@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/routes/v1/api/export.js

@@ -0,0 +1,251 @@
+/**
+ * `GET /v1/api/export` (go-prod spec §6.3): the source's personal data as ONE JSON document — its
+ * settings, members (emails, DIDs), webhook endpoints (URLs, never secrets), every stored claim
+ * (body, metadata, submitter, attachment descriptors), its uploaded files (listed — a signed URL
+ * would expire long before anyone reads the archive), the webhook delivery log (targets, never
+ * payloads) and the review answers given on its claims — written to `API_UPLOADS` as an
+ * `api_uploads` row under `exports/` and handed back behind the same short-lived signed URL an
+ * upload gets. The file route serves it as an `attachment`; the row's one-day `deleteAt` lets the
+ * housekeeping sweep take it (a copy the organisation asked for, not its data). The `exports/` key
+ * is what keeps the archive from ever being named as a claim's attachment (`checkSubmission`,
+ * `acceptClaim` bind `uploads/` keys only).
+ *
+ * - **Memory stays bounded.** A source holds every body it has not erased, each up to the 1 MiB
+ *   request cap — more than a Worker can buffer. So every array is paged (claims a few at a time)
+ *   and the document streams into an R2 multipart upload in fixed parts (R2: every part but the
+ *   last the same size, ≥ 5 MiB); a part's leftover is copied out so the part's buffer can go.
+ * - **The `cid` is real.** The bytes are hashed incrementally as they stream — workerd's native
+ *   `crypto.DigestStream` (standard WebCrypto has no incremental digest; this Workers extension
+ *   does, off the JS heap) — so the row carries the same `raw` sha2-256 CID `cidForBytes` would
+ *   give the whole file — no placeholder, no etag standing in for one.
+ * - **The row lands before the object**, as an upload's does: the object exists only once the
+ *   multipart upload completes, and the row is written just before that. A failure before it
+ *   aborts the upload (R2 aborts a forgotten one after 7 days anyway); a failed `complete` leaves a
+ *   row the sweep removes harmlessly.
+ * - **Erased stays erased.** A body the erase route nulled exports as null;
+ *   nothing is re-derived from digests or webhook payloads.
+ */
+import { and, asc, eq, gt, like, or } from "drizzle-orm";
+import { Hono } from "hono";
+import { apiClaims, apiMembers, apiUploads, claimReviews, matrixDeliveries, webhookEndpoints, } from "../../../db/schema.js";
+import { sourceRoots } from "../../../lib/api-lane/company.js";
+import { EXPORT_KEY_PREFIX, newId, UPLOAD_KEY_PREFIX } from "../../../lib/api-lane/ids.js";
+import { submittedViaOfRow } from "../../../lib/api-lane/record.js";
+import { DAY_MS } from "../../../lib/api-lane/retention.js";
+import { cidForSha256 } from "../../../lib/hash.js";
+import { audit } from "../../../middleware/api/audit.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { chainOf } from "../../../middleware/api/console.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { signedFileUrl } from "./uploads.js";
+import { endpointView, memberView, sourceView } from "./views.js";
+export const dataExport = new Hono();
+/** 8 MiB parts: over R2's 5 MiB floor, one part's buffer is the Worker's whole overhead. */
+const PART_BYTES = 8 * 1024 * 1024;
+/** Claims per D1 read: at the 1 MiB body cap a page (read, then re-serialised) stays a few MiB. */
+const CLAIMS_PAGE = 8;
+/** Rows per D1 read of the small tables (uploads, deliveries, reviews). */
+const PAGE = 100;
+/** The export is a one-shot download (a copy, not the source's data): the sweep takes it after a day. */
+const EXPORT_TTL_MS = DAY_MS;
+dataExport.get("/export", access({ op: "exportSourceData", scope: "none", capability: "source/*" }), async (c) => {
+    const { source } = sourceOf(c);
+    const bucket = c.env.API_UPLOADS;
+    if (!bucket) {
+        throw new ApiError("UPLOADS_DISABLED", "This oracle has no file storage set up, so it can't export data. Contact the oracle's operator.");
+    }
+    const db = await c.var.db();
+    const [members, endpoints] = await Promise.all([
+        db.query.apiMembers.findMany({
+            where: eq(apiMembers.sourceId, source.sourceId),
+            orderBy: [asc(apiMembers.invitedAt), asc(apiMembers.memberId)],
+        }),
+        db.query.webhookEndpoints.findMany({
+            where: eq(webhookEndpoints.sourceId, source.sourceId),
+            orderBy: [asc(webhookEndpoints.createdAt), asc(webhookEndpoints.endpointId)],
+        }),
+    ]);
+    const roots = await sourceRoots(chainOf(c), source);
+    const now = new Date();
+    const uploadId = newId("upl", now);
+    const r2Key = `${EXPORT_KEY_PREFIX}${source.sourceId}/${uploadId.slice("upl_".length)}`;
+    const upload = await bucket.createMultipartUpload(r2Key, {
+        httpMetadata: { contentType: "application/json" },
+    });
+    const out = new PartWriter(upload);
+    const { sourceId } = source;
+    let claims = 0;
+    try {
+        // The document by hand around the arrays, so no array's rows ever sit in memory together.
+        const head = JSON.stringify({
+            exportedAt: now.toISOString(),
+            source: sourceView(source),
+            members: members.map((m) => memberView(m, roots, now)),
+            webhookEndpoints: endpoints.map(endpointView),
+        });
+        await out.write(head.slice(0, -1));
+        claims = await writeArray(out, "claims", CLAIMS_PAGE, claimView, (after) => db
+            .select()
+            .from(apiClaims)
+            .where(and(eq(apiClaims.sourceId, sourceId), after
+            ? or(gt(apiClaims.receivedAt, after.receivedAt), and(eq(apiClaims.receivedAt, after.receivedAt), gt(apiClaims.claimId, after.claimId)))
+            : undefined))
+            .orderBy(asc(apiClaims.receivedAt), asc(apiClaims.claimId))
+            .limit(CLAIMS_PAGE));
+        // Files are listed, not linked: a signed URL would expire long before anyone reads the archive.
+        // Earlier exports are not the source's data, so they are not in the list.
+        await writeArray(out, "uploads", PAGE, uploadView, (after) => db
+            .select({
+            uploadId: apiUploads.uploadId,
+            claimId: apiUploads.claimId,
+            mediaType: apiUploads.mediaType,
+            size: apiUploads.size,
+            createdAt: apiUploads.createdAt,
+        })
+            .from(apiUploads)
+            .where(and(eq(apiUploads.sourceId, sourceId), like(apiUploads.r2Key, `${UPLOAD_KEY_PREFIX}%`), after ? gt(apiUploads.uploadId, after.uploadId) : undefined))
+            .orderBy(asc(apiUploads.uploadId))
+            .limit(PAGE));
+        // Where each event went, never what it carried (the claims above already are the data).
+        await writeArray(out, "webhookDeliveries", PAGE, deliveryView, (after) => db
+            .select({
+            id: matrixDeliveries.dedupeKey,
+            eventType: matrixDeliveries.eventType,
+            targetUrl: matrixDeliveries.targetUrl,
+            status: matrixDeliveries.status,
+            createdAt: matrixDeliveries.createdAt,
+        })
+            .from(matrixDeliveries)
+            .where(and(eq(matrixDeliveries.sourceId, sourceId), eq(matrixDeliveries.kind, "webhook"), after ? gt(matrixDeliveries.dedupeKey, after.id) : undefined))
+            .orderBy(asc(matrixDeliveries.dedupeKey))
+            .limit(PAGE));
+        await writeArray(out, "reviews", PAGE, reviewView, (after) => db
+            .select({
+            claimId: claimReviews.claimId,
+            answers: claimReviews.answers,
+            reviewerDid: claimReviews.reviewerDid,
+            answeredAt: claimReviews.answeredAt,
+        })
+            .from(claimReviews)
+            .innerJoin(apiClaims, eq(apiClaims.claimId, claimReviews.claimId))
+            .where(and(eq(apiClaims.sourceId, sourceId), after ? gt(claimReviews.claimId, after.claimId) : undefined))
+            .orderBy(asc(claimReviews.claimId))
+            .limit(PAGE));
+        await out.write("}");
+        const parts = await out.flushAll();
+        await db.insert(apiUploads).values({
+            uploadId,
+            sourceId: source.sourceId,
+            r2Key,
+            cid: cidForSha256(await out.digest()),
+            mediaType: "application/json",
+            size: out.size,
+            deleteAt: new Date(now.getTime() + EXPORT_TTL_MS),
+            createdAt: now,
+        });
+        await upload.complete(parts);
+    }
+    catch (err) {
+        await upload.abort().catch(() => { });
+        throw err;
+    }
+    await audit(c, "source.exported", source.sourceId, { uploadId, claims, size: out.size });
+    const url = await signedFileUrl(c, uploadId);
+    const body = {
+        url,
+        expiresAt: new Date(Number(new URL(url).searchParams.get("exp")) * 1000).toISOString(),
+    };
+    return c.json(body);
+});
+/**
+ * A claim as the source stored it — the personal data of §6.3 plus what identifies it. Not `content`:
+ * it repeats `body`'s answers, attachments, submitter and metadata as sent.
+ */
+const claimView = (row) => ({
+    claimId: row.claimId,
+    protocolDid: row.protocolDid,
+    contentDigest: row.contentDigest,
+    receivedAt: row.receivedAt.toISOString(),
+    submitter: row.submitter,
+    submittedBy: row.submittedBy,
+    submittedVia: submittedViaOfRow(row),
+    metadata: row.metadata,
+    body: row.body,
+    attachments: row.attachments,
+    webhookUrl: row.webhookUrl,
+    bodyErasedAt: row.bodyErasedAt?.toISOString() ?? null,
+});
+/**
+ * `,"<name>":[…]` — the rows `page` reads, keyset-paged `size` at a time off the last row; the
+ * count written.
+ */
+async function writeArray(out, name, size, view, page) {
+    await out.write(`,"${name}":[`);
+    let n = 0;
+    for (let after;;) {
+        const rows = await page(after);
+        for (const row of rows)
+            await out.write(`${n++ ? "," : ""}${JSON.stringify(view(row))}`);
+        if (rows.length < size)
+            break;
+        after = rows.at(-1);
+    }
+    await out.write("]");
+    return n;
+}
+const uploadView = (row) => ({ ...row, createdAt: row.createdAt.toISOString() });
+const deliveryView = (row) => ({
+    ...row,
+    // The wire's word for it, as the delivery log says (webhooks.ts).
+    status: row.status === "sent" ? "delivered" : row.status,
+    createdAt: row.createdAt.toISOString(),
+});
+const reviewView = (row) => ({ ...row, answeredAt: row.answeredAt.toISOString() });
+const encoder = new TextEncoder();
+/** Text in, fixed-size multipart parts out, hashed as it goes. Exported for its test. */
+export class PartWriter {
+    upload;
+    hash = new crypto.DigestStream("SHA-256");
+    hasher = this.hash.getWriter();
+    size = 0;
+    buffered = [];
+    bufferedBytes = 0;
+    parts = [];
+    constructor(upload) {
+        this.upload = upload;
+    }
+    async write(text) {
+        const bytes = encoder.encode(text);
+        await this.hasher.write(bytes);
+        this.size += bytes.byteLength;
+        this.buffered.push(bytes);
+        this.bufferedBytes += bytes.byteLength;
+        while (this.bufferedBytes >= PART_BYTES)
+            await this.uploadPart(PART_BYTES);
+    }
+    /** The sha2-256 of everything written — once, after the last write. */
+    async digest() {
+        await this.hasher.close();
+        return new Uint8Array(await this.hash.digest);
+    }
+    /** The last (short) part; every part before it was exactly `PART_BYTES`. */
+    async flushAll() {
+        if (this.bufferedBytes > 0)
+            await this.uploadPart(this.bufferedBytes);
+        return this.parts;
+    }
+    async uploadPart(n) {
+        const all = new Uint8Array(this.bufferedBytes);
+        let offset = 0;
+        for (const chunk of this.buffered) {
+            all.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        // A copy, not a view: a view would pin the whole part's buffer until the next part.
+        const rest = all.slice(n);
+        this.buffered = rest.byteLength ? [rest] : [];
+        this.bufferedBytes = rest.byteLength;
+        this.parts.push(await this.upload.uploadPart(this.parts.length + 1, all.subarray(0, n)));
+    }
+}
+//# sourceMappingURL=export.js.map

package/dist/routes/v1/api/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAEL,SAAS,EACT,UAAU,EACV,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE/D,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAU,CAAC;AAE7C,4FAA4F;AAC5F,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,mGAAmG;AACnG,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,2EAA2E;AAC3E,MAAM,IAAI,GAAG,GAAG,CAAC;AACjB,yGAAyG;AACzG,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,UAAU,CAAC,GAAG,CACZ,SAAS,EACT,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACzE,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC3B,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC/C,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SAC/D,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YACjC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;SAC7E,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,iBAAiB,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;KAClD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,0FAA0F;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;YAC1B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACtD,gBAAgB,EAAE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,KAAgB,EAAE,EAAE,CACpF,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAChC,KAAK;YACH,CAAC,CAAC,EAAE,CACA,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAC1C,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAC1C,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACrC,CACF;YACH,CAAC,CAAC,SAAS,CACd,CACF;aACA,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;aAC1D,KAAK,CAAC,WAAW,CAAC,CACtB,CAAC;QACF,gGAAgG;QAChG,0EAA0E;QAC1E,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,KAA4B,EAAE,EAAE,CAClF,EAAE;aACC,MAAM,CAAC;YACN,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;aACD,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACjC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,iBAAiB,GAAG,CAAC,EAC/C,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAC5D,CACF;aACA,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;aACjC,KAAK,CAAC,IAAI,CAAC,CACf,CAAC;QACF,wFAAwF;QACxF,MAAM,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,KAAsB,EAAE,EAAE,CACxF,EAAE;aACC,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,SAAS;YAC9B,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,SAAS,EAAE,gBAAgB,CAAC,SAAS;SACtC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACvC,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,EACpC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAC7D,CACF;aACA,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;aACxC,KAAK,CAAC,IAAI,CAAC,CACf,CAAC;QACF,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,KAA2B,EAAE,EAAE,CACjF,EAAE;aACC,MAAM,CAAC;YACN,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,UAAU,EAAE,YAAY,CAAC,UAAU;SACpC,CAAC;aACD,IAAI,CAAC,YAAY,CAAC;aAClB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;aACjE,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAChC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAC5D,CACF;aACA,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;aAClC,KAAK,CAAC,IAAI,CAAC,CACf,CAAC;QACF,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QAEnC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YACjC,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;YACL,GAAG,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,kBAAkB;YAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC;YACjD,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAe;QACvB,GAAG;QACH,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACvF,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;IAChC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;IACxC,SAAS,EAAE,GAAG,CAAC,SAAS;IACxB,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC;IACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;IAC1B,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,IAAI;CACtD,CAAC,CAAC;AAEH;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAe,EACf,IAAY,EACZ,IAAY,EACZ,IAAyB,EACzB,IAA4C;IAE5C,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,KAAoB,IAAM,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM;QAC9B,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAMnB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAE3D,MAAM,YAAY,GAAG,CAAC,GAMrB,EAAE,EAAE,CAAC,CAAC;IACL,GAAG,GAAG;IACN,kEAAkE;IAClE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;IACxD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,GAKnB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAE7D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,yFAAyF;AACzF,MAAM,OAAO,UAAU;IAQQ,MAAM;IAPlB,IAAI,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IAChD,IAAI,GAAG,CAAC,CAAC;IACD,QAAQ,GAAiB,EAAE,CAAC;IAC5B,aAAa,GAAG,CAAC,CAAC;IACT,KAAK,GAAqB,EAAE,CAAC;IAE9C,YAA6B,MAAyB;sBAAzB,MAAM;IAAsB,CAAC;IAE1D,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,CAAS;QAChC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAC7B,CAAC;QACD,oFAAoF;QACpF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF"}

package/dist/routes/v1/api/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The Decision API (go-prod spec §4): `/v1/api/*`, plus `/llms.txt` at the root. It answers only
+ * when `API_LANE` is on — an oracle that never wanted the lane exposes nothing: every path is the
+ * lane's own `404`, the same as a route that does not exist.
+ *
+ * Every route mounts behind `access(…)` (`middleware/api/auth.ts`), which names the caller and
+ * checks it against the route's declared scope and capability — declared ONCE, at the route, and
+ * held to the OpenAPI file's `x-required-scope` / `x-capability` by the snapshot test. Errors
+ * render as the §4.1 envelope (`middleware/api/errors.ts`, wired in `app.ts`).
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const api: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+/** Served at the root (`/llms.txt`, llmstxt.org), behind the same lane switch. */
+export declare const llms: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/v1/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAqB5D,eAAO,MAAM,GAAG,qDAAqB,CAAC;AAkCtC,kFAAkF;AAClF,eAAO,MAAM,IAAI,qDAAqB,CAAC"}

package/dist/routes/v1/api/index.js

@@ -0,0 +1,68 @@
+/**
+ * The Decision API (go-prod spec §4): `/v1/api/*`, plus `/llms.txt` at the root. It answers only
+ * when `API_LANE` is on — an oracle that never wanted the lane exposes nothing: every path is the
+ * lane's own `404`, the same as a route that does not exist.
+ *
+ * Every route mounts behind `access(…)` (`middleware/api/auth.ts`), which names the caller and
+ * checks it against the route's declared scope and capability — declared ONCE, at the route, and
+ * held to the OpenAPI file's `x-required-scope` / `x-capability` by the snapshot test. Errors
+ * render as the §4.1 envelope (`middleware/api/errors.ts`, wired in `app.ts`).
+ */
+import { Hono } from "hono";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { admin } from "./admin.js";
+import { adminClaims } from "./admin-claims.js";
+import { adminFacilitator } from "./admin-facilitator.js";
+import { audit } from "./audit.js";
+import { batch } from "./batch.js";
+import { claims } from "./claims.js";
+import { claimsRead } from "./claims-read.js";
+import { collectionsLink } from "./collections-link.js";
+import { dataExport } from "./export.js";
+import { keys } from "./keys.js";
+import { me } from "./me.js";
+import { members } from "./members.js";
+import { llmsTxt, openApiJson } from "./meta.js";
+import { protocols } from "./protocols.js";
+import { review } from "./review.js";
+import { reviewBilling } from "./review-billing.js";
+import { sources } from "./sources.js";
+import { uploads } from "./uploads.js";
+import { webhooks } from "./webhooks.js";
+export const api = new Hono();
+api.use("*", async (c, next) => {
+    if (!c.get("config").API_LANE) {
+        throw new ApiError("NOT_FOUND", `The Decision API is not enabled on this oracle, so there is no ${c.req.method} ${c.req.path}.`);
+    }
+    await next();
+});
+api.get("/openapi.json", openApiJson);
+// `/claims/batch` before `/claims/:claimId`-shaped routes, so "batch" is never read as an id.
+api.route("/", batch);
+api.route("/", claims);
+api.route("/", claimsRead);
+api.route("/", review);
+api.route("/", uploads);
+api.route("/", protocols);
+// Console + account routes (§3.4, §12.2); each file declares its own paths.
+api.route("/", sources);
+api.route("/", collectionsLink);
+api.route("/", me);
+api.route("/", keys);
+api.route("/", reviewBilling);
+api.route("/", members);
+api.route("/", audit);
+api.route("/", webhooks);
+api.route("/", dataExport);
+api.route("/", admin);
+api.route("/", adminClaims);
+api.route("/", adminFacilitator);
+/** Served at the root (`/llms.txt`, llmstxt.org), behind the same lane switch. */
+export const llms = new Hono();
+llms.get("/", async (c) => {
+    if (!c.get("config").API_LANE) {
+        throw new ApiError("NOT_FOUND", `The Decision API is not enabled on this oracle, so there is no ${c.req.method} ${c.req.path}.`);
+    }
+    return llmsTxt(c);
+});
+//# sourceMappingURL=index.js.map

package/dist/routes/v1/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;AAEtC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,kEAAkE,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;AACtC,8FAA8F;AAC9F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACtB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACvB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC3B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACvB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC1B,4EAA4E;AAC5E,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;AAChC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAC9B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACtB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACzB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC3B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACtB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAC5B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;AAEjC,kFAAkF;AAClF,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAU,CAAC;AACvC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,kEAAkE,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/routes/v1/api/keys.d.ts

@@ -0,0 +1,9 @@
+/**
+ * API keys on the console (go-prod spec §3.2, §3.3): list (masked), create (the key shown once,
+ * stored as its sha256), revoke (at once, or after a rotation's grace). Console-only — a key never
+ * mints or revokes keys.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const keys: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=keys.d.ts.map

package/dist/routes/v1/api/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAW5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,eAAO,MAAM,IAAI,qDAAqB,CAAC"}

package/dist/routes/v1/api/keys.js

@@ -0,0 +1,95 @@
+/**
+ * API keys on the console (go-prod spec §3.2, §3.3): list (masked), create (the key shown once,
+ * stored as its sha256), revoke (at once, or after a rotation's grace). Console-only — a key never
+ * mints or revokes keys.
+ */
+import { and, desc, eq, gt, isNull, or } from "drizzle-orm";
+import { Hono } from "hono";
+import { z } from "zod";
+import { CreateApiKeyRequest, KeyPrefix, RevokeApiKeyQuery } from "../../../contracts/index.js";
+import { apiKeys } from "../../../db/schema.js";
+import { sha256Hex } from "../../../lib/hash.js";
+import { validate } from "../../../lib/validator.js";
+import { audit } from "../../../middleware/api/audit.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { idempotent } from "../../../middleware/api/idempotency.js";
+import { keyEnvironment } from "../../../middleware/api/keys.js";
+import { keyView } from "./views.js";
+export const keys = new Hono();
+const PREFIX_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyz";
+const SECRET_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+/** A prefix is 8 of 36 chars (~41 bits): a collision is rare, so a few draws always suffice. */
+const PREFIX_DRAWS = 3;
+const DAY_MS = 86_400_000;
+/** `n` chars of `alphabet` from the CSPRNG. 40 base62 chars carry ~238 bits; the modulo bias of
+ *  256 over 62 costs a fraction of one (as `newWebhookSecret`). */
+const draw = (alphabet, n) => [...crypto.getRandomValues(new Uint8Array(n))].map((b) => alphabet[b % alphabet.length]).join("");
+const PrefixParam = z.object({ prefix: KeyPrefix });
+keys.get("/keys", access({ op: "listApiKeys", scope: "none", capability: "keys/manage" }), async (c) => {
+    const { sourceId } = sourceOf(c).source;
+    const db = await c.var.db();
+    const rows = await db.query.apiKeys.findMany({
+        where: eq(apiKeys.sourceId, sourceId),
+        orderBy: [desc(apiKeys.createdAt), desc(apiKeys.prefix)],
+    });
+    return c.json({ items: rows.map(keyView) });
+});
+keys.post("/keys", access({ op: "createApiKey", scope: "none", capability: "keys/manage" }), idempotent({ secretFields: ["key"] }), validate("json", CreateApiKeyRequest), async (c) => {
+    const caller = sourceOf(c);
+    const { name, scopes, maxSpendCentsPerDay } = c.req.valid("json");
+    const environment = keyEnvironment(c.get("config"));
+    const db = await c.var.db();
+    // The prefix is the PK: `onConflictDoNothing` makes a collision a redraw, never an overwrite.
+    for (let i = 0; i < PREFIX_DRAWS; i++) {
+        const prefix = draw(PREFIX_ALPHABET, 8);
+        const key = `eo_${environment}_${prefix}_${draw(SECRET_ALPHABET, 40)}`;
+        const [row] = await db
+            .insert(apiKeys)
+            .values({
+            prefix,
+            keyHash: await sha256Hex(key),
+            sourceId: caller.source.sourceId,
+            name: name ?? null,
+            environment,
+            scopes: [...new Set(scopes)],
+            maxSpendCentsPerDay: maxSpendCentsPerDay ?? null,
+            createdBy: caller.kind === "member" ? caller.did : null,
+        })
+            .onConflictDoNothing()
+            .returning();
+        if (!row)
+            continue;
+        await audit(c, "key.created", prefix, {
+            scopes: row.scopes,
+            maxSpendCentsPerDay: row.maxSpendCentsPerDay,
+        });
+        return c.json({ ...keyView(row), key }, 201);
+    }
+    throw new Error(`createApiKey: ${PREFIX_DRAWS} prefix collisions in a row`);
+});
+keys.delete("/keys/:prefix", access({ op: "revokeApiKey", scope: "none", capability: "keys/manage" }), idempotent(), validate("param", PrefixParam), validate("query", RevokeApiKeyQuery), async (c) => {
+    const { sourceId } = sourceOf(c).source;
+    const { prefix } = c.req.valid("param");
+    const { graceDays } = c.req.valid("query");
+    const revokedAt = new Date(Date.now() + graceDays * DAY_MS);
+    const mine = and(eq(apiKeys.prefix, prefix), eq(apiKeys.sourceId, sourceId));
+    const db = await c.var.db();
+    // A revoke only ever brings the end closer: a live key gets one, a key in its grace period may
+    // be cut short, and a key already revoked by then is answered as it stands (a repeat is a no-op).
+    const [row] = await db
+        .update(apiKeys)
+        .set({ revokedAt })
+        .where(and(mine, or(isNull(apiKeys.revokedAt), gt(apiKeys.revokedAt, revokedAt))))
+        .returning();
+    if (row) {
+        await audit(c, "key.revoked", prefix, { graceDays });
+        return c.json(keyView(row));
+    }
+    // Another source's key does not exist here (§14).
+    const current = await db.query.apiKeys.findFirst({ where: mine });
+    if (!current)
+        throw new ApiError("NOT_FOUND", "This API key was not found for this source; it may belong to another source.");
+    return c.json(keyView(current));
+});
+//# sourceMappingURL=keys.js.map

package/dist/routes/v1/api/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAU,CAAC;AAEvC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAC/D,MAAM,eAAe,GAAG,gEAAgE,CAAC;AACzF,gGAAgG;AAChG,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B;mEACmE;AACnE,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,CAAS,EAAE,EAAE,CAC3C,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEpG,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAEpD,IAAI,CAAC,GAAG,CACN,OAAO,EACP,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EACvE,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACrC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9C,CAAC,CACF,CAAC;AAEF,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EACxE,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EACrC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACrC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,8FAA8F;IAC9F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,WAAW,IAAI,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC;YACN,MAAM;YACN,OAAO,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;YAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;YAChC,IAAI,EAAE,IAAI,IAAI,IAAI;YAClB,WAAW;YACX,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,mBAAmB,EAAE,mBAAmB,IAAI,IAAI;YAChD,SAAS,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SACxD,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,KAAK,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE;YACpC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;SAC7C,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,YAAY,6BAA6B,CAAC,CAAC;AAC9E,CAAC,CACF,CAAC;AAEF,IAAI,CAAC,MAAM,CACT,eAAe,EACf,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EACxE,UAAU,EAAE,EACZ,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,EAC9B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACpC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,+FAA+F;IAC/F,kGAAkG;IAClG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;SACjF,SAAS,EAAE,CAAC;IACf,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,kDAAkD;IAClD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,8EAA8E,CAC/E,CAAC;IACJ,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAClC,CAAC,CACF,CAAC"}

package/dist/routes/v1/api/me.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `GET /v1/api/me` (go-prod spec §4.2, §12.3): the source as the caller sees it — who is calling
+ * (the console gates its screens on `caller`), the source record and the lane's limits, plus what
+ * the caller's grant reaches, under least exposure (§14):
+ *   - `members` (emails, DIDs) — a console member only, never an API key;
+ *   - `keys` — a key, or a member with `keys/manage`;
+ *   - `webhookEndpoints` — a key with `webhooks:manage`, or a member with `webhooks/manage`;
+ *   - `credits` — a key, or a member with `spend/read`.
+ * A part the caller may not see is ABSENT, not empty. `reviewBlocked` says, for every caller, why
+ * it can answer no review here (`reviewBlockOf`) — never whose account owns the oracle.
+ *
+ * `credits` is the facilitator's `upay` balance (payments spec §5.3) for the source OWNER's deed —
+ * `ownerDid`, "the IXO account that pays" (go-prod §3.2). It is the source owner's balance, not
+ * every payer's: the gate also takes an offer paid by any live member, whose own balance is not
+ * shown here. Null when the source pays nothing here (billing mode `none`, payments off) or the
+ * facilitator cannot be read: the page never fails on a balance.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const me: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=me.d.ts.map

package/dist/routes/v1/api/me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/me.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAqB5B,OAAO,KAAK,EAAc,MAAM,EAAgB,MAAM,+BAA+B,CAAC;AAKtF,eAAO,MAAM,EAAE,qDAAqB,CAAC"}

package/dist/routes/v1/api/me.js

@@ -0,0 +1,122 @@
+/**
+ * `GET /v1/api/me` (go-prod spec §4.2, §12.3): the source as the caller sees it — who is calling
+ * (the console gates its screens on `caller`), the source record and the lane's limits, plus what
+ * the caller's grant reaches, under least exposure (§14):
+ *   - `members` (emails, DIDs) — a console member only, never an API key;
+ *   - `keys` — a key, or a member with `keys/manage`;
+ *   - `webhookEndpoints` — a key with `webhooks:manage`, or a member with `webhooks/manage`;
+ *   - `credits` — a key, or a member with `spend/read`.
+ * A part the caller may not see is ABSENT, not empty. `reviewBlocked` says, for every caller, why
+ * it can answer no review here (`reviewBlockOf`) — never whose account owns the oracle.
+ *
+ * `credits` is the facilitator's `upay` balance (payments spec §5.3) for the source OWNER's deed —
+ * `ownerDid`, "the IXO account that pays" (go-prod §3.2). It is the source owner's balance, not
+ * every payer's: the gate also takes an offer paid by any live member, whose own balance is not
+ * shown here. Null when the source pays nothing here (billing mode `none`, payments off) or the
+ * facilitator cannot be read: the page never fails on a balance.
+ */
+import { asc, desc, eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { covers, MAX_BATCH_CLAIMS, MAX_JSON_BODY_BYTES, MAX_PAGE_LIMIT, MAX_UPLOAD_BYTES, MAX_WAIT_SECONDS, } from "../../../contracts/index.js";
+import { apiKeys, apiMembers, webhookEndpoints } from "../../../db/schema.js";
+import { sourceRoots } from "../../../lib/api-lane/company.js";
+import { AppError } from "../../../lib/errors.js";
+import { createFacilitatorClient } from "../../../lib/payments/facilitator.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { chainOf } from "../../../middleware/api/console.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { MAX_WAITERS_PER_SOURCE } from "../../../middleware/api/wait.js";
+import { reviewBlockOf } from "./review.js";
+import { endpointView, keyView, memberView, sourceView } from "./views.js";
+export const me = new Hono();
+const LIMITS = {
+    maxBodyBytes: MAX_JSON_BODY_BYTES,
+    maxUploadBytes: MAX_UPLOAD_BYTES,
+    maxBatchClaims: MAX_BATCH_CLAIMS,
+    maxWaitSeconds: MAX_WAIT_SECONDS,
+    maxConcurrentWaiters: MAX_WAITERS_PER_SOURCE,
+    maxPageLimit: MAX_PAGE_LIMIT,
+};
+/** A member's grant reaches `cap`; a key never holds a console capability. */
+const memberHas = (caller, cap) => caller.kind === "member" && covers(caller.capabilities, cap);
+function callerView(caller) {
+    if (caller.kind === "key") {
+        return { kind: "key", prefix: caller.key.prefix, scopes: caller.key.scopes };
+    }
+    // The console's view of a source is not an AI app's to read (S7: keys, members, caps).
+    if (caller.kind === "oauth") {
+        throw new ApiError("SCOPE", "An AI app connected with OAuth can't read the source's settings.");
+    }
+    // D10: a current controller of the organisation, invoking as root — with or without a row.
+    if (caller.controller) {
+        return { kind: "controller", did: caller.did, capabilities: [...caller.capabilities] };
+    }
+    if (!caller.memberId)
+        throw AppError.internal("A member caller has no member row");
+    return {
+        kind: "member",
+        memberId: caller.memberId,
+        did: caller.did,
+        role: caller.role,
+        capabilities: [...caller.capabilities],
+        protocols: caller.protocols ? [...caller.protocols] : null,
+    };
+}
+async function creditsOf(c, source) {
+    const config = c.get("config");
+    if (source.billingMode === "none" || !config.API_PAYMENTS || !config.X402_FACILITATOR_URL) {
+        return null;
+    }
+    return createFacilitatorClient({
+        config,
+        logger: c.get("logger"),
+        trace: c.get("trace"),
+        cache: c.env.CACHE_KV,
+    }).balances(source.ownerDid);
+}
+me.get("/me", access({ op: "getMe", scope: null, capability: null }), async (c) => {
+    const caller = sourceOf(c);
+    const { source } = caller;
+    const db = await c.var.db();
+    const seesMembers = caller.kind === "member";
+    const seesKeys = caller.kind === "key" || memberHas(caller, "keys/manage");
+    const seesCredits = caller.kind === "key" || memberHas(caller, "spend/read");
+    const seesEndpoints = caller.kind === "key"
+        ? caller.key.scopes.includes("webhooks:manage")
+        : memberHas(caller, "webhooks/manage");
+    const [members, keys, endpoints, credits, reviewBlocked] = await Promise.all([
+        seesMembers
+            ? db.query.apiMembers.findMany({
+                where: eq(apiMembers.sourceId, source.sourceId),
+                orderBy: [asc(apiMembers.invitedAt), asc(apiMembers.memberId)],
+            })
+            : null,
+        seesKeys
+            ? db.query.apiKeys.findMany({
+                where: eq(apiKeys.sourceId, source.sourceId),
+                orderBy: [desc(apiKeys.createdAt), desc(apiKeys.prefix)],
+            })
+            : null,
+        seesEndpoints
+            ? db.query.webhookEndpoints.findMany({
+                where: eq(webhookEndpoints.sourceId, source.sourceId),
+                orderBy: [asc(webhookEndpoints.createdAt), asc(webhookEndpoints.endpointId)],
+            })
+            : null,
+        seesCredits ? creditsOf(c, source) : undefined,
+        reviewBlockOf(c, caller),
+    ]);
+    const roots = members ? await sourceRoots(chainOf(c), source) : null;
+    const body = {
+        caller: callerView(caller),
+        source: sourceView(source),
+        ...(members ? { members: members.map((m) => memberView(m, roots ?? [])) } : {}),
+        ...(keys ? { keys: keys.map(keyView) } : {}),
+        ...(credits !== undefined ? { credits } : {}),
+        limits: LIMITS,
+        ...(endpoints ? { webhookEndpoints: endpoints.map(endpointView) } : {}),
+        reviewBlocked,
+    };
+    return c.json(body);
+});
+//# sourceMappingURL=me.js.map