@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/routes/v1/mcp/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The hosted MCP server (go-prod spec §13.2, decision log row 35): `https://<oracle>/v1/mcp`, MCP
+ * over Streamable HTTP, mounted with the API lane — nothing for a customer to install:
+ *
+ *   claude mcp add --transport http ixo https://<oracle>/v1/mcp --header "Authorization: Bearer eo_live_…"
+ *
+ * STATELESS: a fresh server and transport per POST, JSON answers (no SSE, no session), so any
+ * isolate answers any request. The credentials are the connection's headers — `Authorization:
+ * Bearer <API key>`, plus `X-Payment-Delegation` for a source in billing mode `x402` — and every
+ * tool (`tools.ts`) is the SDK's `DecisionsClient` calling THIS app in-process with them. So the
+ * key's scopes, `SCOPE` refusals, the per-key limits, the spend cap, idempotency, the audit log and
+ * "never the body" hold exactly as on the HTTP routes: they ARE the HTTP routes. A bearer must be
+ * present on every request; its validity is proved once at connect (`initialize` asks `/v1/api/me`,
+ * so a junk or revoked key fails there, not at the first tool call) and otherwise per call, by the
+ * route each tool calls.
+ *
+ * Or the user signs in instead (MCP over OAuth, spec 2026-10-06): a bearer that is not an `eo_` key
+ * and is shaped like a JWT is AuthHub's access token, verified here (`lib/oauth/token.ts`) and
+ * never passed on. The 401 names the protected-resource metadata (`resource_metadata`), which is how
+ * Claude, ChatGPT and Claude Code find AuthHub. The tools then call the routes as an `oauth` caller
+ * — the mark is made on the in-process request itself (`middleware/api/oauth.ts`) — and every
+ * submit waits for the user's approval on AuthHub (`oauth.ts`).
+ *
+ * Each inner call re-enters the whole app (its observability/database middleware are what the
+ * routes read) with the caller's `CF-Connecting-IP`, so it counts against the caller's own per-IP
+ * bucket — the MCP request plus each route call it makes (a paid submit: the 402 and the paid
+ * resend), never another caller's. Only the client's own headers reach the inner request (plus
+ * the IP, the request id and `traceparent`): a caller's `X-Auth-Type` / `X-Source-Id` never do.
+ */
+import { Hono } from "hono";
+import type { AppEnv } from "../../../context.js";
+export declare const mcp: Hono<AppEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/v1/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,kBAAkB,CAAC;AAa1D,eAAO,MAAM,GAAG,qDAAqB,CAAC"}

package/dist/routes/v1/mcp/index.js

@@ -0,0 +1,252 @@
+/**
+ * The hosted MCP server (go-prod spec §13.2, decision log row 35): `https://<oracle>/v1/mcp`, MCP
+ * over Streamable HTTP, mounted with the API lane — nothing for a customer to install:
+ *
+ *   claude mcp add --transport http ixo https://<oracle>/v1/mcp --header "Authorization: Bearer eo_live_…"
+ *
+ * STATELESS: a fresh server and transport per POST, JSON answers (no SSE, no session), so any
+ * isolate answers any request. The credentials are the connection's headers — `Authorization:
+ * Bearer <API key>`, plus `X-Payment-Delegation` for a source in billing mode `x402` — and every
+ * tool (`tools.ts`) is the SDK's `DecisionsClient` calling THIS app in-process with them. So the
+ * key's scopes, `SCOPE` refusals, the per-key limits, the spend cap, idempotency, the audit log and
+ * "never the body" hold exactly as on the HTTP routes: they ARE the HTTP routes. A bearer must be
+ * present on every request; its validity is proved once at connect (`initialize` asks `/v1/api/me`,
+ * so a junk or revoked key fails there, not at the first tool call) and otherwise per call, by the
+ * route each tool calls.
+ *
+ * Or the user signs in instead (MCP over OAuth, spec 2026-10-06): a bearer that is not an `eo_` key
+ * and is shaped like a JWT is AuthHub's access token, verified here (`lib/oauth/token.ts`) and
+ * never passed on. The 401 names the protected-resource metadata (`resource_metadata`), which is how
+ * Claude, ChatGPT and Claude Code find AuthHub. The tools then call the routes as an `oauth` caller
+ * — the mark is made on the in-process request itself (`middleware/api/oauth.ts`) — and every
+ * submit waits for the user's approval on AuthHub (`oauth.ts`).
+ *
+ * Each inner call re-enters the whole app (its observability/database middleware are what the
+ * routes read) with the caller's `CF-Connecting-IP`, so it counts against the caller's own per-IP
+ * bucket — the MCP request plus each route call it makes (a paid submit: the 402 and the paid
+ * resend), never another caller's. Only the client's own headers reach the inner request (plus
+ * the IP, the request id and `traceparent`): a caller's `X-Auth-Type` / `X-Source-Id` never do.
+ */
+import { DecisionsClient, isDecisionsApiError } from "@ixo/decision-oracle-client";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
+import { eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { claimIngests } from "../../../db/schema.js";
+import { canonicalJson, sha256Hex } from "../../../lib/hash.js";
+import { InvalidToken, looksLikeJwt, prmUrl, verifyAccessToken } from "../../../lib/oauth/token.js";
+import { decodeHeader } from "../../../lib/payments/index.js";
+import { ApiError, docsUrl } from "../../../middleware/api/errors.js";
+import { isApiKey } from "../../../middleware/api/keys.js";
+import { markOAuth } from "../../../middleware/api/oauth.js";
+import { findClaim, keyedClaimId } from "../api/claims.js";
+import { oauthClients } from "./oauth.js";
+import { keyClients, registerTools } from "./tools.js";
+import { registerUi } from "./ui.js";
+export const mcp = new Hono();
+/** What an MCP client reads on a 401: "needs authentication", and where to find the AS (RFC 9728). */
+const wwwAuthenticate = (c) => `Bearer realm="ixo-decision-api", resource_metadata="${prmUrl(c.get("config"))}"`;
+mcp.use("*", async (c, next) => {
+    if (!c.get("config").API_LANE) {
+        throw new ApiError("NOT_FOUND", `The Decision API is not enabled on this oracle, so there is no ${c.req.method} ${c.req.path}.`);
+    }
+    if (!bearer(c)) {
+        c.header("WWW-Authenticate", wwwAuthenticate(c));
+        throw new ApiError("UNAUTHORIZED", 'This MCP connection has no credentials. Connect by signing in (OAuth), or add an API key as a header: --header "Authorization: Bearer <key>"; create a key in the console (Keys).');
+    }
+    await next();
+});
+mcp.post("/", async (c) => {
+    const config = c.get("config");
+    const token = bearer(c);
+    let clients;
+    if (!isApiKey(token) && looksLikeJwt(token)) {
+        const identity = await verifyOrRefuse(c, token);
+        clients = oauthClients(c, identity, (seam, paymentDelegation) => clientFor(c, { oauth: seam, paymentDelegation }), (sourceId, args) => acceptedClaim(c, sourceId, args));
+    }
+    else {
+        const client = clientFor(c, {
+            apiKey: token,
+            paymentDelegation: c.req.header("X-Payment-Delegation") || undefined,
+        });
+        if (await isInitialize(c))
+            await assertKey(c, client);
+        clients = keyClients(client, async (args) => {
+            // The key's source as its own route authenticates it (live: revoked, hashed, rate-limited)
+            // — never a second, local key check. A key that no longer passes gets nothing.
+            const sourceId = await client.me().then((me) => me.source.sourceId, () => null);
+            return sourceId ? acceptedClaim(c, sourceId, args) : null;
+        });
+    }
+    const server = new McpServer({ name: config.SERVICE_NAME, version: config.SERVICE_VERSION }, 
+    // ajv (the SDK's default) compiles with `new Function`, which workerd refuses.
+    { jsonSchemaValidator: new CfWorkerJsonSchemaValidator() });
+    registerTools(server, clients, {
+        engineDid: engineDid(config.EVAL_ENGINE_HOSTNAME),
+        logger: c.get("logger"),
+        metrics: c.get("metrics"),
+    });
+    // The upload card PUTs to the link `upload_file` returned, which is on this oracle's own origin.
+    registerUi(server, new URL(config.AUTH_HUB_URL).origin, `https://${config.ORACLE_HOSTNAME}`);
+    // No `Origin` check (the spec's DNS-rebinding guard): the only credential is the bearer header,
+    // never a cookie, so a rebinding page holds nothing to act as anyone with.
+    const transport = new WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+        enableJsonResponse: true,
+    });
+    await server.connect(transport);
+    return transport.handleRequest(c.req.raw);
+});
+// Stateless: no server-initiated stream to open (GET) and no session to end (DELETE). A 405 is
+// what the Streamable HTTP spec asks of a server that offers neither. GET and DELETE get their own
+// routes so `http.request` labels them `/v1/mcp` (`endpointOf` skips ALL routes: they'd read
+// `unmatched`); every other method and path ends in the ALL route, so nothing under `/v1/mcp`
+// falls through to `/v1`'s UCAN guard.
+const notAllowed = (c) => c.json({ jsonrpc: "2.0", error: { code: -32000, message: "Method not allowed." }, id: null }, 405, { Allow: "POST" });
+mcp.get("/", notAllowed);
+mcp.delete("/", notAllowed);
+mcp.all("*", notAllowed);
+function bearer(c) {
+    const m = /^Bearer\s+(\S+)$/i.exec(c.req.header("authorization") ?? "");
+    return m?.[1];
+}
+/** An `initialize` — alone or inside a JSON-RPC batch. Read off a clone: the transport reads the body. */
+async function isInitialize(c) {
+    try {
+        const body = await c.req.raw.clone().json();
+        const msgs = Array.isArray(body) ? body : [body];
+        return msgs.some((m) => m?.method === "initialize");
+    }
+    catch {
+        return false; // not JSON: the transport answers it with its own parse error
+    }
+}
+/** Connect-time key check: `/v1/api/me` is a real route, so a junk or revoked key is its 401. */
+async function assertKey(c, client) {
+    try {
+        await client.me();
+    }
+    catch (e) {
+        if (isDecisionsApiError(e) && e.code === "UNAUTHORIZED") {
+            c.header("WWW-Authenticate", wwwAuthenticate(c));
+            throw new ApiError("UNAUTHORIZED", e.message);
+        }
+        // Anything else (a SCOPE, a blip) is not the key's validity: the tools answer for themselves.
+    }
+}
+/** AuthHub's access token, or the 401 that sends the client back through OAuth. On EVERY request:
+ *  a token lives 5 minutes, and a refused one must be refused before any tool runs. */
+async function verifyOrRefuse(c, token) {
+    try {
+        return await verifyAccessToken({ config: c.get("config"), cache: c.env.CACHE_KV, trace: c.get("trace") }, token);
+    }
+    catch (e) {
+        if (!(e instanceof InvalidToken))
+            throw e;
+        c.get("logger").info("mcp.oauth.token-refused", { reason: e.message });
+        c.header("WWW-Authenticate", `${wwwAuthenticate(c)}, error="invalid_token"`);
+        throw new ApiError("UNAUTHORIZED", "This sign-in has expired or is not for this oracle. Reconnect the app to sign in again.");
+    }
+}
+/** The SDK, pointed at this app in-process — as the key's holder, or marked for an OAuth caller. */
+function clientFor(c, auth) {
+    const ip = c.req.header("CF-Connecting-IP");
+    const traceparent = c.req.header("traceparent");
+    const requestId = c.get("requestId");
+    const inProcess = async (input, init) => {
+        // Lazy: `app.ts` imports this router, so a static import would be a cycle.
+        const { default: app } = await import("../../../app.js");
+        const req = new Request(input, init);
+        if (ip)
+            req.headers.set("CF-Connecting-IP", ip);
+        if (traceparent)
+            req.headers.set("traceparent", traceparent);
+        req.headers.set("X-Request-Id", requestId);
+        if ("oauth" in auth) {
+            const refused = watchPayment(req, auth.oauth, c.get("config"));
+            if (refused)
+                return refused;
+            markOAuth(req, auth.oauth);
+        }
+        return app.fetch(req, c.env, c.executionCtx);
+    };
+    const facilitatorUrl = c.get("config").X402_FACILITATOR_URL;
+    return new DecisionsClient({
+        baseUrl: new URL(c.req.url).origin,
+        // An OAuth caller's token is never passed on: the inner route reads the mark, not this.
+        apiKey: "apiKey" in auth ? auth.apiKey : "oauth",
+        paymentDelegation: auth.paymentDelegation,
+        // Which way to pay when a 402 offers both PAY and card: the header, else the payer's own default
+        // from the console (the SDK reads it with the delegation).
+        prefer: preferOf(c.req.header("X-Payment-Prefer")),
+        // The card authorize goes to OUR facilitator, never the delegation's audience: the delegation
+        // is the caller's, and a caller must not choose which host this worker POSTs to (with the
+        // delegation as its bearer). No facilitator configured ⇒ no payments here to pin.
+        ...(facilitatorUrl ? { facilitatorUrl } : {}),
+        fetch: inProcess,
+        // One retry: a 5xx after the gate's verify reserved the price must be resent with the SAME
+        // PAYMENT-SIGNATURE, which only the SDK holds — the agent's own retry would arrive unpaid and
+        // be offered again. Every other retry is the MCP client's; this keeps a call near its 90 s wait.
+        maxRetries: 1,
+    });
+}
+/**
+ * What an OAuth caller's paid request carries (S3 review F3): a card payment is a hold already
+ * placed (`cardSigned`, never given back), and a 3-D Secure resume may carry only the offer and
+ * PaymentIntent its approval was parked with — anything else (PAY, another card payment) is
+ * refused here, before the route, so a resume can never become a second payment.
+ */
+function watchPayment(req, seam, config) {
+    const header = req.headers.get("PAYMENT-SIGNATURE");
+    if (!header)
+        return null;
+    const signed = decodeHeader(header);
+    const card = signed?.accepted?.scheme === "stripe-manual-capture";
+    if (card)
+        seam.cardSigned = true;
+    const bound = seam.resume;
+    if (bound &&
+        !(card &&
+            signed?.accepted?.extra?.nonce === bound.offerId &&
+            signed?.payload?.paymentIntentId === bound.paymentIntentId)) {
+        return Response.json({
+            error: {
+                code: "CONFLICT",
+                message: "This resume may pay only the card payment the user confirmed for this claim. Nothing was charged.",
+                requestId: req.headers.get("X-Request-Id") ?? "mcp",
+                docsUrl: docsUrl(config, "CONFLICT"),
+            },
+        }, { status: 409 });
+    }
+    return null;
+}
+/**
+ * The claim this very request was recorded as — the one its key names on `sourceId`, AND whose
+ * stored request digest is this body's (the route's own `sha256(canonicalJson(body))`): a key
+ * reused for another body never hands back another claim's id.
+ */
+async function acceptedClaim(c, sourceId, { idempotencyKey, request }) {
+    const db = await c.var.db();
+    const claimId = await keyedClaimId(sourceId, idempotencyKey);
+    const claim = await findClaim(db, claimId);
+    if (!claim || claim.requestDigest !== (await sha256Hex(canonicalJson(request))))
+        return null;
+    const ingest = await db.query.claimIngests.findFirst({
+        columns: { status: true },
+        where: eq(claimIngests.claimId, claimId),
+    });
+    return {
+        claimId,
+        status: ingest?.status ?? "queued",
+        pollUrl: `https://${c.get("config").ORACLE_HOSTNAME}/v1/api/claims/${claimId}`,
+    };
+}
+/** The engine's did:web — the one issuer a receipt here may carry (a port colon is `%3A`). */
+const engineDid = (hostname) => `did:web:${hostname.replace(/:/g, "%3A")}`;
+/** `X-Payment-Prefer: card | upay` (any case); anything else leaves the choice to the payer's default. */
+function preferOf(header) {
+    const value = header?.trim().toLowerCase();
+    return value === "card" || value === "upay" ? value : undefined;
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/v1/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/routes/v1/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AACzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAsB,UAAU,EAAE,aAAa,EAAmB,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;AAEtC,sGAAsG;AACtG,MAAM,eAAe,GAAG,CAAC,CAAkB,EAAE,EAAE,CAC7C,uDAAuD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC;AAEpF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,kEAAkE,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACf,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,mLAAmL,CACpL,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;IAClC,IAAI,OAAsC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,GAAG,YAAY,CACpB,CAAC,EACD,QAAQ,EACR,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAC7E,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CACrD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE;YAC1B,MAAM,EAAE,KAAK;YACb,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,SAAS;SACrE,CAAC,CAAC;QACH,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC;YAAE,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1C,2FAA2F;YAC3F,+EAA+E;YAC/E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CACrC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAC1B,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;YACF,OAAO,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE;IAC9D,+EAA+E;IAC/E,EAAE,mBAAmB,EAAE,IAAI,2BAA2B,EAAE,EAAE,CAC3D,CAAC;IACF,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE;QAC7B,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,oBAAoB,CAAC;QACjD,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;KAC1B,CAAC,CAAC;IACH,iGAAiG;IACjG,UAAU,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7F,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,kBAAkB,EAAE,SAAS;QAC7B,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,+FAA+F;AAC/F,mGAAmG;AACnG,6FAA6F;AAC7F,8FAA8F;AAC9F,uCAAuC;AACvC,MAAM,UAAU,GAAG,CAAC,CAAkB,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CACJ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EACrF,GAAG,EACH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;AACJ,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AACzB,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAEzB,SAAS,MAAM,CAAC,CAAkB;IAChC,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,YAAY,CAAC,CAAkB;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAc,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAiC,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,8DAA8D;IAC9E,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,SAAS,CAAC,CAAkB,EAAE,MAAuB;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,8FAA8F;IAChG,CAAC;AACH,CAAC;AAED;uFACuF;AACvF,KAAK,UAAU,cAAc,CAAC,CAAkB,EAAE,KAAa;IAC7D,IAAI,CAAC;QACH,OAAO,MAAM,iBAAiB,CAC5B,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EACzE,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,CAAC,YAAY,YAAY,CAAC;YAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QAC7E,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,yFAAyF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,SAAS,CAChB,CAAkB,EAClB,IAAkF;IAElF,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,SAAS,GAAiB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACpD,2EAA2E;QAC3E,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,EAAE;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,WAAW;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/D,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC;IAC5D,OAAO,IAAI,eAAe,CAAC;QACzB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;QAClC,wFAAwF;QACxF,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QAChD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,iGAAiG;QACjG,2DAA2D;QAC3D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAClD,8FAA8F;QAC9F,0FAA0F;QAC1F,kFAAkF;QAClF,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,KAAK,EAAE,SAAS;QAChB,2FAA2F;QAC3F,8FAA8F;QAC9F,iGAAiG;QACjG,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAY,EAAE,IAAe,EAAE,MAAc;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAKrB,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,uBAAuB,CAAC;IAClE,IAAI,IAAI;QAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,IACE,KAAK;QACL,CAAC,CACC,IAAI;YACJ,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,KAAK,KAAK,CAAC,OAAO;YAChD,MAAM,EAAE,OAAO,EAAE,eAAe,KAAK,KAAK,CAAC,eAAe,CAC3D,EACD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,UAAU;gBAChB,OAAO,EACL,mGAAmG;gBACrG,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK;gBACnD,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;aACrC;SACF,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,CAAkB,EAClB,QAAgB,EAChB,EAAE,cAAc,EAAE,OAAO,EAAc;IAEvC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACnD,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACzB,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;KACzC,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ;QAClC,OAAO,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,eAAe,kBAAkB,OAAO,EAAE;KAC/E,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,WAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;AAE3F,0GAA0G;AAC1G,SAAS,QAAQ,CAAC,MAA0B;IAC1C,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}

package/dist/routes/v1/mcp/oauth.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The tools of an AI app connected over OAuth (spec 2026-10-06 "Oracle side"; S3 review): which
+ * source a call acts on, and the per-submit approval in front of every `submit_claim`.
+ *
+ * Source: the user's sources are the ones they control or are a live member of (`storedGrant`, read
+ * per request, never cached past it), as far as the role reaches — `claims/submit` to submit or
+ * upload, `claims/read` to read. A CURRENT controller of an active source's organisation stands on
+ * it as root (D10, as `memberCaller`), member row or not; a source they also joined is listed once. Exactly one ⇒ it; several ⇒ `submit_claim` / `upload_file` take `sourceId`
+ * (`SOURCE_REQUIRED` lists them); none ⇒ `NO_SOURCE` with where to get one. OAuth never creates
+ * an account or a source.
+ *
+ * Approval: the token alone never pays. The first `submit_claim` files an `mcp_approvals` row and
+ * answers `APPROVAL_REQUIRED` with AuthHub's approve link; until the user answers, the same request
+ * answers `APPROVAL_PENDING`; once approved, the row is spent by one conditional UPDATE, THEN the
+ * claim is paid in-process with the delegation the user signed — at the price they saw: a price or
+ * billing mode that moved since is `APPROVAL_STALE` (a new approval, never the new price). A
+ * repeat of a claim that already exists answers it like any repeat: nothing left to pay.
+ */
+import { type DecisionsClient } from "@ixo/decision-oracle-client";
+import type { Context } from "hono";
+import type { AppEnv, OAuthSeam } from "../../../context.js";
+import type { OAuthIdentity } from "../../../lib/oauth/token.js";
+import { type AcceptedClaim, type SubmitArgs, type ToolClients } from "./tools.js";
+type ClientFor = (seam: OAuthSeam, paymentDelegation?: string) => DecisionsClient;
+export declare function oauthClients(c: Context<AppEnv>, identity: OAuthIdentity, clientFor: ClientFor, acceptedOn: (sourceId: string, args: SubmitArgs) => Promise<AcceptedClaim | null>): ToolClients;
+export {};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/routes/v1/mcp/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/mcp/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAkC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAK9D,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,EAGjB,MAAM,SAAS,CAAC;AAEjB,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;AAKlF,wBAAgB,YAAY,CAC1B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,GAChF,WAAW,CAseb"}