tool holds this bearer key, and
+     *  since when. Optional because a session saved before this landed won't have it. */
+    app?: string;
+    obtainedAt?: string;
+}
+export interface PublishSigner {
+    network: IxoNetwork;
+    address: string;
+    did: string;
+    /** The full AuthHub session behind this signer — `delegation` mints its UCAN issuer straight from
+     *  `session.edSigningMnemonic` + `session.did`, the room-sourcing step the same, neither needing
+     *  a separate Matrix-vault mnemonic derivation. */
+    session: AuthHubSession;
+    /**
+     * Lazily resolves the REAL secp256k1 pubkey behind this signer — needed only by
+     * `customMessages.iid.createIidVerificationMethods` when creating a brand-new entity's IID
+     * verification methods. Deliberately NOT a plain field: deriving it touches the session mnemonic,
+     * and a dry-run plan-print must never do that (a garbage fake-session mnemonic must not throw
+     * before the `--yes` gate) — callers fetch this only after `confirm()` returns.
+     */
+    getPubkey(): Promise<Uint8Array>;
+    client: any;
+}
+/** One file per network, mode 0600 — the same path the portal-side publish tooling uses, so a
+ *  provider who has logged in once anywhere is logged in here too. */
+export declare function sessionPath(network: IxoNetwork): string;
+/** Written only by `login`; every other command reads it. */
+export declare function saveSession(network: IxoNetwork, session: AuthHubSession): Promise<string>;
+/** Reads and minimally validates the saved session — fails with the exact re-login command on any
+ *  problem (missing file, bad JSON, missing the fields signing needs). Login is meant to run ONCE
+ *  per network: whenever this file exists and is well-formed, every command reuses it silently —
+ *  this function never triggers a login itself, it only reads what `login` already saved. */
+export declare function loadSession(network: IxoNetwork): Promise<AuthHubSession>;
+/** `network → loadSession → buildSessionSigner` — the ONE signer builder every chain command uses. */
+export declare function buildSigner(network: IxoNetwork): Promise<PublishSigner>;
+/**
+ * `session → PublishSigner`. Deliberately does NOT touch the wallet or the network here — both
+ * `getPubkey()` and `client.signAndBroadcast()` defer everything session-mnemonic-related until
+ * actually called, which only happens after `confirm()`'s `--yes` gate. A dry-run invocation that
+ * only ever calls `confirm()` (and exits before it returns) never constructs a wallet, never opens
+ * an RPC connection — even with a garbage `sessionMnemonic` in the session file.
+ */
+export declare function buildSessionSigner(network: IxoNetwork, session: AuthHubSession): Promise<PublishSigner>;
+/**
+ * One self-signed `@ixo/ucan` invocation from the session's DID to the oracle's did:web (read off
+ * its own `/.well-known/did.json`), `{ can: <the route's action>, with: "ixo:eval-oracle" }` — the
+ * action from the chain lane's own table (`middleware/capability.ts` `ROUTE_ACTIONS`), exactly what
+ * the oracle verifies, with a fresh nonce per call so two calls never share a CID. This is the
+ * COMMISSIONER's identity (the wallet that created the collection), which is what `register` and
+ * `scan` are gated on.
+ *
+ * `api` makes it a Decision API console invocation (`middleware/api/console.ts`): the `with` is
+ * derived from the oracle's did:web (`ixo:oracle/<did:web>[/source/<id>]`) and the `can` is the
+ * route's `op` action from the lane's own table (`contracts/capabilities.ts` `API_ACTIONS`).
+ */
+export declare function kitFetch(session: AuthHubSession, kitUrl: string, path: string, init?: RequestInit, api?: {
+    op: ApiOp;
+    resource: (oracleDid: string) => string;
+}): Promise<{
+    res: Response;
+    did: string;
+}>;
+/**
+ * One self-signed invocation from the session's DID to the service at `serviceUrl` — the oracle
+ * (`kitFetch`) or the engine (`api source link`'s `company/link`): audience its did:web, read off
+ * its own `/.well-known/did.json`, the ONE capability the caller names, 120 s, no proofs (the
+ * session invokes as itself), a fresh nonce so two calls never share a CID.
+ */
+export declare function sessionInvocation(session: AuthHubSession, serviceUrl: string, label: string, capability: (audience: string) => {
+    can: string;
+    with: string;
+}): Promise<{
+    token: string;
+    did: string;
+    audience: string;
+}>;
+/**
+ * The organisation's company link (docs/ENGINE-CONTRACT.md "The company link"), signed as the
+ * session — a current controller of `entityDid` — the way the Decision Console's "Add oracle" does
+ * it (eval-engine-dashboard `lib/companyLink.ts`): a compact JWS in the review-attestation format,
+ * `kid` the did:key of the session's Ed25519 key (the one its IID publishes, the same key every
+ * invocation signs with), the payload canonical JSON (the engine re-serializes it and refuses any
+ * other bytes). `payeeField` null: the console's "Add oracle" names none either.
+ */
+export declare function signCompanyLink(session: AuthHubSession, link: {
+    entityDid: string;
+    oracleDid: string;
+    sourceId: string;
+}, now?: Date): Promise<string>;
+//# sourceMappingURL=session.d.ts.map

package/dist/cli/lib/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/session.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAG3D;;;4EAG4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;yFAEqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,UAAU,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ;;uDAEmD;IACnD,OAAO,EAAE,cAAc,CAAC;IACxB;;;;;;OAMG;IACH,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAEjC,MAAM,EAAE,GAAG,CAAC;CACb;AAED;sEACsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAEvD;AAED,6DAA6D;AAC7D,wBAAsB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM/F;AAED;;;6FAG6F;AAC7F,wBAAsB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CA2B9E;AAED,sGAAsG;AACtG,wBAAsB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAE7E;AAgLD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA8BxB;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,WAAgB,EACtB,GAAG,CAAC,EAAE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,GAC3D,OAAO,CAAC;IAAE,GAAG,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBzC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B3D;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAChE,GAAG,OAAa,GACf,OAAO,CAAC,MAAM,CAAC,CA6BjB"}