@seasonkoh/webaz 0.1.26 → 0.1.28

package/dist/pwa/routes/webauthn.js

@@ -3,8 +3,9 @@ import { randomBytes } from 'node:crypto';
 // RFC-004 体验补:绑定 Passkey 后,追溯补发此前"已受理但无锚点跳过"的建设信誉。
 import { grantPendingAnchorCredits } from '../../layer2-business/L2-8-feedback/build-feedback-engine.js';
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { registerAgentGrantsRoutes } from './agent-grants.js'; // RFC-020 PR-B — Passkey-domain delegation grants (keeps server.ts untouched)
 export function registerWebauthnRoutes(app, deps) {
-    const { db, auth, generateId, rpId, rpName, origin, challengeTtlMs, gateTtlMs, invalidateAgentRiskCacheForUser, requireHumanPresence } = deps;
+    const { db, auth, generateId, rateLimitOk, rpId, rpName, origin, challengeTtlMs, gateTtlMs, invalidateAgentRiskCacheForUser, requireHumanPresence } = deps;
     // 1. 注册：start — 生成 challenge + 选项
     app.post('/api/webauthn/register/start', async (req, res) => {
         const user = auth(req, res);
@@ -73,7 +74,7 @@ export function registerWebauthnRoutes(app, deps) {
         if (!user)
             return;
         const purpose = String(req.body?.purpose || '').trim();
-        const allowed = new Set(['withdraw', 'change-password', 'reveal-key', 'region', 'delete_passkey', 'governance_apply', 'governance_activate', 'governance_resign', 'governance_appeal_resolve', 'rewards_apply', 'rewards_deactivate', 'identity_claim']);
+        const allowed = new Set(['withdraw', 'change-password', 'reveal-key', 'region', 'delete_passkey', 'governance_apply', 'governance_activate', 'governance_resign', 'governance_appeal_resolve', 'rewards_apply', 'rewards_deactivate', 'identity_claim', 'operator_claim_unlink']);
         if (!allowed.has(purpose))
             return void res.status(400).json({ error: 'invalid purpose' });
         const purpose_data = req.body?.purpose_data ?? null;
@@ -192,4 +193,8 @@ export function registerWebauthnRoutes(app, deps) {
         await dbRun('UPDATE users SET webauthn_required_for_withdraw = ? WHERE id = ?', [required, user.id]);
         res.json({ success: true, required_for_withdraw: !!required });
     });
+    // RFC-020 PR-B — agent delegation grants (issue/read/revoke). Co-registered with the
+    // Passkey security routes so the money-dense server.ts stays untouched. Safe scopes
+    // only; risk scopes default-hard-reject. Reuses db/auth/generateId from WebauthnDeps.
+    registerAgentGrantsRoutes(app, { db, auth, generateId, rateLimitOk });
 }

package/dist/pwa/server-schema.js

@@ -0,0 +1,9 @@
+/**
+ * Compatibility re-export.
+ *
+ * The pure idempotent schema helpers were relocated to a neutral top-level
+ * module (src/runtime/webaz-schema-helpers.ts) so the PWA boot path and the MCP
+ * runtime schema composition root can share ONE source. This file keeps the
+ * historical `./server-schema.js` import path working for src/pwa/server.ts.
+ */
+export * from '../runtime/webaz-schema-helpers.js';