@oaath/server 0.1.0 → 0.3.1

package/dist/index.js

@@ -1,7 +1,9 @@
-import { _ as jsonResponse, a as OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, b as relayFailure, c as canonicalIdentifier, d as parseAuthorizationRequestRecord, f as parseCapabilityInvalidationRecord, g as RELAY_ERROR_STATUS, h as OaathRelayError, i as OAATH_CAPABILITY_INVALIDATION_RECORD_VERSION, l as parseAuthorizationCodeRecord, m as timestamp, n as OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, o as RELAY_LIMITS, p as parseEncryptedArtifactRecord, r as OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, s as boundedText, t as OAATH_AUTHORIZATION_CODE_RECORD_VERSION, u as parseAuthorizationDecisionRecord, v as relayErrorCode, y as relayErrorResponse } from "./records-Bgr-9PUh.js";
-import { a as relayNow, i as verifyPkceS256, r as sha256Base64Url, t as isCodeChallengeS256 } from "./challenge-AGTmUfj2.js";
-import { a as submitAuthorizationDecision, c as readAuthorizationState, d as withRelayTransaction, i as submitOwnerPhoneDecision, l as openArtifact, o as createAuthorizationRequest, r as projectOwnerPhoneRequest, s as fetchAuthorizationRequest, u as sealArtifact } from "./projection-dGIkE0rI.js";
-import { OAATH_OPERATOR_CREDENTIAL_PROFILE_VERSION, OAATH_SERVICE_BOOTSTRAP_VERSION, captureDenseArray, captureRecord, exactCapturedRecord, exactRecord, parseServiceBootstrap } from "@oaath/protocol";
+import { _ as jsonResponse, a as OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, b as relayFailure, c as canonicalIdentifier, d as parseAuthorizationRequestRecord, f as parseCapabilityInvalidationRecord, g as RELAY_ERROR_STATUS, h as OaathRelayError, i as OAATH_CAPABILITY_INVALIDATION_RECORD_VERSION, l as parseAuthorizationCodeRecord, m as timestamp, n as OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, o as RELAY_LIMITS, p as parseEncryptedArtifactRecord, r as OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, s as boundedText, t as OAATH_AUTHORIZATION_CODE_RECORD_VERSION, u as parseAuthorizationDecisionRecord, v as relayErrorCode, y as relayErrorResponse } from "./records-BQNDxbPg.js";
+import { a as relayNow, i as verifyPkceS256, r as sha256Base64Url, t as isCodeChallengeS256 } from "./challenge-DmpGSogj.js";
+import { S as withRelayTransaction, a as submitOwnerPhoneRevocationDecision, b as openArtifact, c as projectOwnerPhonePermissionSigning, d as classifyStoredAuthorizationScope, f as createAuthorizationRequest, i as requestOwnerPhoneRevocation, l as projectOwnerPhoneRequest, m as readAuthorizationState, n as fetchOwnerPhoneRevocation, p as fetchAuthorizationRequest, t as fetchClientPhoneRevocation, x as sealArtifact, y as readApprovedPermission } from "./service-Cf4f-9KP.js";
+import { i as submitAuthorizationDecision, n as listOwnerPhoneRequests, r as submitOwnerPhoneDecision } from "./inbox-B80EUVht.js";
+import { a as parseRevocationRequestRecord, i as parseRevocationDecisionRecord, n as OAATH_REVOCATION_REQUEST_RECORD_VERSION, t as OAATH_REVOCATION_DECISION_RECORD_VERSION } from "./records-BUvqmp0D.js";
+import { OAATH_GRANT_REFERENCE_APPROVED_REVISION, OAATH_GRANT_REFERENCE_VERSION, OAATH_OPERATOR_CREDENTIAL_PROFILE_VERSION, OAATH_SERVICE_BOOTSTRAP_VERSION, OAATH_WORKSPACE_ACCOUNT_CONTEXT_VERSION, captureDenseArray, captureRecord, captureServiceAccount, exactCapturedRecord, hashGrantPolicy, hashGrantPolicyCalls, isKernelExistingAccountProfile, parseAccountId, parseClientId, parseServiceBootstrap, parseVerifyGrantRevisionInput, readRpcBundlerRejection, readValidationGasDiagnostic } from "@oaath/protocol";
 import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { keccak_256 } from "@noble/hashes/sha3.js";
@@ -109,6 +111,284 @@ function resumeAuthorization(input) {
 	return withRelayTransaction(input.store, (transaction) => readAuthorizationState(transaction, input.requestId, now, (request) => request.clientId === input.caller.clientId));
 }
 //#endregion
+//#region src/directory/records.ts
+const OAATH_SERVICE_DIRECTORY_VERSION = "oaath.service-directory/v1";
+/** Captures one configuration or durable-storage boundary, including reference meaning. */
+function parseServiceDirectory(value, code) {
+	const context = /* @__PURE__ */ new WeakSet();
+	const fail = (message) => relayFailure(code, message);
+	const record = (entry, keys) => exactCapturedRecord(captureRecord(entry, "service directory record", context, fail), keys, "service directory record", fail);
+	const id = (entry) => parseClientId(entry, fail);
+	const subject = (entry) => boundedText(entry, 256, "directory subject", code);
+	function rows(entries, parse, key) {
+		const seen = /* @__PURE__ */ new Set();
+		return Object.freeze(captureDenseArray(entries, "directory records", context, fail).map((entry) => {
+			const parsed = parse(entry);
+			const identity = JSON.stringify(key(parsed));
+			if (seen.has(identity)) return fail("directory records repeat an identity");
+			seen.add(identity);
+			return Object.freeze(parsed);
+		}));
+	}
+	try {
+		const root = record(value, [
+			"version",
+			"workspaces",
+			"applications",
+			"memberships",
+			"ownerDevices",
+			"accounts",
+			"selections"
+		]);
+		if (root.version !== "oaath.service-directory/v1") return fail("service directory version is unsupported");
+		const workspaces = rows(root.workspaces, (value) => {
+			const entry = record(value, ["workspaceId", "kind"]);
+			if (entry.kind !== "personal" && entry.kind !== "team") return fail("workspace kind is unsupported");
+			return {
+				workspaceId: id(entry.workspaceId),
+				kind: entry.kind
+			};
+		}, (entry) => [entry.workspaceId]);
+		const applications = rows(root.applications, (value) => {
+			const entry = record(value, [
+				"clientId",
+				"applicationId",
+				"applicationName"
+			]);
+			return {
+				clientId: id(entry.clientId),
+				applicationId: id(entry.applicationId),
+				applicationName: boundedText(entry.applicationName, 256, "application name", code)
+			};
+		}, (entry) => [entry.clientId]);
+		const memberships = rows(root.memberships, (value) => {
+			const entry = record(value, [
+				"workspaceId",
+				"clientId",
+				"subject"
+			]);
+			return {
+				workspaceId: id(entry.workspaceId),
+				clientId: id(entry.clientId),
+				subject: subject(entry.subject)
+			};
+		}, (entry) => [
+			entry.workspaceId,
+			entry.clientId,
+			entry.subject
+		]);
+		const ownerDevices = rows(root.ownerDevices, (value) => {
+			const entry = record(value, [
+				"workspaceId",
+				"ownerDeviceId",
+				"subject"
+			]);
+			return {
+				workspaceId: id(entry.workspaceId),
+				ownerDeviceId: id(entry.ownerDeviceId),
+				subject: subject(entry.subject)
+			};
+		}, (entry) => [entry.workspaceId, entry.ownerDeviceId]);
+		const accounts = rows(root.accounts, (value) => {
+			const entry = record(value, [
+				"workspaceId",
+				"accountId",
+				"ownerDeviceId",
+				"account",
+				"ownerValidator",
+				"chainIds"
+			]);
+			const chainIds = captureDenseArray(entry.chainIds, "account chains", context, fail).map((chainId) => {
+				if (typeof chainId !== "number" || !Number.isSafeInteger(chainId) || chainId < 1) return fail("account chain must be a positive integer");
+				return chainId;
+			});
+			if (chainIds.length < 1 || chainIds.length > 32 || new Set(chainIds).size !== chainIds.length) return fail("account chains must contain 1 to 32 distinct chains");
+			return {
+				workspaceId: id(entry.workspaceId),
+				accountId: parseAccountId(entry.accountId, fail),
+				ownerDeviceId: id(entry.ownerDeviceId),
+				...captureServiceAccount(entry.account, entry.ownerValidator, context, fail),
+				chainIds: Object.freeze(chainIds)
+			};
+		}, (entry) => [entry.workspaceId, entry.accountId]);
+		const selections = rows(root.selections, (value) => {
+			const entry = record(value, [
+				"clientId",
+				"subject",
+				"workspaceId",
+				"accountId"
+			]);
+			return {
+				clientId: id(entry.clientId),
+				subject: subject(entry.subject),
+				workspaceId: id(entry.workspaceId),
+				accountId: parseAccountId(entry.accountId, fail)
+			};
+		}, (entry) => [entry.clientId, entry.subject]);
+		const workspaceIds = new Set(workspaces.map((entry) => entry.workspaceId));
+		const clientIds = new Set(applications.map((entry) => entry.clientId));
+		for (const entry of [
+			...memberships,
+			...ownerDevices,
+			...accounts
+		]) if (!workspaceIds.has(entry.workspaceId)) return fail("directory reference names an absent workspace");
+		for (const entry of memberships) if (!clientIds.has(entry.clientId)) return fail("membership names an absent application");
+		for (const account of accounts) if (!ownerDevices.some((owner) => owner.workspaceId === account.workspaceId && owner.ownerDeviceId === account.ownerDeviceId)) return fail("account names an absent owner device");
+		return Object.freeze({
+			version: OAATH_SERVICE_DIRECTORY_VERSION,
+			workspaces,
+			applications,
+			memberships,
+			ownerDevices,
+			accounts,
+			selections
+		});
+	} catch {
+		return fail("service directory is invalid");
+	}
+}
+//#endregion
+//#region src/directory/service.ts
+/**
+* Owns membership/account selection and atomic phone enrollment over one
+* versioned directory document. Enrollment moves absent device/accounts to
+* jointly registered identities; it cannot overwrite them. Its single CAS is
+* the persisted evidence and cleanup owner: a lost response causes no retry,
+* and a recreated reader sees the whole enrollment or none of it.
+* Writes use compare-and-swap; bootstrap/admission reads never reserve resources.
+* A reload reads durable state afresh. Member removal blocks new admission but
+* does not revoke grants or delete operation evidence. The deployment owns store
+* resources and cleanup; this service owns no connections and retries no writes.
+*/
+function createServiceDirectory(store) {
+	async function read() {
+		const raw = await store.read();
+		if (raw === null) return null;
+		try {
+			const fail = (message) => relayFailure("relay_record_unreadable", message);
+			const snapshot = exactCapturedRecord(captureRecord(raw, "directory snapshot", /* @__PURE__ */ new WeakSet(), fail), ["revision", "directory"], "directory snapshot", fail);
+			if (typeof snapshot.revision !== "number" || !Number.isSafeInteger(snapshot.revision) || snapshot.revision < 1) return fail("directory revision is invalid");
+			return Object.freeze({
+				revision: snapshot.revision,
+				directory: parseServiceDirectory(snapshot.directory, "relay_record_unreadable")
+			});
+		} catch {
+			return relayFailure("relay_record_unreadable", "directory snapshot is unreadable");
+		}
+	}
+	function assigned(directory, caller, workspaceId) {
+		return caller.role === "client" && directory.memberships.some((member) => member.workspaceId === workspaceId && member.clientId === caller.clientId && member.subject === caller.subject);
+	}
+	async function resolveOwner(caller, input, chainId) {
+		const scope = classifyStoredAuthorizationScope(input.requestedScope, input.requestId);
+		if (scope.kind !== "permission-request") return null;
+		const request = scope.request;
+		const snapshot = await read();
+		if (snapshot === null || !assigned(snapshot.directory, caller, request.context.workspaceId)) return null;
+		const directory = snapshot.directory;
+		const workspace = directory.workspaces.find((entry) => entry.workspaceId === request.context.workspaceId);
+		const application = directory.applications.find((entry) => entry.clientId === caller.clientId);
+		const account = directory.accounts.find((entry) => entry.workspaceId === request.context.workspaceId && entry.accountId === request.context.accountId);
+		if (!workspace || !application || !account || chainId !== void 0 && !account.chainIds.includes(chainId) || workspace.kind !== request.context.workspaceKind || application.applicationId !== request.application.applicationId || caller.clientId !== request.application.clientId || JSON.stringify(account.account) !== JSON.stringify(request.logicalAccount)) return null;
+		const device = directory.ownerDevices.find((entry) => entry.workspaceId === workspace.workspaceId && entry.ownerDeviceId === account.ownerDeviceId);
+		if (!device) return null;
+		return Object.freeze({
+			ownerDeviceId: device.ownerDeviceId,
+			ownerSubject: device.subject
+		});
+	}
+	return Object.freeze({
+		read,
+		resolveOwner,
+		resolveRevocationOwner(caller, input) {
+			return resolveOwner(caller, input, input.chainId);
+		},
+		async replace(input) {
+			if (input.expectedRevision !== null && (!Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 1 || input.expectedRevision === Number.MAX_SAFE_INTEGER)) return relayFailure("relay_request_invalid", "expected directory revision is invalid");
+			return store.compareAndSwap(input.expectedRevision, parseServiceDirectory(input.directory, "relay_request_invalid"));
+		},
+		async enrollOwnerDevice(input) {
+			const enrollment = structuredClone(input);
+			if (!Number.isSafeInteger(enrollment.expectedRevision) || enrollment.expectedRevision < 1 || enrollment.expectedRevision === Number.MAX_SAFE_INTEGER) return relayFailure("relay_request_invalid", "expected directory revision is invalid");
+			const snapshot = await read();
+			if (snapshot === null) return relayFailure("relay_not_found", "service directory is not initialized");
+			if (snapshot.revision !== enrollment.expectedRevision) return false;
+			const proposed = parseServiceDirectory({
+				...snapshot.directory,
+				ownerDevices: [...snapshot.directory.ownerDevices, enrollment.device],
+				accounts: [...snapshot.directory.accounts, ...enrollment.accounts]
+			}, "relay_request_invalid");
+			const device = proposed.ownerDevices.at(-1);
+			const accounts = proposed.accounts.slice(snapshot.directory.accounts.length);
+			const owner = accounts[0]?.account.ownerCredential;
+			if (!device || owner?.kind !== "p256" || accounts.some((account) => account.workspaceId !== device.workspaceId || account.ownerDeviceId !== device.ownerDeviceId || isKernelExistingAccountProfile(account.account) || account.account.factoryRoute !== "kernel_factory" || account.account.ownerCredential.kind !== "p256" || account.account.ownerCredential.publicKey !== owner.publicKey)) return relayFailure("relay_request_invalid", "phone accounts must bind one workspace, device, and P-256 owner");
+			return store.compareAndSwap(enrollment.expectedRevision, proposed);
+		},
+		async selectAccount(caller, selection) {
+			const fail = (message) => relayFailure("relay_request_invalid", message);
+			const workspaceId = parseClientId(selection.workspaceId, fail);
+			const accountId = parseAccountId(selection.accountId, fail);
+			const snapshot = await read();
+			if (snapshot === null || !assigned(snapshot.directory, caller, workspaceId)) return relayFailure("relay_forbidden", "caller is not a member of this workspace");
+			if (!snapshot.directory.accounts.some((account) => account.workspaceId === workspaceId && account.accountId === accountId)) return relayFailure("relay_not_found", "account is not registered in this workspace");
+			const selections = snapshot.directory.selections.filter((entry) => entry.clientId !== caller.clientId || entry.subject !== caller.subject);
+			selections.push(Object.freeze({
+				clientId: caller.clientId,
+				subject: caller.subject,
+				workspaceId,
+				accountId
+			}));
+			return store.compareAndSwap(snapshot.revision, Object.freeze({
+				...snapshot.directory,
+				selections: Object.freeze(selections)
+			}));
+		},
+		async resolve(caller) {
+			const snapshot = await read();
+			if (snapshot === null) return null;
+			const directory = snapshot.directory;
+			const selection = directory.selections.find((entry) => entry.clientId === caller.clientId && entry.subject === caller.subject);
+			if (!selection || !assigned(directory, caller, selection.workspaceId)) return null;
+			const workspace = directory.workspaces.find((entry) => entry.workspaceId === selection.workspaceId);
+			const application = directory.applications.find((entry) => entry.clientId === caller.clientId);
+			const account = directory.accounts.find((entry) => entry.workspaceId === selection.workspaceId && entry.accountId === selection.accountId);
+			if (!workspace || !application || !account) return null;
+			return Object.freeze({
+				application: Object.freeze({
+					applicationId: application.applicationId,
+					applicationName: application.applicationName
+				}),
+				context: Object.freeze({
+					version: OAATH_WORKSPACE_ACCOUNT_CONTEXT_VERSION,
+					workspaceId: workspace.workspaceId,
+					workspaceKind: workspace.kind,
+					accountId: account.accountId
+				}),
+				account: account.account,
+				ownerValidator: account.ownerValidator,
+				chainIds: account.chainIds
+			});
+		}
+	});
+}
+/** Ephemeral deployment/test store; the service captures every read and write boundary. */
+function createMemoryServiceDirectoryStore() {
+	let snapshot = null;
+	return {
+		async read() {
+			return structuredClone(snapshot);
+		},
+		async compareAndSwap(expectedRevision, directory) {
+			if ((snapshot?.revision ?? null) !== expectedRevision) return false;
+			snapshot = {
+				revision: (expectedRevision ?? 0) + 1,
+				directory: structuredClone(directory)
+			};
+			return true;
+		}
+	};
+}
+//#endregion
 //#region src/authorization/pickup.ts
 /**
 * Authenticated client pickup of a released authorization code.
@@ -155,6 +435,106 @@ async function fetchAuthorizationCode(input) {
 	});
 }
 //#endregion
+//#region src/authorization/verify.ts
+/**
+* Grant reference verification: one read-only projection of the relay's
+* durable authorization evidence into the `@oaath/protocol` grant-reference
+* contract.
+*
+* ```text
+* state and owner        no new state; the request, decision, and capability
+*                        invalidation records already own every fact projected
+* persisted evidence     the immutable request (subject, clientId, audience,
+*                        requestedScope), terminal decision, sealed approval
+*                        artifact and one-shot invalidation
+* resource occupied?     nothing; verification is a pure read
+* retry positively safe? yes: no write exists, so a replay answers the same
+*                        stored facts and never mutates the Grant
+* transitions            none; this owner performs no transition
+* crash/reload           nothing to recover; the projected records recover
+*                        through their own owners
+* cleanup owner          none
+* ```
+*
+* Decision semantics, fail closed and in deterministic order:
+*
+* 1. absent grant, another client's grant, or unreadable/contradictory stored
+*    scope → `unknown` (absence is reported for another client's grant so the
+*    endpoint is not an existence oracle);
+* 2. subject, client, or audience assertion mismatch → `denied` before any
+*    lifecycle fact is revealed;
+* 3. pending, rejected, revoked, expired → `denied`;
+* 4. revision other than the single approved authority revision → `denied`;
+* 5. reviewed call set digest differing from the permitted call set →
+*    `denied`;
+* 6. otherwise → `authorized` with the immutable reference evidence.
+*
+* The sealed permission decision owns the approved policy. The requested
+* policy is its upper bound, checked through applyPermissionDecision. A missing
+* or unreadable artifact never falls back to outcome=approved. This reads
+* service-approved authority; Kernel capability verification and onchain
+* installation remain the runtime's separate domain.
+* `expiresAt`/`validUntil` speak protocol seconds; the relay clock speaks
+* milliseconds and is floored into the protocol domain before comparison.
+*
+* @author taek <leekt216@gmail.com>
+*/
+function unknown(code) {
+	return Object.freeze({
+		state: "unknown",
+		code
+	});
+}
+function denied(code) {
+	return Object.freeze({
+		state: "denied",
+		code
+	});
+}
+async function verifyGrantReference(input) {
+	let assertion;
+	try {
+		assertion = parseVerifyGrantRevisionInput(input.assertion);
+	} catch {
+		return relayFailure("relay_request_invalid", "grant verification assertion is malformed");
+	}
+	const now = relayNow(input.clock);
+	return withRelayTransaction(input.store, async (transaction) => {
+		const request = await transaction.lockAuthorizationRequest(assertion.grantId);
+		if (!request || request.clientId !== input.caller.clientId) return unknown("grant_unknown");
+		const scope = classifyStoredAuthorizationScope(request.requestedScope, request.requestId);
+		if (scope.kind !== "permission-request") return unknown("grant_unreadable");
+		if (scope.request.application.clientId !== request.clientId) return unknown("grant_unreadable");
+		if (assertion.subject !== request.subject) return denied("grant_subject_mismatch");
+		if (assertion.clientId !== request.clientId) return denied("grant_client_mismatch");
+		if (request.organizationAudience === null || assertion.organizationAudience !== request.organizationAudience) return denied("grant_audience_mismatch");
+		const decision = await transaction.lockAuthorizationDecision(assertion.grantId);
+		if (!decision) return denied("grant_pending");
+		if (decision.outcome === "rejected") return denied("grant_rejected");
+		if (await transaction.lockCapabilityInvalidation(assertion.grantId)) return denied("grant_revoked");
+		const approval = (await readApprovedPermission(transaction, input.kms, request, decision, scope.request))?.permission ?? null;
+		if (approval === null) return unknown("grant_unreadable");
+		const validUntil = approval.approvedPolicy.validUntil;
+		if (validUntil === null || Math.floor(now / 1e3) > validUntil) return denied("grant_expired");
+		if (assertion.revision !== OAATH_GRANT_REFERENCE_APPROVED_REVISION) return denied("grant_revision_mismatch");
+		if (assertion.requiredCallsDigest !== hashGrantPolicyCalls(approval.approvedPolicy.calls)) return denied("grant_calls_mismatch");
+		const ref = Object.freeze({
+			version: OAATH_GRANT_REFERENCE_VERSION,
+			grantId: request.requestId,
+			revision: OAATH_GRANT_REFERENCE_APPROVED_REVISION,
+			subject: request.subject,
+			clientId: request.clientId,
+			organizationAudience: request.organizationAudience,
+			state: "active",
+			policyDigest: hashGrantPolicy(approval.approvedPolicy)
+		});
+		return Object.freeze({
+			state: "authorized",
+			ref
+		});
+	});
+}
+//#endregion
 //#region src/security/authentication.ts
 /**
 * Deployment-owned client/device authentication port.
@@ -169,12 +549,20 @@ const MAX_REDIRECT_URIS = 8;
 function captureCaller(value) {
 	const context = /* @__PURE__ */ new WeakSet();
 	const fail = (message) => relayFailure("relay_internal", message);
-	const record = exactRecord(value, [
+	const captured = captureRecord(value, "authenticated caller", context, fail);
+	const declaresAudience = Object.hasOwn(captured, "organizationAudience");
+	const record = exactCapturedRecord(captured, declaresAudience ? [
+		"role",
+		"clientId",
+		"subject",
+		"redirectUris",
+		"organizationAudience"
+	] : [
 		"role",
 		"clientId",
 		"subject",
 		"redirectUris"
-	], "authenticated caller", context, fail);
+	], "authenticated caller", fail);
 	if (record.role !== "client" && record.role !== "owner") return relayFailure("relay_internal", "authenticated caller role is unsupported");
 	const redirectUris = captureDenseArray(record.redirectUris, "caller redirectUris", context, fail);
 	if (redirectUris.length > MAX_REDIRECT_URIS) return relayFailure("relay_internal", "caller redirectUris is unbounded");
@@ -182,7 +570,8 @@ function captureCaller(value) {
 		role: record.role,
 		clientId: canonicalIdentifier(record.clientId, "caller clientId", "relay_internal"),
 		subject: canonicalIdentifier(record.subject, "caller subject", "relay_internal"),
-		redirectUris: Object.freeze(redirectUris.map((uri) => boundedText(uri, RELAY_LIMITS.redirectUri, "caller redirectUri", "relay_internal")))
+		redirectUris: Object.freeze(redirectUris.map((uri) => boundedText(uri, RELAY_LIMITS.redirectUri, "caller redirectUri", "relay_internal"))),
+		organizationAudience: declaresAudience && record.organizationAudience !== null ? canonicalIdentifier(record.organizationAudience, "caller organizationAudience", "relay_internal") : null
 	});
 }
 async function authenticateCaller(authentication, request, required) {
@@ -240,6 +629,9 @@ async function assertWithinRateLimit(limiter, input) {
 * POST /authorization/resume                         client  fresh auth + recovery read
 * GET  /bootstrap                                    client  URL-only service context
 * POST /invalidations                                client  capability invalidation
+* POST /grants/verify                                client  grant reference verification
+* POST /grants/{grantId}/revocations/{chainId}       client  request/recover phone custody
+* GET  /grants/{grantId}/revocations/{chainId}       client  current custody status
 * POST /chains/{chainId}/{port}                      client  chain execution relay,
 *                                                            port in reads |
 *                                                            observation | bundler |
@@ -249,13 +641,14 @@ async function assertWithinRateLimit(limiter, input) {
 * ```
 *
 * EXPERIMENTAL PREVIEW routes for the owner-phone approval surface. Preview
-* means: no stability guarantee and no production qualification. Their wire
-* shapes are pinned field-for-field by the strict Swift decoders in
+* means: no stability guarantee and no production qualification. Consent and
+* decision shapes are pinned field-for-field by the strict Swift decoders in
 * `native/ios/Sources/OwnerPhone/{Projection,Decision}.swift`.
 *
 * ```text
 * GET  /native/projections/{operationId}             owner   consent projection
 * POST /native/decisions/{operationId}               owner   approve or reject saga
+* POST /native/revocation-decisions/{operationId}    owner   revocation custody decision
 * ```
 *
 * @author taek <leekt216@gmail.com>
@@ -264,14 +657,17 @@ const DEFAULT_REQUEST_TTL_MS = 3e5;
 const DEFAULT_CODE_TTL_MS = 6e4;
 const DEFAULT_MAX_BODY_BYTES = 65536;
 const MAX_TTL_MS = 864e5;
-/** RFC 6749 ceiling, matching `MAX_AUTHORIZATION_CODE_LIFETIME` in @oaath/protocol. */
+/** The relay owns the authorization-code lifetime ceiling, in milliseconds. */
 const MAX_CODE_TTL_MS = 6e5;
 const MAX_PAYMASTER_REQUEST_TIMEOUT_MS = 3e4;
 const HASH$1 = /^0x[0-9a-f]{64}$/u;
 const INVALID = "relay_request_invalid";
 const OPTION_KEYS = [
+	"revocations",
+	"permissionApprovals",
 	"store",
 	"authentication",
+	"ownerRouting",
 	"kms",
 	"clock",
 	"rateLimit",
@@ -333,7 +729,25 @@ function captureChainPorts(value) {
 		if (port.usage !== null && typeof port.usage !== "function") return relayFailure("relay_internal", "chain port usage must be a function or null");
 		if (port.staticPaymasterConfigurationHash !== null && (typeof port.staticPaymasterConfigurationHash !== "string" || !HASH$1.test(port.staticPaymasterConfigurationHash))) return relayFailure("relay_internal", "chain port static paymaster commitment must be a lowercase hash or null");
 		if (chains.has(port.chainId)) return relayFailure("relay_internal", "chain ports repeat a chainId");
-		chains.set(port.chainId, port);
+		let gas;
+		const configuredGas = port.gas;
+		if (configuredGas !== void 0) {
+			const policy = exactCapturedRecord(captureRecord(configuredGas, "chain gas policy", /* @__PURE__ */ new WeakSet(), () => relayFailure("relay_internal", "chain gas policy is invalid")), ["enableVerificationGasFloor"], "chain gas policy", () => relayFailure("relay_internal", "chain gas policy is invalid"));
+			if (typeof policy.enableVerificationGasFloor !== "bigint" || policy.enableVerificationGasFloor < 0n || policy.enableVerificationGasFloor >= 1n << 120n) return relayFailure("relay_internal", "chain gas floor is invalid");
+			gas = Object.freeze({ enableVerificationGasFloor: policy.enableVerificationGasFloor });
+		}
+		chains.set(port.chainId, Object.freeze({
+			chainId: port.chainId,
+			reads: port.reads,
+			observation: port.observation,
+			bundler: port.bundler,
+			quote: port.quote,
+			submission: port.submission,
+			usage: port.usage,
+			feePayer: port.feePayer,
+			staticPaymasterConfigurationHash: port.staticPaymasterConfigurationHash,
+			...gas === void 0 ? {} : { gas }
+		}));
 	}
 	return chains;
 }
@@ -352,6 +766,7 @@ function capturePaymasterServices(value, context, chains) {
 		if (typeof chainId !== "number" || !Number.isSafeInteger(chainId) || chainId < 1) relayFailure("relay_internal", "paymaster service chainId must be a positive integer");
 		if (!chains.has(chainId)) relayFailure("relay_internal", "paymaster service chain is not configured");
 		if (services.has(chainId)) relayFailure("relay_internal", "paymaster services repeat a chainId");
+		if (chains.get(chainId)?.staticPaymasterConfigurationHash !== null) relayFailure("relay_internal", "a chain cannot combine a paymaster service and a static paymaster");
 		if (service.requestTimeoutMs === void 0) relayFailure("relay_internal", "paymaster requestTimeoutMs is required");
 		services.set(chainId, Object.freeze({
 			chainId,
@@ -388,39 +803,20 @@ function captureOptions(value) {
 	let bootstrap = null;
 	if (record.bootstrap !== void 0) {
 		if (chains.size === 0) relayFailure("relay_internal", "a bootstrap surface requires chain ports");
-		const identity = captureRecord(record.bootstrap, "relay bootstrap configuration", context, (message) => relayFailure("relay_internal", message));
-		try {
-			bootstrap = parseServiceBootstrap({
-				version: OAATH_SERVICE_BOOTSTRAP_VERSION,
-				application: identity.application,
-				userHandle: identity.userHandle,
-				account: identity.account,
-				ownerValidator: identity.ownerValidator,
-				chains: [...chains.values()].map((port) => {
-					const paymasterService = paymasterServices.get(port.chainId);
-					return {
-						chainId: port.chainId,
-						usage: port.usage !== null,
-						feePayer: port.feePayer,
-						paymasterService: paymasterService === void 0 ? null : { providerId: paymasterService.providerId },
-						staticPaymasterConfigurationHash: port.staticPaymasterConfigurationHash
-					};
-				}),
-				sessionSigner: sessionSigner === null ? {
-					mode: "frontend",
-					providerId: null
-				} : {
-					mode: sessionSigner.mode,
-					providerId: sessionSigner.providerId
-				}
-			});
-		} catch {
-			relayFailure("relay_internal", "relay bootstrap configuration is invalid");
-		}
+		bootstrap = requirePort(record.bootstrap, ["resolve"], "bootstrap");
 	}
 	return Object.freeze({
 		store: requirePort(record.store, ["begin", "close"], "store"),
+		revocations: record.revocations === void 0 ? null : (() => {
+			const configuration = requirePort(record.revocations, ["prepare"], "revocations");
+			return Object.freeze({
+				prepare: configuration.prepare.bind(configuration),
+				directory: requirePort(configuration.directory, ["resolveRevocationOwner"], "revocation directory")
+			});
+		})(),
+		permissionApprovals: record.permissionApprovals === void 0 ? void 0 : requirePort(record.permissionApprovals, ["prepare"], "permissionApprovals"),
 		authentication: requirePort(record.authentication, ["authenticate"], "authentication"),
+		ownerRouting: requirePort(record.ownerRouting, ["resolveOwner"], "ownerRouting"),
 		kms: requirePort(record.kms, ["encrypt", "decrypt"], "kms"),
 		clock: requirePort(record.clock, ["now"], "clock"),
 		rateLimit,
@@ -539,11 +935,60 @@ function createRelayHandler(options) {
 	const route = async (request) => {
 		const segments = new URL(request.url).pathname.split("/").filter((part) => part.length > 0);
 		const [head, group, third, fourth] = segments;
+		if (head === "grants" && third === "revocations" && segments.length === 4) {
+			if (request.method !== "GET" && request.method !== "POST") return relayFailure("relay_method_not_allowed", "route does not accept this method");
+			const caller = await authenticate(request, "client", "grants.revocation");
+			const grantId = canonicalIdentifier(group, "grantId", INVALID);
+			if (typeof fourth !== "string" || !/^[1-9][0-9]*$/u.test(fourth) || !Number.isSafeInteger(Number(fourth))) return relayFailure(INVALID, "revocation chain is invalid");
+			const input = {
+				store: captured.store,
+				clock: captured.clock,
+				caller,
+				grantId,
+				chainId: Number(fourth)
+			};
+			if (request.method === "GET") return jsonResponse(200, await fetchClientPhoneRevocation(input));
+			exactBody(await bodyRecord(request, captured.maxBodyBytes), []);
+			if (!captured.revocations) return relayFailure("relay_not_found", "revocation preparation is not configured");
+			const { created, ...status } = await requestOwnerPhoneRevocation({
+				...input,
+				kms: captured.kms,
+				requestTtlMs: captured.requestTtlMs,
+				...captured.revocations
+			});
+			return jsonResponse(created ? 201 : 200, status);
+		}
 		if (head === "native") {
+			if (segments.length === 2 && group === "inbox") {
+				requireMethod(request, "GET");
+				const caller = await authenticate(request, "owner", "native.inbox");
+				return jsonResponse(200, await listOwnerPhoneRequests({
+					store: captured.store,
+					clock: captured.clock,
+					caller
+				}));
+			}
+			if (segments.length === 3 && group === "permission-signing") {
+				requireMethod(request, "GET");
+				const caller = await authenticate(request, "owner", "native.permissionSigning");
+				return jsonResponse(200, await projectOwnerPhonePermissionSigning({
+					store: captured.store,
+					clock: captured.clock,
+					caller,
+					requestId: canonicalIdentifier(third, "operationId", INVALID),
+					...captured.permissionApprovals ? { permissionApprovals: captured.permissionApprovals } : {}
+				}));
+			}
 			if (segments.length === 3 && group === "projections") {
 				requireMethod(request, "GET");
 				const caller = await authenticate(request, "owner", "native.project");
-				const projection = await projectOwnerPhoneRequest({
+				const operationId = canonicalIdentifier(third, "operationId", INVALID);
+				const projection = operationId.startsWith("revocation-") ? await fetchOwnerPhoneRevocation({
+					store: captured.store,
+					clock: captured.clock,
+					caller,
+					operationId
+				}) : await projectOwnerPhoneRequest({
 					store: captured.store,
 					clock: captured.clock,
 					caller,
@@ -551,11 +996,25 @@ function createRelayHandler(options) {
 				});
 				return jsonResponse(200, projection);
 			}
+			if (segments.length === 3 && group === "revocation-decisions") {
+				requireMethod(request, "POST");
+				const caller = await authenticate(request, "owner", "native.revoke");
+				const command = phoneDecisionCommand(await bodyRecord(request, captured.maxBodyBytes));
+				return jsonResponse(200, await submitOwnerPhoneRevocationDecision({
+					store: captured.store,
+					clock: captured.clock,
+					kms: captured.kms,
+					caller,
+					operationId: canonicalIdentifier(third, "operationId", INVALID),
+					command
+				}));
+			}
 			if (segments.length === 3 && group === "decisions") {
 				requireMethod(request, "POST");
 				const caller = await authenticate(request, "owner", "native.decide");
 				const command = phoneDecisionCommand(await bodyRecord(request, captured.maxBodyBytes));
 				const decided = await submitOwnerPhoneDecision({
+					...captured.permissionApprovals ? { permissionApprovals: captured.permissionApprovals } : {},
 					store: captured.store,
 					clock: captured.clock,
 					kms: captured.kms,
@@ -570,9 +1029,59 @@ function createRelayHandler(options) {
 		}
 		if (head === "bootstrap" && segments.length === 1) {
 			requireMethod(request, "GET");
-			await authenticate(request, "client", "bootstrap.fetch");
+			const caller = await authenticate(request, "client", "bootstrap.fetch");
 			if (captured.bootstrap === null) return relayFailure("relay_not_found", "route does not exist");
-			return jsonResponse(200, captured.bootstrap);
+			const selection = await captured.bootstrap.resolve(caller);
+			if (selection === null) return relayFailure("relay_not_found", "no assigned account");
+			let document;
+			try {
+				const context = /* @__PURE__ */ new WeakSet();
+				const fail = (message) => relayFailure("relay_internal", message);
+				const selected = exactCapturedRecord(captureRecord(selection, "bootstrap selection", context, fail), [
+					"application",
+					"context",
+					"account",
+					"ownerValidator",
+					"chainIds"
+				], "bootstrap selection", fail);
+				const application = exactCapturedRecord(captureRecord(selected.application, "bootstrap application", context, fail), ["applicationId", "applicationName"], "bootstrap application", fail);
+				const chainIds = captureDenseArray(selected.chainIds, "selected chains", context, fail);
+				document = parseServiceBootstrap({
+					version: OAATH_SERVICE_BOOTSTRAP_VERSION,
+					application: {
+						...application,
+						clientId: caller.clientId,
+						redirectUris: caller.redirectUris
+					},
+					userHandle: caller.subject,
+					context: selected.context,
+					account: selected.account,
+					ownerValidator: selected.ownerValidator,
+					chains: chainIds.map((chainId) => {
+						const port = captured.chains.get(chainId);
+						if (port === void 0) return fail("selected chain is not configured");
+						const paymasterService = captured.paymasterServices.get(port.chainId);
+						return {
+							chainId: port.chainId,
+							...port.gas === void 0 ? {} : { gas: { enableVerificationGasFloor: port.gas.enableVerificationGasFloor.toString() } },
+							usage: port.usage !== null,
+							feePayer: port.feePayer,
+							paymasterService: paymasterService === void 0 ? null : { providerId: paymasterService.providerId },
+							staticPaymasterConfigurationHash: port.staticPaymasterConfigurationHash
+						};
+					}),
+					sessionSigner: captured.sessionSigner === null ? {
+						mode: "frontend",
+						providerId: null
+					} : {
+						mode: captured.sessionSigner.mode,
+						providerId: captured.sessionSigner.providerId
+					}
+				});
+			} catch {
+				return relayFailure("relay_internal", "resolved bootstrap is invalid");
+			}
+			return jsonResponse(200, document);
 		}
 		if (head === "session-signers") {
 			const custody = captured.sessionSigner;
@@ -615,6 +1124,18 @@ function createRelayHandler(options) {
 			}
 			return relayFailure("relay_not_found", "route does not exist");
 		}
+		if (head === "grants" && segments.length === 2 && group === "verify") {
+			requireMethod(request, "POST");
+			const caller = await authenticate(request, "client", "grants.verify");
+			const result = await verifyGrantReference({
+				store: captured.store,
+				clock: captured.clock,
+				kms: captured.kms,
+				caller,
+				assertion: await bodyRecord(request, captured.maxBodyBytes)
+			});
+			return jsonResponse(200, result);
+		}
 		if (head === "invalidations" && segments.length === 1) {
 			requireMethod(request, "POST");
 			const caller = await authenticate(request, "client", "invalidations.create");
@@ -676,8 +1197,8 @@ function createRelayHandler(options) {
 			let result;
 			try {
 				result = await capability(body.request);
-			} catch {
-				return relayFailure("relay_chain_unavailable", "chain port did not answer");
+			} catch (error) {
+				return relayFailure("relay_chain_unavailable", "chain port did not answer", readValidationGasDiagnostic(error), name === "submission" ? readRpcBundlerRejection(error) : null);
 			}
 			return jsonResponse(200, result === void 0 ? {
 				present: false,
@@ -698,6 +1219,7 @@ function createRelayHandler(options) {
 			]);
 			const created = await createAuthorizationRequest({
 				store: captured.store,
+				ownerRouting: captured.ownerRouting,
 				clock: captured.clock,
 				caller,
 				redirectUri: boundedText(body.redirectUri, RELAY_LIMITS.redirectUri, "redirectUri", INVALID),
@@ -793,7 +1315,7 @@ function createRelayHandler(options) {
 		try {
 			return await route(request);
 		} catch (error) {
-			return relayErrorResponse(relayErrorCode(error));
+			return relayErrorResponse(relayErrorCode(error), readValidationGasDiagnostic(error), error instanceof OaathRelayError ? error.bundlerRejection : null);
 		}
 	};
 }
@@ -1010,6 +1532,8 @@ function createKmsSessionSignerProvider(input) {
 */
 function emptyTables() {
 	return {
+		revocationRequests: /* @__PURE__ */ new Map(),
+		revocationDecisions: /* @__PURE__ */ new Map(),
 		requests: /* @__PURE__ */ new Map(),
 		decisions: /* @__PURE__ */ new Map(),
 		codes: /* @__PURE__ */ new Map(),
@@ -1019,6 +1543,8 @@ function emptyTables() {
 }
 function copyTables(tables) {
 	return {
+		revocationRequests: new Map(tables.revocationRequests),
+		revocationDecisions: new Map(tables.revocationDecisions),
 		requests: new Map(tables.requests),
 		decisions: new Map(tables.decisions),
 		codes: new Map(tables.codes),
@@ -1035,6 +1561,16 @@ function read(table, key, parse) {
 	const stored = table.get(key);
 	return stored === void 0 ? void 0 : parse(stored);
 }
+function artifactByRequest(tables, requestId) {
+	let match;
+	for (const value of tables.artifacts.values()) {
+		const record = parseEncryptedArtifactRecord(value);
+		if (record.requestId !== requestId) continue;
+		if (match) return relayFailure("relay_record_unreadable", "request has multiple artifacts");
+		match = record;
+	}
+	return match;
+}
 function createMemoryRelayStore() {
 	let committed = emptyTables();
 	let closed = false;
@@ -1065,6 +1601,48 @@ function createMemoryRelayStore() {
 				release();
 			};
 			return {
+				async listPendingOwnerRequests(ownerSubject, now, limit) {
+					const tables = open();
+					const requests = [];
+					for (const value of tables.requests.values()) {
+						const record = parseAuthorizationRequestRecord(value);
+						if (record.ownerSubject === ownerSubject && record.expiresAt > now && !tables.decisions.has(record.requestId)) requests.push({
+							operationId: record.requestId,
+							ownerSubject,
+							expiresAt: record.expiresAt
+						});
+					}
+					for (const value of tables.revocationRequests.values()) {
+						const record = parseRevocationRequestRecord(value);
+						if (record.ownerSubject === ownerSubject && record.expiresAt > now && !tables.revocationDecisions.has(record.operationId)) requests.push({
+							operationId: record.operationId,
+							ownerSubject,
+							expiresAt: record.expiresAt
+						});
+					}
+					return requests.sort((a, b) => a.expiresAt - b.expiresAt || (a.operationId < b.operationId ? -1 : a.operationId > b.operationId ? 1 : 0)).slice(0, limit);
+				},
+				async lockLatestRevocationRequest(grantId, chainId) {
+					let latest;
+					for (const stored of open().revocationRequests.values()) {
+						const record = parseRevocationRequestRecord(stored);
+						if (record.signingRequest.permissionRequest.requestId !== grantId || record.signingRequest.chainId !== chainId) continue;
+						if (!latest || record.createdAt > latest.createdAt) latest = record;
+					}
+					return latest;
+				},
+				async lockRevocationRequest(operationId) {
+					return read(open().revocationRequests, operationId, parseRevocationRequestRecord);
+				},
+				async insertRevocationRequest(record) {
+					return insert(open().revocationRequests, record.operationId, record);
+				},
+				async lockRevocationDecision(operationId) {
+					return read(open().revocationDecisions, operationId, parseRevocationDecisionRecord);
+				},
+				async insertRevocationDecision(record) {
+					return insert(open().revocationDecisions, record.operationId, record);
+				},
 				async lockAuthorizationRequest(requestId) {
 					return read(open().requests, requestId, parseAuthorizationRequestRecord);
 				},
@@ -1102,8 +1680,13 @@ function createMemoryRelayStore() {
 				async lockEncryptedArtifact(artifactId) {
 					return read(open().artifacts, artifactId, parseEncryptedArtifactRecord);
 				},
+				async lockEncryptedArtifactByRequestId(requestId) {
+					return artifactByRequest(open(), requestId);
+				},
 				async insertEncryptedArtifact(record) {
-					return insert(open().artifacts, record.artifactId, record);
+					const tables = open();
+					if (artifactByRequest(tables, record.requestId)) return false;
+					return insert(tables.artifacts, record.artifactId, record);
 				},
 				async claimEncryptedArtifact(artifactId, claimedAt) {
 					const artifacts = open().artifacts;
@@ -1130,6 +1713,6 @@ function createMemoryRelayStore() {
 	};
 }
 //#endregion
-export { OAATH_AUTHORIZATION_CODE_RECORD_VERSION, OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, OaathRelayError, REDACTED, RELAY_ERROR_STATUS, claimEncryptedArtifact, consumeAuthorizationCode, createAuthorizationRequest, createKmsSessionSignerProvider, createMemoryRelayStore, createRelayHandler, fetchAuthorizationRequest, isCodeChallengeS256, openArtifact, redactForLog, redactUrl, resumeAuthorization, sealArtifact, submitAuthorizationDecision, verifyPkceS256 };
+export { OAATH_AUTHORIZATION_CODE_RECORD_VERSION, OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, OAATH_REVOCATION_DECISION_RECORD_VERSION, OAATH_REVOCATION_REQUEST_RECORD_VERSION, OAATH_SERVICE_DIRECTORY_VERSION, OaathRelayError, REDACTED, RELAY_ERROR_STATUS, claimEncryptedArtifact, consumeAuthorizationCode, createAuthorizationRequest, createKmsSessionSignerProvider, createMemoryRelayStore, createMemoryServiceDirectoryStore, createRelayHandler, createServiceDirectory, fetchAuthorizationRequest, isCodeChallengeS256, openArtifact, redactForLog, redactUrl, resumeAuthorization, sealArtifact, submitAuthorizationDecision, verifyPkceS256 };
 
 //# sourceMappingURL=index.js.map