@seasonkoh/webaz 0.1.27 → 0.1.29

package/dist/pwa/routes/products-update.js

@@ -1,7 +1,8 @@
 import { dbOne, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { invalidateProductVerification } from '../../product-verification.js';
 export function registerProductsUpdateRoutes(app, deps) {
-    // db 已走 RFC-016 异步 seam(dbOne/dbRun),不再直接用 deps.db
-    const { auth, makeCommitmentHash, makeDescriptionHash, makePriceHash, notifyWaitlist, notifyWishlistPriceDrop, checkStockAndMaybeDelist } = deps;
+    // db 已走 RFC-016 异步 seam(dbOne/dbRun);deps.db 仅用于 direct-pay 逐品验证作废(sync helper,反作弊生命周期)
+    const { db, auth, makeCommitmentHash, makeDescriptionHash, makePriceHash, notifyWaitlist, notifyWishlistPriceDrop, checkStockAndMaybeDelist } = deps;
     app.put('/api/products/:id', async (req, res) => {
         const user = auth(req, res);
         if (!user)
@@ -134,6 +135,25 @@ export function registerProductsUpdateRoutes(app, deps) {
                 console.error('[wishlist price-drop notify]', e);
             }
         }
+        // 反作弊(PR-⑥):任何【买家可见的商品身份字段】变更 → 作废该商品的直付逐品验证,强制重新验证,防"先验证商品 A,
+        //   再改成商品 B"绕过逐品硬门。external-link 变更在 products-links 路由另行作废。fail-soft,不阻断编辑。
+        //   ⚠️ 必须含 i18n_titles/i18n_descs:formatProductForAgent 按 Accept-Language 把 title/description 换成对应语言,
+        //      只改 en/ja/ko 标题描述同样是"换货"(非中文买家看到的就变了);并含 brand/model(商品身份)。
+        const newBrand = brand ?? product.brand;
+        const newModel = model ?? product.model;
+        const eq = (a, b) => String(a ?? '') === String(b ?? '');
+        const materialChanged = !eq(newTitle, product.title) || !eq(newDesc, product.description)
+            || Number(newPrice) !== Number(product.price) || !eq(specsJson, product.specs)
+            || !eq(newI18nTitles, product.i18n_titles) || !eq(newI18nDescs, product.i18n_descs)
+            || !eq(newBrand, product.brand) || !eq(newModel, product.model);
+        if (materialChanged) {
+            try {
+                invalidateProductVerification(db, String(req.params.id));
+            }
+            catch (e) {
+                console.error('[product-verify invalidate]', e);
+            }
+        }
         res.json({ success: true });
     });
 }

package/dist/pwa/routes/promoter.js

@@ -28,6 +28,8 @@ export function registerPromoterRoutes(app, deps) {
         for (const r of earned)
             byLevel[r.level] = { orders: r.orders, total: r.total };
         const grand = byLevel[1].total + byLevel[2].total + byLevel[3].total;
+        // RFC-018: commission accrued but still in the clearing window (matures into grand_total). Pure read.
+        const clearing = (await dbOne("SELECT COALESCE(SUM(amount),0) as s FROM pending_commission_escrow WHERE recipient_user_id = ? AND matures_at IS NOT NULL AND status = 'pending'", [userId])).s;
         const recent = await dbAll(`
       SELECT cr.id, cr.order_id, cr.level, cr.amount, cr.rate, cr.created_at,
              u.name as source_buyer_name
@@ -142,6 +144,7 @@ export function registerPromoterRoutes(app, deps) {
             team: { l1, l2, l3, total: l1 + l2 + l3 },
             earnings: {
                 grand_total: grand,
+                clearing_total: clearing, // RFC-018: accrued, maturing after the return window (not yet paid)
                 l1: byLevel[1],
                 l2: byLevel[2],
                 l3: byLevel[3],

package/dist/pwa/routes/referral.js

@@ -23,6 +23,9 @@ export function registerReferralRoutes(app, deps) {
     `, [user.id]));
         const todayEarnings = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-1 day')`, [user.id])).t;
         const monthEarnings = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-30 days')`, [user.id])).t;
+        // RFC-018: commission accrued but still in the clearing window (pending → matures into total_waz).
+        // Pure read; surfaced so earnings don't appear to vanish during clearing (Option A keeps total_waz = paid).
+        const clearingWaz = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM pending_commission_escrow WHERE recipient_user_id = ? AND matures_at IS NOT NULL AND status = 'pending'`, [user.id])).t;
         res.json({
             invite_code: code,
             invite_link: code ? `${req.protocol}://${req.get('host')}/i/${code}` : null,
@@ -34,6 +37,7 @@ export function registerReferralRoutes(app, deps) {
                 total_waz: earnings.total,
                 today_waz: todayEarnings,
                 month_waz: monthEarnings,
+                clearing_waz: clearingWaz, // RFC-018: accrued, maturing after the return window (not yet paid)
             },
         });
     });

package/dist/pwa/routes/returns.js

@@ -30,6 +30,26 @@ export function registerReturnsRoutes(app, deps) {
             if (debited.changes !== 1)
                 throw new Error('INSUFFICIENT_SELLER_BALANCE');
             db.prepare('UPDATE wallets SET balance = balance + ? WHERE user_id = ?').run(refundAmt, rr.buyer_id);
+            // RFC-018: reverse this order's in-window clearing commission, proportional to the refund.
+            // These pending rows were never paid (maturation is gated on matures_at), so this is a pure
+            // reversal — no clawback. matures_at IS NOT NULL targets clearing rows only; opt-out escrow
+            // rows (matures_at IS NULL) are untouched. Atomic with the refund.
+            const ordTotal = Number(db.prepare('SELECT total_amount FROM orders WHERE id = ?').get(rr.order_id)?.total_amount ?? 0);
+            const refundFrac = ordTotal > 0 ? Math.min(1, refundAmt / ordTotal) : 1;
+            if (refundFrac >= 1) {
+                db.prepare(`UPDATE pending_commission_escrow SET status='reversed' WHERE order_id = ? AND status='pending' AND matures_at IS NOT NULL`).run(rr.order_id);
+                // RFC-018 PR4: a single FULL return is no longer a genuine sale — decrement the stored product
+                // completion_count (incremented at settleOrder). Idempotent: the return CAS'd to 'refunded'
+                // exactly once above, so this runs once. Partial refund stays a genuine sale (no decrement).
+                // Edge: multiple partial refunds cumulatively reaching full aren't caught here (each refundFrac<1),
+                // so the stored counter may transiently over-count by 1 — but the AUTHORITATIVE genuine count
+                // (genuineSalePredicate, cumulative SUM) is correct everywhere on-read, and the completion_count
+                // backfill (genuine-aware) self-heals the stored counter. completion_count is best-effort social proof.
+                db.prepare(`UPDATE products SET completion_count = MAX(0, COALESCE(completion_count,0) - 1) WHERE id = ?`).run(rr.product_id);
+            }
+            else {
+                db.prepare(`UPDATE pending_commission_escrow SET amount = amount * ? WHERE order_id = ? AND status='pending' AND matures_at IS NOT NULL`).run(1 - refundFrac, rr.order_id);
+            }
             // 3. 恢复库存(CAS + 扣款成功后)
             const ord = db.prepare('SELECT quantity, source, variant_id FROM orders WHERE id = ?').get(rr.order_id);
             if (ord && ord.source !== 'secondhand') {
@@ -69,7 +89,7 @@ export function registerReturnsRoutes(app, deps) {
             return void errorRes(res, 403, 'TRUSTED_ROLE_NO_TRADE', '受信角色无购物功能');
         const order = await dbOne(`
       SELECT o.id, o.buyer_id, o.seller_id, o.product_id, o.status, o.total_amount, o.created_at, o.updated_at,
-             p.return_days, p.title as product_title
+             o.payment_rail, p.return_days, p.title as product_title
       FROM orders o JOIN products p ON p.id = o.product_id
       WHERE o.id = ?
     `, [req.params.order_id]);
@@ -77,6 +97,11 @@ export function registerReturnsRoutes(app, deps) {
             return void res.status(404).json({ error: '订单不存在' });
         if (order.buyer_id !== user.id)
             return void res.status(403).json({ error: '仅买家可申请退货' });
+        // 直付(Rail1)= 非托管、refund:none —— WebAZ 不持货款,退款经现有 escrow 钱包路径会错误移动无关 WAZ。
+        //   故 direct_p2p 不走退货/退款流程(买家不满走争议=信誉处理);平台费应收的冲销由治理/admin 调整处理(非此路径)。
+        if (order.payment_rail === 'direct_p2p') {
+            return void res.status(400).json({ error: '直付(非托管)订单不支持退款流程;如有问题请发起争议', error_code: 'DIRECT_PAY_NO_REFUND' });
+        }
         // P0-1: 只允许 completed 退货 — escrow 已结算
         if (order.status !== 'completed') {
             return void res.status(400).json({ error: '仅订单完成后可申请退货（确认收货后）' });

package/dist/pwa/routes/rewards-apply.js

@@ -37,8 +37,10 @@ export function registerRewardsApplyRoutes(app, deps) {
             missing.push(`completed_orders ${completedOrders}/${minOrders}`);
         if (requirePasskey === 1 && passkeyCount === 0)
             missing.push('passkey_not_registered');
-        const pending = (await dbOne("SELECT COUNT(*) AS n, COALESCE(SUM(amount),0) AS total FROM pending_commission_escrow WHERE recipient_user_id = ? AND status = 'pending'", [userId]));
-        const expired = (await dbOne("SELECT COUNT(*) AS n, COALESCE(SUM(amount),0) AS total FROM pending_commission_escrow WHERE recipient_user_id = ? AND status = 'expired'", [userId]));
+        // RFC-018: matures_at IS NULL = opt-out escrow (claimable on activation). Clearing rows
+        // (matures_at NOT NULL) auto-mature via rewards-clearing-mature and must NOT be drained here.
+        const pending = (await dbOne("SELECT COUNT(*) AS n, COALESCE(SUM(amount),0) AS total FROM pending_commission_escrow WHERE recipient_user_id = ? AND status = 'pending' AND matures_at IS NULL", [userId]));
+        const expired = (await dbOne("SELECT COUNT(*) AS n, COALESCE(SUM(amount),0) AS total FROM pending_commission_escrow WHERE recipient_user_id = ? AND status = 'expired' AND matures_at IS NULL", [userId]));
         res.json({
             state,
             opted_in: optIn === 1,
@@ -138,12 +140,15 @@ export function registerRewardsApplyRoutes(app, deps) {
                     VALUES (?, 'activate', ?, ?, ?, ?, ?, ?, ?)`)
                     .run(userId, consent_version, currentMajor.hash, webauthn_token || null, // store gate_token id as audit cross-ref to webauthn_gate_tokens
                 requirePasskey === 1 ? 'passkey' : 'password', sha256_hex(req.ip || '').slice(0, 16), sha256_hex(String(req.headers['user-agent'] || '')).slice(0, 16), now);
-                // Activate batch settle: drain pending escrow to wallet
+                // Activate batch settle: drain OPT-OUT escrow to wallet. RFC-018: matures_at IS NULL excludes
+                // clearing rows — those are NOT claimable on opt-in; they auto-mature after the return window
+                // (rewards-clearing-mature). Draining them here would pay commission early and defeat the
+                // clearing window's reversal guarantee (a returned order could no longer be reversed → clawback).
                 const pending = db.prepare(`SELECT id, amount, attribution_path FROM pending_commission_escrow
-                                    WHERE recipient_user_id = ? AND status = 'pending' AND expires_at > ?`).all(userId, now);
+                                    WHERE recipient_user_id = ? AND status = 'pending' AND matures_at IS NULL AND expires_at > ?`).all(userId, now);
                 let total = 0;
                 for (const p of pending) {
-                    const upd = db.prepare(`UPDATE pending_commission_escrow SET status='settled', settled_at=? WHERE id=? AND status='pending'`).run(now, p.id);
+                    const upd = db.prepare(`UPDATE pending_commission_escrow SET status='settled', settled_at=? WHERE id=? AND status='pending' AND matures_at IS NULL`).run(now, p.id);
                     if (upd.changes === 0)
                         continue; // race: expire cron took it
                     db.prepare(`UPDATE wallets SET balance = balance + ?, earned = earned + ? WHERE user_id = ?`).run(p.amount, p.amount, userId);

package/dist/pwa/routes/rewards-clearing-mature.js

@@ -0,0 +1,96 @@
+// RFC-016 Phase 1 — sweep read → async seam; the per-row pay tx stays sync (Phase 3 → pg).
+import { dbAll } from '../../layer0-foundation/L0-1-database/db.js';
+import { generateId } from '../../layer0-foundation/L0-1-database/schema.js';
+import { applyWalletDelta } from '../../ledger.js';
+import { toUnits, toDecimal } from '../../money.js';
+// #7 Commission source_type (moved from settleCommission). Pure read — stamps commission_records.source_type.
+function commissionSourceType(db, productId, uid) {
+    if (!uid)
+        return 'sponsor';
+    const attr = db.prepare(`SELECT shareable_id FROM product_share_attribution WHERE product_id = ? AND sharer_id = ? AND shareable_id IS NOT NULL ORDER BY created_at DESC LIMIT 1`).get(productId, uid);
+    if (!attr)
+        return 'sponsor';
+    const sh = db.prepare(`SELECT type FROM shareables WHERE id = ?`).get(attr.shareable_id);
+    if (!sh)
+        return 'sponsor';
+    return sh.type === 'note' ? 'note' : 'link';
+}
+/**
+ * Mature ONE clearing commission row. Re-validates genuine closure (completed + no open dispute), then
+ * writes commission_records + credits the wallet in one tx. CAS on status='pending' → idempotent; races
+ * and re-runs lose. Holds (no write) while a dispute is open. Exported for direct unit testing.
+ */
+export function matureClearingRow(db, row) {
+    let outcome = 'skipped';
+    db.transaction(() => {
+        const order = db.prepare("SELECT buyer_id, product_id, snapshot_commission_rate, buyer_region, status FROM orders WHERE id = ?").get(row.order_id);
+        if (!order || order.status !== 'completed') {
+            outcome = 'held';
+            return;
+        } // completed is terminal; defensive hold
+        const openDispute = db.prepare("SELECT 1 FROM disputes WHERE order_id = ? AND status NOT IN ('resolved','dismissed','closed') LIMIT 1").get(row.order_id);
+        if (openDispute) {
+            outcome = 'held';
+            return;
+        } // hold while unresolved (e.g. return escalated to dispute)
+        const claimed = db.prepare("UPDATE pending_commission_escrow SET status='settled', settled_at=? WHERE id=? AND status='pending' AND matures_at IS NOT NULL").run(Date.now(), row.id);
+        if (claimed.changes !== 1) {
+            outcome = 'skipped';
+            return;
+        } // race lost / already settled / reversed
+        const amountU = toUnits(Number(row.amount));
+        if (amountU > 0) {
+            const level = Number(String(row.attribution_path).replace(/^L/, '')) || 0;
+            const rate = Number(order.snapshot_commission_rate ?? 0.10);
+            let region = order.buyer_region || null;
+            if (!region)
+                region = db.prepare("SELECT region FROM users WHERE id = ?").get(order.buyer_id)?.region ?? 'global';
+            const srcType = commissionSourceType(db, order.product_id, row.recipient_user_id);
+            try {
+                db.prepare(`INSERT INTO commission_records (id, order_id, beneficiary_id, source_buyer_id, level, amount, rate, region, source, source_type) VALUES (?,?,?,?,?,?,?,?,?,?)`)
+                    .run(generateId('comm'), row.order_id, row.recipient_user_id, order.buyer_id, level, toDecimal(amountU), rate, region, 'static', srcType);
+            }
+            catch (e) { /* UNIQUE — already recorded on a prior partial run */ }
+            applyWalletDelta(db, row.recipient_user_id, { balance: amountU, earned: amountU });
+        }
+        outcome = 'settled';
+    })();
+    return outcome;
+}
+export async function runClearingMatureSweep(deps) {
+    const { db } = deps;
+    const now = Date.now();
+    const rows = await dbAll(`
+    SELECT id, recipient_user_id, order_id, amount, attribution_path
+    FROM pending_commission_escrow
+    WHERE status = 'pending' AND matures_at IS NOT NULL AND matures_at <= ?
+    ORDER BY matures_at ASC
+    LIMIT 1000
+  `, [now]);
+    let settled = 0, held = 0, skipped = 0;
+    for (const r of rows) {
+        const o = matureClearingRow(db, r);
+        if (o === 'settled')
+            settled++;
+        else if (o === 'held')
+            held++;
+        else
+            skipped++;
+    }
+    return { scanned: rows.length, settled, held, skipped };
+}
+export function startClearingMatureCron(deps) {
+    const ms = 60 * 60 * 1000; // 1h — clearing window granularity is days
+    setInterval(async () => {
+        try {
+            const r = await runClearingMatureSweep(deps);
+            if (r.settled > 0 || r.held > 0) {
+                console.log(`[clearing-mature] scanned ${r.scanned}, settled ${r.settled}, held ${r.held}, skipped ${r.skipped}`);
+            }
+        }
+        catch (e) {
+            console.error('[clearing-mature-cron]', e);
+        }
+    }, ms);
+    console.log('⏳ RFC-018 commission clearing maturation cron 已启动 (每 1h, anchor=matures_at)');
+}

package/dist/pwa/routes/rewards-escrow-expire.js

@@ -3,17 +3,21 @@ import { dbAll } from '../../layer0-foundation/L0-1-database/db.js';
 export async function runEscrowExpireSweep(deps) {
     const { db, redirectToCommissionReserve } = deps;
     const now = Date.now();
+    // RFC-018: pending_commission_escrow now holds TWO lifecycles, discriminated by matures_at:
+    //   - matures_at IS NULL  → opt-out escrow (this cron: expire → commission_reserve / pool).
+    //   - matures_at NOT NULL → clearing rows (the SEPARATE rewards-clearing-mature cron: pay/reverse).
+    // We MUST exclude clearing rows here, or they'd be wrongly expired to the pool instead of paid.
     const rows = await dbAll(`
     SELECT id, recipient_user_id, order_id, amount, attribution_path, expires_at
     FROM pending_commission_escrow
-    WHERE status = 'pending' AND expires_at <= ?
+    WHERE status = 'pending' AND matures_at IS NULL AND expires_at <= ?
     ORDER BY expires_at ASC
     LIMIT 1000
   `, [now]);
     const expired = [];
     for (const r of rows) {
         db.transaction(() => {
-            const upd = db.prepare(`UPDATE pending_commission_escrow SET status='expired', expired_to_charity_at=? WHERE id=? AND status='pending'`).run(now, r.id);
+            const upd = db.prepare(`UPDATE pending_commission_escrow SET status='expired', expired_to_charity_at=? WHERE id=? AND status='pending' AND matures_at IS NULL`).run(now, r.id);
             if (upd.changes === 0)
                 return; // race lost — another sweep already took it
             if (r.attribution_path === 'pv_pair') {

package/dist/pwa/routes/shops.js

@@ -1,4 +1,5 @@
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { genuineSalePredicate } from '../../layer0-foundation/L0-2-state-machine/genuine-sale.js'; // RFC-018 PR4: 真实成交(排除全额退货)
 export function registerShopsRoutes(app, deps) {
     // db 已走 RFC-016 异步 seam(dbOne/dbAll/dbRun),不再直接用 deps.db
     const { auth } = deps;
@@ -20,7 +21,7 @@ export function registerShopsRoutes(app, deps) {
         const sellerId = String(seller.id);
         const products = await dbAll(`
       SELECT p.id, p.title, p.price, p.stock, p.category, p.images, p.has_variants, p.commission_rate,
-        (SELECT COUNT(1) FROM orders o WHERE o.product_id = p.id AND o.status = 'completed') as sales_count
+        (SELECT COUNT(1) FROM orders o WHERE o.product_id = p.id AND ${genuineSalePredicate('o')}) as sales_count
       FROM products p
       WHERE p.seller_id = ? AND p.status = 'active'
       ORDER BY sales_count DESC, p.created_at DESC

package/dist/pwa/routes/url-claim.js

@@ -119,8 +119,8 @@ export function registerUrlClaimRoutes(app, deps) {
                 db.prepare(`INSERT INTO products (
           id, seller_id, title, description, price, stock, category, stake_amount,
           specs, source_url, handling_hours, return_days, warranty_days,
-          commitment_hash, description_hash, price_hash, hashed_at, status, stake_locked_at
-        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'warehouse',datetime('now'))`)
+          commitment_hash, description_hash, price_hash, hashed_at, status, stake_locked_at, currency
+        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'warehouse',datetime('now'),'WAZ')`)
                     .run(productId, user.id, title, description, priceNum, Number(stock), category, stakeAmount, specsJson, url, Number(handling_hours), Number(return_days), Number(warranty_days), makeCommitmentHash(pFields), makeDescriptionHash({ title, description, specs: specsJson }), makePriceHash(priceNum, now), now);
                 db.prepare(`INSERT INTO product_external_links
           (id, product_id, url, source, verified, verify_note, platform, external_id, external_title)

package/dist/pwa/routes/users-public.js

@@ -25,6 +25,14 @@ export function registerUsersPublicRoutes(app, deps) {
                 return;
             userId = user.id;
         }
+        else {
+            // ref 三态(usr_xxx / permanent_code / @handle)必须解析为 canonical id;
+            // 漏掉解析会让 @handle/permanent_code 当字面 user_id 去查 → 永远落到默认 'new'。
+            const resolved = await resolveUserId(userId);
+            if (!resolved)
+                return void res.status(404).json({ error: 'user not found' });
+            userId = resolved;
+        }
         const row = await dbOne(`
       SELECT level, MAX(trust_score) as max_score
       FROM agent_reputation WHERE user_id = ?

package/dist/pwa/routes/wallet-read.js

@@ -181,8 +181,11 @@ export function registerWalletReadRoutes(app, deps) {
       FROM orders WHERE seller_id = ? AND status = 'completed'
     `, [user.id]));
         const totalIncome = commMap.l1.total + commMap.l2.total + commMap.l3.total + Number(sales.total);
+        // RFC-018: commission accrued but still in the clearing window (matures into commissions/total_income). Pure read.
+        const clearing = (await dbOne("SELECT COALESCE(SUM(amount),0) as s FROM pending_commission_escrow WHERE recipient_user_id = ? AND matures_at IS NOT NULL AND status = 'pending'", [user.id])).s;
         res.json({
             commissions: commMap,
+            commission_clearing: Number(clearing.toFixed(2)), // RFC-018: accrued, maturing after the return window (not yet paid)
             sales: { count: sales.cnt, total: Number(Number(sales.total).toFixed(2)) },
             total_income: Number(totalIncome.toFixed(2)),
         });

package/dist/pwa/routes/webauthn.js

@@ -3,8 +3,9 @@ import { randomBytes } from 'node:crypto';
 // RFC-004 体验补:绑定 Passkey 后,追溯补发此前"已受理但无锚点跳过"的建设信誉。
 import { grantPendingAnchorCredits } from '../../layer2-business/L2-8-feedback/build-feedback-engine.js';
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { registerAgentGrantsRoutes } from './agent-grants.js'; // RFC-020 PR-B — Passkey-domain delegation grants (keeps server.ts untouched)
 export function registerWebauthnRoutes(app, deps) {
-    const { db, auth, generateId, rpId, rpName, origin, challengeTtlMs, gateTtlMs, invalidateAgentRiskCacheForUser, requireHumanPresence } = deps;
+    const { db, auth, generateId, rateLimitOk, rpId, rpName, origin, challengeTtlMs, gateTtlMs, invalidateAgentRiskCacheForUser, requireHumanPresence } = deps;
     // 1. 注册：start — 生成 challenge + 选项
     app.post('/api/webauthn/register/start', async (req, res) => {
         const user = auth(req, res);
@@ -73,7 +74,7 @@ export function registerWebauthnRoutes(app, deps) {
         if (!user)
             return;
         const purpose = String(req.body?.purpose || '').trim();
-        const allowed = new Set(['withdraw', 'change-password', 'reveal-key', 'region', 'delete_passkey', 'governance_apply', 'governance_activate', 'governance_resign', 'governance_appeal_resolve', 'rewards_apply', 'rewards_deactivate', 'identity_claim', 'operator_claim_unlink']);
+        const allowed = new Set(['withdraw', 'change-password', 'reveal-key', 'region', 'delete_passkey', 'governance_apply', 'governance_activate', 'governance_resign', 'governance_appeal_resolve', 'rewards_apply', 'rewards_deactivate', 'identity_claim', 'operator_claim_unlink', 'direct_pay_disclosure_ack', 'direct_pay_order_action', 'direct_receive_production_confirm', 'direct_pay_aml_review', 'direct_pay_kyb_ingress', 'direct_pay_sanctions_ingress', 'direct_pay_aml_ingress', 'direct_pay_admin_readiness', 'direct_pay_deferral_approve', 'direct_pay_deferral_reject', 'direct_pay_product_verify', 'direct_pay_store_verify', 'direct_pay_fee_prepay_record', 'direct_pay_fee_adjust', 'direct_pay_fee_refund', 'direct_receive_account_manage']);
         if (!allowed.has(purpose))
             return void res.status(400).json({ error: 'invalid purpose' });
         const purpose_data = req.body?.purpose_data ?? null;
@@ -192,4 +193,8 @@ export function registerWebauthnRoutes(app, deps) {
         await dbRun('UPDATE users SET webauthn_required_for_withdraw = ? WHERE id = ?', [required, user.id]);
         res.json({ success: true, required_for_withdraw: !!required });
     });
+    // RFC-020 PR-B — agent delegation grants (issue/read/revoke). Co-registered with the
+    // Passkey security routes so the money-dense server.ts stays untouched. Safe scopes
+    // only; risk scopes default-hard-reject. Reuses db/auth/generateId from WebauthnDeps.
+    registerAgentGrantsRoutes(app, { db, auth, generateId, rateLimitOk });
 }

package/dist/pwa/server-schema.js

@@ -0,0 +1,9 @@
+/**
+ * Compatibility re-export.
+ *
+ * The pure idempotent schema helpers were relocated to a neutral top-level
+ * module (src/runtime/webaz-schema-helpers.ts) so the PWA boot path and the MCP
+ * runtime schema composition root can share ONE source. This file keeps the
+ * historical `./server-schema.js` import path working for src/pwa/server.ts.
+ */
+export * from '../runtime/webaz-schema-helpers.js';