@ixo/oracle-runtime 0.0.1

package/dist/matrix/room-membership.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when `matrixUserId` is a joined member of `roomId`. Fails closed:
+ * returns `false` on a missing id or any lookup error, so a Matrix outage
+ * denies access rather than silently granting it.
+ */
+export declare function isUserInRoom(roomId: string, matrixUserId: string | undefined, opts?: {
+    ttlMs?: number;
+}): Promise<boolean>;
+/** Drop a room's cached membership (e.g. after a known membership change). */
+export declare function invalidateRoomMembership(roomId: string): void;
+//# sourceMappingURL=room-membership.d.ts.map

package/dist/matrix/room-membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-membership.d.ts","sourceRoot":"","sources":["../../src/matrix/room-membership.ts"],"names":[],"mappings":"AAsCA;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5B,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,8EAA8E;AAC9E,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAE7D"}

package/dist/matrix/room-membership.js

@@ -0,0 +1,33 @@
+import { MatrixManager } from '@ixo/matrix';
+const DEFAULT_TTL_MS = 60_000;
+const cache = new Map();
+async function getRoomMembers(roomId, ttlMs) {
+    const cached = cache.get(roomId);
+    if (cached && cached.expiresAt > Date.now()) {
+        return cached.members;
+    }
+    const info = await MatrixManager.getInstance().getRoomInfo(roomId);
+    const members = new Set(info.joinedMemberIds);
+    cache.set(roomId, { members, expiresAt: Date.now() + ttlMs });
+    return members;
+}
+/**
+ * True when `matrixUserId` is a joined member of `roomId`. Fails closed:
+ * returns `false` on a missing id or any lookup error, so a Matrix outage
+ * denies access rather than silently granting it.
+ */
+export async function isUserInRoom(roomId, matrixUserId, opts = {}) {
+    if (!roomId || !matrixUserId)
+        return false;
+    try {
+        const members = await getRoomMembers(roomId, opts.ttlMs ?? DEFAULT_TTL_MS);
+        return members.has(matrixUserId);
+    }
+    catch {
+        return false;
+    }
+}
+/** Drop a room's cached membership (e.g. after a known membership change). */
+export function invalidateRoomMembership(roomId) {
+    cache.delete(roomId);
+}

package/dist/meta-tools/index.d.ts

@@ -0,0 +1,28 @@
+import type { PluginTool } from '../plugin-api/types.js';
+import type { ManifestRegistry } from '../registries/manifest-registry.js';
+import type { ToolRegistry } from '../registries/tool-registry.js';
+/**
+ * Inputs for `buildMetaTools`. The runtime passes its already-collected
+ * registries; the meta-tools read manifests and tool descriptors from them.
+ */
+export interface BuildMetaToolsOptions {
+    manifestRegistry: ManifestRegistry;
+    toolRegistry: ToolRegistry;
+}
+/**
+ * Build the two meta-tools the agent always has, regardless of which
+ * plugins are loaded:
+ *
+ *  - `load_capability`   — mark a plugin as loaded for this thread; returns
+ *                          the plugin's full manifest + tool list, so the
+ *                          agent gets discovery + load in one call.
+ *  - `list_capabilities` — list every visible plugin with status flags.
+ *
+ * These tools are internal: registered by the runtime in `createMainAgent`,
+ * never exported on the public package surface, and not authorable by
+ * plugins.
+ */
+export declare function buildMetaTools(opts: BuildMetaToolsOptions): PluginTool[];
+export { buildLoadCapabilityTool } from './load-capability.js';
+export { buildListCapabilitiesTool } from './list-capabilities.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/meta-tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/meta-tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAInE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,EAAE,CAMxE;AAED,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/meta-tools/index.js

@@ -0,0 +1,24 @@
+import { buildLoadCapabilityTool } from './load-capability.js';
+import { buildListCapabilitiesTool } from './list-capabilities.js';
+/**
+ * Build the two meta-tools the agent always has, regardless of which
+ * plugins are loaded:
+ *
+ *  - `load_capability`   — mark a plugin as loaded for this thread; returns
+ *                          the plugin's full manifest + tool list, so the
+ *                          agent gets discovery + load in one call.
+ *  - `list_capabilities` — list every visible plugin with status flags.
+ *
+ * These tools are internal: registered by the runtime in `createMainAgent`,
+ * never exported on the public package surface, and not authorable by
+ * plugins.
+ */
+export function buildMetaTools(opts) {
+    const { manifestRegistry, toolRegistry } = opts;
+    return [
+        buildLoadCapabilityTool(manifestRegistry, toolRegistry),
+        buildListCapabilitiesTool(manifestRegistry),
+    ];
+}
+export { buildLoadCapabilityTool } from './load-capability.js';
+export { buildListCapabilitiesTool } from './list-capabilities.js';

package/dist/meta-tools/list-capabilities.d.ts

@@ -0,0 +1,12 @@
+import type { PluginTool } from '../plugin-api/types.js';
+import type { ManifestRegistry } from '../registries/manifest-registry.js';
+/**
+ * Build the `list_capabilities` meta-tool.
+ *
+ * Returns one entry per loaded plugin, with a `loaded` flag that combines
+ * the boot-time always-on plugins (`visibility === 'always'`) with the set
+ * of plugins the agent has explicitly loaded for this thread (the
+ * `loadedPlugins` state field).
+ */
+export declare function buildListCapabilitiesTool(manifestRegistry: ManifestRegistry): PluginTool;
+//# sourceMappingURL=list-capabilities.d.ts.map

package/dist/meta-tools/list-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-capabilities.d.ts","sourceRoot":"","sources":["../../src/meta-tools/list-capabilities.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAkB,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAuB3E;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,gBAAgB,GACjC,UAAU,CA2CZ"}

package/dist/meta-tools/list-capabilities.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import { tool } from '../plugin-api/tool-helper.js';
+/**
+ * Schema accepted by `list_capabilities`.
+ *
+ * `includeOnDemand` defaults `true` because the agent normally wants to see
+ * everything it could load. `includeSilent` defaults `false` because silent
+ * plugins are not loadable and are kept out of the agent's view.
+ */
+const listCapabilitiesSchema = z.object({
+    includeOnDemand: z.boolean().default(true),
+    includeSilent: z.boolean().default(false),
+});
+/**
+ * Build the `list_capabilities` meta-tool.
+ *
+ * Returns one entry per loaded plugin, with a `loaded` flag that combines
+ * the boot-time always-on plugins (`visibility === 'always'`) with the set
+ * of plugins the agent has explicitly loaded for this thread (the
+ * `loadedPlugins` state field).
+ */
+export function buildListCapabilitiesTool(manifestRegistry) {
+    return tool(async (args, ctx) => {
+        const { includeOnDemand, includeSilent } = listCapabilitiesSchema.parse(args);
+        const loadedSet = ctx.loadedPlugins ?? new Set();
+        const out = [];
+        for (const { pluginName, manifest } of manifestRegistry.collect()) {
+            const visibility = manifest.visibility ?? 'on-demand';
+            if (visibility === 'silent' && !includeSilent)
+                continue;
+            if (visibility === 'on-demand' && !includeOnDemand)
+                continue;
+            out.push({
+                name: pluginName,
+                summary: manifest.summary,
+                visibility,
+                loaded: visibility === 'always' || loadedSet.has(pluginName),
+                category: manifest.category,
+                tags: manifest.tags ?? [],
+            });
+        }
+        if (ctx.logger && typeof ctx.logger.debug === 'function') {
+            ctx.logger.debug(`[listCapabilities] includeOnDemand: ${includeOnDemand} | includeSilent: ${includeSilent} | loadedSet: ${Array.from(loadedSet).join(', ')} | results: ${out.length}`);
+        }
+        // Return a JSON string — LangChain's `tool()` mis-handles a raw array
+        // return (the `[content, artifact]` heuristic can drop the content),
+        // so the agent ends up with an empty ToolMessage. Explicit JSON keeps
+        // the contract unambiguous; tests parse the result.
+        return JSON.stringify(out);
+    }, {
+        name: 'list_capabilities',
+        description: 'List all available capabilities and their summaries.',
+        schema: listCapabilitiesSchema,
+    });
+}

package/dist/meta-tools/load-capability.d.ts

@@ -0,0 +1,24 @@
+import type { PluginTool } from '../plugin-api/types.js';
+import type { ManifestRegistry } from '../registries/manifest-registry.js';
+import type { ToolRegistry } from '../registries/tool-registry.js';
+/**
+ * Build the `load_capability` meta-tool.
+ *
+ * Marks a plugin as loaded for the current thread AND returns its full
+ * manifest (whenToUse, examples, …) plus a per-tool description + arg-shape
+ * summary. This is the single discovery+load entry point — the agent does
+ * not need a separate `list_capability_details` call.
+ *
+ * Behavior:
+ *  - Unknown plugin → throws, instructing the agent to call
+ *    `list_capabilities` first.
+ *  - `silent` plugin → throws (silent plugins are not agent-loadable).
+ *  - Plugin already loaded, or visibility is `always` → returns
+ *    `LoadCapabilityResult` directly (no state change).
+ *  - Otherwise → returns a LangGraph `Command` whose update both appends the
+ *    plugin to `loadedPlugins` AND emits a matching `ToolMessage` carrying
+ *    the JSON-encoded `LoadCapabilityResult` so the agent sees the manifest
+ *    in conversation history on the same turn.
+ */
+export declare function buildLoadCapabilityTool(manifestRegistry: ManifestRegistry, toolRegistry: ToolRegistry): PluginTool;
+//# sourceMappingURL=load-capability.d.ts.map

package/dist/meta-tools/load-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-capability.d.ts","sourceRoot":"","sources":["../../src/meta-tools/load-capability.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAkB,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AA0BnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,gBAAgB,EAClC,YAAY,EAAE,YAAY,GACzB,UAAU,CAmEZ"}

package/dist/meta-tools/load-capability.js

@@ -0,0 +1,82 @@
+import { z } from 'zod';
+import { Command } from '@langchain/langgraph';
+import { ToolMessage } from '@langchain/core/messages';
+import { tool } from '../plugin-api/tool-helper.js';
+/**
+ * Schema accepted by `load_capability`. The agent supplies the plugin name
+ * returned by `list_capabilities`.
+ */
+const loadCapabilitySchema = z.object({
+    name: z.string(),
+});
+/**
+ * Build the `load_capability` meta-tool.
+ *
+ * Marks a plugin as loaded for the current thread AND returns its full
+ * manifest (whenToUse, examples, …) plus a per-tool description + arg-shape
+ * summary. This is the single discovery+load entry point — the agent does
+ * not need a separate `list_capability_details` call.
+ *
+ * Behavior:
+ *  - Unknown plugin → throws, instructing the agent to call
+ *    `list_capabilities` first.
+ *  - `silent` plugin → throws (silent plugins are not agent-loadable).
+ *  - Plugin already loaded, or visibility is `always` → returns
+ *    `LoadCapabilityResult` directly (no state change).
+ *  - Otherwise → returns a LangGraph `Command` whose update both appends the
+ *    plugin to `loadedPlugins` AND emits a matching `ToolMessage` carrying
+ *    the JSON-encoded `LoadCapabilityResult` so the agent sees the manifest
+ *    in conversation history on the same turn.
+ */
+export function buildLoadCapabilityTool(manifestRegistry, toolRegistry) {
+    return tool(async (args, ctx) => {
+        const { name } = loadCapabilitySchema.parse(args);
+        const entry = manifestRegistry
+            .collect()
+            .find((m) => m.pluginName === name);
+        if (!entry) {
+            throw new Error(`Capability "${name}" does not exist. Call list_capabilities first to discover available plugins.`);
+        }
+        if (entry.manifest.visibility === 'silent') {
+            throw new Error(`Capability "${name}" is internal and cannot be loaded by the agent. Call list_capabilities first to discover loadable plugins.`);
+        }
+        const tools = toolRegistry
+            .toolsForPlugin(name)
+            .map((t) => ({
+            name: t.name,
+            description: t.description,
+        }));
+        const alreadyLoaded = ctx.loadedPlugins?.has(name) === true;
+        const alwaysVisible = entry.manifest.visibility === 'always';
+        const alreadyAvailable = alreadyLoaded || alwaysVisible;
+        const detail = {
+            ...entry.manifest,
+            alreadyAvailable,
+            tools,
+        };
+        if (alreadyAvailable) {
+            return detail;
+        }
+        // New load — update state AND emit a ToolMessage so the agent sees the
+        // manifest on the same turn. Without a matching tool_call_id LangChain
+        // can't satisfy the model's tool-result expectation, so when we don't
+        // have one (direct/test invocation) we skip the message and rely on the
+        // caller to read state.
+        const update = {
+            loadedPlugins: [name],
+        };
+        if (ctx.toolCallId) {
+            update.messages = [
+                new ToolMessage({
+                    content: JSON.stringify(detail),
+                    tool_call_id: ctx.toolCallId,
+                }),
+            ];
+        }
+        return new Command({ update });
+    }, {
+        name: 'load_capability',
+        description: "Load a capability for the rest of this conversation. The response is the plugin's full manifest plus a tool list — after this call, the capability's tools are usable on the next model step.",
+        schema: loadCapabilitySchema,
+    });
+}

package/dist/modules/auth/auth-header.middleware.d.ts

@@ -0,0 +1,37 @@
+import { Cache } from '@nestjs/cache-manager';
+import { type NestMiddleware } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { type NextFunction, type Request, type Response } from 'express';
+import { UcanService } from '../ucan/ucan.service.js';
+declare global {
+    namespace Express {
+        interface Request {
+            authData: {
+                did: string;
+                ucanDelegation: {
+                    /**
+                     * Raw base64-encoded delegation header as sent by the client.
+                     * Plugin code reads this from `runCtx.user.ucanDelegation.raw`
+                     * to mint downstream service invocations.
+                     */
+                    raw: string;
+                    issuer: string;
+                    audience: string;
+                    capabilities: unknown[];
+                    expiration?: number;
+                };
+            };
+        }
+    }
+}
+export declare class AuthHeaderMiddleware implements NestMiddleware {
+    private cacheManager;
+    private readonly configService;
+    private readonly ucanService;
+    private readonly logger;
+    constructor(cacheManager: Cache, configService: ConfigService, ucanService: UcanService);
+    private hashToken;
+    private validateUcanDelegation;
+    use(req: Request, _res: Response, next: NextFunction): Promise<void>;
+}
+//# sourceMappingURL=auth-header.middleware.d.ts.map

package/dist/modules/auth/auth-header.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-header.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth-header.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAiB,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEzE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,EAAE;gBACR,GAAG,EAAE,MAAM,CAAC;gBACZ,cAAc,EAAE;oBACd;;;;uBAIG;oBACH,GAAG,EAAE,MAAM,CAAC;oBACZ,MAAM,EAAE,MAAM,CAAC;oBACf,QAAQ,EAAE,MAAM,CAAC;oBACjB,YAAY,EAAE,OAAO,EAAE,CAAC;oBACxB,UAAU,CAAC,EAAE,MAAM,CAAC;iBACrB,CAAC;aACH,CAAC;SACH;KACF;CACF;AAcD,qBACa,oBAAqB,YAAW,cAAc;IAIhC,OAAO,CAAC,YAAY;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAL9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAG/B,YAAY,EAAE,KAAK,EACjC,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW;IAG3C,OAAO,CAAC,SAAS;YAIH,sBAAsB;IAuC9B,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAuF3E"}

package/dist/modules/auth/auth-header.middleware.js

@@ -0,0 +1,115 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthHeaderMiddleware_1;
+import { Cache, CACHE_MANAGER } from '@nestjs/cache-manager';
+import { HttpException, HttpStatus, Inject, Injectable, Logger, } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { minutes } from '@nestjs/throttler';
+import * as crypto from 'node:crypto';
+import { UcanService } from '../ucan/ucan.service.js';
+import { validateUcanDelegation } from './validate-ucan-delegation.js';
+const THREE_MINUTES = minutes(3);
+let AuthHeaderMiddleware = AuthHeaderMiddleware_1 = class AuthHeaderMiddleware {
+    cacheManager;
+    configService;
+    ucanService;
+    logger = new Logger(AuthHeaderMiddleware_1.name);
+    constructor(cacheManager, configService, ucanService) {
+        this.cacheManager = cacheManager;
+        this.configService = configService;
+        this.ucanService = ucanService;
+    }
+    hashToken(token) {
+        return crypto.createHash('sha256').update(token, 'utf8').digest('hex');
+    }
+    async validateUcanDelegation(ucanHeader) {
+        const oracleDid = this.configService.get('ORACLE_DID');
+        if (!oracleDid) {
+            this.logger.warn('[UCAN] ORACLE_DID not configured, skipping delegation validation');
+            return null;
+        }
+        const blocksyncUri = this.configService.getOrThrow('BLOCKSYNC_GRAPHQL_URL');
+        const outcome = await validateUcanDelegation(ucanHeader, {
+            oracleDid,
+            blocksyncUri,
+        });
+        if (!outcome.ok) {
+            this.logger.warn(`[UCAN] Delegation validation failed: ${outcome.error}`);
+            return null;
+        }
+        const { delegation } = outcome.result;
+        this.logger.log(`[UCAN] Delegation validated: iss=${outcome.result.userDid} aud=${oracleDid} exp=${delegation.expiration ? new Date(delegation.expiration * 1000).toISOString() : 'none'}`);
+        return outcome.result;
+    }
+    async use(req, _res, next) {
+        this.logger.debug(`AuthHeaderMiddleware processing request for: ${req.originalUrl}`);
+        try {
+            const ucanHeader = req.headers['x-ucan-delegation'];
+            if (!ucanHeader) {
+                throw new HttpException('Missing x-ucan-delegation header', HttpStatus.UNAUTHORIZED);
+            }
+            const ucanHash = this.hashToken(ucanHeader);
+            const cachedUcan = await this.cacheManager.get(`ucan_auth_${ucanHash}`);
+            if (cachedUcan) {
+                req.authData = {
+                    did: cachedUcan.userDid,
+                    ucanDelegation: { ...cachedUcan.delegation, raw: ucanHeader },
+                };
+                // Re-cache raw delegation for downstream invocations
+                await this.ucanService.cacheDelegation(cachedUcan.userDid, ucanHeader, cachedUcan.delegation.expiration);
+                this.logger.debug(`[UCAN] Auth from cache for DID: ${cachedUcan.userDid}`);
+                next();
+                return;
+            }
+            const ucanResult = await this.validateUcanDelegation(ucanHeader);
+            if (!ucanResult) {
+                throw new HttpException('Invalid UCAN delegation', HttpStatus.UNAUTHORIZED);
+            }
+            req.authData = {
+                did: ucanResult.userDid,
+                ucanDelegation: { ...ucanResult.delegation, raw: ucanHeader },
+            };
+            // Cache auth result
+            const ttl = ucanResult.delegation.expiration
+                ? Math.max(0, ucanResult.delegation.expiration * 1000 - Date.now())
+                : THREE_MINUTES;
+            await this.cacheManager.set(`ucan_auth_${ucanHash}`, {
+                userDid: ucanResult.userDid,
+                delegation: ucanResult.delegation,
+            }, ttl);
+            // Cache raw delegation for downstream service invocations
+            await this.ucanService.cacheDelegation(ucanResult.userDid, ucanHeader, ucanResult.delegation.expiration);
+            this.logger.debug(`[UCAN] Auth completed for DID: ${ucanResult.userDid}`);
+            next();
+        }
+        catch (error) {
+            if (error instanceof HttpException) {
+                next(error);
+            }
+            else {
+                const message = error instanceof Error ? error.message : String(error);
+                const errorStack = error instanceof Error ? error.stack : undefined;
+                this.logger.error(`Auth header validation failed: ${message}`, errorStack);
+                next(new HttpException(message, HttpStatus.UNAUTHORIZED));
+            }
+        }
+    }
+};
+AuthHeaderMiddleware = AuthHeaderMiddleware_1 = __decorate([
+    Injectable(),
+    __param(0, Inject(CACHE_MANAGER)),
+    __metadata("design:paramtypes", [Cache,
+        ConfigService,
+        UcanService])
+], AuthHeaderMiddleware);
+export { AuthHeaderMiddleware };

package/dist/modules/auth/auth.module.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Auth module wrapping the UCAN-based auth-header middleware.
+ *
+ * Provides AuthHeaderMiddleware as a NestJS provider so that
+ * RuntimeAppModule can wire it via `MiddlewareConsumer.apply()`.
+ */
+export declare class AuthModule {
+}
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/modules/auth/auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,qBAKa,UAAU;CAAG"}

package/dist/modules/auth/auth.module.js

@@ -0,0 +1,27 @@
+/**
+ * @fileoverview Auth module wrapping the UCAN-based auth-header middleware.
+ *
+ * Provides AuthHeaderMiddleware as a NestJS provider so that
+ * RuntimeAppModule can wire it via `MiddlewareConsumer.apply()`.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from '@nestjs/common';
+import { CacheModule } from '@nestjs/cache-manager';
+import { ConfigModule } from '@nestjs/config';
+import { UcanModule } from '../ucan/ucan.module.js';
+import { AuthHeaderMiddleware } from './auth-header.middleware.js';
+let AuthModule = class AuthModule {
+};
+AuthModule = __decorate([
+    Module({
+        imports: [ConfigModule, CacheModule.register(), UcanModule],
+        providers: [AuthHeaderMiddleware],
+        exports: [AuthHeaderMiddleware],
+    })
+], AuthModule);
+export { AuthModule };

package/dist/modules/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { AuthHeaderMiddleware } from './auth-header.middleware.js';
+export { AuthModule } from './auth.module.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/modules/auth/index.js

@@ -0,0 +1,2 @@
+export { AuthHeaderMiddleware } from './auth-header.middleware.js';
+export { AuthModule } from './auth.module.js';

package/dist/modules/auth/validate-ucan-delegation.d.ts

@@ -0,0 +1,31 @@
+/** The validated identity + delegation metadata extracted from a UCAN header. */
+export interface ValidatedUcanDelegation {
+    userDid: string;
+    delegation: {
+        issuer: string;
+        audience: string;
+        capabilities: unknown[];
+        expiration?: number;
+    };
+}
+export interface ValidateUcanDelegationOptions {
+    /** The oracle's DID — used as the expected delegation audience (serverDid). */
+    oracleDid: string;
+    /** Blocksync GraphQL endpoint used to resolve `did:ixo` verification keys. */
+    blocksyncUri: string;
+}
+export type ValidateUcanDelegationOutcome = {
+    ok: true;
+    result: ValidatedUcanDelegation;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Validate a raw UCAN delegation header against this oracle. Shared by the
+ * HTTP `AuthHeaderMiddleware` and the WebSocket gateway so both transports
+ * authenticate identically — the returned `userDid` is the validated invoker,
+ * never a value the client claimed for itself.
+ */
+export declare function validateUcanDelegation(ucanHeader: string, opts: ValidateUcanDelegationOptions): Promise<ValidateUcanDelegationOutcome>;
+//# sourceMappingURL=validate-ucan-delegation.d.ts.map

package/dist/modules/auth/validate-ucan-delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-ucan-delegation.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/validate-ucan-delegation.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE;QACV,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,OAAO,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,6BAA6B,CAAC,CAgCxC"}

package/dist/modules/auth/validate-ucan-delegation.js

@@ -0,0 +1,36 @@
+import { createIxoDIDResolver, createUCANValidator } from '@ixo/ucan';
+/**
+ * Validate a raw UCAN delegation header against this oracle. Shared by the
+ * HTTP `AuthHeaderMiddleware` and the WebSocket gateway so both transports
+ * authenticate identically — the returned `userDid` is the validated invoker,
+ * never a value the client claimed for itself.
+ */
+export async function validateUcanDelegation(ucanHeader, opts) {
+    const validator = await createUCANValidator({
+        serverDid: opts.oracleDid,
+        rootIssuers: [],
+        didResolver: createIxoDIDResolver({ indexerUrl: opts.blocksyncUri }),
+    });
+    const result = await validator.validateDelegation(ucanHeader);
+    if (!result.ok) {
+        return {
+            ok: false,
+            error: `[${result.error?.code}] ${result.error?.message}`,
+        };
+    }
+    if (!result.invoker) {
+        return { ok: false, error: 'Delegation validated without an invoker DID' };
+    }
+    return {
+        ok: true,
+        result: {
+            userDid: result.invoker,
+            delegation: {
+                issuer: result.invoker,
+                audience: opts.oracleDid,
+                capabilities: result.capability ? [result.capability] : [],
+                expiration: result.expiration,
+            },
+        },
+    };
+}

package/dist/modules/blob-store/blob-store.module.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Global module exposing BlobStoreService.
+ *
+ * The service uses the runtime-wide CacheModule (already registered globally
+ * in RuntimeAppModule), so this module just declares the service as a global
+ * provider — no extra imports needed.
+ */
+export declare class BlobStoreModule {
+}
+//# sourceMappingURL=blob-store.module.d.ts.map

package/dist/modules/blob-store/blob-store.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-store.module.d.ts","sourceRoot":"","sources":["../../../src/modules/blob-store/blob-store.module.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAKa,eAAe;CAAG"}

package/dist/modules/blob-store/blob-store.module.js

@@ -0,0 +1,25 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Global, Module } from '@nestjs/common';
+import { BlobStoreService } from './blob-store.service.js';
+/**
+ * Global module exposing BlobStoreService.
+ *
+ * The service uses the runtime-wide CacheModule (already registered globally
+ * in RuntimeAppModule), so this module just declares the service as a global
+ * provider — no extra imports needed.
+ */
+let BlobStoreModule = class BlobStoreModule {
+};
+BlobStoreModule = __decorate([
+    Global(),
+    Module({
+        providers: [BlobStoreService],
+        exports: [BlobStoreService],
+    })
+], BlobStoreModule);
+export { BlobStoreModule };