@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/lib/ixo/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../../src/lib/ixo/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C,KAAK,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;AAI3E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAS/D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,iBAAe,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2BX,KAAK;YAAI,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QACjB,KAAK;;;;;;;;;GAEjB;AAED,wBAAgB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAG3C;AAKD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CASzE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,CAAC,EAC9B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACrB,QAAQ,GAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAqB,GAChD,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAWjB;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,CAChB,IAAI,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,EACpD,IAAI,CAAC,EAAE,MAAM,KACV,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAMjG;AAiCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGxD;AAoBD,4FAA4F;AAC5F,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAC;AAErE;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1F,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,sBAAsB,GACtC,OAAO,CAAC,YAAY,CAAC,CA4BvB"}

package/dist/lib/ixo/chain.js

@@ -0,0 +1,279 @@
+/**
+ * The IXO chain SDK (`@ixo/impactxclient-sdk`), loaded LAZILY: the SDK drags in heavy proto/crypto
+ * deps, so it must never load on request paths that don't touch the chain — the dynamic import
+ * keeps cold starts cheap and pays only on first use (the supa-minting-worker pattern).
+ *
+ * `getQueryClient` memoizes one RPC query client per isolate — safe because the RPC transport is
+ * HTTP fetch-per-call (it holds no request-bound socket). `getOracleSigner` is the act
+ * lane: it memoizes ONLY the wallet (pure crypto) and builds the signing client + its
+ * SequenceManagerDO stub FRESH per call. Those two are I/O objects that Cloudflare forbids reusing
+ * across requests (workflow steps and cron ticks are separate contexts — reuse throws the
+ * "Cannot perform I/O on behalf of a different request / OutgoingFactory" error); the DO, NOT the
+ * client, carries the sequence across rebuilds (one instance per signer address, the
+ * subscriptions-api pattern), so concurrent workflow steps still never race a sequence — and a
+ * sequence-mismatch rejection heals per direction (`broadcastWithSequenceReset` below): a burned
+ * allocation resets the DO, a stale-chain-read one waits out the block, because the allocator has
+ * no failure feedback and a tx that dies before inclusion would otherwise poison every later
+ * broadcast.
+ */
+import { AppError } from "../errors.js";
+import { currentMetrics } from "../metrics.js";
+let sdkPromise = null;
+/**
+ * workerd's `Buffer.prototype.utf8Write` mis-computes the default length for the
+ * `(string, offset)` call shape protobufjs's BufferWriter uses for strings ≥ 40 chars — it
+ * validates the string's byte length against the WHOLE buffer instead of the remainder after
+ * `offset`, so any string field ending exactly at the end of a message (e.g. the grantee address
+ * in a granteeGrants query) throws RangeError ERR_OUT_OF_RANGE instead of encoding.
+ *
+ * The patch must be PROTOTYPE-level: the SDK's telescope codegen (codegen/helpers.js) calls
+ * `_m0.configure()` at import time, which re-runs protobufjs's environment detection and resets
+ * every static (`Writer.create`, allocators) — clobbering any static patch. configure() never
+ * touches prototypes, so swapping `BufferWriter.prototype.string` for the base Writer's pure-JS
+ * UTF-8 encoder removes exactly the broken fast path and survives re-configuration, so the patch
+ * may run before or after the codegen import. Exported for the regression test.
+ *
+ * The prototype is reached THROUGH an SDK message's writer, never `import("protobufjs")`, so it
+ * is the copy the SDK encodes with even when a second copy is installed (CLAUDE.md gotcha
+ * "protobufjs is pinned to the SDK's exact version").
+ */
+export async function patchProtobufjsForWorkerd() {
+    const { QueryParamsRequest } = await import("@ixo/impactxclient-sdk/module/codegen/ixo/claims/v1beta1/query.js");
+    const writerProto = Object.getPrototypeOf(QueryParamsRequest.encode({}));
+    const baseProto = Object.getPrototypeOf(writerProto);
+    // A BufferWriter's parent is Writer; without a Buffer the SDK hands out a plain Writer (parent
+    // Object.prototype) — nothing to patch then.
+    if (typeof baseProto.string === "function")
+        writerProto.string = baseProto.string;
+}
+/**
+ * The SDK surface this service actually uses, assembled from NARROW subpath modules.
+ *
+ * NOT `import("@ixo/impactxclient-sdk")`: a dynamic import of the barrel materializes the whole
+ * module namespace at runtime, so esbuild cannot drop a single export — destructuring the result
+ * changes nothing, because the namespace has to exist first. The package itself is perfectly
+ * shakeable (`sideEffects: false`, an ESM `module` build, subpath exports); the dynamic barrel
+ * import was the only thing defeating it. Measured with esbuild: barrel 8.94 MB raw / 0.99 MB
+ * gzip, this set 5.96 MB / 0.69 MB. (`codegen` alone is 8.36 MB — one message module is 0.27 MB.)
+ *
+ * A static named import would shake just as well, but is NOT an option here: it hoists above
+ * `patchProtobufjsForWorkerd()`, and the codegen calls `_m0.configure()` at import time — the
+ * exact race the patch exists to win. Dynamic + narrow keeps both properties.
+ *
+ * The returned shape MIRRORS the SDK's own namespaces so call sites read identically to the
+ * barrel. Needing a new message type means adding its codegen module here; typecheck catches a
+ * missing one at build time rather than at runtime.
+ */
+async function loadIxoSdk() {
+    const [queries, signing, cloudflare, claimsTx, claimsTypes, claimsAuthz, claimsQuery, authzTx, protoUtils,] = await Promise.all([
+        import("@ixo/impactxclient-sdk/queries"),
+        import("@ixo/impactxclient-sdk/module/stargate_client/customClient.js"),
+        import("@ixo/impactxclient-sdk/cloudflare"),
+        import("@ixo/impactxclient-sdk/module/codegen/ixo/claims/v1beta1/tx.js"),
+        import("@ixo/impactxclient-sdk/module/codegen/ixo/claims/v1beta1/claims.js"),
+        import("@ixo/impactxclient-sdk/module/codegen/ixo/claims/v1beta1/authz.js"),
+        import("@ixo/impactxclient-sdk/module/codegen/ixo/claims/v1beta1/query.js"),
+        import("@ixo/impactxclient-sdk/module/codegen/cosmos/authz/v1beta1/tx.js"),
+        import("@ixo/impactxclient-sdk/module/utils/proto.js"),
+    ]);
+    return {
+        createQueryClient: queries.createQueryClient,
+        createSigningClient: signing.createSigningClient,
+        createDOStoreFunctions: cloudflare.createDOStoreFunctions,
+        ixo: { claims: { v1beta1: { ...claimsTx, ...claimsTypes, ...claimsAuthz, ...claimsQuery } } },
+        cosmos: { authz: { v1beta1: authzTx } },
+        utils: { proto: protoUtils },
+    };
+}
+export function getIxoSdk() {
+    sdkPromise ??= patchProtobufjsForWorkerd().then(loadIxoSdk);
+    return sdkPromise;
+}
+let queryClient = null;
+let queryClientUrl = null;
+/**
+ * One RPC query client per isolate. The RESOLVED client is memoized, never the promise — that
+ * distinction is the whole point, and it was learned the hard way:
+ *
+ * caching the in-flight promise meant a bootstrap whose creating context went away before it settled
+ * (a canceled request, a timed-out cron tick or workflow step) left a promise pending FOREVER. Every
+ * later caller in that isolate awaited it and hung — reproduced in workerd: no error, no log line,
+ * just a request that never returns. `.catch(() => null)` never fired, because the promise never
+ * rejected; it simply never settled. So "a failed connect resets so the next call retries" was true
+ * of rejection and silently untrue of cancellation.
+ *
+ * Awaiting per caller costs concurrent COLD callers one bootstrap each (~3 cheap fetches, cold
+ * isolate only). That is far cheaper than one permanently wedged isolate, and it also means a
+ * rejected bootstrap can never be fanned out to every concurrent reader at once.
+ */
+export async function getQueryClient(config) {
+    const rpcUrl = config.CHAIN_RPC_URL;
+    if (queryClient && queryClientUrl === rpcUrl)
+        return queryClient;
+    const sdk = await getIxoSdk();
+    const client = await sdk.createQueryClient(rpcUrl);
+    queryClient = client;
+    queryClientUrl = rpcUrl;
+    return client;
+}
+/**
+ * `upstream` timing for one chain RPC call: the SDK's transport is not `fetchClient`, so its calls
+ * are timed here instead — op `rpc`, route the call name, status `-` (the SDK hides it), outcome
+ * `ok`/`error`. A rejection `answered` recognizes is the chain's own "no" (e.g. no grants as
+ * not-found), not a failed call: it stays `ok`; so does a broadcast the chain refused with a code.
+ */
+export async function timedRpc(call, run, answered = () => false) {
+    const started = Date.now();
+    let outcome = "ok";
+    try {
+        return await run();
+    }
+    catch (err) {
+        if (!answered(err))
+            outcome = "error";
+        throw err;
+    }
+    finally {
+        currentMetrics()?.timing("upstream", Date.now() - started, {
+            op: "rpc",
+            route: call,
+            status: "-",
+            outcome,
+        });
+    }
+}
+/**
+ * An account's SPENDABLE balance of one denom, as a BigInt of base units (`payment.ts`: chain
+ * amounts are integer strings, never Numbers). Spendable, not total — vesting/locked coins cannot
+ * pay `MsgEvaluateClaim`'s evaluation leg, and "spendable balance … is smaller than" is exactly
+ * what the chain says when it refuses. Absent denom ⇒ 0n. Chain trouble is 503 (fail loud).
+ */
+export async function getSpendableBalance(config, address, denom) {
+    const queryClient = await getQueryClient(config);
+    let balances;
+    try {
+        ({ balances } = await timedRpc("balance", () => queryClient.cosmos.bank.v1beta1.spendableBalances({ address })));
+    }
+    catch (err) {
+        throw AppError.unavailable("Chain bank query failed", err);
+    }
+    return BigInt(balances.find((coin) => coin.denom === denom)?.amount ?? "0");
+}
+/**
+ * Pure, exported for tests: a configured `ORACLE_ADDRESS` that isn't the mnemonic's own address
+ * is a misconfiguration that would sign as one identity while granting to another — fail loud.
+ */
+export function assertOracleAddress(config, derived) {
+    if (config.ORACLE_ADDRESS && config.ORACLE_ADDRESS !== derived) {
+        throw AppError.internal(`ORACLE_ADDRESS (${config.ORACLE_ADDRESS}) does not match the ORACLE_SECP_MNEMONIC wallet (${derived})`);
+    }
+}
+// The wallet + its account is PURE crypto derived from the mnemonic — no I/O, so it is safe to
+// memoize per isolate (keyed by mnemonic; a config change rebuilds). This is the ONLY thing the
+// reference (supamoto feeClaims.evaluate) caches, and the only thing we cache in the submit lane.
+let oracleWalletPromise = null;
+let oracleWalletMnemonic = null;
+function getOracleWallet(config) {
+    const mnemonic = config.ORACLE_SECP_MNEMONIC;
+    if (!mnemonic)
+        return Promise.reject(AppError.internal("ORACLE_SECP_MNEMONIC not configured"));
+    if (!oracleWalletPromise || oracleWalletMnemonic !== mnemonic) {
+        oracleWalletMnemonic = mnemonic;
+        oracleWalletPromise = (async () => {
+            const { DirectSecp256k1HdWallet } = await import("@cosmjs/proto-signing");
+            const wallet = await DirectSecp256k1HdWallet.fromMnemonic(mnemonic, { prefix: "ixo" });
+            const [account] = await wallet.getAccounts();
+            if (!account)
+                throw AppError.internal("ORACLE_SECP_MNEMONIC yielded no account");
+            assertOracleAddress(config, account.address);
+            return { address: account.address, wallet };
+        })();
+        oracleWalletPromise.catch(() => {
+            oracleWalletPromise = null;
+        });
+    }
+    return oracleWalletPromise;
+}
+/**
+ * The chain's sequence-mismatch rejection, in either lane it surfaces: THROWN from simulate or
+ * CheckTx (the tx never entered the mempool — the user-visible "Query failed with (6)" /
+ * BroadcastTxError shapes), or carried in a failed DeliverTx's rawLog (raced in-block; the ante
+ * handler reverts, so the sequence was NOT consumed there either).
+ */
+export function isSequenceMismatch(err) {
+    const text = String(err).toLowerCase();
+    return text.includes("account sequence mismatch") || text.includes("incorrect account sequence");
+}
+/**
+ * Which side of the counter a mismatch is on — the two directions need OPPOSITE heals. The text is
+ * `expected E, got G` where E is the chain's counter and G is what we signed with:
+ * - G > E ("ahead"): the DO burned numbers on txs that died before inclusion — reset heals it.
+ * - G < E ("behind"): we signed off a committed-state account read while our OWN previous tx was
+ *   still in the mempool (`chainSequence` never includes pending txs, and the DO trusts it after
+ *   its 7s staleness window). The DO's counter is fine; a reset would force the next allocation
+ *   onto the same stale read. The heal is waiting out the block instead.
+ * `null` when the message doesn't carry the numbers — treated as ahead (today's conservative reset).
+ */
+function sequenceMismatchDirection(err) {
+    const m = String(err).match(/expected (\d+), got (\d+)/);
+    return m ? (Number(m[2]) > Number(m[1]) ? "ahead" : "behind") : null;
+}
+/** One ImpactHub block — how long a behind-mismatch waits for its in-flight tx to commit. */
+const BLOCK_TIME_MS = 6_000;
+/**
+ * Broadcast with the poisoned-counter heal. The SequenceManagerDO is advance-on-allocate with no
+ * failure feedback: a tx that dies before block inclusion (simulate, CheckTx, broadcast error)
+ * burns its number in the DO but never on chain, and under load the DO's 7s stale-resync cannot
+ * fire — every retry's allocation refreshes the staleness clock — so ONE failed write cascades
+ * into "expected N, got N+2" on every concurrent workflow. A mismatch is the moment the burn
+ * becomes visible: clear the counter via the DO's own POST /reset (the instance is per signer
+ * address, nothing else is touched) so the caller's workflow-step retry re-reads the chain
+ * sequence fresh. The reset is fail-soft — it must never mask the broadcast error, and the next
+ * mismatch would retry it anyway.
+ *
+ * A BEHIND mismatch (`got < expected`, see `sequenceMismatchDirection`) never resets: it sleeps
+ * one block so the in-flight tx commits, then rethrows — the workflow-step retry's fresh chain
+ * read is then correct, and if that tx already did this claim's job the caller's
+ * `isAlreadyLanded` path records it.
+ */
+export async function broadcastWithSequenceReset(stub, broadcast) {
+    const heal = (cause) => sequenceMismatchDirection(cause) === "behind"
+        ? new Promise((r) => setTimeout(r, BLOCK_TIME_MS))
+        : stub.fetch(new Request("http://do/reset", { method: "POST" })).then(() => { }, () => { });
+    try {
+        const res = await broadcast();
+        if (res.code !== 0 && isSequenceMismatch(res.rawLog))
+            await heal(res.rawLog);
+        return res;
+    }
+    catch (err) {
+        if (isSequenceMismatch(err))
+            await heal(err);
+        throw err;
+    }
+}
+/**
+ * This oracle's signing client for the act lane (README "How a claim flows" step 6). Callers gate on
+ * `config.ORACLE_SECP_MNEMONIC` BEFORE calling (the fail-safe skip is theirs); reaching here
+ * without it is a programmer error. Fee is `auto` off the fixed gas price — the subscriptions-api
+ * convention.
+ *
+ * Built FRESH per call: the SigningStargateClient (its RPC connection) and the SequenceManagerDO
+ * stub are I/O objects bound to the calling request/step, and Cloudflare rejects reusing them from
+ * a different request (the OutgoingFactory error). Only the wallet above is cached; sequence state
+ * lives in the DO, so rebuilding the client per call is the intended pattern (storeCloudflare docs).
+ */
+export async function getOracleSigner(config, sequenceManager) {
+    const { address, wallet } = await getOracleWallet(config);
+    const [sdk, { GasPrice }] = await Promise.all([getIxoSdk(), import("@cosmjs/stargate")]);
+    // One DO instance per signer address — the atomic sequence allocator. The stub is acquired in
+    // THIS context and used only here; it is never cached across requests.
+    const stub = sequenceManager.get(sequenceManager.idFromName(address));
+    const client = await sdk.createSigningClient(config.CHAIN_RPC_URL, wallet, false, { gasPrice: GasPrice.fromString("0.025uixo") }, sdk.createDOStoreFunctions(stub));
+    return {
+        address,
+        did: `did:ixo:${address}`,
+        signAndBroadcast: (msgs, memo) => timedRpc("broadcast", () => broadcastWithSequenceReset(stub, () => client.signAndBroadcast(address, msgs, "auto", memo))),
+    };
+}
+//# sourceMappingURL=chain.js.map

package/dist/lib/ixo/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../../src/lib/ixo/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAK5C,IAAI,UAAU,GAA2B,IAAI,CAAC;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CACzC,mEAAmE,CACpE,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACrD,+FAA+F;IAC/F,6CAA6C;IAC7C,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU;QAAE,WAAW,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,UAAU;IACvB,MAAM,CACJ,OAAO,EACP,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,WAAW,EACX,OAAO,EACP,UAAU,EACX,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,gCAAgC,CAAC;QACxC,MAAM,CAAC,+DAA+D,CAAC;QACvE,MAAM,CAAC,mCAAmC,CAAC;QAC3C,MAAM,CAAC,gEAAgE,CAAC;QACxE,MAAM,CAAC,oEAAoE,CAAC;QAC5E,MAAM,CAAC,mEAAmE,CAAC;QAC3E,MAAM,CAAC,mEAAmE,CAAC;QAC3E,MAAM,CAAC,kEAAkE,CAAC;QAC1E,MAAM,CAAC,8CAA8C,CAAC;KACvD,CAAC,CAAC;IACH,OAAO;QACL,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,WAAW,EAAE,EAAE,EAAE;QAC7F,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QACvC,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,UAAU,KAAK,yBAAyB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,IAAI,WAAW,GAAuB,IAAI,CAAC;AAC3C,IAAI,cAAc,GAAkB,IAAI,CAAC;AAEzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;IACpC,IAAI,WAAW,IAAI,cAAc,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC;IAEjE,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnD,WAAW,GAAG,MAAM,CAAC;IACrB,cAAc,GAAG,MAAM,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,GAAqB,EACrB,QAAQ,GAA8B,GAAG,EAAE,CAAC,KAAK;IAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,OAAO,CAAC;QACtC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE;YACzD,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,GAAG;YACX,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAAe,EACf,KAAa;IAEb,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,QAA6C,CAAC;IAClD,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAC7C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAC/D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;AAC9E,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsC,EAAE,OAAe;IACzF,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/D,MAAM,QAAQ,CAAC,QAAQ,CACrB,mBAAmB,MAAM,CAAC,cAAc,qDAAqD,OAAO,GAAG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,+FAA+F;AAC/F,gGAAgG;AAChG,kGAAkG;AAClG,IAAI,mBAAmB,GAA0D,IAAI,CAAC;AACtF,IAAI,oBAAoB,GAAkB,IAAI,CAAC;AAE/C,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAC7C,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,mBAAmB,IAAI,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC9D,oBAAoB,GAAG,QAAQ,CAAC;QAChC,mBAAmB,GAAG,CAAC,KAAK,IAAI,EAAE;YAChC,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YACjF,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAC;QACL,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,mBAAmB,GAAG,IAAI,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACzD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,6FAA6F;AAC7F,MAAM,aAAa,GAAG,KAAK,CAAC;AAK5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAkB,EAClB,SAA2B;IAE3B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAC9B,yBAAyB,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC3C,CAAC,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QACxD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CACjE,GAAG,EAAE,GAAE,CAAC,EACR,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;IACR,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,kBAAkB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,eAAuC;IAEvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACzF,8FAA8F;IAC9F,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC1C,MAAM,CAAC,aAAa,EACpB,MAAM,EACN,KAAK,EACL,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,EAC9C,GAAG,CAAC,sBAAsB,CAAC,IAAwD,CAAC,CACrF,CAAC;IACF,OAAO;QACL,OAAO;QACP,GAAG,EAAE,WAAW,OAAO,EAAE;QACzB,gBAAgB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAC/B,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CACzB,0BAA0B,CAAC,IAAI,EAAE,GAAG,EAAE,CACpC,MAAM,CAAC,gBAAgB,CACrB,OAAO,EACP,IAAqD,EACrD,MAAM,EACN,IAAI,CACL,CACF,CACF;KACJ,CAAC;AACJ,CAAC"}

package/dist/lib/ixo/claim-bot.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The claim bot — the DATA plane of a claim (§4 steps 2, 4, 5).
+ *
+ * URL resolution mirrors the portal EXACTLY (constants/matrix.ts, didMatrixBatcher.ts): entity DID
+ * → its MatrixHomeServer serviceEndpoint (default home server if it declares none) → normalize →
+ * `https://claim.bot.{domain}`. The body read is a hand-rolled `POST {bot}/action` `get-claim`
+ * (delegation-backed UCAN); attachments come back already DECRYPTED from `GET {bot}/media/...`
+ * (attachments.ts reads them on demand).
+ */
+import type { Config } from "../../config.js";
+import type { Logger } from "../logger.js";
+import type { TraceContext } from "../tracing.js";
+export interface ClaimBotDeps {
+    config: Config;
+    trace: TraceContext;
+    cache: KVNamespace;
+    logger: Logger;
+}
+/**
+ * Normalize a Matrix home-server base URL (portal constants/matrix.ts): strip whitespace + stray
+ * CR/LF some on-chain serviceEndpoints carry, prepend https:// if bare, strip trailing slashes.
+ */
+export declare function normalizeMatrixHomeServerUrl(url: string | null | undefined): string;
+/**
+ * Resolve the claim-bot base URL for a claim's entity DID, the full portal way (Step 2). Falls back
+ * to the network default home server when the entity declares no MatrixHomeServer — this default is
+ * the portal's own behavior, not a shortcut.
+ */
+export declare function resolveClaimBotUrl(deps: ClaimBotDeps, entityDid: string): Promise<string>;
+/** The claim bot's did:web (the audience of our invocation), cached. */
+export declare function getBotDid(deps: ClaimBotDeps, botUrl: string): Promise<string>;
+/**
+ * Fetch and extract the claim body via `POST {bot}/action` `get-claim`. Returns the survey answers
+ * object (`data.identifier ? data : data.credentialSubject`, per portal + editor), or null when the
+ * collection room doesn't hold it (bot 404) — the puller then asks the next store. Fails closed
+ * otherwise: 401/403 → forbidden, 5xx/timeout → unavailable. The THIRD lane the puller tries, after
+ * the VFS claims lane and a VFS public copy (index.ts).
+ */
+export declare function getClaimBody(deps: ClaimBotDeps, botUrl: string, botToken: string, collectionId: string, claimId: string): Promise<Record<string, unknown> | null>;
+/**
+ * A stored claim document → the answers the evaluator reads. The bot returns `data` verbatim as the
+ * submitting client saved it (bot handlers/claims.ts: `claimData = decryptedEvent.content?.data`),
+ * and the CID-verified stores serve the whole stored document (a cellnode the W3C VC) — so every
+ * lane hits the same two shapes. Some clients wrap
+ * the answers in a VC, so unwrap `credentialSubject` when it's there; otherwise the document IS the
+ * answers. Same read the portal does (`pages/domain/[entityDid]/claims/index.tsx`).
+ */
+export declare function unwrapClaimAnswers(vc: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=claim-bot.d.ts.map

package/dist/lib/ixo/claim-bot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-bot.d.ts","sourceRoot":"","sources":["../../../src/lib/ixo/claim-bot.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAMnF;AAUD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY/F;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7E;AAOD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAsDzC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOvF"}

package/dist/lib/ixo/claim-bot.js

@@ -0,0 +1,141 @@
+/**
+ * The claim bot — the DATA plane of a claim (§4 steps 2, 4, 5).
+ *
+ * URL resolution mirrors the portal EXACTLY (constants/matrix.ts, didMatrixBatcher.ts): entity DID
+ * → its MatrixHomeServer serviceEndpoint (default home server if it declares none) → normalize →
+ * `https://claim.bot.{domain}`. The body read is a hand-rolled `POST {bot}/action` `get-claim`
+ * (delegation-backed UCAN); attachments come back already DECRYPTED from `GET {bot}/media/...`
+ * (attachments.ts reads them on demand).
+ */
+import { AppError } from "../errors.js";
+import { fetchClient, MAX_JSON_DOC_BYTES, readCappedBytes } from "../http/client.js";
+import { getMatrixHomeServerEndpoint } from "./blocksync/index.js";
+import { resolveServiceDid } from "./did.js";
+/**
+ * Normalize a Matrix home-server base URL (portal constants/matrix.ts): strip whitespace + stray
+ * CR/LF some on-chain serviceEndpoints carry, prepend https:// if bare, strip trailing slashes.
+ */
+export function normalizeMatrixHomeServerUrl(url) {
+    if (!url)
+        return "";
+    const trimmed = url.replace(/\s+/g, "");
+    if (trimmed === "")
+        return "";
+    const withProtocol = /^https?:\/\//.test(trimmed) ? trimmed : `https://${trimmed}`;
+    return withProtocol.replace(/\/+$/, "");
+}
+function extractDomain(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return url.replace(/^https?:\/\//, "").split("/")[0] ?? url;
+    }
+}
+/**
+ * Resolve the claim-bot base URL for a claim's entity DID, the full portal way (Step 2). Falls back
+ * to the network default home server when the entity declares no MatrixHomeServer — this default is
+ * the portal's own behavior, not a shortcut.
+ */
+export async function resolveClaimBotUrl(deps, entityDid) {
+    if (deps.config.CLAIM_BOT_URL_OVERRIDE)
+        return deps.config.CLAIM_BOT_URL_OVERRIDE;
+    const endpoint = await getMatrixHomeServerEndpoint(deps, entityDid);
+    const homeServer = normalizeMatrixHomeServerUrl(endpoint) ||
+        normalizeMatrixHomeServerUrl(deps.config.MATRIX_HOMESERVER_URL);
+    if (!homeServer)
+        throw AppError.unavailable("No Matrix home server resolvable for entity");
+    const domain = extractDomain(homeServer);
+    const botUrl = `https://claim.bot.${domain}`;
+    deps.logger.debug("claim-bot.resolved", { entityDid, homeServer, botUrl });
+    return botUrl;
+}
+/** The claim bot's did:web (the audience of our invocation), cached. */
+export function getBotDid(deps, botUrl) {
+    return resolveServiceDid(deps.trace, deps.cache, botUrl);
+}
+const UCAN_HEADERS = (token) => ({
+    authorization: `Bearer ${token}`,
+    "x-auth-type": "ucan",
+});
+/**
+ * Fetch and extract the claim body via `POST {bot}/action` `get-claim`. Returns the survey answers
+ * object (`data.identifier ? data : data.credentialSubject`, per portal + editor), or null when the
+ * collection room doesn't hold it (bot 404) — the puller then asks the next store. Fails closed
+ * otherwise: 401/403 → forbidden, 5xx/timeout → unavailable. The THIRD lane the puller tries, after
+ * the VFS claims lane and a VFS public copy (index.ts).
+ */
+export async function getClaimBody(deps, botUrl, botToken, collectionId, claimId) {
+    let res;
+    try {
+        // A POST in shape but a pure read in effect (`get-claim`) — safe to retry transient failures.
+        res = await fetchClient(`${botUrl}/action`, {
+            method: "POST",
+            trace: deps.trace,
+            attempts: 3,
+            headers: { "content-type": "application/json", ...UCAN_HEADERS(botToken) },
+            body: JSON.stringify({
+                action: "get-claim",
+                flags: { collection: collectionId, cid: claimId },
+            }),
+        });
+    }
+    catch (err) {
+        throw AppError.unavailable("Claim bot unreachable", err);
+    }
+    if (res.status === 404) {
+        await res.body?.cancel().catch(() => { });
+        return null;
+    }
+    if (!res.ok) {
+        // Discarded bodies pin one of the isolate's 6 open connections until GC.
+        await res.body?.cancel().catch(() => { });
+        if (res.status === 401 || res.status === 403) {
+            throw AppError.forbidden("Claim bot rejected the delegation (owner not room admin?)");
+        }
+        throw AppError.unavailable(`Claim bot returned ${res.status}`);
+    }
+    // The same cap the other body lanes read under (verified-read.ts) — the more so here: this host
+    // is derived from an on-chain `MatrixHomeServer` endpoint, so "the bot" is whoever the entity's
+    // author says it is. Oversize is deterministic, exactly as there: a body that IS here but cannot
+    // be a claim is never a fall-through to the next store.
+    let bytes;
+    try {
+        bytes = await readCappedBytes(res, MAX_JSON_DOC_BYTES);
+    }
+    catch (err) {
+        throw AppError.unavailable("Claim bot body read failed", err);
+    }
+    if (!bytes) {
+        throw AppError.notFound(`matrix body for ${claimId} exceeds the ${MAX_JSON_DOC_BYTES} B cap`);
+    }
+    let payload = null;
+    try {
+        payload = JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        /* not JSON — the bot holds nothing readable for this claim: a miss, as before */
+    }
+    const vc = payload?.data;
+    if (!vc || typeof vc !== "object")
+        return null;
+    return unwrapClaimAnswers(vc);
+}
+/**
+ * A stored claim document → the answers the evaluator reads. The bot returns `data` verbatim as the
+ * submitting client saved it (bot handlers/claims.ts: `claimData = decryptedEvent.content?.data`),
+ * and the CID-verified stores serve the whole stored document (a cellnode the W3C VC) — so every
+ * lane hits the same two shapes. Some clients wrap
+ * the answers in a VC, so unwrap `credentialSubject` when it's there; otherwise the document IS the
+ * answers. Same read the portal does (`pages/domain/[entityDid]/claims/index.tsx`).
+ */
+export function unwrapClaimAnswers(vc) {
+    if ("identifier" in vc)
+        return vc;
+    const credentialSubject = vc.credentialSubject;
+    if (credentialSubject && typeof credentialSubject === "object") {
+        return credentialSubject;
+    }
+    return vc;
+}
+//# sourceMappingURL=claim-bot.js.map

package/dist/lib/ixo/claim-bot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-bot.js","sourceRoot":"","sources":["../../../src/lib/ixo/claim-bot.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGlF,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAS1C;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAA8B;IACzE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC;IACnF,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAkB,EAAE,SAAiB;IAC5E,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC;IAClF,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,UAAU,GACd,4BAA4B,CAAC,QAAQ,CAAC;QACtC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,6CAA6C,CAAC,CAAC;IAE3F,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAqB,MAAM,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,IAAkB,EAAE,MAAc;IAC1D,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,KAAa,EAA0B,EAAE,CAAC,CAAC;IAC/D,aAAa,EAAE,UAAU,KAAK,EAAE;IAChC,aAAa,EAAE,MAAM;CACtB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,OAAe;IAEf,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,8FAA8F;QAC9F,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,MAAM,SAAS,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE;YAC1E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE;aAClD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,yEAAyE;QACzE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,QAAQ,CAAC,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,QAAQ,CAAC,WAAW,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,wDAAwD;IACxD,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,OAAO,gBAAgB,kBAAkB,QAAQ,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,GAA8C,IAAI,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE/C,OAAO,kBAAkB,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAA2B;IAC5D,IAAI,YAAY,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,iBAAiB,GAAG,EAAE,CAAC,iBAAiB,CAAC;IAC/C,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,iBAA4C,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/lib/ixo/delegation-verify.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Proving an owner→oracle delegation was SIGNED by the issuer it names.
+ *
+ * `parseDelegation` (ucanto's `extract`) decodes a CAR without checking its signature, and
+ * `verifyOwnerDelegation` (ucan.ts) compares only the fields the CAR itself claims — issuer,
+ * audience, resource, expiry. Without this check any holder of an evaluate grant on a collection
+ * (a competing oracle hired on it holds one by definition) could re-register it with a CAR naming
+ * the owner as issuer and signed by anyone: the forgery was stored, its `exp` (or none — valid
+ * forever, never refreshed from the UCAN Store) became the row's, and the claim bot refused every
+ * pull made under it, so a claim held only in Matrix failed for good.
+ *
+ * The signature is checked by `@ixo/ucan`'s own `validateDelegation` (`serverDid = ORACLE_DID`, the
+ * delegation's audience). The issuer's keys are resolved HERE (`resolveIssuerKeys`), through the ixo
+ * resolver on Blocksync over `fetchClient` (timeout, metrics), so its failure can be sorted before
+ * the validator sees it — by the SHAPE of Blocksync's answer, never by message text: a clean GraphQL
+ * answer with no document, or a document with no Ed25519 key, is as deterministic as a bad
+ * signature — a 400 (the store and pull paths read 400 as "skip this CAR", ucan-store.ts /
+ * lib/ixo/index.ts); an HTTP failure, a GraphQL `errors[]` or a throw is a 503 the caller retries. The validator then gets those keys through a closed resolver and makes no
+ * network call. An owner delegation is a root — the owner IS the issuer (`verifyOwnerDelegation`
+ * requires it): the portal signs it with `signerFromMnemonic(<user mnemonic>, did:ixo)`, the CLI
+ * with the AuthHub `edSigningMnemonic` — so the closed resolver answers for that one DID only.
+ */
+import type { Config } from "../../config.js";
+import type { TraceContext } from "../tracing.js";
+/** An issuer's published keys, as the resolver hands them to the validator. */
+export type IssuerKeys = `did:key:${string}`[];
+/**
+ * The `did:key`s `issuerDid` publishes on chain. 400 (`ISSUER_UNRESOLVABLE`) when Blocksync answered
+ * cleanly and the DID has no document or no Ed25519 key; 503 for anything else. Resolve once per
+ * caller and hand the keys to every CAR it verifies (ucan-store.ts tries several).
+ */
+export declare function resolveIssuerKeys(config: Config, issuerDid: string, trace?: TraceContext): Promise<IssuerKeys>;
+/**
+ * Throw unless the CAR's signature verifies against a key `issuerDid` publishes on chain — 400 when
+ * it does not (`details.code` carries the validator's code), and `resolveIssuerKeys`' answers when
+ * the keys cannot be had. `keys` reuses a resolution already made for the same issuer. The CAR must
+ * be a ROOT: a proof inside it is signed by someone else, whom the closed resolver does not answer
+ * for, so it is refused like a bad signature.
+ */
+export declare function verifyDelegationSignature(config: Config, car: string, issuerDid: string, keys?: () => Promise<IssuerKeys>, 
+/** Whom the delegation must be addressed to: this oracle's `ORACLE_DID` unless said (a payment
+ *  delegation is the facilitator's). */
+audience?: string): Promise<void>;
+//# sourceMappingURL=delegation-verify.d.ts.map

package/dist/lib/ixo/delegation-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-verify.d.ts","sourceRoot":"","sources":["../../../src/lib/ixo/delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,WAAW,MAAM,EAAE,EAAE,CAAC;AAK/C;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC;AAChC;wCACwC;AACxC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAwBf"}