@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/routes/v1/api/admin-facilitator.js

@@ -0,0 +1,64 @@
+/**
+ * The operator's facilitator delegation (contracts v1.3.2, S6 console + S10 card facilitator): an
+ * `ORACLE_ADMIN_DIDS` invoker gets a short-lived UCAN delegation, signed by this oracle's did:web (the
+ * key `/.well-known/did.json` publishes), granting exactly the requested `operators/*` actions on
+ * `ixo:ixo-pay-facilitator` — one capability each, never `*` (CLAUDE.md "Capabilities") — to
+ * their own did:ixo. The facilitator roots its operator actions in this oracle, so the console
+ * mints one here and presents it there.
+ *
+ * Every call is a NEW credential — a nonce each, `Cache-Control: no-store`, never cached here —
+ * and every mint is audited (who, to whom, which actions, until when, its CID; never the token).
+ * A GET, so no `idempotent()`: there is nothing to replay, only something to mint again.
+ *
+ * Never a `payouts/*` action (CA-M8): the payouts facilitator holds each company's payout team
+ * itself (the controllers of its company entity, `GET /v1/payouts/info`) and takes no grant rooted
+ * in an oracle, so one minted here would be refused there.
+ */
+import { Hono } from "hono";
+import { FACILITATOR_DELEGATION_MAX_TTL_SEC, FACILITATOR_RESOURCE, FacilitatorDelegationQuery, } from "../../../contracts/index.js";
+import { mintDelegation, oracleWebDid } from "../../../lib/ixo/ucan.js";
+import { validate } from "../../../lib/validator.js";
+import { audit } from "../../../middleware/api/audit.js";
+import { access } from "../../../middleware/api/auth.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+export const adminFacilitator = new Hono();
+adminFacilitator.get("/admin/facilitator-delegation", access({ op: "adminGetFacilitatorDelegation", scope: "none", capability: "operator" }), validate("query", FacilitatorDelegationQuery), async (c) => {
+    const { actions, ttl } = c.req.valid("query");
+    const config = c.get("config");
+    const caller = c.get("caller");
+    // `access()` guarantees it; the narrowing is for the type.
+    if (caller.kind !== "operator")
+        throw new ApiError("FORBIDDEN", "Only this oracle's operators can do this, and your account is not one of them.");
+    // Checked here, not left to the signer's 500: an unset key is this deployment's config, and
+    // the console should say so plainly.
+    if (!config.SERVICE_ED25519_MNEMONIC) {
+        throw new ApiError("UNAVAILABLE", "This oracle has no signing key configured (SERVICE_ED25519_MNEMONIC), so it can't sign facilitator access. Set the secret and redeploy, then try again.");
+    }
+    const capabilities = actions.map((can) => ({
+        with: FACILITATOR_RESOURCE,
+        can,
+    }));
+    const minted = await mintDelegation(config, {
+        audience: caller.did,
+        capabilities,
+        ttlSec: ttl,
+        maxLifetimeSec: FACILITATOR_DELEGATION_MAX_TTL_SEC,
+    });
+    const expiresAt = new Date(minted.exp * 1000).toISOString();
+    // The CID names the credential without being it: enough to match a facilitator log line.
+    await audit(c, "facilitator.delegation_minted", caller.did, {
+        audience: caller.did,
+        actions,
+        expiresAt,
+        cid: minted.cid,
+    });
+    c.header("Cache-Control", "no-store");
+    return c.json({
+        delegation: minted.car,
+        issuer: oracleWebDid(config),
+        audience: caller.did,
+        capabilities,
+        expiresAt,
+    });
+});
+//# sourceMappingURL=admin-facilitator.js.map

package/dist/routes/v1/api/admin-facilitator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-facilitator.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/admin-facilitator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kCAAkC,EAClC,oBAAoB,EAGpB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAU,CAAC;AAEnD,gBAAgB,CAAC,GAAG,CAClB,+BAA+B,EAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,+BAA+B,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACtF,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC,EAC7C,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,2DAA2D;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAC5B,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,gFAAgF,CACjF,CAAC;IACJ,4FAA4F;IAC5F,qCAAqC;IACrC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAChB,aAAa,EACb,yJAAyJ,CAC1J,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAA4B,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,EAAE,oBAAoB;QAC1B,GAAG;KACJ,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE;QAC1C,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,YAAY;QACZ,MAAM,EAAE,GAAG;QACX,cAAc,EAAE,kCAAkC;KACnD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,yFAAyF;IACzF,MAAM,KAAK,CAAC,CAAC,EAAE,+BAA+B,EAAE,MAAM,CAAC,GAAG,EAAE;QAC1D,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,OAAO;QACP,SAAS;QACT,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC,CAAC;IACH,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC,GAAG;QACtB,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,YAAY;QACZ,SAAS;KACsB,CAAC,CAAC;AACrC,CAAC,CACF,CAAC"}

package/dist/routes/v1/api/admin.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The operator view (go-prod spec §12.2): `ORACLE_ADMIN_DIDS` invokers over EVERY source — list, pause,
+ * resume, the allow-list and the billing mode, the two commercial terms a source's own members can
+ * never set. Each change is audited against the source it touched (`actorKind: operator`).
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const admin: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=admin.d.ts.map

package/dist/routes/v1/api/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/admin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAmB5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,eAAO,MAAM,KAAK,qDAAqB,CAAC"}

package/dist/routes/v1/api/admin.js

@@ -0,0 +1,110 @@
+/**
+ * The operator view (go-prod spec §12.2): `ORACLE_ADMIN_DIDS` invokers over EVERY source — list, pause,
+ * resume, the allow-list and the billing mode, the two commercial terms a source's own members can
+ * never set. Each change is audited against the source it touched (`actorKind: operator`).
+ */
+import { and, desc, eq, isNotNull, lt, or } from "drizzle-orm";
+import { Hono } from "hono";
+import { z } from "zod";
+import { MAX_PAGE_LIMIT, PauseSourceRequest, SetBillingModeRequest, SetSourceProtocolsRequest, SourceId, SourceStatus, } from "../../../contracts/index.js";
+import { apiSources } from "../../../db/schema.js";
+import { pauseSource, resumeSource } from "../../../lib/api-lane/pause.js";
+import { decodeCursor, encodeCursor } from "../../../lib/cursor.js";
+import { validate } from "../../../lib/validator.js";
+import { audit } from "../../../middleware/api/audit.js";
+import { access } from "../../../middleware/api/auth.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { idempotent } from "../../../middleware/api/idempotency.js";
+import { sourceView } from "./views.js";
+export const admin = new Hono();
+const ListQuery = z.object({
+    status: SourceStatus.optional(),
+    limit: z.coerce.number().int().min(1).max(MAX_PAGE_LIMIT).default(100),
+    cursor: z.string().max(1024).optional(),
+});
+const SourceParam = z.object({ sourceId: SourceId });
+async function sourceRow(db, sourceId) {
+    const row = await db.query.apiSources.findFirst({ where: eq(apiSources.sourceId, sourceId) });
+    if (!row)
+        throw new ApiError("NOT_FOUND", `Source ${sourceId} was not found.`);
+    return row;
+}
+admin.get("/admin/sources", access({ op: "adminListSources", scope: "none", capability: "operator" }), validate("query", ListQuery), async (c) => {
+    const { status, limit, cursor } = c.req.valid("query");
+    // The shared cursor names its id `claimId`; here it carries the sourceId.
+    const after = cursor ? decodeCursor(cursor) : null;
+    const db = await c.var.db();
+    const rows = await db
+        .select()
+        .from(apiSources)
+        .where(and(status ? eq(apiSources.status, status) : undefined, 
+    // D10: a source's id is its organisation's until it first goes active — not even
+    // operators list it (a pending source, or a disputed one that never was active).
+    isNotNull(apiSources.activatedAt), after
+        ? or(lt(apiSources.createdAt, after.createdAt), and(eq(apiSources.createdAt, after.createdAt), lt(apiSources.sourceId, after.claimId)))
+        : undefined))
+        .orderBy(desc(apiSources.createdAt), desc(apiSources.sourceId))
+        .limit(limit + 1);
+    const page = rows.slice(0, limit);
+    const last = page.at(-1);
+    return c.json({
+        items: page.map(sourceView),
+        nextCursor: rows.length > limit && last ? encodeCursor(last.createdAt, last.sourceId) : null,
+    });
+});
+admin.post("/admin/sources/:sourceId/pause", access({ op: "adminPauseSource", scope: "none", capability: "operator" }), idempotent(), validate("param", SourceParam), validate("json", PauseSourceRequest), async (c) => {
+    const { sourceId } = c.req.valid("param");
+    const { note } = c.req.valid("json");
+    const db = await c.var.db();
+    await sourceRow(db, sourceId);
+    // The note is the operator view's own (`notes` is never shown to the source) — so it stays
+    // out of the audit row too, which the source's `audit/read` members read.
+    if (note !== undefined) {
+        await db.update(apiSources).set({ notes: note }).where(eq(apiSources.sourceId, sourceId));
+    }
+    // Audited only when it changed something: a pause of a paused source is a no-op.
+    // No page: the operator is the one acting (the alert is for pauses nobody chose).
+    const deps = { config: c.get("config"), logger: c.get("logger") };
+    if (await pauseSource(db, deps, sourceId, "operator", undefined, false)) {
+        await audit(c, "source.paused", sourceId, { reason: "operator" }, sourceId);
+    }
+    return c.json(sourceView(await sourceRow(db, sourceId)));
+});
+admin.post("/admin/sources/:sourceId/resume", access({ op: "adminResumeSource", scope: "none", capability: "operator" }), idempotent(), validate("param", SourceParam), async (c) => {
+    const { sourceId } = c.req.valid("param");
+    const db = await c.var.db();
+    const { pausedReason } = await sourceRow(db, sourceId);
+    if (await resumeSource(db, c.get("logger"), sourceId)) {
+        await audit(c, "source.resumed", sourceId, { reason: pausedReason }, sourceId);
+    }
+    return c.json(sourceView(await sourceRow(db, sourceId)));
+});
+admin.put("/admin/sources/:sourceId/protocols", access({ op: "adminSetSourceProtocols", scope: "none", capability: "operator" }), idempotent(), validate("param", SourceParam), validate("json", SetSourceProtocolsRequest), async (c) => {
+    const { sourceId } = c.req.valid("param");
+    const protocols = [...new Set(c.req.valid("json").protocols.map((p) => p.protocolDid))];
+    const db = await c.var.db();
+    const [row] = await db
+        .update(apiSources)
+        .set({ allowedProtocols: protocols })
+        .where(eq(apiSources.sourceId, sourceId))
+        .returning();
+    if (!row)
+        throw new ApiError("NOT_FOUND", `Source ${sourceId} was not found.`);
+    await audit(c, "source.protocols_set", sourceId, { protocols }, sourceId);
+    return c.json(sourceView(row));
+});
+admin.put("/admin/sources/:sourceId/billing-mode", access({ op: "adminSetSourceBillingMode", scope: "none", capability: "operator" }), idempotent(), validate("param", SourceParam), validate("json", SetBillingModeRequest), async (c) => {
+    const { sourceId } = c.req.valid("param");
+    const { billingMode } = c.req.valid("json");
+    const db = await c.var.db();
+    const [row] = await db
+        .update(apiSources)
+        .set({ billingMode })
+        .where(eq(apiSources.sourceId, sourceId))
+        .returning();
+    if (!row)
+        throw new ApiError("NOT_FOUND", `Source ${sourceId} was not found.`);
+    await audit(c, "source.billing_mode_set", sourceId, { billingMode }, sourceId);
+    return c.json(sourceView(row));
+});
+//# sourceMappingURL=admin.js.map

package/dist/routes/v1/api/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/admin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,QAAQ,EACR,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAU,CAAC;AAExC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAErD,KAAK,UAAU,SAAS,CAAC,EAAY,EAAE,QAAgB;IACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,UAAU,QAAQ,iBAAiB,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,CAAC,GAAG,CACP,gBAAgB,EAChB,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,EAC5B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;IAClD,iFAAiF;IACjF,iFAAiF;IACjF,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,EACjC,KAAK;QACH,CAAC,CAAC,EAAE,CACA,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACzC,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACzC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CACvC,CACF;QACH,CAAC,CAAC,SAAS,CACd,CACF;SACA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SAC9D,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3B,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;KAC7F,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEF,KAAK,CAAC,IAAI,CACR,gCAAgC,EAChC,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACzE,UAAU,EAAE,EACZ,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,EAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACpC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9B,2FAA2F;IAC3F,0EAA0E;IAC1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,iFAAiF;IACjF,kFAAkF;IAClF,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClE,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,KAAK,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,KAAK,CAAC,IAAI,CACR,iCAAiC,EACjC,MAAM,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAC1E,UAAU,EAAE,EACZ,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,MAAM,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,KAAK,CAAC,GAAG,CACP,oCAAoC,EACpC,MAAM,CAAC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAChF,UAAU,EAAE,EACZ,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,EAC9B,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC,EAC3C,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;SACpC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACxC,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,UAAU,QAAQ,iBAAiB,CAAC,CAAC;IAC/E,MAAM,KAAK,CAAC,CAAC,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC,CACF,CAAC;AAEF,KAAK,CAAC,GAAG,CACP,uCAAuC,EACvC,MAAM,CAAC,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAClF,UAAU,EAAE,EACZ,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,EAC9B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACvC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACxC,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,UAAU,QAAQ,iBAAiB,CAAC,CAAC;IAC/E,MAAM,KAAK,CAAC,CAAC,EAAE,yBAAyB,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC,CACF,CAAC"}

package/dist/routes/v1/api/audit.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `GET /v1/api/audit` — the source's audit log (go-prod spec §6.1), newest first, keyset-paged over
+ * (createdAt, auditId) with the shared cursor. The rows are written by `middleware/api/audit.ts`.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const audit: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=audit.d.ts.map

package/dist/routes/v1/api/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/audit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAE5D,eAAO,MAAM,KAAK,qDAAqB,CAAC"}

package/dist/routes/v1/api/audit.js

@@ -0,0 +1,56 @@
+/**
+ * `GET /v1/api/audit` — the source's audit log (go-prod spec §6.1), newest first, keyset-paged over
+ * (createdAt, auditId) with the shared cursor. The rows are written by `middleware/api/audit.ts`.
+ */
+import { and, desc, eq, lt, or } from "drizzle-orm";
+import { Hono } from "hono";
+import { z } from "zod";
+import { MAX_PAGE_LIMIT } from "../../../contracts/index.js";
+import { apiAudit } from "../../../db/schema.js";
+import { decodeCursor, encodeCursor } from "../../../lib/cursor.js";
+import { validate } from "../../../lib/validator.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+export const audit = new Hono();
+/** The file's `Limit` + `Cursor` parameters. Loose, like every query string of the lane. */
+const AuditQuery = z.object({
+    limit: z.coerce.number().int().min(1).max(MAX_PAGE_LIMIT).default(100),
+    cursor: z.string().max(1024).optional(),
+});
+const entryView = (row) => ({
+    id: row.auditId,
+    sourceId: row.sourceId,
+    actor: {
+        kind: row.actorKind,
+        id: row.actor,
+        // An AI app over OAuth (1.4.6): the app acting for the user `id`.
+        ...(row.actorKind === "oauth"
+            ? { clientId: row.clientId ?? "", clientName: row.clientName ?? "" }
+            : {}),
+    },
+    action: row.action,
+    target: row.target,
+    at: row.createdAt.toISOString(),
+    details: row.details,
+});
+audit.get("/audit", access({ op: "listAudit", scope: "none", capability: "audit/read" }), validate("query", AuditQuery), async (c) => {
+    const { sourceId } = sourceOf(c).source;
+    const { limit, cursor } = c.req.valid("query");
+    // The shared cursor names its id `claimId`; here it carries the auditId.
+    const after = cursor ? decodeCursor(cursor) : null;
+    const db = await c.var.db();
+    const rows = await db
+        .select()
+        .from(apiAudit)
+        .where(and(eq(apiAudit.sourceId, sourceId), after
+        ? or(lt(apiAudit.createdAt, after.createdAt), and(eq(apiAudit.createdAt, after.createdAt), lt(apiAudit.auditId, after.claimId)))
+        : undefined))
+        .orderBy(desc(apiAudit.createdAt), desc(apiAudit.auditId))
+        .limit(limit + 1);
+    const page = rows.slice(0, limit);
+    const last = page.at(-1);
+    return c.json({
+        items: page.map(entryView),
+        nextCursor: rows.length > limit && last ? encodeCursor(last.createdAt, last.auditId) : null,
+    });
+});
+//# sourceMappingURL=audit.js.map

package/dist/routes/v1/api/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/audit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAoB,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAGhE,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAU,CAAC;AAExC,4FAA4F;AAC5F,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,GAAgB,EAAE,EAAE,CAAC,CAAC;IACvC,EAAE,EAAE,GAAG,CAAC,OAAO;IACf,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,KAAK,EAAE;QACL,IAAI,EAAE,GAAG,CAAC,SAAS;QACnB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,kEAAkE;QAClE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO;YAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;KACR;IACD,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;IAC/B,OAAO,EAAE,GAAG,CAAC,OAAO;CACrB,CAAC,CAAC;AAEH,KAAK,CAAC,GAAG,CACP,QAAQ,EACR,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,EACpE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,yEAAyE;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC/B,KAAK;QACH,CAAC,CAAC,EAAE,CACA,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACvC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAClF;QACH,CAAC,CAAC,SAAS,CACd,CACF;SACA,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SACzD,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;KAC5F,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/routes/v1/api/batch.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `POST /v1/api/claims/batch` (go-prod spec §4.2): up to 100 claims, async only, the single submit's
+ * rules per item (`claims.ts`), with three batch-shaped differences:
+ *
+ * - **Per-item answers.** A bad item is `rejected` inline with its error and never charged; one bad
+ *   item never fails the batch (only a paused source or a payment problem does).
+ * - **One offer** (board D32) covers the valid NEW items: one 402, one `PAYMENT-SIGNATURE`, one
+ *   verify reserving every claim's price (all or none); each claim settles on its own receipt. The
+ *   paid retry takes its claimIds from the offer its nonce names, matched to the batch's valid new
+ *   items in order.
+ * - **Idempotency** names item i `K:i` (Idempotency-Key K), so a retried batch re-finds every item:
+ *   a recorded item answers `accepted` again and is never charged twice.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const batch: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=batch.d.ts.map

package/dist/routes/v1/api/batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/batch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAgB5B,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAiBxE,eAAO,MAAM,KAAK,qDAAqB,CAAC"}

package/dist/routes/v1/api/batch.js

@@ -0,0 +1,192 @@
+/**
+ * `POST /v1/api/claims/batch` (go-prod spec §4.2): up to 100 claims, async only, the single submit's
+ * rules per item (`claims.ts`), with three batch-shaped differences:
+ *
+ * - **Per-item answers.** A bad item is `rejected` inline with its error and never charged; one bad
+ *   item never fails the batch (only a paused source or a payment problem does).
+ * - **One offer** (board D32) covers the valid NEW items: one 402, one `PAYMENT-SIGNATURE`, one
+ *   verify reserving every claim's price (all or none); each claim settles on its own receipt. The
+ *   paid retry takes its claimIds from the offer its nonce names, matched to the batch's valid new
+ *   items in order.
+ * - **Idempotency** names item i `K:i` (Idempotency-Key K), so a retried batch re-finds every item:
+ *   a recorded item answers `accepted` again and is never charged twice.
+ */
+import { inArray } from "drizzle-orm";
+import { Hono } from "hono";
+import { BatchSubmitRequest, } from "../../../contracts/index.js";
+import { apiClaims } from "../../../db/schema.js";
+import { claimContent, recordApiClaims, startApiClaims } from "../../../lib/api-lane/index.js";
+import { newId } from "../../../lib/api-lane/ids.js";
+import { submitterFor } from "../../../lib/api-lane/submitter.js";
+import { canonicalJson, sha256Hex } from "../../../lib/hash.js";
+import { validate } from "../../../lib/validator.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { ApiError, docsUrl } from "../../../middleware/api/errors.js";
+import { gateFor, idempotencyKeyOf, keyPrefixOf, paymentRequired, preflightOrNone, protocolOf, protocolOutOfReach, reserve, sourcePaused, submission, submittedByOf, submittedViaOf, } from "./claims.js";
+import { checkSubmission, workOrderFor } from "./work-orders.js";
+export const batch = new Hono();
+batch.post("/claims/batch", access({ op: "submitClaimBatch", scope: "claims:write", capability: "claims/submit" }), validate("json", BatchSubmitRequest), async (c) => {
+    const caller = sourceOf(c);
+    const { source } = caller;
+    const { claims: items } = c.req.valid("json");
+    const db = await c.var.db();
+    const key = idempotencyKeyOf(c);
+    const header = c.req.header("PAYMENT-SIGNATURE") ?? null;
+    const results = new Map();
+    const accepted = (index, claimId) => results.set(index, { index, status: "accepted", claimId, pollUrl: pollUrlOf(c, claimId) });
+    const reject = (index, err) => results.set(index, {
+        index,
+        status: "rejected",
+        error: {
+            code: err.apiCode,
+            message: err.message,
+            ...(err.details !== undefined ? { details: err.details } : {}),
+            docsUrl: docsUrl(c.get("config"), err.apiCode),
+        },
+    });
+    // 0. A paid retry first names its claims: a keyless batch learns them only from the offer, and
+    //    an upload already bound to one of them is that item's own, not "another claim's". The
+    //    gate's preflight reserves NOTHING: every check that can refuse runs before `verify` (2).
+    const x402 = source.billingMode === "x402";
+    // Built only when needed: a batch of repeats is answered even with payments off.
+    let pay = x402 && header ? await gateFor(c) : null;
+    const checked = pay && header ? await preflightOrNone(pay, header, caller) : null;
+    if (checked && !checked.ok)
+        return paymentRequired(c, checked.paymentRequired);
+    const paid = checked?.ok ? checked : null;
+    // 1. Each item on its own: a repeat of its key, or every check of the single submit.
+    const ids = key
+        ? await Promise.all(items.map((_, i) => batchClaimId(source.sourceId, key, i)))
+        : [];
+    const existing = new Map((ids.length > 0
+        ? await db.select().from(apiClaims).where(inArray(apiClaims.claimId, ids))
+        : []).map((r) => [r.claimId, r]));
+    const fresh = [];
+    const repeats = [];
+    const claimedUploads = new Set();
+    for (const [index, item] of items.entries()) {
+        const claimId = ids[index] ?? null;
+        const requestDigest = key ? await sha256Hex(canonicalJson(item)) : null;
+        try {
+            const prior = claimId ? existing.get(claimId) : undefined;
+            if (claimId && prior) {
+                if (prior.requestDigest !== null && prior.requestDigest !== requestDigest) {
+                    throw new ApiError("IDEMPOTENCY_MISMATCH", `This Idempotency-Key was already used for a batch whose item ${index} was different. Use a new key for a new batch, or resend the original batch unchanged.`);
+                }
+                repeats.push(claimId);
+                accepted(index, claimId);
+                continue;
+            }
+            // As the single submit: a repeat is answered even while paused; a NEW item is not taken.
+            if (source.status === "paused") {
+                throw sourcePaused(source.pausedReason);
+            }
+            const protocolDid = protocolOf(item.protocolDid, source.allowedProtocols);
+            if (caller.kind !== "key" && caller.protocols && !caller.protocols.includes(protocolDid)) {
+                throw new ApiError("FORBIDDEN", protocolOutOfReach(protocolDid));
+            }
+            const work = await workOrderFor(c.env, protocolDid);
+            const own = claimId ? [claimId] : (paid?.items.map((i) => i.claimId) ?? []);
+            await checkSubmission(db, work, submission(item, source, own, submitterFor(item, source.payeeField)));
+            // Two items of one batch naming one upload: only the first could bind it (accept.ts).
+            const uploads = (item.attachments ?? []).flatMap((a) => "uploadId" in a ? [a.uploadId] : []);
+            if (uploads.some((u) => claimedUploads.has(u))) {
+                throw new ApiError("VALIDATION", "Each upload can be attached to one claim only, and an earlier item in this batch already uses it. Upload the file again for this item.", {
+                    issues: [{ path: "attachments", message: "already used by an earlier item" }],
+                });
+            }
+            for (const u of uploads)
+                claimedUploads.add(u);
+            fresh.push({ index, item, protocolDid, claimId, requestDigest });
+        }
+        catch (err) {
+            if (!(err instanceof ApiError) || err.status >= 500)
+                throw err; // a pause or an outage fails the batch
+            reject(index, err);
+        }
+    }
+    // 2. Pay for the fresh items: one offer, one verify (payments spec §4, board D32). The paid
+    //    retry must be for exactly these items — same count, same protocol at each position, and
+    //    for a keyed batch the same claims; anything else gets a fresh offer. Only then does
+    //    `verify` reserve: nothing reserves and then refuses.
+    const charges = new Map();
+    if (x402 && fresh.length > 0) {
+        pay ??= await gateFor(c);
+        const matches = paid !== null &&
+            paid.items.length === fresh.length &&
+            fresh.every((f, j) => paid.items[j]?.protocolDid === f.protocolDid &&
+                (f.claimId === null || paid.items[j]?.claimId === f.claimId));
+        if (!paid || !matches) {
+            for (const f of fresh)
+                f.claimId ??= newId("apc");
+            const body402 = await pay.run((g) => g.offer({
+                sourceId: source.sourceId,
+                keyPrefix: keyPrefixOf(caller),
+                items: fresh.map((f) => ({ claimId: f.claimId, protocolDid: f.protocolDid })),
+            }));
+            return paymentRequired(c, body402);
+        }
+        const verified = await reserve(pay, header, caller);
+        if (!verified.ok)
+            return paymentRequired(c, verified.paymentRequired);
+        for (const [j, f] of fresh.entries()) {
+            const it = verified.items[j];
+            if (!it)
+                continue;
+            f.claimId = it.claimId;
+            charges.set(it.claimId, {
+                amount: it.amount,
+                amountCents: it.amountCents,
+                offerId: verified.offerId,
+                payerDid: verified.payer,
+                paymentHeader: header,
+            });
+        }
+    }
+    // 3. Record, start. A keyless paid retry re-finds its own claims here: `exists`.
+    const recorded = await recordApiClaims(c.env, fresh.map((f) => {
+        f.claimId ??= newId("apc");
+        return {
+            claimId: f.claimId,
+            sourceId: source.sourceId,
+            protocolDid: f.protocolDid,
+            answers: f.item.answers,
+            attachments: f.item.attachments ?? [],
+            submitter: submitterFor(f.item, source.payeeField),
+            metadata: f.item.metadata ?? null,
+            webhookUrl: f.item.webhookUrl ?? null,
+            idempotencyKey: key ? `${key}:${f.index}` : null,
+            requestDigest: f.requestDigest,
+            content: claimContent(f.item, f.protocolDid),
+            keyPrefix: keyPrefixOf(caller),
+            submittedBy: submittedByOf(caller),
+            submittedVia: submittedViaOf(caller),
+            charge: charges.get(f.claimId) ?? null,
+        };
+    }));
+    for (const f of fresh)
+        accepted(f.index, f.claimId);
+    // Counted before the start, as the single submit.
+    const metrics = c.get("metrics");
+    const submitted = recorded.filter((r) => r.status !== "exists").length;
+    if (submitted > 0)
+        metrics.count("api.submit", submitted, { op: "batch" });
+    if (repeats.length > 0)
+        metrics.count("api.idempotent_replay", repeats.length, { op: "batch" });
+    // Every recorded claim is reserved (or free); a repeat whose start was lost starts again.
+    const start = [...recorded.map((r) => r.claimId), ...repeats];
+    if (start.length > 0)
+        await startApiClaims(c.env, start);
+    return c.json({
+        items: [...results.values()].sort((a, b) => a.index - b.index),
+    }, 202);
+});
+/**
+ * Item i of a batch under Idempotency-Key K. Its own namespace (`batch|…`), so it can never equal
+ * a single submit's `sourceId|key` — a single submit keyed `K:0` names a different claim.
+ */
+async function batchClaimId(sourceId, key, index) {
+    return `apc_${(await sha256Hex(`batch|${sourceId}|${key}|${index}`)).slice(0, 40)}`;
+}
+const pollUrlOf = (c, claimId) => `https://${c.get("config").ORACLE_HOSTNAME}/v1/api/claims/${claimId}`;
+//# sourceMappingURL=batch.js.map

package/dist/routes/v1/api/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/batch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAGL,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,YAAY,EACZ,UAAU,EACV,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAU,CAAC;AAWxC,KAAK,CAAC,IAAI,CACR,eAAe,EACf,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,EACtF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACpC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,EAAE,CAClD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,GAAa,EAAE,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;QACjB,KAAK;QACL,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE;YACL,IAAI,EAAE,GAAG,CAAC,OAAO;YACjB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC;SAC/C;KACF,CAAC,CAAC;IAEL,+FAA+F;IAC/F,2FAA2F;IAC3F,8FAA8F;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC;IAC3C,iFAAiF;IACjF,IAAI,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1C,qFAAqF;IACrF,MAAM,GAAG,GAAG,GAAG;QACb,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACb,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC,CAAC,EAAE,CACL,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAC7B,CAAC;IACF,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACnC,MAAM,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;gBACrB,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;oBAC1E,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,gEAAgE,KAAK,wFAAwF,CAC9J,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,yFAAyF;YACzF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzF,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,eAAe,CACnB,EAAE,EACF,IAAI,EACJ,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CACrE,CAAC;YACF,sFAAsF;YACtF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACrD,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CACpC,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,QAAQ,CAChB,YAAY,EACZ,wIAAwI,EACxI;oBACE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;iBAC9E,CACF,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC,CAAC,uCAAuC;YACvG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,6FAA6F;IAC7F,yFAAyF;IACzF,0DAA0D;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC3E,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,GAAG,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GACX,IAAI,KAAK,IAAI;YACb,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAClC,KAAK,CAAC,KAAK,CACT,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,KAAK,CAAC,CAAC,WAAW;gBAC5C,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,CAC/D,CAAC;QACJ,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,MAAO,GAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/D,CAAC,CAAC,KAAK,CAAC;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC;gBAC9B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;aACxF,CAAC,CACH,CAAC;YACF,OAAO,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAA8B,EAAE,MAAgB,EAAE,MAAM,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE;gBACtB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK;gBACxB,aAAa,EAAE,MAAgB;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,CAAC,CAAC,GAAG,EACL,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACd,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;YACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;YACrC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC;YAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI;YACjC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI;YACrC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;YAChD,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC;YAC5C,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC;YAC9B,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC;YAClC,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC;YACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI;SACvC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAiB,CAAC,CAAC;IAC9D,kDAAkD;IAClD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACvE,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEhG,0FAA0F;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEzD,OAAO,CAAC,CAAC,IAAI,CACX;QACE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;KACjC,EAC/B,GAAG,CACJ,CAAC;AACJ,CAAC,CACF,CAAC;AAEF;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IACtE,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,SAAS,QAAQ,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAa,EAAE,OAAe,EAAE,EAAE,CACnD,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,eAAe,kBAAkB,OAAO,EAAE,CAAC"}

package/dist/routes/v1/api/claims-read.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The claim reads that are not the record itself (go-prod spec §4.2): the list, the timeline and the
+ * receipt. Every one is scoped to the caller's source — its own API claims plus its linked
+ * collections' chain claims (contracts v1.2) — and a console member's `nb.protocols` narrow it
+ * further; a claim outside either is `404`, never `403`: its existence is not the caller's to learn
+ * (§14). `readableClaimOf` is that rule for one claim read, `claimOf` its API-only form for the
+ * routes that touch a body (review, erase).
+ */
+import { Hono } from "hono";
+import { z } from "zod";
+import { type Receipt } from "../../../contracts/index.js";
+import type { ApiContext, ApiEnv } from "../../../middleware/api/types.js";
+export declare const claimsRead: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+/** A read route's `:claimId` — either lane's id (contracts v1.2), bounded before any query. */
+export declare const ClaimParam: z.ZodObject<{
+    claimId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The caller's API claim, or `404 NOT_FOUND` — for an unknown id, another source's, one outside the
+ * member's `nb.protocols`, and a linked collection's chain claim alike, so the answer never tells
+ * them apart (§14). What the routes that touch the claim's BODY take (review, erase): a chain
+ * claim's body is not the oracle's to show or erase.
+ */
+export declare function claimOf(c: ApiContext, claimId: string): Promise<{
+    claimId: string;
+    protocolDid: string;
+    receivedAt: Date;
+    sourceId: string;
+}>;
+/**
+ * Any claim the caller may READ (contracts v1.2): its own API claim, or a chain claim of a
+ * collection linked to its source (`api_source_collections`, any live link — lib/api-lane/linked.ts),
+ * inside the member's `nb.protocols` by the collection's protocol — else the same
+ * `404` as `claimOf`. The record, timeline, receipt
+ * and report routes take this; nothing that touches a body does.
+ */
+export declare function readableClaimOf(c: ApiContext, claimId: string): Promise<{
+    claimId: string;
+    lane: "api" | "chain";
+}>;
+/** The claim's receipt with where to verify it — shared with the operator view (admin-claims.ts). */
+export declare function receiptOf(c: ApiContext, claimId: string): Promise<Receipt>;
+//# sourceMappingURL=claims-read.d.ts.map

package/dist/routes/v1/api/claims-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims-read.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/claims-read.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAmB,KAAK,OAAO,EAAiB,MAAM,oBAAoB,CAAC;AAclF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAgB,MAAM,+BAA+B,CAAC;AAEtF,eAAO,MAAM,UAAU,qDAAqB,CAAC;AAM7C,+FAA+F;AAC/F,eAAO,MAAM,UAAU;;iBAAuC,CAAC;AAK/D;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM;;;;;GAU3D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,UAAU,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAAA;CAAE,CAAC,CA6BrD;AAqDD,qGAAqG;AACrG,wBAAsB,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBhF"}