@invokable/server 0.1.0 → 0.3.0

package/README.md

@@ -74,7 +74,7 @@ Also not handled here, and yours to add:
   add your framework's CSRF protection.
 - **Rate limiting on `/device/start`.** Nothing stops an attacker minting device
   codes in bulk.
-- **Durable storage.** `memoryStore()` loses every token on restart. It is for
-  development and tests. A Postgres store is on the roadmap.
+- **Durable storage** — but `postgresAuthStore()` and `postgresCheckpointStore()`
+  are provided; see below. `memoryStore()` is for development only.
 - **Audit logging.** The store records who approved what and when; surfacing it
   is the host application's job.

package/dist/index.d.ts

@@ -8,4 +8,8 @@ export type { CheckpointRoutesOptions, VerifyCheckpointOptions } from './checkpo
 export { CheckpointVerifier, computeFingerprint, hashSummary, memoryCheckpointStore, parseCheckpointHeader, } from './checkpoints.js';
 export type { CheckpointRecord, CheckpointStore, CheckpointVerifierOptions, CheckpointFailure, VerifyResult, } from './checkpoints.js';
 export { stableStringify } from './stable-json.js';
+export { postgresAuthStore, postgresCheckpointStore, purgeExpired, createSchema, } from './postgres-store.js';
+export type { PostgresStoreOptions, PurgeResult } from './postgres-store.js';
+export { SCHEMA_SQL, SCHEMA_STATEMENTS } from './sql.js';
+export type { SqlExecutor } from './sql.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEpF,OAAO,EACL,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC3F,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAE/F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEpF,OAAO,EACL,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC3F,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAE/F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACZ,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACzD,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -4,4 +4,6 @@ export { generateToken, hashToken, generateUserCode, generateDeviceCode, safeEqu
 export { checkpointRoutes, verifyCheckpoint, staleResponse } from './checkpoint-routes.js';
 export { CheckpointVerifier, computeFingerprint, hashSummary, memoryCheckpointStore, parseCheckpointHeader, } from './checkpoints.js';
 export { stableStringify } from './stable-json.js';
+export { postgresAuthStore, postgresCheckpointStore, purgeExpired, createSchema, } from './postgres-store.js';
+export { SCHEMA_SQL, SCHEMA_STATEMENTS } from './sql.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ7C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EACL,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG3F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ7C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EACL,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG3F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACZ,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/postgres-store.d.ts

@@ -0,0 +1,33 @@
+import type { AuthStore } from './store.js';
+import type { CheckpointStore } from './checkpoints.js';
+import { createSchema, type SqlExecutor } from './sql.js';
+export interface PostgresStoreOptions {
+    exec: SqlExecutor;
+}
+export interface PurgeResult {
+    devices: number;
+    checkpoints: number;
+}
+/**
+ * Durable auth store.
+ *
+ * Required anywhere the process is not the only one holding state: a restart,
+ * a second instance behind a load balancer, or a serverless platform where
+ * every request may reach a fresh worker. With the in-memory store, a login
+ * started on one instance and polled on another simply never completes.
+ */
+export declare function postgresAuthStore(options: PostgresStoreOptions): AuthStore;
+/** Durable checkpoint store. See `consumeCheckpoint` for the part that matters. */
+export declare function postgresCheckpointStore(options: PostgresStoreOptions): CheckpointStore;
+/**
+ * Deletes rows that can no longer be used. Nothing depends on this for
+ * correctness — expiry is enforced on read — but without it the tables grow
+ * forever. Run it from a scheduled job.
+ */
+export declare function purgeExpired(exec: SqlExecutor, options?: {
+    now?: number;
+    graceMs?: number;
+}): Promise<PurgeResult>;
+export { createSchema };
+export type { SqlExecutor };
+//# sourceMappingURL=postgres-store.d.ts.map

package/dist/postgres-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-store.d.ts","sourceRoot":"","sources":["../src/postgres-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAA0C,MAAM,YAAY,CAAC;AACpF,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,YAAY,EAIZ,KAAK,WAAW,EACjB,MAAM,UAAU,CAAC;AA6GlB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAgG1E;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CAqDtF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/C,OAAO,CAAC,WAAW,CAAC,CAgBtB;AAED,OAAO,EAAE,YAAY,EAAE,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/postgres-store.js

@@ -0,0 +1,211 @@
+import { createSchema, toNumber, toOptionalNumber, toOptionalString, } from './sql.js';
+function toDevice(row) {
+    const record = {
+        deviceCode: row.device_code,
+        userCode: row.user_code,
+        state: row.state,
+        clientName: row.client_name,
+        hostname: row.hostname,
+        toolVersion: row.tool_version,
+        createdAt: toNumber(row.created_at),
+        expiresAt: toNumber(row.expires_at),
+    };
+    const subject = toOptionalString(row.subject);
+    const orgId = toOptionalString(row.org_id);
+    const lastPolledAt = toOptionalNumber(row.last_polled_at);
+    if (subject !== undefined)
+        record.subject = subject;
+    if (orgId !== undefined)
+        record.orgId = orgId;
+    if (lastPolledAt !== undefined)
+        record.lastPolledAt = lastPolledAt;
+    return record;
+}
+function toToken(row) {
+    const record = {
+        tokenHash: row.token_hash,
+        tokenPrefix: row.token_prefix,
+        subject: row.subject,
+        clientName: row.client_name,
+        hostname: row.hostname,
+        createdAt: toNumber(row.created_at),
+        expiresAt: row.expires_at === null || row.expires_at === undefined ? null : toNumber(row.expires_at),
+    };
+    const orgId = toOptionalString(row.org_id);
+    const revokedAt = toOptionalNumber(row.revoked_at);
+    if (orgId !== undefined)
+        record.orgId = orgId;
+    if (revokedAt !== undefined)
+        record.revokedAt = revokedAt;
+    return record;
+}
+function toCheckpoint(row) {
+    const record = {
+        fingerprint: row.fingerprint,
+        gate: row.gate,
+        subject: row.subject,
+        summaryHash: row.summary_hash,
+        issuedAt: toNumber(row.issued_at),
+        expiresAt: toNumber(row.expires_at),
+        consumed: Boolean(row.consumed),
+    };
+    const consumedAt = toOptionalNumber(row.consumed_at);
+    const issuedTo = toOptionalString(row.issued_to);
+    if (consumedAt !== undefined)
+        record.consumedAt = consumedAt;
+    if (issuedTo !== undefined)
+        record.issuedTo = issuedTo;
+    return record;
+}
+/** Column name for each patchable device field, for the partial UPDATE. */
+const DEVICE_COLUMNS = {
+    deviceCode: 'device_code',
+    userCode: 'user_code',
+    state: 'state',
+    clientName: 'client_name',
+    hostname: 'hostname',
+    toolVersion: 'tool_version',
+    createdAt: 'created_at',
+    expiresAt: 'expires_at',
+    subject: 'subject',
+    orgId: 'org_id',
+    lastPolledAt: 'last_polled_at',
+};
+/**
+ * Durable auth store.
+ *
+ * Required anywhere the process is not the only one holding state: a restart,
+ * a second instance behind a load balancer, or a serverless platform where
+ * every request may reach a fresh worker. With the in-memory store, a login
+ * started on one instance and polled on another simply never completes.
+ */
+export function postgresAuthStore(options) {
+    const { exec } = options;
+    return {
+        async createDevice(record) {
+            await exec.query(`INSERT INTO invokable_devices
+           (device_code, user_code, state, client_name, hostname, tool_version,
+            created_at, expires_at, subject, org_id, last_polled_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11)`, [
+                record.deviceCode,
+                record.userCode,
+                record.state,
+                record.clientName,
+                record.hostname,
+                record.toolVersion,
+                record.createdAt,
+                record.expiresAt,
+                record.subject ?? null,
+                record.orgId ?? null,
+                record.lastPolledAt ?? null,
+            ]);
+        },
+        async findDeviceByDeviceCode(deviceCode) {
+            const { rows } = await exec.query('SELECT * FROM invokable_devices WHERE device_code = $1', [deviceCode]);
+            return rows[0] ? toDevice(rows[0]) : null;
+        },
+        async findDeviceByUserCode(userCode) {
+            // Newest first: an expired code may linger until the sweeper runs, and the
+            // live one is the one a person is looking at.
+            const { rows } = await exec.query('SELECT * FROM invokable_devices WHERE user_code = $1 ORDER BY created_at DESC LIMIT 1', [userCode]);
+            return rows[0] ? toDevice(rows[0]) : null;
+        },
+        async updateDevice(deviceCode, patch) {
+            const sets = [];
+            const params = [];
+            for (const [key, value] of Object.entries(patch)) {
+                const column = DEVICE_COLUMNS[key];
+                if (!column)
+                    continue;
+                params.push(value ?? null);
+                sets.push(`${column} = $${params.length}`);
+            }
+            if (sets.length === 0)
+                return;
+            params.push(deviceCode);
+            await exec.query(`UPDATE invokable_devices SET ${sets.join(', ')} WHERE device_code = $${params.length}`, params);
+        },
+        async createToken(record) {
+            await exec.query(`INSERT INTO invokable_tokens
+           (token_hash, token_prefix, subject, org_id, client_name, hostname,
+            created_at, expires_at, revoked_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`, [
+                record.tokenHash,
+                record.tokenPrefix,
+                record.subject,
+                record.orgId ?? null,
+                record.clientName,
+                record.hostname,
+                record.createdAt,
+                record.expiresAt,
+                record.revokedAt ?? null,
+            ]);
+        },
+        async findTokenByHash(tokenHash) {
+            const { rows } = await exec.query('SELECT * FROM invokable_tokens WHERE token_hash = $1', [tokenHash]);
+            return rows[0] ? toToken(rows[0]) : null;
+        },
+        async revokeToken(tokenHash, at) {
+            await exec.query('UPDATE invokable_tokens SET revoked_at = $1 WHERE token_hash = $2 AND revoked_at IS NULL', [at, tokenHash]);
+        },
+    };
+}
+/** Durable checkpoint store. See `consumeCheckpoint` for the part that matters. */
+export function postgresCheckpointStore(options) {
+    const { exec } = options;
+    return {
+        async createCheckpoint(record) {
+            await exec.query(`INSERT INTO invokable_checkpoints
+           (fingerprint, gate, subject, summary_hash, issued_at, expires_at,
+            consumed, consumed_at, issued_to)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`, [
+                record.fingerprint,
+                record.gate,
+                record.subject,
+                record.summaryHash,
+                record.issuedAt,
+                record.expiresAt,
+                record.consumed,
+                record.consumedAt ?? null,
+                record.issuedTo ?? null,
+            ]);
+        },
+        async findCheckpoint(fingerprint) {
+            const { rows } = await exec.query('SELECT * FROM invokable_checkpoints WHERE fingerprint = $1', [fingerprint]);
+            return rows[0] ? toCheckpoint(rows[0]) : null;
+        },
+        /**
+         * One statement, not a read followed by a write.
+         *
+         * `WHERE consumed = FALSE` makes the database the arbiter: of two concurrent
+         * requests carrying the same approval, exactly one UPDATE matches a row and
+         * the other returns nothing. A SELECT-then-UPDATE would let both pass and
+         * bill the user twice for one approval — the precise thing the gate exists
+         * to prevent. The in-memory store gets away without this only because a
+         * single Node process cannot interleave.
+         */
+        async consumeCheckpoint(fingerprint, at) {
+            const { rows } = await exec.query(`UPDATE invokable_checkpoints
+            SET consumed = TRUE, consumed_at = $2
+          WHERE fingerprint = $1 AND consumed = FALSE
+          RETURNING fingerprint`, [fingerprint, at]);
+            return rows.length === 1;
+        },
+    };
+}
+/**
+ * Deletes rows that can no longer be used. Nothing depends on this for
+ * correctness — expiry is enforced on read — but without it the tables grow
+ * forever. Run it from a scheduled job.
+ */
+export async function purgeExpired(exec, options = {}) {
+    const now = options.now ?? Date.now();
+    // Kept past expiry so a recently expired approval can still be explained to
+    // whoever asks why it was refused.
+    const cutoff = now - (options.graceMs ?? 24 * 60 * 60 * 1000);
+    const devices = await exec.query('DELETE FROM invokable_devices WHERE expires_at < $1 RETURNING device_code', [cutoff]);
+    const checkpoints = await exec.query('DELETE FROM invokable_checkpoints WHERE expires_at < $1 RETURNING fingerprint', [cutoff]);
+    return { devices: devices.rows.length, checkpoints: checkpoints.rows.length };
+}
+export { createSchema };
+//# sourceMappingURL=postgres-store.js.map

package/dist/postgres-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-store.js","sourceRoot":"","sources":["../src/postgres-store.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,UAAU,CAAC;AAwClB,SAAS,QAAQ,CAAC,GAAc;IAC9B,MAAM,MAAM,GAAiB;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,KAAK,EAAE,GAAG,CAAC,KAAoB;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;KACpC,CAAC;IACF,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9C,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,GAAa;IAC5B,MAAM,MAAM,GAAgB;QAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;KACrG,CAAC;IACF,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,MAAM,MAAM,GAAqB;QAC/B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;KAChC,CAAC;IACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IAC7D,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,cAAc,GAAuC;IACzD,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,YAAY;IACvB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,gBAAgB;CAC/B,CAAC;AAWF;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAEzB,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;qDAG6C,EAC7C;gBACE,MAAM,CAAC,UAAU;gBACjB,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,KAAK;gBACZ,MAAM,CAAC,UAAU;gBACjB,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,WAAW;gBAClB,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,OAAO,IAAI,IAAI;gBACtB,MAAM,CAAC,KAAK,IAAI,IAAI;gBACpB,MAAM,CAAC,YAAY,IAAI,IAAI;aAC5B,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,UAAU;YACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,wDAAwD,EACxD,CAAC,UAAU,CAAC,CACb,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,QAAQ;YACjC,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,uFAAuF,EACvF,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK;YAClC,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAyB,CAAC,CAAC;gBACzD,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,MAAM,IAAI,CAAC,KAAK,CACd,gCAAgC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,EACvF,MAAM,CACP,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,IAAI,CAAC,KAAK,CACd;;;6CAGqC,EACrC;gBACE,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,WAAW;gBAClB,MAAM,CAAC,OAAO;gBACd,MAAM,CAAC,KAAK,IAAI,IAAI;gBACpB,MAAM,CAAC,UAAU;gBACjB,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,SAAS,IAAI,IAAI;aACzB,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,SAAS;YAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,sDAAsD,EACtD,CAAC,SAAS,CAAC,CACZ,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE;YAC7B,MAAM,IAAI,CAAC,KAAK,CACd,0FAA0F,EAC1F,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,OAA6B;IACnE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAEzB,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC3B,MAAM,IAAI,CAAC,KAAK,CACd;;;6CAGqC,EACrC;gBACE,MAAM,CAAC,WAAW;gBAClB,MAAM,CAAC,IAAI;gBACX,MAAM,CAAC,OAAO;gBACd,MAAM,CAAC,WAAW;gBAClB,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,UAAU,IAAI,IAAI;gBACzB,MAAM,CAAC,QAAQ,IAAI,IAAI;aACxB,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,WAAW;YAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,4DAA4D,EAC5D,CAAC,WAAW,CAAC,CACd,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;QAED;;;;;;;;;WASG;QACH,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE;YACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;gCAGwB,EACxB,CAAC,WAAW,EAAE,EAAE,CAAC,CAClB,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAiB,EACjB,UAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,4EAA4E;IAC5E,mCAAmC;IACnC,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B,2EAA2E,EAC3E,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAClC,+EAA+E,EAC/E,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;AAChF,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/sql.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The database seam.
+ *
+ * Deliberately not a driver. Any client with a `query(text, params)` that
+ * returns `{ rows }` satisfies this — `pg`, `postgres.js`,
+ * `@neondatabase/serverless`, PGlite. That keeps `@invokable/server` free of a
+ * database dependency, and lets the same store run on a serverless platform
+ * (where an HTTP driver avoids exhausting connections) and on a plain server.
+ */
+export interface SqlExecutor {
+    query<T = Record<string, unknown>>(text: string, params?: readonly unknown[]): Promise<{
+        rows: T[];
+    }>;
+}
+/**
+ * Timestamps are stored as epoch milliseconds in `bigint` rather than
+ * `timestamptz`, because the record types are `number` and a round trip through
+ * a date type loses the exact value the fingerprint was signed over.
+ */
+/**
+ * Each statement separately, not one blob.
+ *
+ * A multi-statement string only works over the simple query protocol. Drivers
+ * that use the extended protocol — PGlite, and HTTP drivers such as Neon's
+ * serverless client — reject it with "cannot insert multiple commands into a
+ * prepared statement", which is exactly the setup this store exists for.
+ *
+ * Timestamps are epoch milliseconds in `bigint` rather than `timestamptz`,
+ * because the record types are `number` and a round trip through a date type
+ * loses the exact value the fingerprint was signed over.
+ */
+export declare const SCHEMA_STATEMENTS: readonly string[];
+/** The whole schema as one script, for running by hand with psql. */
+export declare const SCHEMA_SQL: string;
+/** Creates the tables if they are absent. Safe to run on every boot. */
+export declare function createSchema(exec: SqlExecutor): Promise<void>;
+/**
+ * `bigint` arrives as a string from most drivers, because it can exceed
+ * `Number.MAX_SAFE_INTEGER`. Epoch milliseconds cannot, so converting is exact.
+ */
+export declare function toNumber(value: unknown): number;
+export declare function toOptionalNumber(value: unknown): number | undefined;
+export declare function toOptionalString(value: unknown): string | undefined;
+//# sourceMappingURL=sql.d.ts.map

package/dist/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;;;GAIG;AACH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EA8C9C,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,UAAU,QAA0C,CAAC;AAElE,wEAAwE;AACxE,wBAAsB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAInE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG/C;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGnE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEnE"}

package/dist/sql.js

@@ -0,0 +1,88 @@
+/**
+ * Timestamps are stored as epoch milliseconds in `bigint` rather than
+ * `timestamptz`, because the record types are `number` and a round trip through
+ * a date type loses the exact value the fingerprint was signed over.
+ */
+/**
+ * Each statement separately, not one blob.
+ *
+ * A multi-statement string only works over the simple query protocol. Drivers
+ * that use the extended protocol — PGlite, and HTTP drivers such as Neon's
+ * serverless client — reject it with "cannot insert multiple commands into a
+ * prepared statement", which is exactly the setup this store exists for.
+ *
+ * Timestamps are epoch milliseconds in `bigint` rather than `timestamptz`,
+ * because the record types are `number` and a round trip through a date type
+ * loses the exact value the fingerprint was signed over.
+ */
+export const SCHEMA_STATEMENTS = [
+    `CREATE TABLE IF NOT EXISTS invokable_devices (
+    device_code    TEXT PRIMARY KEY,
+    user_code      TEXT NOT NULL,
+    state          TEXT NOT NULL,
+    client_name    TEXT NOT NULL,
+    hostname       TEXT NOT NULL,
+    tool_version   TEXT NOT NULL,
+    created_at     BIGINT NOT NULL,
+    expires_at     BIGINT NOT NULL,
+    subject        TEXT,
+    org_id         TEXT,
+    last_polled_at BIGINT
+  )`,
+    // One pending device per user code: the code is what a human types, and two
+    // live devices answering to it would make approval ambiguous.
+    `CREATE UNIQUE INDEX IF NOT EXISTS invokable_devices_user_code_pending
+     ON invokable_devices (user_code) WHERE state = 'pending'`,
+    `CREATE INDEX IF NOT EXISTS invokable_devices_user_code ON invokable_devices (user_code)`,
+    `CREATE INDEX IF NOT EXISTS invokable_devices_expires_at ON invokable_devices (expires_at)`,
+    `CREATE TABLE IF NOT EXISTS invokable_tokens (
+    token_hash   TEXT PRIMARY KEY,
+    token_prefix TEXT NOT NULL,
+    subject      TEXT NOT NULL,
+    org_id       TEXT,
+    client_name  TEXT NOT NULL,
+    hostname     TEXT NOT NULL,
+    created_at   BIGINT NOT NULL,
+    expires_at   BIGINT,
+    revoked_at   BIGINT
+  )`,
+    `CREATE INDEX IF NOT EXISTS invokable_tokens_subject ON invokable_tokens (subject)`,
+    `CREATE TABLE IF NOT EXISTS invokable_checkpoints (
+    fingerprint  TEXT PRIMARY KEY,
+    gate         TEXT NOT NULL,
+    subject      TEXT NOT NULL,
+    summary_hash TEXT NOT NULL,
+    issued_at    BIGINT NOT NULL,
+    expires_at   BIGINT NOT NULL,
+    consumed     BOOLEAN NOT NULL DEFAULT FALSE,
+    consumed_at  BIGINT,
+    issued_to    TEXT
+  )`,
+    `CREATE INDEX IF NOT EXISTS invokable_checkpoints_expires_at ON invokable_checkpoints (expires_at)`,
+];
+/** The whole schema as one script, for running by hand with psql. */
+export const SCHEMA_SQL = SCHEMA_STATEMENTS.join(';\n\n') + ';\n';
+/** Creates the tables if they are absent. Safe to run on every boot. */
+export async function createSchema(exec) {
+    for (const statement of SCHEMA_STATEMENTS) {
+        await exec.query(statement);
+    }
+}
+/**
+ * `bigint` arrives as a string from most drivers, because it can exceed
+ * `Number.MAX_SAFE_INTEGER`. Epoch milliseconds cannot, so converting is exact.
+ */
+export function toNumber(value) {
+    if (value === null || value === undefined)
+        return 0;
+    return typeof value === 'number' ? value : Number(value);
+}
+export function toOptionalNumber(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    return toNumber(value);
+}
+export function toOptionalString(value) {
+    return value === null || value === undefined ? undefined : String(value);
+}
+//# sourceMappingURL=sql.js.map

package/dist/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD;;;;;;;;;;;;IAYE;IACF,4EAA4E;IAC5E,8DAA8D;IAC9D;8DAC4D;IAC5D,yFAAyF;IACzF,2FAA2F;IAE3F;;;;;;;;;;IAUE;IACF,mFAAmF;IAEnF;;;;;;;;;;IAUE;IACF,mGAAmG;CACpG,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;AAElE,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAiB;IAClD,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC"}

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEzE,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACzE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,wBAAgB,WAAW,IAAI,SAAS,GAAG;IAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CAAE,CAoCpH"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEzE,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACzE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,wBAAgB,WAAW,IAAI,SAAS,GAAG;IAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CAAE,CAwCpH"}

package/dist/store.js

@@ -30,8 +30,11 @@ export function memoryStore() {
         },
         async revokeToken(tokenHash, at) {
             const existing = tokens.get(tokenHash);
-            if (existing)
+            // First revocation wins: that is the moment the token stopped working,
+            // and overwriting it would misreport when access actually ended.
+            if (existing && existing.revokedAt === undefined) {
                 tokens.set(tokenHash, { ...existing, revokedAt: at });
+            }
         },
     };
 }

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAgDA,MAAM,UAAU,WAAW;IACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,MAAM;QAEf,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,sBAAsB,CAAC,UAAU;YACrC,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,QAAQ;YACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK;YAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,SAAS;YAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE;YAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAgDA,MAAM,UAAU,WAAW;IACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,MAAM;QAEf,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,sBAAsB,CAAC,UAAU;YACrC,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,QAAQ;YACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK;YAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,SAAS;YAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE;YAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,uEAAuE;YACvE,iEAAiE;YACjE,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invokable/server",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Self-hostable device-code auth endpoints for invokable tools.",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,8 @@
     "access": "public"
   },
   "devDependencies": {
-    "@invokable/core": "^0.1.0"
+    "@electric-sql/pglite": "^0.5.8",
+    "@invokable/core": "^0.3.0"
   },
   "scripts": {
     "build": "tsc -b",