@jinn-network/client 0.1.2 → 0.1.3-canary.2d6b2676

package/dist/harnesses/capability/index.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Capability handles passed to a {@link Harness} via
+ * {@link HarnessContext}. The daemon mints these per-call and
+ * enforces the impl's manifest allow-list before delegating to the
+ * underlying signer / RPC client.
+ *
+ * Spec: `spec/2026-05-executor-trust-boundary.md` §3.
+ */
+import type { Address, Hex } from 'viem';
+/**
+ * EIP-712 typed-data signing payload. Mirrors viem's signTypedData
+ * input but with `account` removed — the daemon binds the signer to
+ * its master EOA before delegation.
+ */
+export interface SignTypedDataArgs {
+    domain: {
+        name?: string;
+        version?: string;
+        chainId?: number;
+        verifyingContract?: Address;
+    };
+    types: Record<string, Array<{
+        name: string;
+        type: string;
+    }>>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+/**
+ * Allow-listed transaction shape. Each call's `(chainId, to, selector)`
+ * triple must match the impl's manifest capability allow-list; the
+ * daemon refuses calls outside the list.
+ */
+export interface SendAllowedCallArgs {
+    to: Address;
+    data: Hex;
+    value?: bigint;
+}
+/**
+ * Scoped signer — an impl never sees a raw private key. The daemon
+ * issues this handle per `run()` call, validates each request against
+ * the manifest allow-list, and discards it on return.
+ */
+export interface ScopedSigner {
+    /** EOA address the daemon will sign as. Read-only. */
+    readonly address: Address;
+    /** Sign EIP-712 typed data for an allow-listed domain. */
+    signTypedData(args: SignTypedDataArgs): Promise<Hex>;
+    /** Send a tx whose (chainId, to, selector) is on the impl allow-list. */
+    sendAllowedCall(call: SendAllowedCallArgs): Promise<Hex>;
+}
+/**
+ * Scoped RPC — read-only subset of viem's PublicClient interface.
+ * The daemon enforces method allow-list, rate limiting, and chain
+ * filtering per `spec/2026-05-executor-trust-boundary.md` §3.3.
+ */
+export interface ScopedRpc {
+    readContract(args: {
+        address: Address;
+        abi: readonly unknown[];
+        functionName: string;
+        args?: readonly unknown[];
+    }): Promise<unknown>;
+    getBlockNumber(): Promise<bigint>;
+    getBalance(args: {
+        address: Address;
+    }): Promise<bigint>;
+    getCode(args: {
+        address: Address;
+    }): Promise<Hex | undefined>;
+    getChainId(): Promise<number>;
+}
+/**
+ * Per-impl secret bag. Populated by the impl's own `onEnable` flow
+ * and persisted under `implStateDir/<impl>/secrets/`. Read-only.
+ */
+export type ScopedSecrets = Readonly<Record<string, string>>;
+export { createScopedSigner } from './scoped-signer.js';
+export type { CapabilityAllowEntry, CreateScopedSignerArgs, TypedDataAllowEntry, } from './scoped-signer.js';
+export { createScopedRpc } from './scoped-rpc.js';
+export type { CreateScopedRpcArgs } from './scoped-rpc.js';
+export { freezeSecrets } from './scoped-secrets.js';

package/dist/harnesses/capability/index.js

@@ -0,0 +1,12 @@
+/**
+ * Capability handles passed to a {@link Harness} via
+ * {@link HarnessContext}. The daemon mints these per-call and
+ * enforces the impl's manifest allow-list before delegating to the
+ * underlying signer / RPC client.
+ *
+ * Spec: `spec/2026-05-executor-trust-boundary.md` §3.
+ */
+export { createScopedSigner } from './scoped-signer.js';
+export { createScopedRpc } from './scoped-rpc.js';
+export { freezeSecrets } from './scoped-secrets.js';
+//# sourceMappingURL=index.js.map

package/dist/harnesses/capability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/harnesses/capability/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAMxD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/harnesses/capability/scoped-rpc.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Scoped RPC constructor — wraps an upstream public RPC client and
+ * enforces a chain-id allow-list before delegating.
+ */
+import type { ScopedRpc } from './index.js';
+export interface CreateScopedRpcArgs {
+    /** A viem PublicClient (or compatible read-only RPC) the daemon owns. */
+    upstream: ScopedRpc;
+    /** Chain ids this impl is allowed to read. Empty array = none. */
+    chainIdAllowList: readonly number[];
+}
+export declare function createScopedRpc({ upstream, chainIdAllowList, }: CreateScopedRpcArgs): ScopedRpc;

package/dist/harnesses/capability/scoped-rpc.js

@@ -0,0 +1,34 @@
+/**
+ * Scoped RPC constructor — wraps an upstream public RPC client and
+ * enforces a chain-id allow-list before delegating.
+ */
+export function createScopedRpc({ upstream, chainIdAllowList, }) {
+    async function ensureChainAllowed() {
+        const chainId = await upstream.getChainId();
+        if (!chainIdAllowList.includes(chainId)) {
+            throw new Error(`chain ${chainId} not in allow-list ${JSON.stringify(chainIdAllowList)}`);
+        }
+    }
+    return {
+        async readContract(args) {
+            await ensureChainAllowed();
+            return upstream.readContract(args);
+        },
+        async getBlockNumber() {
+            await ensureChainAllowed();
+            return upstream.getBlockNumber();
+        },
+        async getBalance(args) {
+            await ensureChainAllowed();
+            return upstream.getBalance(args);
+        },
+        async getCode(args) {
+            await ensureChainAllowed();
+            return upstream.getCode(args);
+        },
+        async getChainId() {
+            return upstream.getChainId();
+        },
+    };
+}
+//# sourceMappingURL=scoped-rpc.js.map

package/dist/harnesses/capability/scoped-rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-rpc.js","sourceRoot":"","sources":["../../../src/harnesses/capability/scoped-rpc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,MAAM,UAAU,eAAe,CAAC,EAC9B,QAAQ,EACR,gBAAgB,GACI;IACpB,KAAK,UAAU,kBAAkB;QAC/B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,sBAAsB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,IAAI;YACrB,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,cAAc,EAAE,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/harnesses/capability/scoped-secrets.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Scoped secrets helper — produces a read-only view over a secrets
+ * bag. The daemon stores the underlying map and re-issues a fresh
+ * frozen view per `run()` call so revoked secrets stop reaching impls
+ * promptly.
+ */
+import type { ScopedSecrets } from './index.js';
+export declare function freezeSecrets(source: Record<string, string>): ScopedSecrets;

package/dist/harnesses/capability/scoped-secrets.js

@@ -0,0 +1,10 @@
+/**
+ * Scoped secrets helper — produces a read-only view over a secrets
+ * bag. The daemon stores the underlying map and re-issues a fresh
+ * frozen view per `run()` call so revoked secrets stop reaching impls
+ * promptly.
+ */
+export function freezeSecrets(source) {
+    return Object.freeze({ ...source });
+}
+//# sourceMappingURL=scoped-secrets.js.map

package/dist/harnesses/capability/scoped-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-secrets.js","sourceRoot":"","sources":["../../../src/harnesses/capability/scoped-secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC"}

package/dist/harnesses/capability/scoped-signer.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Scoped signer constructor — Phase 1 implementation. The (chainId,
+ * to, selector) allow-list is enforced before `sendAllowedCall`
+ * delegates, and the EIP-712 domain allow-list is enforced before
+ * `signTypedData` delegates. Actual transaction signing is wired in a
+ * follow-up plan (the daemon plan that owns the wallet); the typed-data
+ * delegation hits the master account immediately.
+ *
+ * Spec: `spec/2026-05-executor-trust-boundary.md` §3.
+ */
+import type { Account, Address, Hex } from 'viem';
+import type { ScopedSigner } from './index.js';
+export interface CapabilityAllowEntry {
+    chainId: number;
+    to: Address;
+    /** Lower-case 4-byte selector with `0x` prefix (e.g. `0xdeadbeef`). */
+    selector: Hex;
+}
+/**
+ * EIP-712 typed-data domain allow-list entry. See
+ * `client/src/harnesses/manifest/types.ts:TypedDataAllowEntry` and
+ * the manifest-schema field `capabilities.signer.typedDataDomains`.
+ *
+ * - `chainId` MUST match exactly.
+ * - `verifyingContract` / `name` / `version` match only when set on
+ *   the entry; an unset field on the entry means "any value".
+ */
+export interface TypedDataAllowEntry {
+    chainId: number;
+    name?: string;
+    version?: string;
+    verifyingContract?: Address;
+}
+export interface CreateScopedSignerArgs {
+    account: Account;
+    allowList: readonly CapabilityAllowEntry[];
+    /**
+     * Domain allow-list for `signTypedData`. The daemon refuses any
+     * `signTypedData` call whose domain does not match an entry here.
+     * Default-deny: an empty array means EVERY `signTypedData` call
+     * throws (matches the "no typedDataDomains in the manifest" case).
+     */
+    typedDataAllowList: readonly TypedDataAllowEntry[];
+    chainId: number;
+}
+export declare function createScopedSigner({ account, allowList, typedDataAllowList, chainId, }: CreateScopedSignerArgs): ScopedSigner;

package/dist/harnesses/capability/scoped-signer.js

@@ -0,0 +1,73 @@
+/**
+ * Scoped signer constructor — Phase 1 implementation. The (chainId,
+ * to, selector) allow-list is enforced before `sendAllowedCall`
+ * delegates, and the EIP-712 domain allow-list is enforced before
+ * `signTypedData` delegates. Actual transaction signing is wired in a
+ * follow-up plan (the daemon plan that owns the wallet); the typed-data
+ * delegation hits the master account immediately.
+ *
+ * Spec: `spec/2026-05-executor-trust-boundary.md` §3.
+ */
+function eqLowerOrUndef(a, b) {
+    if (a === undefined || b === undefined)
+        return false;
+    return a.toLowerCase() === b.toLowerCase();
+}
+function matchesEntry(entry, domain) {
+    if (domain.chainId !== entry.chainId)
+        return false;
+    if (entry.verifyingContract !== undefined) {
+        if (!domain.verifyingContract)
+            return false;
+        if (!eqLowerOrUndef(entry.verifyingContract, domain.verifyingContract)) {
+            return false;
+        }
+    }
+    if (entry.name !== undefined) {
+        if (domain.name !== entry.name)
+            return false;
+    }
+    if (entry.version !== undefined) {
+        if (domain.version !== entry.version)
+            return false;
+    }
+    return true;
+}
+export function createScopedSigner({ account, allowList, typedDataAllowList, chainId, }) {
+    return {
+        get address() {
+            return account.address;
+        },
+        async signTypedData(args) {
+            // Default-deny: empty allow-list refuses everything. Operators
+            // who need typed-data signing MUST declare a
+            // `capabilities.signer.typedDataDomains` entry on the manifest.
+            // Finding 3.
+            const allowed = typedDataAllowList.some((entry) => matchesEntry(entry, args.domain));
+            if (!allowed) {
+                throw new Error(`signTypedData domain not in allow-list (chainId=${args.domain.chainId ?? 'unspecified'}, ` +
+                    `verifyingContract=${args.domain.verifyingContract ?? 'unspecified'})`);
+            }
+            if (typeof account.signTypedData !== 'function') {
+                throw new Error('master account does not support signTypedData');
+            }
+            return account.signTypedData(args);
+        },
+        async sendAllowedCall(call) {
+            const selector = call.data.slice(0, 10).toLowerCase();
+            const entry = allowList.find((e) => e.chainId === chainId &&
+                e.to.toLowerCase() === call.to.toLowerCase() &&
+                e.selector.toLowerCase() === selector);
+            if (!entry) {
+                const haveContract = allowList.some((e) => e.chainId === chainId && e.to.toLowerCase() === call.to.toLowerCase());
+                if (!haveContract) {
+                    throw new Error(`to ${call.to} not in allow-list for chain ${chainId}`);
+                }
+                throw new Error(`selector ${selector} not in allow-list for ${call.to} on chain ${chainId}`);
+            }
+            // Phase 1: shape only — actual signing is wired in the daemon plan.
+            throw new Error('sendAllowedCall is allow-list-validated but signing is wired in the daemon plan');
+        },
+    };
+}
+//# sourceMappingURL=scoped-signer.js.map

package/dist/harnesses/capability/scoped-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-signer.js","sourceRoot":"","sources":["../../../src/harnesses/capability/scoped-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAyCH,SAAS,cAAc,CAAC,CAAqB,EAAE,CAAqB;IAClE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CACnB,KAA0B,EAC1B,MAAmC;IAEnC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,OAAO,GACgB;IACvB,OAAO;QACL,IAAI,OAAO;YACT,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAuB;YACzC,+DAA+D;YAC/D,6CAA6C;YAC7C,gEAAgE;YAChE,aAAa;YACb,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CACjC,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,aAAa,IAAI;oBACzF,qBAAqB,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,aAAa,GAAG,CACzE,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,OAAO,CAAC,aAAa,CAAC,IAAa,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,IAAyB;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAS,CAAC;YAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,OAAO;gBACrB,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;gBAC5C,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CACxC,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAC7E,CAAC;gBACF,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,gCAAgC,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,YAAY,QAAQ,0BAA0B,IAAI,CAAC,EAAE,aAAa,OAAO,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,oEAAoE;YACpE,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/harnesses/engine/canonical-json.d.ts

@@ -0,0 +1 @@
+export declare function canonicalJson(value: unknown): string;

package/dist/harnesses/engine/canonical-json.js

@@ -0,0 +1,66 @@
+/**
+ * Canonical JSON serialisation — RFC 8785 JCS.
+ *
+ * Uses the `canonicalize` npm package (≈30 LOC, zero deps) so third-party
+ * verifiers can reproduce our signing input with any standard JCS library.
+ *
+ * Rules per RFC 8785:
+ * - Object keys sorted lexicographically by UTF-16 code-unit order.
+ * - No insignificant whitespace.
+ * - I-JSON number formatting per ECMAScript `Number.prototype.toString(10)`
+ *   (integer-preferred; scientific notation when |x| ≥ 1e21 or |x| < 5e-7;
+ *   -0 serialises as 0).
+ * - String escape rules per JSON spec (control chars as \\uXXXX; only ", \
+ *   and control chars must be escaped).
+ * - `undefined` values in objects are dropped (matches JSON.stringify).
+ * - `NaN` / `Infinity` serialise to `null` (matches JSON.stringify).
+ *
+ * BigInt is **not** supported — JCS is a canonicalization of standard JSON,
+ * which has no BigInt type. Callers must convert BigInt to string or number
+ * before calling. Passing BigInt throws.
+ *
+ * Used for manifest signing: produce a deterministic byte string that two
+ * independent parties can reproduce from the same object graph.
+ */
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const canonicalize = require('canonicalize');
+/**
+ * Recursively replace NaN / ±Infinity with null so that canonicalize does not
+ * throw — matching the JSON.stringify behaviour that the rest of the codebase
+ * expects. BigInt is intentionally left unhandled so that canonicalize throws
+ * a clear error when a caller passes one.
+ */
+function coerceNonFinite(value) {
+    if (typeof value === 'number' && !isFinite(value))
+        return null;
+    if (Array.isArray(value))
+        return value.map(coerceNonFinite);
+    if (value !== null && typeof value === 'object') {
+        // Preserve toJSON() — canonicalize would otherwise call it itself;
+        // by pre-processing we must not strip it. Invoke it here and recurse
+        // on its return value so NaN/Infinity inside toJSON results are still
+        // coerced.
+        const toJson = value.toJSON;
+        if (typeof toJson === 'function') {
+            return coerceNonFinite(toJson.call(value));
+        }
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = coerceNonFinite(v);
+        return out;
+    }
+    return value;
+}
+export function canonicalJson(value) {
+    const coerced = coerceNonFinite(value);
+    const result = canonicalize(coerced);
+    if (result === undefined) {
+        // canonicalize returns undefined for top-level undefined input (matches
+        // JSON.stringify). Match Jinn's previous behaviour: emit "null" so the
+        // return type is always a string.
+        return 'null';
+    }
+    return result;
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/harnesses/engine/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../src/harnesses/engine/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAA2C,CAAC;AAEvF;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,WAAW;QACX,MAAM,MAAM,GAAI,KAAoC,CAAC,MAAM,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,wEAAwE;QACxE,uEAAuE;QACvE,kCAAkC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/{restorer → harnesses}/engine/claim.d.ts

@@ -1,5 +1,5 @@
 /**
- * Two-layer claim orchestration for the restorer engine.
+ * Two-layer claim orchestration for the harness engine.
  *
  * §6.1, §9.1, §9.2 of spec/2026-04-17-portfolio-v0-design.md
  *
@@ -29,8 +29,8 @@ export interface MarketplaceClaimer {
     claimRequest(requestId: string): Promise<void>;
 }
 /**
- * Parameters describing a single intent's timing window.
- * Extracted from PersistedIntent for testability (no DB dependency).
+ * Parameters describing a single task's timing window.
+ * Extracted from PersistedTaskRun for testability (no DB dependency).
  */
 export interface ClaimWindow {
     requestId: string;
@@ -43,15 +43,15 @@ export interface ClaimResult {
     registryClaimWasFresh: boolean;
 }
 /**
- * Execute the two-layer claim for a single intent.
+ * Execute the two-layer claim for a single task.
  *
  * // Claim ordering: ClaimRegistry FIRST (cheap coordination lock), marketplace SECOND.
  * // Spec §6.1 lists them in opposite order but doesn't enforce sequencing — registry-first
- * // is preferred because: (a) ClaimRegistry revert is fast and signals "another restorer
+ * // is preferred because: (a) ClaimRegistry revert is fast and signals "another harness
  * // is on it" cleanly; (b) marketplace claim is more expensive (Safe tx + actual gas);
  * // (c) we release ClaimRegistry on marketplace failure to avoid leaking a stale claim.
  *
- * @param claimWindow - Timing data for the intent (requestId, windowStartTs).
+ * @param claimWindow - Timing data for the task (requestId, windowStartTs).
  * @param registryClient - ClaimRegistryClient for the deployed ClaimRegistry contract.
  * @param marketplaceClaimer - Adapter whose claimRequest() performs the marketplace claim.
  * @returns ClaimResult on success.
@@ -59,7 +59,7 @@ export interface ClaimResult {
  */
 export declare function executeTwoLayerClaim(claimWindow: ClaimWindow, registryClient: ClaimRegistryClient, marketplaceClaimer: MarketplaceClaimer): Promise<ClaimResult>;
 /**
- * Release the ClaimRegistry claim for an intent that was CLAIMED but whose
+ * Release the ClaimRegistry claim for an task that was CLAIMED but whose
  * work window has not yet started (windowStartTs not reached).
  *
  * Used during graceful engine shutdown. No-op if we don't hold the claim.

package/dist/{restorer → harnesses}/engine/claim.js

@@ -1,5 +1,5 @@
 /**
- * Two-layer claim orchestration for the restorer engine.
+ * Two-layer claim orchestration for the harness engine.
  *
  * §6.1, §9.1, §9.2 of spec/2026-04-17-portfolio-v0-design.md
  *
@@ -22,15 +22,15 @@
  */
 // ── Two-layer claim ───────────────────────────────────────────────────────────
 /**
- * Execute the two-layer claim for a single intent.
+ * Execute the two-layer claim for a single task.
  *
  * // Claim ordering: ClaimRegistry FIRST (cheap coordination lock), marketplace SECOND.
  * // Spec §6.1 lists them in opposite order but doesn't enforce sequencing — registry-first
- * // is preferred because: (a) ClaimRegistry revert is fast and signals "another restorer
+ * // is preferred because: (a) ClaimRegistry revert is fast and signals "another harness
  * // is on it" cleanly; (b) marketplace claim is more expensive (Safe tx + actual gas);
  * // (c) we release ClaimRegistry on marketplace failure to avoid leaking a stale claim.
  *
- * @param claimWindow - Timing data for the intent (requestId, windowStartTs).
+ * @param claimWindow - Timing data for the task (requestId, windowStartTs).
  * @param registryClient - ClaimRegistryClient for the deployed ClaimRegistry contract.
  * @param marketplaceClaimer - Adapter whose claimRequest() performs the marketplace claim.
  * @returns ClaimResult on success.
@@ -45,7 +45,14 @@ export async function executeTwoLayerClaim(claimWindow, registryClient, marketpl
     if (!alreadyClaimed) {
         const result = await registryClient.claimJob(requestIdHex);
         if (!result.claimed) {
-            throw new Error(`[claim-orchestration] ClaimRegistry claim failed for ${claimWindow.requestId} — another operator may hold the claim`);
+            const detail = result.reason === 'lost-race' && result.competitor
+                ? `lost claim race to ${result.competitor}`
+                : result.reason === 'lost-race'
+                    ? 'lost claim race to another operator'
+                    : result.reason === 'ineligible'
+                        ? 'eligibility checker rejected'
+                        : `tx reverted${result.reason ? ` (${result.reason})` : ''}`;
+            throw new Error(`[claim-orchestration] ClaimRegistry claim failed for ${claimWindow.requestId} — ${detail}`);
         }
         registryClaimWasFresh = true;
     }
@@ -61,7 +68,7 @@ export async function executeTwoLayerClaim(claimWindow, registryClient, marketpl
         // (only if we placed it fresh; pre-existing claims are not ours to release here)
         // TODO(v0 trade-off): on the resume path (weAlreadyClaimed = true, registryClaimWasFresh = false)
         // we do NOT release the ClaimRegistry claim here.  Releasing on a transient marketplace failure
-        // would forfeit our coordination lock and let a competing restorer take it.  The downside is that
+        // would forfeit our coordination lock and let a competing harness take it.  The downside is that
         // on a *persistent* failure the claim sits locked until TTL expiry (owner-configured per-deployment).
         // Distinguishing transient vs. permanent failures is non-trivial; for v0 we accept the TTL wait.
         // Future: inspect the marketplace error type and release only on permanent failures.
@@ -81,7 +88,7 @@ export async function executeTwoLayerClaim(claimWindow, registryClient, marketpl
 }
 // ── Graceful release ──────────────────────────────────────────────────────────
 /**
- * Release the ClaimRegistry claim for an intent that was CLAIMED but whose
+ * Release the ClaimRegistry claim for an task that was CLAIMED but whose
  * work window has not yet started (windowStartTs not reached).
  *
  * Used during graceful engine shutdown. No-op if we don't hold the claim.

package/dist/harnesses/engine/claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim.js","sourceRoot":"","sources":["../../../src/harnesses/engine/claim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+BH,iFAAiF;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAwB,EACxB,cAAmC,EACnC,kBAAsC;IAEtC,MAAM,YAAY,GAAG,WAAW,CAAC,SAAgB,CAAC;IAElD,6EAA6E;IAE7E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC3E,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAElC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,UAAU;gBAChD,CAAC,CAAC,sBAAsB,MAAM,CAAC,UAAU,EAAE;gBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW;oBAC7B,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY;wBAC9B,CAAC,CAAC,8BAA8B;wBAChC,CAAC,CAAC,cAAc,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,wDAAwD,WAAW,CAAC,SAAS,MAAM,MAAM,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,qBAAqB,GAAG,IAAI,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,qEAAqE,WAAW,CAAC,SAAS,qBAAqB,CAChH,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,cAAc,EAAE,CAAC;QACxB,4EAA4E;QAC5E,iFAAiF;QACjF,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,sGAAsG;QACtG,iGAAiG;QACjG,qFAAqF;QACrF,IAAI,qBAAqB,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,CACT,0DAA0D,WAAW,CAAC,SAAS,4BAA4B,CAC5G,CAAC;YACJ,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,UAAU,GAAG,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACzF,OAAO,CAAC,KAAK,CACX,mEAAmE,WAAW,CAAC,SAAS,+BAA+B,UAAU,EAAE,CACpI,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,cAAc,CAAC;IACvB,CAAC;IAED,OAAO,EAAE,qBAAqB,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAwB,EACxB,cAAmC;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,SAAgB,CAAC;IAElD,qDAAqD;IACrD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CACT,iDAAiD,WAAW,CAAC,SAAS,2BAA2B,CAClG,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,0DAA0D,WAAW,CAAC,SAAS,2CAA2C,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/{restorer → harnesses}/engine/delivery.d.ts

@@ -1,5 +1,5 @@
 /**
- * Restorer engine — mech delivery + JinnRouter.claimDelivery.
+ * Harness engine — mech delivery + JinnRouter.claimDelivery.
  *
  * §6.1 DELIVERING phase.
  *
@@ -10,6 +10,7 @@
  *      is the keccak256 hash of the signed manifest (from manifest assembly).
  */
 import type { Hex, PublicClient, WalletClient, Address } from 'viem';
+import type { EvictionRecoveryConfig } from '../../adapters/mech/types.js';
 export interface DeliveryDeps {
     publicClient: PublicClient;
     walletClient: WalletClient;
@@ -18,6 +19,7 @@ export interface DeliveryDeps {
     routerAddress: Address;
     /** v1 or v2 claimDelivery encoding — matches chain config */
     claimDeliveryVariant: 'v1' | 'v2';
+    evictionRecovery?: EvictionRecoveryConfig;
 }
 /**
  * Callback invoked after deliverToMarketplace lands on-chain but BEFORE

package/dist/{restorer → harnesses}/engine/delivery.js

@@ -1,5 +1,5 @@
 /**
- * Restorer engine — mech delivery + JinnRouter.claimDelivery.
+ * Harness engine — mech delivery + JinnRouter.claimDelivery.
  *
  * §6.1 DELIVERING phase.
  *
@@ -34,16 +34,16 @@ export async function deliverAndClaim(requestId, manifestCid, evidenceHash, deps
     let deliveryTxHash;
     if (preExistingDeliveryTxHash) {
         // Recovery path: deliverToMarketplace already landed on a previous run.
-        console.log(`[restorer-engine] deliverToMarketplace already done (recovery), tx=${preExistingDeliveryTxHash}`);
+        console.log(`[harness-engine] deliverToMarketplace already done (recovery), tx=${preExistingDeliveryTxHash}`);
         deliveryTxHash = preExistingDeliveryTxHash;
     }
     else {
         // 1. Convert manifest CID to 32-byte digest for on-chain delivery data
         const deliveryDigest = cidToDigestHex(manifestCid);
         // 2. deliverToMarketplace via Safe
-        console.log(`[restorer-engine] deliverToMarketplace requestId=${requestId}`);
-        deliveryTxHash = await callDeliverToMarketplace(deps.publicClient, deps.walletClient, deps.safeAddress, deps.mechContractAddress, [requestId], [deliveryDigest]);
-        console.log(`[restorer-engine] deliverToMarketplace tx=${deliveryTxHash}`);
+        console.log(`[harness-engine] deliverToMarketplace requestId=${requestId}`);
+        deliveryTxHash = await callDeliverToMarketplace(deps.publicClient, deps.walletClient, deps.safeAddress, deps.mechContractAddress, [requestId], [deliveryDigest], deps.evictionRecovery);
+        console.log(`[harness-engine] deliverToMarketplace tx=${deliveryTxHash}`);
         // Persist the tx hash before proceeding to claimDelivery. If the process
         // crashes between here and the COMPLETE transition, recovery will read this
         // hash and skip the deliver step.
@@ -52,12 +52,12 @@ export async function deliverAndClaim(requestId, manifestCid, evidenceHash, deps
         }
     }
     // 3. claimDelivery on JinnRouter
-    console.log(`[restorer-engine] claimDelivery requestId=${requestId}`);
+    console.log(`[harness-engine] claimDelivery requestId=${requestId}`);
     const claimTxHash = await claimDelivery(deps.publicClient, deps.walletClient, deps.safeAddress, deps.routerAddress, requestId, {
         variant: deps.claimDeliveryVariant,
         evidenceHash: deps.claimDeliveryVariant === 'v2' ? evidenceHash : undefined,
-    });
-    console.log(`[restorer-engine] claimDelivery tx=${claimTxHash}`);
+    }, deps.evictionRecovery);
+    console.log(`[harness-engine] claimDelivery tx=${claimTxHash}`);
     return { deliveryTxHash, claimTxHash };
 }
 //# sourceMappingURL=delivery.js.map

package/dist/harnesses/engine/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../../../src/harnesses/engine/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EACL,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,aAAa,GACd,MAAM,kCAAkC,CAAC;AA8B1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAc,EACd,WAAmB,EACnB,YAAiB,EACjB,IAAkB,EAClB,yBAA+B,EAC/B,kBAAuC;IAEvC,IAAI,cAAmB,CAAC;IAExB,IAAI,yBAAyB,EAAE,CAAC;QAC9B,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,qEAAqE,yBAAyB,EAAE,CAAC,CAAC;QAC9G,cAAc,GAAG,yBAAyB,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,MAAM,cAAc,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QAEnD,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QAC5E,cAAc,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,mBAAmB,EACxB,CAAC,SAAS,CAAC,EACX,CAAC,cAAc,CAAC,EAChB,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,4CAA4C,cAAc,EAAE,CAAC,CAAC;QAE1E,yEAAyE;QACzE,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,OAAO,CAAC,GAAG,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,MAAM,aAAa,CACrC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,aAAa,EAClB,SAAS,EACT;QACE,OAAO,EAAE,IAAI,CAAC,oBAAoB;QAClC,YAAY,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KAC5E,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,qCAAqC,WAAW,EAAE,CAAC,CAAC;IAEhE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC"}