@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/cli/commands/create-deed.js

@@ -0,0 +1,208 @@
+/**
+ * `decision-oracle create-deed` — create a DEED (the domain entity people submit claims against) and
+ * link it to an already-published protocol the way the portal's creator-studio does, so the portal's
+ * collection block lists the protocol in its picker. Signs REAL transactions — see lib/chain.ts for
+ * the `--yes` confirm gate every write goes through.
+ *
+ *   decision-oracle create-deed --protocol did:ixo:entity:… --title "…" [--description "…"]
+ *     [--type deed] [--network devnet] [--phase entity|room|claims|all] [--entity did:ixo:entity:…] [--yes]
+ *
+ * The claims stack is THREE objects, created in a fixed order, each pointing at the previous one:
+ *
+ *   protocol (`protocol/verifiableClaim`: the claim SCHEMA — #vct + #rub; a template, owns nothing)
+ *     → deed (a domain: hosts claims; its `linkedClaim` names the protocol)
+ *       → collection (`MsgCreateCollection` entity = the deed, protocol = the protocol — `create-collection`)
+ *
+ * Passing the protocol DID where the deed belongs is what the portal reports as "No claim protocols
+ * are linked to <did>": its picker is given the ENTITY, reads its `linkedClaim[]`, resolves each to
+ * a claims-config doc, and lists `entityClaims[].template.id` — which must be a bare protocol DID,
+ * never a creator-studio `ref:<node>:did` placeholder (those render greyed-out).
+ *
+ * Phases (default `all`): `entity` — MsgCreateEntity of `--type` (default `deed`), skipped with
+ * `--entity`; `room` — source the deed's Matrix room + invite the claim bot (a collection's claims
+ * land in ITS entity's room, so without this every submission is IXO_ROOM_NOT_FOUND); `claims` —
+ * write the claims-config doc into the deed's room state at key `claims`, path `<cid>`, with a
+ * public ACL — exactly where the portal reads it — then ONE tx: MsgAddLinkedClaim `{id}#claims`
+ * (serviceEndpoint `matrix:<cid>`, proof `<cid>`) + MsgAddService `{id}#matrix`. Resume a
+ * half-finished run with `--entity <did> --phase room|claims|all`; `room` is idempotent and `claims`
+ * re-writes the same doc.
+ */
+import { CID } from "multiformats/cid";
+import { sha256 } from "multiformats/hashes/sha2";
+import { NETWORKS } from "../../networks.js";
+import { parse } from "../lib/args.js";
+import { addServiceMsg, broadcast, confirm, createEntity, fail, matrixBots, matrixLoginFromSession, resolveEntity, resolveNetwork, STANDARD_FEE, sourceEntityRoom, } from "../lib/chain.js";
+import { buildSigner } from "../lib/session.js";
+function resolvePhase(value) {
+    const phase = value ?? "all";
+    if (phase !== "entity" && phase !== "room" && phase !== "claims" && phase !== "all") {
+        fail(`unknown --phase '${phase}' (entity|room|claims|all)`);
+    }
+    return phase;
+}
+const RUNS = {
+    entity: (p) => p === "entity" || p === "all",
+    room: (p) => p === "room" || p === "all",
+    claims: (p) => p === "claims" || p === "all",
+};
+/**
+ * The claims-config doc, verbatim the shape impacts-x-webapp's `addLinkedClaimOnConnection.ts`
+ * writes (envelope, `entityClaims[].template` fields) with `template.id` already the bare protocol
+ * DID — the one thing creator-studio only resolves at publish time and the portal's picker insists on.
+ */
+function claimsConfigDoc(protocolDid, title, description) {
+    return {
+        "@context": {
+            ixo: "https://w3id.org/ixo/vocab/v1",
+            web3: "https://ipfs.io/ipfs/",
+            id: "@id",
+            type: "@type",
+            "@protected": true,
+        },
+        id: "{id}#claims",
+        type: "ixo:Claims",
+        entityClaims: [
+            {
+                id: "claims",
+                template: {
+                    id: protocolDid,
+                    type: "verifiableClaim",
+                    title,
+                    description,
+                    creator: "",
+                    createdAt: new Date().toISOString(),
+                },
+                isEncrypted: false,
+                isHeadlineMetric: true,
+            },
+        ],
+    };
+}
+/** CIDv1 / raw / sha256 of the bytes — `createCIDFromBase64` in impacts-x-webapp's `storage/utils.ts`,
+ *  minus its base64 detour (the multibase decode there just yields these bytes back). */
+async function cidOf(bytes) {
+    return CID.create(1, 0x55, await sha256.digest(bytes)).toString();
+}
+async function linkClaims(signer, entityDid, protocolDid, title, description, yes) {
+    const matrixBase = NETWORKS[signer.network].matrix.replace(/\/+$/, "");
+    const doc = claimsConfigDoc(protocolDid, title, description);
+    const bytes = new TextEncoder().encode(JSON.stringify(doc));
+    const cid = await cidOf(bytes);
+    confirm({
+        network: signer.network,
+        signer: signer.did,
+        action: "write claims-config doc to the deed's room state (state-bot) + set public ACL",
+        lines: [
+            `entity: ${entityDid}`,
+            `template.id: ${protocolDid}`,
+            `room state key: claims, path: ${cid}`,
+        ],
+    }, yes);
+    // State-bot writes carry only the session's UCAN — no Matrix login. `matrixBots` (UCAN-only here)
+    // resolves the room and mints the UCAN; the writes themselves (`setState`, `setAcl`) go straight
+    // through the SDK's state-bot client.
+    const bots = await matrixBots(signer);
+    const roomId = await bots.roomId(entityDid);
+    const { createMatrixStateBotClient } = await import("@ixo/matrixclient-sdk");
+    const urls = await bots.urls(entityDid);
+    const ucan = await bots.ucan(entityDid, "stateBot");
+    const stateBot = createMatrixStateBotClient({
+        botUrl: urls.stateBot,
+        accessToken: "",
+        homeServerUrl: urls.homeServer,
+    });
+    await stateBot.state.v1beta1.setState(roomId, "claims", cid, JSON.stringify(doc), ucan);
+    await stateBot.acl.v1beta1.setAcl(roomId, "claims", cid, JSON.stringify({ canAccess: ["*"], canEdit: [] }), ucan);
+    console.log(`✓ claims-config doc stored in ${roomId} at claims/${cid} (public ACL)`);
+    confirm({
+        network: signer.network,
+        signer: signer.address,
+        action: "MsgAddLinkedClaim {id}#claims + MsgAddService Matrix",
+        lines: [`entity: ${entityDid}`, `serviceEndpoint: matrix:${cid}`, `proof: ${cid}`],
+        fee: STANDARD_FEE,
+    }, yes);
+    const { ixo } = await import("@ixo/impactxclient-sdk");
+    const linkedClaim = {
+        typeUrl: "/ixo.iid.v1beta1.MsgAddLinkedClaim",
+        value: ixo.iid.v1beta1.MsgAddLinkedClaim.fromPartial({
+            id: entityDid,
+            linkedClaim: ixo.iid.v1beta1.LinkedClaim.fromPartial({
+                id: "{id}#claims",
+                type: "protocol/verifiableClaim",
+                description,
+                serviceEndpoint: `matrix:${cid}`,
+                proof: cid,
+                encrypted: "false",
+                right: "",
+            }),
+            signer: signer.address,
+        }),
+    };
+    const svc = await addServiceMsg(entityDid, { id: "{id}#matrix", type: "Matrix", serviceEndpoint: matrixBase }, signer.address);
+    const { hash } = await broadcast(signer, [linkedClaim, svc], "create-deed: claims");
+    console.log(`✓ linkedClaim + Matrix service added (tx ${hash})`);
+    return cid;
+}
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            protocol: { type: "string" },
+            title: { type: "string" },
+            description: { type: "string" },
+            type: { type: "string" },
+            network: { type: "string" },
+            phase: { type: "string" },
+            entity: { type: "string" },
+            yes: { type: "boolean" },
+        },
+    });
+    const protocolDid = values.protocol ?? fail("--protocol <did> is required");
+    const title = values.title ?? fail('--title "<deed name>" is required');
+    const description = values.description ?? "";
+    const entityType = values.type ?? "deed";
+    const network = resolveNetwork(values.network);
+    const phase = resolvePhase(values.phase);
+    const yes = values.yes === true;
+    let entityDid = values.entity;
+    const blocksync = NETWORKS[network].blocksync;
+    const protocol = await resolveEntity(blocksync, protocolDid);
+    if (protocol.type !== "protocol/verifiableClaim") {
+        fail(`${protocolDid} is ${protocol.type ?? "not on blocksync"} — --protocol must be a protocol/verifiableClaim entity (publish-protocol first)`);
+    }
+    if (!protocol.linkedResources.some((r) => r.id.endsWith("#rub"))) {
+        fail(`${protocolDid} has no #rub linked resource — finish publish-protocol before linking a deed`);
+    }
+    const signer = await buildSigner(network);
+    console.log(`signer: ${signer.address} (${network})`);
+    // The one Matrix login (the `room` phase's join/invite), minted only past its confirm gate.
+    let matrixLogin;
+    const matrixToken = () => (matrixLogin ??= matrixLoginFromSession(signer));
+    let roomId;
+    let cid;
+    if (RUNS.entity(phase)) {
+        if (entityDid) {
+            console.log(`using existing entity ${entityDid} (--entity given) — skipping creation`);
+        }
+        else {
+            entityDid = await createEntity(signer, entityType, yes);
+        }
+    }
+    if (RUNS.room(phase)) {
+        if (!entityDid)
+            fail("--phase room needs --entity <did> (or run --phase entity/all first)");
+        roomId = await sourceEntityRoom(signer, entityDid, matrixToken, yes);
+    }
+    if (RUNS.claims(phase)) {
+        if (!entityDid)
+            fail("--phase claims needs --entity <did> (or run --phase entity/all first)");
+        cid = await linkClaims(signer, entityDid, protocolDid, title, description, yes);
+    }
+    console.log("\n════ deed ════");
+    console.log(`deed DID     : ${entityDid ?? "(not created this run)"}`);
+    console.log(`protocol     : ${protocolDid}`);
+    console.log(`room id      : ${roomId ?? "(not run this phase)"}`);
+    console.log(`claims cid   : ${cid ?? "(not run this phase)"} (linkedClaim proof)`);
+    console.log(`next         : decision-oracle create-collection --entity ${entityDid ?? "<deed>"} --protocol ${protocolDid} --eval-amount <uixo>\n`);
+    return 0;
+}
+//# sourceMappingURL=create-deed.js.map

package/dist/cli/commands/create-deed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-deed.js","sourceRoot":"","sources":["../../../src/cli/commands/create-deed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,aAAa,EACb,SAAS,EACT,OAAO,EACP,YAAY,EACZ,IAAI,EACJ,UAAU,EACV,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAsB,MAAM,gBAAgB,CAAC;AAIjE,SAAS,YAAY,CAAC,KAAyB;IAC7C,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC;IAC7B,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpF,IAAI,CAAC,oBAAoB,KAAK,4BAA4B,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,IAAI,GAAG;IACX,MAAM,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK;IACnD,IAAI,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;IAC/C,MAAM,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK;CACpD,CAAC;AAEF;;;;GAIG;AACH,SAAS,eAAe,CAAC,WAAmB,EAAE,KAAa,EAAE,WAAmB;IAC9E,OAAO;QACL,UAAU,EAAE;YACV,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,uBAAuB;YAC7B,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,IAAI;SACnB;QACD,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE;YACZ;gBACE,EAAE,EAAE,QAAQ;gBACZ,QAAQ,EAAE;oBACR,EAAE,EAAE,WAAW;oBACf,IAAI,EAAE,iBAAiB;oBACvB,KAAK;oBACL,WAAW;oBACX,OAAO,EAAE,EAAE;oBACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;gBACD,WAAW,EAAE,KAAK;gBAClB,gBAAgB,EAAE,IAAI;aACvB;SACF;KACF,CAAC;AACJ,CAAC;AAED;yFACyF;AACzF,KAAK,UAAU,KAAK,CAAC,KAAiB;IACpC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAqB,EACrB,SAAiB,EACjB,WAAmB,EACnB,KAAa,EACb,WAAmB,EACnB,GAAY;IAEZ,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IAE/B,OAAO,CACL;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM,EAAE,+EAA+E;QACvF,KAAK,EAAE;YACL,WAAW,SAAS,EAAE;YACtB,gBAAgB,WAAW,EAAE;YAC7B,iCAAiC,GAAG,EAAE;SACvC;KACF,EACD,GAAG,CACJ,CAAC;IACF,kGAAkG;IAClG,iGAAiG;IACjG,sCAAsC;IACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,QAAQ;QACrB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,IAAI,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACxF,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAC/B,MAAM,EACN,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EACjD,IAAI,CACL,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,iCAAiC,MAAM,cAAc,GAAG,eAAe,CAAC,CAAC;IAErF,OAAO,CACL;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,OAAO;QACtB,MAAM,EAAE,sDAAsD;QAC9D,KAAK,EAAE,CAAC,WAAW,SAAS,EAAE,EAAE,2BAA2B,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,CAAC;QAClF,GAAG,EAAE,YAAY;KAClB,EACD,GAAG,CACJ,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,oCAAoC;QAC7C,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC;YACnD,EAAE,EAAE,SAAS;YACb,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;gBACnD,EAAE,EAAE,aAAa;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,WAAW;gBACX,eAAe,EAAE,UAAU,GAAG,EAAE;gBAChC,KAAK,EAAE,GAAG;gBACV,SAAS,EAAE,OAAO;gBAClB,KAAK,EAAE,EAAE;aACV,CAAC;YACF,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC;KACH,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,SAAS,EACT,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAClE,MAAM,CAAC,OAAO,CACf,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,4CAA4C,IAAI,GAAG,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SACzB;KACF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC;IACzC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC;IAChC,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAE9B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACjD,IAAI,CACF,GAAG,WAAW,OAAO,QAAQ,CAAC,IAAI,IAAI,kBAAkB,kFAAkF,CAC3I,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,CACF,GAAG,WAAW,8EAA8E,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,KAAK,OAAO,GAAG,CAAC,CAAC;IACtD,4FAA4F;IAC5F,IAAI,WAAwC,CAAC;IAC7C,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,CAAC,WAAW,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,IAAI,MAA0B,CAAC;IAC/B,IAAI,GAAuB,CAAC;IAE5B,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,yBAAyB,SAAS,uCAAuC,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAC5F,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,uEAAuE,CAAC,CAAC;QAC9F,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,IAAI,wBAAwB,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,IAAI,sBAAsB,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,IAAI,sBAAsB,sBAAsB,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CACT,6DAA6D,SAAS,IAAI,QAAQ,eAAe,WAAW,yBAAyB,CACtI,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/delegation.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `decision-oracle delegation` — mint an owner→oracle UCAN delegation CAR for the Matrix claim-bot
+ * resource. Without it, an oracle granted Evaluate/Submit on a collection still can't pull claim
+ * bodies: the claim bot needs a delegation, not just an on-chain claims-authz grant.
+ *
+ *   decision-oracle delegation --audience did:ixo:<oracle wallet address> --out delegation.car \
+ *     [--network devnet] [--days 30] [--yes]
+ *
+ * `--for engine` mints a DIFFERENT delegation instead: the oracle OWNER's billing delegation to the
+ * DECISION ENGINE — what `register()` posts as `ownerDelegation` so the engine can find (and bill)
+ * the owner's subscription. Same signer, same AuthHub session, different audience/capabilities/
+ * resource:
+ *
+ *   decision-oracle delegation --for engine --audience did:web:<engine host> \
+ *     --oracle did:web:<oracle host> --out owner-delegation.car [--network devnet] \
+ *     [--days 36500] [--yes]
+ *
+ * Requires an AuthHub session (`decision-oracle login --network <n>` first) — the owner is whoever is
+ * logged in. Signs with the session's `edSigningMnemonic` directly (the ed25519 key AuthHub already
+ * provisions for UCAN signing) — no Matrix-vault mnemonic derivation, no PIN.
+ * The resource is always `ixo:matrix-claims-bot` — the only thing the (default) bot delegation is for.
+ *
+ * The CAR is WRITTEN to `--out`, never printed: it is a bearer credential.
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=delegation.d.ts.map

package/dist/cli/commands/delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAgCH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+GzD"}

package/dist/cli/commands/delegation.js

@@ -0,0 +1,162 @@
+/**
+ * `decision-oracle delegation` — mint an owner→oracle UCAN delegation CAR for the Matrix claim-bot
+ * resource. Without it, an oracle granted Evaluate/Submit on a collection still can't pull claim
+ * bodies: the claim bot needs a delegation, not just an on-chain claims-authz grant.
+ *
+ *   decision-oracle delegation --audience did:ixo:<oracle wallet address> --out delegation.car \
+ *     [--network devnet] [--days 30] [--yes]
+ *
+ * `--for engine` mints a DIFFERENT delegation instead: the oracle OWNER's billing delegation to the
+ * DECISION ENGINE — what `register()` posts as `ownerDelegation` so the engine can find (and bill)
+ * the owner's subscription. Same signer, same AuthHub session, different audience/capabilities/
+ * resource:
+ *
+ *   decision-oracle delegation --for engine --audience did:web:<engine host> \
+ *     --oracle did:web:<oracle host> --out owner-delegation.car [--network devnet] \
+ *     [--days 36500] [--yes]
+ *
+ * Requires an AuthHub session (`decision-oracle login --network <n>` first) — the owner is whoever is
+ * logged in. Signs with the session's `edSigningMnemonic` directly (the ed25519 key AuthHub already
+ * provisions for UCAN signing) — no Matrix-vault mnemonic derivation, no PIN.
+ * The resource is always `ixo:matrix-claims-bot` — the only thing the (default) bot delegation is for.
+ *
+ * The CAR is WRITTEN to `--out`, never printed: it is a bearer credential.
+ */
+import { chmod, lstat, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { parse } from "../lib/args.js";
+import { confirm, fail, resolveNetwork } from "../lib/chain.js";
+import { buildSigner } from "../lib/session.js";
+const RESOURCE = "ixo:matrix-claims-bot";
+/** `--for engine`: the oracle OWNER's delegation to the DECISION ENGINE — subscriptions-api answers
+ *  `GET /subscriptions` for the root of this chain, and `billing/pay` binds the CAR to ONE oracle so
+ *  a leaked file can't bill its owner for a stranger. */
+const ENGINE_CAPABILITIES = (oracleDid) => [
+    { can: "subscriptions/read", with: "ixo:subscriptions" },
+    { can: "billing/pay", with: oracleDid },
+];
+/** Lifetimes are typed in days but read in the unit that fits: `30d` is a number a human holds,
+ *  `36500d` is not. A year or more prints as years. */
+function lifetime(days) {
+    return days < 365 ? `${days}d` : `${Number((days / 365).toFixed(1))}y`;
+}
+/** `@ixo/ucan`'s `signerFromMnemonic` wants its DID as a `did:ixo:${string}` template literal type. */
+function asIxoDid(value) {
+    if (!value.startsWith("did:ixo:"))
+        fail(`AuthHub session did must be a did:ixo: DID, got: ${value}`);
+    return value;
+}
+export async function run(argv) {
+    const { values } = parse(argv, {
+        options: {
+            for: { type: "string" },
+            audience: { type: "string" },
+            out: { type: "string" },
+            oracle: { type: "string" },
+            network: { type: "string" },
+            days: { type: "string" },
+            yes: { type: "boolean" },
+        },
+    });
+    const target = values.for ?? "bot";
+    if (target !== "bot" && target !== "engine") {
+        fail(`--for must be "bot" or "engine", got: ${target}`);
+    }
+    const audience = values.audience ??
+        fail(target === "engine"
+            ? "--audience did:web:<engine host> is required with --for engine"
+            : "--audience <did:ixo:oracle…> is required");
+    const out = values.out ?? fail("--out <file> is required");
+    const network = resolveNetwork(values.network);
+    // The two defaults are deliberately far apart — don't tidy them into one number.
+    // The bot delegation keeps its 30d: it carries `{ can: "*", with: RESOURCE }`, every capability on
+    // the claims bot, and for a capability that broad a short life IS the containment.
+    // The engine delegation gets 100 years because NOTHING renews it. The engine checks expiry only at
+    // registration, re-parses the stored CAR on every billing call, and the billing cron never looks at
+    // it — so the old 365d default meant each oracle silently began failing billing on the engine's
+    // 400 "ownerDelegation is already expired" a year after it was minted, one at a time, on a rolling
+    // schedule nobody is watching. Past a handful of oracles that is not fixable by hand.
+    // The price of removing that cliff, stated plainly: the engine has no revocation anywhere, so a
+    // leaked owner→engine CAR is a bearer credential that can read the owner's subscription and bill
+    // them for the life of the delegation — now effectively forever. We accept it because the loss is
+    // bounded by the capability pair itself (subscriptions/read, and billing/pay bound to ONE oracle
+    // did:web), while the expiry cliff was not bounded by anything. Leaked → rotate the owner's key.
+    const days = Number(values.days ?? (target === "engine" ? "36500" : "30"));
+    const yes = values.yes === true;
+    const oracle = target === "engine"
+        ? (values.oracle ?? fail("--oracle <did:web:oracle host> is required with --for engine"))
+        : undefined;
+    if (target === "engine" && !audience.startsWith("did:web:")) {
+        fail(`--for engine requires --audience did:web:<engine host>, got: ${audience}`);
+    }
+    const signer = await buildSigner(network);
+    const ownerDid = asIxoDid(signer.session.did);
+    console.log(`owner: ${ownerDid} (wallet ${signer.address}, ${network})`);
+    confirm({
+        network,
+        signer: ownerDid,
+        action: target === "engine"
+            ? "mint owner→engine UCAN delegation"
+            : "mint owner→oracle UCAN delegation",
+        lines: target === "engine"
+            ? [
+                `audience: ${audience}`,
+                `capabilities: subscriptions/read on ixo:subscriptions · billing/pay on ${oracle}`,
+                `expires:  ${lifetime(days)}`,
+                `out:      ${out}`,
+                "signs with the AuthHub session's edSigningMnemonic (no Matrix-vault PIN decrypt needed)",
+            ]
+            : [
+                `audience: ${audience}`,
+                `resource: ${RESOURCE}`,
+                `expires:  ${lifetime(days)}`,
+                `out:      ${out}`,
+                "signs with the AuthHub session's edSigningMnemonic (no Matrix-vault PIN decrypt needed)",
+            ],
+    }, yes);
+    const edSigningMnemonic = signer.session.edSigningMnemonic ??
+        fail("AuthHub session has no edSigningMnemonic — re-run login");
+    const { signerFromMnemonic, createDelegation, serializeDelegation } = await import("@ixo/ucan");
+    const { signer: ucanSigner } = await signerFromMnemonic(edSigningMnemonic, ownerDid);
+    const delegation = await createDelegation({
+        issuer: ucanSigner,
+        audience,
+        capabilities: target === "engine" ? ENGINE_CAPABILITIES(oracle) : [{ can: "*", with: RESOURCE }],
+        expiration: Math.floor(Date.now() / 1000) + days * 24 * 3600,
+    });
+    const car = await serializeDelegation(delegation);
+    await writeSecretFile(out, car);
+    if (target === "engine") {
+        console.log(`✓ owner→engine delegation written to ${out}`);
+        console.log(`  Set it in your .dev.vars:   OWNER_DELEGATION_CAR="<contents of ${out}>"`);
+        console.log("  If register answers 402: buy credits in the Decision Console (Billing › Credits) as this same account, then register again.");
+    }
+    else {
+        console.log(`✓ delegation ${ownerDid} → ${audience}`);
+        console.log(`  resource ${RESOURCE} · expires in ${lifetime(days)} · ${car.length} bytes → ${out}`);
+    }
+    return 0;
+}
+/**
+ * Write a bearer credential so it is never readable by anyone else, not even for a moment: a fresh
+ * temp file beside `out`, created exclusively (`wx`) at 0600 and chmodded before the secret goes in
+ * (umask can only narrow `mode`), then renamed over `out`. A symlink at `out` is refused — the
+ * credential would land wherever it points.
+ */
+async function writeSecretFile(out, content) {
+    const existing = await lstat(out).catch(() => null);
+    if (existing?.isSymbolicLink())
+        fail(`--out ${out} is a symlink — refusing to write a credential through it`);
+    const tmp = join(dirname(out), `.${basename(out)}.${crypto.randomUUID()}.tmp`);
+    try {
+        await writeFile(tmp, "", { mode: 0o600, flag: "wx" });
+        await chmod(tmp, 0o600);
+        await writeFile(tmp, content);
+        await rename(tmp, out);
+    }
+    catch (err) {
+        await rm(tmp, { force: true });
+        throw err;
+    }
+}
+//# sourceMappingURL=delegation.js.map

package/dist/cli/commands/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../../src/cli/commands/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEzC;;yDAEyD;AACzD,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAgB,EAAE,CAAC;IAC/D,EAAE,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACxD,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,SAAkC,EAAE;CACjE,CAAC;AAEF;uDACuD;AACvD,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACzE,CAAC;AAED,uGAAuG;AACvG,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/B,IAAI,CAAC,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO,KAA4B,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SACzB;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC;IACnC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GACZ,MAAM,CAAC,QAAQ;QACf,IAAI,CACF,MAAM,KAAK,QAAQ;YACjB,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,0CAA0C,CAC/C,CAAC;IACJ,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,iFAAiF;IACjF,mGAAmG;IACnG,mFAAmF;IACnF,mGAAmG;IACnG,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,sFAAsF;IACtF,gGAAgG;IAChG,iGAAiG;IACjG,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC;IAEhC,MAAM,MAAM,GACV,MAAM,KAAK,QAAQ;QACjB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,8DAA8D,CAAC,CAAC;QACzF,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,gEAAgE,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,QAAQ,YAAY,MAAM,CAAC,OAAO,KAAK,OAAO,GAAG,CAAC,CAAC;IAEzE,OAAO,CACL;QACE,OAAO;QACP,MAAM,EAAE,QAAQ;QAChB,MAAM,EACJ,MAAM,KAAK,QAAQ;YACjB,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,mCAAmC;QACzC,KAAK,EACH,MAAM,KAAK,QAAQ;YACjB,CAAC,CAAC;gBACE,aAAa,QAAQ,EAAE;gBACvB,0EAA0E,MAAM,EAAE;gBAClF,aAAa,QAAQ,CAAC,IAAI,CAAC,EAAE;gBAC7B,aAAa,GAAG,EAAE;gBAClB,yFAAyF;aAC1F;YACH,CAAC,CAAC;gBACE,aAAa,QAAQ,EAAE;gBACvB,aAAa,QAAQ,EAAE;gBACvB,aAAa,QAAQ,CAAC,IAAI,CAAC,EAAE;gBAC7B,aAAa,GAAG,EAAE;gBAClB,yFAAyF;aAC1F;KACR,EACD,GAAG,CACJ,CAAC;IAEF,MAAM,iBAAiB,GACrB,MAAM,CAAC,OAAO,CAAC,iBAAiB;QAChC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAElE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAChG,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;QACxC,MAAM,EAAE,UAAU;QAClB,QAAQ;QACR,YAAY,EACV,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC9F,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI;KAC7D,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEhC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,oEAAoE,GAAG,IAAI,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CACT,+HAA+H,CAChI,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,MAAM,QAAQ,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CACT,cAAc,QAAQ,iBAAiB,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,YAAY,GAAG,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,OAAe;IACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,cAAc,EAAE;QAC5B,IAAI,CAAC,SAAS,GAAG,2DAA2D,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/cli/commands/derive.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `decision-oracle derive` — the chain identity behind an `ORACLE_SECP_MNEMONIC`, derived exactly as
+ * the oracle derives it at first use (lib/engine/adr36.ts `deriveOracleKey`: cosmos path
+ * m/44'/118'/0'/0/0, `ixo` bech32) — i.e. the three public vars the config needs
+ * (`ORACLE_ADDRESS`, `ORACLE_DID`, `ORACLE_MATRIX_USER_ID`), printed as `.dev.vars` lines.
+ * `ORACLE_ADDRESS` is asserted against this derivation before the first proof or signature, so a
+ * hand-typed one that differs fails loud.
+ *
+ *   decision-oracle derive "<12/24-word mnemonic>"   derive from a mnemonic you hold
+ *   decision-oracle derive --new                     generate a fresh 24-word one first
+ *   … [--network devnet] [--homeserver devmx.ixo.earth]   the MXID's server (the network's, by default)
+ *
+ * The mnemonic must be valid BIP-39 English: the ADR-36 proof would accept any string, but the
+ * chain signer (`DirectSecp256k1HdWallet`) refuses a bad checksum — so it is refused here first. A
+ * fresh one from `--new` also serves as a `SERVICE_ED25519_MNEMONIC` (that key is SHA-256 of the
+ * string — lib/ixo/identity.ts — so real words are convention, not a rule).
+ *
+ * Nothing here touches the network or writes a file: the four lines go to stdout, and a provider
+ * pastes them into `.dev.vars` themselves.
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=derive.d.ts.map

package/dist/cli/commands/derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BzD"}

package/dist/cli/commands/derive.js

@@ -0,0 +1,53 @@
+/**
+ * `decision-oracle derive` — the chain identity behind an `ORACLE_SECP_MNEMONIC`, derived exactly as
+ * the oracle derives it at first use (lib/engine/adr36.ts `deriveOracleKey`: cosmos path
+ * m/44'/118'/0'/0/0, `ixo` bech32) — i.e. the three public vars the config needs
+ * (`ORACLE_ADDRESS`, `ORACLE_DID`, `ORACLE_MATRIX_USER_ID`), printed as `.dev.vars` lines.
+ * `ORACLE_ADDRESS` is asserted against this derivation before the first proof or signature, so a
+ * hand-typed one that differs fails loud.
+ *
+ *   decision-oracle derive "<12/24-word mnemonic>"   derive from a mnemonic you hold
+ *   decision-oracle derive --new                     generate a fresh 24-word one first
+ *   … [--network devnet] [--homeserver devmx.ixo.earth]   the MXID's server (the network's, by default)
+ *
+ * The mnemonic must be valid BIP-39 English: the ADR-36 proof would accept any string, but the
+ * chain signer (`DirectSecp256k1HdWallet`) refuses a bad checksum — so it is refused here first. A
+ * fresh one from `--new` also serves as a `SERVICE_ED25519_MNEMONIC` (that key is SHA-256 of the
+ * string — lib/ixo/identity.ts — so real words are convention, not a rule).
+ *
+ * Nothing here touches the network or writes a file: the four lines go to stdout, and a provider
+ * pastes them into `.dev.vars` themselves.
+ */
+import { generateMnemonic, validateMnemonic } from "@scure/bip39";
+import { wordlist } from "@scure/bip39/wordlists/english.js";
+import { deriveOracleKey } from "../../lib/engine/adr36.js";
+import { NETWORKS } from "../../networks.js";
+import { parse, UsageError } from "../lib/args.js";
+import { resolveNetwork } from "../lib/chain.js";
+export async function run(argv) {
+    const { values, positionals } = parse(argv, {
+        options: {
+            new: { type: "boolean" },
+            homeserver: { type: "string" },
+            network: { type: "string" },
+        },
+    });
+    const network = resolveNetwork(values.network);
+    const mnemonic = values.new ? generateMnemonic(wordlist, 256) : positionals[0];
+    if (!mnemonic)
+        throw new UsageError('derive needs "<mnemonic>" or --new');
+    if (!validateMnemonic(mnemonic, wordlist)) {
+        console.error("not a valid BIP-39 English mnemonic (wordlist/checksum) — the chain signer would refuse it");
+        return 2;
+    }
+    // The MXID's home server is the network's Matrix home server unless told otherwise — the same
+    // per-network map every other command reads, so devnet keeps printing devnet's.
+    const homeserver = values.homeserver ?? new URL(NETWORKS[network].matrix).host;
+    const { address } = deriveOracleKey(mnemonic);
+    console.log(`ORACLE_SECP_MNEMONIC="${mnemonic}"`);
+    console.log(`ORACLE_ADDRESS=${address}`);
+    console.log(`ORACLE_DID=did:ixo:${address}`);
+    console.log(`ORACLE_MATRIX_USER_ID=@did-ixo-${address}:${homeserver}`);
+    return 0;
+}
+//# sourceMappingURL=derive.js.map

package/dist/cli/commands/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.js","sourceRoot":"","sources":["../../../src/cli/commands/derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QAC1C,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACxB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC5B;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,oCAAoC,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CACX,4FAA4F,CAC7F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,8FAA8F;IAC9F,gFAAgF;IAChF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAE/E,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,IAAI,UAAU,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/engine.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `decision-oracle engine register` — register this oracle with the decision engine NOW, instead of
+ * lazily at its first decide (docs/ENGINE-CONTRACT.md "Registration"). The engine prices an oracle
+ * by its plan, and an unregistered oracle has none: the payments facilitator refuses its offers
+ * (`plan_inactive`) until it exists there. Registered with no plan row of its own, it runs at the
+ * engine's Standard plan at once — payable and listed. Only IXO's OWN oracles move to the IXO-owned
+ * plan (staff, in the engine's admin editor); a third-party oracle needs nothing more.
+ *
+ * It is the oracle's OWN engine client (cli/lib/engine.ts) — the exact `POST /v1/oracles/register`
+ * the Worker makes: an invocation minted as `did:web:<ORACLE_HOSTNAME>`, the ADR-36 proof over the
+ * `ORACLE_SECP_MNEMONIC` address, and the owner's `OWNER_DELEGATION_CAR`. The engine resolves that
+ * did:web by fetching `https://<ORACLE_HOSTNAME>/.well-known/did.json`, so run it against the env
+ * that is deployed (`--env devnet`) once the deploy has landed. Idempotent on the engine: running it
+ * again re-proves the same binding. Then it reads `GET /v1/oracles/me` for the billing status.
+ *
+ * It reads `GET /v1/oracles/me` FIRST: the engine upserts by did:web, so registering a did:web the
+ * engine already binds to ANOTHER address moves the oracle's identity (its fees, its plan, the
+ * address the chain's grants name). That is refused without `--yes`; same address or not yet
+ * registered ⇒ it proceeds.
+ *
+ *   decision-oracle engine register [--env <name>] [--env-file <path>] [--engine-url <url>]
+ *     [--network devnet] [--yes] [--json]
+ */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=engine.d.ts.map

package/dist/cli/commands/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AASH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyEzD"}