@mcsherrylabs/evolver-mcp 0.0.0-stage → 0.8.0

package/dist/identity.d.ts

@@ -0,0 +1,87 @@
+import type { Signer } from "@mcsherrylabs/evolver-client";
+import type { ChainReads } from "./read.js";
+import type { SignedIdentity, SignedGroup, SignedChannel, SignedRecord } from "./write.js";
+import type { ToolResult } from "./result.js";
+/** What the identity verbs need from the world. NO `submitTx` — deliberately: the five signing
+ *  verbs submit nothing, so the capability is not present to reach for (SIGN-20 is structural). */
+export interface IdentityOpsDeps {
+    readonly identity: string;
+    readonly signer: Signer;
+    readonly ttlOffset?: number;
+    readonly reads: ChainReads;
+}
+/** A signed identity operation, as returned by a signing verb. Always `ok` once composed. */
+export type IdentitySignResult = ToolResult<SignedIdentity>;
+/** Decode a starting credit from a decimal string, refusing `< 1`, non-integers, and negative/hex
+ *  forms. The chain FINES a zero- or negative-credit creation rather than refusing it, so the whole
+ *  point is this refusal happening BEFORE anything is signed (Pitfall 4). */
+export declare function parseInitialCredit(input: string): {
+    ok: true;
+    value: bigint;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Compose a body into a signed identity transaction and record it — in ONE call. Mirrors
+ * `signTransfer`'s inline compose→sign→record: `buildSignedTx` → `txIdHex` → record into the two
+ * session stores via `recordSigned`. It SUBMITS NOTHING.
+ *
+ * This is the single compose implementation, re-exported from `src/write.ts` as `composeAndSign`
+ * (one compose path, never two). The `ledgerId` is always `LEDGER.identity` at the call sites.
+ */
+export declare function composeIdentityTx(deps: IdentityOpsDeps, args: {
+    ledgerId: string;
+    body: Uint8Array;
+    ttlRound: number;
+    signedAtRound: number;
+    verb: SignedIdentity["verb"] | SignedGroup["verb"] | SignedChannel["verb"];
+    fields: Record<string, string>;
+    maxToll?: bigint;
+}): ToolResult<SignedRecord>;
+/**
+ * Sponsor a new identity, paid for by this agent — signed for `deps.identity`, the configured host
+ * identity as `senderNodeId` (never a caller-chosen node id).
+ *
+ * ⚠️ THE CHAIN'S KEY RULES ARE ENFORCED HERE, not left to it, because its answer arrives too late
+ * to help: a body with the wrong keys is ORDERED and FINED 100, not refused. Exactly one
+ * BLS12-381-G1 and one Ed25519, each at label "", a starting credit >= 1, and both keys carrying a
+ * proof of possession from their holder.
+ */
+export declare function signCreateIdentity(deps: IdentityOpsDeps, params: {
+    keys: Array<{
+        keyType: string;
+        keyLabel: string;
+        publicKey: string;
+        popSignature: string;
+    }>;
+    initialCredit: string;
+}): Promise<ToolResult<SignedRecord>>;
+/**
+ * Delete the identity this agent signs as. SELF-DELETION ONLY (Pitfall 5): `confirmName` must match
+ * `deps.identity`, else the chain would fine a deletion naming another identity.
+ */
+export declare function signDeleteIdentity(deps: IdentityOpsDeps, params: {
+    confirmName: string;
+}): Promise<ToolResult<SignedRecord>>;
+export declare const signAddKey: (deps: IdentityOpsDeps, p: {
+    keyType: string;
+    keyLabel: string;
+    publicKey: string;
+    popSignature: string;
+}) => Promise<ToolResult<SignedRecord>>;
+export declare const signReplaceKey: (deps: IdentityOpsDeps, p: {
+    keyType: string;
+    keyLabel: string;
+    publicKey: string;
+    popSignature: string;
+}) => Promise<ToolResult<SignedRecord>>;
+/**
+ * Remove one of this identity's own keys. ⚠️ THE CHAIN WILL NOT STOP YOU LOCKING YOURSELF OUT — its
+ * only guard refuses a committee member deleting its default consensus key.
+ */
+export declare function signDeleteKey(deps: IdentityOpsDeps, p: {
+    keyType: string;
+    keyLabel: string;
+}): Promise<ToolResult<SignedRecord>>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;mGACmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,6FAA6F;AAC7F,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;AAE5D;;6EAE6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAU5G;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,UAAU,CAAC,YAAY,CAAC,CAoB1B;AAYD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC7H,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CA6DnC;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9B,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAuBnC;AAmDD,eAAO,MAAM,UAAU,GAAI,MAAM,eAAe,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,sCACpG,CAAC;AAEhC,eAAO,MAAM,cAAc,GAAI,MAAM,eAAe,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,sCACpG,CAAC;AAEpC;;;GAGG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,eAAe,EACrB,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAiBnC"}

package/dist/identity.js

@@ -0,0 +1,230 @@
+// Identity-lifecycle signing verbs (SIGN-03..07): sign create/delete identity and add/replace/delete
+// key. Each is a compose→sign→record→return-txId operation with ZERO submit, mirroring Phase 2's
+// `signTransfer` (SIGN-20) and resolving in the SAME `submitSigned`/`inspectSigned` path (SIGN-19).
+//
+// The ledger is pinned to `LEDGER.identity` (never a caller-chosen channel or core-ledger id), so
+// nothing here can reach a node before `evolver_submit`. The costly local refusals — create-identity
+// key rules, delete-identity self-check, empty-PoP refusal — fire BEFORE anything is signed, because
+// the chain's answer for a malformed body arrives as a FINE, too late to refuse (Pitfalls 4/5).
+//
+// ⚠️ KEY MATERIAL NEVER REACHES A RECORD OR A REFUSAL. Records carry key `type`/`label` and the txId
+// only; the caller supplies the holder-produced `popSignature` bytes, which are folded into the
+// composed body by the SDK encoder — this process never computes a PoP digest and never signs for a
+// key it does not hold.
+import { LEDGER, buildSignedTx, txIdHex, hexToBytes, createIdentityInner, createIdentityBody, deleteIdentityBody, addKeyBody, replaceKeyBody, deleteKeyBody, } from "@mcsherrylabs/evolver-client";
+import { DEFAULT_TTL_OFFSET, recordSigned } from "./write.js";
+/** Decode a starting credit from a decimal string, refusing `< 1`, non-integers, and negative/hex
+ *  forms. The chain FINES a zero- or negative-credit creation rather than refusing it, so the whole
+ *  point is this refusal happening BEFORE anything is signed (Pitfall 4). */
+export function parseInitialCredit(input) {
+    const s = String(input ?? "").trim();
+    if (!/^[1-9][0-9]*$/.test(s))
+        return {
+            ok: false,
+            error: `initialCredit "${s}" is not a positive decimal integer — it must be at least 1, because ` +
+                `a zero- or negative-credit creation is ordered and FINED rather than refused`,
+        };
+    return { ok: true, value: BigInt(s) };
+}
+/**
+ * Compose a body into a signed identity transaction and record it — in ONE call. Mirrors
+ * `signTransfer`'s inline compose→sign→record: `buildSignedTx` → `txIdHex` → record into the two
+ * session stores via `recordSigned`. It SUBMITS NOTHING.
+ *
+ * This is the single compose implementation, re-exported from `src/write.ts` as `composeAndSign`
+ * (one compose path, never two). The `ledgerId` is always `LEDGER.identity` at the call sites.
+ */
+export function composeIdentityTx(deps, args) {
+    const bytes = buildSignedTx({
+        ledgerId: args.ledgerId,
+        senderNodeId: deps.identity,
+        body: args.body,
+        ttlRound: args.ttlRound,
+        signers: [deps.signer],
+        maxToll: args.maxToll,
+    });
+    const id = txIdHex(args.ledgerId, deps.identity, args.ttlRound, args.body, args.maxToll);
+    const signed = {
+        txId: id,
+        expiresAtRound: args.ttlRound,
+        signedAtRound: args.signedAtRound,
+        verb: args.verb,
+        fields: { ...args.fields },
+        summary: { sender: deps.identity, ...args.fields },
+    };
+    recordSigned(signed, bytes);
+    return { kind: "ok", value: signed };
+}
+/** Read the chain tip to bound a transaction's life; an unreachable chain is `unreachable`, never a
+ *  submit. */
+async function tipOrUnreachable(deps) {
+    try {
+        return await deps.reads.currentRound();
+    }
+    catch (e) {
+        return { kind: "unreachable", chain: "", cause: e instanceof Error ? e.message : String(e) };
+    }
+}
+/**
+ * Sponsor a new identity, paid for by this agent — signed for `deps.identity`, the configured host
+ * identity as `senderNodeId` (never a caller-chosen node id).
+ *
+ * ⚠️ THE CHAIN'S KEY RULES ARE ENFORCED HERE, not left to it, because its answer arrives too late
+ * to help: a body with the wrong keys is ORDERED and FINED 100, not refused. Exactly one
+ * BLS12-381-G1 and one Ed25519, each at label "", a starting credit >= 1, and both keys carrying a
+ * proof of possession from their holder.
+ */
+export async function signCreateIdentity(deps, params) {
+    const credit = parseInitialCredit(params.initialCredit);
+    if (!credit.ok)
+        return { kind: "partial", what: "initialCredit", cause: credit.error };
+    const keys = Array.isArray(params.keys) ? params.keys : [];
+    const bls = keys.filter((k) => k.keyType === "BLS12-381-G1");
+    const ed = keys.filter((k) => k.keyType === "Ed25519");
+    if (bls.length !== 1 || ed.length !== 1 || keys.length !== 2)
+        return {
+            kind: "partial",
+            what: "keys",
+            cause: "exactly one BLS12-381-G1 and one Ed25519 are required, each at the default label. " +
+                "A body without both is ordered and FINED 100 rather than refused, so it is refused here.",
+        };
+    if (keys.some((k) => String(k.keyLabel ?? "") !== ""))
+        return {
+            kind: "partial",
+            what: "keys",
+            cause: "both keys must be at the default (empty) label — a non-empty label is refused here rather than fined on-chain",
+        };
+    // Empty-PoP refusal: this agent signs for NO key it does not hold (T-03-01). Named by field, never bytes.
+    const empty = keys.findIndex((k) => !k.popSignature || String(k.popSignature).length === 0);
+    if (empty !== -1)
+        return {
+            kind: "partial",
+            what: `keys.${empty}.popSignature`,
+            cause: "each key needs a proof of possession from its holder — this agent signs for no key it does not hold",
+        };
+    // Hex-decode each key, refusing (naming the PATH) on non-hex/odd-length input (T-03-07). The
+    // refusal names the field, never echoes the bytes.
+    const decoded = [];
+    for (let i = 0; i < keys.length; i++) {
+        const k = keys[i];
+        try {
+            const publicKey = hexToBytes(String(k.publicKey ?? ""));
+            // Empty-publicKey refusal: zero bytes, not an error — refused for free rather than fined.
+            if (publicKey.length === 0)
+                return { kind: "partial", what: `keys.${i}.publicKey`, cause: "a key is needed" };
+            const popSig = hexToBytes(String(k.popSignature ?? ""));
+            decoded.push({ keyType: k.keyType, publicKey, keyLabel: String(k.keyLabel ?? ""), popSig });
+        }
+        catch (e) {
+            return { kind: "partial", what: `keys.${i}`, cause: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    const tip = await tipOrUnreachable(deps);
+    if (typeof tip !== "number")
+        return tip;
+    const expiresAtRound = tip + (deps.ttlOffset ?? DEFAULT_TTL_OFFSET);
+    const body = createIdentityBody(createIdentityInner(deps.identity, credit.value, decoded, true));
+    return composeIdentityTx(deps, {
+        ledgerId: LEDGER.identity,
+        body,
+        ttlRound: expiresAtRound,
+        signedAtRound: tip,
+        verb: "create_identity",
+        fields: { initialCredit: credit.value.toString() },
+    });
+}
+/**
+ * Delete the identity this agent signs as. SELF-DELETION ONLY (Pitfall 5): `confirmName` must match
+ * `deps.identity`, else the chain would fine a deletion naming another identity.
+ */
+export async function signDeleteIdentity(deps, params) {
+    const confirmName = String(params.confirmName ?? "").trim();
+    if (confirmName !== deps.identity)
+        return {
+            kind: "partial",
+            what: "confirmName",
+            cause: `this deletes THIS identity and nothing else — the chain fines a deletion naming another. ` +
+                `Pass "${deps.identity}" to mean it.`,
+        };
+    const tip = await tipOrUnreachable(deps);
+    if (typeof tip !== "number")
+        return tip;
+    const expiresAtRound = tip + (deps.ttlOffset ?? DEFAULT_TTL_OFFSET);
+    return composeIdentityTx(deps, {
+        ledgerId: LEDGER.identity,
+        body: deleteIdentityBody(deps.identity),
+        ttlRound: expiresAtRound,
+        signedAtRound: tip,
+        verb: "delete_identity",
+        fields: { target: deps.identity },
+    });
+}
+/** Add/replace share one shape, differing only by verb tag and encoder. The SDK encoders keep them
+ *  distinct (a shared hand-rolled digest would make an AddKey proof valid for a ReplaceKey). */
+async function signKeyOp(deps, verb, p) {
+    const keyType = String(p.keyType ?? "").trim();
+    const keyLabel = String(p.keyLabel ?? "");
+    let publicKey, popSignature;
+    try {
+        publicKey = hexToBytes(String(p.publicKey ?? ""));
+    }
+    catch (e) {
+        return { kind: "partial", what: "publicKey", cause: e instanceof Error ? e.message : String(e) };
+    }
+    // Empty-publicKey refusal: `hexToBytes("")` is zero bytes, not an error — a body carrying an
+    // empty key would be ordered and fined on-chain, so it is refused for free before anything is
+    // signed (reference: admin.ts signKeyOp refuses `publicKey.length === 0`).
+    if (publicKey.length === 0)
+        return { kind: "partial", what: "publicKey", cause: "a key is needed" };
+    try {
+        popSignature = hexToBytes(String(p.popSignature ?? ""));
+    }
+    catch (e) {
+        return { kind: "partial", what: "popSignature", cause: e instanceof Error ? e.message : String(e) };
+    }
+    // Empty-PoP refusal: this agent signs for NO key it does not hold.
+    if (popSignature.length === 0)
+        return {
+            kind: "partial",
+            what: "popSignature",
+            cause: "the key's holder must prove possession — this agent cannot sign for a key it does not hold",
+        };
+    const tip = await tipOrUnreachable(deps);
+    if (typeof tip !== "number")
+        return tip;
+    const expiresAtRound = tip + (deps.ttlOffset ?? DEFAULT_TTL_OFFSET);
+    const args = { publicKey, keyType, keyLabel, popSignature };
+    return composeIdentityTx(deps, {
+        ledgerId: LEDGER.identity,
+        body: verb === "add_key" ? addKeyBody(args) : replaceKeyBody(args),
+        ttlRound: expiresAtRound,
+        signedAtRound: tip,
+        verb,
+        fields: { keyType, keyLabel },
+    });
+}
+export const signAddKey = (deps, p) => signKeyOp(deps, "add_key", p);
+export const signReplaceKey = (deps, p) => signKeyOp(deps, "replace_key", p);
+/**
+ * Remove one of this identity's own keys. ⚠️ THE CHAIN WILL NOT STOP YOU LOCKING YOURSELF OUT — its
+ * only guard refuses a committee member deleting its default consensus key.
+ */
+export async function signDeleteKey(deps, p) {
+    const keyType = String(p.keyType ?? "").trim();
+    if (keyType.length === 0)
+        return { kind: "partial", what: "keyType", cause: "which key?" };
+    const keyLabel = String(p.keyLabel ?? "");
+    const tip = await tipOrUnreachable(deps);
+    if (typeof tip !== "number")
+        return tip;
+    const expiresAtRound = tip + (deps.ttlOffset ?? DEFAULT_TTL_OFFSET);
+    return composeIdentityTx(deps, {
+        ledgerId: LEDGER.identity,
+        body: deleteKeyBody({ keyType, keyLabel }),
+        ttlRound: expiresAtRound,
+        signedAtRound: tip,
+        verb: "delete_key",
+        fields: { keyType, keyLabel },
+    });
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,iGAAiG;AACjG,oGAAoG;AACpG,EAAE;AACF,kGAAkG;AAClG,qGAAqG;AACrG,qGAAqG;AACrG,gGAAgG;AAChG,EAAE;AACF,qGAAqG;AACrG,gGAAgG;AAChG,oGAAoG;AACpG,wBAAwB;AAExB,OAAO,EACL,MAAM,EACN,aAAa,EACb,OAAO,EACP,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,aAAa,GACd,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAgB9D;;6EAE6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,kBAAkB,CAAC,uEAAuE;gBAC1F,8EAA8E;SACjF,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB,EACrB,IAQC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC;QAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;QACtB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,EAAE;QACR,cAAc,EAAE,IAAI,CAAC,QAAQ;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;QAC1B,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;KACH,CAAC;IAClD,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;cACc;AACd,KAAK,UAAU,gBAAgB,CAAC,IAAqB;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAqB,EACrB,MAA8H;IAE9H,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAEvF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAC1D,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM;YACZ,KAAK,EACH,oFAAoF;gBACpF,0FAA0F;SAC7F,CAAC;IACJ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,+GAA+G;SACvH,CAAC;IAEJ,0GAA0G;IAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK,KAAK,CAAC,CAAC;QACd,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,QAAQ,KAAK,eAAe;YAClC,KAAK,EAAE,qGAAqG;SAC7G,CAAC;IAEJ,6FAA6F;IAC7F,mDAAmD;IACnD,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;YACxD,0FAA0F;YAC1F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;YACpF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACjG,OAAO,iBAAiB,CAAC,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI;QACJ,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE;KACnD,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAqB,EACrB,MAA+B;IAE/B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,WAAW,KAAK,IAAI,CAAC,QAAQ;QAC/B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,aAAa;YACnB,KAAK,EACH,2FAA2F;gBAC3F,SAAS,IAAI,CAAC,QAAQ,eAAe;SACxC,CAAC;IAEJ,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,iBAAiB,CAAC,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvC,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE;KAClC,CAAC,CAAC;AACL,CAAC;AAED;gGACgG;AAChG,KAAK,UAAU,SAAS,CACtB,IAAqB,EACrB,IAA+B,EAC/B,CAAiF;IAEjF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAE1C,IAAI,SAAqB,EAAE,YAAwB,CAAC;IACpD,IAAI,CAAC;QACH,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,CAAC;IACD,6FAA6F;IAC7F,8FAA8F;IAC9F,2EAA2E;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,CAAC;IACD,mEAAmE;IACnE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,4FAA4F;SACpG,CAAC;IAEJ,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5D,OAAO,iBAAiB,CAAC,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC;QAClE,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI;QACJ,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAqB,EAAE,CAAiF,EAAE,EAAE,CACrI,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAqB,EAAE,CAAiF,EAAE,EAAE,CACzI,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAqB,EACrB,CAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,iBAAiB,CAAC,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC1C,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC"}

package/dist/inbox.d.ts

@@ -0,0 +1,30 @@
+import type { ToolResult } from "./result.js";
+export declare const INBOX_DEFAULT_LIMIT = 10;
+/** Lower than the route's own 100 (MAX_PAGE), mirroring the other read tools' `MAX_LIMIT < node
+ *  clamp` convention: a page is context the model keeps, not a dump it loses. */
+export declare const INBOX_MAX_LIMIT = 50;
+/** What the inbox verbs need from the world: the processor endpoint, plus the fetch seam so the
+ *  whole flow is exercisable against a structural fake (the same pattern as `ChainReads` /
+ *  `ContentDeps`). `fetchImpl` defaults to the global `fetch`. */
+export interface InboxDeps {
+    readonly processorUrl: string;
+    readonly fetchImpl?: typeof fetch;
+}
+/** Which channels have entries (or an inbox refusal), with counts and bounds. */
+export declare function inboxSummary(deps: InboxDeps): Promise<ToolResult<unknown>>;
+/**
+ * One page of a channel's entries after `after`, with each body ALSO as hex.
+ *
+ * Hex because service protocols document their bodies in hex bytes (the LLM proxy's worked
+ * example is hex), and a model decoding base64 by eye gets bytes wrong. A malformed `after` is a
+ * refusal of the argument (`partial`), carrying the route's own statement of the expected form —
+ * never `unreachable`, which would say "retry" (the processor DID answer; it refused the
+ * argument).
+ *
+ * Intent and bytes stay SEPARATE: `txId`/`round`/`index`/`ledgerId`/`sender`/`receivedAt` are the
+ * intent (who wrote, where, when), `body` is the raw bytes as the processor returned them, and
+ * `bodyHex` is the additive hex re-encode of `body` — never a fusion of the two. `body` is dropped
+ * only if the processor omitted it; it is never merged into intent.
+ */
+export declare function inboxPage(deps: InboxDeps, ledgerId: string, after: string | undefined, limit: number | undefined): Promise<ToolResult<unknown>>;
+//# sourceMappingURL=inbox.d.ts.map

package/dist/inbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox.d.ts","sourceRoot":"","sources":["../src/inbox.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC;iFACiF;AACjF,eAAO,MAAM,eAAe,KAAK,CAAC;AAMlC;;kEAEkE;AAClE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAQD,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAahF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAkC9B"}

package/dist/inbox.js

@@ -0,0 +1,95 @@
+// The read-only channel-consumer surface: the event processor's inbox.
+//
+// ⚠️ THE INBOX IS NOT ON THE NODE. It is a local queue owned by the Meerkat event processor — a
+// SEPARATE process from the node the MCP's `config.url` points at, with its OWN HTTP read server.
+// The processor is the one-and-only drainer of the node's ordered channel stream (Constitution V),
+// and every delivery whose channel has no registered handler is written to a local `inbox` table
+// the MCP reads over `GET /inbox` and `GET /inbox/<ledgerId>`. Because the endpoint is a different
+// process, this is a thin `fetch` wrapper driven by `config.processorUrl` — NOT a `NodeClient`
+// method, and NOT a drainer: the MCP only ever GETs, so it cannot split the stream the processor
+// is walking.
+//
+// ⚠️ AN ENTRY WAS WRITTEN BY WHOEVER COULD WRITE TO THE CHANNEL. The processor proved nothing
+// about it except that it was ordered on that channel; `sender` is the only provenance. Every
+// tool description and non-ok prose string repeats that; the body bytes are surfaced verbatim
+// (base64 AND hex) so a model can decode them by whatever convention it keeps, never interpreted.
+import { ok, misconfigured, partial, unreachableFrom } from "./result.js";
+export const INBOX_DEFAULT_LIMIT = 10;
+/** Lower than the route's own 100 (MAX_PAGE), mirroring the other read tools' `MAX_LIMIT < node
+ *  clamp` convention: a page is context the model keeps, not a dump it loses. */
+export const INBOX_MAX_LIMIT = 50;
+/** The read deadline on every inbox fetch. A hung processor surfaces as `unreachable`, never an
+ *  indefinite hang (T-6-04). */
+const DEADLINE_MS = 15_000;
+const fix = () => "set `processorUrl` to the event processor's read server (e.g. http://127.0.0.1:8090); it is " +
+    "a separate process from the node, so it cannot be derived from the node `url`";
+const jsonHeaders = { Accept: "application/json" };
+/** Which channels have entries (or an inbox refusal), with counts and bounds. */
+export async function inboxSummary(deps) {
+    if (!deps.processorUrl)
+        return misconfigured("the event inbox", fix());
+    const f = deps.fetchImpl ?? fetch;
+    try {
+        const res = await f(`${deps.processorUrl}/inbox`, {
+            headers: jsonHeaders,
+            signal: AbortSignal.timeout(DEADLINE_MS),
+        });
+        if (!res.ok)
+            throw new Error(`GET /inbox: HTTP ${res.status}`);
+        return ok(await res.json());
+    }
+    catch (e) {
+        return unreachableFrom(e, deps.processorUrl);
+    }
+}
+/**
+ * One page of a channel's entries after `after`, with each body ALSO as hex.
+ *
+ * Hex because service protocols document their bodies in hex bytes (the LLM proxy's worked
+ * example is hex), and a model decoding base64 by eye gets bytes wrong. A malformed `after` is a
+ * refusal of the argument (`partial`), carrying the route's own statement of the expected form —
+ * never `unreachable`, which would say "retry" (the processor DID answer; it refused the
+ * argument).
+ *
+ * Intent and bytes stay SEPARATE: `txId`/`round`/`index`/`ledgerId`/`sender`/`receivedAt` are the
+ * intent (who wrote, where, when), `body` is the raw bytes as the processor returned them, and
+ * `bodyHex` is the additive hex re-encode of `body` — never a fusion of the two. `body` is dropped
+ * only if the processor omitted it; it is never merged into intent.
+ */
+export async function inboxPage(deps, ledgerId, after, limit) {
+    if (!deps.processorUrl)
+        return misconfigured("the event inbox", fix());
+    const f = deps.fetchImpl ?? fetch;
+    const n = Math.trunc(Number(limit));
+    const bounded = Number.isNaN(n) || n < 1 ? INBOX_DEFAULT_LIMIT : Math.min(n, INBOX_MAX_LIMIT);
+    const q = new URLSearchParams({ ...(after ? { after } : {}), limit: String(bounded) });
+    try {
+        const res = await f(`${deps.processorUrl}/inbox/${encodeURIComponent(ledgerId)}?${q.toString()}`, {
+            headers: jsonHeaders,
+            signal: AbortSignal.timeout(DEADLINE_MS),
+        });
+        if (res.status === 400) {
+            const b = (await res.json().catch(() => ({})));
+            return b.error === "bad_position"
+                ? partial("after", `expected ${b.expected ?? "<round>:<index>"} — pass the \`next\` of the previous page`)
+                : partial("arguments", b.message ?? "the processor refused the request");
+        }
+        if (!res.ok)
+            throw new Error(`GET /inbox/${ledgerId}: HTTP ${res.status}`);
+        const page = (await res.json());
+        return ok({
+            ...page,
+            // Intent vs bytes (never fused): `txId`/`round`/`index`/`sender` say who wrote, where, when;
+            // `body` is the raw base64 the processor stored; `bodyHex` is the additive hex re-encode of
+            // the SAME bytes. `body` is never dropped and never merged into the intent fields.
+            entries: (page.entries ?? []).map((e) => ({
+                ...e,
+                bodyHex: Buffer.from(e.body ?? "", "base64").toString("hex"),
+            })),
+        });
+    }
+    catch (e) {
+        return unreachableFrom(e, deps.processorUrl);
+    }
+}
+//# sourceMappingURL=inbox.js.map

package/dist/inbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox.js","sourceRoot":"","sources":["../src/inbox.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,+FAA+F;AAC/F,iGAAiG;AACjG,cAAc;AACd,EAAE;AACF,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,kGAAkG;AAElG,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC;iFACiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC;gCACgC;AAChC,MAAM,WAAW,GAAG,MAAM,CAAC;AAU3B,MAAM,GAAG,GAAG,GAAW,EAAE,CACvB,8FAA8F;IAC9F,+EAA+E,CAAC;AAElF,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AAEnD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAe;IAChD,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,QAAQ,EAAE;YAChD,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAe,EACf,QAAgB,EAChB,KAAyB,EACzB,KAAyB;IAEzB,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAElC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC9F,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEvF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,UAAU,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE;YAChG,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC;SACzC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4D,CAAC;YAC1G,OAAO,CAAC,CAAC,KAAK,KAAK,cAAc;gBAC/B,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,IAAI,iBAAiB,2CAA2C,CAAC;gBAC1G,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,IAAI,mCAAmC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2C,CAAC;QAC1E,OAAO,EAAE,CAAC;YACR,GAAG,IAAI;YACP,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxC,GAAG,CAAC;gBACJ,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+/** Resolve the content-listener endpoint from the environment (D-08 analog for content).
+ *
+ *  ⚠️ THE CONTENT LISTENER IS A SEPARATE PORT from the chain API (`ce.evolver.content.http-port`),
+ *  and it can NEVER be derived from `config.url` — that would 404 against the wrong listener, or
+ *  worse, silently "work" against the wrong one. `contentUrl` is a FORBIDDEN config key for
+ *  exactly this reason, so the single source is the `EVOLVER_CONTENT_URL` environment variable,
+ *  read once at startup. */
+export declare function contentUrlFromEnv(env: NodeJS.ProcessEnv): string | undefined;
+export declare function main(): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAqBA;;;;;;4BAM4B;AAC5B,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAI5E;AAyFD,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAuG1C"}