@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/lib/payments/settle.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Settle on the receipt (payments spec §4 step 6, §13.0 addition 2, §13.4): once the engine's
+ * receipt for an API claim is recorded, x402 `/settle` with the body verified at accept plus
+ * `receipts: [{ claimId, jws }]` — the operator is paid only for delivered decisions. Called by the
+ * workflows right after the decision row (and the fold's), by a sync `200` whose workflow call has
+ * not landed yet (`paymentResponse`), and by the reconcile cron until the claim is `paid`.
+ *
+ * The body is built from the verified `PAYMENT-SIGNATURE` on the charge row (KV as the fallback),
+ * so a retry is byte-identical — the only way the facilitator replays (`replayed: true`); a body
+ * with another claim's receipt is another settle of the same offer, and its answer covers THAT
+ * claim. So an answer is acted on only when it names this offer and lists this claim `settled` or
+ * `paid`; anything else is logged and leaves the row as it was.
+ *
+ * The answer lands on the claim's `api_charges` row, verbatim in `settleResult`:
+ *   - `success` ⇒ `paid`, `txHash` = the transfer's `transaction`;
+ *   - `settlement_pending` ⇒ `settled` (the receipt is accepted; the minute's transfer pays it);
+ *   - `reservation_released` ⇒ `released`; any other refusal ⇒ `failed`. Only a `reserved` row
+ *     takes a refusal; a `settled` one never goes back (logged loudly).
+ * The facilitator is authoritative: a row the reconcile marked `released` on its own reckoning
+ * (`reservation_expired`) still settles if the facilitator accepts the receipt
+ * (`reservation_expired_late`). The first answer that settles a row emits `payment.settled` — the
+ * guard is the row's own status, so a replay or a concurrent caller announces nothing new.
+ *
+ * A `settled` row whose verified header is gone is resolved by `GET /settlements/:id`, never failed.
+ * NEVER throws: an outage, a lost header, an unexpected answer or any other trouble is `skipped`
+ * and the row stays as it was for the reconcile.
+ */
+import { type SettleOutcome, X402PaymentResponse } from "../../contracts/index.js";
+import type { Database } from "../../db/client.js";
+import { type FacilitatorDeps } from "./facilitator.js";
+export type SettleDeps = FacilitatorDeps & {
+    db: Database;
+};
+/** What the reconcile marks a reservation past the facilitator's TTL with no receipt. */
+export declare const EXPIRED = "reservation_expired";
+export declare function settleClaim(deps: SettleDeps, claimId: string, receiptJws: string): Promise<SettleOutcome>;
+/**
+ * A decided claim's `PAYMENT-RESPONSE` (payments spec §4 step 8): the stored `/settle` answer —
+ * settling first when the workflow's own call has not landed yet (the sync `200` may read the
+ * decision row a moment before it). Null for a free claim, a claim without a receipt yet
+ * (`pending_review`), a refused settle, an outage or any other trouble — never a throw.
+ */
+export declare function paymentResponse(deps: SettleDeps, claimId: string): Promise<X402PaymentResponse | null>;
+//# sourceMappingURL=settle.d.ts.map

package/dist/lib/payments/settle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settle.d.ts","sourceRoot":"","sources":["../../../src/lib/payments/settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,KAAK,aAAa,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,eAAe,CAAC;AAKvB,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG;IAAE,EAAE,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE5D,yFAAyF;AACzF,eAAO,MAAM,OAAO,wBAAwB,CAAC;AAoB7C,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAQxB;AAwOD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAuBrC"}

package/dist/lib/payments/settle.js

@@ -0,0 +1,306 @@
+/**
+ * Settle on the receipt (payments spec §4 step 6, §13.0 addition 2, §13.4): once the engine's
+ * receipt for an API claim is recorded, x402 `/settle` with the body verified at accept plus
+ * `receipts: [{ claimId, jws }]` — the operator is paid only for delivered decisions. Called by the
+ * workflows right after the decision row (and the fold's), by a sync `200` whose workflow call has
+ * not landed yet (`paymentResponse`), and by the reconcile cron until the claim is `paid`.
+ *
+ * The body is built from the verified `PAYMENT-SIGNATURE` on the charge row (KV as the fallback),
+ * so a retry is byte-identical — the only way the facilitator replays (`replayed: true`); a body
+ * with another claim's receipt is another settle of the same offer, and its answer covers THAT
+ * claim. So an answer is acted on only when it names this offer and lists this claim `settled` or
+ * `paid`; anything else is logged and leaves the row as it was.
+ *
+ * The answer lands on the claim's `api_charges` row, verbatim in `settleResult`:
+ *   - `success` ⇒ `paid`, `txHash` = the transfer's `transaction`;
+ *   - `settlement_pending` ⇒ `settled` (the receipt is accepted; the minute's transfer pays it);
+ *   - `reservation_released` ⇒ `released`; any other refusal ⇒ `failed`. Only a `reserved` row
+ *     takes a refusal; a `settled` one never goes back (logged loudly).
+ * The facilitator is authoritative: a row the reconcile marked `released` on its own reckoning
+ * (`reservation_expired`) still settles if the facilitator accepts the receipt
+ * (`reservation_expired_late`). The first answer that settles a row emits `payment.settled` — the
+ * guard is the row's own status, so a replay or a concurrent caller announces nothing new.
+ *
+ * A `settled` row whose verified header is gone is resolved by `GET /settlements/:id`, never failed.
+ * NEVER throws: an outage, a lost header, an unexpected answer or any other trouble is `skipped`
+ * and the row stays as it was for the reconcile.
+ */
+import { and, eq } from "drizzle-orm";
+import { X402PaymentResponse } from "../../contracts/index.js";
+import { apiCharges, decisions } from "../../db/schema.js";
+import { emitPaymentSettled } from "../api-lane/webhooks.js";
+import { reportAlert, reportError } from "../sentry.js";
+import { createFacilitatorClient, SettleRefusal, } from "./facilitator.js";
+import { readPaidOffer, settleBody } from "./gate.js";
+import { openHeader } from "./header-seal.js";
+import { chargeTerms } from "./terms.js";
+/** What the reconcile marks a reservation past the facilitator's TTL with no receipt. */
+export const EXPIRED = "reservation_expired";
+const EXPIRED_LATE = "reservation_expired_late";
+/** The `/settle` refusals that say our receipt itself is wrong — each one pages. */
+const RECEIPT_REFUSALS = new Set(["invalid_receipt", "receipt_mismatch"]);
+/** Logged and reported, never paged: the reconcile meets the same answer every run. */
+function unexpectedAnswer(logger, fields) {
+    logger.error("payments.settle.unexpected-answer", fields);
+    reportError(new Error("payments.settle.unexpected-answer"), {
+        lane: "payments",
+        step: "settle",
+        claimId: typeof fields.claimId === "string" ? fields.claimId : undefined,
+    });
+}
+const parsed = (value) => {
+    const r = X402PaymentResponse.safeParse(value);
+    return r.success ? r.data : null;
+};
+export async function settleClaim(deps, claimId, receiptJws) {
+    try {
+        return await settleOnce(deps, claimId, receiptJws);
+    }
+    catch (err) {
+        deps.logger.error("payments.settle.failed", { claimId, detail: String(err) });
+        reportError(err, { lane: "payments", step: "settle", claimId });
+        return { status: "skipped", reason: "unavailable" };
+    }
+}
+async function settleOnce(deps, claimId, receiptJws) {
+    const { db, logger, cache } = deps;
+    const charge = await db.query.apiCharges.findFirst({ where: eq(apiCharges.claimId, claimId) });
+    // A free source (billing mode `none`) records no charge: nothing was reserved.
+    if (!charge)
+        return { status: "skipped", reason: "no_charge" };
+    if (charge.status === "paid")
+        return { status: "paid", response: parsed(charge.settleResult) };
+    if (charge.status === "failed" || (charge.status === "released" && charge.error !== EXPIRED)) {
+        return { status: charge.status, reason: charge.error ?? charge.status };
+    }
+    const stored = charge.paymentHeader ??
+        (charge.offerId ? (await readPaidOffer(cache, charge.offerId))?.header : null) ??
+        null;
+    const header = stored === null ? null : await openHeader(deps.config, stored);
+    if (!header || !charge.offerId) {
+        if (charge.status === "settled" && charge.settlementId)
+            return resolve(deps, charge);
+        logger.warn("payments.settle.no-payment", { claimId, offerId: charge.offerId });
+        return { status: "skipped", reason: "no_payment" };
+    }
+    let answer;
+    try {
+        answer = await createFacilitatorClient(deps).settle(settleBody(header, charge.offerId, claimId, receiptJws));
+    }
+    catch (err) {
+        logger.warn("payments.settle.unavailable", {
+            claimId,
+            detail: err instanceof Error ? err.message : String(err),
+        });
+        return { status: "skipped", reason: "unavailable" };
+    }
+    const response = parsed(answer);
+    if (response) {
+        const receipt = response.extensions["org.udid.receipt@1"];
+        const mine = receipt.claims.find((c) => c.claimId === claimId);
+        // Another offer's settlement, or one that does not settle THIS claim (a sibling's answer).
+        if (receipt.offerId !== charge.offerId ||
+            (mine?.state !== "settled" && mine?.state !== "paid")) {
+            unexpectedAnswer(logger, {
+                claimId,
+                offerId: charge.offerId,
+                answerOfferId: receipt.offerId,
+                claimState: mine?.state ?? null,
+            });
+            return { status: "skipped", reason: "unexpected_answer" };
+        }
+        const status = response.success && mine.state === "paid" ? "paid" : "settled";
+        await land(deps, charge, {
+            status,
+            settlementId: receipt.settlementId,
+            txHash: status === "paid" ? response.transaction : null,
+            settleResult: response,
+        });
+        logger.info("payments.settled", {
+            claimId,
+            status,
+            settlementId: receipt.settlementId,
+            replayed: receipt.replayed,
+        });
+        return { status, response };
+    }
+    const refusal = SettleRefusal.safeParse(answer);
+    // `settlement_pending` is never a refusal: one that did not parse as pending is malformed.
+    if (!refusal.success || refusal.data.errorReason === "settlement_pending") {
+        unexpectedAnswer(logger, {
+            claimId,
+            offerId: charge.offerId,
+            answer: JSON.stringify(answer).slice(0, 300),
+        });
+        return { status: "skipped", reason: "unexpected_answer" };
+    }
+    const reason = refusal.data.errorReason;
+    const status = reason === "reservation_released" ? "released" : "failed";
+    // Only a reservation takes a refusal.
+    const refused = await db
+        .update(apiCharges)
+        .set({ status, error: reason, settleResult: refusal.data })
+        .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "reserved")))
+        .returning({ claimId: apiCharges.claimId });
+    if (refused.length > 0) {
+        logger.warn("payments.settle.refused", { claimId, reason });
+        // The facilitator refused our receipt (the spec's "reconcile mismatch"): a delivered decision
+        // the operator will not be paid for. Other refusals (`reservation_released` — the hold's own
+        // clock — and the rest) are the reconcile's to settle, not a person's.
+        if (RECEIPT_REFUSALS.has(reason)) {
+            await reportAlert(deps, "payments.receipt-mismatch", { claimId, code: reason });
+        }
+        return { status, reason };
+    }
+    // One the reconcile already called lapsed takes the facilitator's word for why, and stays
+    // released — now final.
+    const lapsed = await db
+        .update(apiCharges)
+        .set({ error: reason, settleResult: refusal.data })
+        .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "released"), eq(apiCharges.error, EXPIRED)))
+        .returning({ claimId: apiCharges.claimId });
+    if (lapsed.length > 0)
+        return { status: "released", reason };
+    // A `settled` row: the facilitator accepted the receipt before. Never downgraded.
+    logger.error("payments.settle.refused-after-settled", { claimId, reason });
+    // An issue, never a page: the reconcile meets this row again every run.
+    reportError(new Error("payments.settle.refused-after-settled"), {
+        lane: "payments",
+        step: "settle",
+        claimId,
+        context: { reason },
+    });
+    return { status: "skipped", reason: "unexpected_answer" };
+}
+/**
+ * Write an accepted receipt's answer: from `reserved` (or a reservation the reconcile called lapsed)
+ * it is the claim's first settlement and emits `payment.settled`; from `settled` it is progress
+ * (written even when unchanged, so the reconcile's oldest-first walk moves on).
+ */
+async function land(deps, charge, fields) {
+    const { db, logger } = deps;
+    const { claimId } = charge;
+    const returning = {
+        sourceId: apiCharges.sourceId,
+        amount: apiCharges.amount,
+        amountCents: apiCharges.amountCents,
+        scheme: apiCharges.scheme,
+        paymentHeader: apiCharges.paymentHeader,
+        lane: apiCharges.lane,
+    };
+    const [first] = await db
+        .update(apiCharges)
+        .set({ ...fields, error: null })
+        .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "reserved")))
+        .returning(returning);
+    const [late] = first
+        ? []
+        : await db
+            .update(apiCharges)
+            .set({ ...fields, error: EXPIRED_LATE })
+            .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "released"), eq(apiCharges.error, EXPIRED)))
+            .returning(returning);
+    const settled = first ?? late;
+    if (!settled) {
+        await db
+            .update(apiCharges)
+            .set(fields)
+            .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "settled")));
+        return;
+    }
+    if (late)
+        logger.warn("payments.settle.expired-late", { claimId });
+    // `payment.settled` is an API claim's webhook: a chain claim (review billing) has no timeline.
+    if (settled.lane === "chain")
+        return;
+    // The receipt is accepted and the row says so: a lost webhook must not undo that — logged, and
+    // the record still shows the settlement.
+    await emitPaymentSettled(db, {
+        claimId,
+        sourceId: settled.sourceId,
+        settlementId: fields.settlementId,
+        terms: chargeTerms(settled),
+        settledAt: new Date(),
+    }).catch((err) => {
+        logger.error("payments.settled-webhook.failed", { claimId, detail: String(err) });
+        reportError(err, { lane: "payments", step: "settled-webhook", claimId });
+    });
+}
+/**
+ * A `settled` row whose verified header is gone: ask `GET /settlements/:id` where this claim got
+ * to. Paid ⇒ `paid` with its transaction; anything else ⇒ still `settled` (touched, so the
+ * reconcile moves on). Never failed — the receipt was accepted.
+ */
+async function resolve(deps, charge) {
+    const { db, logger } = deps;
+    const { claimId } = charge;
+    const settlement = await createFacilitatorClient(deps)
+        .settlement(charge.settlementId)
+        .catch((err) => {
+        logger.warn("payments.settle.unavailable", { claimId, detail: String(err) });
+        return undefined;
+    });
+    if (settlement === undefined)
+        return { status: "skipped", reason: "unavailable" };
+    const mine = settlement?.claims.find((c) => c.claimId === claimId);
+    if (!settlement || settlement.offerId !== charge.offerId || !mine) {
+        unexpectedAnswer(logger, {
+            claimId,
+            settlementId: charge.settlementId,
+            found: settlement !== null,
+        });
+        return { status: "skipped", reason: "unexpected_answer" };
+    }
+    if (mine.state === "paid" && mine.transaction) {
+        const result = parsed(settlement.result);
+        await db
+            .update(apiCharges)
+            .set({
+            status: "paid",
+            txHash: mine.transaction,
+            ...(result ? { settleResult: result } : {}),
+        })
+            .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "settled")));
+        logger.info("payments.settled", { claimId, status: "paid", via: "settlement" });
+        return { status: "paid", response: result ?? parsed(charge.settleResult) };
+    }
+    await db
+        .update(apiCharges)
+        .set({ updatedAt: new Date() })
+        .where(and(eq(apiCharges.claimId, claimId), eq(apiCharges.status, "settled")));
+    return { status: "settled", response: parsed(charge.settleResult) };
+}
+/**
+ * A decided claim's `PAYMENT-RESPONSE` (payments spec §4 step 8): the stored `/settle` answer —
+ * settling first when the workflow's own call has not landed yet (the sync `200` may read the
+ * decision row a moment before it). Null for a free claim, a claim without a receipt yet
+ * (`pending_review`), a refused settle, an outage or any other trouble — never a throw.
+ */
+export async function paymentResponse(deps, claimId) {
+    try {
+        const { db } = deps;
+        const charge = await db.query.apiCharges.findFirst({
+            columns: { status: true, settleResult: true },
+            where: eq(apiCharges.claimId, claimId),
+        });
+        if (!charge)
+            return null;
+        if (charge.status === "reserved") {
+            const decision = await db.query.decisions.findFirst({
+                columns: { receiptJws: true },
+                where: eq(decisions.claimId, claimId),
+            });
+            if (!decision?.receiptJws)
+                return null;
+            const out = await settleClaim(deps, claimId, decision.receiptJws);
+            return "response" in out ? out.response : null;
+        }
+        return parsed(charge.settleResult);
+    }
+    catch (err) {
+        deps.logger.error("payments.payment-response.failed", { claimId, detail: String(err) });
+        reportError(err, { lane: "payments", step: "payment-response", claimId });
+        return null;
+    }
+}
+//# sourceMappingURL=settle.js.map

package/dist/lib/payments/settle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settle.js","sourceRoot":"","sources":["../../../src/lib/payments/settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAsB,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAkB,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EACL,uBAAuB,EAEvB,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAItC,yFAAyF;AACzF,MAAM,CAAC,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAC7C,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAChD,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE1E,uFAAuF;AACvF,SAAS,gBAAgB,CAAC,MAA4B,EAAE,MAA+B;IACrF,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IAC1D,WAAW,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,EAAE;QAC1D,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;IAChC,MAAM,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAgB,EAChB,OAAe,EACf,UAAkB;IAElB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAgB,EAChB,OAAe,EACf,UAAkB;IAElB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/F,+EAA+E;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GACV,MAAM,CAAC,aAAa;QACpB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,IAAI,CAAC;IACP,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,CACjD,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CACxD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YACzC,OAAO;YACP,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC/D,2FAA2F;QAC3F,IACE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAClC,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC,EACrD,CAAC;YACD,gBAAgB,CAAC,MAAM,EAAE;gBACvB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa,EAAE,OAAO,CAAC,OAAO;gBAC9B,UAAU,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM;YACN,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;YACvD,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC9B,OAAO;YACP,MAAM;YACN,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,2FAA2F;IAC3F,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;QAC1E,gBAAgB,CAAC,MAAM,EAAE;YACvB,OAAO;YACP,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzE,sCAAsC;IACtC,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;SAC1D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;SAC9E,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,8FAA8F;QAC9F,6FAA6F;QAC7F,uEAAuE;QACvE,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,WAAW,CAAC,IAAI,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IACD,0FAA0F;IAC1F,wBAAwB;IACxB,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;SAClD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAC/B,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAC9B,CACF;SACA,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAC7D,kFAAkF;IAClF,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,wEAAwE;IACxE,WAAW,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAAE;QAC9D,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AAC5D,CAAC;AAID;;;;GAIG;AACH,KAAK,UAAU,IAAI,CAAC,IAAgB,EAAE,MAAiB,EAAE,MAAc;IACrE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,SAAS,GAAG;QAChB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,IAAI,EAAE,UAAU,CAAC,IAAI;KACtB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC/B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;SAC9E,SAAS,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;aACvC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAC/B,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAC9B,CACF;aACA,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,MAAM,CAAC;aACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,IAAI,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,+FAA+F;IAC/F,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IACrC,+FAA+F;IAC/F,yCAAyC;IACzC,MAAM,kBAAkB,CAAC,EAAE,EAAE;QAC3B,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,YAAsB;QAC3C,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACf,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,MAAiB;IACxD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC;SACnD,UAAU,CAAC,MAAM,CAAC,YAAsB,CAAC;SACzC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACL,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAClF,MAAM,IAAI,GAAG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QAClE,gBAAgB,CAAC,MAAM,EAAE;YACvB,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,UAAU,KAAK,IAAI;SAC3B,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAgB,EAChB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7C,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;gBAClD,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;gBAC7B,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,UAAU;gBAAE,OAAO,IAAI,CAAC;YACvC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YAClE,OAAO,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/payments/terms.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What a charge was paid in, for the claim record's `payment` and `payment.settled` (contracts
+ * v1.4): the charge row's `scheme`, kept beside its sealed PAYMENT-SIGNATURE (header-seal.ts) — or,
+ * on a row written before it was, read off a header still in the clear. Card
+ * (`stripe-manual-capture`) is US cents — this claim's price, `amountCents`; PAY (ixo-pay) is upay;
+ * USDC on Base (`exact`) is USDC base units, the same number as upay. No header (a row from before headers were kept) reads as PAY, the only way to pay then.
+ */
+export type ChargeTerms = {
+    scheme: "ixo-pay";
+    amount: string;
+    asset: "upay";
+} | {
+    scheme: "stripe-manual-capture";
+    amount: string;
+    asset: "usd";
+} | {
+    scheme: "exact";
+    amount: string;
+    asset: "usdc";
+};
+export declare function chargeTerms(charge: {
+    amount: string;
+    amountCents: number;
+    scheme?: string | null;
+    paymentHeader: string | null;
+}): ChargeTerms;
+//# sourceMappingURL=terms.d.ts.map

package/dist/lib/payments/terms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.d.ts","sourceRoot":"","sources":["../../../src/lib/payments/terms.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACjE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GAAG,WAAW,CAUd"}

package/dist/lib/payments/terms.js

@@ -0,0 +1,21 @@
+/**
+ * What a charge was paid in, for the claim record's `payment` and `payment.settled` (contracts
+ * v1.4): the charge row's `scheme`, kept beside its sealed PAYMENT-SIGNATURE (header-seal.ts) — or,
+ * on a row written before it was, read off a header still in the clear. Card
+ * (`stripe-manual-capture`) is US cents — this claim's price, `amountCents`; PAY (ixo-pay) is upay;
+ * USDC on Base (`exact`) is USDC base units, the same number as upay. No header (a row from before headers were kept) reads as PAY, the only way to pay then.
+ */
+import { isSealed } from "../api-lane/webhook-crypto.js";
+import { schemeOf } from "./header-seal.js";
+export function chargeTerms(charge) {
+    const header = charge.paymentHeader;
+    const scheme = charge.scheme ?? (header && !isSealed(header) ? schemeOf(header) : null) ?? "ixo-pay";
+    if (scheme === "stripe-manual-capture") {
+        return { scheme, amount: String(charge.amountCents), asset: "usd" };
+    }
+    // USDC's base unit (6 decimals) IS the micro-USD, as upay is: the claim's own amount.
+    if (scheme === "exact")
+        return { scheme, amount: charge.amount, asset: "usdc" };
+    return { scheme: "ixo-pay", amount: charge.amount, asset: "upay" };
+}
+//# sourceMappingURL=terms.js.map

package/dist/lib/payments/terms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.js","sourceRoot":"","sources":["../../../src/lib/payments/terms.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAOzC,MAAM,UAAU,WAAW,CAAC,MAK3B;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;IACpC,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACxF,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,sFAAsF;IACtF,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrE,CAAC"}

package/dist/lib/payouts.d.ts

@@ -0,0 +1,20 @@
+/**
+ * S16 — `OracleConfig.payouts` → the engine's `payout` block (payouts design §4.7). Pure over the
+ * registered config: one function the decide step and the fold both call, so the two can never send
+ * different blocks for one claim.
+ */
+import { getOracle } from "../oracle.js";
+import type { PayoutRequest } from "./engine/types.js";
+type PayoutConfig = NonNullable<ReturnType<typeof getOracle>["config"]["payouts"]>[string];
+export declare function payoutsFor(protocolDid: string): PayoutConfig | undefined;
+/**
+ * The block for a configured protocol, `undefined` otherwise — and then the request carries no
+ * `payout` key at all. Sent for EVERY claim of a configured protocol: the engine derives the payee
+ * (ENGINE-CONTRACT "Company authority" → "Payee") and answers `decisionToPayRefused: "NO_PAYEE"`
+ * when the claim has none, so there is nothing for the oracle to gate on.
+ */
+export declare function payoutRequestFor(protocolDid: string): PayoutRequest | undefined;
+/** Whether any protocol has payouts — the cheap gate before resolving a protocol DID for them. */
+export declare const payoutsConfigured: () => boolean;
+export {};
+//# sourceMappingURL=payouts.d.ts.map

package/dist/lib/payouts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payouts.d.ts","sourceRoot":"","sources":["../../src/lib/payouts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,KAAK,YAAY,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAW/E;AAED,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,QAAO,OAAmD,CAAC"}

package/dist/lib/payouts.js

@@ -0,0 +1,30 @@
+/**
+ * S16 — `OracleConfig.payouts` → the engine's `payout` block (payouts design §4.7). Pure over the
+ * registered config: one function the decide step and the fold both call, so the two can never send
+ * different blocks for one claim.
+ */
+import { getOracle } from "../oracle.js";
+export function payoutsFor(protocolDid) {
+    return getOracle().config.payouts?.[protocolDid];
+}
+/**
+ * The block for a configured protocol, `undefined` otherwise — and then the request carries no
+ * `payout` key at all. Sent for EVERY claim of a configured protocol: the engine derives the payee
+ * (ENGINE-CONTRACT "Company authority" → "Payee") and answers `decisionToPayRefused: "NO_PAYEE"`
+ * when the claim has none, so there is nothing for the oracle to gate on.
+ */
+export function payoutRequestFor(protocolDid) {
+    const config = payoutsFor(protocolDid);
+    if (!config)
+        return undefined;
+    const { currency } = config;
+    const currencyField = typeof currency === "string"
+        ? { currency }
+        : "path" in currency
+            ? { currencyPath: currency.path }
+            : { asset: currency.asset, decimals: currency.decimals };
+    return { version: 1, amountPath: config.amount, ...currencyField };
+}
+/** Whether any protocol has payouts — the cheap gate before resolving a protocol DID for them. */
+export const payoutsConfigured = () => getOracle().config.payouts !== undefined;
+//# sourceMappingURL=payouts.js.map

package/dist/lib/payouts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payouts.js","sourceRoot":"","sources":["../../src/lib/payouts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAKtC,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,aAAa,GACjB,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,EAAE,QAAQ,EAAE;QACd,CAAC,CAAC,MAAM,IAAI,QAAQ;YAClB,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;YACjC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;AACrE,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC"}

package/dist/lib/readiness.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Readiness (observability spec §6): can this oracle serve right now? One computation feeds two
+ * answers — the public `GET /health/ready` serves only its `ok`, and the operator's
+ * `GET /v1/admin/status` the per-check detail. An unauthenticated probe must learn nothing about
+ * our dependencies (no names, timings or hosts), which is why the detail is operator-only.
+ *
+ * Every check runs in parallel under a 2 s budget, never throws (a throw or a timeout is
+ * `ok: false`), and records its `ms`. `ok` is every CRITICAL check ok; every check here is
+ * critical — the oracle has no gas signer of its own to report as a non-critical one.
+ *
+ * The SETTLED result is cached per isolate for 15 s, and only one caller refreshes it — the rest
+ * keep serving the last answer meanwhile (a refresher is presumed dead after 2 × the check budget
+ * + 1 s). With the per-IP limiter in front of `/health/ready` (middleware/rate-limit.ts exempts
+ * only `/health` itself), a probe storm never fans out to D1/KV/the engine — the lever SEC-07
+ * removed the earlier, uncached probe for.
+ *
+ * `identity` is a config read, not a probe: a DEPLOYED oracle must have its on-chain identity
+ * (`decision-oracle oracle init` → `ORACLE_ENTITY_DID`). It is a readiness failure rather than a boot
+ * refusal because `oracle init` reads the running worker's `/v1/info` before the entity exists,
+ * and health/did.json must boot without config; a local `wrangler dev` host is exempt, so a fresh
+ * project runs before `oracle init`.
+ *
+ * `owner-delegation` is the same kind of config read: a set `OWNER_DELEGATION_CAR` must parse. Unset
+ * is fine (the review gate then skips the owner check); a broken one would fail every review answer
+ * loud (lib/review/reviewer-grant.ts `oracleOwnerDid`) while the console's hints read it as none.
+ */
+import type { Config } from "../config.js";
+import type { OracleEnv } from "../env.js";
+import type { Metrics } from "./metrics.js";
+export interface Check {
+    ok: boolean;
+    ms: number;
+    critical: boolean;
+    /** What the operator should do — only on a failed config check (`identity`, `owner-delegation`). */
+    detail?: string;
+}
+export interface Readiness {
+    ok: boolean;
+    checks: Record<string, Check>;
+}
+export declare function readiness(env: OracleEnv, config: Config, metrics: Metrics): Promise<Readiness>;
+//# sourceMappingURL=readiness.d.ts.map

package/dist/lib/readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../src/lib/readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAUD,wBAAsB,SAAS,CAC7B,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CASpB"}