@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/lib/oauth/token.js

@@ -0,0 +1,129 @@
+/**
+ * MCP over OAuth, the oracle as RESOURCE SERVER (spec 2026-10-06 "Oracle side"; S3 review §4):
+ * the access token AuthHub mints for `/v1/mcp` and the discovery document that points a client at
+ * AuthHub. AuthHub is the one authorization server (`AUTH_HUB_URL`, network-defaulted); the
+ * oracle never sees a user's key, only this 5-minute JWT.
+ *
+ * A token is accepted only if EVERY one holds: EdDSA (no other `alg`, so no `none` and no HMAC
+ * confusion), `typ: at+jwt`, signed by a key in AuthHub's JWKS, `iss` exactly AuthHub, `aud`
+ * exactly THIS oracle's MCP URL (scheme, host and path — RFC 8707, so a token for one oracle is
+ * useless at another; one `aud`, never a list), unexpired within 60 s of skew, issued (`iat`) at
+ * most 10 minutes ago, and `sub` a `did:ixo` account. The JWKS is read through KV (`readCache`) and
+ * fetched only through `fetchClient`; a miss or a `kid` it does not list fetches it, at most once
+ * per REFETCH_MS per isolate, so neither junk `kid`s nor an outage turn into a stream of fetches.
+ *
+ * A token is accepted on `/v1/mcp` only (`routes/v1/mcp`): `/v1/api` never parses one.
+ */
+import { createLocalJWKSet, errors as joseErrors, jwtVerify, } from "jose";
+import { AccountDid } from "../../contracts/api.js";
+import { AppError } from "../errors.js";
+import { fetchClient } from "../http/client.js";
+import { webDidOf } from "../ixo/web-did.js";
+import { readCache } from "../metrics.js";
+/** The scopes AuthHub grants (its plan, Global Constraints): exactly these two. */
+export const OAUTH_SCOPES = ["claims:write", "claims:read"];
+const SKEW_SEC = 60;
+const MAX_TOKEN_AGE = "10m";
+const JWKS_TTL_SEC = 300;
+/** At most one forced JWKS fetch (an unknown `kid`) per isolate this often. */
+const REFETCH_MS = 30_000;
+let lastRefetch = 0;
+/** http only for a local host, as the engine client and AuthHub's own `issuer()` do. */
+const origin = (host) => `${host.startsWith("localhost") ? "http" : "https"}://${host}`;
+/** The resource every token must be for: this oracle's MCP endpoint, exactly. */
+export const mcpResource = (config) => `${origin(config.ORACLE_HOSTNAME)}/v1/mcp`;
+/** RFC 9728's well-known location for that resource. */
+export const prmUrl = (config) => `${origin(config.ORACLE_HOSTNAME)}/.well-known/oauth-protected-resource/v1/mcp`;
+/** AuthHub's `did:web` — the one invoker of the approvals back-channel. */
+export const authHubDid = (config) => webDidOf(new URL(config.AUTH_HUB_URL).host);
+/** RFC 9728 protected-resource metadata for `/v1/mcp`. */
+export const protectedResource = (config) => ({
+    resource: mcpResource(config),
+    authorization_servers: [config.AUTH_HUB_URL],
+    scopes_supported: [...OAUTH_SCOPES],
+    bearer_methods_supported: ["header"],
+});
+/** A bearer that is not ours to accept: the caller gets 401 and goes back through OAuth. */
+export class InvalidToken extends Error {
+}
+/** Three base64url segments: the only bearer shape `/v1/mcp` treats as an OAuth token. */
+export const looksLikeJwt = (token) => /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
+export async function verifyAccessToken(deps, token) {
+    const { config } = deps;
+    let payload;
+    try {
+        ({ payload } = await jwtVerify(token, (header) => keyFor(deps, header), {
+            algorithms: ["EdDSA"],
+            typ: "at+jwt",
+            issuer: config.AUTH_HUB_URL,
+            audience: mcpResource(config),
+            clockTolerance: SKEW_SEC,
+            // AuthHub mints 5-minute tokens: one issued longer ago than this is not one of them.
+            maxTokenAge: MAX_TOKEN_AGE,
+            requiredClaims: ["exp", "iat", "sub"],
+        }));
+    }
+    catch (err) {
+        if (err instanceof joseErrors.JOSEError)
+            throw new InvalidToken(err.code);
+        throw err;
+    }
+    const { sub, client_id, client_name, verified, gid, scope, aud } = payload;
+    // One audience, this one: a token minted for several resources is not bound to this oracle.
+    if (typeof aud !== "string")
+        throw new InvalidToken("aud is not a single resource");
+    if (!AccountDid.safeParse(sub).success)
+        throw new InvalidToken("sub is not a did:ixo account");
+    if (typeof client_id !== "string" || !client_id || typeof gid !== "string" || !gid) {
+        throw new InvalidToken("client_id or gid missing");
+    }
+    const asked = typeof scope === "string" ? scope.split(" ") : [];
+    return {
+        did: sub,
+        clientId: client_id,
+        clientName: typeof client_name === "string" && client_name ? client_name : client_id,
+        clientVerified: verified === true,
+        grantId: gid,
+        scopes: OAUTH_SCOPES.filter((s) => asked.includes(s)),
+    };
+}
+/**
+ * The verification key for `header.kid`, from the cached JWKS. A KV miss or an unknown `kid`
+ * fetches it — at most once per REFETCH_MS per isolate, either way, so neither junk `kid`s nor an
+ * AuthHub outage (every request a miss) becomes a stream of fetches.
+ */
+async function keyFor(deps, header) {
+    const kv = `oauth-jwks:${deps.config.AUTH_HUB_URL}`;
+    let set = await readCache("oauth-jwks", () => deps.cache.get(kv, "json"));
+    const known = (s) => !!s?.keys.some((k) => k.kid === header.kid);
+    if (!known(set) && Date.now() - lastRefetch > REFETCH_MS) {
+        lastRefetch = Date.now();
+        set = await fetchJwks(deps);
+        await deps.cache.put(kv, JSON.stringify(set), { expirationTtl: JWKS_TTL_SEC }).catch(() => { });
+    }
+    // Not the token's fault: AuthHub's keys are unreadable right now (503, retry).
+    if (!set)
+        throw AppError.unavailable("AuthHub's signing keys are not available yet");
+    return createLocalJWKSet(set)(header);
+}
+async function fetchJwks(deps) {
+    const url = `${deps.config.AUTH_HUB_URL}/.well-known/jwks.json`;
+    let res;
+    try {
+        res = await fetchClient(url, {
+            trace: deps.trace,
+            attempts: 2,
+            timeoutMs: 5_000,
+            headers: { accept: "application/json" },
+        });
+    }
+    catch (err) {
+        throw AppError.unavailable("AuthHub's JWKS could not be reached", err);
+    }
+    const body = (await res.json().catch(() => null));
+    if (!res.ok || !Array.isArray(body?.keys)) {
+        throw AppError.unavailable(`AuthHub's JWKS answered ${res.status}`);
+    }
+    return body;
+}
+//# sourceMappingURL=token.js.map

package/dist/lib/oauth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/lib/oauth/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,iBAAiB,EAGjB,MAAM,IAAI,UAAU,EACpB,SAAS,GACV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,aAAa,CAAU,CAAC;AAkBrE,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,+EAA+E;AAC/E,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,wFAAwF;AACxF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,IAAI,EAAE,CAAC;AAEhG,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAuC,EAAU,EAAE,CAC7E,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAuC,EAAU,EAAE,CACxE,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,8CAA8C,CAAC;AAElF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAoC,EAAU,EAAE,CACzE,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC;AAE9C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwD,EAAE,EAAE,CAAC,CAAC;IAC9F,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC;IAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;IAC5C,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;IACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;CACrC,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAE1C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAW,EAAE,CACrD,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAQjE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAe,EAAE,KAAa;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;YACtE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,MAAM,CAAC,YAAY;YAC3B,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC;YAC7B,cAAc,EAAE,QAAQ;YACxB,qFAAqF;YACrF,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;SACtC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,CAAC,SAAS;YAAE,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC3E,4FAA4F;IAC5F,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACpF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAC/F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;QACnF,MAAM,IAAI,YAAY,CAAC,0BAA0B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO;QACL,GAAG,EAAE,GAAa;QAClB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACpF,cAAc,EAAE,QAAQ,KAAK,IAAI;QACjC,OAAO,EAAE,GAAG;QACZ,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CAAC,IAAe,EAAE,MAA2B;IAChE,MAAM,EAAE,GAAG,cAAc,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACpD,IAAI,GAAG,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,UAAU,EAAE,CAAC;QACzD,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,GAAG;QAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,8CAA8C,CAAC,CAAC;IACrF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAe;IACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,wBAAwB,CAAC;IAChE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAC;IAC1E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,QAAQ,CAAC,WAAW,CAAC,2BAA2B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/payments/extend.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Hold a paid claim's reservation through its human review (payments spec §4; Go Prod §10). The
+ * facilitator releases a reservation 24 h after `/verify`, but a `pending_review` decision has no
+ * receipt to settle on until a reviewer answers — up to 30 days. So when the decision row lands
+ * `pending_review`, `POST /v1/reservations/extend` asks for verify + 30 days — the facilitator
+ * clamps it to its own bound and answers the expiry it really holds to — and that `expiresAt` lands
+ * on the charge row (`reservationExpiresAt`): the reconcile's expiry arm and the review's deadline
+ * read it.
+ *
+ * Called by the workflow right after a `pending_review` decision row, and by the reconcile for a
+ * row still unextended (the workflow's call was lost). Only a `reserved` row not yet extended is
+ * asked for; the facilitator is idempotent anyway.
+ *
+ * NEVER throws. A refusal (404 not ours, 409 `reservation_not_reserved`) is logged and leaves the
+ * row as it was — the 24 h expiry then stands. A 422 should no longer happen (the facilitator
+ * clamps): logged loudly and the row marked `extend_refused` (status unchanged), so the reconcile
+ * never asks again. An outage or an unexpected answer is `skipped` for the reconcile to retry.
+ */
+import type { Database } from "../../db/client.js";
+import { type FacilitatorDeps } from "./facilitator.js";
+export type ExtendDeps = FacilitatorDeps & {
+    db: Database;
+};
+export type ExtendOutcome = {
+    status: "extended";
+    expiresAt: Date;
+} | {
+    status: "refused";
+    reason: string;
+} | {
+    status: "skipped";
+    reason: "no_charge" | "not_reserved" | "already_extended" | "unavailable";
+};
+/** On a `reserved` row: the facilitator refused to extend it (422) — never asked again. */
+export declare const EXTEND_REFUSED = "extend_refused";
+export declare function extendForReview(deps: ExtendDeps, claimId: string): Promise<ExtendOutcome>;
+/** The reservation's expiry as the oracle reckons it: the extended one, else 24 h from verify. */
+export declare const reservationExpiry: (charge: {
+    createdAt: Date;
+    reservationExpiresAt: Date | null;
+}) => Date;
+//# sourceMappingURL=extend.d.ts.map

package/dist/lib/payments/extend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extend.d.ts","sourceRoot":"","sources":["../../../src/lib/payments/extend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAE9E,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG;IAAE,EAAE,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,kBAAkB,GAAG,aAAa,CAAC;CAC3E,CAAC;AAIN,2FAA2F;AAC3F,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,wBAAsB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAiE/F;AAED,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,WAAY;IACxC,SAAS,EAAE,IAAI,CAAC;IAChB,oBAAoB,EAAE,IAAI,GAAG,IAAI,CAAC;CACnC,KAAG,IAAoF,CAAC"}

package/dist/lib/payments/extend.js

@@ -0,0 +1,98 @@
+/**
+ * Hold a paid claim's reservation through its human review (payments spec §4; Go Prod §10). The
+ * facilitator releases a reservation 24 h after `/verify`, but a `pending_review` decision has no
+ * receipt to settle on until a reviewer answers — up to 30 days. So when the decision row lands
+ * `pending_review`, `POST /v1/reservations/extend` asks for verify + 30 days — the facilitator
+ * clamps it to its own bound and answers the expiry it really holds to — and that `expiresAt` lands
+ * on the charge row (`reservationExpiresAt`): the reconcile's expiry arm and the review's deadline
+ * read it.
+ *
+ * Called by the workflow right after a `pending_review` decision row, and by the reconcile for a
+ * row still unextended (the workflow's call was lost). Only a `reserved` row not yet extended is
+ * asked for; the facilitator is idempotent anyway.
+ *
+ * NEVER throws. A refusal (404 not ours, 409 `reservation_not_reserved`) is logged and leaves the
+ * row as it was — the 24 h expiry then stands. A 422 should no longer happen (the facilitator
+ * clamps): logged loudly and the row marked `extend_refused` (status unchanged), so the reconcile
+ * never asks again. An outage or an unexpected answer is `skipped` for the reconcile to retry.
+ */
+import { and, eq } from "drizzle-orm";
+import { apiCharges } from "../../db/schema.js";
+import { DAY_MS } from "../api-lane/retention.js";
+import { reportAlert, reportError } from "../sentry.js";
+import { createFacilitatorClient } from "./facilitator.js";
+/** What a review may take; the facilitator decides the real bound (it clamps `until`). */
+const REVIEW_HOLD_MS = 30 * DAY_MS;
+/** On a `reserved` row: the facilitator refused to extend it (422) — never asked again. */
+export const EXTEND_REFUSED = "extend_refused";
+export async function extendForReview(deps, claimId) {
+    const { db, logger } = deps;
+    try {
+        const charge = await db.query.apiCharges.findFirst({
+            columns: {
+                status: true,
+                createdAt: true,
+                reservationExpiresAt: true,
+                lane: true,
+                collectionId: true,
+            },
+            where: eq(apiCharges.claimId, claimId),
+        });
+        // A free source (billing mode `none`) records no charge: nothing was reserved.
+        if (!charge)
+            return { status: "skipped", reason: "no_charge" };
+        if (charge.status !== "reserved")
+            return { status: "skipped", reason: "not_reserved" };
+        if (charge.reservationExpiresAt)
+            return { status: "skipped", reason: "already_extended" };
+        const until = new Date(charge.createdAt.getTime() + REVIEW_HOLD_MS);
+        // A chain claim (review billing) is named by its collection too, as its offer was (0.7.0).
+        const chain = charge.lane === "chain" && charge.collectionId
+            ? { lane: "chain", collectionId: charge.collectionId }
+            : undefined;
+        const answer = await createFacilitatorClient(deps).extend(claimId, until, chain);
+        if (!answer.ok) {
+            const reason = answer.code ?? `http_${answer.status}`;
+            if (answer.status !== 422) {
+                logger.warn("payments.extend.refused", { claimId, status: answer.status, reason });
+                // Not ours to hold (404): the reservation went somewhere we did not expect — an issue to
+                // look at, not a page (the 24 h expiry still stands).
+                if (answer.status === 404) {
+                    reportError(new Error("payments.extend.refused"), {
+                        lane: "payments",
+                        step: "extend",
+                        claimId,
+                        context: { status: answer.status, reason },
+                    });
+                }
+                return { status: "refused", reason };
+            }
+            // A contract drift, not a payer's problem: loud, and marked so the reconcile stops asking.
+            logger.error("payments.extend.refused", { claimId, status: answer.status, reason });
+            // A paid review that loses its hold at 24 h: its operator may not be paid. Once per claim —
+            // the mark below keeps the reconcile from asking again.
+            await reportAlert(deps, "payments.extend.refused", { claimId, code: reason });
+            await db
+                .update(apiCharges)
+                .set({ error: EXTEND_REFUSED })
+                .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "reserved")));
+            return { status: "refused", reason };
+        }
+        await db
+            .update(apiCharges)
+            .set({ reservationExpiresAt: answer.expiresAt })
+            .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "reserved")));
+        logger.info("payments.extended", { claimId, expiresAt: answer.expiresAt.toISOString() });
+        return { status: "extended", expiresAt: answer.expiresAt };
+    }
+    catch (err) {
+        logger.warn("payments.extend.unavailable", {
+            claimId,
+            detail: err instanceof Error ? err.message : String(err),
+        });
+        return { status: "skipped", reason: "unavailable" };
+    }
+}
+/** The reservation's expiry as the oracle reckons it: the extended one, else 24 h from verify. */
+export const reservationExpiry = (charge) => charge.reservationExpiresAt ?? new Date(charge.createdAt.getTime() + DAY_MS);
+//# sourceMappingURL=extend.js.map

package/dist/lib/payments/extend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extend.js","sourceRoot":"","sources":["../../../src/lib/payments/extend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAwB,MAAM,eAAe,CAAC;AAY9E,0FAA0F;AAC1F,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AACnC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAgB,EAAE,OAAe;IACrE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;gBACf,oBAAoB,EAAE,IAAI;gBAC1B,IAAI,EAAE,IAAI;gBACV,YAAY,EAAE,IAAI;aACnB;YACD,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;SACvC,CAAC,CAAC;QACH,+EAA+E;QAC/E,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACvF,IAAI,MAAM,CAAC,oBAAoB;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAE1F,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC;QACpE,2FAA2F;QAC3F,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,YAAY;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YAC/D,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnF,yFAAyF;gBACzF,sDAAsD;gBACtD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC1B,WAAW,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE;wBAChD,IAAI,EAAE,UAAU;wBAChB,IAAI,EAAE,QAAQ;wBACd,OAAO;wBACP,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACvC,CAAC;YACD,2FAA2F;YAC3F,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACpF,4FAA4F;YAC5F,wDAAwD;YACxD,MAAM,WAAW,CAAC,IAAI,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9E,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;iBAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YAClF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;aAC/C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YACzC,OAAO;YACP,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAGjC,EAAQ,EAAE,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC"}

package/dist/lib/payments/facilitator.d.ts

@@ -0,0 +1,220 @@
+/**
+ * The facilitator client (`ixoworld/ixo-pay-facilitator`, payments spec §13.0–§13.2: standard x402
+ * v2 plus our additions) — the ONE place the oracle talks to it. Every call is a UCAN
+ * invocation self-signed by our did:web, addressed to the facilitator's did:web (resolved from its
+ * `/.well-known/did.json`), one token reused until near expiry — the engine client's pattern.
+ *
+ * Only what this oracle reads is validated here, with local Zod: the facilitator's own package is
+ * not a dependency, and its responses are forwarded (the 402, `PAYMENT-RESPONSE`) verbatim.
+ *
+ * Unreachable, a 5xx, or a refusal the payer cannot act on (an `/offers` 422, an auth failure) is
+ * `AppError.unavailable` — the router answers `503 SOURCE_PAUSED { reason: payments-disabled }`.
+ * An answer of the wrong shape is a loud 500, never a half-read payment.
+ */
+import { z } from "zod";
+import type { Config } from "../../config.js";
+import { AppError } from "../errors.js";
+import type { Logger } from "../logger.js";
+import type { TraceContext } from "../tracing.js";
+export interface FacilitatorDeps {
+    config: Config;
+    logger: Logger;
+    trace: TraceContext;
+    /** CACHE_KV — the facilitator's did:web, the offers, the verified headers. */
+    cache: KVNamespace;
+}
+export declare const OffersResponse: z.ZodObject<{
+    offerId: z.ZodString;
+    expiresAt: z.ZodISODateTime;
+    paymentRequired: z.ZodObject<{
+        x402Version: z.ZodLiteral<2>;
+    }, z.core.$loose>;
+}, z.core.$strip>;
+export type OffersResponse = z.infer<typeof OffersResponse>;
+/** `/offers` refused (422): still `UNAVAILABLE` to a router, its code for a caller that routes it. */
+export declare class OfferRefused extends AppError {
+    readonly refusal: string;
+    constructor(refusal: string);
+}
+/** `payer`: an IXO account (PAY, and card — bound to one), or the EVM account that signed an
+ *  `exact` payment (USDC on Base). */
+export declare const VerifyResponse: z.ZodUnion<readonly [z.ZodObject<{
+    isValid: z.ZodLiteral<true>;
+    payer: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+}, z.core.$loose>, z.ZodObject<{
+    isValid: z.ZodLiteral<false>;
+    invalidReason: z.ZodString;
+}, z.core.$loose>]>;
+export type VerifyResponse = z.infer<typeof VerifyResponse>;
+/** A refused `/settle` (`invalid_receipt`, `receipt_mismatch`, `reservation_released`, …). */
+export declare const SettleRefusal: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    errorReason: z.ZodString;
+}, z.core.$loose>;
+/** `/settle`: paid or `settlement_pending` (both carry the receipt), else a refusal with its code.
+ *  Loose on purpose: an answer of any other shape is the caller's to refuse to act on. */
+export declare const SettleResponse: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    transaction: z.ZodString;
+    network: z.ZodUnion<readonly [z.ZodString, z.ZodEnum<{
+        "stripe:live": "stripe:live";
+        "stripe:test": "stripe:test";
+    }>, z.ZodString]>;
+    payer: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+    extensions: z.ZodObject<{
+        "org.udid.receipt@1": z.ZodObject<{
+            settlementId: z.ZodString;
+            offerId: z.ZodString;
+            replayed: z.ZodBoolean;
+            claims: z.ZodArray<z.ZodObject<{
+                claimId: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+                state: z.ZodString;
+            }, z.core.$loose>>;
+            decision: z.ZodOptional<z.ZodObject<{
+                issuer: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$loose>;
+    }, z.core.$loose>;
+}, z.core.$loose>, z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    errorReason: z.ZodLiteral<"settlement_pending">;
+    transaction: z.ZodString;
+    network: z.ZodUnion<readonly [z.ZodString, z.ZodEnum<{
+        "stripe:live": "stripe:live";
+        "stripe:test": "stripe:test";
+    }>, z.ZodString]>;
+    payer: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+    extensions: z.ZodObject<{
+        "org.udid.receipt@1": z.ZodObject<{
+            settlementId: z.ZodString;
+            offerId: z.ZodString;
+            replayed: z.ZodBoolean;
+            claims: z.ZodArray<z.ZodObject<{
+                claimId: z.ZodUnion<readonly [z.ZodString, z.ZodString]>;
+                state: z.ZodString;
+            }, z.core.$loose>>;
+            decision: z.ZodOptional<z.ZodObject<{
+                issuer: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$loose>;
+    }, z.core.$loose>;
+}, z.core.$loose>]>, z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    errorReason: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{}, z.core.$loose>]>;
+/** `GET /v1/card/refunds/:claimId` — a card claim's refunds, as the facilitator (Stripe) has them.
+ *  `refundedAmountCents` sums the succeeded and pending ones; `refunded` = it is above 0. */
+export declare const CardRefunds: z.ZodObject<{
+    claimId: z.ZodString;
+    chargedAmountCents: z.ZodInt;
+    refundedAmountCents: z.ZodInt;
+    refunded: z.ZodBoolean;
+    refunds: z.ZodArray<z.ZodObject<{
+        refundId: z.ZodNullable<z.ZodString>;
+        amountCents: z.ZodInt;
+        at: z.ZodNullable<z.ZodISODateTime>;
+        status: z.ZodNullable<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+export type CardRefunds = z.infer<typeof CardRefunds>;
+/** `GET /settlements/:settlementId` — where each claim of one offer's settlement got to. */
+export declare const Settlement: z.ZodObject<{
+    settlementId: z.ZodString;
+    offerId: z.ZodString;
+    state: z.ZodString;
+    claims: z.ZodArray<z.ZodObject<{
+        claimId: z.ZodString;
+        state: z.ZodString;
+        transaction: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    result: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$loose>;
+export type Settlement = z.infer<typeof Settlement>;
+/**
+ * A chain claim's reservation key beside its claimId (x402-ixo-pay 0.7.0: reservations are unique
+ * by oracle, lane, collection and claim). Sent ONLY for a chain claim — the request bodies are
+ * strict, and an API claim's stay exactly as they were, so an older facilitator never sees them.
+ */
+export interface ChainScope {
+    lane: "chain";
+    collectionId: string;
+}
+/** Why a reservation is released (0.7.0's `reason`). */
+export type ReleaseReason = "facts_unusable" | "facts_invalid" | "claim_withdrawn" | "other";
+export interface PayerCreditsRead {
+    available: string;
+    /** Null when the facilitator did not say (the caller uses its own count). */
+    delegationRemaining: string | null;
+}
+export type SettleResponse = z.infer<typeof SettleResponse>;
+export interface UpayBalances {
+    asset: "upay";
+    balance: string;
+    sendLimit: string | null;
+    reserved: string;
+    settled: string;
+    paying: string;
+    available: string;
+}
+/**
+ * The facilitator itself cannot be reached (network, or its did.json) — as opposed to one call
+ * answering 5xx. Still `UNAVAILABLE` for the router; the crons stop their run on it.
+ */
+export declare class FacilitatorUnreachable extends AppError {
+    constructor(message: string, cause?: unknown);
+}
+export declare function facilitatorUrl(config: Pick<Config, "X402_FACILITATOR_URL">): string;
+export declare function createFacilitatorClient(deps: FacilitatorDeps): {
+    /** `POST /offers`. A 422 (`price_mismatch` / `plan_inactive`) is unavailable, logged loudly. */
+    offers(body: unknown): Promise<OffersResponse>;
+    /** `POST /verify` — reserves; `isValid: false` is an answer (HTTP 200), not an error. */
+    verify(body: unknown): Promise<VerifyResponse>;
+    /** `POST /settle` — `success: false` is an answer (HTTP 200), not an error. */
+    settle(body: unknown): Promise<SettleResponse>;
+    /**
+     * `POST /v1/reservations/extend` — hold a claim's reservation until `until` (its human review).
+     * Clamped to the facilitator's bound, and idempotent: an `until` at or before the current expiry
+     * answers the current one. A 404 / 409 /
+     * 422 is an answer (`ok: false` with its code); any other refusal is the operator's, loudly.
+     */
+    extend(claimId: string, until: Date, chain?: ChainScope): Promise<{
+        ok: true;
+        expiresAt: Date;
+    } | {
+        ok: false;
+        status: number;
+        code: string | null;
+    }>;
+    /**
+     * `POST /v1/reservations/release` (0.7.0) — free a chain claim's reservation that will never get
+     * a receipt, the amount back on the deed AND the delegation's cap. `released` for a release or
+     * its repeat (200) and for one no longer held (409 `reservation_not_reserved`: settled or lapsed
+     * — done either way); `not_found` for 404; an outage is `unavailable`, thrown.
+     */
+    release(claimId: string, chain: ChainScope, reason: ReleaseReason): Promise<"released" | "not_held" | "not_found">;
+    /**
+     * The payer's credits, read WITH their stored delegation (`X-Payment-Delegation`, 0.7.0): the
+     * facilitator shows an oracle a payer whose live delegation names it. Null when it will not
+     * say (403/404) — the caller fails closed. The delegation rides a header, never a log line.
+     */
+    payerCredits(payer: string, delegation: string): Promise<PayerCreditsRead | null>;
+    /** A card claim's refunds; null = not a paid card claim of ours (404) — a no-op, never an error. */
+    refunds(claimId: string): Promise<CardRefunds | null>;
+    /** `GET /settlements/:settlementId` — null when the facilitator has no such settlement. */
+    settlement(settlementId: string): Promise<Settlement | null>;
+    /**
+     * `GET /v1/balances?payer=` — the payer's `upay` available, base units ("0" without a deed).
+     * Null when the facilitator will not say: it shows an oracle only payers who reserved with it (403).
+     */
+    availableUpay(payer: string): Promise<string | null>;
+    /**
+     * The same read, the `upay` entry in full, for a person to look at (`GET /v1/api/me`). Never
+     * throws: a payer the facilitator will not show (403/404), an outage or an answer of the wrong
+     * shape is null — logged, since a page of account details must not fail on a balance.
+     */
+    balances(payer: string): Promise<UpayBalances | null>;
+};
+export type FacilitatorClient = ReturnType<typeof createFacilitatorClient>;
+//# sourceMappingURL=facilitator.d.ts.map

package/dist/lib/payments/facilitator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facilitator.d.ts","sourceRoot":"","sources":["../../../src/lib/payments/facilitator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAQ3C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIrC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,8EAA8E;IAC9E,KAAK,EAAE,WAAW,CAAC;CACpB;AAyBD,eAAO,MAAM,cAAc;;;;;;iBAKzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D,sGAAsG;AACtG,qBAAa,YAAa,SAAQ,QAAQ;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM;IAApC,YAAqB,OAAO,EAAE,MAAM,EAGnC;CACF;AAED;sCACsC;AACtC,eAAO,MAAM,cAAc;;;;;;mBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,8FAA8F;AAC9F,eAAO,MAAM,aAAa;;;iBAGxB,CAAC;AAEH;0FAC0F;AAC1F,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDAAmE,CAAC;AAE/F;6FAC6F;AAC7F,eAAO,MAAM,WAAW;;;;;;;;;;;iBActB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,4FAA4F;AAC5F,eAAO,MAAM,UAAU;;;;;;;;;;iBAYrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAUpD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wDAAwD;AACxD,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,GAAG,OAAO,CAAC;AAoB7F,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAOD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAkB5D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAG3C;CACF;AAKD,wBAAgB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,GAAG,MAAM,CAInF;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,eAAe;IAwJzD,gGAAgG;IAC1F,MAAM,OAAO,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAgBpD,yFAAyF;IACnF,MAAM,OAAO,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIpD,+EAA+E;IACzE,MAAM,OAAO,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIpD;;;;;OAKG;IACG,MAAM,UACD,MAAM,SACR,IAAI,UACH,UAAU,GACjB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAqB9F;;;;;OAKG;IACG,OAAO,UACF,MAAM,SACR,UAAU,UACT,aAAa,GACpB,OAAO,CAAC,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IAkBjD;;;;OAIG;IACG,YAAY,QAAQ,MAAM,cAAc,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAsBvF,oGAAoG;IAC9F,OAAO,UAAU,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS3D,2FAA2F;IACrF,UAAU,eAAe,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAalE;;;OAGG;IACG,aAAa,QAAQ,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAM1D;;;;OAIG;IACG,QAAQ,QAAQ,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;EAwB9D;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC"}