@ixo/editor 6.27.1 → 6.28.0

package/dist/{chunk-WGCOGBWG.js → chunk-TT4TNNOV.js}

@@ -451,6 +451,10 @@ function didToMatrixUserId(did, homeserver) {
   const localpart = did.replace(/:/g, "-");
   return `@${localpart}:${homeserver}`;
 }
+function matrixUserIdToDid(userId) {
+  const localpart = userId.startsWith("@") ? userId.slice(1).split(":")[0] : userId;
+  return localpart.startsWith("did-") ? localpart.replace(/-/g, ":") : localpart;
+}
 async function findOrCreateDMRoom(matrixClient, targetUserId) {
   try {
     const directEvent = matrixClient.getAccountData("m.direct");
@@ -903,7 +907,12 @@ var SERVICE_GROUP_REQUIRED_HANDLERS = {
   ],
   collectionUsers: ["collectionUsers.grant", "collectionUsers.revoke", "collectionUsers.list", "collectionUsers.classifyAddress", "collectionUsers.enumerateMembers"],
   carbon: ["carbon.loadBatches", "carbon.harvest", "carbon.retire"],
-  kyc: ["kycLoadForm", "kycInitiate", "kycGetVerificationUrl", "kycGetStatus", "kycSaveCredential"]
+  kyc: ["kycLoadForm", "kycInitiate", "kycGetVerificationUrl", "kycGetStatus", "kycSaveCredential"],
+  evalRegister: ["requestPin", "mintBotDelegation", "depositDelegation", "registerEvalCollection"],
+  // Rubric publishing (qi/eval.rubric). `pinRubric` is best-effort (run() guards it), so it is not
+  // required for the group to be usable — `uploadRubric` (store the bytes) and `getRubricSchema`
+  // (the pre-publish shape check) are.
+  rubric: ["uploadRubric", "getRubricSchema"]
 };
 function getHandlerAtPath(handlers, path) {
   return path.split(".").reduce((acc, key) => acc == null ? void 0 : acc[key], handlers);
@@ -1065,6 +1074,36 @@ function buildServicesFromHandlers(handlers) {
       getVerificationUrl: async (params) => handlers.kycGetVerificationUrl(params),
       getStatus: async (params) => handlers.kycGetStatus(params),
       saveCredential: async (params) => handlers.kycSaveCredential(params)
+    } : void 0,
+    // Evaluation-Engine enrollment service (qi/eval.register — spec §6). All
+    // signing + HTTP live host-side: `mintBotDelegation` (owns the oracle-DID
+    // default + the claim-bot AND subscriptions-read capabilities + signing —
+    // see EvalRegisterService), `depositDelegation` (UCAN Store
+    // store/add), `registerEvalCollection` (engine). The core run() proof-guards
+    // every result, so we only forward calls here.
+    evalRegister: handlers?.requestPin && handlers?.mintBotDelegation && handlers?.depositDelegation && handlers?.registerEvalCollection ? {
+      requestPin: async (config) => handlers.requestPin(config),
+      mintBotDelegation: async (params) => handlers.mintBotDelegation(params),
+      depositDelegation: async (params) => handlers.depositDelegation(params),
+      registerCollection: async (params) => handlers.registerEvalCollection(params)
+    } : void 0,
+    // Rubric publishing service (qi/eval.rubric — spec §B.2/§C). Host-side: `uploadRubric` (Matrix
+    // media store, returns the content hash used as the id), `getRubricSchema` (fetch the engine's
+    // served JSON Schema for the pre-publish shape check), `pinRubric` (best-effort engine link).
+    // The core run() forwards to these and proof-guards its result. Gated on `uploadRubric` so a
+    // host that hasn't wired the group yet leaves the block cleanly disabled rather than crashing.
+    rubric: handlers?.uploadRubric ? {
+      uploadRubric: async (params) => handlers.uploadRubric(params),
+      ...handlers.getRubricSchema ? { getRubricSchema: async (url) => handlers.getRubricSchema(url) } : {},
+      ...handlers.pinRubric ? { pinRubric: async (params) => handlers.pinRubric(params) } : {},
+      // §C.7 pre-publish dry run against the engine (schema + live form bind + settings); optional.
+      ...handlers.previewRubric ? { previewRubric: async (params) => handlers.previewRubric(params) } : {},
+      // Best-effort live test of a §A.14 external source (the builder's Test button); optional, like pinRubric.
+      ...handlers.testExternalSource ? { testExternalSource: async (params) => handlers.testExternalSource(params) } : {},
+      // Public did:web resolution from a source's endpoint (auto-fills its audience); optional.
+      ...handlers.resolveSourceDid ? { resolveSourceDid: async (params) => handlers.resolveSourceDid(params) } : {},
+      // The entity's existing #rub resource, so a republish can delete+add in one tx; optional.
+      ...handlers.getRubricResource ? { getRubricResource: async (params) => handlers.getRubricResource(params) } : {}
     } : void 0
   };
 }
@@ -8839,6 +8878,1839 @@ registerAction({
   }
 });
 
+// src/core/lib/actionRegistry/actions/evalRegister/description.ts
+var REPEAT_SUBMISSIONS_OPTIONS = [
+  { value: "normal", label: "Yes, that's normal", sentence: "Repeat submissions from the same person are expected and normal here." },
+  { value: "sometimes", label: "Sometimes", sentence: "Repeat submissions from the same person happen but are not the norm." },
+  { value: "once", label: "No, only once ever", sentence: "Each claim should be a distinct one-off; repeat submissions are unusual here." }
+];
+var DIFFERENT_WHEN_OPTIONS = [
+  { value: "date", label: "The date", phrase: "the date" },
+  { value: "amount", label: "The amount or weight", phrase: "the amount or weight" },
+  { value: "place", label: "The place", phrase: "the place" },
+  { value: "kind", label: "The type or kind", phrase: "the type or kind" },
+  { value: "photos", label: "The photos", phrase: "the photos" }
+];
+var WHAT_IS_COLLECTED_MAX = 300;
+var DIFFERENT_WHEN_OTHER_MAX = 100;
+function normalizeDifferentWhen(value) {
+  if (!Array.isArray(value)) return [];
+  return DIFFERENT_WHEN_OPTIONS.filter((option) => value.includes(option.value)).map((option) => option.value);
+}
+function normalizeRepeatSubmissions(value) {
+  return REPEAT_SUBMISSIONS_OPTIONS.find((option) => option.value === value)?.value;
+}
+function composeCollectionDescription(answers) {
+  const lines = [];
+  const whatIsCollected = String(answers.whatIsCollected || "").trim().slice(0, WHAT_IS_COLLECTED_MAX);
+  if (whatIsCollected) lines.push(`What is collected: ${whatIsCollected}`);
+  const repeat = REPEAT_SUBMISSIONS_OPTIONS.find((option) => option.value === answers.repeatSubmissions);
+  if (repeat) lines.push(`Repeat submissions: ${repeat.sentence}`);
+  const ticked = normalizeDifferentWhen(answers.differentWhen);
+  const differences = DIFFERENT_WHEN_OPTIONS.filter((option) => ticked.includes(option.value)).map((option) => option.phrase);
+  const other = String(answers.differentWhenOther || "").trim().slice(0, DIFFERENT_WHEN_OTHER_MAX);
+  if (other) differences.push(other);
+  if (differences.length) lines.push(`Two claims are different when: any of these differ \u2014 ${differences.join(", ")}.`);
+  return lines.length ? lines.join("\n") : void 0;
+}
+
+// src/core/lib/actionRegistry/actions/evalRegister/evalRegister.ts
+async function runEvalRegister(inputs, ctx) {
+  const service = ctx.services.evalRegister;
+  if (!service) {
+    throw new Error("evalRegister service not configured (ctx.services.evalRegister is undefined)");
+  }
+  const collectionId = String(inputs.collectionId || "").trim();
+  const deedDid = String(inputs.deedDid || "").trim();
+  const displayName = String(inputs.displayName || "").trim().slice(0, 120) || void 0;
+  const notifyEmail = String(inputs.notifyEmail || "").trim();
+  if (!notifyEmail) {
+    throw new Error(
+      "A billing email is needed: if a payment fails or your evaluations pause, that address is where we tell you. Add it in the block settings \u2014 it is filled from your account when we can read it."
+    );
+  }
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(notifyEmail)) {
+    throw new Error(`"${notifyEmail}" is not a valid email address \u2014 fix the billing email in the block settings.`);
+  }
+  const description = composeCollectionDescription(inputs);
+  const ownerDid = String(inputs.ownerDid || ctx.actorDid || "").trim();
+  const oracleDid = String(inputs.oracleDid || "").trim() || void 0;
+  const ttlDays = typeof inputs.ttlDays === "number" && inputs.ttlDays > 0 ? inputs.ttlDays : void 0;
+  const ucanStoreUrl = String(inputs.ucanStoreUrl || "").trim() || void 0;
+  const evalEngineUrl = String(inputs.evalEngineUrl || "").trim() || void 0;
+  const rubricId = String(inputs.rubricId || "").trim() || void 0;
+  const allowAiChecks = inputs.allowAiChecks !== false;
+  const allowImageChecks = allowAiChecks && inputs.allowImageChecks !== false;
+  const allowChainEvaluation = inputs.allowChainEvaluation !== false;
+  if (!collectionId) throw new Error("collectionId is required");
+  if (!deedDid) throw new Error("deedDid (entity/deed DID) is required");
+  if (!ownerDid) throw new Error("ownerDid is required (pass it explicitly, or run as the collection owner)");
+  let pin = String(inputs.pin || "").trim();
+  if (!pin) {
+    pin = await service.requestPin({
+      title: "Enable Evaluation Engine",
+      description: "Enter your PIN to authorize the evaluation engine for this collection",
+      submitText: "Authorize"
+    });
+  }
+  if (!pin) throw new Error("PIN is required to authorize enrollment");
+  const minted = await service.mintBotDelegation({ oracleDid, ttlDays, pin, evalEngineUrl });
+  const delegationToken = String(minted?.token || "").trim();
+  if (!delegationToken) {
+    throw new Error("mintBotDelegation returned no token. The owner\u2192oracle delegation was not created.");
+  }
+  const deposited = await service.depositDelegation({
+    token: delegationToken,
+    note: `eval-engine enrollment: collection ${collectionId}`,
+    ucanStoreUrl
+  });
+  const depositCid = String(deposited?.cid || "").trim();
+  if (!depositCid) {
+    throw new Error("depositDelegation returned no cid. The delegation was not stored in the UCAN Store.");
+  }
+  const registration = await service.registerCollection({
+    collectionId,
+    deedDid,
+    ownerDid,
+    rubricId,
+    evalEngineUrl,
+    displayName,
+    notifyEmail,
+    // Spread, not `description,`: the key must be genuinely ABSENT when nothing was answered
+    // (see above), and a host that copies `params` field-by-field would otherwise forward an
+    // explicit `undefined` as the erasing empty value.
+    ...description !== void 0 ? { description } : {},
+    settings: { allowAiChecks, allowImageChecks, allowChainEvaluation }
+  });
+  const registrationId = String(registration?.id || "").trim();
+  if (!registrationId) {
+    throw new Error("registerCollection returned no id. The collection was not registered with the evaluation engine.");
+  }
+  let evaluateAuthzTxHash;
+  if (allowChainEvaluation) {
+    const granterAdminAddress = String(inputs.adminAddress || "").trim();
+    if (!granterAdminAddress) {
+      throw new Error("adminAddress (entity admin account) is required to grant the engine evaluator rights for on-chain decisions.");
+    }
+    const granteeDid = oracleDid || String(minted?.oracleDid || "").trim();
+    const oracleAddress = String(inputs.oracleAddress || "").trim() || (granteeDid.startsWith("did:ixo:") ? granteeDid.slice("did:ixo:".length) : "");
+    if (!oracleAddress) {
+      throw new Error("The engine address is unknown: pass oracleAddress, or an oracleDid of the form did:ixo:<address> (hosts can echo it from mintBotDelegation).");
+    }
+    const grantService = ctx.services.collectionUsers;
+    if (!grantService) throw new Error("collectionUsers service not configured (needed for the evaluate-authz grant)");
+    const grant = await grantService.grant({
+      granterAdminAddress,
+      granteeAddress: oracleAddress,
+      collectionId,
+      role: "evaluate",
+      // The engine acts on every claim in the collection — the chain rejects a 0
+      // quota, so use the effectively-unlimited value the portal already grants
+      // its subscription oracles.
+      agentQuota: "9999999",
+      // The cap on what the engine may pay out per claim (`maxCustomAmount`), in
+      // BASE units and the owner's chosen denoms — the config UI collects them,
+      // this never picks one. An EMPTY cap rejects any evaluation that carries
+      // coins, and the engine echoes an ordinary claim's own amount when it
+      // approves it (intent claims carry none — the escrow pays).
+      maxAmount: Array.isArray(inputs.evaluateMaxAmount) && inputs.evaluateMaxAmount.length > 0 ? inputs.evaluateMaxAmount : void 0,
+      deedDid
+    });
+    evaluateAuthzTxHash = String(grant?.transactionHash || "").trim() || void 0;
+    if (!evaluateAuthzTxHash) {
+      throw new Error("evaluate grant returned no transactionHash. The engine cannot submit decisions on chain \u2014 retry the registration.");
+    }
+  }
+  return {
+    output: {
+      registrationId,
+      collectionId,
+      ownerDid,
+      deedDid,
+      depositCid,
+      ...oracleDid ? { oracleDid } : {},
+      ...evaluateAuthzTxHash ? { evaluateAuthzTxHash } : {}
+    }
+  };
+}
+
+// src/core/lib/actionRegistry/actions/evalRubric/canonical.ts
+function canonicalJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error(`canonicalJson: non-finite number ${value}`);
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => item === void 0 ? "null" : canonicalJson(item)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
+    return `{${entries.join(",")}}`;
+  }
+  throw new Error(`canonicalJson: unsupported value of type ${typeof value}`);
+}
+
+// src/core/lib/actionRegistry/actions/evalRubric/fieldCatalog.ts
+var SEGMENT = /^[A-Za-z0-9_-]+$/;
+function scalarKind(type, inputType) {
+  switch (type) {
+    case "text":
+      if (inputType === "number") return "number";
+      if (inputType === "date" || inputType === "datetime-local") return "date";
+      return "text";
+    case "comment":
+      return "text";
+    case "rating":
+    case "slider":
+      return "number";
+    case "dropdown":
+    case "radiogroup":
+      return "choice";
+    case "checkbox":
+    case "tagbox":
+    case "ranking":
+      return "multichoice";
+    case "boolean":
+      return "boolean";
+    case "file":
+      return "file";
+    case "signaturepad":
+      return "signature";
+    case "geopoint":
+      return "geo";
+    default:
+      return void 0;
+  }
+}
+function normalizeChoices(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const entry of raw) {
+    let value = "";
+    let text = "";
+    if (typeof entry === "string" || typeof entry === "number") {
+      value = String(entry);
+      text = String(entry);
+    } else if (entry && typeof entry === "object") {
+      const obj = entry;
+      if (obj.value === void 0 || obj.value === null) continue;
+      value = String(obj.value);
+      text = obj.text === void 0 || obj.text === null ? value : stripHtml2(String(obj.text));
+    } else {
+      continue;
+    }
+    out.push({ value, text });
+  }
+  return out;
+}
+function segmentChoices(raw) {
+  return normalizeChoices(raw).filter((choice) => SEGMENT.test(choice.value));
+}
+function innerField(el, path, fallbackKind) {
+  const type = typeof el.cellType === "string" && el.cellType ? el.cellType : typeof el.type === "string" ? el.type : "";
+  const kind = scalarKind(type, el.inputType) ?? fallbackKind;
+  if (!kind) return void 0;
+  const choices = kind === "choice" || kind === "multichoice" ? normalizeChoices(el.choices) : void 0;
+  return {
+    path,
+    kind,
+    title: titleOf(el),
+    isRequired: el.isRequired === true,
+    ...choices && choices.length > 0 ? { choices } : {}
+  };
+}
+function extractRubricFieldCatalog(surveyTemplate, proof = "") {
+  const root = surveyTemplate?.question ?? surveyTemplate;
+  if (!root || typeof root !== "object") return { fields: [], proof };
+  const fields = [];
+  const seen2 = /* @__PURE__ */ new Set();
+  const walk = (elements) => {
+    if (!Array.isArray(elements)) return;
+    for (const el of elements) {
+      if (!el || typeof el !== "object") continue;
+      if (el.type === "panel" && Array.isArray(el.elements)) {
+        walk(el.elements);
+        continue;
+      }
+      const name = typeof el.name === "string" ? el.name.trim() : "";
+      const type = typeof el.type === "string" ? el.type : "";
+      if (!name || !SEGMENT.test(name) || seen2.has(name) || type === "html" || type === "expression") continue;
+      const field = extractQuestion(el, name, type);
+      if (!field) continue;
+      seen2.add(name);
+      fields.push(field);
+    }
+  };
+  if (Array.isArray(root.pages) && root.pages.length > 0) {
+    for (const page of root.pages) walk(page.elements);
+  }
+  walk(root.elements);
+  return { fields, proof };
+}
+function extractQuestion(el, name, type) {
+  const base = { path: `$${name}`, title: titleOf(el), isRequired: el.isRequired === true };
+  if (type === "imagepicker") {
+    return { ...base, kind: el.multiSelect === true ? "multichoice" : "choice", choices: normalizeChoices(el.choices) };
+  }
+  const scalar = scalarKind(type, el.inputType);
+  if (scalar) {
+    const choices = scalar === "choice" || scalar === "multichoice" ? normalizeChoices(el.choices) : void 0;
+    return { ...base, kind: scalar, ...choices && choices.length > 0 ? { choices } : {} };
+  }
+  switch (type) {
+    case "matrix": {
+      const rows = segmentChoices(el.rows);
+      const choices = normalizeChoices(el.columns);
+      const columns = rows.map(
+        (row) => ({ path: `$${name}.${row.value}`, kind: "choice", title: `${base.title} \u2014 ${row.text}`, isRequired: base.isRequired, choices })
+      );
+      return { ...base, kind: "keyed_choice", rows, choices, columns };
+    }
+    case "matrixdropdown": {
+      const rows = segmentChoices(el.rows);
+      const columns = [];
+      for (const rawCol of Array.isArray(el.columns) ? el.columns : []) {
+        const col = rawCol;
+        const colName = typeof col?.name === "string" ? col.name.trim() : "";
+        if (!colName || !SEGMENT.test(colName)) continue;
+        for (const row of rows) {
+          const cell = innerField(col, `$${name}.${row.value}.${colName}`, "choice");
+          if (cell) columns.push({ ...cell, title: `${base.title} \u2014 ${row.text} / ${titleOf(col) || colName}` });
+        }
+      }
+      return { ...base, kind: "cells", rows, columns };
+    }
+    case "matrixdynamic": {
+      const columns = [];
+      for (const rawCol of Array.isArray(el.columns) ? el.columns : []) {
+        const col = rawCol;
+        const colName = typeof col?.name === "string" ? col.name.trim() : "";
+        if (!colName || !SEGMENT.test(colName)) continue;
+        const inner = innerField(col, `$${name}[*].${colName}`, "choice");
+        if (inner) columns.push(inner);
+      }
+      return { ...base, kind: "rows", columns };
+    }
+    case "paneldynamic": {
+      const columns = [];
+      const walkTemplate = (elements) => {
+        if (!Array.isArray(elements)) return;
+        for (const child of elements) {
+          if (!child || typeof child !== "object") continue;
+          if (child.type === "panel" && Array.isArray(child.elements)) {
+            walkTemplate(child.elements);
+            continue;
+          }
+          const childName = typeof child.name === "string" ? child.name.trim() : "";
+          const childType = typeof child.type === "string" ? child.type : "";
+          if (!childName || !SEGMENT.test(childName) || childType === "html" || childType === "expression") continue;
+          const inner = innerField(child, `$${name}[*].${childName}`);
+          if (inner) columns.push(inner);
+        }
+      };
+      walkTemplate(el.templateElements);
+      return { ...base, kind: "rows", columns };
+    }
+    case "multipletext": {
+      const columns = [];
+      for (const rawItem of Array.isArray(el.items) ? el.items : []) {
+        const item = rawItem;
+        const itemName = typeof item?.name === "string" ? item.name.trim() : "";
+        if (!itemName || !SEGMENT.test(itemName)) continue;
+        columns.push({ path: `$${name}.${itemName}`, kind: "text", title: titleOf(item) || humanize2(itemName), isRequired: item.isRequired === true });
+      }
+      return { ...base, kind: "keyed_text", columns };
+    }
+    default:
+      return void 0;
+  }
+}
+function titleOf(el) {
+  const title = typeof el.title === "string" ? stripHtml2(el.title.trim()) : "";
+  return title || humanize2(typeof el.name === "string" ? el.name : "");
+}
+function humanize2(name) {
+  return name.replace(/[-_]+/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+function stripHtml2(s) {
+  return s.replace(/<[^>]*>/g, "").replace(/\s+/g, " ").trim();
+}
+
+// src/core/lib/actionRegistry/actions/evalRubric/schemaGate.ts
+import Ajv2020 from "ajv/dist/2020.js";
+
+// src/core/lib/actionRegistry/actions/evalRubric/types.ts
+var RUBRIC_CTX_TOKENS = [
+  "ctx.now",
+  "ctx.collection.startDate",
+  "ctx.collection.endDate",
+  "ctx.claim.submitter",
+  "ctx.claim.submitterAddress",
+  "ctx.claim.submissionDate",
+  "ctx.submitter.priorClaimCount",
+  "ctx.submitter.priorApprovedCount",
+  "ctx.collection.projectBoundary"
+];
+var RUBRIC_CONTEXT = {
+  ixo: "https://w3id.org/ixo/ns/protocol/",
+  "@id": "@type",
+  type: "@type",
+  "@protected": true
+};
+var RUBRIC_ENVELOPE_TYPE = "ixo:entity#rubric";
+function buildRubricEnvelope(body) {
+  return { "@context": RUBRIC_CONTEXT, type: RUBRIC_ENVELOPE_TYPE, rubric: body };
+}
+var EMPTY_INPUTS = {
+  deedDid: "",
+  collectionId: "",
+  rubric: null,
+  claimSchemaSnapshot: null,
+  evalEngineUrl: ""
+};
+function migrateRubric(rubric) {
+  const review = rubric.review;
+  if (!review) return rubric;
+  let next = review;
+  if (next.route?.matrixRoom === "collection") {
+    const { route: _retired, ...withoutRoute } = next;
+    next = withoutRoute;
+  }
+  const assignTo = next.assignTo;
+  if (assignTo && "matrixUserId" in assignTo) {
+    const { matrixUserId, assigneeDid, ...rest } = assignTo;
+    const nextDid = typeof assigneeDid === "string" && assigneeDid ? assigneeDid : typeof matrixUserId === "string" && matrixUserId ? matrixUserIdToDid(matrixUserId) : void 0;
+    next = { ...next, assignTo: { ...rest, ...nextDid ? { assigneeDid: nextDid } : {} } };
+  }
+  return next === review ? rubric : { ...rubric, review: next };
+}
+function parseEvalRubricInputs(raw) {
+  try {
+    const parsed = typeof raw === "string" ? JSON.parse(raw || "{}") : raw || {};
+    const rubric = parsed.rubric && typeof parsed.rubric === "object" && !Array.isArray(parsed.rubric) ? migrateRubric(parsed.rubric) : null;
+    const snapshot = parsed.claimSchemaSnapshot && typeof parsed.claimSchemaSnapshot === "object" && Array.isArray(parsed.claimSchemaSnapshot.fields) ? { fields: parsed.claimSchemaSnapshot.fields, proof: typeof parsed.claimSchemaSnapshot.proof === "string" ? parsed.claimSchemaSnapshot.proof : "" } : null;
+    return {
+      deedDid: typeof parsed.deedDid === "string" ? parsed.deedDid : "",
+      collectionId: typeof parsed.collectionId === "string" ? parsed.collectionId : "",
+      rubric,
+      claimSchemaSnapshot: snapshot,
+      evalEngineUrl: typeof parsed.evalEngineUrl === "string" ? parsed.evalEngineUrl : ""
+    };
+  } catch {
+    return { ...EMPTY_INPUTS };
+  }
+}
+function serializeEvalRubricInputs(inputs) {
+  return JSON.stringify(inputs);
+}
+
+// src/core/lib/actionRegistry/actions/evalRubric/schemaGate.ts
+var compiledValidator = null;
+function resetRubricSchemaCache() {
+  compiledValidator = null;
+}
+async function getValidator(fetchSchema, evalEngineUrl) {
+  if (compiledValidator) return compiledValidator;
+  const schema = await fetchSchema(evalEngineUrl);
+  if (!schema || typeof schema !== "object") throw new Error("the rules service returned no schema");
+  const validate = new Ajv2020({ allErrors: true, strict: false }).compile(schema);
+  compiledValidator = validate;
+  return validate;
+}
+async function validateRubricShape(body, fetchSchema, evalEngineUrl) {
+  if (typeof fetchSchema !== "function") return { ok: false, reason: "The rules service is not available to check these rules." };
+  let validate;
+  try {
+    validate = await getValidator(fetchSchema, evalEngineUrl);
+  } catch (error) {
+    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+  if (validate(buildRubricEnvelope(body))) return { ok: true, problems: [] };
+  let errors = validate.errors ?? [];
+  if (errors.length > 0 && errors.every((error) => error.keyword === "additionalProperties")) {
+    resetRubricSchemaCache();
+    try {
+      validate = await getValidator(fetchSchema, evalEngineUrl);
+    } catch (error) {
+      return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+    }
+    if (validate(buildRubricEnvelope(body))) return { ok: true, problems: [] };
+    errors = validate.errors ?? [];
+  }
+  return { ok: true, problems: translateAjvErrors(errors) };
+}
+var SCHEMA_PROBLEM_MESSAGE = "This rule has a setting the rules service will not accept.";
+var SCHEMA_UNKNOWN_KEY_PREFIX = "The rules service doesn\u2019t recognise";
+function unknownKeyMessage(key) {
+  return `${SCHEMA_UNKNOWN_KEY_PREFIX} '${key}' \u2014 the rules service may be out of date; refresh and try again.`;
+}
+function translateAjvErrors(errors) {
+  const seen2 = /* @__PURE__ */ new Set();
+  const diagnostics = [];
+  for (const error of errors) {
+    const path = sectionPath(bodyPath(error.instancePath));
+    const unknownKey = error.keyword === "additionalProperties" ? String(error.params?.additionalProperty ?? "") : "";
+    const dedupeKey = `${path}@@${unknownKey}`;
+    if (seen2.has(dedupeKey)) continue;
+    seen2.add(dedupeKey);
+    diagnostics.push({ code: "RUB_SCHEMA", severity: "error", message: unknownKey ? unknownKeyMessage(unknownKey) : SCHEMA_PROBLEM_MESSAGE, path });
+  }
+  return diagnostics;
+}
+function bodyPath(instancePath) {
+  if (instancePath === "/rubric") return "";
+  return instancePath.startsWith("/rubric/") ? instancePath.slice("/rubric".length) : instancePath;
+}
+var RULE_ROOT = /^(\/gates\/\d+|\/scoring\/criteria\/\d+|\/review\/tasks\/\d+|\/derived\/\d+)/;
+function sectionPath(path) {
+  const rule = RULE_ROOT.exec(path);
+  if (rule) return rule[1];
+  if (path.startsWith("/claimSchema")) {
+    if (path.startsWith("/claimSchema/proof")) return "/claimSchema/proof";
+    if (path.startsWith("/claimSchema/protocol")) return "/claimSchema/protocol";
+    if (path.startsWith("/claimSchema/resource")) return "/claimSchema/resource";
+    return "/claimSchema";
+  }
+  if (path.startsWith("/review/assignTo")) return "/review/assignTo";
+  if (path.startsWith("/review")) return "/review";
+  if (path.startsWith("/scoring")) return "/scoring";
+  if (path.startsWith("/settlement")) return "/settlement";
+  if (path.startsWith("/derived")) return "/derived";
+  if (path.startsWith("/unique")) return "/unique";
+  if (path.startsWith("/frequency")) return "/frequency";
+  return "";
+}
+
+// src/core/lib/actionRegistry/actions/evalRubric/expression.ts
+var EXPR_FUNCTIONS = {
+  min: { minArgs: 2, maxArgs: Infinity },
+  max: { minArgs: 2, maxArgs: Infinity },
+  clamp: { minArgs: 3, maxArgs: 3 },
+  abs: { minArgs: 1, maxArgs: 1 },
+  floor: { minArgs: 1, maxArgs: 1 },
+  ceil: { minArgs: 1, maxArgs: 1 },
+  round: { minArgs: 1, maxArgs: 1 },
+  sum: { minArgs: 1, maxArgs: 1 },
+  avg: { minArgs: 1, maxArgs: 1 },
+  count: { minArgs: 1, maxArgs: 1 },
+  countWhere: { minArgs: 3, maxArgs: 3 },
+  daysBetween: { minArgs: 2, maxArgs: 2 },
+  hoursBetween: { minArgs: 2, maxArgs: 2 },
+  yearsBetween: { minArgs: 2, maxArgs: 2 },
+  distanceMeters: { minArgs: 2, maxArgs: 2 },
+  length: { minArgs: 1, maxArgs: 1 }
+};
+var COUNT_WHERE_OPS = ["==", "!=", ">", ">=", "<", "<="];
+var COUNT_WHERE_ORDERING_OPS = [">", ">=", "<", "<="];
+var ExpressionSyntaxError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at offset ${position})`);
+    this.position = position;
+    this.name = "ExpressionSyntaxError";
+  }
+};
+var IDENT = /[A-Za-z_][A-Za-z0-9_]*/y;
+var NUMBER = /(?:\d+\.?\d*|\.\d+)/y;
+var FIELD_REF = /\$[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+|\[\*\])*/y;
+var SIGIL_REF = /~[A-Za-z_][A-Za-z0-9_]*/y;
+var CTX_REF = /ctx(?:\.[A-Za-z][A-Za-z0-9]*)+/y;
+function parseExpression(src) {
+  let pos = 0;
+  const skipWs = () => {
+    while (pos < src.length && /\s/.test(src[pos])) pos++;
+  };
+  const match = (re) => {
+    re.lastIndex = pos;
+    const m = re.exec(src);
+    if (!m) return void 0;
+    pos = re.lastIndex;
+    return m[0];
+  };
+  const fail = (message) => {
+    throw new ExpressionSyntaxError(message, pos);
+  };
+  const parseExpr = () => {
+    let left = parseTerm();
+    for (; ; ) {
+      skipWs();
+      const ch = src[pos];
+      if (ch !== "+" && ch !== "-") return left;
+      pos++;
+      left = { kind: "bin", op: ch, left, right: parseTerm() };
+    }
+  };
+  const parseTerm = () => {
+    let left = parseFactor();
+    for (; ; ) {
+      skipWs();
+      const ch = src[pos];
+      if (ch !== "*" && ch !== "/") return left;
+      pos++;
+      left = { kind: "bin", op: ch, left, right: parseFactor() };
+    }
+  };
+  const parseFactor = () => {
+    skipWs();
+    const ch = src[pos];
+    if (ch === void 0) return fail("unexpected end of expression");
+    if (ch === "-") {
+      pos++;
+      return { kind: "neg", operand: parseFactor() };
+    }
+    if (ch === "(") {
+      pos++;
+      const inner = parseExpr();
+      skipWs();
+      if (src[pos] !== ")") return fail("expected ')'");
+      pos++;
+      return inner;
+    }
+    if (ch === "'" || ch === '"') {
+      const quote = ch;
+      const start = ++pos;
+      while (pos < src.length && src[pos] !== quote) pos++;
+      if (pos >= src.length) return fail("unterminated string literal");
+      return { kind: "str", value: src.slice(start, pos++) };
+    }
+    if (ch === "$") {
+      const ref = match(FIELD_REF);
+      if (!ref) return fail("malformed $field reference");
+      return { kind: "ref", ref };
+    }
+    if (ch === "~") {
+      const ref = match(SIGIL_REF);
+      if (!ref) return fail("malformed ~-reference");
+      return { kind: "ref", ref };
+    }
+    const numeric = match(NUMBER);
+    if (numeric) return { kind: "num", value: Number(numeric) };
+    const ctxRef = match(CTX_REF);
+    if (ctxRef) return { kind: "ref", ref: ctxRef };
+    const ident = match(IDENT);
+    if (ident) {
+      if (ident === "true" || ident === "false") return { kind: "bool", value: ident === "true" };
+      skipWs();
+      if (src[pos] !== "(") return fail(`'${ident}' is not a value \u2014 bare identifiers must be function calls`);
+      pos++;
+      const args = [];
+      skipWs();
+      if (src[pos] === ")") {
+        pos++;
+      } else {
+        for (; ; ) {
+          args.push(parseExpr());
+          skipWs();
+          if (src[pos] === ",") {
+            pos++;
+            continue;
+          }
+          if (src[pos] === ")") {
+            pos++;
+            break;
+          }
+          return fail("expected ',' or ')'");
+        }
+      }
+      return { kind: "call", name: ident, args };
+    }
+    return fail(`unexpected character '${ch}'`);
+  };
+  const root = parseExpr();
+  skipWs();
+  if (pos < src.length) fail(`unexpected trailing input '${src.slice(pos)}'`);
+  return root;
+}
+
+// src/core/lib/actionRegistry/actions/evalRubric/validate.ts
+var RUBRIC_OPERATOR_KINDS = {
+  present: "all",
+  empty: "all",
+  "==": ["text", "number", "date", "choice", "boolean"],
+  "!=": ["text", "number", "date", "choice", "boolean"],
+  ">": ["number", "date"],
+  ">=": ["number", "date"],
+  "<": ["number", "date"],
+  "<=": ["number", "date"],
+  between: ["number", "date"],
+  approx: ["number"],
+  in: ["text", "number", "choice"],
+  notIn: ["text", "number", "choice"],
+  matches: ["text"],
+  startsWith: ["text"],
+  endsWith: ["text"],
+  lengthBetween: ["text"],
+  contains: ["multichoice"],
+  containsAll: ["multichoice"],
+  containsAny: ["multichoice"],
+  subsetOf: ["multichoice"],
+  countBetween: ["multichoice", "rows"],
+  isTrue: ["boolean"],
+  isFalse: ["boolean"],
+  before: ["date"],
+  after: ["date"],
+  withinWindow: ["date"],
+  withinDays: ["date"],
+  notInFuture: ["date"],
+  mediaTypeIn: ["file", "signature"],
+  maxSizeMB: ["file", "signature"],
+  withinBoundary: ["geo"],
+  withinRadius: ["geo"]
+};
+function operatorsForKind(kind) {
+  return Object.keys(RUBRIC_OPERATOR_KINDS).filter((op) => {
+    const kinds = RUBRIC_OPERATOR_KINDS[op];
+    return kinds === "all" || kinds.includes(kind);
+  });
+}
+var GATE_FAILURE_CLASSES = ["refuted", "invalid_evidence", "out_of_authority", "insufficient_evidence", "requires_human_review"];
+var CTX_TOKEN_KIND = {
+  "ctx.now": "date",
+  "ctx.collection.startDate": "date",
+  "ctx.collection.endDate": "date",
+  "ctx.claim.submitter": "text",
+  "ctx.claim.submitterAddress": "text",
+  "ctx.claim.submissionDate": "date",
+  "ctx.submitter.priorClaimCount": "number",
+  "ctx.submitter.priorApprovedCount": "number",
+  "ctx.collection.projectBoundary": "geo"
+};
+var FIELD_REF2 = /^\$[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+|\[\*\])*$/;
+var ROW_REF = /^\.[A-Za-z0-9_-]+$/;
+var DERIVED_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var EXT_REF = /^ext\.([A-Za-z0-9_-]+)\.(valid|score|reason)$/;
+var AI_REF = /^ai\.([A-Za-z0-9_-]+)\.(valid|reason)$/;
+var SOURCE_NAME = /^[A-Za-z0-9_-]+$/;
+function validateRubric(body, catalog, authoringCatalog) {
+  const diags = [];
+  const error = (code, message, path) => diags.push({ code, severity: "error", message, path });
+  const warn = (code, message, path) => diags.push({ code, severity: "warning", message, path });
+  const fieldIndex = indexCatalog(catalog);
+  const snapshotIndex = authoringCatalog ? indexCatalog(authoringCatalog) : void 0;
+  const derivedNames = new Set((body.derived ?? []).map((d) => d.name));
+  const sourcesByName = new Map((body.sources ?? []).map((s) => [s.name, s]));
+  const aiChecksByName = new Map((body.aiChecks ?? []).map((c) => [c.name, c]));
+  const checkFieldRef = (ref, path) => {
+    if (!FIELD_REF2.test(ref)) {
+      error("RUB_FIELD_PATH", `malformed field path '${ref}'`, path);
+      return void 0;
+    }
+    const field = fieldIndex.get(ref);
+    if (field) {
+      const snapshotKind = snapshotIndex?.get(ref)?.kind;
+      if (snapshotKind && snapshotKind !== field.kind) {
+        error("RUB_SCHEMA_DRIFT", `'${ref}' changed from ${snapshotKind} to ${field.kind} since the rules were authored`, path);
+        return void 0;
+      }
+      return field.kind;
+    }
+    if (snapshotIndex?.has(ref)) {
+      error("RUB_SCHEMA_DRIFT", `'${ref}' no longer exists on the claim form (deleted or renamed since the rules were authored)`, path);
+      return void 0;
+    }
+    const rootName = /^\$[A-Za-z0-9_-]+/.exec(ref)?.[0] ?? ref;
+    if (ref !== rootName && fieldIndex.has(rootName)) {
+      error("RUB_FIELD_PATH", `'${ref}' does not address a row/column of ${rootName}`, path);
+    } else {
+      error("RUB_FIELD_NOT_IN_SCHEMA", `'${ref}' does not resolve to a question in the bound form`, path);
+    }
+    return void 0;
+  };
+  const checkExtRef = (ref, path) => {
+    const match = EXT_REF.exec(ref);
+    if (!match) {
+      error("RUB_EXT_FIELD_INVALID", `'${ref}' is not a valid external-check reference \u2014 use ext.<name>.valid, .score or .reason`, path);
+      return void 0;
+    }
+    const [, name, fieldName] = match;
+    const source = sourcesByName.get(name);
+    if (!source) {
+      error("RUB_EXT_SOURCE_UNKNOWN", `no external check named '${name}' is defined`, path);
+      return void 0;
+    }
+    if (fieldName === "valid" && source.expect !== "boolean") {
+      error("RUB_EXT_FIELD_INVALID", `external check '${name}' returns a score, not a yes/no \u2014 read ext.${name}.score`, path);
+      return void 0;
+    }
+    if (fieldName === "score" && source.expect !== "score") {
+      error("RUB_EXT_FIELD_INVALID", `external check '${name}' returns a yes/no, not a score \u2014 read ext.${name}.valid`, path);
+      return void 0;
+    }
+    return fieldName === "score" ? "number" : fieldName === "valid" ? "boolean" : "text";
+  };
+  const checkAiRef = (ref, path) => {
+    const match = AI_REF.exec(ref);
+    if (!match) {
+      error("RUB_AI_FIELD_INVALID", `'${ref}' is not a valid AI-check reference \u2014 use ai.<name>.valid or ai.<name>.reason`, path);
+      return void 0;
+    }
+    const [, name, fieldName] = match;
+    if (!aiChecksByName.has(name)) {
+      error("RUB_AI_CHECK_UNKNOWN", `no AI check named '${name}' is defined`, path);
+      return void 0;
+    }
+    return fieldName === "valid" ? "boolean" : "text";
+  };
+  const checkConditionField = (ref, path, forEachTarget) => {
+    if (typeof ref !== "string" || ref.length === 0) {
+      error("RUB_FIELD_PATH", "condition field must be a reference string", path);
+      return void 0;
+    }
+    if (ref.startsWith("~")) {
+      if (!derivedNames.has(ref.slice(1))) {
+        error("RUB_UNKNOWN_REF", `derived value '${ref}' is not defined`, path);
+        return void 0;
+      }
+      return "number";
+    }
+    if (ref.startsWith("ext.")) return checkExtRef(ref, path);
+    if (ref.startsWith("ai.")) return checkAiRef(ref, path);
+    if (ref.startsWith(".")) {
+      if (!forEachTarget) {
+        error("RUB_FIELD_PATH", `row-relative ref '${ref}' is only legal inside a forEach`, path);
+        return void 0;
+      }
+      if (!ROW_REF.test(ref)) {
+        error("RUB_FIELD_PATH", `malformed row-relative ref '${ref}'`, path);
+        return void 0;
+      }
+      return checkFieldRef(`${forEachTarget}[*]${ref}`, path);
+    }
+    if (ref.startsWith("$")) return checkFieldRef(ref, path);
+    error("RUB_FIELD_PATH", `'${ref}' is not a field reference ($answer, ~derived, or a row-relative .column)`, path);
+    return void 0;
+  };
+  const isRefString = (v) => typeof v === "string" && (v.startsWith("$") || v.startsWith("~") || v.startsWith("ctx.") || v.startsWith("ext.") || v.startsWith("ai."));
+  const unwrapLiteral = (v) => {
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && "@value" in v) {
+      return { literal: v["@value"] };
+    }
+    return isRefString(v) ? void 0 : { literal: v };
+  };
+  const checkValueRef = (ref, path) => {
+    if (ref.startsWith("$")) {
+      if (FIELD_REF2.test(ref) && (fieldIndex.has(ref) || snapshotIndex?.has(ref))) return checkFieldRef(ref, path);
+      error("RUB_UNKNOWN_REF", `'${ref}' does not resolve \u2014 wrap a literal that starts with a sigil in {"@value": \u2026}`, path);
+      return void 0;
+    }
+    if (ref.startsWith("~")) {
+      if (!derivedNames.has(ref.slice(1))) {
+        error("RUB_UNKNOWN_REF", `derived value '${ref}' is not defined`, path);
+        return void 0;
+      }
+      return "number";
+    }
+    if (ref.startsWith("ext.")) return checkExtRef(ref, path);
+    if (ref.startsWith("ai.")) return checkAiRef(ref, path);
+    if (RUBRIC_CTX_TOKENS.includes(ref)) return CTX_TOKEN_KIND[ref];
+    error("RUB_UNKNOWN_REF", `unknown context token '${ref}'`, path);
+    return void 0;
+  };
+  const isDateString = (v) => typeof v === "string" && !Number.isNaN(Date.parse(v));
+  const literalFitsKind = (literal, kind) => {
+    switch (kind) {
+      case "number":
+        return typeof literal === "number";
+      case "boolean":
+        return typeof literal === "boolean";
+      case "date":
+        return isDateString(literal);
+      default:
+        return typeof literal === "string";
+    }
+  };
+  const checkComparable = (value, kind, path) => {
+    if (isRefString(value)) {
+      const refKind = checkValueRef(value, path);
+      if (refKind && refKind !== kind) error("RUB_VALUE_TYPE", `'${value}' is a ${refKind}, expected a ${kind}`, path);
+      return;
+    }
+    const unwrapped = unwrapLiteral(value);
+    if (!unwrapped || !literalFitsKind(unwrapped.literal, kind)) {
+      error("RUB_VALUE_TYPE", `expected a ${kind} value`, path);
+    }
+  };
+  const checkPair = (value, path, check) => {
+    if (!Array.isArray(value) || value.length !== 2) {
+      error("RUB_VALUE_TYPE", "expected a [min, max] pair", path);
+      return;
+    }
+    check(value[0], `${path}/0`);
+    check(value[1], `${path}/1`);
+  };
+  const checkInteger = (value, path) => {
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0) error("RUB_VALUE_TYPE", "expected a non-negative integer", path);
+  };
+  const checkSimpleCondition = (cond, path, forEachTarget) => {
+    const kind = checkConditionField(cond.field, `${path}/field`, forEachTarget);
+    const legalKinds = RUBRIC_OPERATOR_KINDS[cond.op];
+    if (!legalKinds) {
+      error("RUB_OPERATOR_TYPE_MISMATCH", `unknown operator '${String(cond.op)}'`, `${path}/op`);
+      return;
+    }
+    if (kind === void 0) return;
+    if (legalKinds !== "all" && !legalKinds.includes(kind)) {
+      error("RUB_OPERATOR_TYPE_MISMATCH", `'${cond.op}' is not legal for a ${kind} field`, `${path}/op`);
+      return;
+    }
+    const value = cond.value;
+    const valuePath = `${path}/value`;
+    switch (cond.op) {
+      case "present":
+      case "empty":
+      case "isTrue":
+      case "isFalse":
+      case "withinWindow":
+      case "notInFuture":
+        if (value !== void 0) error("RUB_VALUE_TYPE", `'${cond.op}' takes no value`, valuePath);
+        break;
+      case "==":
+      case "!=": {
+        if (isRefString(value)) {
+          const refKind = checkValueRef(value, valuePath);
+          if (refKind && refKind !== kind) error("RUB_VALUE_TYPE", `'${value}' is a ${refKind}, expected a ${kind}`, valuePath);
+          break;
+        }
+        const unwrapped = unwrapLiteral(value);
+        if (!unwrapped || !literalFitsKind(unwrapped.literal, kind)) error("RUB_VALUE_TYPE", `expected a ${kind} value`, valuePath);
+        break;
+      }
+      case ">":
+      case ">=":
+      case "<":
+      case "<=":
+        checkComparable(value, kind === "date" ? "date" : "number", valuePath);
+        break;
+      case "between":
+        checkPair(value, valuePath, (v, p) => checkComparable(v, kind === "date" ? "date" : "number", p));
+        break;
+      case "approx":
+        checkComparable(value, "number", valuePath);
+        if (typeof cond.tolerance !== "number" || cond.tolerance < 0) error("RUB_VALUE_TYPE", "'approx' needs a non-negative numeric tolerance", `${path}/tolerance`);
+        break;
+      case "in":
+      case "notIn":
+      case "containsAll":
+      case "containsAny":
+      case "subsetOf": {
+        if (!Array.isArray(value)) {
+          error("RUB_VALUE_TYPE", "expected a list of values", valuePath);
+          break;
+        }
+        const elementKind = kind === "number" ? "number" : "text";
+        for (const [i, element] of value.entries()) {
+          if (isRefString(element)) checkValueRef(element, `${valuePath}/${i}`);
+          else if (!literalFitsKind(element, elementKind)) error("RUB_VALUE_TYPE", `list entry must be a ${elementKind === "number" ? "number" : "string"}`, `${valuePath}/${i}`);
+        }
+        break;
+      }
+      case "contains": {
+        if (isRefString(value)) checkValueRef(value, valuePath);
+        else {
+          const unwrapped = unwrapLiteral(value);
+          if (!unwrapped || typeof unwrapped.literal !== "string" && typeof unwrapped.literal !== "number" && typeof unwrapped.literal !== "boolean") {
+            error("RUB_VALUE_TYPE", "'contains' expects a single literal value", valuePath);
+          }
+        }
+        break;
+      }
+      case "matches": {
+        if (typeof value !== "string" || value.length === 0) {
+          error("RUB_VALUE_TYPE", "'matches' expects a regex pattern string", valuePath);
+          break;
+        }
+        try {
+          new RegExp(value);
+        } catch {
+          error("RUB_VALUE_TYPE", `'${value}' is not a valid pattern`, valuePath);
+          break;
+        }
+        const unsafeReason = unsafeRegexReason(value);
+        if (unsafeReason) error("RUB_REGEX_UNSAFE", `pattern outside the safe subset: ${unsafeReason}`, valuePath);
+        break;
+      }
+      case "startsWith":
+      case "endsWith": {
+        const unwrapped = unwrapLiteral(value);
+        if (!unwrapped || typeof unwrapped.literal !== "string") error("RUB_VALUE_TYPE", `'${cond.op}' expects a string`, valuePath);
+        break;
+      }
+      case "lengthBetween":
+      case "countBetween":
+        checkPair(value, valuePath, checkInteger);
+        break;
+      case "before":
+      case "after":
+        checkComparable(value, "date", valuePath);
+        break;
+      case "withinDays":
+        checkInteger(value, valuePath);
+        break;
+      case "mediaTypeIn":
+        if (!Array.isArray(value) || value.length === 0 || value.some((v) => typeof v !== "string")) {
+          error("RUB_VALUE_TYPE", "'mediaTypeIn' expects a list of MIME globs", valuePath);
+        }
+        break;
+      case "maxSizeMB":
+        if (typeof value !== "number" || value <= 0) error("RUB_VALUE_TYPE", "'maxSizeMB' expects a positive number", valuePath);
+        break;
+      case "withinBoundary":
+        if (value !== "ctx.collection.projectBoundary") {
+          error("RUB_VALUE_TYPE", "'withinBoundary' expects ctx.collection.projectBoundary", valuePath);
+        }
+        break;
+      case "withinRadius": {
+        const spec = value;
+        if (!spec || typeof spec !== "object" || Array.isArray(spec)) {
+          error("RUB_VALUE_TYPE", "'withinRadius' expects { center, meters }", valuePath);
+          break;
+        }
+        if (typeof spec.meters !== "number" || spec.meters <= 0) error("RUB_VALUE_TYPE", "meters must be a positive number", `${valuePath}/meters`);
+        if (typeof spec.center === "string") {
+          const centerKind = checkValueRef(spec.center, `${valuePath}/center`);
+          if (centerKind && centerKind !== "geo") error("RUB_VALUE_TYPE", "center must be a geo answer or {lat, lng}", `${valuePath}/center`);
+        } else {
+          const center = spec.center;
+          if (!center || typeof center.lat !== "number" || typeof center.lng !== "number") {
+            error("RUB_VALUE_TYPE", "center must be a geo answer or {lat, lng}", `${valuePath}/center`);
+          }
+        }
+        break;
+      }
+    }
+  };
+  const checkCondition = (cond, path, forEachTarget) => {
+    if (!cond || typeof cond !== "object") return;
+    if ("forEach" in cond && cond.forEach !== void 0) {
+      const targetKind = typeof cond.forEach === "string" && cond.forEach.startsWith("$") ? checkFieldRef(cond.forEach, `${path}/forEach`) : void 0;
+      if (typeof cond.forEach !== "string" || !cond.forEach.startsWith("$")) {
+        error("RUB_FIELD_PATH", "forEach must reference a repeating-rows question", `${path}/forEach`);
+      } else if (targetKind && targetKind !== "rows") {
+        error("RUB_OPERATOR_TYPE_MISMATCH", `forEach needs a repeating-rows question, '${cond.forEach}' is a ${targetKind}`, `${path}/forEach`);
+      }
+      if (cond.every) checkCondition(cond.every, `${path}/every`, cond.forEach);
+      if (cond.some) checkCondition(cond.some, `${path}/some`, cond.forEach);
+      return;
+    }
+    if ("all" in cond || "any" in cond) {
+      const key = "all" in cond ? "all" : "any";
+      const members = "all" in cond ? cond.all : cond.any;
+      if (!Array.isArray(members) || members.length === 0) {
+        error("RUB_SCHEMA", `'${key}' needs at least one check inside it`, `${path}/${key}`);
+        return;
+      }
+      members.forEach((member, i) => checkCondition(member, `${path}/${key}/${i}`, forEachTarget));
+      return;
+    }
+    if ("not" in cond) {
+      checkCondition(cond.not, `${path}/not`, forEachTarget);
+      return;
+    }
+    if ("atLeast" in cond || "of" in cond) {
+      const { atLeast: n, of: members } = cond;
+      if (!Array.isArray(members) || members.length === 0) {
+        error("RUB_SCHEMA", `'atLeast' needs a non-empty 'of' list of checks`, `${path}/of`);
+        return;
+      }
+      if (typeof n !== "number" || !Number.isInteger(n) || n < 1) {
+        error("RUB_VALUE_TYPE", `'atLeast' must be a whole number, 1 or more \u2014 got ${String(n)}`, `${path}/atLeast`);
+      } else if (n > members.length) {
+        error("RUB_QUORUM_INVALID", `atLeast ${n} of ${members.length} \u2014 atLeast cannot exceed the number of checks in 'of'`, `${path}/atLeast`);
+      }
+      members.forEach((member, i) => checkCondition(member, `${path}/of/${i}`, forEachTarget));
+      return;
+    }
+    if ("field" in cond) checkSimpleCondition(cond, path, forEachTarget);
+  };
+  const checkExpression = (expr, path, earlierDerived) => {
+    let root;
+    try {
+      root = parseExpression(expr);
+    } catch (e) {
+      error("RUB_EXPR_SYNTAX", e instanceof ExpressionSyntaxError ? e.message : String(e), path);
+      return;
+    }
+    const checkNode = (node, allowLiteral) => {
+      switch (node.kind) {
+        case "str":
+        case "bool":
+          if (!allowLiteral) error("RUB_EXPR_SYNTAX", "string and true/false literals are only legal as countWhere's operator or value", path);
+          break;
+        case "ref": {
+          const ref = node.ref;
+          if (ref.startsWith("$")) checkFieldRef(ref, path);
+          else if (ref.startsWith("~")) {
+            const name = ref.slice(1);
+            if (earlierDerived.has(name)) break;
+            if (derivedNames.has(name)) error("RUB_EXPR_SYNTAX", `'${ref}' must be defined earlier in the derived list (no cycles)`, path);
+            else error("RUB_UNKNOWN_REF", `derived value '${ref}' is not defined`, path);
+          } else if (!RUBRIC_CTX_TOKENS.includes(ref)) {
+            error("RUB_UNKNOWN_REF", `unknown context token '${ref}'`, path);
+          }
+          break;
+        }
+        case "call": {
+          const signature = EXPR_FUNCTIONS[node.name];
+          if (!signature) {
+            error("RUB_EXPR_UNKNOWN_FUNC", `'${node.name}' is not in the function library`, path);
+            break;
+          }
+          if (node.args.length < signature.minArgs || node.args.length > signature.maxArgs) {
+            error("RUB_EXPR_SYNTAX", `'${node.name}' takes ${signature.minArgs === signature.maxArgs ? signature.minArgs : `${signature.minArgs}+`} argument(s)`, path);
+          }
+          if (node.name === "sum" || node.name === "avg" || node.name === "count" || node.name === "countWhere") {
+            const selector = node.args[0];
+            if (!selector || selector.kind !== "ref" || !selector.ref.includes("[*]")) {
+              error("RUB_EXPR_SYNTAX", `'${node.name}' needs a $rows[*].column selector`, path);
+            }
+          }
+          if (node.name === "countWhere") {
+            const op = node.args[1];
+            const value = node.args[2];
+            if (!op || op.kind !== "str" || !COUNT_WHERE_OPS.includes(op.value)) {
+              error("RUB_EXPR_SYNTAX", `countWhere's operator must be one of ${COUNT_WHERE_OPS.join(" ")}`, path);
+            } else if (value) {
+              const ordering = COUNT_WHERE_ORDERING_OPS.includes(op.value);
+              if (ordering && value.kind !== "num" && value.kind !== "ref") {
+                error("RUB_EXPR_SYNTAX", `countWhere's '${op.value}' compares numbers \u2014 only == and != take a true/false or text value`, path);
+              }
+            }
+          }
+          node.args.forEach((arg, i) => checkNode(arg, node.name === "countWhere" && (i === 1 || i === 2)));
+          break;
+        }
+        case "bin":
+          checkNode(node.left, false);
+          checkNode(node.right, false);
+          break;
+        case "neg":
+          checkNode(node.operand, false);
+          break;
+        default:
+          break;
+      }
+    };
+    checkNode(root, false);
+  };
+  const seenCodes = /* @__PURE__ */ new Map();
+  const checkDuplicate = (code, path) => {
+    if (typeof code !== "string" || !code) return;
+    const first = seenCodes.get(code);
+    if (first) error("RUB_DUPLICATE_CODE", `'${code}' already used at ${first}`, path);
+    else seenCodes.set(code, path);
+  };
+  const earlier = /* @__PURE__ */ new Set();
+  (body.derived ?? []).forEach((derived, i) => {
+    if (typeof derived.name !== "string" || !DERIVED_NAME.test(derived.name)) {
+      error("RUB_EXPR_SYNTAX", `'${String(derived.name)}' is not a valid derived name`, `/derived/${i}/name`);
+    }
+    checkDuplicate(derived.name, `/derived/${i}/name`);
+    if (typeof derived.expr === "string") checkExpression(derived.expr, `/derived/${i}/expr`, earlier);
+    earlier.add(derived.name);
+  });
+  (body.gates ?? []).forEach((gate, i) => {
+    checkDuplicate(gate.code, `/gates/${i}/code`);
+    const klass = gate.class;
+    if (typeof klass !== "string" || !GATE_FAILURE_CLASSES.includes(klass)) {
+      error("RUB_SCHEMA", `reject rule '${gate.code}' is missing the outcome it declares (it must be one of ${GATE_FAILURE_CLASSES.join(", ")})`, `/gates/${i}/class`);
+    }
+    if (gate.appliesWhen) checkCondition(gate.appliesWhen, `/gates/${i}/appliesWhen`);
+    checkCondition(gate.when, `/gates/${i}/when`);
+  });
+  const scoring = body.scoring;
+  const criteria = scoring?.criteria ?? [];
+  const reviewTaskIds = new Set((body.review?.tasks ?? []).map((t) => t.id));
+  if (scoring) {
+    const { approveAt, partialFloor, reviewFloor } = scoring;
+    if (typeof partialFloor === "number" && approveAt <= partialFloor) {
+      error("RUB_THRESHOLD_ORDER", `approveAt (${approveAt}) must be greater than partialFloor (${partialFloor})`, "/scoring");
+    }
+    if (typeof reviewFloor === "number" && approveAt <= reviewFloor) {
+      error("RUB_THRESHOLD_ORDER", `approveAt (${approveAt}) must be greater than reviewFloor (${reviewFloor})`, "/scoring");
+    }
+    if (typeof partialFloor === "number" && typeof reviewFloor === "number" && partialFloor < reviewFloor) {
+      error("RUB_THRESHOLD_ORDER", `partialFloor (${partialFloor}) must be at least reviewFloor (${reviewFloor})`, "/scoring");
+    }
+    const quorum = scoring.quorum;
+    if (quorum && typeof quorum.need === "number" && typeof quorum.of === "number" && quorum.need > quorum.of) {
+      error("RUB_QUORUM_INVALID", `quorum needs ${quorum.need} of ${quorum.of} \u2014 need cannot exceed of`, "/scoring/quorum");
+    }
+    if (scoring.method !== "weighted_average" && criteria.length > 0) {
+      warn("RUB_WEIGHT_IGNORED", `'${scoring.method}' combines rules by min/count and never reads weights \u2014 the stars set on your scored rules have no effect`, "/scoring/method");
+    }
+    criteria.forEach((criterion, i) => {
+      const path = `/scoring/criteria/${i}`;
+      checkDuplicate(criterion.code, `${path}/code`);
+      if (typeof criterion.weight !== "number" || !Number.isInteger(criterion.weight) || criterion.weight < 1 || criterion.weight > 5) {
+        error("RUB_WEIGHT_INVALID", `weight must be an integer 1..5, got ${String(criterion.weight)}`, `${path}/weight`);
+      }
+      if (criterion.appliesWhen) checkCondition(criterion.appliesWhen, `${path}/appliesWhen`);
+      checkScoreNode(criterion, `${path}/score`);
+    });
+  }
+  function checkScoreNode(criterion, path) {
+    const score = criterion.score;
+    if (!score || typeof score !== "object") return;
+    switch (score["@type"]) {
+      case "BooleanScore":
+        checkCondition(score.when, `${path}/when`);
+        break;
+      case "BandsScore":
+        checkNumericValueRef(score.value, `${path}/value`, "BandsScore");
+        (score.bands ?? []).forEach((band, i) => {
+          if ("op" in band) checkNumericAnchor(band.value, `${path}/bands/${i}/value`);
+        });
+        checkBandsReachable(score.bands, `${path}/bands`);
+        break;
+      case "LinearScore":
+        checkNumericValueRef(score.value, `${path}/value`, "LinearScore");
+        checkNumericAnchor(score.zeroAt, `${path}/zeroAt`);
+        checkNumericAnchor(score.fullAt, `${path}/fullAt`);
+        break;
+      case "LevelsScore": {
+        let elseAt = -1;
+        (score.levels ?? []).forEach((level, i) => {
+          if (elseAt >= 0) warn("RUB_UNREACHABLE_BAND", `level shadowed by the catch-all level at index ${elseAt}`, `${path}/levels/${i}`);
+          if ("else" in level && level.else) elseAt = i;
+          else if ("when" in level) checkCondition(level.when, `${path}/levels/${i}/when`);
+        });
+        break;
+      }
+      case "MapScore": {
+        if (typeof score.value === "string" && score.value.startsWith("$")) checkFieldRef(score.value, `${path}/value`);
+        else if (typeof score.value === "string" && score.value.startsWith("~")) checkValueRef(score.value, `${path}/value`);
+        else error("RUB_FIELD_PATH", "MapScore.value must be a $answer or ~derived ref", `${path}/value`);
+        break;
+      }
+      case "DeductionsScore":
+        (score.deduct ?? []).forEach((deduction, i) => {
+          checkDuplicate(deduction.code, `${path}/deduct/${i}/code`);
+          checkCondition(deduction.when, `${path}/deduct/${i}/when`);
+        });
+        break;
+      case "ManualScore":
+        if (typeof score.field === "string" && score.field.startsWith("$")) checkFieldRef(score.field, `${path}/field`);
+        else error("RUB_FIELD_PATH", "ManualScore.field must be a $answer ref", `${path}/field`);
+        if (!reviewTaskIds.has(score.reviewTask)) {
+          error("RUB_REVIEW_TASK_UNMAPPED", `ManualScore names review task '${String(score.reviewTask)}' but no such task exists`, `${path}/reviewTask`);
+        }
+        break;
+      default:
+        break;
+    }
+  }
+  function checkNumericAnchor(value, path) {
+    if (typeof value === "number") return;
+    if (typeof value !== "string" || !value.startsWith("~")) {
+      error("RUB_VALUE_TYPE", `'${String(value)}' is not a number \u2014 an anchor takes a number or a ~calculated value`, path);
+      return;
+    }
+    const kind = checkValueRef(value, path);
+    if (kind && kind !== "number") error("RUB_VALUE_TYPE", `'${value}' is a ${kind}, expected a number`, path);
+  }
+  function checkNumericValueRef(value, path, node) {
+    if (typeof value !== "string" || !(value.startsWith("$") || value.startsWith("~") || value.startsWith("ext."))) {
+      error("RUB_FIELD_PATH", `${node}.value must be a $answer, ~derived, or ext.<name>.score ref`, path);
+      return;
+    }
+    const kind = value.startsWith("$") ? checkFieldRef(value, path) : checkValueRef(value, path);
+    if (kind && kind !== "number") error("RUB_OPERATOR_TYPE_MISMATCH", `${node} needs a number, '${value}' is a ${kind}`, path);
+  }
+  function checkBandsReachable(bands, path) {
+    if (!Array.isArray(bands)) return;
+    let elseAt = -1;
+    bands.forEach((band, i) => {
+      if (elseAt >= 0) {
+        warn("RUB_UNREACHABLE_BAND", `band shadowed by the catch-all band at index ${elseAt}`, `${path}/${i}`);
+        return;
+      }
+      if ("else" in band && band.else) {
+        elseAt = i;
+        return;
+      }
+      for (let j = 0; j < i; j++) {
+        const earlierBand = bands[j];
+        if ("else" in earlierBand) continue;
+        if ("op" in band && bandCovers(earlierBand, band)) {
+          warn("RUB_UNREACHABLE_BAND", `band shadowed by the band at index ${j}`, `${path}/${i}`);
+          break;
+        }
+      }
+    });
+  }
+  (body.review?.tasks ?? []).forEach((task, i) => {
+    const path = `/review/tasks/${i}`;
+    checkDuplicate(task.id, `${path}/id`);
+    (task.show ?? []).forEach((ref, j) => {
+      if (typeof ref === "string" && ref.startsWith("$")) checkFieldRef(ref, `${path}/show/${j}`);
+      else error("RUB_FIELD_PATH", "show entries must be $answer refs", `${path}/show/${j}`);
+    });
+    const map = task.map ?? {};
+    for (const [answer, verdict] of Object.entries(map)) {
+      if (verdict !== "approve" && verdict !== "partial" && verdict !== "reject") {
+        error("RUB_VALUE_TYPE", `answer '${answer}' maps to '${String(verdict)}' \u2014 must be approve | partial | reject`, `${path}/map/${answer}`);
+      }
+    }
+    const required = task.answer?.type === "boolean" ? ["true", "false"] : task.answer?.options ?? [];
+    for (const answer of required) {
+      if (!(answer in map)) error("RUB_REVIEW_ANSWER_UNMAPPED", `answer '${answer}' has no verdict mapping`, `${path}/map`);
+    }
+  });
+  const seenSourceNames = /* @__PURE__ */ new Set();
+  (body.sources ?? []).forEach((source, i) => {
+    const path = `/sources/${i}`;
+    const name = source.name;
+    if (typeof name !== "string" || !SOURCE_NAME.test(name)) {
+      error("RUB_SCHEMA", `external check name '${String(name)}' may use only letters, numbers, dashes and underscores`, `${path}/name`);
+    } else if (seenSourceNames.has(name)) {
+      error("RUB_SCHEMA", `two external checks are named '${name}' \u2014 a name must be unique so ext.${name}.* points at one`, `${path}/name`);
+    } else {
+      seenSourceNames.add(name);
+    }
+    if (typeof source.endpoint !== "string" || !/^https?:\/\//.test(source.endpoint)) {
+      error("RUB_SCHEMA", `external check '${String(name)}' needs a web address starting with http:// or https://`, `${path}/endpoint`);
+    }
+    if (typeof source.audience !== "string" || !/^did:web:/.test(source.audience)) {
+      error("RUB_SCHEMA", `external check '${String(name)}' needs an audience starting with did:web:`, `${path}/audience`);
+    }
+    const send = source.send;
+    if (!send || typeof send !== "object" || Array.isArray(send) || Object.keys(send).length === 0) {
+      error("RUB_SCHEMA", `external check '${String(name)}' must send at least one value`, `${path}/send`);
+    } else {
+      for (const [key, value] of Object.entries(send)) {
+        if (!SOURCE_NAME.test(key)) {
+          error("RUB_SCHEMA", `external check '${String(name)}' has a send key '${key}' that may use only letters, numbers, dashes and underscores`, `${path}/send/${key}`);
+        }
+        if (isRefString(value)) checkValueRef(value, `${path}/send/${key}`);
+      }
+    }
+  });
+  const seenAiNames = /* @__PURE__ */ new Set();
+  (body.aiChecks ?? []).forEach((check, i) => {
+    const path = `/aiChecks/${i}`;
+    const name = check.name;
+    if (typeof name !== "string" || !SOURCE_NAME.test(name)) {
+      error("RUB_SCHEMA", `AI check name '${String(name)}' may use only letters, numbers, dashes and underscores`, `${path}/name`);
+    } else if (seenAiNames.has(name)) {
+      error("RUB_SCHEMA", `two AI checks are named '${name}' \u2014 a name must be unique so ai.${name}.* points at one`, `${path}/name`);
+    } else {
+      seenAiNames.add(name);
+    }
+    const instructions = check.instructions;
+    if (!Array.isArray(instructions) || instructions.filter((rule) => typeof rule === "string" && rule.trim().length > 0).length === 0) {
+      error("RUB_SCHEMA", `AI check '${String(name)}' has nothing to check \u2014 write at least one rule for the AI`, `${path}/instructions`);
+    }
+    const send = check.send;
+    if (!send || typeof send !== "object" || Array.isArray(send) || Object.keys(send).length === 0) {
+      error("RUB_SCHEMA", `AI check '${String(name)}' must send at least one value`, `${path}/send`);
+    } else {
+      for (const [key, value] of Object.entries(send)) {
+        if (!SOURCE_NAME.test(key)) {
+          error("RUB_SCHEMA", `AI check '${String(name)}' has a send key '${key}' that may use only letters, numbers, dashes and underscores`, `${path}/send/${key}`);
+        }
+        if (isRefString(value)) checkValueRef(value, `${path}/send/${key}`);
+      }
+    }
+  });
+  (body.unique?.by ?? []).forEach((entry, i) => {
+    const ref = typeof entry === "string" ? entry : entry?.ref;
+    const path = `/unique/by/${i}`;
+    if (typeof ref !== "string" || ref.length === 0) {
+      error("RUB_FIELD_PATH", "a unique-key entry must be a field reference", path);
+    } else if (ref.startsWith("~")) {
+      error("RUB_UNIQUE_KEY_DERIVED", `calculated value '${ref}' cannot be part of the unique key \u2014 pick answer fields`, path);
+    } else if (ref.startsWith("$")) {
+      checkFieldRef(ref, path);
+    } else {
+      error("RUB_FIELD_PATH", `'${ref}' is not an answer-field reference ($answer)`, path);
+    }
+  });
+  const prorateBy = body.settlement?.onPartial?.prorateBy;
+  if (prorateBy !== void 0 && prorateBy !== "total" && prorateBy !== "none") {
+    if (typeof prorateBy === "string" && (prorateBy.startsWith("$") || prorateBy.startsWith("~"))) {
+      checkValueRef(prorateBy, "/settlement/onPartial/prorateBy");
+    } else {
+      error("RUB_VALUE_TYPE", "prorateBy must be 'total', 'none', or a $answer/~derived fraction", "/settlement/onPartial/prorateBy");
+    }
+  }
+  if ((body.gates ?? []).length === 0 && criteria.length === 0) {
+    error("RUB_NO_RULES", "no rules at all \u2014 this rubric would approve (and charge for) every claim; add at least one rule", "");
+  }
+  return diags;
+}
+function indexCatalog(catalog) {
+  const index = /* @__PURE__ */ new Map();
+  const add = (field) => {
+    index.set(field.path, field);
+    field.columns?.forEach(add);
+  };
+  for (const field of catalog.fields ?? []) add(field);
+  return index;
+}
+function bandCovers(earlier, later) {
+  if (!("op" in earlier)) return false;
+  const [a, b] = [earlier.value, later.value];
+  if (typeof a !== "number" || typeof b !== "number") return false;
+  switch (earlier.op) {
+    case ">=":
+      return later.op === ">=" || later.op === ">" ? a <= b : later.op === "==" ? b >= a : false;
+    case ">":
+      return later.op === ">" ? a <= b : later.op === ">=" ? a < b : later.op === "==" ? b > a : false;
+    case "<=":
+      return later.op === "<=" || later.op === "<" ? a >= b : later.op === "==" ? b <= a : false;
+    case "<":
+      return later.op === "<" ? a >= b : later.op === "<=" ? a > b : later.op === "==" ? b < a : false;
+    case "==":
+      return later.op === "==" && a === b;
+    default:
+      return false;
+  }
+}
+function firstOverlap(a, b) {
+  if (a.wild || b.wild) return true;
+  return a.char === b.char;
+}
+function unsafeRegexReason(src) {
+  let pos = 0;
+  const parseAlternation = () => {
+    let unbounded = false;
+    let ambiguous = false;
+    const firsts = [];
+    let first = { wild: true };
+    let atStart = true;
+    for (; ; ) {
+      const seq = parseSequence();
+      if (atStart) {
+        first = seq.first;
+        atStart = false;
+      }
+      unbounded = seq.unbounded || unbounded;
+      ambiguous = seq.ambiguous || ambiguous;
+      firsts.push(seq.first);
+      if (src[pos] === "|") {
+        pos++;
+        continue;
+      }
+      break;
+    }
+    if (firsts.length > 1) {
+      for (let i = 0; i < firsts.length && !ambiguous; i++) {
+        for (let j = i + 1; j < firsts.length; j++) {
+          if (firstOverlap(firsts[i], firsts[j])) {
+            ambiguous = true;
+            break;
+          }
+        }
+      }
+    }
+    return { unbounded, ambiguous, first };
+  };
+  const parseSequence = () => {
+    let unbounded = false;
+    let ambiguous = false;
+    let first = { wild: true };
+    let atStart = true;
+    while (pos < src.length && src[pos] !== "|" && src[pos] !== ")") {
+      const atom = parseAtom();
+      const quantifier = parseQuantifier();
+      if (atStart) {
+        first = quantifier?.nullable ? { wild: true } : atom.first;
+        atStart = false;
+      }
+      if (quantifier?.unbounded) {
+        if (atom.unbounded) throw new Error("unbounded repetition nested inside unbounded repetition");
+        if (atom.ambiguous) throw new Error("a repeated group with overlapping choices can backtrack catastrophically");
+        unbounded = true;
+      }
+      unbounded = unbounded || atom.unbounded;
+      ambiguous = ambiguous || atom.ambiguous;
+    }
+    return { unbounded, ambiguous, first };
+  };
+  const parseAtom = () => {
+    const ch = src[pos];
+    if (ch === "(") {
+      pos++;
+      if (src[pos] === "?") {
+        if (src[pos + 1] === ":") pos += 2;
+        else throw new Error("lookaround and special groups are not allowed");
+      }
+      const inner = parseAlternation();
+      if (src[pos] !== ")") throw new Error("unbalanced group");
+      pos++;
+      return { unbounded: inner.unbounded, ambiguous: inner.ambiguous, first: { wild: true } };
+    }
+    if (ch === "[") {
+      pos++;
+      if (src[pos] === "^") pos++;
+      if (src[pos] === "]") pos++;
+      while (pos < src.length && src[pos] !== "]") {
+        if (src[pos] === "\\") pos++;
+        pos++;
+      }
+      if (src[pos] !== "]") throw new Error("unterminated character class");
+      pos++;
+      return { unbounded: false, ambiguous: false, first: { wild: true } };
+    }
+    if (ch === "\\") {
+      const next = src[pos + 1];
+      if (next === void 0) throw new Error("dangling escape");
+      if (/[1-9]/.test(next)) throw new Error("backreferences are not allowed");
+      if (next === "k") throw new Error("named backreferences are not allowed");
+      pos += 2;
+      return { unbounded: false, ambiguous: false, first: { wild: true } };
+    }
+    if (ch === "*" || ch === "+" || ch === "?") throw new Error("quantifier without a target");
+    pos++;
+    const first = ch === "." || ch === "^" || ch === "$" ? { wild: true } : { wild: false, char: ch };
+    return { unbounded: false, ambiguous: false, first };
+  };
+  const parseQuantifier = () => {
+    const ch = src[pos];
+    if (ch === "*") {
+      pos++;
+      if (src[pos] === "?") pos++;
+      return { unbounded: true, nullable: true };
+    }
+    if (ch === "+") {
+      pos++;
+      if (src[pos] === "?") pos++;
+      return { unbounded: true, nullable: false };
+    }
+    if (ch === "?") {
+      pos++;
+      if (src[pos] === "?") pos++;
+      return { unbounded: false, nullable: true };
+    }
+    if (ch === "{") {
+      const match = /^\{(\d+)(?:(,)(\d+)?)?\}/.exec(src.slice(pos));
+      if (!match) return null;
+      pos += match[0].length;
+      if (src[pos] === "?") pos++;
+      return { unbounded: match[2] === "," && match[3] === void 0, nullable: Number(match[1]) === 0 };
+    }
+    return null;
+  };
+  try {
+    parseAlternation();
+    if (pos < src.length) throw new Error("unbalanced group");
+    return null;
+  } catch (e) {
+    return e instanceof Error ? e.message : String(e);
+  }
+}
+
+// src/core/lib/actionRegistry/actions/evalRubric/evalRubric.ts
+async function preflightEvalRubric(inputs, ctx, settings) {
+  const service = ctx.services.rubric;
+  if (!service) {
+    throw new Error("rubric service not configured (ctx.services.rubric is undefined)");
+  }
+  const handlers = ctx.handlers;
+  if (!handlers) {
+    throw new Error("handlers not available (ctx.handlers is undefined)");
+  }
+  const deedDid = String(inputs.deedDid || "").trim();
+  const collectionId = String(inputs.collectionId || "").trim();
+  const evalEngineUrl = String(inputs.evalEngineUrl || "").trim() || void 0;
+  if (!deedDid) throw new Error("deedDid (entity/deed DID) is required");
+  if (!collectionId) throw new Error("collectionId is required");
+  const rubric = dropRemovedKeys(parseObjectInput(inputs.rubric, "rubric"));
+  const snapshot = parseObjectInput(inputs.claimSchemaSnapshot, "claimSchemaSnapshot");
+  if (!Array.isArray(snapshot.fields)) {
+    throw new Error("claimSchemaSnapshot must carry the authored field catalog (fields[])");
+  }
+  throwOnErrors(validateRubric(rubric, snapshot), "The rules are not valid");
+  if (typeof handlers.getDeedSurveyTemplate !== "function") {
+    throw new Error("getDeedSurveyTemplate handler not implemented \u2014 the rules cannot be re-checked against the live claim form");
+  }
+  const template = await hostCall("getDeedSurveyTemplate", () => handlers.getDeedSurveyTemplate(deedDid, collectionId));
+  const surveyTemplate = template?.surveyTemplate;
+  if (!surveyTemplate) {
+    throw new Error(`No claim form found for collection ${collectionId}. Rules can only be published against an existing form.`);
+  }
+  const liveCatalog = extractRubricFieldCatalog(surveyTemplate, String(template?.proof || "") || snapshot.proof);
+  throwOnErrors(validateRubric(rubric, liveCatalog, snapshot), "The claim form changed since these rules were written");
+  console.info("[eval.rubric] step validate \u2014 rules valid against the snapshot and the live form");
+  const preview = service.previewRubric ? await service.previewRubric({ collectionId, rubric, evalEngineUrl, interactive: true, ...settings ? { settings } : {} }).catch((error) => {
+    throw new Error(`Couldn't reach the rules service to check your rules \u2014 try again. (${errorMessageOf(error)})`);
+  }) : null;
+  if (preview) {
+    throwOnErrors(preview.problems, "These rules cannot be published");
+    console.info("[eval.rubric] step engine preview \u2014 passed");
+  } else {
+    const shape = await validateRubricShape(rubric, service.getRubricSchema, evalEngineUrl);
+    if (!shape.ok) {
+      throw new Error(`Couldn't reach the rules service to check your rules \u2014 try again. (${shape.reason})`);
+    }
+    throwOnErrors(shape.problems, "These rules have a setting the rules service will not accept");
+    console.info("[eval.rubric] step schema gate \u2014 passed (host has no previewRubric)");
+  }
+  return { rubric, collectionId, evalEngineUrl };
+}
+async function publishEvalRubric(preflight, ctx) {
+  const service = ctx.services.rubric;
+  if (!service) {
+    throw new Error("rubric service not configured (ctx.services.rubric is undefined)");
+  }
+  const handlers = ctx.handlers;
+  if (!handlers) {
+    throw new Error("handlers not available (ctx.handlers is undefined)");
+  }
+  const { rubric, collectionId, evalEngineUrl } = preflight;
+  const bytes = canonicalJson(buildRubricEnvelope(rubric));
+  console.info("[eval.rubric] step canonicalize \u2014 envelope bytes built", { byteLength: bytes.length });
+  const uploaded = await hostCall("uploadRubric", () => service.uploadRubric({ json: bytes, fileName: "rubric" }));
+  console.info("[eval.rubric] step upload \u2014 stored", { url: uploaded?.url, sha256: uploaded?.sha256 });
+  const resourceUrl = String(uploaded?.url || "").trim();
+  if (!resourceUrl) {
+    throw new Error("uploadRubric returned no url. The rubric document was not stored.");
+  }
+  const rubricId = String(uploaded?.sha256 || "").trim();
+  if (!rubricId) {
+    throw new Error("uploadRubric returned no sha256. Without the content hash the rubric has no id and cannot be anchored.");
+  }
+  if (typeof handlers.createAddLinkedResourceMessage !== "function") {
+    throw new Error("createAddLinkedResourceMessage handler not implemented");
+  }
+  if (typeof handlers.executeTransaction !== "function") {
+    throw new Error("executeTransaction handler not implemented");
+  }
+  const protocolDid = String(rubric.claimSchema?.protocol || "").trim();
+  if (!protocolDid) {
+    throw new Error("rubric.claimSchema.protocol is required \u2014 it names the protocol entity that carries the claim form and the rules");
+  }
+  const messages = [];
+  if (service.getRubricResource) {
+    let existing = null;
+    try {
+      existing = await service.getRubricResource({ protocolDid });
+    } catch (error) {
+      console.error("[eval.rubric] getRubricResource rejected", error);
+      throw new Error(`Couldn't check whether this protocol already has published rules \u2014 try again. (${errorMessageOf(error)})`);
+    }
+    console.info("[eval.rubric] step existing #rub \u2014", existing?.id ?? "none");
+    if (existing?.id) {
+      if (typeof handlers.createDeleteLinkedResourceMessage !== "function") {
+        throw new Error("This protocol already has rules, and the createDeleteLinkedResourceMessage handler is not implemented \u2014 they cannot be replaced.");
+      }
+      messages.push(await hostCall("createDeleteLinkedResourceMessage", () => handlers.createDeleteLinkedResourceMessage({ entityDid: protocolDid, resourceId: existing.id })));
+    }
+  } else {
+    console.info("[eval.rubric] step existing #rub \u2014 host has no getRubricResource; composing add-only");
+  }
+  const resourceId = "{id}#rub";
+  messages.push(
+    await hostCall(
+      "createAddLinkedResourceMessage",
+      () => handlers.createAddLinkedResourceMessage({
+        entityDid: protocolDid,
+        linkedResource: {
+          id: resourceId,
+          type: "rubric",
+          description: rubric.title || "Claim Approval Rules",
+          mediaType: "application/ld+json",
+          serviceEndpoint: resourceUrl,
+          // The id IS the content commitment (§A.10) — one value, both jobs.
+          proof: rubricId,
+          encrypted: "false",
+          right: ""
+        }
+      })
+    )
+  );
+  console.info(
+    "[eval.rubric] step compose \u2014 messages",
+    messages.map((message) => message?.typeUrl ?? typeof message)
+  );
+  const anchored = await hostCall("executeTransaction", () => handlers.executeTransaction({ messages, memo: "Set claim approval rules" }));
+  console.info("[eval.rubric] step anchor \u2014 executeTransaction returned", anchored);
+  const resourceTxHash = String(anchored?.transactionHash || "").trim();
+  if (!resourceTxHash) {
+    throw new Error("The anchor transaction completed but returned no transaction hash. The rules were not published.");
+  }
+  if (service.pinRubric) {
+    try {
+      await service.pinRubric({ collectionId, rubricId, evalEngineUrl });
+      console.info("[eval.rubric] step pin \u2014 engine notified of the new rubricId");
+    } catch (error) {
+      console.warn(`[eval.rubric] step pin \u2014 failed for collection ${collectionId}; the engine will re-resolve from chain. ${errorMessageOf(error)}`);
+    }
+  } else {
+    console.info("[eval.rubric] step pin \u2014 skipped (host has no pinRubric)");
+  }
+  return {
+    output: {
+      rubricId,
+      resourceId,
+      protocolDid,
+      collectionId,
+      resourceUrl,
+      resourceTxHash
+    }
+  };
+}
+function errorMessageOf(error) {
+  if (error instanceof Error) return error.message;
+  if (typeof error === "string" && error) return error;
+  if (error && typeof error === "object" && "message" in error && error.message) {
+    return String(error.message);
+  }
+  try {
+    const serialized = JSON.stringify(error);
+    if (serialized && serialized !== "{}" && serialized !== "null" && serialized !== "undefined") return serialized;
+  } catch {
+  }
+  return "Execution failed";
+}
+async function hostCall(step, call) {
+  try {
+    return await call();
+  } catch (error) {
+    console.error(`[eval.rubric] ${step} rejected`, error);
+    throw new Error(`${step} failed: ${errorMessageOf(error)}`);
+  }
+}
+function dropRemovedKeys(body) {
+  const settlement = body.settlement;
+  if (!settlement || !("maturityRung" in settlement)) return body;
+  const { maturityRung: _removed, ...rest } = settlement;
+  console.info("[eval.rubric] dropped removed key settlement.maturityRung from a pre-existing draft");
+  return { ...body, settlement: rest };
+}
+function parseObjectInput(raw, name) {
+  const value = typeof raw === "string" ? safeParse(raw, name) : raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${name} is required and must be an object`);
+  }
+  return value;
+}
+function safeParse(raw, name) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`${name} must be valid JSON`);
+  }
+}
+function throwOnErrors(diagnostics, summary) {
+  const errors = diagnostics.filter((d) => d.severity === "error");
+  if (errors.length === 0) return;
+  const detail = errors.map((d) => `${d.code}${d.path ? ` at ${d.path}` : ""}: ${d.message}`).join("; ");
+  throw new Error(`${summary} \u2014 ${errors.length} problem(s) must be fixed before publishing. ${detail}`);
+}
+
+// src/core/lib/actionRegistry/actions/evalRegister/index.ts
+var EVAL_REGISTER_OUTPUT_SCHEMA = [
+  { path: "registrationId", displayName: "Registration ID", type: "string", description: "Evaluation engine registration id (proof of enrollment)" },
+  { path: "collectionId", displayName: "Collection ID", type: "string", description: "Enrolled claim collection identifier" },
+  { path: "ownerDid", displayName: "Owner DID", type: "string", description: "Collection owner DID (delegation issuer)" },
+  { path: "deedDid", displayName: "Deed DID", type: "string", description: "Entity (deed) DID the collection belongs to" },
+  { path: "depositCid", displayName: "Deposit CID", type: "string", description: "CID of the delegation deposited in the UCAN Store" },
+  { path: "oracleDid", displayName: "Oracle DID", type: "string", description: "Evaluation engine DID (delegation audience), when overridden" },
+  {
+    path: "evaluateAuthzTxHash",
+    displayName: "Evaluate Authz Tx",
+    type: "string",
+    description: "On-chain evaluate-authz grant tx hash \u2014 present when decisions are submitted on chain"
+  }
+];
+
+// src/core/lib/actionRegistry/actions/evalRubric/index.ts
+var EVAL_RUBRIC_OUTPUT_SCHEMA = [
+  { path: "rubricId", displayName: "Rubric ID", type: "string", description: "sha256 of the published rubric bytes \u2014 the id, and the on-chain proof (\xA7A.10)" },
+  { path: "resourceId", displayName: "Linked Resource ID", type: "string", description: "The #rub LinkedResource id on the protocol entity" },
+  { path: "protocolDid", displayName: "Protocol DID", type: "string", description: "Protocol entity the rubric is anchored on (carries #vct and #rub)" },
+  { path: "collectionId", displayName: "Collection ID", type: "string", description: "Claim collection these rules govern" },
+  { path: "resourceUrl", displayName: "Rubric URL", type: "string", description: "Public Matrix media URL of the rubric document" },
+  { path: "resourceTxHash", displayName: "Anchor Tx", type: "string", description: "Transaction hash of the on-chain anchor (proof of publish)" }
+];
+
+// src/core/lib/actionRegistry/actions/evalEngine/index.ts
+var EVAL_ENGINE_ACTION_TYPE = "qi/eval.engine";
+var EVAL_ENGINE_OUTPUT_SCHEMA = [
+  ...EVAL_REGISTER_OUTPUT_SCHEMA,
+  ...EVAL_RUBRIC_OUTPUT_SCHEMA.filter((f) => f.path !== "collectionId")
+];
+
+// src/core/lib/actionRegistry/actions/evalEngine/evalEngine.ts
+registerAction({
+  type: EVAL_ENGINE_ACTION_TYPE,
+  can: "eval/engine",
+  sideEffect: true,
+  dynamicResolutionMode: "replace",
+  proof: { fields: ["registrationId", "rubricId", "resourceTxHash"] },
+  done: doneWhenCompleted,
+  executionOwner: "human",
+  cardinality: "once",
+  defaultRequiresConfirmation: true,
+  requiredCapability: "flow/block/execute",
+  outputSchema: EVAL_ENGINE_OUTPUT_SCHEMA,
+  getDynamicOutputSchema: () => EVAL_ENGINE_OUTPUT_SCHEMA,
+  // Same listener story as qi/eval.register: a Claim Collection `created` event can bind the
+  // collection; the rules are then authored in flow mode against that collection's form.
+  eligibleForEventTrigger: true,
+  inputSchema: {
+    type: "object",
+    required: ["collectionId", "deedDid", "notifyEmail", "rubric", "claimSchemaSnapshot"],
+    properties: {
+      // ---- shared context ----
+      collectionId: { type: "string", description: "Target claim collection to enroll and govern." },
+      deedDid: { type: "string", description: "Entity (deed) DID the collection belongs to." },
+      // ---- enrolment (qi/eval.register) ----
+      displayName: { type: "string", description: "Optional collection name, shown on the engine's billing emails next to the collection id." },
+      notifyEmail: { type: "string", description: "Required billing email \u2014 failed payments and paused evaluations are announced there." },
+      // The three plain answers about what this collection collects. They are composed into the
+      // engine's one opaque `description` string inside `runEvalRegister` — an agent authoring
+      // this block answers the questions, it never writes the sentence.
+      whatIsCollected: { type: "string", description: "One sentence on what people do to make a claim here (max 300)." },
+      repeatSubmissions: {
+        type: "string",
+        enum: ["normal", "sometimes", "once"],
+        description: "Can the same person claim again tomorrow? normal = expected, sometimes = happens, once = one-off only."
+      },
+      differentWhen: {
+        type: "array",
+        description: "What differs between two legitimate claims from the same person: date, amount, place, kind, photos."
+      },
+      differentWhenOther: { type: "string", description: "Anything else that differs, in the owner\u2019s own words (max 100)." },
+      ownerDid: { type: "string", description: "Collection owner DID. Defaults to the connected actor." },
+      oracleDid: { type: "string", description: "Optional override of the engine DID (delegation audience). Blank = host default." },
+      ttlDays: { type: "number", description: "Optional delegation lifetime override in days. Blank = host default." },
+      ucanStoreUrl: { type: "string", description: "UCAN Store base URL. Optional; host resolves from network if omitted." },
+      evalEngineUrl: { type: "string", description: "Evaluation engine base URL. Optional; host resolves from network if omitted." },
+      adminAddress: { type: "string", description: "Granter entity admin account address \u2014 required when decisions are submitted on chain." },
+      oracleAddress: { type: "string", description: "Engine grantee address override for the on-chain grants. Blank = derived from the oracle DID." },
+      pin: { type: "string", description: "Verification PIN; requested at runtime if omitted." },
+      allowAiChecks: { type: "boolean", default: true, description: "Engine setting: allow paid AI checks for this collection." },
+      allowImageChecks: { type: "boolean", default: true, description: "Engine setting: allow fake-photo detection (needs AI checks on)." },
+      allowChainEvaluation: { type: "boolean", default: true, description: "Engine setting: submit the decision on chain (releases payment); makes adminAddress required." },
+      evaluateMaxAmount: { type: "array", description: "Per-claim payout cap on the evaluate grant, base-unit coins in the owner's denoms." },
+      // ---- rules (qi/eval.rubric) ----
+      rubric: {
+        type: "object",
+        description: "The authored rubric body (\xA7A.2), the duplicate-claim `unique` block included (dup-detection spec \xA76); envelope + @id computed at publish."
+      },
+      claimSchemaSnapshot: { type: "object", description: "The field catalog the rules were authored against (\xA7B.4)." }
+    }
+  },
+  run: async (inputs, ctx) => {
+    if (inputs.allowChainEvaluation !== false && !String(inputs.adminAddress || "").trim()) {
+      throw new Error("adminAddress (entity admin account) is required to grant the engine evaluator rights for on-chain decisions.");
+    }
+    const intendedSettings = {
+      allowAiChecks: inputs.allowAiChecks !== false,
+      allowImageChecks: inputs.allowAiChecks !== false && inputs.allowImageChecks !== false,
+      allowChainEvaluation: inputs.allowChainEvaluation !== false
+    };
+    const preflight = await preflightEvalRubric(inputs, ctx, intendedSettings);
+    const registered = await runEvalRegister(inputs, ctx);
+    const published = await publishEvalRubric(preflight, ctx);
+    return { output: { ...registered.output, ...published.output } };
+  }
+});
+
 // src/core/lib/actionRegistry/actions/kycVerify.ts
 registerAction({
   type: "qi/kyc.verify",
@@ -11321,6 +13193,46 @@ registerDiffResolver("qi/entity.transfer", {
   }
 });
 
+// src/core/lib/actionRegistry/actions/evalEngine/evalEngine.diff.ts
+registerDiffResolver(EVAL_ENGINE_ACTION_TYPE, {
+  resolver: async (inputs) => {
+    const collectionId = String(inputs?.collectionId || "").trim();
+    if (!collectionId) return [];
+    const displayName = String(inputs?.displayName || "").trim();
+    const rows = [
+      { key: "collection", label: "Claim collection", before: null, after: displayName ? `${displayName} (${collectionId})` : collectionId, changeType: "add" },
+      { key: "access", label: "Evaluation Engine", before: null, after: "Reads & evaluates this collection\u2019s claims on your behalf", changeType: "add" },
+      {
+        key: "decisions",
+        label: "Decisions",
+        before: null,
+        after: inputs?.allowChainEvaluation !== false ? "Submitted on chain, which releases payment \u2014 you grant the engine evaluator rights" : "Recorded only \u2014 nothing is submitted on chain",
+        changeType: "add"
+      }
+    ];
+    const { rubric } = parseEvalRubricInputs(inputs);
+    if (rubric) {
+      const rejectRules = rubric.gates?.length ?? 0;
+      const scoredQuestions = rubric.scoring?.criteria?.length ?? 0;
+      const humanChecks = rubric.review?.tasks?.length ?? 0;
+      rows.push({
+        key: "rules",
+        label: "Rules",
+        before: null,
+        after: [plural(rejectRules, "reject rule"), plural(scoredQuestions, "scored question"), plural(humanChecks, "human check")].join(" \xB7 "),
+        changeType: "add"
+      });
+      if (typeof rubric.scoring?.approveAt === "number") {
+        rows.push({ key: "approveAt", label: "Approved at a score of", before: null, after: `${Math.trunc(rubric.scoring.approveAt / 100)} / 100`, changeType: "add" });
+      }
+    }
+    return rows;
+  }
+});
+function plural(count, noun) {
+  return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+
 // src/core/lib/flowEngine/dmNotificationState.ts
 var DM_NOTIFICATIONS_MAP_KEY = "dmNotificationState";
 var DM_NOTIFICATIONS_KEY = "__dm_notifications";
@@ -18279,6 +20191,7 @@ export {
   createUcanService,
   getHomeserver,
   didToMatrixUserId,
+  matrixUserIdToDid,
   findOrCreateDMRoom,
   sendDirectMessage,
   canToType,
@@ -18344,6 +20257,21 @@ export {
   buildGovernanceGroupLinkedEntities,
   tempDomainCreatorSurvey,
   resolveEntityTypeFromSchema,
+  REPEAT_SUBMISSIONS_OPTIONS,
+  DIFFERENT_WHEN_OPTIONS,
+  WHAT_IS_COLLECTED_MAX,
+  DIFFERENT_WHEN_OTHER_MAX,
+  normalizeDifferentWhen,
+  normalizeRepeatSubmissions,
+  extractRubricFieldCatalog,
+  buildRubricEnvelope,
+  parseEvalRubricInputs,
+  serializeEvalRubricInputs,
+  validateRubricShape,
+  SCHEMA_UNKNOWN_KEY_PREFIX,
+  operatorsForKind,
+  validateRubric,
+  EVAL_ENGINE_ACTION_TYPE,
   parseDelegatedToolInputs,
   serializeDelegatedToolInputs,
   fieldValues,
@@ -18575,4 +20503,4 @@ export {
   executeQueuedFlowAgentCoreCommands,
   FlowAgentService
 };
-//# sourceMappingURL=chunk-WGCOGBWG.js.map
+//# sourceMappingURL=chunk-TT4TNNOV.js.map