@kubun/store-delegation 0.17.0 → 0.18.0

package/lib/api.d.ts

@@ -13,6 +13,16 @@ export type DelegationStoreAPI = {
         atTime: number;
     }): Promise<Array<DelegationToken>>;
     listIssuedTokens(grantor: string): Promise<Array<DelegationToken>>;
+    /**
+     * Superseded grants for one key that are still unexpired at `atTime` and carry no
+     * revocation from their grantor: replaced capabilities that remain valid if presented.
+     */
+    listUnrevokedSupersededTokens(params: {
+        grantor: string;
+        audience: string;
+        resource: string;
+        atTime: number;
+    }): Promise<Array<DelegationToken>>;
     getDelegationTokenByGrantorJTI(params: {
         jti: string;
         grantor: string;

package/lib/api.js

@@ -46,63 +46,89 @@ const REVOCATION_GC_SAMPLE_RATE = 0.01;
 // is folded through `normalizeDID`, because a raw equality here silently
 // returns "not revoked".
 export function createDelegationStore(db, adapter, logger = getKubunLogger('store-delegation')) {
+    // Shared transaction locks do not serialise concurrent calls on their own connection.
+    let ambientWriteChain = Promise.resolve();
     const api = {
         // --- Delegation token operations ---
-        // LWW arbitration on the serialized HLC: the SQL string `>` compare is a
-        // stand-in for `HLC.compare`, valid only while the per-millisecond counter
-        // stays within the pad width; that ceiling is unreachable and the SQL
-        // compare avoids a read-modify-write race. The pre-read drives the returned
-        // "changed" flag (used by emission gates to suppress `delegationTokenAdded`
-        // on idempotent re-stores). It is not wrapped in a transaction because
-        // callers already run inside one — Kysely rejects nested transactions on
-        // shared connections. The narrow TOCTOU window between read and upsert can
-        // let a concurrent identical re-store race and emit twice; that is benign
-        // for emission gating, and the LWW upsert itself remains correct under the
-        // SQL `>` arbiter regardless.
+        // HLC text order matches HLC.compare while its counter stays within the pad width.
+        // Lock before reading so arbitration and the history-preserving replacement are atomic.
         async addDelegationToken (token) {
             const grantor = normalizeDID(token.grantor);
             const audience = normalizeDID(token.audience);
-            const existing = await db.selectFrom('kubun_delegation_tokens').select([
-                'jti',
-                'token',
-                'act',
-                'exp',
-                'hlc'
-            ]).where('grantor', '=', grantor).where('audience', '=', audience).where('resource', '=', token.resource).executeTakeFirst();
-            await db.insertInto('kubun_delegation_tokens').values({
-                jti: token.jti,
+            const key = {
                 grantor,
                 audience,
-                token: token.token,
-                resource: token.resource,
-                act: token.act,
-                exp: token.exp,
-                hlc: token.hlc
-            }).onConflict((oc)=>oc.columns([
-                    'grantor',
-                    'audience',
-                    'resource'
-                ]).doUpdateSet((eb)=>({
-                        jti: eb.ref('excluded.jti'),
-                        token: eb.ref('excluded.token'),
-                        act: eb.ref('excluded.act'),
-                        exp: eb.ref('excluded.exp'),
-                        hlc: eb.ref('excluded.hlc'),
+                resource: token.resource
+            };
+            const replace = async (tx)=>{
+                // An upsert locks present and absent keys on Postgres, and reserves SQLite's writer.
+                await tx.insertInto('kubun_delegation_token_keys').values(key).onConflict((oc)=>oc.columns([
+                        'grantor',
+                        'audience',
+                        'resource'
+                    ]).doUpdateSet({
+                        resource: token.resource
+                    })).execute();
+                const existing = await tx.selectFrom('kubun_delegation_tokens').select([
+                    'jti',
+                    'token',
+                    'act',
+                    'exp',
+                    'hlc'
+                ]).where('grantor', '=', grantor).where('audience', '=', audience).where('resource', '=', token.resource).where('superseded', '=', 0).executeTakeFirst();
+                if (existing != null && token.hlc <= existing.hlc) {
+                    // A losing JTI may already have been delivered and must remain revocable.
+                    await tx.insertInto('kubun_delegation_tokens').values({
+                        ...key,
+                        jti: token.jti,
+                        token: token.token,
+                        act: token.act,
+                        exp: token.exp,
+                        hlc: token.hlc,
+                        superseded: 1
+                    }).onConflict((oc)=>oc.columns([
+                            'grantor',
+                            'audience',
+                            'resource',
+                            'jti'
+                        ]).doNothing()).execute();
+                    return false;
+                }
+                if (existing != null && existing.jti !== token.jti) {
+                    await tx.updateTable('kubun_delegation_tokens').set({
+                        superseded: 1,
                         updated_at: adapter.encodeTimestamp(new Date())
-                    })).where((eb)=>eb('excluded.hlc', '>', eb.ref('kubun_delegation_tokens.hlc')))).execute();
-            let changed;
-            if (existing == null) {
-                // New PK — row was inserted.
-                changed = true;
-            } else if (token.hlc <= existing.hlc) {
-                // LWW lost (older or equal HLC) — stored row unchanged.
-                changed = false;
-            } else {
-                // LWW won — emit only if any content field actually differs. Identical
-                // re-broadcasts (same jti/token/act/exp with a newer hlc) are a no-op
-                // from the consumer's perspective.
-                changed = existing.jti !== token.jti || existing.token !== token.token || existing.act !== token.act || existing.exp !== token.exp;
+                    }).where('grantor', '=', grantor).where('audience', '=', audience).where('resource', '=', token.resource).where('superseded', '=', 0).execute();
+                }
+                await tx.insertInto('kubun_delegation_tokens').values({
+                    ...key,
+                    jti: token.jti,
+                    token: token.token,
+                    act: token.act,
+                    exp: token.exp,
+                    hlc: token.hlc,
+                    superseded: 0
+                }).onConflict((oc)=>oc.columns([
+                        'grantor',
+                        'audience',
+                        'resource',
+                        'jti'
+                    ]).doUpdateSet((eb)=>({
+                            token: eb.ref('excluded.token'),
+                            act: eb.ref('excluded.act'),
+                            exp: eb.ref('excluded.exp'),
+                            hlc: eb.ref('excluded.hlc'),
+                            superseded: 0,
+                            updated_at: adapter.encodeTimestamp(new Date())
+                        }))).execute();
+                return existing == null || existing.jti !== token.jti || existing.token !== token.token || existing.act !== token.act || existing.exp !== token.exp;
+            };
+            // Use an ambient transaction inline: Kysely rejects nested transactions.
+            const write = db.isTransaction ? ambientWriteChain.then(()=>replace(db)) : db.transaction().execute(replace);
+            if (db.isTransaction) {
+                ambientWriteChain = write.then(()=>undefined, ()=>undefined);
             }
+            const changed = await write;
             // Amortize revocation GC across delegation-token inserts. Sample rate
             // keeps the sweep cost negligible while ensuring the table doesn't grow
             // unbounded when the cap stream is busy. Best-effort — sweep failures
@@ -126,7 +152,7 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
             return changed;
         },
         async getDelegationTokens (params) {
-            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', normalizeDID(params.grantor)).where('audience', '=', normalizeDID(params.audience)).execute();
+            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', normalizeDID(params.grantor)).where('audience', '=', normalizeDID(params.audience)).where('superseded', '=', 0).execute();
         },
         // The join carries the author predicate for two reasons. It is an
         // authorization filter — only the grantor's own claim may withhold a token
@@ -137,7 +163,7 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
         // the list as a delegation chain, and a duplicate breaks a multi-hop chain
         // outright.
         async getHeldTokens (params) {
-            return await db.selectFrom('kubun_delegation_tokens').leftJoin('kubun_revoked_capabilities', (join)=>join.onRef('kubun_revoked_capabilities.jti', '=', 'kubun_delegation_tokens.jti').onRef('kubun_revoked_capabilities.revoker_did', '=', 'kubun_delegation_tokens.grantor')).selectAll('kubun_delegation_tokens').where('audience', '=', normalizeDID(params.audience)).where('exp', '>', params.atTime)// Pending revocations (verified_at IS NULL) are not binding until the
+            return await db.selectFrom('kubun_delegation_tokens').leftJoin('kubun_revoked_capabilities', (join)=>join.onRef('kubun_revoked_capabilities.jti', '=', 'kubun_delegation_tokens.jti').onRef('kubun_revoked_capabilities.revoker_did', '=', 'kubun_delegation_tokens.grantor')).selectAll('kubun_delegation_tokens').where('audience', '=', normalizeDID(params.audience)).where('exp', '>', params.atTime).where('kubun_delegation_tokens.superseded', '=', 0)// Pending revocations (verified_at IS NULL) are not binding until the
             // cap-arrival cross-check verifies them, so they don't filter tokens.
             .where((eb)=>eb.or([
                     eb('kubun_revoked_capabilities.jti', 'is', null),
@@ -145,12 +171,16 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
                 ])).execute();
         },
         async listIssuedTokens (grantor) {
-            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', normalizeDID(grantor)).execute();
+            return await db.selectFrom('kubun_delegation_tokens').selectAll().where('grantor', '=', normalizeDID(grantor)).where('superseded', '=', 0).execute();
+        },
+        async listUnrevokedSupersededTokens (params) {
+            const grantor = normalizeDID(params.grantor);
+            return await db.selectFrom('kubun_delegation_tokens').leftJoin('kubun_revoked_capabilities', (join)=>join.onRef('kubun_revoked_capabilities.jti', '=', 'kubun_delegation_tokens.jti').onRef('kubun_revoked_capabilities.revoker_did', '=', 'kubun_delegation_tokens.grantor')).selectAll('kubun_delegation_tokens').where('kubun_delegation_tokens.grantor', '=', grantor).where('audience', '=', normalizeDID(params.audience)).where('resource', '=', params.resource).where('kubun_delegation_tokens.superseded', '=', 1).where('exp', '>', params.atTime).where('kubun_revoked_capabilities.jti', 'is', null).orderBy('kubun_delegation_tokens.hlc').orderBy('kubun_delegation_tokens.jti').execute();
         },
         // `jti` is picked by whoever minted the capability and the grant travels to
         // the whole group, so any co-member can mint one reusing a `jti` it saw. It
         // names a row only inside a single grantor's namespace, and even there it
-        // is not a key — the primary key is `(grantor, audience, resource)`. A
+        // is not a key — the primary key is `(grantor, audience, resource, jti)`. A
         // grantor that reused one `jti` across two of its own grants would leave
         // this read with no representable answer, so it throws rather than pick.
         async getDelegationTokenByGrantorJTI (params) {
@@ -178,7 +208,7 @@ export function createDelegationStore(db, adapter, logger = getKubunLogger('stor
             return (result.numDeletedRows ?? 0n) > 0n;
         },
         // --- Revoked capability operations ---
-        // Same LWW arbitration as `addDelegationToken`: SQL string `>` on the
+        // LWW arbitration uses SQL string `>` on the
         // serialized HLC is a stand-in for `HLC.compare`, valid only while the
         // per-millisecond counter stays within the pad width. The pre-read drives
         // the boolean change signal that emission gates consume; the upsert is

package/lib/definition.js

@@ -3,5 +3,7 @@ import { getDelegationMigrations } from './migrations.js';
 export const delegationStoreDefinition = {
     name: 'delegation',
     migrations: getDelegationMigrations,
-    createAPI: createDelegationStore
+    // Only the db and adapter: KubunDB passes a store context third, and this
+    // factory's third parameter means something else.
+    createAPI: (db, adapter)=>createDelegationStore(db, adapter)
 };

package/lib/index.d.ts

@@ -3,7 +3,7 @@ import type { DelegationStoreAPI } from './api.js';
 export type { DelegationStoreAPI } from './api.js';
 export { createDelegationStore, MAX_CAP_TTL_SECONDS, MAX_REVOCATION_FUTURE_DRIFT_SECONDS, REVOCATION_GC_VERIFIED_GRACE_SECONDS, } from './api.js';
 export { delegationStoreDefinition } from './definition.js';
-export { createDelegationRevocationChecker, type RevocationClaims, } from './revocation-checker.js';
+export { createDelegationRevocationChecker, type RevocationClaims, VerifiedRevocationError, } from './revocation-checker.js';
 export declare const DELEGATION_STORE: "delegation";
 export declare function getDelegationStore(provider: StoreProvider): Promise<DelegationStoreAPI>;
 export type { DelegationStoreTables, DelegationToken, DelegationTokenTable, HeldRevocation, InsertDelegationToken, InsertRevokedCapability, RevokedCapability, RevokedCapabilityTable, } from './tables.js';

package/lib/index.js

@@ -1,6 +1,6 @@
 export { createDelegationStore, MAX_CAP_TTL_SECONDS, MAX_REVOCATION_FUTURE_DRIFT_SECONDS, REVOCATION_GC_VERIFIED_GRACE_SECONDS } from './api.js';
 export { delegationStoreDefinition } from './definition.js';
-export { createDelegationRevocationChecker } from './revocation-checker.js';
+export { createDelegationRevocationChecker, VerifiedRevocationError } from './revocation-checker.js';
 export const DELEGATION_STORE = 'delegation';
 export function getDelegationStore(provider) {
     return provider.getStore(DELEGATION_STORE);

package/lib/migrations.js

@@ -1,18 +1,32 @@
+import { sql } from 'kysely';
 export function getDelegationMigrations(ctx) {
     const t = ctx.types;
     const now = ctx.functions.now;
     const init = {
         async up (db) {
+            // A stable row serialises replacements even before the first grant exists.
+            await db.schema.createTable('kubun_delegation_token_keys').ifNotExists().addColumn('grantor', t.text, (col)=>col.notNull()).addColumn('audience', t.text, (col)=>col.notNull()).addColumn('resource', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_delegation_token_keys', [
+                'grantor',
+                'audience',
+                'resource'
+            ]).execute();
             // Delegation tokens
             await db.schema.createTable('kubun_delegation_tokens').ifNotExists().addColumn('jti', t.text, (col)=>col.notNull()).addColumn('grantor', t.text, (col)=>col.notNull()).addColumn('audience', t.text, (col)=>col.notNull()).addColumn('token', t.text, (col)=>col.notNull()).addColumn('resource', t.text, (col)=>col.notNull()).addColumn('act', t.text, (col)=>col.notNull())// Capability expiry, a numeric unix-seconds claim mirrored from the
             // token for indexed validity filtering. bigint, not int32: a 32-bit
             // seconds column ceilings at 2038. The adapter's int8 parser reads it
             // back as a JS number, so the row type stays `number`.
-            .addColumn('exp', t.bigint, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).addPrimaryKeyConstraint('pk_delegation_tokens', [
+            .addColumn('exp', t.bigint, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull())// Integer 0/1 reads uniformly across SQLite and Postgres.
+            .addColumn('superseded', 'integer', (col)=>col.defaultTo(0).notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).addPrimaryKeyConstraint('pk_delegation_tokens', [
                 'grantor',
                 'audience',
-                'resource'
+                'resource',
+                'jti'
             ]).execute();
+            await db.schema.createIndex('idx_delegation_tokens_active_key').ifNotExists().unique().on('kubun_delegation_tokens').columns([
+                'grantor',
+                'audience',
+                'resource'
+            ]).where(sql.ref('superseded'), '=', 0).execute();
             await db.schema.createIndex('idx_delegation_tokens_grantor_audience').ifNotExists().on('kubun_delegation_tokens').columns([
                 'grantor',
                 'audience'
@@ -23,9 +37,7 @@ export function getDelegationMigrations(ctx) {
                 'audience',
                 'exp'
             ]).execute();
-            // Revocation lookup keys on `jti`, which is not part of the composite PK
-            // `(grantor, audience, resource)`. Index it so cap-by-jti lookups during
-            // revocation are not a table scan.
+            // JTI is last in the composite key; index issuer-history lookups separately.
             await db.schema.createIndex('idx_delegation_tokens_jti').ifNotExists().on('kubun_delegation_tokens').column('jti').execute();
             // Revoked capabilities. `verified_at` doubles as both the verified flag
             // (NULL = pending cross-check vs the cap's iss) and a forensic
@@ -57,6 +69,7 @@ export function getDelegationMigrations(ctx) {
         async down (db) {
             await db.schema.dropTable('kubun_revoked_capabilities').ifExists().execute();
             await db.schema.dropTable('kubun_delegation_tokens').ifExists().execute();
+            await db.schema.dropTable('kubun_delegation_token_keys').ifExists().execute();
         }
     };
     return {

package/lib/revocation-checker.d.ts

@@ -1,4 +1,4 @@
-import { type VerifyTokenHook } from '@kokuin/capability';
+import { type CapabilityToken, type VerifyTokenHook } from '@kokuin/capability';
 import { type MethodRegistry } from '@kokuin/token';
 import type { DelegationStoreAPI } from './api.js';
 export type RevocationClaims = {
@@ -7,6 +7,11 @@ export type RevocationClaims = {
     rev: true;
     iat: number;
 };
+/** A revocation proved by kokuin after the store and resolver returned successfully. */
+export declare class VerifiedRevocationError extends Error {
+    get brand(): string;
+    constructor(message: string, options?: ErrorOptions);
+}
 /**
  * Revocation hook backed by the delegation store.
  *
@@ -24,4 +29,9 @@ export type RevocationClaims = {
  * without the registry it fails to resolve, is dropped, and the revoked
  * capability passes (fail-open). Optional so non-controller callers stay 1-arg.
  */
-export declare function createDelegationRevocationChecker(api: DelegationStoreAPI, methods?: MethodRegistry): VerifyTokenHook;
+/** Proves whether a token's delegation chain is unrevoked, without throwing. */
+export type DelegationRevocationVerdict = (token: CapabilityToken, raw: string) => Promise<boolean>;
+/** Adapt a proved verdict to kokuin's throwing VerifyTokenHook contract. */
+export declare function createDelegationRevocationChecker(api: DelegationStoreAPI, methods?: MethodRegistry): VerifyTokenHook & {
+    verdict: DelegationRevocationVerdict;
+};

package/lib/revocation-checker.js

@@ -1,25 +1,50 @@
 import { createRevocationChecker } from '@kokuin/capability';
-import { verifyToken } from '@kokuin/token';
-/**
- * Revocation hook backed by the delegation store.
- *
- * The store holds one row per (capability, revoker): a `jti` alone names
- * several claims, of which only the one signed by the capability's own issuer
- * binds. The lookup is scoped to that issuer so a co-member's claim about the
- * same `jti` can neither answer in its place nor hide it.
- *
- * kokuin's checker still re-verifies the record's signature and re-compares the
- * issuer, so a row this device could not cross-check against a locally held
- * grant is safe to hand over.
- *
- * `methods` resolves the record's issuer: a revocation whose `iss` is a
- * `did:kokuin:` controller DID cannot verify from the identifier alone, so
- * without the registry it fails to resolve, is dropped, and the revoked
- * capability passes (fail-open). Optional so non-controller callers stay 1-arg.
- */ export function createDelegationRevocationChecker(api, methods) {
+import { isIssuerKeyNotFoundError, isUnresolvableIssuerError, normalizeDID, verifyToken } from '@kokuin/token';
+/** A revocation proved by kokuin after the store and resolver returned successfully. */ export class VerifiedRevocationError extends Error {
+    get brand() {
+        return '@kubun/store-delegation/VerifiedRevocationError';
+    }
+    constructor(message, options){
+        super(message, options);
+        this.name = 'VerifiedRevocationError';
+    }
+}
+function createDelegationRevocationVerdictChecker(api, methods) {
     // The backend is per-token: its `get` closes over the issuer of the
     // capability being checked, which is only known once the hook is called.
     return async (token, raw)=>{
+        let dependencyFault;
+        let hadDependencyFault = false;
+        let provedRevocation = false;
+        const recordFault = (error)=>{
+            if (!hadDependencyFault) {
+                dependencyFault = error;
+                hadDependencyFault = true;
+            }
+        };
+        const trackedMethods = methods?.map((base)=>{
+            const wrap = (fn)=>async (...args)=>{
+                    try {
+                        return await fn(...args);
+                    } catch (error) {
+                        recordFault(error);
+                        throw error;
+                    }
+                };
+            return {
+                method: base.method,
+                resolve: wrap(base.resolve.bind(base)),
+                ...base.resolveHistoric == null ? {} : {
+                    resolveHistoric: wrap(base.resolveHistoric.bind(base))
+                },
+                ...base.resolveDenySet == null ? {} : {
+                    resolveDenySet: wrap(base.resolveDenySet.bind(base))
+                },
+                ...base.resolveAgreementKey == null ? {} : {
+                    resolveAgreementKey: wrap(base.resolveAgreementKey.bind(base))
+                }
+            };
+        });
         const issuer = token.payload.iss;
         const backend = {
             async add () {
@@ -30,25 +55,60 @@ import { verifyToken } from '@kokuin/token';
             // offering a second, lossy write path.
             },
             async get (jti) {
-                const row = await api.getRevocationByIssuer(jti, issuer);
+                let row;
+                try {
+                    row = await api.getRevocationByIssuer(jti, issuer);
+                } catch (error) {
+                    recordFault(error);
+                    throw error;
+                }
                 if (row == null) {
                     return undefined;
                 }
                 try {
                     // Carries `methods` so a controller-issued (`did:kokuin:`) record can
                     // resolve; must match the checker's own verify below or the two drift.
-                    return await verifyToken(row.revocation_token, {
-                        methods
+                    const verified = await verifyToken(row.revocation_token, {
+                        methods: trackedMethods
                     });
-                } catch  {
-                    // A stored record that no longer verifies revokes nothing. The checker
-                    // re-verifies too, but failing here keeps a corrupt row from surfacing.
-                    return undefined;
+                    provedRevocation = normalizeDID(verified.payload.iss) === normalizeDID(issuer);
+                    return verified;
+                } catch (error) {
+                    if (hadDependencyFault) throw dependencyFault;
+                    // A corrupt record is not revocation evidence. A resolver that cannot
+                    // answer is different: the record may be genuine, so retry the frame.
+                    if (isUnresolvableIssuerError(error)) throw error.cause ?? error;
+                    if (isIssuerKeyNotFoundError(error)) return undefined;
+                    if (error instanceof SyntaxError || error instanceof Error && (error.message === 'Invalid signature' || error.message === 'Token expired' || error.message === 'Token not yet valid' || error.message.startsWith('Invalid token') || error.message.startsWith('Unsupported token') || error.message.startsWith('Unsupported signature algorithm'))) {
+                        return undefined;
+                    }
+                    throw error;
                 }
             }
         };
-        await createRevocationChecker(backend, {
-            methods
-        })(token, raw);
+        try {
+            await createRevocationChecker(backend, {
+                methods: trackedMethods
+            })(token, raw);
+        } catch (error) {
+            if (hadDependencyFault) throw dependencyFault;
+            // The store read and record verification proved this issuer's revocation.
+            // kokuin re-verifies that same record and throws its refusal; its spelling
+            // is irrelevant to this verdict. Any dependency throw was handled above.
+            if (provedRevocation) return true;
+            throw error;
+        }
+        return false;
+    };
+}
+/** Adapt a proved verdict to kokuin's throwing VerifyTokenHook contract. */ export function createDelegationRevocationChecker(api, methods) {
+    const verdict = createDelegationRevocationVerdictChecker(api, methods);
+    const checker = async (token, raw)=>{
+        if (await verdict(token, raw)) {
+            throw new VerifiedRevocationError(`Token revoked: ${token.payload.jti}`);
+        }
     };
+    return Object.assign(checker, {
+        verdict
+    });
 }

package/lib/tables.d.ts

@@ -1,5 +1,5 @@
 import type { CreatedAtColumn, UpdatedAtColumn } from '@kubun/db-adapter';
-import type { Insertable, Selectable } from 'kysely';
+import type { Generated, Insertable, Selectable } from 'kysely';
 export type DelegationTokenTable = {
     jti: string;
     grantor: string;
@@ -9,6 +9,7 @@ export type DelegationTokenTable = {
     act: string;
     exp: number;
     hlc: string;
+    superseded: Generated<number>;
     created_at: CreatedAtColumn;
     updated_at: UpdatedAtColumn;
 };
@@ -37,6 +38,7 @@ export type HeldRevocation = {
     cap_exp: number | null;
 };
 export type DelegationStoreTables = {
+    kubun_delegation_token_keys: Pick<DelegationTokenTable, 'grantor' | 'audience' | 'resource'>;
     kubun_delegation_tokens: DelegationTokenTable;
     kubun_revoked_capabilities: RevokedCapabilityTable;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/store-delegation",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -15,17 +15,17 @@
     "LICENSE.md"
   ],
   "dependencies": {
-    "@kokuin/capability": "^0.3.0",
-    "@kokuin/token": "^0.5.0",
-    "@kubun/db": "^0.17.0",
-    "@kubun/db-adapter": "^0.17.0",
-    "@kubun/logger": "^0.17.0",
-    "kysely": "^0.29.5"
+    "@kokuin/capability": "^0.4.2",
+    "@kokuin/token": "^0.5.1",
+    "@kubun/db": "^0.18.0",
+    "@kubun/db-adapter": "^0.18.0",
+    "@kubun/logger": "^0.18.0",
+    "kysely": "^0.29.7"
   },
   "devDependencies": {
-    "@kubun/db-better-sqlite": "^0.17.0",
-    "@kubun/db-postgres": "^0.17.0",
-    "@testcontainers/postgresql": "^12.1.0"
+    "@kubun/db-better-sqlite": "^0.18.0",
+    "@kubun/db-postgres": "^0.18.0",
+    "@testcontainers/postgresql": "^12.2.1"
   },
   "publishConfig": {
     "access": "public"