@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/lib/oauth/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../../src/lib/oauth/approvals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AAInF,OAAO,EAAE,UAAU,EAAoB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEnD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AAC3C,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,GAAG,MAAM,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,GAAS,EAAE,EAAE,CACvD,GAAG,CAAA,wBAAwB,iBAAiB,CAAC,IAAI,cAAc,iBAAiB,UAAU,iBAAiB,CAAC,OAAO,MAAM,OAAO,QAAQ,iBAAiB,CAAC,SAAS,MAAM,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC;AAErM,mGAAmG;AACnG,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC;AAE1D,iGAAiG;AACjG,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,CAS9B;IACC,OAAO,SAAS,CACd,aAAa,CAAC;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,cAAc,EAAE,CAAC,CAAC,cAAc;KACjC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAwD,EAAE,EAAU,EAAE,EAAE,CACjG,GAAG,MAAM,CAAC,YAAY,2BAA2B,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;AAEzG,4CAA4C;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAE9E,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAY,EACZ,OAAe,EACf,aAAqB,EACrB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,KAAK,GAAG,GAAG,CACf,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EACjC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,CACvC,CAAC;IACT,MAAM,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACrC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAU,CAAC;AAE9D;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,KAAU,EAAE,GAAS;IAC5D,MAAM,EAAE;SACL,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SAC5C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAY,EACZ,GAGC,EACD,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,EAAE;SACL,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC;QACN,GAAG,GAAG;QACN,EAAE,EAAE,aAAa,EAAE;QACnB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;QACpD,SAAS,EAAE,GAAG;KACf,CAAC;SACD,mBAAmB,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAY,EAAE,EAAU;IAC3D,MAAM,EAAE;SACL,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SAC5C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAY,EACZ,GAA0D,EAC1D,IAAI,GAAgC,UAAU,EAC9C,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CACd,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EACvB,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EAC7B,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAChC,CAAC;IACF,0FAA0F;IAC1F,wFAAwF;IACxF,MAAM,IAAI,GACR,IAAI,KAAK,cAAc;QACrB,CAAC,CAAC,GAAG,CAAA,GAAG;QACR,CAAC,CAAC,GAAG,CAAA,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO,cAAc,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,6FAA6F;IAC7F,2FAA2F;IAC3F,iGAAiG;IACjG,MAAM,OAAO,GACX,IAAI,KAAK,cAAc;QACrB,CAAC,CAAC,GAAG,CAAA,yBAAyB,iBAAiB,UAAU,iBAAiB,CAAC,OAAO,MAAM,OAAO,QAAQ,iBAAiB,CAAC,aAAa,MAAM,QAAQ,GAAG;QACvJ,CAAC,CAAC,GAAG,CAAA,yBAAyB,iBAAiB,UAAU,iBAAiB,CAAC,OAAO,MAAM,OAAO,QAAQ,iBAAiB,CAAC,aAAa,MAAM,QAAQ,QAAQ,iBAAiB,CAAC,OAAO,MAAM,OAAO,GAAG,CAAC;IAC1M,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC;QAC/B,0FAA0F;QAC1F,EAAE;aACC,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CACL,GAAG,CAAA,UAAU,OAAO,KAAK,QAAQ,KAAK,OAAO,KAAK,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,gCAAgC,YAAY,UAAU,IAAI,SAAS,IAAI,EAAE,CAChL;aACA,mBAAmB,EAAE;QACxB,EAAE;aACC,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;aACzB,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,IAAI,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC3B,0FAA0F;IAC1F,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAY,EACZ,EAAU,EACV,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC;QAChC,EAAE;aACC,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;aACjE,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EACvB,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAChC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;QACrC,kEAAkE;QAClE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAChC,GAAG;QACD,0CAA0C;QAC1C,GAAG,CAAA,GAAG,iBAAiB,CAAC,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,YAAY,UAAU,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAC1H,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,EACzD,GAAG,CAAA,yBAAyB,YAAY,UAAU,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,YAAY,CAAC,MAAM,gBAAgB,CACrH,CACF;KACF,CAAC,CAAC;IACH,6FAA6F;IAC7F,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAY,EACZ,EAAU,EACV,KAAmD,EACnD,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,CAAC;SACzC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EACvB,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAChC,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAY,EACZ,EAAU,EACV,UAAkB,EAClB,KAAmD;IAEnD,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,CAAC;SACrD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;SACvE,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,EAAU;IAC7D,MAAM,EAAE;SACL,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SACzB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAY,EAAE,EAAU,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC9E,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACrC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAY,EACZ,EAAU,EACV,MAAkF,EAClF,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,GAAG,GACP,MAAM,CAAC,MAAM,KAAK,UAAU;QAC1B,CAAC,CAAC;YACE,MAAM,EAAE,UAAmB;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;SACrD;QACH,CAAC,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EACvB,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,EAClC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAChC,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;AAC3B,CAAC;AAkBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,GAA+C,EAC/C,MAKC,EACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAChF,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,sBAAsB;YAC9B,OAAO,EAAE,8DAA8D;YACvE,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC;IACJ,CAAC;IACD,kGAAkG;IAClG,kGAAkG;IAClG,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACjF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAY,EACZ,OAAe,EACf,KAAa,EACb,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,gBAAgB,UAAU,CAAC,WAAW,OAAO,EAAE,CAAC;SAC3E,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,OAAO,EAAE,CAAC,EACtC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,EAChD,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CACtD,CACF,CAAC;IACJ,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,uBAAuB,CAAC;AAC7D,CAAC"}

package/dist/lib/oauth/standing.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Auto-approve ("don't ask again", spec 2026-10-06 "Auto-approve"; S7): a grant's standing payment
+ * authority, `mcp_standing`. AuthHub — and only AuthHub, on its own pages — sets it (with an
+ * approval, or a PUT) and revokes it; the oracle spends from it. A grant is one app on this oracle,
+ * so one standing covers every source the user submits for through that app — intended: the user
+ * set the limits for the app, not per source.
+ *
+ * Unlike a one-claim approval (`approvals.ts`, maxAmount EXACTLY the price), the delegation here
+ * covers many claims: its `maxAmount` must EQUAL `totalUpay`, each claim may cost at most
+ * `perClaimUpay`, and it must outlive `until` (AuthHub signs until + 30 d + 600 s, for review
+ * holds). The facilitator enforces the delegation's total as well, since spend counts across offers.
+ * The oracle holds the same bounds AuthHub does: a total of at most $100, an end at most 7 days out.
+ *
+ * Accounting (S3 review of #87): `totalUpay` is THIS auto-approve's total across every delegation
+ * AuthHub signs for it, so `spentUpay` is never reset — a PUT must leave `totalUpay ≥ spentUpay`,
+ * and what is left is `totalUpay − spentUpay`. Every spend is one `db.batch`: the request's lock
+ * row (`mcp_standing_spends`) and the conditional `spentUpay` update that lands only if that lock
+ * did, within the per-claim cap, the total, `until`, and the grant's daily cap summed over the lock
+ * rows — so concurrent submits can never exceed the total or the day's cap, and a retry of the same
+ * request never spends twice. A refund (proven nothing reserved) gives the price back and deletes
+ * the lock, in one batch. `mcp_standing_spends` is the grant's ONE day counter: it also holds the
+ * one-claim approvals' spends (`approvals.ts` `spendApproval`) and each answer's marker
+ * (`answer:<id>`, 0 upay), so the $20/day cap is atomic across both paths.
+ */
+import type { Database } from "../../db/client.js";
+import { AppError } from "../errors.js";
+import { type DelegationRefusal } from "./approvals.js";
+/**
+ * Company authority D8 (F13): a standing approval leaves the user's spending authority on THIS
+ * operator's server, so only an oracle whose config says `allowStandingApprovals` (IXO's own) takes
+ * one. Off ⇒ none is set (`standingApprovalsOff`), none is read back (`GET` is 404), a standing
+ * already stored never pays — every submit falls to the user's approval of that one claim, and a
+ * card payment one parked for 3-D Secure is not resumed — and the housekeeping sweep deletes every
+ * stored one. Read per request — the config is the isolate's, and a redeploy that turns it off
+ * takes effect on the next submit.
+ */
+export declare const standingApprovalsAllowed: () => boolean;
+export declare const standingApprovalsOff: () => AppError;
+/** The limits AuthHub sends, upay strings and unix seconds — its wire shape. */
+export interface StandingLimits {
+    perClaimUpay: string;
+    totalUpay: string;
+    until: number;
+}
+/** AuthHub's own bounds (`OAUTH_MAX_STANDING_UPAY`, 7 days), held here too. */
+export declare const MAX_STANDING_UPAY = 100000000n;
+/**
+ * Why `delegation` cannot be this grant's standing authority, or null. The one-claim checks
+ * (issuer, oracle, facilitator, unexpired) with `maxAmount` = `totalUpay`, plus the bounds — a
+ * per-claim cap within the total, a total of at most $100, `until` ahead and at most 7 days out,
+ * the delegation outliving it — and, with an approval, the claim's price within the per-claim cap.
+ */
+export declare function standingRefusal(delegation: string, limits: StandingLimits, expect: {
+    did: string;
+    oracleDid: string;
+    facilitatorDid: string;
+    claimUpay?: string;
+}, now?: number): Promise<DelegationRefusal | null>;
+/**
+ * Set the grant's standing authority, adding `spentUpay` (the approved claim's price with an
+ * approval, 0 for a PUT) to what it has spent — never resetting it. Refused (false) when the new
+ * total would not cover what is spent.
+ */
+export declare function setStanding(db: Database, grantId: string, did: string, limits: StandingLimits, delegation: string, spentUpay: number): Promise<boolean>;
+/**
+ * Approve a pending approval AND, with limits, set the grant's standing — ONE batch in which the
+ * answer that wins is decided FIRST (S3 review of #90, A + B). Every answer, with limits or without,
+ * claims the approval's one marker row (`answer:<id>`, keyed by the PK, 0 upay, outside the day's
+ * count) carrying its own `answerId`; the marker lands only while the approval is still pending and
+ * unexpired and — with limits — only if the new total covers what this auto-approve has already
+ * spent plus this claim. The flip and the standing write both require THIS answer's marker. So:
+ *   - two answers at once (twins, or one without limits racing one with): the PK lets exactly one
+ *     marker in; the other answer changes nothing — no flip, no standing, no double count;
+ *   - limits that would not cover what is spent: no marker, no flip — the approval stays pending
+ *     and the answer is refused (`overSpent`), never "refused" while the claim went live.
+ * `approved` = this answer flipped it; `pending` = it is still pending (so a refusal, not a race).
+ */
+export declare function approveWithStanding(db: Database, approval: {
+    id: string;
+    grantId: string;
+    did: string;
+    delegation: string | null;
+}, standing: {
+    limits: StandingLimits;
+    delegation: string;
+    spentUpay: number;
+} | null, expiresAt: Date, now?: Date): Promise<{
+    approved: boolean;
+    pending: boolean;
+}>;
+/** The grant's live standing (unrevoked, before `until`), or undefined. */
+export declare const liveStanding: (db: Database, grantId: string, now?: Date) => import("drizzle-orm/sqlite-core/query-builders/query").SQLiteRelationalQuery<"async", {
+    delegation: string | null;
+    did: string;
+    grantId: string;
+    perClaimUpay: number;
+    spentUpay: number;
+    totalUpay: number;
+    until: Date;
+    updatedAt: Date;
+} | undefined>;
+/** Whose grant this is, as far as this oracle has seen it: its standing, else an approval. */
+export declare function grantDid(db: Database, grantId: string): Promise<string | undefined>;
+/**
+ * Revoke: the row goes, delegation and all, and so does every standing delegation an approval of
+ * the grant still holds — an approve-with-limits claim, one parked for 3-D Secure — whichever
+ * delegation it was (a PUT may have replaced it since): expired if live, nulled if spent. A
+ * standing copy is told from a one-claim approval's own by its amount: a one-claim delegation is
+ * for exactly the claim's price (F1), a standing one for the total. A standing whose total equals
+ * that one price is indistinguishable and survives — benign (S3): it can pay at most the one claim
+ * the user just approved. `false` when the row is another user's. The read-then-batch window is
+ * tolerable: a spend racing a revoke can at most be one the user had already allowed.
+ */
+/**
+ * Whether an approval row's delegation is a copy of the grant's standing rather than the claim's
+ * own: a one-claim delegation is for exactly the claim's price (F1), a standing one for the total.
+ * One that does not parse is counted a copy — the side that never pays from it.
+ */
+export declare function isStandingCopy(delegation: string, maxAmountUpay: string): Promise<boolean>;
+export declare function revokeStanding(db: Database, grantId: string, did: string): Promise<boolean>;
+/**
+ * Take `upay` from the grant's standing for ONE request — one batch whose two statements test the
+ * SAME conditions: the request's lock row is written only if the price fits (per-claim, total,
+ * `until`, the grant's day), and the spend lands only if that lock is this attempt's. So nothing
+ * is written when it does not fit — no lock to clean up, whatever happens to the isolate.
+ *   - `locked`: this request already spent (a retry): never spend or pay again;
+ *   - null: it does not fit (or there is no live standing): ask the user;
+ *   - else the delegation to pay with, what is left, and the lock's id (for a refund).
+ * An exhausted standing (`spentUpay` = `totalUpay`) or one past `until` approves nothing, free
+ * claims included.
+ */
+export declare function spendStanding(db: Database, spend: {
+    grantId: string;
+    did: string;
+    requestDigest: string;
+    upay: number;
+}, now?: Date): Promise<{
+    delegation: string;
+    remainingUpay: number;
+    spendId: string;
+} | "locked" | null>;
+/**
+ * Proven nothing reserved: give `upay` back — to the delegation it was spent from only (a PUT in
+ * between keeps the count, conservatively) — and release THIS spend's lock, in one batch.
+ */
+export declare function refundStanding(db: Database, spend: {
+    grantId: string;
+    spendId: string;
+    delegation: string;
+    upay: number;
+}): Promise<void>;
+//# sourceMappingURL=standing.d.ts.map

package/dist/lib/oauth/standing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGhD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,KAAK,iBAAiB,EAAiD,MAAM,aAAa,CAAC;AAEpG;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,eAA2D,CAAC;AAEjG,eAAO,MAAM,oBAAoB,gBAI9B,CAAC;AAEJ,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,aAAe,CAAC;AAK9C;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtF,GAAG,SAAgC,GAClC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAsBnC;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CA8BlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjF,QAAQ,EAAE;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAClF,SAAS,EAAE,IAAI,EACf,GAAG,OAAa,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA6DlD;AAED,2EAA2E;AAC3E,eAAO,MAAM,YAAY,OAAQ,QAAQ,WAAW,MAAM;;;;;;;;;cAOtD,CAAC;AAEL,8FAA8F;AAC9F,wBAAsB,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWzF;AAED;;;;;;;;;GASG;AACH;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhG;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BjG;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC5E,GAAG,OAAa,GACf,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CA+C3F;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5E,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/lib/oauth/standing.js

@@ -0,0 +1,299 @@
+/**
+ * Auto-approve ("don't ask again", spec 2026-10-06 "Auto-approve"; S7): a grant's standing payment
+ * authority, `mcp_standing`. AuthHub — and only AuthHub, on its own pages — sets it (with an
+ * approval, or a PUT) and revokes it; the oracle spends from it. A grant is one app on this oracle,
+ * so one standing covers every source the user submits for through that app — intended: the user
+ * set the limits for the app, not per source.
+ *
+ * Unlike a one-claim approval (`approvals.ts`, maxAmount EXACTLY the price), the delegation here
+ * covers many claims: its `maxAmount` must EQUAL `totalUpay`, each claim may cost at most
+ * `perClaimUpay`, and it must outlive `until` (AuthHub signs until + 30 d + 600 s, for review
+ * holds). The facilitator enforces the delegation's total as well, since spend counts across offers.
+ * The oracle holds the same bounds AuthHub does: a total of at most $100, an end at most 7 days out.
+ *
+ * Accounting (S3 review of #87): `totalUpay` is THIS auto-approve's total across every delegation
+ * AuthHub signs for it, so `spentUpay` is never reset — a PUT must leave `totalUpay ≥ spentUpay`,
+ * and what is left is `totalUpay − spentUpay`. Every spend is one `db.batch`: the request's lock
+ * row (`mcp_standing_spends`) and the conditional `spentUpay` update that lands only if that lock
+ * did, within the per-claim cap, the total, `until`, and the grant's daily cap summed over the lock
+ * rows — so concurrent submits can never exceed the total or the day's cap, and a retry of the same
+ * request never spends twice. A refund (proven nothing reserved) gives the price back and deletes
+ * the lock, in one batch. `mcp_standing_spends` is the grant's ONE day counter: it also holds the
+ * one-claim approvals' spends (`approvals.ts` `spendApproval`) and each answer's marker
+ * (`answer:<id>`, 0 upay), so the $20/day cap is atomic across both paths.
+ */
+import { parsePaymentDelegation } from "@ixo/x402-ixo-pay";
+import { and, eq, gt, inArray, lte, sql } from "drizzle-orm";
+import { mcpApprovals, mcpStanding, mcpStandingSpends } from "../../db/schema.js";
+import { getOracle } from "../../oracle.js";
+import { AppError } from "../errors.js";
+import { delegationRefusal, GRANT_CAP_UPAY, spentToday } from "./approvals.js";
+/**
+ * Company authority D8 (F13): a standing approval leaves the user's spending authority on THIS
+ * operator's server, so only an oracle whose config says `allowStandingApprovals` (IXO's own) takes
+ * one. Off ⇒ none is set (`standingApprovalsOff`), none is read back (`GET` is 404), a standing
+ * already stored never pays — every submit falls to the user's approval of that one claim, and a
+ * card payment one parked for 3-D Secure is not resumed — and the housekeeping sweep deletes every
+ * stored one. Read per request — the config is the isolate's, and a redeploy that turns it off
+ * takes effect on the next submit.
+ */
+export const standingApprovalsAllowed = () => getOracle().config.policies.allowStandingApprovals;
+export const standingApprovalsOff = () => new AppError("This oracle does not accept auto-approve (standing approvals): the user approves each claim.", { code: "FORBIDDEN", details: { reason: "standing_approvals_off" } });
+/** AuthHub's own bounds (`OAUTH_MAX_STANDING_UPAY`, 7 days), held here too. */
+export const MAX_STANDING_UPAY = 100000000n;
+const MAX_STANDING_SEC = 7 * 86_400;
+/** Clock skew allowed on `until` against AuthHub's "at most 7 days". */
+const UNTIL_SKEW_SEC = 300;
+/**
+ * Why `delegation` cannot be this grant's standing authority, or null. The one-claim checks
+ * (issuer, oracle, facilitator, unexpired) with `maxAmount` = `totalUpay`, plus the bounds — a
+ * per-claim cap within the total, a total of at most $100, `until` ahead and at most 7 days out,
+ * the delegation outliving it — and, with an approval, the claim's price within the per-claim cap.
+ */
+export async function standingRefusal(delegation, limits, expect, now = Math.floor(Date.now() / 1000)) {
+    const per = BigInt(limits.perClaimUpay);
+    const total = BigInt(limits.totalUpay);
+    if (per <= 0n || per > total || total > MAX_STANDING_UPAY) {
+        return {
+            reason: "limits_invalid",
+            message: "the per-claim cap must be positive and within the total, and the total at most $100",
+        };
+    }
+    if (limits.until <= now || limits.until > now + MAX_STANDING_SEC + UNTIL_SKEW_SEC) {
+        return { reason: "limits_invalid", message: "it must end in the next 7 days" };
+    }
+    if (expect.claimUpay !== undefined && BigInt(expect.claimUpay) > per) {
+        return { reason: "limits_invalid", message: "this claim costs more than the per-claim cap" };
+    }
+    return delegationRefusal(delegation, { did: expect.did, maxAmountUpay: limits.totalUpay }, { ...expect, validUntil: limits.until }, now);
+}
+/**
+ * Set the grant's standing authority, adding `spentUpay` (the approved claim's price with an
+ * approval, 0 for a PUT) to what it has spent — never resetting it. Refused (false) when the new
+ * total would not cover what is spent.
+ */
+export async function setStanding(db, grantId, did, limits, delegation, spentUpay) {
+    const row = {
+        grantId,
+        did,
+        perClaimUpay: Number(limits.perClaimUpay),
+        totalUpay: Number(limits.totalUpay),
+        spentUpay,
+        until: new Date(limits.until * 1000),
+        delegation,
+        updatedAt: new Date(),
+    };
+    if (row.spentUpay > row.totalUpay)
+        return false;
+    const set = await db
+        .insert(mcpStanding)
+        .values(row)
+        .onConflictDoUpdate({
+        target: mcpStanding.grantId,
+        set: {
+            did: row.did,
+            perClaimUpay: row.perClaimUpay,
+            totalUpay: row.totalUpay,
+            until: row.until,
+            updatedAt: row.updatedAt,
+            spentUpay: sql `${mcpStanding.spentUpay} + ${spentUpay}`,
+            delegation,
+        },
+        setWhere: sql `${mcpStanding.spentUpay} + ${spentUpay} <= ${row.totalUpay}`,
+    })
+        .returning({ grantId: mcpStanding.grantId });
+    return set.length === 1;
+}
+/**
+ * Approve a pending approval AND, with limits, set the grant's standing — ONE batch in which the
+ * answer that wins is decided FIRST (S3 review of #90, A + B). Every answer, with limits or without,
+ * claims the approval's one marker row (`answer:<id>`, keyed by the PK, 0 upay, outside the day's
+ * count) carrying its own `answerId`; the marker lands only while the approval is still pending and
+ * unexpired and — with limits — only if the new total covers what this auto-approve has already
+ * spent plus this claim. The flip and the standing write both require THIS answer's marker. So:
+ *   - two answers at once (twins, or one without limits racing one with): the PK lets exactly one
+ *     marker in; the other answer changes nothing — no flip, no standing, no double count;
+ *   - limits that would not cover what is spent: no marker, no flip — the approval stays pending
+ *     and the answer is refused (`overSpent`), never "refused" while the claim went live.
+ * `approved` = this answer flipped it; `pending` = it is still pending (so a refusal, not a race).
+ */
+export async function approveWithStanding(db, approval, standing, expiresAt, now = new Date()) {
+    const answerId = crypto.randomUUID();
+    const markerKey = `answer:${approval.id}`;
+    const pending = and(eq(mcpApprovals.id, approval.id), eq(mcpApprovals.status, "pending"), gt(mcpApprovals.expiresAt, now));
+    // Exactly this answer's marker, looked up by the PK (grant, key) — never a scan by spendId.
+    const mine = sql `exists (select 1 from ${mcpStandingSpends} where ${mcpStandingSpends.grantId} = ${approval.grantId} and ${mcpStandingSpends.requestDigest} = ${markerKey} and ${mcpStandingSpends.spendId} = ${answerId})`;
+    const per = standing ? Number(standing.limits.perClaimUpay) : 0;
+    const total = standing ? Number(standing.limits.totalUpay) : 0;
+    const spentUpay = standing?.spentUpay ?? 0;
+    // B: the new total must cover what this auto-approve has spent plus this claim — else no marker.
+    const covers = standing
+        ? sql `${spentUpay} <= ${total} and not exists (select 1 from ${mcpStanding} where ${mcpStanding.grantId} = ${approval.grantId} and ${mcpStanding.spentUpay} + ${spentUpay} > ${total})`
+        : sql `1`;
+    const marker = db
+        .insert(mcpStandingSpends)
+        .select(sql `select ${approval.grantId}, ${markerKey}, ${answerId}, 0, ${now.getTime()} where exists (select 1 from ${mcpApprovals} where ${pending}) and ${covers}`)
+        .onConflictDoNothing();
+    const flip = db
+        .update(mcpApprovals)
+        .set({ status: "approved", delegation: approval.delegation, expiresAt })
+        .where(and(pending, mine))
+        .returning({ id: mcpApprovals.id });
+    let flipped;
+    if (!standing) {
+        [, flipped] = await db.batch([marker, flip]);
+    }
+    else {
+        const { limits, delegation } = standing;
+        const until = limits.until * 1000;
+        [, flipped] = await db.batch([
+            marker,
+            flip,
+            db
+                .insert(mcpStanding)
+                .select(sql `select ${approval.grantId}, ${approval.did}, ${per}, ${total}, ${spentUpay}, ${until}, ${delegation}, ${now.getTime()} where ${mine}`)
+                .onConflictDoUpdate({
+                target: mcpStanding.grantId,
+                set: {
+                    did: approval.did,
+                    perClaimUpay: per,
+                    totalUpay: total,
+                    until: new Date(until),
+                    updatedAt: now,
+                    spentUpay: sql `${mcpStanding.spentUpay} + ${spentUpay}`,
+                    delegation,
+                },
+                // Already guaranteed by the marker's `covers`; kept so this write can never overspend.
+                setWhere: sql `${mcpStanding.spentUpay} + ${spentUpay} <= ${total}`,
+            }),
+        ]);
+    }
+    if (flipped.length === 1)
+        return { approved: true, pending: false };
+    const still = await db.query.mcpApprovals.findFirst({ columns: { id: true }, where: pending });
+    return { approved: false, pending: still !== undefined };
+}
+/** The grant's live standing (unrevoked, before `until`), or undefined. */
+export const liveStanding = (db, grantId, now = new Date()) => db.query.mcpStanding.findFirst({
+    where: and(eq(mcpStanding.grantId, grantId), gt(mcpStanding.until, now), sql `${mcpStanding.delegation} is not null`),
+});
+/** Whose grant this is, as far as this oracle has seen it: its standing, else an approval. */
+export async function grantDid(db, grantId) {
+    const standing = await db.query.mcpStanding.findFirst({
+        columns: { did: true },
+        where: eq(mcpStanding.grantId, grantId),
+    });
+    if (standing)
+        return standing.did;
+    const approval = await db.query.mcpApprovals.findFirst({
+        columns: { did: true },
+        where: eq(mcpApprovals.grantId, grantId),
+    });
+    return approval?.did;
+}
+/**
+ * Revoke: the row goes, delegation and all, and so does every standing delegation an approval of
+ * the grant still holds — an approve-with-limits claim, one parked for 3-D Secure — whichever
+ * delegation it was (a PUT may have replaced it since): expired if live, nulled if spent. A
+ * standing copy is told from a one-claim approval's own by its amount: a one-claim delegation is
+ * for exactly the claim's price (F1), a standing one for the total. A standing whose total equals
+ * that one price is indistinguishable and survives — benign (S3): it can pay at most the one claim
+ * the user just approved. `false` when the row is another user's. The read-then-batch window is
+ * tolerable: a spend racing a revoke can at most be one the user had already allowed.
+ */
+/**
+ * Whether an approval row's delegation is a copy of the grant's standing rather than the claim's
+ * own: a one-claim delegation is for exactly the claim's price (F1), a standing one for the total.
+ * One that does not parse is counted a copy — the side that never pays from it.
+ */
+export async function isStandingCopy(delegation, maxAmountUpay) {
+    const parsed = await parsePaymentDelegation(delegation);
+    // Amounts compared as integers (as `delegationRefusal` does), never as strings.
+    return !parsed.ok || BigInt(parsed.delegation.maxAmount) !== BigInt(maxAmountUpay);
+}
+export async function revokeStanding(db, grantId, did) {
+    const row = await db.query.mcpStanding.findFirst({
+        columns: { did: true },
+        where: eq(mcpStanding.grantId, grantId),
+    });
+    if (row && row.did !== did)
+        return false;
+    const holding = await db.query.mcpApprovals.findMany({
+        columns: { id: true, status: true, delegation: true, maxAmountUpay: true },
+        where: and(eq(mcpApprovals.grantId, grantId), eq(mcpApprovals.did, did), inArray(mcpApprovals.status, ["approved", "awaiting_3ds", "used"]), sql `${mcpApprovals.delegation} is not null`),
+    });
+    const standingCopies = [];
+    for (const a of holding) {
+        if (await isStandingCopy(a.delegation, a.maxAmountUpay))
+            standingCopies.push(a.id);
+    }
+    const copies = and(eq(mcpApprovals.grantId, grantId), inArray(mcpApprovals.id, standingCopies));
+    await db.batch([
+        db.delete(mcpStanding).where(eq(mcpStanding.grantId, grantId)),
+        db
+            .update(mcpApprovals)
+            .set({ status: "expired", delegation: null })
+            .where(and(copies, inArray(mcpApprovals.status, ["approved", "awaiting_3ds"]))),
+        db.update(mcpApprovals).set({ delegation: null }).where(copies),
+    ]);
+    return true;
+}
+/**
+ * Take `upay` from the grant's standing for ONE request — one batch whose two statements test the
+ * SAME conditions: the request's lock row is written only if the price fits (per-claim, total,
+ * `until`, the grant's day), and the spend lands only if that lock is this attempt's. So nothing
+ * is written when it does not fit — no lock to clean up, whatever happens to the isolate.
+ *   - `locked`: this request already spent (a retry): never spend or pay again;
+ *   - null: it does not fit (or there is no live standing): ask the user;
+ *   - else the delegation to pay with, what is left, and the lock's id (for a refund).
+ * An exhausted standing (`spentUpay` = `totalUpay`) or one past `until` approves nothing, free
+ * claims included.
+ */
+export async function spendStanding(db, spend, now = new Date()) {
+    const { grantId, did, requestDigest, upay } = spend;
+    const spendId = crypto.randomUUID();
+    const fits = sql `exists (select 1 from ${mcpStanding} where ${and(eq(mcpStanding.grantId, grantId), eq(mcpStanding.did, did), gt(mcpStanding.until, now), lte(sql `${upay}`, mcpStanding.perClaimUpay), sql `${mcpStanding.spentUpay} < ${mcpStanding.totalUpay}`, lte(sql `${mcpStanding.spentUpay} + ${upay}`, mcpStanding.totalUpay), sql `${mcpStanding.delegation} is not null`)}) and ${spentToday(grantId, now)} + ${upay} <= ${GRANT_CAP_UPAY}`;
+    const [, taken] = await db.batch([
+        db
+            .insert(mcpStandingSpends)
+            .select(sql `select ${grantId}, ${requestDigest}, ${spendId}, ${upay}, ${now.getTime()} where ${fits}`)
+            .onConflictDoNothing(),
+        db
+            .update(mcpStanding)
+            .set({ spentUpay: sql `${mcpStanding.spentUpay} + ${upay}` })
+            .where(and(eq(mcpStanding.grantId, grantId), 
+        // Only if THIS attempt wrote the request's lock (which it did only if the price fit).
+        sql `exists (select 1 from ${mcpStandingSpends} where ${mcpStandingSpends.grantId} = ${grantId} and ${mcpStandingSpends.requestDigest} = ${requestDigest} and ${mcpStandingSpends.spendId} = ${spendId})`))
+            .returning({
+            delegation: mcpStanding.delegation,
+            totalUpay: mcpStanding.totalUpay,
+            spentUpay: mcpStanding.spentUpay,
+        }),
+    ]);
+    const [row] = taken;
+    if (row?.delegation) {
+        return { delegation: row.delegation, remainingUpay: row.totalUpay - row.spentUpay, spendId };
+    }
+    const lock = await db.query.mcpStandingSpends.findFirst({
+        columns: { spendId: true },
+        where: and(eq(mcpStandingSpends.grantId, grantId), eq(mcpStandingSpends.requestDigest, requestDigest)),
+    });
+    return lock ? "locked" : null;
+}
+/**
+ * Proven nothing reserved: give `upay` back — to the delegation it was spent from only (a PUT in
+ * between keeps the count, conservatively) — and release THIS spend's lock, in one batch.
+ */
+export async function refundStanding(db, spend) {
+    const { grantId, spendId, delegation, upay } = spend;
+    await db.batch([
+        db
+            .update(mcpStanding)
+            .set({ spentUpay: sql `${mcpStanding.spentUpay} - ${upay}` })
+            .where(and(eq(mcpStanding.grantId, grantId), eq(mcpStanding.delegation, delegation), sql `${mcpStanding.spentUpay} >= ${upay}`)),
+        db
+            .delete(mcpStandingSpends)
+            .where(and(eq(mcpStandingSpends.grantId, grantId), eq(mcpStandingSpends.spendId, spendId))),
+    ]);
+}
+//# sourceMappingURL=standing.js.map

package/dist/lib/oauth/standing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing.js","sourceRoot":"","sources":["../../../src/lib/oauth/standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAA0B,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC;AAEjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,IAAI,QAAQ,CACV,8FAA8F,EAC9F,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,CACrE,CAAC;AASJ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAY,CAAC;AAC9C,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AACpC,wEAAwE;AACxE,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,MAAsB,EACtB,MAAsF,EACtF,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,GAAG,KAAK,IAAI,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,OAAO,EACL,qFAAqF;SACxF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,GAAG,gBAAgB,GAAG,cAAc,EAAE,CAAC;QAClF,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,iBAAiB,CACtB,UAAU,EACV,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,EACpD,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,EACvC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAY,EACZ,OAAe,EACf,GAAW,EACX,MAAsB,EACtB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,GAAG,GAAG;QACV,OAAO;QACP,GAAG;QACH,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnC,SAAS;QACT,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACpC,UAAU;QACV,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO;QAC3B,GAAG,EAAE;YACH,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,MAAM,SAAS,EAAE;YACvD,UAAU;SACX;QACD,QAAQ,EAAE,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,MAAM,SAAS,OAAO,GAAG,CAAC,SAAS,EAAE;KAC3E,CAAC;SACD,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAY,EACZ,QAAiF,EACjF,QAAkF,EAClF,SAAe,EACf,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,UAAU,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CACjB,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAChC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,EAClC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAChC,CAAC;IACF,4FAA4F;IAC5F,MAAM,IAAI,GAAG,GAAG,CAAA,yBAAyB,iBAAiB,UAAU,iBAAiB,CAAC,OAAO,MAAM,QAAQ,CAAC,OAAO,QAAQ,iBAAiB,CAAC,aAAa,MAAM,SAAS,QAAQ,iBAAiB,CAAC,OAAO,MAAM,QAAQ,GAAG,CAAC;IAC5N,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,IAAI,CAAC,CAAC;IAC3C,iGAAiG;IACjG,MAAM,MAAM,GAAG,QAAQ;QACrB,CAAC,CAAC,GAAG,CAAA,GAAG,SAAS,OAAO,KAAK,kCAAkC,WAAW,UAAU,WAAW,CAAC,OAAO,MAAM,QAAQ,CAAC,OAAO,QAAQ,WAAW,CAAC,SAAS,MAAM,SAAS,MAAM,KAAK,GAAG;QACvL,CAAC,CAAC,GAAG,CAAA,GAAG,CAAC;IACX,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,CAAC,iBAAiB,CAAC;SACzB,MAAM,CACL,GAAG,CAAA,UAAU,QAAQ,CAAC,OAAO,KAAK,SAAS,KAAK,QAAQ,QAAQ,GAAG,CAAC,OAAO,EAAE,gCAAgC,YAAY,UAAU,OAAO,SAAS,MAAM,EAAE,CAC5J;SACA,mBAAmB,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE;SACZ,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;SACvE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SACzB,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,OAAyB,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QAClC,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC;YAC3B,MAAM;YACN,IAAI;YACJ,EAAE;iBACC,MAAM,CAAC,WAAW,CAAC;iBACnB,MAAM,CACL,GAAG,CAAA,UAAU,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,GAAG,KAAK,GAAG,KAAK,KAAK,KAAK,SAAS,KAAK,KAAK,KAAK,UAAU,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAC1I;iBACA,kBAAkB,CAAC;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO;gBAC3B,GAAG,EAAE;oBACH,GAAG,EAAE,QAAQ,CAAC,GAAG;oBACjB,YAAY,EAAE,GAAG;oBACjB,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;oBACtB,SAAS,EAAE,GAAG;oBACd,SAAS,EAAE,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,MAAM,SAAS,EAAE;oBACvD,UAAU;iBACX;gBACD,uFAAuF;gBACvF,QAAQ,EAAE,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,MAAM,SAAS,OAAO,KAAK,EAAE;aACnE,CAAC;SACL,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAY,EAAE,OAAe,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,EAAE,EAAE,CAC9E,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;IAC7B,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,EAChC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAC1B,GAAG,CAAA,GAAG,WAAW,CAAC,UAAU,cAAc,CAC3C;CACF,CAAC,CAAC;AAEL,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAY,EAAE,OAAe;IAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;QACpD,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;QACtB,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACrD,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;QACtB,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,QAAQ,EAAE,GAAG,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,aAAqB;IAC5E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACxD,gFAAgF;IAChF,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAY,EAAE,OAAe,EAAE,GAAW;IAC7E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;QAC/C,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;QACtB,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;QAC1E,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EACjC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,EACzB,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,EAClE,GAAG,CAAA,GAAG,YAAY,CAAC,UAAU,cAAc,CAC5C;KACF,CAAC,CAAC;IACH,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,MAAM,cAAc,CAAC,CAAC,CAAC,UAAoB,EAAE,CAAC,CAAC,aAAa,CAAC;YAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAChG,MAAM,EAAE,CAAC,KAAK,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9D,EAAE;aACC,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;aAC5C,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QACjF,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;KAChE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAY,EACZ,KAA4E,EAC5E,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,CAAA,yBAAyB,WAAW,UAAU,GAAG,CAC/D,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,EAChC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EACxB,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAC1B,GAAG,CAAC,GAAG,CAAA,GAAG,IAAI,EAAE,EAAE,WAAW,CAAC,YAAY,CAAC,EAC3C,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,MAAM,WAAW,CAAC,SAAS,EAAE,EACxD,GAAG,CAAC,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,MAAM,IAAI,EAAE,EAAE,WAAW,CAAC,SAAS,CAAC,EACnE,GAAG,CAAA,GAAG,WAAW,CAAC,UAAU,cAAc,CAC3C,SAAS,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO,cAAc,EAAE,CAAC;IACpE,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC;QAC/B,EAAE;aACC,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CACL,GAAG,CAAA,UAAU,OAAO,KAAK,aAAa,KAAK,OAAO,KAAK,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAC9F;aACA,mBAAmB,EAAE;QACxB,EAAE;aACC,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,MAAM,IAAI,EAAE,EAAE,CAAC;aAC3D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAChC,sFAAsF;QACtF,GAAG,CAAA,yBAAyB,iBAAiB,UAAU,iBAAiB,CAAC,OAAO,MAAM,OAAO,QAAQ,iBAAiB,CAAC,aAAa,MAAM,aAAa,QAAQ,iBAAiB,CAAC,OAAO,MAAM,OAAO,GAAG,CACzM,CACF;aACA,SAAS,CAAC;YACT,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,CAAC;KACL,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;QACpB,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC;QACtD,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QAC1B,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EACtC,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,CACnD;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAY,EACZ,KAA6E;IAE7E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,EAAE,CAAC,KAAK,CAAC;QACb,EAAE;aACC,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,MAAM,IAAI,EAAE,EAAE,CAAC;aAC3D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,EAChC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,EACtC,GAAG,CAAA,GAAG,WAAW,CAAC,SAAS,OAAO,IAAI,EAAE,CACzC,CACF;QACH,EAAE;aACC,MAAM,CAAC,iBAAiB,CAAC;aACzB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/oauth/token.d.ts

@@ -0,0 +1,60 @@
+/**
+ * MCP over OAuth, the oracle as RESOURCE SERVER (spec 2026-10-06 "Oracle side"; S3 review §4):
+ * the access token AuthHub mints for `/v1/mcp` and the discovery document that points a client at
+ * AuthHub. AuthHub is the one authorization server (`AUTH_HUB_URL`, network-defaulted); the
+ * oracle never sees a user's key, only this 5-minute JWT.
+ *
+ * A token is accepted only if EVERY one holds: EdDSA (no other `alg`, so no `none` and no HMAC
+ * confusion), `typ: at+jwt`, signed by a key in AuthHub's JWKS, `iss` exactly AuthHub, `aud`
+ * exactly THIS oracle's MCP URL (scheme, host and path — RFC 8707, so a token for one oracle is
+ * useless at another; one `aud`, never a list), unexpired within 60 s of skew, issued (`iat`) at
+ * most 10 minutes ago, and `sub` a `did:ixo` account. The JWKS is read through KV (`readCache`) and
+ * fetched only through `fetchClient`; a miss or a `kid` it does not list fetches it, at most once
+ * per REFETCH_MS per isolate, so neither junk `kid`s nor an outage turn into a stream of fetches.
+ *
+ * A token is accepted on `/v1/mcp` only (`routes/v1/mcp`): `/v1/api` never parses one.
+ */
+import type { Config } from "../../config.js";
+import type { TraceContext } from "../tracing.js";
+/** The scopes AuthHub grants (its plan, Global Constraints): exactly these two. */
+export declare const OAUTH_SCOPES: readonly ["claims:write", "claims:read"];
+export type OAuthScope = (typeof OAUTH_SCOPES)[number];
+/** Who an OAuth access token says is calling, and through which app. */
+export interface OAuthIdentity {
+    /** The user (`sub`), a `did:ixo` account. */
+    did: string;
+    clientId: string;
+    /** The app's registered name; `clientId` when the token carries none. */
+    clientName: string;
+    /** AuthHub's `verified`: every redirect URI the client registered is Claude's or ChatGPT's own
+     *  callback, so only that app can hold the token. Exactly `true`, else false. */
+    clientVerified: boolean;
+    /** AuthHub's grant (`gid`): the unit a user revokes, and the rate-limit and spend-cap key. */
+    grantId: string;
+    scopes: readonly OAuthScope[];
+}
+/** The resource every token must be for: this oracle's MCP endpoint, exactly. */
+export declare const mcpResource: (config: Pick<Config, "ORACLE_HOSTNAME">) => string;
+/** RFC 9728's well-known location for that resource. */
+export declare const prmUrl: (config: Pick<Config, "ORACLE_HOSTNAME">) => string;
+/** AuthHub's `did:web` — the one invoker of the approvals back-channel. */
+export declare const authHubDid: (config: Pick<Config, "AUTH_HUB_URL">) => string;
+/** RFC 9728 protected-resource metadata for `/v1/mcp`. */
+export declare const protectedResource: (config: Pick<Config, "ORACLE_HOSTNAME" | "AUTH_HUB_URL">) => {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: ("claims:read" | "claims:write")[];
+    bearer_methods_supported: string[];
+};
+/** A bearer that is not ours to accept: the caller gets 401 and goes back through OAuth. */
+export declare class InvalidToken extends Error {
+}
+/** Three base64url segments: the only bearer shape `/v1/mcp` treats as an OAuth token. */
+export declare const looksLikeJwt: (token: string) => boolean;
+export interface TokenDeps {
+    config: Pick<Config, "ORACLE_HOSTNAME" | "AUTH_HUB_URL">;
+    cache: KVNamespace;
+    trace?: TraceContext;
+}
+export declare function verifyAccessToken(deps: TokenDeps, token: string): Promise<OAuthIdentity>;
+//# sourceMappingURL=token.d.ts.map

package/dist/lib/oauth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAM3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,mFAAmF;AACnF,eAAO,MAAM,YAAY,YAAI,cAAc,EAAE,aAAa,CAAU,CAAC;AACrE,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB;qFACiF;IACjF,cAAc,EAAE,OAAO,CAAC;IACxB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;CAC/B;AAYD,iFAAiF;AACjF,eAAO,MAAM,WAAW,WAAY,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,KAAG,MAC1B,CAAC;AAE7C,wDAAwD;AACxD,eAAO,MAAM,MAAM,WAAY,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,KAAG,MACgB,CAAC;AAElF,2EAA2E;AAC3E,eAAO,MAAM,UAAU,WAAY,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,KAAG,MACrB,CAAC;AAE9C,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,WAAY,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC;IACxF,QAAQ;IACR,qBAAqB;IACrB,gBAAgB;IAChB,wBAAwB;CACxB,CAAC;AAEH,4FAA4F;AAC5F,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,0FAA0F;AAC1F,eAAO,MAAM,YAAY,UAAW,MAAM,KAAG,OACmB,CAAC;AAEjE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC,CAAC;IACzD,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAkC9F"}