@jinn-network/client 0.1.2 → 0.1.3-canary.2d6b2676

package/dist/harnesses/impls/prediction-v0-evaluator/index.js

@@ -0,0 +1,342 @@
+/**
+ * prediction-v0-evaluator — deterministic verifier for prediction.v0.
+ *
+ * §6 of spec/2026-04-20-prediction-v0-pis-phase-1-design.md
+ *
+ * Pipeline: availability → eligibility → integrity → spec → verdict.
+ * Score: brier.v1 scaled to 1e18 fixed-point.
+ */
+import { writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { createPublicClient, http } from 'viem';
+import { baseSepolia, base } from 'viem/chains';
+import { privateKeyToAccount } from 'viem/accounts';
+import { signCanonical } from '../../engine/signing.js';
+import { buildVerificationStub } from '../../engine/verification-stub.js';
+import { REQUIRES_LIVE_DAEMON_READINESS } from '../../types.js';
+import { PredictionV0TaskSchema, } from '../../../types/prediction.js';
+import { SignedEnvelopeSchema } from '../../../types/envelope.js';
+import { PredictionV0RestorationPayloadSchema } from '../../../types/payloads/prediction-v0.js';
+import { oraclePriceAtResolveTs, scaleToDecimal, } from '../../../venues/chainlink/client.js';
+import { resolveGroundTruth } from './canonical-metrics.js';
+import { computeScore } from './score.js';
+import { checkOracleReachable, checkOracleRoundCoversResolveTs } from './checks/availability.js';
+import { checkSubmissionWithinWindow } from './checks/eligibility.js';
+import { checkWindowBounds, checkManifestFieldsPresent, checkManifestSignature, checkTaskRef, checkTaskRefMissingExpected, recomputeTopLevelSignatureHash, } from './checks/integrity.js';
+import { resolveExpectedRestorationTaskCid, RESTORATION_ENVELOPE_CID_CONTEXT_KEY } from '../evaluation-context.js';
+import { canonicalJson } from '../../engine/canonical-json.js';
+import { checkQuestionKindSupported } from './checks/spec.js';
+function nowNanos() {
+    return `${BigInt(Date.now()) * 1000000n}`;
+}
+export class PredictionV0Evaluator {
+    config;
+    name = 'prediction-v0-evaluator';
+    version = '1.0.0';
+    constructor(config) {
+        this.config = config;
+    }
+    supports(ctx) {
+        return ctx.solverType === 'prediction.v0' && ctx.role === 'evaluation';
+    }
+    async isReady() {
+        if (this.config.stub)
+            return { ...REQUIRES_LIVE_DAEMON_READINESS };
+        return { ready: true };
+    }
+    async canAttempt(task) {
+        if (task.solverType !== 'prediction.v0')
+            return { ok: false, reason: 'solverType is not prediction.v0' };
+        if (task.role !== 'evaluation')
+            return { ok: false, reason: 'role is not evaluation' };
+        if (!task.restorationRequestId)
+            return { ok: false, reason: 'restorationRequestId is required' };
+        if (typeof task.context?.['restorationResult'] !== 'string') {
+            return { ok: false, reason: 'context.restorationResult required' };
+        }
+        return { ok: true };
+    }
+    async run(ctx) {
+        if (this.config.stub) {
+            throw new Error('prediction-v0-evaluator: stub registry cannot run evaluation (requires live daemon)');
+        }
+        if (!this.config.evaluatorPk || !this.config.evaluatorSafeAddress) {
+            throw new Error('prediction-v0-evaluator: evaluatorPk and evaluatorSafeAddress are required');
+        }
+        const { task: task, workingDir, log } = ctx;
+        // Support _testDeps injection from ctx (test) or config (constructor).
+        const testDeps = ctx._testDeps ?? this.config._testDeps;
+        const expectedRef = resolveExpectedRestorationTaskCid(task, testDeps);
+        // 1. Parse task — same spec the harness ran under
+        const predictionTask = PredictionV0TaskSchema.parse(task);
+        const { feed, venue } = predictionTask.spec.oracle;
+        // 2. Parse harness's SignedEnvelope from inlined context
+        const manifestJson = task.context['restorationResult'];
+        const rawPayload = JSON.parse(manifestJson);
+        const envelope = SignedEnvelopeSchema.parse(rawPayload);
+        if (envelope.solverType !== 'prediction.v0' || envelope.role !== 'restoration') {
+            throw new Error(`Unexpected envelope kind/role: ${envelope.solverType}/${envelope.role}; expected prediction.v0/restoration`);
+        }
+        const payload = PredictionV0RestorationPayloadSchema.parse(envelope.payload);
+        // 3. Fetch Chainlink spanning round
+        let spanning;
+        const oracleFetchStart = nowNanos();
+        const oraclePeerName = venue === 'chainlink-base' ? 'base-rpc' : 'base-sepolia-rpc';
+        try {
+            if (testDeps?.oraclePriceAtResolveTs) {
+                spanning = await testDeps.oraclePriceAtResolveTs(feed, predictionTask.spec.question.resolveTs);
+            }
+            else {
+                const expectedChainId = venue === 'chainlink-base' ? 8453 : 84532;
+                const chain = venue === 'chainlink-base' ? base : baseSepolia;
+                const publicClient = createPublicClient({
+                    chain,
+                    transport: http(this.config.rpcUrl),
+                });
+                const actualChainId = await publicClient.getChainId();
+                if (actualChainId !== expectedChainId) {
+                    throw new Error(`oracle venue mismatch: spec says ${venue} (chainId ${expectedChainId}) but RPC chainId is ${actualChainId}`);
+                }
+                spanning = await oraclePriceAtResolveTs(feed, predictionTask.spec.question.resolveTs, publicClient);
+            }
+            ctx.trajectory.addSpan({
+                name: `chainlink.oraclePriceAtResolveTs ${oraclePeerName}`,
+                kind: 'CLIENT',
+                startTimeUnixNano: oracleFetchStart,
+                endTimeUnixNano: nowNanos(),
+                attributes: {
+                    'jinn.span.kind': 'jinn.venue_io',
+                    'net.peer.name': oraclePeerName,
+                    'http.request.method': 'POST',
+                    'http.response.status_code': 200,
+                    'url.full': this.config.rpcUrl ?? 'rpc',
+                    'venue.id': 'chainlink',
+                    'chainlink.feed': feed,
+                    'chainlink.resolveTs': predictionTask.spec.question.resolveTs,
+                },
+                events: [],
+                status: { code: 'OK' },
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            ctx.trajectory.addSpan({
+                name: `chainlink.oraclePriceAtResolveTs ${oraclePeerName}`,
+                kind: 'CLIENT',
+                startTimeUnixNano: oracleFetchStart,
+                endTimeUnixNano: nowNanos(),
+                attributes: {
+                    'jinn.span.kind': 'jinn.venue_io',
+                    'net.peer.name': oraclePeerName,
+                    'http.request.method': 'POST',
+                    'http.response.status_code': 0,
+                    'url.full': this.config.rpcUrl ?? 'rpc',
+                    'venue.id': 'chainlink',
+                    'chainlink.feed': feed,
+                    'chainlink.resolveTs': predictionTask.spec.question.resolveTs,
+                },
+                events: [
+                    {
+                        timeUnixNano: nowNanos(),
+                        name: 'exception',
+                        attributes: { 'exception.message': msg },
+                    },
+                ],
+                status: { code: 'ERROR', message: msg },
+            });
+            throw err;
+        }
+        // 4. Run checks (order matters: availability → eligibility → integrity → spec)
+        const checks = [];
+        // availability — oracle reachable (already fetched above; re-wrap to surface errors)
+        checks.push(await checkOracleReachable(async () => spanning));
+        checks.push(checkOracleRoundCoversResolveTs(spanning));
+        // eligibility
+        checks.push(checkSubmissionWithinWindow(payload.prediction.submittedAt, predictionTask.window));
+        // integrity
+        checks.push(checkWindowBounds(predictionTask));
+        checks.push(checkManifestFieldsPresent(payload.prediction));
+        {
+            const recomputed = recomputeTopLevelSignatureHash(rawPayload);
+            checks.push(await checkManifestSignature(recomputed, envelope.signature));
+        }
+        if (expectedRef.kind === 'missing') {
+            checks.push(checkTaskRefMissingExpected());
+        }
+        else {
+            checks.push(checkTaskRef(envelope.task.cid, expectedRef.cid));
+        }
+        // spec
+        checks.push(checkQuestionKindSupported(predictionTask.spec.question));
+        // 5. Derive verdict
+        const scoreStart = nowNanos();
+        const verdict = deriveVerdict(checks);
+        // 6. Derive ground truth + score
+        const priceAtResolve = scaleToDecimal(spanning.round.answer, spanning.round.decimals);
+        const groundTruth = resolveGroundTruth(predictionTask.spec.question, priceAtResolve);
+        const { score, scoreBasis, scoreVersion } = computeScore(verdict, payload.prediction.probability, groundTruth);
+        const scoreEnd = nowNanos();
+        ctx.trajectory.addSpan({
+            name: 'score.brier.v1',
+            kind: 'INTERNAL',
+            startTimeUnixNano: scoreStart,
+            endTimeUnixNano: scoreEnd,
+            attributes: {
+                'jinn.span.kind': 'jinn.state_transition',
+                'jinn.state.from': 'FETCHED',
+                'jinn.state.to': 'SCORED',
+                'verdict': verdict,
+                'score.basis': scoreBasis,
+            },
+            events: [],
+            status: { code: 'OK' },
+        });
+        // 7. Assemble + sign verdict manifest
+        const evaluatorAccount = privateKeyToAccount(this.config.evaluatorPk);
+        const verdictManifestBase = {
+            generatedAt: Date.now(),
+            task: envelope.task,
+            evaluator: { safeAddress: this.config.evaluatorSafeAddress, agentEoa: evaluatorAccount.address },
+            window: predictionTask.window,
+            verdict,
+            score,
+            scoreBasis,
+            scoreVersion,
+            oracleReading: {
+                feed: feed,
+                roundId: String(spanning.round.roundId),
+                answer: String(spanning.round.answer),
+                updatedAt: spanning.round.updatedAt,
+                ...(spanning.nextRound ? { nextRoundUpdatedAt: spanning.nextRound.updatedAt } : {}),
+            },
+            claimed: {
+                probability: payload.prediction.probability,
+                submittedAt: payload.prediction.submittedAt,
+                modelId: payload.prediction.modelId,
+                // Omitted when no IPFS submission CID is available (inline / dev).
+            },
+            groundTruth,
+            checks,
+        };
+        // Sign with JCS canonical form (RFC 8785) via signCanonical — matching
+        // envelope-assembly and portfolio-v0-evaluator.
+        const signed = await signCanonical(verdictManifestBase, this.config.evaluatorPk, evaluatorAccount.address);
+        const verdictManifest = {
+            ...verdictManifestBase,
+            signature: { algo: 'secp256k1', signer: evaluatorAccount.address, hash: signed.hash, sig: signed.sig },
+        };
+        const verdictJson = JSON.stringify(verdictManifest, null, 2);
+        const verdictSha256 = createHash('sha256').update(verdictJson).digest('hex');
+        writeFileSync(join(workingDir, 'verdict.json'), verdictJson);
+        const artifactEmitNs = nowNanos();
+        ctx.trajectory.addSpan({
+            name: 'artifact.emit verdict.json',
+            kind: 'INTERNAL',
+            startTimeUnixNano: artifactEmitNs,
+            endTimeUnixNano: artifactEmitNs,
+            attributes: {
+                'jinn.span.kind': 'jinn.artifact.emit',
+                'jinn.artifact.cid': 'pending',
+                'jinn.artifact.artifactType': 'evaluation_verdict',
+                'jinn.artifact.sha256': verdictSha256,
+                'artifact.path': 'verdict.json',
+            },
+            events: [],
+            status: { code: 'OK' },
+        });
+        log({ level: 'info', msg: 'prediction-v0-evaluator: verdict', data: { verdict, score, groundTruth } });
+        // ── Verdict payload for engine.pack() (role='verdict' envelope) ───────────
+        // Assembles the PredictionV0VerdictPayload from the already-computed fields.
+        //
+        // restorationEnvelope: CID threaded from the daemon via context, sha256
+        // computed as sha256(JCS(restorationEnvelope)) — matching the upload pipeline
+        // and the conformance harness (8l6 fix A).
+        //
+        // verificationOfRestoration: stub — Plan D will connect the real SDK that
+        // fetches + validates the restoration envelope against its claimed tier.
+        // For V1 the stub always reports 'valid' (self-signed tier), which means
+        // the REJECTED-if-invalid path in engine.pack() never fires in practice
+        // until Plan D replaces this stub.
+        const envelopeCid = task.context?.[RESTORATION_ENVELOPE_CID_CONTEXT_KEY]
+            ?? task.restorationRequestId
+            ?? 'bafy-unknown';
+        // Use JCS canonical bytes so the sha256 matches the upload pipeline (8l6 fix A).
+        const envelopeSha256 = createHash('sha256').update(canonicalJson(rawPayload)).digest('hex');
+        const restorationEnvelope = {
+            cid: envelopeCid,
+            sha256: envelopeSha256,
+        };
+        const verificationOfRestoration = buildVerificationStub();
+        const verdictPayload = {
+            restorationEnvelope,
+            verificationOfRestoration,
+            verdict,
+            score,
+            scoreBasis,
+            scoreVersion,
+            oracleReading: verdictManifestBase['oracleReading'],
+            claimed: {
+                probability: payload.prediction.probability,
+                submittedAt: payload.prediction.submittedAt,
+                modelId: payload.prediction.modelId,
+                // submissionManifestCid omitted — not available from inline manifest context
+                // TODO(plan-d): populate once IPFS submission CID is resolved
+            },
+            groundTruth,
+            checks,
+        };
+        return {
+            venueRef: { name: 'chainlink' },
+            gating: {
+                verdict,
+                score,
+                scoreBasis,
+                groundTruth,
+                checkCount: checks.length,
+                passCount: checks.filter(c => c.status === 'PASS').length,
+                failCount: checks.filter(c => c.status === 'FAIL').length,
+                skipCount: checks.filter(c => c.status === 'SKIP').length,
+            },
+            informational: {
+                claimedProbability: payload.prediction.probability,
+                oracleReading: verdictManifestBase['oracleReading'],
+            },
+            verdictPayload,
+            artifacts: [
+                {
+                    path: 'verdict.json',
+                    artifactType: 'evaluation_verdict',
+                    metadata: { verdict, score },
+                    access: { priceUsdc: '0' },
+                },
+            ],
+        };
+    }
+}
+/**
+ * Derive verdict from check statuses.
+ * Order matters: data-availability failures precede attempt-quality failures.
+ */
+function deriveVerdict(checks) {
+    // Any availability FAIL → INDETERMINATE (oracle unreachable, data gaps)
+    if (checks.some(c => c.name.startsWith('availability.') && c.status === 'FAIL'))
+        return 'INDETERMINATE';
+    // Any availability SKIP → INDETERMINATE (oracle not yet spanning)
+    if (checks.some(c => c.name.startsWith('availability.') && c.status === 'SKIP'))
+        return 'INDETERMINATE';
+    // Missing trust anchor for task CID (e.g. legacy eval payload) → INDETERMINATE
+    if (checks.some(c => c.name.startsWith('integrity.') && c.status === 'INDETERMINATE'))
+        return 'INDETERMINATE';
+    // Any eligibility FAIL → REJECTED
+    if (checks.some(c => c.name.startsWith('eligibility.') && c.status === 'FAIL'))
+        return 'REJECTED';
+    // Any integrity or spec FAIL → FAIL
+    if (checks.some(c => c.name.startsWith('integrity.') && c.status === 'FAIL') ||
+        checks.some(c => c.name.startsWith('spec.') && c.status === 'FAIL')) {
+        return 'FAIL';
+    }
+    return 'PASS';
+}
+export default PredictionV0Evaluator;
+//# sourceMappingURL=index.js.map

package/dist/harnesses/impls/prediction-v0-evaluator/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/harnesses/impls/prediction-v0-evaluator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EACL,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oCAAoC,EAAuC,MAAM,0CAA0C,CAAC;AACrI,OAAO,EACL,sBAAsB,EACtB,cAAc,GAEf,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAA8B,MAAM,YAAY,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,YAAY,EACZ,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iCAAiC,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AACnH,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9D,SAAS,QAAQ;IACf,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,QAAU,EAAE,CAAC;AAC9C,CAAC;AAkBD,MAAM,OAAO,qBAAqB;IAIH;IAHpB,IAAI,GAAG,yBAAyB,CAAC;IACjC,OAAO,GAAG,OAAO,CAAC;IAE3B,YAA6B,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;IAAG,CAAC;IAEpE,QAAQ,CAAC,GAAgE;QACvE,OAAO,GAAG,CAAC,UAAU,KAAK,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,8BAA8B,EAAE,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAU;QACzB,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACzG,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,oBAAoB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACjG,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAmB;QAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;QAC5C,uEAAuE;QACvE,MAAM,QAAQ,GAAI,GAAW,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACjE,MAAM,WAAW,GAAG,iCAAiC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEtE,kDAAkD;QAClD,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAEnD,yDAAyD;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAQ,CAAC,mBAAmB,CAAW,CAAC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAA4B,CAAC;QACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,QAAQ,CAAC,UAAU,KAAK,eAAe,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI,sCAAsC,CAC7G,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAmC,oCAAoC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE7G,oCAAoC;QACpC,IAAI,QAAwB,CAAC;QAC7B,MAAM,gBAAgB,GAAG,QAAQ,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACpF,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,sBAAsB,EAAE,CAAC;gBACrC,QAAQ,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,IAAqB,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClH,CAAC;iBAAM,CAAC;gBACN,MAAM,eAAe,GAAG,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;gBAClE,MAAM,KAAK,GAAG,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC9D,MAAM,YAAY,GAAG,kBAAkB,CAAC;oBACtC,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;iBACpC,CAA4B,CAAC;gBAC9B,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC;gBACtD,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;oBACtC,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,aAAa,eAAe,wBAAwB,aAAa,EAAE,CAC7G,CAAC;gBACJ,CAAC;gBACD,QAAQ,GAAG,MAAM,sBAAsB,CACrC,IAAqB,EACrB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EACtC,YAAY,CACb,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;gBACrB,IAAI,EAAE,oCAAoC,cAAc,EAAE;gBAC1D,IAAI,EAAE,QAAQ;gBACd,iBAAiB,EAAE,gBAAgB;gBACnC,eAAe,EAAE,QAAQ,EAAE;gBAC3B,UAAU,EAAE;oBACV,gBAAgB,EAAE,eAAe;oBACjC,eAAe,EAAE,cAAc;oBAC/B,qBAAqB,EAAE,MAAM;oBAC7B,2BAA2B,EAAE,GAAG;oBAChC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK;oBACvC,UAAU,EAAE,WAAW;oBACvB,gBAAgB,EAAE,IAAI;oBACtB,qBAAqB,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;iBAC9D;gBACD,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;gBACrB,IAAI,EAAE,oCAAoC,cAAc,EAAE;gBAC1D,IAAI,EAAE,QAAQ;gBACd,iBAAiB,EAAE,gBAAgB;gBACnC,eAAe,EAAE,QAAQ,EAAE;gBAC3B,UAAU,EAAE;oBACV,gBAAgB,EAAE,eAAe;oBACjC,eAAe,EAAE,cAAc;oBAC/B,qBAAqB,EAAE,MAAM;oBAC7B,2BAA2B,EAAE,CAAC;oBAC9B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK;oBACvC,UAAU,EAAE,WAAW;oBACvB,gBAAgB,EAAE,IAAI;oBACtB,qBAAqB,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;iBAC9D;gBACD,MAAM,EAAE;oBACN;wBACE,YAAY,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,WAAW;wBACjB,UAAU,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE;qBACzC;iBACF;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE;aACxC,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,+EAA+E;QAC/E,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,qFAAqF;QACrF,MAAM,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvD,cAAc;QACd,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QAEhG,YAAY;QACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,CAAC;YACC,MAAM,UAAU,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,OAAO;QACP,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEtE,oBAAoB;QACpB,MAAM,UAAU,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAEtC,iCAAiC;QACjC,MAAM,cAAc,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACrF,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC/G,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU;YAChB,iBAAiB,EAAE,UAAU;YAC7B,eAAe,EAAE,QAAQ;YACzB,UAAU,EAAE;gBACV,gBAAgB,EAAE,uBAAuB;gBACzC,iBAAiB,EAAE,SAAS;gBAC5B,eAAe,EAAE,QAAQ;gBACzB,SAAS,EAAE,OAAO;gBAClB,aAAa,EAAE,UAAU;aAC1B;YACD,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QAEH,sCAAsC;QACtC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;QACvE,MAAM,mBAAmB,GAA4B;YACnD,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,CAAC,OAAO,EAAE;YAChG,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,OAAO;YACP,KAAK;YACL,UAAU;YACV,YAAY;YACZ,aAAa,EAAE;gBACb,IAAI,EAAE,IAAqB;gBAC3B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;gBACvC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBACrC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;gBACnC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF;YACD,OAAO,EAAE;gBACP,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW;gBAC3C,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW;gBAC3C,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;gBACnC,mEAAmE;aACpE;YACD,WAAW;YACX,MAAM;SACP,CAAC;QACF,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,WAA6B,EAAE,gBAAgB,CAAC,OAAwB,CAAC,CAAC;QAC9I,MAAM,eAAe,GAA4B;YAC/C,GAAG,mBAAmB;YACtB,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;SACvG,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,CAAC;QAE7D,MAAM,cAAc,GAAG,QAAQ,EAAE,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,UAAU;YAChB,iBAAiB,EAAE,cAAc;YACjC,eAAe,EAAE,cAAc;YAC/B,UAAU,EAAE;gBACV,gBAAgB,EAAE,oBAAoB;gBACtC,mBAAmB,EAAE,SAAS;gBAC9B,4BAA4B,EAAE,oBAAoB;gBAClD,sBAAsB,EAAE,aAAa;gBACrC,eAAe,EAAE,cAAc;aAChC;YACD,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,kCAAkC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAEvG,6EAA6E;QAC7E,6EAA6E;QAC7E,EAAE;QACF,wEAAwE;QACxE,8EAA8E;QAC9E,2CAA2C;QAC3C,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,WAAW,GAAI,IAAI,CAAC,OAAO,EAAE,CAAC,oCAAoC,CAAwB;eAC3F,IAAI,CAAC,oBAAoB;eACzB,cAAc,CAAC;QACpB,iFAAiF;QACjF,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5F,MAAM,mBAAmB,GAAG;YAC1B,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,cAAc;SACvB,CAAC;QAEF,MAAM,yBAAyB,GAAG,qBAAqB,EAAE,CAAC;QAE1D,MAAM,cAAc,GAA4B;YAC9C,mBAAmB;YACnB,yBAAyB;YACzB,OAAO;YACP,KAAK;YACL,UAAU;YACV,YAAY;YACZ,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC;YACnD,OAAO,EAAE;gBACP,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW;gBAC3C,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW;gBAC3C,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;gBACnC,6EAA6E;gBAC7E,8DAA8D;aAC/D;YACD,WAAW;YACX,MAAM;SACP,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAC/B,MAAM,EAAE;gBACN,OAAO;gBACP,KAAK;gBACL,UAAU;gBACV,WAAW;gBACX,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;gBACzD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;gBACzD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;aAC1D;YACD,aAAa,EAAE;gBACb,kBAAkB,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW;gBAClD,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC;aACpD;YACD,cAAc;YACd,SAAS,EAAE;gBACT;oBACE,IAAI,EAAE,cAAc;oBACpB,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;oBAC5B,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;iBAC3B;aACF;SACF,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAe;IACpC,wEAAwE;IACxE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IACxG,kEAAkE;IAClE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IACxG,+EAA+E;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC;QAAE,OAAO,eAAe,CAAC;IAC9G,kCAAkC;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAClG,oCAAoC;IACpC,IACE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EACnE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,eAAe,qBAAqB,CAAC"}

package/dist/harnesses/impls/prediction-v0-evaluator/score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../../src/harnesses/impls/prediction-v0-evaluator/score.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,MAAM,CAAC,MAAM,WAAW,GAAG,UAAmB,CAAC;AAC/C,MAAM,CAAC,MAAM,aAAa,GAAG,GAAY,CAAC;AAI1C,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,WAAmB,EACnB,WAAyB;IAEzB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO;QACL,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC;QACvC,UAAU,EAAE,WAAW;QACvB,YAAY,EAAE,aAAa;KAC5B,CAAC;AACJ,CAAC"}

package/dist/harnesses/impls/prediction-v0-evaluator/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/harnesses/impls/prediction-v0-evaluator/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/harnesses/impls/prediction-v0-evaluator/types.ts"],"names":[],"mappings":""}

package/dist/harnesses/manifest/index.d.ts

@@ -0,0 +1,3 @@
+export { loadManifest } from './load.js';
+export { canonicaliseManifest, verifyManifestSignature } from './verify.js';
+export type { JinnManifest, SignerTrustEntry, CapabilityAllowEntry, ManifestRpcAllow, TypedDataAllowEntry, } from './types.js';

package/dist/harnesses/manifest/index.js

@@ -0,0 +1,3 @@
+export { loadManifest } from './load.js';
+export { canonicaliseManifest, verifyManifestSignature } from './verify.js';
+//# sourceMappingURL=index.js.map

package/dist/harnesses/manifest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/harnesses/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/harnesses/manifest/load.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Load a `jinn.manifest.json` from disk and validate it against the
+ * Jinn manifest JSON Schema. Pure (no signature verification — that is
+ * `verifyManifestSignature` in `verify.ts`).
+ */
+import type { JinnManifest } from './types.js';
+export declare function loadManifest(absPath: string): Promise<JinnManifest>;

package/dist/harnesses/manifest/load.js

@@ -0,0 +1,49 @@
+/**
+ * Load a `jinn.manifest.json` from disk and validate it against the
+ * Jinn manifest JSON Schema. Pure (no signature verification — that is
+ * `verifyManifestSignature` in `verify.ts`).
+ */
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import * as addFormatsModule from 'ajv-formats';
+// `ajv-formats` is published as CJS; under Node16 module resolution
+// the callable plugin lives on `.default`.
+const addFormats = addFormatsModule
+    .default;
+const SCHEMA_PATH = fileURLToPath(new URL('../../../schemas/jinn-manifest-v1.json', import.meta.url));
+let validatorPromise = null;
+let lastValidator;
+async function getValidator() {
+    if (validatorPromise)
+        return validatorPromise;
+    validatorPromise = (async () => {
+        const ajv = new Ajv2020({ allErrors: true, strict: false });
+        addFormats(ajv);
+        const schema = JSON.parse(await readFile(SCHEMA_PATH, 'utf8'));
+        const compiled = ajv.compile(schema);
+        lastValidator = compiled;
+        return compiled;
+    })();
+    return validatorPromise;
+}
+export async function loadManifest(absPath) {
+    const text = await readFile(resolve(absPath), 'utf8');
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        throw new Error(`manifest at ${absPath} is not valid JSON: ${err.message}`);
+    }
+    const validate = await getValidator();
+    if (!validate(parsed)) {
+        const errs = (lastValidator?.errors ?? [])
+            .map((e) => `${e.instancePath} ${e.message}`)
+            .join('; ');
+        throw new Error(`manifest at ${absPath} failed schema validation: ${errs}`);
+    }
+    return parsed;
+}
+//# sourceMappingURL=load.js.map

package/dist/harnesses/manifest/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/harnesses/manifest/load.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,KAAK,gBAAgB,MAAM,aAAa,CAAC;AAEhD,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,UAAU,GAAI,gBAA4D;KAC7E,OAAO,CAAC;AAGX,MAAM,WAAW,GAAG,aAAa,CAC/B,IAAI,GAAG,CAAC,wCAAwC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACnE,CAAC;AAEF,IAAI,gBAAgB,GAA4C,IAAI,CAAC;AACrE,IAAI,aAEH,CAAC;AAEF,KAAK,UAAU,YAAY;IACzB,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,gBAAgB,GAAG,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAElC,CAAC;QACF,aAAa,GAAG,QAAQ,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,uBAAwB,GAAa,CAAC,OAAO,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,IAAI,EAAE,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;aAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,8BAA8B,IAAI,EAAE,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,MAAsB,CAAC;AAChC,CAAC"}

package/dist/harnesses/manifest/types.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Daemon-side manifest types. Same shape as the SDK manifest type;
+ * mirrored locally so the client doesn't have to depend on
+ * @jinn-network/harness-sdk at runtime (the SDK is a publish-time
+ * boundary).
+ */
+export interface CapabilityAllowEntry {
+    chainId: number;
+    to: `0x${string}`;
+    selector: `0x${string}`;
+    description?: string;
+}
+/**
+ * EIP-712 typed-data domain allow-list entry. The daemon's scoped
+ * signer refuses any `signTypedData` call whose domain does not
+ * match one of these entries.
+ *
+ * - `chainId` MUST match exactly.
+ * - `verifyingContract` / `name` / `version` match only when set on
+ *   the entry; an unset field on the entry means "any value".
+ * - An empty / omitted `typedDataDomains` array means default-deny:
+ *   every `signTypedData` call throws.
+ */
+export interface TypedDataAllowEntry {
+    chainId: number;
+    name?: string;
+    version?: string;
+    verifyingContract?: `0x${string}`;
+}
+export interface ManifestRpcAllow {
+    chainId: number;
+    methods: ReadonlyArray<'eth_call' | 'eth_getBlockByNumber' | 'eth_getLogs' | 'eth_getTransactionReceipt' | 'eth_chainId' | 'eth_blockNumber' | 'eth_getBalance' | 'eth_getCode'>;
+    rateLimit?: {
+        perSec: number;
+    };
+}
+export interface JinnManifest {
+    schemaVersion: '1.0.0';
+    name: string;
+    version: string;
+    description?: string;
+    supportedSolverTypes: readonly string[];
+    entry: string;
+    package: {
+        cid: string;
+        hash: `sha256:${string}`;
+    };
+    capabilities: {
+        signer?: {
+            selectors: ReadonlyArray<CapabilityAllowEntry>;
+            typedDataDomains?: ReadonlyArray<TypedDataAllowEntry>;
+        };
+        rpc?: ReadonlyArray<ManifestRpcAllow>;
+        secrets?: ReadonlyArray<{
+            name: string;
+            description: string;
+            required: boolean;
+        }>;
+    };
+    signature: {
+        alg: 'ed25519';
+        publicKey: string;
+        sig: string;
+    };
+    author?: {
+        name: string;
+        url?: string;
+    };
+    license?: string;
+}
+export interface SignerTrustEntry {
+    alg: 'ed25519';
+    publicKey: string;
+    label?: string;
+}

package/dist/harnesses/manifest/types.js

@@ -0,0 +1,8 @@
+/**
+ * Daemon-side manifest types. Same shape as the SDK manifest type;
+ * mirrored locally so the client doesn't have to depend on
+ * @jinn-network/harness-sdk at runtime (the SDK is a publish-time
+ * boundary).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/harnesses/manifest/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/harnesses/manifest/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/harnesses/manifest/verify.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Manifest signature verifier (ed25519).
+ *
+ * Canonicalisation: RFC 8785 JCS over the manifest with the `signature`
+ * field stripped. Authors sign the resulting bytes.
+ */
+import type { JinnManifest, SignerTrustEntry } from './types.js';
+/**
+ * Canonicalise a manifest for signing/verification: RFC 8785 JCS with
+ * the signature field stripped. Recursive (nested objects sort their
+ * own keys), so a third-party verifier with any standard JCS library
+ * can reproduce the signing pre-image byte-for-byte.
+ */
+export declare function canonicaliseManifest(manifest: JinnManifest): string;
+export declare function verifyManifestSignature(manifest: JinnManifest, trustedSigners: readonly SignerTrustEntry[]): Promise<boolean>;

package/dist/harnesses/manifest/verify.js

@@ -0,0 +1,53 @@
+/**
+ * Manifest signature verifier (ed25519).
+ *
+ * Canonicalisation: RFC 8785 JCS over the manifest with the `signature`
+ * field stripped. Authors sign the resulting bytes.
+ */
+import * as ed from '@noble/ed25519';
+import { sha512 } from '@noble/hashes/sha2.js';
+import { canonicalJson } from '../engine/canonical-json.js';
+// @noble/ed25519 v3 needs sha512 wired for synchronous use; the
+// async path (verifyAsync/signAsync) prefers WebCrypto where available
+// but falls back to ed.hashes.sha512 when WebCrypto is missing.
+ed.hashes.sha512 = (m) => sha512(m);
+/**
+ * Canonicalise a manifest for signing/verification: RFC 8785 JCS with
+ * the signature field stripped. Recursive (nested objects sort their
+ * own keys), so a third-party verifier with any standard JCS library
+ * can reproduce the signing pre-image byte-for-byte.
+ */
+export function canonicaliseManifest(manifest) {
+    const { signature: _omit, ...body } = manifest;
+    return canonicalJson(body);
+}
+function b64ToBytes(s) {
+    return new Uint8Array(Buffer.from(s, 'base64'));
+}
+export async function verifyManifestSignature(manifest, trustedSigners) {
+    if (manifest.signature.alg !== 'ed25519')
+        return false;
+    const trustHit = trustedSigners.find((t) => t.alg === 'ed25519' && t.publicKey === manifest.signature.publicKey);
+    if (!trustHit)
+        return false;
+    const body = canonicaliseManifest(manifest);
+    const msg = new TextEncoder().encode(body);
+    let pk;
+    let sig;
+    try {
+        pk = b64ToBytes(manifest.signature.publicKey);
+        sig = b64ToBytes(manifest.signature.sig);
+    }
+    catch {
+        return false;
+    }
+    if (pk.length !== 32 || sig.length !== 64)
+        return false;
+    try {
+        return await ed.verifyAsync(sig, msg, pk);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/harnesses/manifest/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/harnesses/manifest/verify.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,gEAAgE;AAChE,uEAAuE;AACvE,gEAAgE;AAChE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAsB;IACzD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAsB,EACtB,cAA2C;IAE3C,IAAI,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,SAAS,CAC3E,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE3C,IAAI,EAAc,CAAC;IACnB,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAExD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}