@kubun/store-delegation 0.11.0

package/LICENSE.md

@@ -0,0 +1,57 @@
+# The Prosperity Public License 3.0.0
+
+Contributor: Paul Le Cam
+
+Source Code: https://github.com/PaulLeCam/kubun
+
+## Purpose
+
+This license allows you to use and share this software for noncommercial purposes for free and to try this software for commercial purposes for thirty days.
+
+## Agreement
+
+In order to receive this license, you have to agree to its rules.  Those rules are both obligations under that agreement and conditions to your license.  Don't do anything with this software that triggers a rule you can't or won't follow.
+
+## Notices
+
+Make sure everyone who gets a copy of any part of this software from you, with or without changes, also gets the text of this license and the contributor and source code lines above.
+
+## Commercial Trial
+
+Limit your use of this software for commercial purposes to a thirty-day trial period.  If you use this software for work, your company gets one trial period for all personnel, not one trial per person.
+
+## Contributions Back
+
+Developing feedback, changes, or additions that you contribute back to the contributor on the terms of a standardized public software license such as [the Blue Oak Model License 1.0.0](https://blueoakcouncil.org/license/1.0.0), [the Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0.html), [the MIT license](https://spdx.org/licenses/MIT.html), or [the two-clause BSD license](https://spdx.org/licenses/BSD-2-Clause.html) doesn't count as use for a commercial purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, doesn't count as use for a commercial purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution doesn't count as use for a commercial purpose regardless of the source of funding or obligations resulting from the funding.
+
+## Defense
+
+Don't make any legal claim against anyone accusing this software, with or without changes, alone or with other technology, of infringing any patent.
+
+## Copyright
+
+The contributor licenses you to do everything with this software that would otherwise infringe their copyright in it.
+
+## Patent
+
+The contributor licenses you to do everything with this software that would otherwise infringe any patents they can license or become able to license.
+
+## Reliability
+
+The contributor can't revoke this license.
+
+## Excuse
+
+You're excused for unknowingly breaking [Notices](#notices) if you take all practical steps to comply within thirty days of learning you broke the rule.
+
+## No Liability
+
+***As far as the law allows, this software comes as is, without any warranty or condition, and the contributor won't be liable to anyone for any damages related to this software or this license, under any kind of legal claim.***

package/lib/api.d.ts

@@ -0,0 +1,39 @@
+import type { Adapter } from '@kubun/db-adapter';
+import { type Logger } from '@kubun/logger';
+import type { Kysely } from 'kysely';
+import type { DelegationStoreTables, DelegationToken, HeldRevocation, InsertDelegationToken, InsertRevokedCapability, RevokedCapability } from './tables.js';
+export type DelegationStoreAPI = {
+    addDelegationToken(token: InsertDelegationToken): Promise<boolean>;
+    getDelegationTokens(params: {
+        grantor: string;
+        audience: string;
+    }): Promise<Array<DelegationToken>>;
+    getHeldTokens(params: {
+        audience: string;
+        atTime: number;
+    }): Promise<Array<DelegationToken>>;
+    listIssuedTokens(grantor: string): Promise<Array<DelegationToken>>;
+    getDelegationTokenByJTI(jti: string): Promise<DelegationToken | null>;
+    removeDelegationToken(params: {
+        jti: string;
+    }): Promise<boolean>;
+    addRevocation(input: InsertRevokedCapability): Promise<boolean>;
+    getRevocation(jti: string): Promise<RevokedCapability | null>;
+    isRevoked(jti: string): Promise<boolean>;
+    getHeldRevocations(params: {
+        audience: string;
+    }): Promise<Array<HeldRevocation>>;
+    markRevocationVerified(jti: string, params: {
+        cap_exp: number;
+        verified_at?: number;
+    }): Promise<boolean>;
+    getPendingRevocationByJTI(jti: string): Promise<RevokedCapability | null>;
+    deletePendingRevocation(jti: string): Promise<boolean>;
+    purgeExpiredRevocations(params: {
+        graceSeconds: number;
+    }): Promise<number>;
+    purgeDeadPendingRevocations(params: {
+        maxAgeSeconds: number;
+    }): Promise<number>;
+};
+export declare function createDelegationStore(db: Kysely<DelegationStoreTables>, adapter: Adapter, logger?: Logger): DelegationStoreAPI;

package/lib/api.js

@@ -0,0 +1,234 @@
+import { getKubunLogger } from '@kubun/logger';
+// --- Revocation GC defaults ---
+// Probability that each delegation-token insert triggers a revocation sweep.
+// 1% keeps the sweep amortized cost negligible; over a busy stream it still
+// runs often enough to bound table growth.
+const REVOCATION_GC_SAMPLE_RATE = 0.01;
+// Verified revocations remain queryable this long past the capability's
+// expiry — enough for audit lookbacks before the row is pruned.
+const REVOCATION_GC_VERIFIED_GRACE_SECONDS = 86_400 * 30;
+// Pending revocations that never receive a matching capability are dropped
+// after this age — past this window the broadcast is treated as dead.
+const REVOCATION_GC_PENDING_MAX_AGE_SECONDS = 86_400 * 7;
+// --- Factory function ---
+export function createDelegationStore(db, adapter, logger = getKubunLogger('store-delegation')) {
+    const api = {
+        // --- Delegation token operations ---
+        // LWW arbitration on the serialized HLC: the SQL string `>` compare is a
+        // stand-in for `HLC.compare`, valid only while the per-millisecond counter
+        // stays within the pad width; that ceiling is unreachable and the SQL
+        // compare avoids a read-modify-write race. The pre-read drives the returned
+        // "changed" flag (used by emission gates to suppress `delegationTokenAdded`
+        // on idempotent re-stores). It is not wrapped in a transaction because
+        // callers already run inside one — Kysely rejects nested transactions on
+        // shared connections. The narrow TOCTOU window between read and upsert can
+        // let a concurrent identical re-store race and emit twice; that is benign
+        // for emission gating, and the LWW upsert itself remains correct under the
+        // SQL `>` arbiter regardless.
+        async addDelegationToken (token) {
+            const existing = await db.selectFrom('kubun_delegation_tokens').select([
+                'jti',
+                'token',
+                'act',
+                'exp',
+                'hlc'
+            ]).where('grantor', '=', token.grantor).where('audience', '=', token.audience).where('resource', '=', token.resource).executeTakeFirst();
+            await db.insertInto('kubun_delegation_tokens').values({
+                jti: token.jti,
+                grantor: token.grantor,
+                audience: token.audience,
+                token: token.token,
+                resource: token.resource,
+                act: token.act,
+                exp: token.exp,
+                hlc: token.hlc
+            }).onConflict((oc)=>oc.columns([
+                    'grantor',
+                    'audience',
+                    'resource'
+                ]).doUpdateSet((eb)=>({
+                        jti: eb.ref('excluded.jti'),
+                        token: eb.ref('excluded.token'),
+                        act: eb.ref('excluded.act'),
+                        exp: eb.ref('excluded.exp'),
+                        hlc: eb.ref('excluded.hlc'),
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    })).where((eb)=>eb('excluded.hlc', '>', eb.ref('kubun_delegation_tokens.hlc')))).execute();
+            let changed;
+            if (existing == null) {
+                // New PK — row was inserted.
+                changed = true;
+            } else if (token.hlc <= existing.hlc) {
+                // LWW lost (older or equal HLC) — stored row unchanged.
+                changed = false;
+            } else {
+                // LWW won — emit only if any content field actually differs. Identical
+                // re-broadcasts (same jti/token/act/exp with a newer hlc) are a no-op
+                // from the consumer's perspective.
+                changed = existing.jti !== token.jti || existing.token !== token.token || existing.act !== token.act || existing.exp !== token.exp;
+            }
+            // Amortize revocation GC across delegation-token inserts. Sample rate
+            // keeps the sweep cost negligible while ensuring the table doesn't grow
+            // unbounded when the cap stream is busy. Best-effort — sweep failures
+            // must not propagate up and break the insert path, but they must be
+            // logged so a regression (typo in a purge method, schema drift, etc.)
+            // surfaces in operator logs instead of silently going undetected.
+            if (Math.random() < REVOCATION_GC_SAMPLE_RATE) {
+                try {
+                    await api.purgeExpiredRevocations({
+                        graceSeconds: REVOCATION_GC_VERIFIED_GRACE_SECONDS
+                    });
+                    await api.purgeDeadPendingRevocations({
+                        maxAgeSeconds: REVOCATION_GC_PENDING_MAX_AGE_SECONDS
+                    });
+                } catch (error) {
+                    logger.warn('revocation GC sweep failed during addDelegationToken: {error}', {
+                        error
+                    });
+                }
+            }
+            return changed;
+        },
+        async getDelegationTokens (params) {
+            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', params.grantor).where('audience', '=', params.audience).execute();
+        },
+        async getHeldTokens (params) {
+            return await db.selectFrom('kubun_delegation_tokens').leftJoin('kubun_revoked_capabilities', 'kubun_revoked_capabilities.jti', 'kubun_delegation_tokens.jti').selectAll('kubun_delegation_tokens').where('audience', '=', params.audience).where('exp', '>', params.atTime)// Pending revocations (verified_at IS NULL) are not binding until the
+            // cap-arrival cross-check verifies them, so they don't filter tokens.
+            .where((eb)=>eb.or([
+                    eb('kubun_revoked_capabilities.jti', 'is', null),
+                    eb('kubun_revoked_capabilities.verified_at', 'is', null)
+                ])).execute();
+        },
+        async listIssuedTokens (grantor) {
+            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', grantor).execute();
+        },
+        async getDelegationTokenByJTI (jti) {
+            const row = await db.selectFrom('kubun_delegation_tokens').selectAll().where('jti', '=', jti).executeTakeFirst();
+            return row ?? null;
+        },
+        // Hard-delete a held token by `jti`. Used to drop a delegated write
+        // capability the server no longer needs — e.g. when a viewer disconnects a
+        // connector, the server relinquishes the ability to keep writing on the
+        // viewer's behalf. Not wrapped in a transaction because callers already run
+        // inside one.
+        async removeDelegationToken (params) {
+            const result = await db.deleteFrom('kubun_delegation_tokens').where('jti', '=', params.jti).executeTakeFirst();
+            return (result.numDeletedRows ?? 0n) > 0n;
+        },
+        // --- Revoked capability operations ---
+        // Same LWW arbitration as `addDelegationToken`: SQL string `>` on the
+        // serialized HLC is a stand-in for `HLC.compare`, valid only while the
+        // per-millisecond counter stays within the pad width. The pre-read drives
+        // the boolean change signal that emission gates consume; the upsert is
+        // not wrapped in a transaction because callers already run inside one.
+        async addRevocation (input) {
+            const existing = await db.selectFrom('kubun_revoked_capabilities').select([
+                'revoker_did',
+                'revoked_iat',
+                'revocation_token',
+                'verified_at',
+                'cap_exp',
+                'hlc'
+            ]).where('jti', '=', input.jti).executeTakeFirst();
+            await db.insertInto('kubun_revoked_capabilities').values({
+                jti: input.jti,
+                revoker_did: input.revoker_did,
+                revoked_iat: input.revoked_iat,
+                revocation_token: input.revocation_token,
+                verified_at: input.verified_at ?? null,
+                cap_exp: input.cap_exp ?? null,
+                hlc: input.hlc
+            }).onConflict((oc)=>oc.column('jti').doUpdateSet((eb)=>({
+                        revoker_did: eb.ref('excluded.revoker_did'),
+                        revoked_iat: eb.ref('excluded.revoked_iat'),
+                        revocation_token: eb.ref('excluded.revocation_token'),
+                        verified_at: eb.ref('excluded.verified_at'),
+                        cap_exp: eb.ref('excluded.cap_exp'),
+                        hlc: eb.ref('excluded.hlc'),
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    })).where((eb)=>eb('excluded.hlc', '>', eb.ref('kubun_revoked_capabilities.hlc')))).execute();
+            if (existing == null) {
+                return true;
+            }
+            if (input.hlc <= existing.hlc) {
+                return false;
+            }
+            const incomingVerifiedAt = input.verified_at ?? null;
+            const incomingCapExp = input.cap_exp ?? null;
+            return existing.revoker_did !== input.revoker_did || existing.revoked_iat !== input.revoked_iat || existing.revocation_token !== input.revocation_token || existing.verified_at !== incomingVerifiedAt || existing.cap_exp !== incomingCapExp;
+        },
+        async getRevocation (jti) {
+            const row = await db.selectFrom('kubun_revoked_capabilities').selectAll().where('jti', '=', jti).executeTakeFirst();
+            return row ?? null;
+        },
+        async isRevoked (jti) {
+            const row = await db.selectFrom('kubun_revoked_capabilities').select('jti').where('jti', '=', jti).where('verified_at', 'is not', null).limit(1).executeTakeFirst();
+            return row != null;
+        },
+        // Explicit column list (no `selectAll`) because `kubun_revoked_capabilities`
+        // and `kubun_delegation_tokens` share several column names (`jti`, `hlc`,
+        // `created_at`, `updated_at`); `selectAll` would produce an ambiguous
+        // projection. The INNER JOIN drops verified revocations whose cap row is not
+        // held locally, which is exactly the desired filter for an audience-scoped
+        // query.
+        async getHeldRevocations (params) {
+            const rows = await db.selectFrom('kubun_revoked_capabilities').innerJoin('kubun_delegation_tokens', 'kubun_delegation_tokens.jti', 'kubun_revoked_capabilities.jti').select([
+                'kubun_revoked_capabilities.jti as jti',
+                'kubun_delegation_tokens.grantor as grantor',
+                'kubun_delegation_tokens.audience as audience',
+                'kubun_revoked_capabilities.revoker_did as revoker_did',
+                'kubun_revoked_capabilities.revoked_iat as revoked_iat',
+                'kubun_revoked_capabilities.verified_at as verified_at',
+                'kubun_revoked_capabilities.cap_exp as cap_exp'
+            ]).where('kubun_revoked_capabilities.verified_at', 'is not', null).where('kubun_delegation_tokens.audience', '=', params.audience).execute();
+            return rows.map((row)=>({
+                    jti: row.jti,
+                    grantor: row.grantor,
+                    audience: row.audience,
+                    revoker_did: row.revoker_did,
+                    revoked_iat: row.revoked_iat,
+                    // verified_at is non-null by the WHERE above.
+                    verified_at: row.verified_at,
+                    cap_exp: row.cap_exp
+                }));
+        },
+        async markRevocationVerified (jti, params) {
+            const verifiedAt = params.verified_at ?? Math.floor(Date.now() / 1000);
+            const result = await db.updateTable('kubun_revoked_capabilities').set({
+                verified_at: verifiedAt,
+                cap_exp: params.cap_exp,
+                updated_at: adapter.encodeTimestamp(new Date())
+            }).where('jti', '=', jti).where('verified_at', 'is', null).executeTakeFirst();
+            return (result.numUpdatedRows ?? 0n) > 0n;
+        },
+        async getPendingRevocationByJTI (jti) {
+            const row = await db.selectFrom('kubun_revoked_capabilities').selectAll().where('jti', '=', jti).where('verified_at', 'is', null).executeTakeFirst();
+            return row ?? null;
+        },
+        async deletePendingRevocation (jti) {
+            const result = await db.deleteFrom('kubun_revoked_capabilities').where('jti', '=', jti).where('verified_at', 'is', null).executeTakeFirst();
+            return (result.numDeletedRows ?? 0n) > 0n;
+        },
+        // `cap_exp` is a plain integer column of epoch seconds (no adapter
+        // coercion on either side); the predicate is rewritten as
+        // `cap_exp < now - grace` so the comparison stays in integer space on
+        // both SQLite and Postgres. Pending rows have `cap_exp` NULL and are
+        // excluded by the `is not null` guard.
+        async purgeExpiredRevocations (params) {
+            const cutoff = Math.floor(Date.now() / 1000) - params.graceSeconds;
+            const result = await db.deleteFrom('kubun_revoked_capabilities').where('verified_at', 'is not', null).where('cap_exp', 'is not', null).where('cap_exp', '<', cutoff).executeTakeFirst();
+            return Number(result.numDeletedRows ?? 0n);
+        },
+        // `created_at` is adapter-encoded (integer seconds on SQLite,
+        // timestamptz on Postgres), so the cutoff is produced via
+        // `adapter.encodeTimestamp` to match the stored representation on both
+        // back-ends.
+        async purgeDeadPendingRevocations (params) {
+            const threshold = adapter.encodeTimestamp(new Date(Date.now() - params.maxAgeSeconds * 1000));
+            const result = await db.deleteFrom('kubun_revoked_capabilities').where('verified_at', 'is', null).where('created_at', '<', threshold).executeTakeFirst();
+            return Number(result.numDeletedRows ?? 0n);
+        }
+    };
+    return api;
+}

package/lib/definition.d.ts

@@ -0,0 +1,4 @@
+import type { StoreDefinition } from '@kubun/db';
+import type { DelegationStoreAPI } from './api.js';
+import type { DelegationStoreTables } from './tables.js';
+export declare const delegationStoreDefinition: StoreDefinition<DelegationStoreTables, DelegationStoreAPI>;

package/lib/definition.js

@@ -0,0 +1,7 @@
+import { createDelegationStore } from './api.js';
+import { getDelegationMigrations } from './migrations.js';
+export const delegationStoreDefinition = {
+    name: 'delegation',
+    migrations: getDelegationMigrations,
+    createAPI: createDelegationStore
+};

package/lib/index.d.ts

@@ -0,0 +1,9 @@
+import type { StoreProvider } from '@kubun/db';
+import type { DelegationStoreAPI } from './api.js';
+export type { DelegationStoreAPI } from './api.js';
+export { createDelegationStore } from './api.js';
+export { delegationStoreDefinition } from './definition.js';
+export { createRevocationBackend } from './revocation-backend.js';
+export declare const DELEGATION_STORE: "delegation";
+export declare function getDelegationStore(provider: StoreProvider): Promise<DelegationStoreAPI>;
+export type { DelegationStoreTables, DelegationToken, DelegationTokenTable, HeldRevocation, InsertDelegationToken, InsertRevokedCapability, RevokedCapability, RevokedCapabilityTable, } from './tables.js';

package/lib/index.js

@@ -0,0 +1,7 @@
+export { createDelegationStore } from './api.js';
+export { delegationStoreDefinition } from './definition.js';
+export { createRevocationBackend } from './revocation-backend.js';
+export const DELEGATION_STORE = 'delegation';
+export function getDelegationStore(provider) {
+    return provider.getStore(DELEGATION_STORE);
+}

package/lib/migrations.d.ts

@@ -0,0 +1,3 @@
+import type { MigrationContext } from '@kubun/db';
+import type { Migration } from 'kysely/migration';
+export declare function getDelegationMigrations(ctx: MigrationContext): Record<string, Migration>;

package/lib/migrations.js

@@ -0,0 +1,55 @@
+export function getDelegationMigrations(ctx) {
+    const t = ctx.types;
+    const now = ctx.functions.now;
+    const init = {
+        async up (db) {
+            // Delegation tokens
+            await db.schema.createTable('kubun_delegation_tokens').ifNotExists().addColumn('jti', t.text, (col)=>col.notNull()).addColumn('grantor', t.text, (col)=>col.notNull()).addColumn('audience', t.text, (col)=>col.notNull()).addColumn('token', t.text, (col)=>col.notNull()).addColumn('resource', t.text, (col)=>col.notNull()).addColumn('act', t.text, (col)=>col.notNull())// Capability expiry, a numeric unix-seconds claim mirrored from the
+            // token for indexed validity filtering. bigint, not int32: a 32-bit
+            // seconds column ceilings at 2038. The adapter's int8 parser reads it
+            // back as a JS number, so the row type stays `number`.
+            .addColumn('exp', t.bigint, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).addPrimaryKeyConstraint('pk_delegation_tokens', [
+                'grantor',
+                'audience',
+                'resource'
+            ]).execute();
+            await db.schema.createIndex('idx_delegation_tokens_grantor_audience').ifNotExists().on('kubun_delegation_tokens').columns([
+                'grantor',
+                'audience'
+            ]).execute();
+            // Auto-attach reads held tokens by audience on every mutation; index the
+            // audience (+ exp for the validity filter) so that hot path is not a scan.
+            await db.schema.createIndex('idx_delegation_tokens_audience_exp').ifNotExists().on('kubun_delegation_tokens').columns([
+                'audience',
+                'exp'
+            ]).execute();
+            // Revocation lookup keys on `jti`, which is not part of the composite PK
+            // `(grantor, audience, resource)`. Index it so cap-by-jti lookups during
+            // revocation are not a table scan.
+            await db.schema.createIndex('idx_delegation_tokens_jti').ifNotExists().on('kubun_delegation_tokens').column('jti').execute();
+            // Revoked capabilities. `verified_at` doubles as both the verified flag
+            // (NULL = pending cross-check vs the cap's iss) and a forensic
+            // timestamp. `cap_exp` is set when verification matches a known cap,
+            // and drives the GC sweep that prunes revocations once their cap has
+            // been expired long enough that no late-arriving mutation can still
+            // reference them.
+            await db.schema.createTable('kubun_revoked_capabilities').ifNotExists().addColumn('jti', t.text, (col)=>col.notNull().primaryKey()).addColumn('revoker_did', t.text, (col)=>col.notNull())// Unix-seconds timestamps, bigint for the same reason as `exp` above:
+            // int32 seconds ceilings at 2038. int8 parser reads back as a number.
+            .addColumn('revoked_iat', t.bigint, (col)=>col.notNull()).addColumn('revocation_token', t.text, (col)=>col.notNull()).addColumn('verified_at', t.bigint).addColumn('cap_exp', t.bigint).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).execute();
+            // GC sweep predicate filters on verified-and-cap-expired; the secondary
+            // index keeps that scan cheap at the cost of one extra index on the
+            // write path. The `jti` PK already serves the hot-path isRevoked check.
+            await db.schema.createIndex('idx_revoked_capabilities_verified_cap_exp').ifNotExists().on('kubun_revoked_capabilities').columns([
+                'verified_at',
+                'cap_exp'
+            ]).execute();
+        },
+        async down (db) {
+            await db.schema.dropTable('kubun_revoked_capabilities').ifExists().execute();
+            await db.schema.dropTable('kubun_delegation_tokens').ifExists().execute();
+        }
+    };
+    return {
+        '0-init': init
+    };
+}

package/lib/revocation-backend.d.ts

@@ -0,0 +1,3 @@
+import type { RevocationBackend } from '@kokuin/capability';
+import type { DelegationStoreAPI } from './api.js';
+export declare function createRevocationBackend(api: DelegationStoreAPI): RevocationBackend;

package/lib/revocation-backend.js

@@ -0,0 +1,14 @@
+export function createRevocationBackend(api) {
+    return {
+        async add (_record) {
+        // No-op. Revocations enter the delegation store through explicit local
+        // mint and broadcast/invite arrival paths, both of which carry context
+        // this adapter does not have (signed token, hlc). Enkaku's revocation
+        // checker only consumes `isRevoked`, so this stub satisfies the interface
+        // without offering a second, lossy write path.
+        },
+        async isRevoked (jti) {
+            return await api.isRevoked(jti);
+        }
+    };
+}

package/lib/tables.d.ts

@@ -0,0 +1,42 @@
+import type { CreatedAtColumn, UpdatedAtColumn } from '@kubun/db-adapter';
+import type { Insertable, Selectable } from 'kysely';
+export type DelegationTokenTable = {
+    jti: string;
+    grantor: string;
+    audience: string;
+    token: string;
+    resource: string;
+    act: string;
+    exp: number;
+    hlc: string;
+    created_at: CreatedAtColumn;
+    updated_at: UpdatedAtColumn;
+};
+export type DelegationToken = Selectable<DelegationTokenTable>;
+export type InsertDelegationToken = Insertable<DelegationTokenTable>;
+export type RevokedCapabilityTable = {
+    jti: string;
+    revoker_did: string;
+    revoked_iat: number;
+    revocation_token: string;
+    verified_at: number | null;
+    cap_exp: number | null;
+    hlc: string;
+    created_at: CreatedAtColumn;
+    updated_at: UpdatedAtColumn;
+};
+export type RevokedCapability = Selectable<RevokedCapabilityTable>;
+export type InsertRevokedCapability = Insertable<RevokedCapabilityTable>;
+export type HeldRevocation = {
+    jti: string;
+    grantor: string;
+    audience: string;
+    revoker_did: string;
+    revoked_iat: number;
+    verified_at: number;
+    cap_exp: number | null;
+};
+export type DelegationStoreTables = {
+    kubun_delegation_tokens: DelegationTokenTable;
+    kubun_revoked_capabilities: RevokedCapabilityTable;
+};

package/lib/tables.js

@@ -0,0 +1,2 @@
+// --- Aggregate DelegationStoreTables type ---
+export { };

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@kubun/store-delegation",
+  "version": "0.11.0",
+  "license": "see LICENSE.md",
+  "keywords": [],
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib/*",
+    "LICENSE.md"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@kokuin/capability": "^0.1.0",
+    "kysely": "^0.29.2",
+    "@kubun/db": "^0.11.0",
+    "@kubun/db-adapter": "^0.11.0",
+    "@kubun/logger": "^0.11.0"
+  },
+  "devDependencies": {
+    "@testcontainers/postgresql": "^12.0.4",
+    "@kubun/db-better-sqlite": "^0.11.0",
+    "@kubun/db-postgres": "^0.11.0"
+  },
+  "scripts": {
+    "build:clean": "del lib",
+    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
+    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
+    "test:types": "tsc --noEmit -p tsconfig.test.json",
+    "test:unit": "vitest run",
+    "test": "pnpm run test:types && pnpm run test:unit"
+  }
+}