@kubun/store-delegation 0.11.0 → 0.12.1

package/lib/api.d.ts

@@ -13,27 +13,73 @@ export type DelegationStoreAPI = {
         atTime: number;
     }): Promise<Array<DelegationToken>>;
     listIssuedTokens(grantor: string): Promise<Array<DelegationToken>>;
-    getDelegationTokenByJTI(jti: string): Promise<DelegationToken | null>;
+    getDelegationTokenByGrantorJTI(params: {
+        jti: string;
+        grantor: string;
+    }): Promise<DelegationToken | null>;
+    listDelegationTokensByJTI(jti: string): Promise<Array<DelegationToken>>;
     removeDelegationToken(params: {
         jti: string;
     }): Promise<boolean>;
     addRevocation(input: InsertRevokedCapability): Promise<boolean>;
-    getRevocation(jti: string): Promise<RevokedCapability | null>;
-    isRevoked(jti: string): Promise<boolean>;
+    getRevocationByIssuer(jti: string, issuer: string): Promise<RevokedCapability | null>;
+    listRevocations(jti: string): Promise<Array<RevokedCapability>>;
+    /**
+     * Diagnostic only — **not** an authorization read. The `verified_at IS NOT NULL`
+     * predicate is the inverse of the enforcement rule: a co-member holds no copy
+     * of the capability, so its genuine revocation stays pending forever and this
+     * answers `false` for it. Authorization goes through
+     * `createDelegationRevocationChecker`, which is what closes that fail-open.
+     */
+    isRevokedBy(jti: string, issuer: string): Promise<boolean>;
     getHeldRevocations(params: {
         audience: string;
     }): Promise<Array<HeldRevocation>>;
-    markRevocationVerified(jti: string, params: {
+    markRevocationVerified(jti: string, issuer: string, params: {
         cap_exp: number;
         verified_at?: number;
     }): Promise<boolean>;
-    getPendingRevocationByJTI(jti: string): Promise<RevokedCapability | null>;
-    deletePendingRevocation(jti: string): Promise<boolean>;
+    getPendingRevocationByIssuer(jti: string, issuer: string): Promise<RevokedCapability | null>;
+    deletePendingRevocationsFromOtherIssuers(jti: string, issuer: string): Promise<number>;
     purgeExpiredRevocations(params: {
         graceSeconds: number;
     }): Promise<number>;
     purgeDeadPendingRevocations(params: {
-        maxAgeSeconds: number;
+        graceSeconds: number;
     }): Promise<number>;
 };
+/**
+ * Longest lifetime (`exp - iat`, seconds) a `document/write` capability may
+ * carry — 30 days.
+ *
+ * This is a retention bound, not a policy preference. A co-member holds no copy
+ * of the capability a revocation names, so the pending-revocation sweep can only
+ * bound the row's useful life from the revocation itself:
+ * `cap.exp ≤ cap.iat + MAX_CAP_TTL_SECONDS ≤ revoked_iat + MAX_CAP_TTL_SECONDS`.
+ * That inequality holds only while every *accepted* capability respects the
+ * limit, so it is enforced on receive as well as on mint — a capability minted
+ * outside kubun's resolver would otherwise outlive its own revocation's
+ * retention and start being honored again.
+ */
+export declare const MAX_CAP_TTL_SECONDS = 2592000;
+/**
+ * Verified revocations remain queryable this long past the capability's
+ * expiry — enough for audit lookbacks before the row is pruned. Pending rows
+ * reuse it as the margin past `revoked_iat + MAX_CAP_TTL_SECONDS`, so both
+ * kinds age out on the same policy.
+ */
+export declare const REVOCATION_GC_VERIFIED_GRACE_SECONDS: number;
+/**
+ * How far ahead of the local clock a revocation's `iat` may sit before it is
+ * floored on write — one hour.
+ *
+ * A pending row's retention is computed from `revoked_iat`, and `revoked_iat`
+ * comes off a broadcast any co-member can sign, so an unbounded stamp buys an
+ * immortal row. Floored rather than rejected: dropping a genuine revocation is
+ * the failure this store exists to prevent, and a grantor with real clock skew
+ * must not lose its record. `KubunEngine`'s `maxDriftMS` (`engine.ts:208`,
+ * default `3_600_000`) bounds the same hazard on incoming mutations with the
+ * same tolerance, but it rejects — the two are not interchangeable.
+ */
+export declare const MAX_REVOCATION_FUTURE_DRIFT_SECONDS = 3600;
 export declare function createDelegationStore(db: Kysely<DelegationStoreTables>, adapter: Adapter, logger?: Logger): DelegationStoreAPI;

package/lib/api.js

@@ -1,16 +1,50 @@
+import { normalizeDID } from '@kokuin/token';
 import { getKubunLogger } from '@kubun/logger';
 // --- Revocation GC defaults ---
+/**
+ * Longest lifetime (`exp - iat`, seconds) a `document/write` capability may
+ * carry — 30 days.
+ *
+ * This is a retention bound, not a policy preference. A co-member holds no copy
+ * of the capability a revocation names, so the pending-revocation sweep can only
+ * bound the row's useful life from the revocation itself:
+ * `cap.exp ≤ cap.iat + MAX_CAP_TTL_SECONDS ≤ revoked_iat + MAX_CAP_TTL_SECONDS`.
+ * That inequality holds only while every *accepted* capability respects the
+ * limit, so it is enforced on receive as well as on mint — a capability minted
+ * outside kubun's resolver would otherwise outlive its own revocation's
+ * retention and start being honored again.
+ */ export const MAX_CAP_TTL_SECONDS = 2_592_000;
 // Probability that each delegation-token insert triggers a revocation sweep.
 // 1% keeps the sweep amortized cost negligible; over a busy stream it still
 // runs often enough to bound table growth.
 const REVOCATION_GC_SAMPLE_RATE = 0.01;
-// Verified revocations remain queryable this long past the capability's
-// expiry — enough for audit lookbacks before the row is pruned.
-const REVOCATION_GC_VERIFIED_GRACE_SECONDS = 86_400 * 30;
-// Pending revocations that never receive a matching capability are dropped
-// after this age — past this window the broadcast is treated as dead.
-const REVOCATION_GC_PENDING_MAX_AGE_SECONDS = 86_400 * 7;
+/**
+ * Verified revocations remain queryable this long past the capability's
+ * expiry — enough for audit lookbacks before the row is pruned. Pending rows
+ * reuse it as the margin past `revoked_iat + MAX_CAP_TTL_SECONDS`, so both
+ * kinds age out on the same policy.
+ */ export const REVOCATION_GC_VERIFIED_GRACE_SECONDS = 86_400 * 30;
+/**
+ * How far ahead of the local clock a revocation's `iat` may sit before it is
+ * floored on write — one hour.
+ *
+ * A pending row's retention is computed from `revoked_iat`, and `revoked_iat`
+ * comes off a broadcast any co-member can sign, so an unbounded stamp buys an
+ * immortal row. Floored rather than rejected: dropping a genuine revocation is
+ * the failure this store exists to prevent, and a grantor with real clock skew
+ * must not lose its record. `KubunEngine`'s `maxDriftMS` (`engine.ts:208`,
+ * default `3_600_000`) bounds the same hazard on incoming mutations with the
+ * same tolerance, but it rejects — the two are not interchangeable.
+ */ export const MAX_REVOCATION_FUTURE_DRIFT_SECONDS = 3_600;
 // --- Factory function ---
+// One identity reaches this store in two spellings: a `did:peer:4` signer
+// embeds its long form as the `iss` of its first token to a given audience and
+// its short form thereafter, while `identity.id` and `sub` are always short. So
+// the DID a capability presents at check time and the DID its revocation was
+// filed under are genuinely different strings for the same peer, with no
+// attacker involved. Every DID crossing this boundary — written or compared —
+// is folded through `normalizeDID`, because a raw equality here silently
+// returns "not revoked".
 export function createDelegationStore(db, adapter, logger = getKubunLogger('store-delegation')) {
     const api = {
         // --- Delegation token operations ---
@@ -26,17 +60,19 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
         // for emission gating, and the LWW upsert itself remains correct under the
         // SQL `>` arbiter regardless.
         async addDelegationToken (token) {
+            const grantor = normalizeDID(token.grantor);
+            const audience = normalizeDID(token.audience);
             const existing = await db.selectFrom('kubun_delegation_tokens').select([
                 'jti',
                 'token',
                 'act',
                 'exp',
                 'hlc'
-            ]).where('grantor', '=', token.grantor).where('audience', '=', token.audience).where('resource', '=', token.resource).executeTakeFirst();
+            ]).where('grantor', '=', grantor).where('audience', '=', audience).where('resource', '=', token.resource).executeTakeFirst();
             await db.insertInto('kubun_delegation_tokens').values({
                 jti: token.jti,
-                grantor: token.grantor,
-                audience: token.audience,
+                grantor,
+                audience,
                 token: token.token,
                 resource: token.resource,
                 act: token.act,
@@ -79,7 +115,7 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
                         graceSeconds: REVOCATION_GC_VERIFIED_GRACE_SECONDS
                     });
                     await api.purgeDeadPendingRevocations({
-                        maxAgeSeconds: REVOCATION_GC_PENDING_MAX_AGE_SECONDS
+                        graceSeconds: REVOCATION_GC_VERIFIED_GRACE_SECONDS
                     });
                 } catch (error) {
                     logger.warn('revocation GC sweep failed during addDelegationToken: {error}', {
@@ -90,10 +126,18 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
             return changed;
         },
         async getDelegationTokens (params) {
-            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', params.grantor).where('audience', '=', params.audience).execute();
+            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', normalizeDID(params.grantor)).where('audience', '=', normalizeDID(params.audience)).execute();
         },
+        // The join carries the author predicate for two reasons. It is an
+        // authorization filter — only the grantor's own claim may withhold a token
+        // from the audience holding it. It is also what keeps the result one row
+        // per token: `(jti, revoker_did)` is the revocation key, so pinning
+        // `revoker_did` to the token's grantor makes the fan-out at most 1. A
+        // repeated token would not merely be redundant — `checkCapability` reads
+        // the list as a delegation chain, and a duplicate breaks a multi-hop chain
+        // outright.
         async getHeldTokens (params) {
-            return await db.selectFrom('kubun_delegation_tokens').leftJoin('kubun_revoked_capabilities', 'kubun_revoked_capabilities.jti', 'kubun_delegation_tokens.jti').selectAll('kubun_delegation_tokens').where('audience', '=', params.audience).where('exp', '>', params.atTime)// Pending revocations (verified_at IS NULL) are not binding until the
+            return await db.selectFrom('kubun_delegation_tokens').leftJoin('kubun_revoked_capabilities', (join)=>join.onRef('kubun_revoked_capabilities.jti', '=', 'kubun_delegation_tokens.jti').onRef('kubun_revoked_capabilities.revoker_did', '=', 'kubun_delegation_tokens.grantor')).selectAll('kubun_delegation_tokens').where('audience', '=', normalizeDID(params.audience)).where('exp', '>', params.atTime)// Pending revocations (verified_at IS NULL) are not binding until the
             // cap-arrival cross-check verifies them, so they don't filter tokens.
             .where((eb)=>eb.or([
                     eb('kubun_revoked_capabilities.jti', 'is', null),
@@ -101,11 +145,28 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
                 ])).execute();
         },
         async listIssuedTokens (grantor) {
-            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', grantor).execute();
+            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', normalizeDID(grantor)).execute();
         },
-        async getDelegationTokenByJTI (jti) {
-            const row = await db.selectFrom('kubun_delegation_tokens').selectAll().where('jti', '=', jti).executeTakeFirst();
-            return row ?? null;
+        // `jti` is picked by whoever minted the capability and the grant travels to
+        // the whole group, so any co-member can mint one reusing a `jti` it saw. It
+        // names a row only inside a single grantor's namespace, and even there it
+        // is not a key — the primary key is `(grantor, audience, resource)`. A
+        // grantor that reused one `jti` across two of its own grants would leave
+        // this read with no representable answer, so it throws rather than pick.
+        async getDelegationTokenByGrantorJTI (params) {
+            const grantor = normalizeDID(params.grantor);
+            const rows = await db.selectFrom('kubun_delegation_tokens').selectAll().where('jti', '=', params.jti).where('grantor', '=', grantor).limit(2).execute();
+            if (rows.length > 1) {
+                throw new Error(`Ambiguous delegation token: grantor ${grantor} holds more than one row for jti ${params.jti}`);
+            }
+            return rows[0] ?? null;
+        },
+        // Every grantor's row for one `jti`. For diagnostics and for absence
+        // assertions that must hold across grantors — an authorization decision
+        // needs `getDelegationTokenByGrantorJTI`, since any row here may be a
+        // co-member's.
+        async listDelegationTokensByJTI (jti) {
+            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('jti', '=', jti).orderBy('grantor').execute();
         },
         // Hard-delete a held token by `jti`. Used to drop a delegated write
         // capability the server no longer needs — e.g. when a viewer disconnects a
@@ -122,25 +183,47 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
         // per-millisecond counter stays within the pad width. The pre-read drives
         // the boolean change signal that emission gates consume; the upsert is
         // not wrapped in a transaction because callers already run inside one.
+        //
+        // Both the pre-read and the conflict target are scoped to `(jti,
+        // revoker_did)`: several revokers may name the same `jti`, and each may
+        // only arbitrate against its own row. A `jti`-only match here would let one
+        // author's HLC decide another author's outcome.
         async addRevocation (input) {
+            const revokerDID = normalizeDID(input.revoker_did);
+            // `revoked_iat` is a claim from a signed broadcast, and on a pending row
+            // no issuer has been matched yet — so any co-member can name a `jti` with
+            // a far-future stamp and, since the pending sweep is keyed off this
+            // column, keep the row past every sweep. Floored, not rejected: the
+            // record still binds, only its retention is bounded.
+            const maxIat = Math.floor(Date.now() / 1000) + MAX_REVOCATION_FUTURE_DRIFT_SECONDS;
+            const revokedIat = Math.min(input.revoked_iat, maxIat);
+            if (revokedIat !== input.revoked_iat) {
+                logger.warn('revocation {jti} from {revoker} carries a future iat {iat}, floored to {floored}', {
+                    jti: input.jti,
+                    revoker: revokerDID,
+                    iat: input.revoked_iat,
+                    floored: revokedIat
+                });
+            }
             const existing = await db.selectFrom('kubun_revoked_capabilities').select([
-                'revoker_did',
                 'revoked_iat',
                 'revocation_token',
                 'verified_at',
                 'cap_exp',
                 'hlc'
-            ]).where('jti', '=', input.jti).executeTakeFirst();
+            ]).where('jti', '=', input.jti).where('revoker_did', '=', revokerDID).executeTakeFirst();
             await db.insertInto('kubun_revoked_capabilities').values({
                 jti: input.jti,
-                revoker_did: input.revoker_did,
-                revoked_iat: input.revoked_iat,
+                revoker_did: revokerDID,
+                revoked_iat: revokedIat,
                 revocation_token: input.revocation_token,
                 verified_at: input.verified_at ?? null,
                 cap_exp: input.cap_exp ?? null,
                 hlc: input.hlc
-            }).onConflict((oc)=>oc.column('jti').doUpdateSet((eb)=>({
-                        revoker_did: eb.ref('excluded.revoker_did'),
+            }).onConflict((oc)=>oc.columns([
+                    'jti',
+                    'revoker_did'
+                ]).doUpdateSet((eb)=>({
                         revoked_iat: eb.ref('excluded.revoked_iat'),
                         revocation_token: eb.ref('excluded.revocation_token'),
                         verified_at: eb.ref('excluded.verified_at'),
@@ -156,14 +239,23 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
             }
             const incomingVerifiedAt = input.verified_at ?? null;
             const incomingCapExp = input.cap_exp ?? null;
-            return existing.revoker_did !== input.revoker_did || existing.revoked_iat !== input.revoked_iat || existing.revocation_token !== input.revocation_token || existing.verified_at !== incomingVerifiedAt || existing.cap_exp !== incomingCapExp;
+            return existing.revoked_iat !== revokedIat || existing.revocation_token !== input.revocation_token || existing.verified_at !== incomingVerifiedAt || existing.cap_exp !== incomingCapExp;
         },
-        async getRevocation (jti) {
-            const row = await db.selectFrom('kubun_revoked_capabilities').selectAll().where('jti', '=', jti).executeTakeFirst();
+        // `jti` alone does not identify a row: several revokers may name the same
+        // capability and only the one signed by its issuer binds. Every read names
+        // the author it is asking about.
+        async getRevocationByIssuer (jti, issuer) {
+            const row = await db.selectFrom('kubun_revoked_capabilities').selectAll().where('jti', '=', jti).where('revoker_did', '=', normalizeDID(issuer)).executeTakeFirst();
             return row ?? null;
         },
-        async isRevoked (jti) {
-            const row = await db.selectFrom('kubun_revoked_capabilities').select('jti').where('jti', '=', jti).where('verified_at', 'is not', null).limit(1).executeTakeFirst();
+        // Every author's claim about one `jti`. For diagnostics and for absence
+        // assertions that must hold across all authors — an enforcement decision
+        // needs `getRevocationByIssuer`, since any row here may be a co-member's.
+        async listRevocations (jti) {
+            return await db.selectFrom('kubun_revoked_capabilities').selectAll().where('jti', '=', jti).orderBy('revoker_did').execute();
+        },
+        async isRevokedBy (jti, issuer) {
+            const row = await db.selectFrom('kubun_revoked_capabilities').select('jti').where('jti', '=', jti).where('revoker_did', '=', normalizeDID(issuer)).where('verified_at', 'is not', null).executeTakeFirst();
             return row != null;
         },
         // Explicit column list (no `selectAll`) because `kubun_revoked_capabilities`
@@ -171,9 +263,11 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
         // `created_at`, `updated_at`); `selectAll` would produce an ambiguous
         // projection. The INNER JOIN drops verified revocations whose cap row is not
         // held locally, which is exactly the desired filter for an audience-scoped
-        // query.
+        // query. It also joins on `revoker_did = grantor`: a co-member's row for the
+        // same `jti` revokes nothing, so surfacing it here would report a held
+        // capability as revoked on someone else's say-so.
         async getHeldRevocations (params) {
-            const rows = await db.selectFrom('kubun_revoked_capabilities').innerJoin('kubun_delegation_tokens', 'kubun_delegation_tokens.jti', 'kubun_revoked_capabilities.jti').select([
+            const rows = await db.selectFrom('kubun_revoked_capabilities').innerJoin('kubun_delegation_tokens', (join)=>join.onRef('kubun_delegation_tokens.jti', '=', 'kubun_revoked_capabilities.jti').onRef('kubun_delegation_tokens.grantor', '=', 'kubun_revoked_capabilities.revoker_did')).select([
                 'kubun_revoked_capabilities.jti as jti',
                 'kubun_delegation_tokens.grantor as grantor',
                 'kubun_delegation_tokens.audience as audience',
@@ -181,7 +275,7 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
                 'kubun_revoked_capabilities.revoked_iat as revoked_iat',
                 'kubun_revoked_capabilities.verified_at as verified_at',
                 'kubun_revoked_capabilities.cap_exp as cap_exp'
-            ]).where('kubun_revoked_capabilities.verified_at', 'is not', null).where('kubun_delegation_tokens.audience', '=', params.audience).execute();
+            ]).where('kubun_revoked_capabilities.verified_at', 'is not', null).where('kubun_delegation_tokens.audience', '=', normalizeDID(params.audience)).execute();
             return rows.map((row)=>({
                     jti: row.jti,
                     grantor: row.grantor,
@@ -193,22 +287,30 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
                     cap_exp: row.cap_exp
                 }));
         },
-        async markRevocationVerified (jti, params) {
+        // Promotion is an authorization decision about one author's claim: the
+        // arriving capability proves only that its own issuer's record is genuine.
+        // Scoped to that author, so a co-member's row for the same `jti` is not
+        // promoted on the strength of someone else's capability.
+        async markRevocationVerified (jti, issuer, params) {
             const verifiedAt = params.verified_at ?? Math.floor(Date.now() / 1000);
             const result = await db.updateTable('kubun_revoked_capabilities').set({
                 verified_at: verifiedAt,
                 cap_exp: params.cap_exp,
                 updated_at: adapter.encodeTimestamp(new Date())
-            }).where('jti', '=', jti).where('verified_at', 'is', null).executeTakeFirst();
+            }).where('jti', '=', jti).where('revoker_did', '=', normalizeDID(issuer)).where('verified_at', 'is', null).executeTakeFirst();
             return (result.numUpdatedRows ?? 0n) > 0n;
         },
-        async getPendingRevocationByJTI (jti) {
-            const row = await db.selectFrom('kubun_revoked_capabilities').selectAll().where('jti', '=', jti).where('verified_at', 'is', null).executeTakeFirst();
+        async getPendingRevocationByIssuer (jti, issuer) {
+            const row = await db.selectFrom('kubun_revoked_capabilities').selectAll().where('jti', '=', jti).where('revoker_did', '=', normalizeDID(issuer)).where('verified_at', 'is', null).executeTakeFirst();
             return row ?? null;
         },
-        async deletePendingRevocation (jti) {
-            const result = await db.deleteFrom('kubun_revoked_capabilities').where('jti', '=', jti).where('verified_at', 'is', null).executeTakeFirst();
-            return (result.numDeletedRows ?? 0n) > 0n;
+        // Drop the pending rows a capability from `issuer` proves nothing about.
+        // The inverse scoping of `markRevocationVerified`: what that promotes this
+        // discards, so the two together settle every pending row for the `jti`
+        // without either one answering for an author it did not name.
+        async deletePendingRevocationsFromOtherIssuers (jti, issuer) {
+            const result = await db.deleteFrom('kubun_revoked_capabilities').where('jti', '=', jti).where('revoker_did', '!=', normalizeDID(issuer)).where('verified_at', 'is', null).executeTakeFirst();
+            return Number(result.numDeletedRows ?? 0n);
         },
         // `cap_exp` is a plain integer column of epoch seconds (no adapter
         // coercion on either side); the predicate is rewritten as
@@ -220,13 +322,22 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
             const result = await db.deleteFrom('kubun_revoked_capabilities').where('verified_at', 'is not', null).where('cap_exp', 'is not', null).where('cap_exp', '<', cutoff).executeTakeFirst();
             return Number(result.numDeletedRows ?? 0n);
         },
-        // `created_at` is adapter-encoded (integer seconds on SQLite,
-        // timestamptz on Postgres), so the cutoff is produced via
-        // `adapter.encodeTimestamp` to match the stored representation on both
-        // back-ends.
+        // A pending row names a capability this device does not hold, so `cap_exp`
+        // is unknown and the row's useful life can only be bounded from the
+        // revocation itself: the capability was live when it was revoked, so
+        // `cap.exp ≤ revoked_iat + MAX_CAP_TTL_SECONDS`. Keyed off `revoked_iat`
+        // rather than `created_at` because a row dropped while its capability is
+        // still honored un-revokes it.
+        //
+        // `revoked_iat` is a bigint of unix seconds — not an adapter-encoded
+        // timestamp like `created_at`, which is integer seconds on SQLite but
+        // timestamptz on Postgres. Building this cutoff through
+        // `adapter.encodeTimestamp` would compare a Postgres ISO string against a
+        // bigint. Written as `revoked_iat < now - ttl - grace` so it stays plain
+        // integer arithmetic on both back-ends.
         async purgeDeadPendingRevocations (params) {
-            const threshold = adapter.encodeTimestamp(new Date(Date.now() - params.maxAgeSeconds * 1000));
-            const result = await db.deleteFrom('kubun_revoked_capabilities').where('verified_at', 'is', null).where('created_at', '<', threshold).executeTakeFirst();
+            const cutoff = Math.floor(Date.now() / 1000) - MAX_CAP_TTL_SECONDS - Math.floor(params.graceSeconds);
+            const result = await db.deleteFrom('kubun_revoked_capabilities').where('verified_at', 'is', null).where('revoked_iat', '<', cutoff).executeTakeFirst();
             return Number(result.numDeletedRows ?? 0n);
         }
     };

package/lib/index.d.ts

@@ -1,9 +1,9 @@
 import type { StoreProvider } from '@kubun/db';
 import type { DelegationStoreAPI } from './api.js';
 export type { DelegationStoreAPI } from './api.js';
-export { createDelegationStore } from './api.js';
+export { createDelegationStore, MAX_CAP_TTL_SECONDS, MAX_REVOCATION_FUTURE_DRIFT_SECONDS, REVOCATION_GC_VERIFIED_GRACE_SECONDS, } from './api.js';
 export { delegationStoreDefinition } from './definition.js';
-export { createRevocationBackend } from './revocation-backend.js';
+export { createDelegationRevocationChecker, type RevocationClaims, } from './revocation-checker.js';
 export declare const DELEGATION_STORE: "delegation";
 export declare function getDelegationStore(provider: StoreProvider): Promise<DelegationStoreAPI>;
 export type { DelegationStoreTables, DelegationToken, DelegationTokenTable, HeldRevocation, InsertDelegationToken, InsertRevokedCapability, RevokedCapability, RevokedCapabilityTable, } from './tables.js';

package/lib/index.js

@@ -1,6 +1,6 @@
-export { createDelegationStore } from './api.js';
+export { createDelegationStore, MAX_CAP_TTL_SECONDS, MAX_REVOCATION_FUTURE_DRIFT_SECONDS, REVOCATION_GC_VERIFIED_GRACE_SECONDS } from './api.js';
 export { delegationStoreDefinition } from './definition.js';
-export { createRevocationBackend } from './revocation-backend.js';
+export { createDelegationRevocationChecker } from './revocation-checker.js';
 export const DELEGATION_STORE = 'delegation';
 export function getDelegationStore(provider) {
     return provider.getStore(DELEGATION_STORE);

package/lib/migrations.js

@@ -33,12 +33,22 @@ export function getDelegationMigrations(ctx) {
             // and drives the GC sweep that prunes revocations once their cap has
             // been expired long enough that no late-arriving mutation can still
             // reference them.
-            await db.schema.createTable('kubun_revoked_capabilities').ifNotExists().addColumn('jti', t.text, (col)=>col.notNull().primaryKey()).addColumn('revoker_did', t.text, (col)=>col.notNull())// Unix-seconds timestamps, bigint for the same reason as `exp` above:
+            //
+            // Keyed by `(jti, revoker_did)`, not `jti` alone: one row per `jti`
+            // cannot represent two revokers naming the same capability, so the LWW
+            // upsert would let any group member's higher-HLC broadcast overwrite the
+            // grantor's row. Each author owns its own row and can only displace
+            // itself. Every read of this table names an issuer for the same reason.
+            await db.schema.createTable('kubun_revoked_capabilities').ifNotExists().addColumn('jti', t.text, (col)=>col.notNull()).addColumn('revoker_did', t.text, (col)=>col.notNull())// Unix-seconds timestamps, bigint for the same reason as `exp` above:
             // int32 seconds ceilings at 2038. int8 parser reads back as a number.
-            .addColumn('revoked_iat', t.bigint, (col)=>col.notNull()).addColumn('revocation_token', t.text, (col)=>col.notNull()).addColumn('verified_at', t.bigint).addColumn('cap_exp', t.bigint).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).execute();
+            .addColumn('revoked_iat', t.bigint, (col)=>col.notNull()).addColumn('revocation_token', t.text, (col)=>col.notNull()).addColumn('verified_at', t.bigint).addColumn('cap_exp', t.bigint).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).addPrimaryKeyConstraint('pk_revoked_capabilities', [
+                'jti',
+                'revoker_did'
+            ]).execute();
             // GC sweep predicate filters on verified-and-cap-expired; the secondary
             // index keeps that scan cheap at the cost of one extra index on the
-            // write path. The `jti` PK already serves the hot-path isRevoked check.
+            // write path. `jti` leads the primary key, so the per-issuer lookups on
+            // the hot path use it as a prefix and need no index of their own.
             await db.schema.createIndex('idx_revoked_capabilities_verified_cap_exp').ifNotExists().on('kubun_revoked_capabilities').columns([
                 'verified_at',
                 'cap_exp'

package/lib/revocation-checker.d.ts

@@ -0,0 +1,21 @@
+import { type VerifyTokenHook } from '@kokuin/capability';
+import type { DelegationStoreAPI } from './api.js';
+export type RevocationClaims = {
+    jti: string;
+    iss: string;
+    rev: true;
+    iat: number;
+};
+/**
+ * Revocation hook backed by the delegation store.
+ *
+ * The store holds one row per (capability, revoker): a `jti` alone names
+ * several claims, of which only the one signed by the capability's own issuer
+ * binds. The lookup is scoped to that issuer so a co-member's claim about the
+ * same `jti` can neither answer in its place nor hide it.
+ *
+ * kokuin's checker still re-verifies the record's signature and re-compares the
+ * issuer, so a row this device could not cross-check against a locally held
+ * grant is safe to hand over.
+ */
+export declare function createDelegationRevocationChecker(api: DelegationStoreAPI): VerifyTokenHook;

package/lib/revocation-checker.js

@@ -0,0 +1,43 @@
+import { createRevocationChecker } from '@kokuin/capability';
+import { verifyToken } from '@kokuin/token';
+/**
+ * Revocation hook backed by the delegation store.
+ *
+ * The store holds one row per (capability, revoker): a `jti` alone names
+ * several claims, of which only the one signed by the capability's own issuer
+ * binds. The lookup is scoped to that issuer so a co-member's claim about the
+ * same `jti` can neither answer in its place nor hide it.
+ *
+ * kokuin's checker still re-verifies the record's signature and re-compares the
+ * issuer, so a row this device could not cross-check against a locally held
+ * grant is safe to hand over.
+ */ export function createDelegationRevocationChecker(api) {
+    // The backend is per-token: its `get` closes over the issuer of the
+    // capability being checked, which is only known once the hook is called.
+    return async (token, raw)=>{
+        const issuer = token.payload.iss;
+        const backend = {
+            async add () {
+            // No-op. Revocations enter the delegation store through explicit local
+            // mint and broadcast/invite arrival paths, both of which carry context
+            // this adapter does not have (hlc, capability cross-check). The checker
+            // only consumes `get`, so this stub satisfies the interface without
+            // offering a second, lossy write path.
+            },
+            async get (jti) {
+                const row = await api.getRevocationByIssuer(jti, issuer);
+                if (row == null) {
+                    return undefined;
+                }
+                try {
+                    return await verifyToken(row.revocation_token);
+                } catch  {
+                    // A stored record that no longer verifies revokes nothing. The checker
+                    // re-verifies too, but failing here keeps a corrupt row from surfacing.
+                    return undefined;
+                }
+            }
+        };
+        await createRevocationChecker(backend)(token, raw);
+    };
+}

package/package.json

@@ -1,39 +1,43 @@
 {
   "name": "@kubun/store-delegation",
-  "version": "0.11.0",
-  "license": "see LICENSE.md",
+  "version": "0.12.1",
   "keywords": [],
+  "license": "see LICENSE.md",
+  "sideEffects": false,
   "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
   "exports": {
     ".": "./lib/index.js"
   },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
   "files": [
     "lib/*",
     "LICENSE.md"
   ],
-  "sideEffects": false,
   "dependencies": {
-    "@kokuin/capability": "^0.1.0",
-    "kysely": "^0.29.2",
-    "@kubun/db": "^0.11.0",
-    "@kubun/db-adapter": "^0.11.0",
-    "@kubun/logger": "^0.11.0"
+    "@kokuin/capability": "^0.2.2",
+    "@kokuin/token": "^0.4.0",
+    "kysely": "^0.29.5",
+    "@kubun/db": "^0.12.1",
+    "@kubun/logger": "^0.12.0",
+    "@kubun/db-adapter": "^0.13.0"
   },
   "devDependencies": {
-    "@testcontainers/postgresql": "^12.0.4",
-    "@kubun/db-better-sqlite": "^0.11.0",
-    "@kubun/db-postgres": "^0.11.0"
+    "@testcontainers/postgresql": "^12.1.0",
+    "@kubun/db-postgres": "^0.12.1",
+    "@kubun/db-better-sqlite": "^0.12.1"
+  },
+  "publishConfig": {
+    "access": "public"
   },
   "scripts": {
+    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "build:clean": "del lib",
     "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
     "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
     "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
-    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
+    "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit -p tsconfig.test.json",
-    "test:unit": "vitest run",
-    "test": "pnpm run test:types && pnpm run test:unit"
+    "test:unit": "vitest run"
   }
 }

package/lib/revocation-backend.d.ts

@@ -1,3 +0,0 @@
-import type { RevocationBackend } from '@kokuin/capability';
-import type { DelegationStoreAPI } from './api.js';
-export declare function createRevocationBackend(api: DelegationStoreAPI): RevocationBackend;

package/lib/revocation-backend.js

@@ -1,14 +0,0 @@
-export function createRevocationBackend(api) {
-    return {
-        async add (_record) {
-        // No-op. Revocations enter the delegation store through explicit local
-        // mint and broadcast/invite arrival paths, both of which carry context
-        // this adapter does not have (signed token, hlc). Enkaku's revocation
-        // checker only consumes `isRevoked`, so this stub satisfies the interface
-        // without offering a second, lossy write path.
-        },
-        async isRevoked (jti) {
-            return await api.isRevoked(jti);
-        }
-    };
-}