@oaath/server 0.1.0 → 0.3.0

package/dist/interface-DHpwP0wr.d.ts

@@ -0,0 +1,245 @@
+import { BundlerRejection, KernelRevocationSigningRequest, ValidationGasDiagnostic } from "@oaath/protocol";
+//#region src/clock.d.ts
+/**
+ * Injected clock. Expiry is never read from `Date.now()` directly, so tests and
+ * deployments own time.
+ *
+ * @author taek <leekt216@gmail.com>
+ */
+interface RelayClock {
+  /** Milliseconds since the Unix epoch as a non-negative safe integer. */
+  now(): number;
+}
+//#endregion
+//#region src/revocation/records.d.ts
+declare const OAATH_REVOCATION_REQUEST_RECORD_VERSION: "oaath.revocation-request-record/v1";
+declare const OAATH_REVOCATION_DECISION_RECORD_VERSION: "oaath.revocation-decision-record/v1";
+interface RevocationRequestRecord {
+  readonly version: typeof OAATH_REVOCATION_REQUEST_RECORD_VERSION;
+  readonly operationId: string;
+  readonly ownerDeviceId: string;
+  readonly ownerSubject: string;
+  readonly createdAt: number;
+  readonly expiresAt: number;
+  readonly signingRequest: Readonly<KernelRevocationSigningRequest>;
+}
+interface RevocationDecisionRecord {
+  readonly version: typeof OAATH_REVOCATION_DECISION_RECORD_VERSION;
+  readonly operationId: string;
+  readonly outcome: "approved" | "rejected";
+  readonly decidedAt: number;
+  /** Sealed canonical phone artifact; null exactly for rejection. Never an OAuth release. */
+  readonly artifactRef: string | null;
+}
+//#endregion
+//#region src/relay/errors.d.ts
+type RelayErrorCode =
+/** Wire input is missing, malformed, oversized, or contains unknown fields. */
+"relay_request_invalid" |
+/** The deployment authentication port did not authenticate the caller. */
+"relay_unauthenticated" |
+/** Authenticated caller may not act in the required role. */
+"relay_forbidden" |
+/** Route, or a record the caller is entitled to see, does not exist. */
+"relay_not_found" |
+/** Route exists with a different method. */
+"relay_method_not_allowed" |
+/** The authorization request or code is past its injected-clock expiry. */
+"relay_expired" |
+/** The authorization request already reached a terminal decision. */
+"relay_already_decided" |
+/** The one-time authorization code was already consumed. */
+"relay_code_already_consumed" |
+/** The one-time encrypted artifact was already claimed. */
+"relay_artifact_already_claimed" |
+/**
+ * Authorization code redemption failed. One code for every reason it can
+ * fail — unknown code, another client's code, wrong redirect URI, wrong PKCE
+ * verifier — so the endpoint never confirms that a guessed code was correct.
+ * A code that existed is burned.
+ */
+"relay_code_invalid" |
+/** The optional deployment limiter rejected the call. */
+"relay_rate_limited" |
+/** A durable record could not be read as the current schema version. */
+"relay_record_unreadable" |
+/** The KMS port was unavailable or returned an unusable result. */
+"relay_kms_unavailable" |
+/** The store failed before any state change could have been committed. */
+"relay_store_unavailable" |
+/**
+ * The store could not prove whether a transition committed. The caller must
+ * treat the transition as neither applied nor retryable: an ambiguous commit
+ * never authorizes resubmission.
+ */
+"relay_state_ambiguous" |
+/**
+ * EXPERIMENTAL PREVIEW (`@oaath/server/apns`): the constructed APNs payload
+ * exceeded Apple's 4096-byte limit, so nothing was sent.
+ */
+"relay_apns_payload_too_large" |
+/**
+ * EXPERIMENTAL PREVIEW (`@oaath/server/apns`): the injected Apple credential
+ * capability is not a usable P-256 signing key, key id, team id, or topic.
+ */
+"relay_apns_credentials_invalid" |
+/** A deployment-injected chain execution port failed or answered unusably. */
+"relay_chain_unavailable" |
+/** The Grant's capability is durably invalidated; nothing more executes here. */
+"relay_capability_invalidated" |
+/** An invariant the relay owns was violated. */
+"relay_internal";
+/**
+ * Status projection. `relay_state_ambiguous` is deliberately 500 and not 503,
+ * because 503 invites the retry that an ambiguous commit forbids.
+ */
+declare const RELAY_ERROR_STATUS: Readonly<Record<RelayErrorCode, number>>;
+declare class OaathRelayError extends Error {
+  readonly bundlerRejection: Readonly<BundlerRejection> | null;
+  readonly code: RelayErrorCode;
+  readonly diagnostic: Readonly<ValidationGasDiagnostic> | null;
+  constructor(code: RelayErrorCode, message: string, diagnostic?: Readonly<ValidationGasDiagnostic> | null, bundlerRejection?: Readonly<BundlerRejection> | null);
+}
+//#endregion
+//#region src/store/records.d.ts
+declare const OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION: "oaath.authorization-request-record/v2";
+declare const OAATH_AUTHORIZATION_DECISION_RECORD_VERSION: "oaath.authorization-decision-record/v1";
+declare const OAATH_AUTHORIZATION_CODE_RECORD_VERSION: "oaath.authorization-code-record/v1";
+declare const OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION: "oaath.encrypted-artifact-record/v1";
+declare const OAATH_CAPABILITY_INVALIDATION_RECORD_VERSION: "oaath.capability-invalidation-record/v1";
+/** Deployment-selected device reference and its authenticated approving subject. */
+interface AuthorizationOwnerRoute {
+  readonly ownerDeviceId: string;
+  readonly ownerSubject: string;
+}
+interface AuthorizationRequestRecord extends AuthorizationOwnerRoute {
+  readonly version: typeof OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION;
+  readonly requestId: string;
+  /** Client bound by the deployment authentication port, never by wire input. */
+  readonly clientId: string;
+  /** Requesting member's subject, independent of the approving device. */
+  readonly subject: string;
+  /**
+   * Organization/audience bound by the authentication port at creation time,
+   * or null when the deployment declares none. Grant reference verification
+   * compares assertions against this captured value.
+   */
+  readonly organizationAudience: string | null;
+  readonly redirectUri: string;
+  /** PKCE S256 challenge; the verifier never reaches the store. */
+  readonly codeChallenge: string;
+  /** Opaque owner-reviewed scope payload. Migrates to @oaath/protocol. */
+  readonly requestedScope: string;
+  readonly createdAt: number;
+  readonly expiresAt: number;
+}
+type AuthorizationDecisionOutcome = "approved" | "rejected";
+/**
+ * Terminal decision. Its existence is the single authoritative fact that an
+ * authorization request was decided; the request record never mutates.
+ */
+interface AuthorizationDecisionRecord {
+  readonly version: typeof OAATH_AUTHORIZATION_DECISION_RECORD_VERSION;
+  readonly requestId: string;
+  readonly outcome: AuthorizationDecisionOutcome;
+  readonly decidedAt: number;
+  /**
+   * KMS-sealed copy of the released code for authenticated client pickup, and
+   * its expiry. The relay mints the code itself, so holding a sealed copy adds
+   * no new trust; PKCE still guards consumption. Both are null exactly when
+   * the outcome is a rejection.
+   */
+  readonly codeRef: string | null;
+  readonly codeExpiresAt: number | null;
+}
+interface AuthorizationCodeRecord {
+  readonly version: typeof OAATH_AUTHORIZATION_CODE_RECORD_VERSION;
+  /** SHA-256 (base64url) of the released code. The code itself is never stored. */
+  readonly codeHash: string;
+  readonly requestId: string;
+  /** Binding snapshot taken at issue time so consume needs exactly one row lock. */
+  readonly clientId: string;
+  readonly redirectUri: string;
+  readonly codeChallenge: string;
+  readonly artifactId: string;
+  readonly createdAt: number;
+  readonly expiresAt: number;
+  /** Set exactly once. A non-null value is terminal. */
+  readonly consumedAt: number | null;
+}
+interface EncryptedArtifactRecord {
+  readonly version: typeof OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION;
+  readonly artifactId: string;
+  readonly requestId: string;
+  readonly clientId: string;
+  /** Opaque KMS reference. Plaintext never reaches the store. */
+  readonly ciphertextRef: string;
+  readonly createdAt: number;
+  /** Set exactly once. A non-null value is terminal. */
+  readonly claimedAt: number | null;
+}
+/**
+ * One durable capability invalidation: from the moment this record commits,
+ * the relay's chain execution routes refuse every submission and usage read
+ * for the Grant, so the recorded evidence states an enforced fact — "this
+ * service will no longer act for this capability" — not a bare digest.
+ * Consuming the on-chain install nonce is the chain-local revocation
+ * operation's job and stays separate evidence.
+ */
+interface CapabilityInvalidationRecord {
+  readonly version: typeof OAATH_CAPABILITY_INVALIDATION_RECORD_VERSION;
+  readonly grantId: string;
+  /** The authenticated client that recorded the invalidation. */
+  readonly clientId: string;
+  readonly capabilityHash: string;
+  readonly invalidatedAt: number;
+}
+//#endregion
+//#region src/store/interface.d.ts
+/** Read-only discovery metadata. The existing request/decision records own pending state. */
+interface PendingOwnerRequest {
+  readonly operationId: string;
+  readonly ownerSubject: string;
+  readonly expiresAt: number;
+}
+interface RelayTransaction {
+  /** Unexpired and undecided requests, ordered by expiry then ASCII operation ID. No reservation. */
+  listPendingOwnerRequests(ownerSubject: string, now: number, limit: number): Promise<readonly PendingOwnerRequest[]>;
+  /** Lock the original authorization request first to serialize grant/chain enqueue. */
+  lockLatestRevocationRequest(grantId: string, chainId: number): Promise<RevocationRequestRecord | undefined>;
+  /** Lock the immutable request before reading or writing its terminal decision. */
+  lockRevocationRequest(operationId: string): Promise<RevocationRequestRecord | undefined>;
+  insertRevocationRequest(record: RevocationRequestRecord): Promise<boolean>;
+  lockRevocationDecision(operationId: string): Promise<RevocationDecisionRecord | undefined>;
+  insertRevocationDecision(record: RevocationDecisionRecord): Promise<boolean>;
+  lockAuthorizationRequest(requestId: string): Promise<AuthorizationRequestRecord | undefined>;
+  /** Returns false when the identifier already exists. */
+  insertAuthorizationRequest(record: AuthorizationRequestRecord): Promise<boolean>;
+  lockAuthorizationDecision(requestId: string): Promise<AuthorizationDecisionRecord | undefined>;
+  /** Returns false when the request was already decided. */
+  insertAuthorizationDecision(record: AuthorizationDecisionRecord): Promise<boolean>;
+  lockAuthorizationCode(codeHash: string): Promise<AuthorizationCodeRecord | undefined>;
+  insertAuthorizationCode(record: AuthorizationCodeRecord): Promise<boolean>;
+  /** Returns true only when this call set `consumed_at`. */
+  consumeAuthorizationCode(codeHash: string, consumedAt: number): Promise<boolean>;
+  lockCapabilityInvalidation(grantId: string): Promise<CapabilityInvalidationRecord | undefined>;
+  /** Returns false when the Grant's capability is already invalidated. */
+  insertCapabilityInvalidation(record: CapabilityInvalidationRecord): Promise<boolean>;
+  lockEncryptedArtifact(artifactId: string): Promise<EncryptedArtifactRecord | undefined>;
+  /** Internal authority lookup; returns retained evidence even after client claim. Never releases it. */
+  lockEncryptedArtifactByRequestId(requestId: string): Promise<EncryptedArtifactRecord | undefined>;
+  insertEncryptedArtifact(record: EncryptedArtifactRecord): Promise<boolean>;
+  /** Returns true only when this call set `claimed_at`. */
+  claimEncryptedArtifact(artifactId: string, claimedAt: number): Promise<boolean>;
+  /** Throws `relay_state_ambiguous` when the outcome cannot be proven. */
+  commit(): Promise<void>;
+  /** Never throws; rollback failure is a suppressed diagnostic. */
+  rollback(): Promise<void>;
+}
+interface RelayStore {
+  begin(): Promise<RelayTransaction>;
+  close(): Promise<void>;
+}
+//#endregion
+export { OAATH_REVOCATION_REQUEST_RECORD_VERSION as _, AuthorizationDecisionRecord as a, RelayClock as b, EncryptedArtifactRecord as c, OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION as d, OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION as f, OAATH_REVOCATION_DECISION_RECORD_VERSION as g, RelayErrorCode as h, AuthorizationDecisionOutcome as i, OAATH_AUTHORIZATION_CODE_RECORD_VERSION as l, RELAY_ERROR_STATUS as m, RelayTransaction as n, AuthorizationOwnerRoute as o, OaathRelayError as p, AuthorizationCodeRecord as r, AuthorizationRequestRecord as s, RelayStore as t, OAATH_AUTHORIZATION_DECISION_RECORD_VERSION as u, RevocationDecisionRecord as v, RevocationRequestRecord as y };
+//# sourceMappingURL=interface-DHpwP0wr.d.ts.map

package/dist/interface-DHpwP0wr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-DHpwP0wr.d.ts","names":[],"sources":["../src/clock.ts","../src/revocation/records.ts","../src/relay/errors.ts","../src/store/records.ts","../src/store/interface.ts"],"mappings":";;;;;;;;UAUiB;;EAEf;;;;cCHW;cAEA;UAKI;WACN,gBAAgB;WAChB;WACA;WACA;WACA;WACA;WACA,gBAAgB,SAAS;;UAEnB;WACN,gBAAgB;WAChB;WACA;WACA;;WAEA;;;;KCfC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6DC,oBAAoB,SAAS,OAAO;cAyBpC,wBAAwB;WAC1B,kBAAkB,SAAS;WAC3B,MAAM;WACN,YAAY,SAAS;EAE9B,YACE,MAAM,gBACN,iBACA,aAAY,SAAS,iCACrB,mBAAkB,SAAS;;;;cC3FlB;cAEA;cAEA;cAEA;cAEA;;UAiBI;WACN;WACA;;UAGM,mCAAmC;WACzC,gBAAgB;WAChB;;WAEA;;WAEA;;;;;;WAMA;WACA;;WAEA;;WAEA;WACA;WACA;;KAGC;;;;;UAMK;WACN,gBAAgB;WAChB;WACA,SAAS;WACT;;;;;;;WAOA;WACA;;UAGM;WACN,gBAAgB;;WAEhB;WACA;;WAEA;WACA;WACA;WACA;WACA;WACA;;WAEA;;UAGM;WACN,gBAAgB;WAChB;WACA;WACA;;WAEA;WACA;;WAEA;;;;;;;;;;UAWM;WACN,gBAAgB;WAChB;;WAEA;WACA;WACA;;;;;UC7FM;WACN;WACA;WACA;;UAGM;;EAEf,yBACE,sBACA,aACA,gBACC,iBAAiB;;EAEpB,4BACE,iBACA,kBACC,QAAQ;;EAEX,sBAAsB,sBAAsB,QAAQ;EACpD,wBAAwB,QAAQ,0BAA0B;EAC1D,uBAAuB,sBAAsB,QAAQ;EACrD,yBAAyB,QAAQ,2BAA2B;EAE5D,yBAAyB,oBAAoB,QAAQ;;EAErD,2BAA2B,QAAQ,6BAA6B;EAEhE,0BAA0B,oBAAoB,QAAQ;;EAEtD,4BAA4B,QAAQ,8BAA8B;EAElE,sBAAsB,mBAAmB,QAAQ;EACjD,wBAAwB,QAAQ,0BAA0B;;EAE1D,yBAAyB,kBAAkB,qBAAqB;EAEhE,2BAA2B,kBAAkB,QAAQ;;EAErD,6BAA6B,QAAQ,+BAA+B;EAEpE,sBAAsB,qBAAqB,QAAQ;;EAEnD,iCAAiC,oBAAoB,QAAQ;EAC7D,wBAAwB,QAAQ,0BAA0B;;EAE1D,uBAAuB,oBAAoB,oBAAoB;;EAG/D,UAAU;;EAEV,YAAY;;UAGG;EACf,SAAS,QAAQ;EACjB,SAAS"}

package/dist/kernel.d.ts

@@ -0,0 +1,42 @@
+import { b as RelayClock, t as RelayStore } from "./interface-DHpwP0wr.js";
+import { t as RelayKms } from "./kms-BWkywdJM.js";
+import { OperationObserveResult, OperationObserverCapabilities, OperationStartResult, OperationStoreAdapter } from "@oaath/sdk/advanced";
+import { PreparedUserOperation } from "@oaath/sdk/kernel";
+//#region src/revocation/executor.d.ts
+interface OwnerPhoneRevocationExecutorInput {
+  readonly store: RelayStore;
+  readonly kms: RelayKms;
+  readonly clock: RelayClock;
+  readonly operationId: string;
+  readonly operations: OperationStoreAdapter;
+  readonly observation: OperationObserverCapabilities;
+  /**
+   * Opens a session for this exact prepared operation and verified root signature.
+   * Opening must not send. Return { submit(): Promise<{ userOperationHash }>, close() }.
+   * Both opening and submit happen only after durable submission_attempted.
+   */
+  readonly submission: Readonly<{
+    openSubmission(prepared: Readonly<PreparedUserOperation>, signature: `0x${string}`): Promise<unknown>;
+    close(): Promise<void>;
+  }>;
+}
+/**
+ * Deployment execution capability, not a client/phone HTTP route. A terminal
+ * approved decision is custody; the existing Operation journal owns execution.
+ * Reload reconstructs exact bytes without quoting or preparing on chain. The
+ * journal is read before KMS/submission access. An attempted or terminal hash
+ * never opens another session, even after consent expiry. Observe reads only
+ * chain evidence and retains uncertainty. Close delegates retryable resource
+ * cleanup to the runner; the deployment owns relay store, pool and KMS lifetime.
+ */
+interface OwnerPhoneRevocationExecutor {
+  readonly operationId: string;
+  readonly userOperationHash: `0x${string}`;
+  start(timeoutMs: number): Promise<OperationStartResult>;
+  observe(timeoutMs: number): Promise<OperationObserveResult>;
+  close(): Promise<void>;
+}
+declare function createOwnerPhoneRevocationExecutor(input: OwnerPhoneRevocationExecutorInput): Promise<Readonly<OwnerPhoneRevocationExecutor>>;
+//#endregion
+export { type OwnerPhoneRevocationExecutor, type OwnerPhoneRevocationExecutorInput, createOwnerPhoneRevocationExecutor };
+//# sourceMappingURL=kernel.d.ts.map

package/dist/kernel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel.d.ts","names":[],"sources":["../src/revocation/executor.ts"],"mappings":";;;;;UAmBiB;WACN,OAAO;WACP,KAAK;WACL,OAAO;WACP;WACA,YAAY;WACZ,aAAa;;;;;;WAMb,YAAY;IACnB,eACE,UAAU,SAAS,wBACnB,2BACC;IACH,SAAS;;;;;;;;;;;;UAaI;WACN;WACA;EACT,MAAM,oBAAoB,QAAQ;EAClC,QAAQ,oBAAoB,QAAQ;EACpC,SAAS;;iBAEW,mCACpB,OAAO,oCACN,QAAQ,SAAS"}

package/dist/kernel.js

@@ -0,0 +1,80 @@
+import { b as relayFailure } from "./records-BQNDxbPg.js";
+import { a as relayNow } from "./challenge-DmpGSogj.js";
+import { S as withRelayTransaction, b as openArtifact, r as readRevocationState } from "./service-Cf4f-9KP.js";
+import { parseOwnerSigningArtifact } from "@oaath/protocol";
+import { OperationStore, createOperationObserver, createOperationRunner } from "@oaath/sdk/advanced";
+import { restoreKernelPermissionRevocation } from "@oaath/sdk/kernel";
+//#region src/revocation/executor.ts
+/** Composes durable approved phone custody with the existing SDK execution owners. */
+async function createOwnerPhoneRevocationExecutor(input) {
+	const { store, kms, clock, operationId, operations, observation, submission } = input;
+	const { request, decision } = await withRelayTransaction(store, (transaction) => readRevocationState(transaction, operationId));
+	if (decision?.outcome !== "approved" || decision.artifactRef === null) return relayFailure("relay_request_invalid", "revocation has no approved custody");
+	const artifactRef = decision.artifactRef;
+	const restored = await restoreKernelPermissionRevocation({ preparation: request.signingRequest });
+	const prepared = restored.prepared;
+	const key = Object.freeze({
+		grantId: prepared.grantId,
+		chainId: prepared.chainId,
+		kind: "revocation"
+	});
+	const journal = new OperationStore(operations);
+	const noEffect = async () => void 0;
+	const runner = createOperationRunner({
+		terminalBehavior: "reuse_same_kind",
+		requestHash: null,
+		store: journal,
+		observer: createOperationObserver(observation),
+		preparation: {
+			prepare: async () => prepared,
+			reserveOperation: noEffect,
+			releaseOperationReservation: noEffect,
+			authorizeOperation: async () => {
+				if (relayNow(clock) > request.expiresAt) return relayFailure("relay_expired", "revocation consent expired before submission");
+			},
+			abandonOperation: noEffect,
+			confirmOperationPublished: noEffect,
+			close: noEffect
+		},
+		submission: {
+			async openSubmission(snapshot) {
+				const artifact = parseOwnerSigningArtifact(JSON.parse(await openArtifact(kms, artifactRef)));
+				const signature = await restored.complete(artifact);
+				return submission.openSubmission(snapshot, signature);
+			},
+			close: () => submission.close()
+		}
+	});
+	function runInput(timeoutMs) {
+		const now = Math.floor(relayNow(clock) / 1e3);
+		return {
+			kind: "revocation",
+			key,
+			expectedUserOperationHash: prepared.userOperationHash,
+			preparedAt: now,
+			attemptedAt: now,
+			submittedAt: now,
+			observedAt: now,
+			timeoutMs
+		};
+	}
+	return Object.freeze({
+		operationId,
+		userOperationHash: prepared.userOperationHash,
+		async start(timeoutMs) {
+			const existing = await journal.getExact(key, prepared.userOperationHash);
+			if (existing && existing.value.state !== "prepared") return Object.freeze({
+				status: "started",
+				record: existing
+			});
+			if (relayNow(clock) > request.expiresAt) return relayFailure("relay_expired", "revocation consent expired before submission");
+			return runner.resumePreparedOperation(runInput(timeoutMs));
+		},
+		observe: (timeoutMs) => runner.observeOperation(runInput(timeoutMs)),
+		close: () => runner.close()
+	});
+}
+//#endregion
+export { createOwnerPhoneRevocationExecutor };
+
+//# sourceMappingURL=kernel.js.map

package/dist/kernel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel.js","names":[],"sources":["../src/revocation/executor.ts"],"sourcesContent":["/** Composes durable approved phone custody with the existing SDK execution owners. */\nimport { parseOwnerSigningArtifact } from \"@oaath/protocol\";\nimport {\n  createOperationObserver,\n  createOperationRunner,\n  type OperationObserveResult,\n  type OperationObserverCapabilities,\n  type OperationStartResult,\n  OperationStore,\n  type OperationStoreAdapter,\n} from \"@oaath/sdk/advanced\";\nimport { type PreparedUserOperation, restoreKernelPermissionRevocation } from \"@oaath/sdk/kernel\";\nimport { openArtifact } from \"../artifact/encrypt.js\";\nimport { type RelayClock, relayNow } from \"../clock.js\";\nimport { relayFailure } from \"../relay/errors.js\";\nimport type { RelayKms } from \"../security/kms.js\";\nimport { type RelayStore, withRelayTransaction } from \"../store/interface.js\";\nimport { readRevocationState } from \"./service.js\";\n\nexport interface OwnerPhoneRevocationExecutorInput {\n  readonly store: RelayStore;\n  readonly kms: RelayKms;\n  readonly clock: RelayClock;\n  readonly operationId: string;\n  readonly operations: OperationStoreAdapter;\n  readonly observation: OperationObserverCapabilities;\n  /**\n   * Opens a session for this exact prepared operation and verified root signature.\n   * Opening must not send. Return { submit(): Promise<{ userOperationHash }>, close() }.\n   * Both opening and submit happen only after durable submission_attempted.\n   */\n  readonly submission: Readonly<{\n    openSubmission(\n      prepared: Readonly<PreparedUserOperation>,\n      signature: `0x${string}`,\n    ): Promise<unknown>;\n    close(): Promise<void>;\n  }>;\n}\n\n/**\n * Deployment execution capability, not a client/phone HTTP route. A terminal\n * approved decision is custody; the existing Operation journal owns execution.\n * Reload reconstructs exact bytes without quoting or preparing on chain. The\n * journal is read before KMS/submission access. An attempted or terminal hash\n * never opens another session, even after consent expiry. Observe reads only\n * chain evidence and retains uncertainty. Close delegates retryable resource\n * cleanup to the runner; the deployment owns relay store, pool and KMS lifetime.\n */\nexport interface OwnerPhoneRevocationExecutor {\n  readonly operationId: string;\n  readonly userOperationHash: `0x${string}`;\n  start(timeoutMs: number): Promise<OperationStartResult>;\n  observe(timeoutMs: number): Promise<OperationObserveResult>;\n  close(): Promise<void>;\n}\nexport async function createOwnerPhoneRevocationExecutor(\n  input: OwnerPhoneRevocationExecutorInput,\n): Promise<Readonly<OwnerPhoneRevocationExecutor>> {\n  const { store, kms, clock, operationId, operations, observation, submission } = input;\n  const { request, decision } = await withRelayTransaction(store, (transaction) =>\n    readRevocationState(transaction, operationId),\n  );\n  if (decision?.outcome !== \"approved\" || decision.artifactRef === null)\n    return relayFailure(\"relay_request_invalid\", \"revocation has no approved custody\");\n  const artifactRef = decision.artifactRef;\n  const restored = await restoreKernelPermissionRevocation({ preparation: request.signingRequest });\n  const prepared = restored.prepared;\n  const key = Object.freeze({\n    grantId: prepared.grantId,\n    chainId: prepared.chainId,\n    kind: \"revocation\" as const,\n  });\n  const journal = new OperationStore(operations);\n  const noEffect = async () => undefined;\n  const runner = createOperationRunner({\n    terminalBehavior: \"reuse_same_kind\",\n    requestHash: null,\n    store: journal,\n    observer: createOperationObserver(observation),\n    preparation: {\n      prepare: async () => prepared,\n      reserveOperation: noEffect,\n      releaseOperationReservation: noEffect,\n      authorizeOperation: async () => {\n        if (relayNow(clock) > request.expiresAt)\n          return relayFailure(\"relay_expired\", \"revocation consent expired before submission\");\n      },\n      abandonOperation: noEffect,\n      confirmOperationPublished: noEffect,\n      close: noEffect,\n    },\n    submission: {\n      async openSubmission(snapshot: PreparedUserOperation) {\n        const artifact = parseOwnerSigningArtifact(\n          JSON.parse(await openArtifact(kms, artifactRef)),\n        );\n        const signature = await restored.complete(artifact);\n        return submission.openSubmission(snapshot, signature);\n      },\n      close: () => submission.close(),\n    },\n  });\n  function runInput(timeoutMs: number) {\n    const now = Math.floor(relayNow(clock) / 1000);\n    return {\n      kind: \"revocation\",\n      key,\n      expectedUserOperationHash: prepared.userOperationHash,\n      preparedAt: now,\n      attemptedAt: now,\n      submittedAt: now,\n      observedAt: now,\n      timeoutMs,\n    };\n  }\n  return Object.freeze({\n    operationId,\n    userOperationHash: prepared.userOperationHash,\n    async start(timeoutMs: number) {\n      const existing = await journal.getExact(key, prepared.userOperationHash);\n      if (existing && existing.value.state !== \"prepared\")\n        return Object.freeze({ status: \"started\" as const, record: existing });\n      if (relayNow(clock) > request.expiresAt)\n        return relayFailure(\"relay_expired\", \"revocation consent expired before submission\");\n      return runner.resumePreparedOperation(runInput(timeoutMs));\n    },\n    observe: (timeoutMs: number) => runner.observeOperation(runInput(timeoutMs)),\n    close: () => runner.close(),\n  });\n}\n"],"mappings":";;;;;;;;AAwDA,eAAsB,mCACpB,OACiD;CACjD,MAAM,EAAE,OAAO,KAAK,OAAO,aAAa,YAAY,aAAa,eAAe;CAChF,MAAM,EAAE,SAAS,aAAa,MAAM,qBAAqB,QAAQ,gBAC/D,oBAAoB,aAAa,WAAW,CAC9C;CACA,IAAI,UAAU,YAAY,cAAc,SAAS,gBAAgB,MAC/D,OAAO,aAAa,yBAAyB,oCAAoC;CACnF,MAAM,cAAc,SAAS;CAC7B,MAAM,WAAW,MAAM,kCAAkC,EAAE,aAAa,QAAQ,eAAe,CAAC;CAChG,MAAM,WAAW,SAAS;CAC1B,MAAM,MAAM,OAAO,OAAO;EACxB,SAAS,SAAS;EAClB,SAAS,SAAS;EAClB,MAAM;CACR,CAAC;CACD,MAAM,UAAU,IAAI,eAAe,UAAU;CAC7C,MAAM,WAAW,YAAY,KAAA;CAC7B,MAAM,SAAS,sBAAsB;EACnC,kBAAkB;EAClB,aAAa;EACb,OAAO;EACP,UAAU,wBAAwB,WAAW;EAC7C,aAAa;GACX,SAAS,YAAY;GACrB,kBAAkB;GAClB,6BAA6B;GAC7B,oBAAoB,YAAY;IAC9B,IAAI,SAAS,KAAK,IAAI,QAAQ,WAC5B,OAAO,aAAa,iBAAiB,8CAA8C;GACvF;GACA,kBAAkB;GAClB,2BAA2B;GAC3B,OAAO;EACT;EACA,YAAY;GACV,MAAM,eAAe,UAAiC;IACpD,MAAM,WAAW,0BACf,KAAK,MAAM,MAAM,aAAa,KAAK,WAAW,CAAC,CACjD;IACA,MAAM,YAAY,MAAM,SAAS,SAAS,QAAQ;IAClD,OAAO,WAAW,eAAe,UAAU,SAAS;GACtD;GACA,aAAa,WAAW,MAAM;EAChC;CACF,CAAC;CACD,SAAS,SAAS,WAAmB;EACnC,MAAM,MAAM,KAAK,MAAM,SAAS,KAAK,IAAI,GAAI;EAC7C,OAAO;GACL,MAAM;GACN;GACA,2BAA2B,SAAS;GACpC,YAAY;GACZ,aAAa;GACb,aAAa;GACb,YAAY;GACZ;EACF;CACF;CACA,OAAO,OAAO,OAAO;EACnB;EACA,mBAAmB,SAAS;EAC5B,MAAM,MAAM,WAAmB;GAC7B,MAAM,WAAW,MAAM,QAAQ,SAAS,KAAK,SAAS,iBAAiB;GACvE,IAAI,YAAY,SAAS,MAAM,UAAU,YACvC,OAAO,OAAO,OAAO;IAAE,QAAQ;IAAoB,QAAQ;GAAS,CAAC;GACvE,IAAI,SAAS,KAAK,IAAI,QAAQ,WAC5B,OAAO,aAAa,iBAAiB,8CAA8C;GACrF,OAAO,OAAO,wBAAwB,SAAS,SAAS,CAAC;EAC3D;EACA,UAAU,cAAsB,OAAO,iBAAiB,SAAS,SAAS,CAAC;EAC3E,aAAa,OAAO,MAAM;CAC5B,CAAC;AACH"}

package/dist/kms-BWkywdJM.d.ts

@@ -0,0 +1,18 @@
+//#region src/security/kms.d.ts
+/**
+ * Deployment-owned encryption port.
+ *
+ * The relay stores only the opaque reference this port returns. It never sees a
+ * key, and plaintext never reaches the store.
+ *
+ * @author taek <leekt216@gmail.com>
+ */
+interface RelayKms {
+  /** Resolves to an opaque bounded string reference for the ciphertext. */
+  encrypt(plaintext: string): Promise<unknown>;
+  /** Resolves to the plaintext for a reference this port previously returned. */
+  decrypt(ciphertextRef: string): Promise<unknown>;
+}
+//#endregion
+export { RelayKms as t };
+//# sourceMappingURL=kms-BWkywdJM.d.ts.map

package/dist/kms-BWkywdJM.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms-BWkywdJM.d.ts","names":[],"sources":["../src/security/kms.ts"],"mappings":";;;;;;;;;UASiB;;EAEf,QAAQ,oBAAoB;;EAE5B,QAAQ,wBAAwB"}

package/dist/native.d.ts

@@ -1,30 +1,3 @@
-import { i as RelayClock, n as RelayCaller } from "./authentication-HUYWk5Y2.js";
-import { i as AuthorizationDecisionOutcome, t as RelayStore } from "./interface-WwvwWs8e.js";
-import { a as OwnerPhoneScopeProjection, i as OwnerPhoneRequestProjection, n as OAATH_NATIVE_PROJECTION_VERSION, o as ProjectOwnerPhoneRequestInput, r as OwnerPhonePushProjection, s as projectOwnerPhoneRequest, t as NATIVE_DISPLAY_PAYLOAD_LENGTH } from "./projection-g6k_CCUK.js";
-import { a as RelayKms, r as SubmittedAuthorizationDecision, t as AuthorizationDecisionCommand } from "./decision-dEe9n108.js";
-//#region src/native/decision.d.ts
-interface SubmitOwnerPhoneDecisionInput {
-  readonly store: RelayStore;
-  readonly clock: RelayClock;
-  readonly kms: RelayKms;
-  /** Authenticated `owner` caller; only the bound subject may decide. */
-  readonly caller: RelayCaller;
-  /** `operationId` from `projectOwnerPhoneRequest`. */
-  readonly operationId: string;
-  readonly command: AuthorizationDecisionCommand;
-  readonly codeTtlMs: number;
-}
-interface OwnerPhoneDecision {
-  readonly operationId: string;
-  /** The stored outcome, which on a replay may differ from the command sent. */
-  readonly outcome: AuthorizationDecisionOutcome;
-  readonly decidedAt: number;
-  /** `decided` performed the transition; `replayed` answered the stored one. */
-  readonly settlement: "decided" | "replayed";
-  /** One-time release material, on the deciding call only. */
-  readonly release: SubmittedAuthorizationDecision | null;
-}
-declare function submitOwnerPhoneDecision(input: SubmitOwnerPhoneDecisionInput): Promise<OwnerPhoneDecision>;
-//#endregion
-export { NATIVE_DISPLAY_PAYLOAD_LENGTH, OAATH_NATIVE_PROJECTION_VERSION, type OwnerPhoneDecision, type OwnerPhonePushProjection, type OwnerPhoneRequestProjection, type OwnerPhoneScopeProjection, type ProjectOwnerPhoneRequestInput, type SubmitOwnerPhoneDecisionInput, projectOwnerPhoneRequest, submitOwnerPhoneDecision };
-//# sourceMappingURL=native.d.ts.map
+import { a as ProjectOwnerPhoneRequestInput, c as OwnerPhoneRevocationDecision, d as OwnerPhonePermissionApprovals, f as PreparedOwnerPhonePermissionApproval, i as OwnerPhoneScopeProjection, l as OwnerPhoneRevocationScopeProjection, n as OwnerPhonePushProjection, o as projectOwnerPhonePermissionSigning, r as OwnerPhoneRequestProjection, s as projectOwnerPhoneRequest, t as OAATH_NATIVE_PROJECTION_VERSION, u as projectOwnerPhoneRevocation } from "./projection-B7IB9irs.js";
+import { A as listOwnerPhoneRequests, B as createMemoryOwnerDeviceCredentialStore, C as RequestOwnerPhoneRevocationInput, D as submitOwnerPhoneRevocationDecision, E as requestOwnerPhoneRevocation, F as OAATH_OWNER_DEVICE_CREDENTIAL_VERSION, I as OwnerDeviceAuthentication, L as OwnerDeviceCredentialRecord, M as OwnerPhoneDecision, N as SubmitOwnerPhoneDecisionInput, O as OAATH_NATIVE_INBOX_VERSION, P as submitOwnerPhoneDecision, R as OwnerDeviceCredentialStore, S as OwnerPhoneRevocationStatus, T as fetchOwnerPhoneRevocation, V as createOwnerDeviceAuthentication, j as NATIVE_DISPLAY_PAYLOAD_LENGTH, k as OwnerPhoneInbox, w as fetchClientPhoneRevocation, z as OwnerDeviceReference } from "./service-J51bOVe6.js";
+export { NATIVE_DISPLAY_PAYLOAD_LENGTH, OAATH_NATIVE_INBOX_VERSION, OAATH_NATIVE_PROJECTION_VERSION, OAATH_OWNER_DEVICE_CREDENTIAL_VERSION, type OwnerDeviceAuthentication, type OwnerDeviceCredentialRecord, type OwnerDeviceCredentialStore, type OwnerDeviceReference, type OwnerPhoneDecision, type OwnerPhoneInbox, type OwnerPhonePermissionApprovals, type OwnerPhonePushProjection, type OwnerPhoneRequestProjection, type OwnerPhoneRevocationDecision, type OwnerPhoneRevocationScopeProjection, type OwnerPhoneRevocationStatus, type OwnerPhoneScopeProjection, type PreparedOwnerPhonePermissionApproval, type ProjectOwnerPhoneRequestInput, type RequestOwnerPhoneRevocationInput, type SubmitOwnerPhoneDecisionInput, createMemoryOwnerDeviceCredentialStore, createOwnerDeviceAuthentication, fetchClientPhoneRevocation, fetchOwnerPhoneRevocation, listOwnerPhoneRequests, projectOwnerPhonePermissionSigning, projectOwnerPhoneRequest, projectOwnerPhoneRevocation, requestOwnerPhoneRevocation, submitOwnerPhoneDecision, submitOwnerPhoneRevocationDecision };

package/dist/native.js

@@ -1,2 +1,115 @@
-import { i as submitOwnerPhoneDecision, n as OAATH_NATIVE_PROJECTION_VERSION, r as projectOwnerPhoneRequest, t as NATIVE_DISPLAY_PAYLOAD_LENGTH } from "./projection-dGIkE0rI.js";
-export { NATIVE_DISPLAY_PAYLOAD_LENGTH, OAATH_NATIVE_PROJECTION_VERSION, projectOwnerPhoneRequest, submitOwnerPhoneDecision };
+import { b as relayFailure, c as canonicalIdentifier } from "./records-BQNDxbPg.js";
+import { n as randomIdentifier, r as sha256Base64Url } from "./challenge-DmpGSogj.js";
+import { a as submitOwnerPhoneRevocationDecision, c as projectOwnerPhonePermissionSigning, h as NATIVE_DISPLAY_PAYLOAD_LENGTH, i as requestOwnerPhoneRevocation, l as projectOwnerPhoneRequest, n as fetchOwnerPhoneRevocation, o as projectOwnerPhoneRevocation, s as OAATH_NATIVE_PROJECTION_VERSION, t as fetchClientPhoneRevocation } from "./service-Cf4f-9KP.js";
+import { n as listOwnerPhoneRequests, r as submitOwnerPhoneDecision, t as OAATH_NATIVE_INBOX_VERSION } from "./inbox-B80EUVht.js";
+import { captureRecord, exactCapturedRecord } from "@oaath/protocol";
+//#region src/native/authentication.ts
+const OAATH_OWNER_DEVICE_CREDENTIAL_VERSION = "oaath.owner-device-credential/v1";
+const CREDENTIAL = /^[A-Za-z0-9_-]{43}$/u;
+function deviceReference(device) {
+	return Object.freeze({
+		workspaceId: canonicalIdentifier(device.workspaceId, "workspaceId", "relay_request_invalid"),
+		ownerDeviceId: canonicalIdentifier(device.ownerDeviceId, "ownerDeviceId", "relay_request_invalid")
+	});
+}
+function captureCredential(value) {
+	const code = "relay_record_unreadable";
+	const fail = (message) => relayFailure(code, message);
+	const record = exactCapturedRecord(captureRecord(value, "owner device credential", /* @__PURE__ */ new WeakSet(), fail), [
+		"version",
+		"credentialHash",
+		"workspaceId",
+		"ownerDeviceId",
+		"subject",
+		"revoked"
+	], "owner device credential", fail);
+	if (record.version !== "oaath.owner-device-credential/v1" || typeof record.credentialHash !== "string" || !CREDENTIAL.test(record.credentialHash) || typeof record.revoked !== "boolean") return fail("owner device credential is invalid");
+	return Object.freeze({
+		version: OAATH_OWNER_DEVICE_CREDENTIAL_VERSION,
+		credentialHash: record.credentialHash,
+		workspaceId: canonicalIdentifier(record.workspaceId, "workspaceId", code),
+		ownerDeviceId: canonicalIdentifier(record.ownerDeviceId, "ownerDeviceId", code),
+		subject: canonicalIdentifier(record.subject, "subject", code),
+		revoked: record.revoked
+	});
+}
+/**
+* One active -> revoked transition per credential hash, separate from account
+* authority. Directory identity is checked at issuance and authentication;
+* an issued credential can never be retargeted to a changed owner subject.
+* No cache, operation lane, retries or owned connections. Recreated instances
+* read the same stores. The deployment owns pool shutdown and pairing delivery.
+* Explicit later issuance creates a new credential; it cannot revive an old one.
+*/
+function createOwnerDeviceAuthentication(options) {
+	const { store, directory } = options;
+	async function enrolled(reference) {
+		return (await directory.read())?.directory.ownerDevices.find((device) => device.workspaceId === reference.workspaceId && device.ownerDeviceId === reference.ownerDeviceId);
+	}
+	return Object.freeze({
+		async issue(input) {
+			const reference = deviceReference(input);
+			const device = await enrolled(reference);
+			if (!device) return relayFailure("relay_not_found", "owner device is not enrolled");
+			const subject = canonicalIdentifier(device.subject, "owner subject", "relay_request_invalid");
+			const credential = randomIdentifier();
+			const record = Object.freeze({
+				version: OAATH_OWNER_DEVICE_CREDENTIAL_VERSION,
+				credentialHash: await sha256Base64Url(credential),
+				...reference,
+				subject,
+				revoked: false
+			});
+			if (await store.insert(record) !== true) return relayFailure("relay_internal", "owner device credential was not issued");
+			return credential;
+		},
+		async authenticate(request) {
+			const header = request.headers.get("authorization");
+			if (!header?.startsWith("Bearer ")) return null;
+			const credential = header.slice(7);
+			if (!CREDENTIAL.test(credential)) return null;
+			const hash = await sha256Base64Url(credential);
+			const stored = await store.read(hash);
+			if (stored === null) return null;
+			const record = captureCredential(stored);
+			if (record.credentialHash !== hash) return relayFailure("relay_record_unreadable", "owner device credential binding differs");
+			if (record.revoked) return null;
+			const device = await enrolled(record);
+			if (!device || device.subject !== record.subject) return null;
+			return Object.freeze({
+				role: "owner",
+				clientId: record.ownerDeviceId,
+				subject: record.subject,
+				redirectUris: Object.freeze([]),
+				organizationAudience: null
+			});
+		},
+		revoke(device) {
+			return store.revoke(deviceReference(device));
+		}
+	});
+}
+/** Ephemeral deployment adapter; the authentication service owns no local cache. */
+function createMemoryOwnerDeviceCredentialStore() {
+	const records = /* @__PURE__ */ new Map();
+	return {
+		async read(hash) {
+			return records.get(hash) ?? null;
+		},
+		async insert(record) {
+			if (records.has(record.credentialHash)) return false;
+			records.set(record.credentialHash, Object.freeze({ ...record }));
+			return true;
+		},
+		async revoke(device) {
+			for (const [hash, record] of records) if (record.workspaceId === device.workspaceId && record.ownerDeviceId === device.ownerDeviceId && !record.revoked) records.set(hash, Object.freeze({
+				...record,
+				revoked: true
+			}));
+		}
+	};
+}
+//#endregion
+export { NATIVE_DISPLAY_PAYLOAD_LENGTH, OAATH_NATIVE_INBOX_VERSION, OAATH_NATIVE_PROJECTION_VERSION, OAATH_OWNER_DEVICE_CREDENTIAL_VERSION, createMemoryOwnerDeviceCredentialStore, createOwnerDeviceAuthentication, fetchClientPhoneRevocation, fetchOwnerPhoneRevocation, listOwnerPhoneRequests, projectOwnerPhonePermissionSigning, projectOwnerPhoneRequest, projectOwnerPhoneRevocation, requestOwnerPhoneRevocation, submitOwnerPhoneDecision, submitOwnerPhoneRevocationDecision };
+
+//# sourceMappingURL=native.js.map

package/dist/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","names":[],"sources":["../src/native/authentication.ts"],"sourcesContent":["import { captureRecord, exactCapturedRecord } from \"@oaath/protocol\";\nimport { randomIdentifier, sha256Base64Url } from \"../authorization/challenge.js\";\nimport type { DirectoryOwnerDevice } from \"../directory/records.js\";\nimport type { ServiceDirectory } from \"../directory/service.js\";\nimport { relayFailure } from \"../relay/errors.js\";\nimport type { RelayAuthentication, RelayCaller } from \"../security/authentication.js\";\nimport { canonicalIdentifier } from \"../store/records.js\";\n\nexport const OAATH_OWNER_DEVICE_CREDENTIAL_VERSION = \"oaath.owner-device-credential/v1\" as const;\nexport type OwnerDeviceReference = Pick<DirectoryOwnerDevice, \"workspaceId\" | \"ownerDeviceId\">;\n\n/** Authentication binding captured at issuance; contains no bearer or owner key. */\nexport interface OwnerDeviceCredentialRecord extends DirectoryOwnerDevice {\n  readonly version: typeof OAATH_OWNER_DEVICE_CREDENTIAL_VERSION;\n  readonly credentialHash: string;\n  readonly revoked: boolean;\n}\n\nexport interface OwnerDeviceCredentialStore {\n  /** Null means absent. Unreadable or unavailable storage must throw. */\n  read(credentialHash: string): Promise<unknown>;\n  /** Insert an immutable binding once. Never replace a revoked record. */\n  insert(record: Readonly<OwnerDeviceCredentialRecord>): Promise<boolean>;\n  /** Atomically revoke all credentials already issued for this device. Idempotent. */\n  revoke(device: Readonly<OwnerDeviceReference>): Promise<void>;\n}\n\nexport interface OwnerDeviceAuthentication extends RelayAuthentication {\n  authenticate(request: Request): Promise<Readonly<RelayCaller> | null>;\n  /**\n   * Deployment administration only, after authenticated pairing/enrollment.\n   * Returns a fresh 32-byte base64url bearer after its hash is stored. A lost\n   * write response throws; nothing is returned and no write is retried.\n   */\n  issue(device: Readonly<OwnerDeviceReference>): Promise<string>;\n  /** Revokes relay access only. Does not uninstall permissions or delete keys/accounts. */\n  revoke(device: Readonly<OwnerDeviceReference>): Promise<void>;\n}\n\nconst CREDENTIAL = /^[A-Za-z0-9_-]{43}$/u;\n\nfunction deviceReference(device: Readonly<OwnerDeviceReference>): OwnerDeviceReference {\n  return Object.freeze({\n    workspaceId: canonicalIdentifier(device.workspaceId, \"workspaceId\", \"relay_request_invalid\"),\n    ownerDeviceId: canonicalIdentifier(\n      device.ownerDeviceId,\n      \"ownerDeviceId\",\n      \"relay_request_invalid\",\n    ),\n  });\n}\n\nfunction captureCredential(value: unknown): Readonly<OwnerDeviceCredentialRecord> {\n  const code = \"relay_record_unreadable\";\n  const fail = (message: string): never => relayFailure(code, message);\n  const record = exactCapturedRecord(\n    captureRecord(value, \"owner device credential\", new WeakSet(), fail),\n    [\"version\", \"credentialHash\", \"workspaceId\", \"ownerDeviceId\", \"subject\", \"revoked\"],\n    \"owner device credential\",\n    fail,\n  );\n  if (\n    record.version !== OAATH_OWNER_DEVICE_CREDENTIAL_VERSION ||\n    typeof record.credentialHash !== \"string\" ||\n    !CREDENTIAL.test(record.credentialHash) ||\n    typeof record.revoked !== \"boolean\"\n  )\n    return fail(\"owner device credential is invalid\");\n  return Object.freeze({\n    version: OAATH_OWNER_DEVICE_CREDENTIAL_VERSION,\n    credentialHash: record.credentialHash,\n    workspaceId: canonicalIdentifier(record.workspaceId, \"workspaceId\", code),\n    ownerDeviceId: canonicalIdentifier(record.ownerDeviceId, \"ownerDeviceId\", code),\n    subject: canonicalIdentifier(record.subject, \"subject\", code),\n    revoked: record.revoked,\n  });\n}\n\n/**\n * One active -> revoked transition per credential hash, separate from account\n * authority. Directory identity is checked at issuance and authentication;\n * an issued credential can never be retargeted to a changed owner subject.\n * No cache, operation lane, retries or owned connections. Recreated instances\n * read the same stores. The deployment owns pool shutdown and pairing delivery.\n * Explicit later issuance creates a new credential; it cannot revive an old one.\n */\nexport function createOwnerDeviceAuthentication(options: {\n  readonly store: OwnerDeviceCredentialStore;\n  readonly directory: Pick<ServiceDirectory, \"read\">;\n}): Readonly<OwnerDeviceAuthentication> {\n  const { store, directory } = options;\n  async function enrolled(reference: OwnerDeviceReference) {\n    const snapshot = await directory.read();\n    return snapshot?.directory.ownerDevices.find(\n      (device) =>\n        device.workspaceId === reference.workspaceId &&\n        device.ownerDeviceId === reference.ownerDeviceId,\n    );\n  }\n  return Object.freeze({\n    async issue(input: Readonly<OwnerDeviceReference>): Promise<string> {\n      const reference = deviceReference(input);\n      const device = await enrolled(reference);\n      if (!device) return relayFailure(\"relay_not_found\", \"owner device is not enrolled\");\n      const subject = canonicalIdentifier(device.subject, \"owner subject\", \"relay_request_invalid\");\n      const credential = randomIdentifier();\n      const record = Object.freeze({\n        version: OAATH_OWNER_DEVICE_CREDENTIAL_VERSION,\n        credentialHash: await sha256Base64Url(credential),\n        ...reference,\n        subject,\n        revoked: false,\n      });\n      if ((await store.insert(record)) !== true)\n        return relayFailure(\"relay_internal\", \"owner device credential was not issued\");\n      return credential;\n    },\n    async authenticate(request: Request): Promise<Readonly<RelayCaller> | null> {\n      const header = request.headers.get(\"authorization\");\n      if (!header?.startsWith(\"Bearer \")) return null;\n      const credential = header.slice(7);\n      if (!CREDENTIAL.test(credential)) return null;\n      const hash = await sha256Base64Url(credential);\n      const stored = await store.read(hash);\n      if (stored === null) return null;\n      const record = captureCredential(stored);\n      if (record.credentialHash !== hash)\n        return relayFailure(\"relay_record_unreadable\", \"owner device credential binding differs\");\n      if (record.revoked) return null;\n      const device = await enrolled(record);\n      if (!device || device.subject !== record.subject) return null;\n      return Object.freeze({\n        role: \"owner\",\n        clientId: record.ownerDeviceId,\n        subject: record.subject,\n        redirectUris: Object.freeze([]),\n        organizationAudience: null,\n      });\n    },\n    revoke(device: Readonly<OwnerDeviceReference>): Promise<void> {\n      return store.revoke(deviceReference(device));\n    },\n  });\n}\n\n/** Ephemeral deployment adapter; the authentication service owns no local cache. */\nexport function createMemoryOwnerDeviceCredentialStore(): OwnerDeviceCredentialStore {\n  const records = new Map<string, Readonly<OwnerDeviceCredentialRecord>>();\n  return {\n    async read(hash) {\n      return records.get(hash) ?? null;\n    },\n    async insert(record) {\n      if (records.has(record.credentialHash)) return false;\n      records.set(record.credentialHash, Object.freeze({ ...record }));\n      return true;\n    },\n    async revoke(device) {\n      for (const [hash, record] of records) {\n        if (\n          record.workspaceId === device.workspaceId &&\n          record.ownerDeviceId === device.ownerDeviceId &&\n          !record.revoked\n        )\n          records.set(hash, Object.freeze({ ...record, revoked: true }));\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;AAQA,MAAa,wCAAwC;AA+BrD,MAAM,aAAa;AAEnB,SAAS,gBAAgB,QAA8D;CACrF,OAAO,OAAO,OAAO;EACnB,aAAa,oBAAoB,OAAO,aAAa,eAAe,uBAAuB;EAC3F,eAAe,oBACb,OAAO,eACP,iBACA,uBACF;CACF,CAAC;AACH;AAEA,SAAS,kBAAkB,OAAuD;CAChF,MAAM,OAAO;CACb,MAAM,QAAQ,YAA2B,aAAa,MAAM,OAAO;CACnE,MAAM,SAAS,oBACb,cAAc,OAAO,2CAA2B,IAAI,QAAQ,GAAG,IAAI,GACnE;EAAC;EAAW;EAAkB;EAAe;EAAiB;EAAW;CAAS,GAClF,2BACA,IACF;CACA,IACE,OAAO,YAAA,sCACP,OAAO,OAAO,mBAAmB,YACjC,CAAC,WAAW,KAAK,OAAO,cAAc,KACtC,OAAO,OAAO,YAAY,WAE1B,OAAO,KAAK,oCAAoC;CAClD,OAAO,OAAO,OAAO;EACnB,SAAS;EACT,gBAAgB,OAAO;EACvB,aAAa,oBAAoB,OAAO,aAAa,eAAe,IAAI;EACxE,eAAe,oBAAoB,OAAO,eAAe,iBAAiB,IAAI;EAC9E,SAAS,oBAAoB,OAAO,SAAS,WAAW,IAAI;EAC5D,SAAS,OAAO;CAClB,CAAC;AACH;;;;;;;;;AAUA,SAAgB,gCAAgC,SAGR;CACtC,MAAM,EAAE,OAAO,cAAc;CAC7B,eAAe,SAAS,WAAiC;EAEvD,QAAO,MADgB,UAAU,KAAK,EAAA,EACrB,UAAU,aAAa,MACrC,WACC,OAAO,gBAAgB,UAAU,eACjC,OAAO,kBAAkB,UAAU,aACvC;CACF;CACA,OAAO,OAAO,OAAO;EACnB,MAAM,MAAM,OAAwD;GAClE,MAAM,YAAY,gBAAgB,KAAK;GACvC,MAAM,SAAS,MAAM,SAAS,SAAS;GACvC,IAAI,CAAC,QAAQ,OAAO,aAAa,mBAAmB,8BAA8B;GAClF,MAAM,UAAU,oBAAoB,OAAO,SAAS,iBAAiB,uBAAuB;GAC5F,MAAM,aAAa,iBAAiB;GACpC,MAAM,SAAS,OAAO,OAAO;IAC3B,SAAS;IACT,gBAAgB,MAAM,gBAAgB,UAAU;IAChD,GAAG;IACH;IACA,SAAS;GACX,CAAC;GACD,IAAK,MAAM,MAAM,OAAO,MAAM,MAAO,MACnC,OAAO,aAAa,kBAAkB,wCAAwC;GAChF,OAAO;EACT;EACA,MAAM,aAAa,SAAyD;GAC1E,MAAM,SAAS,QAAQ,QAAQ,IAAI,eAAe;GAClD,IAAI,CAAC,QAAQ,WAAW,SAAS,GAAG,OAAO;GAC3C,MAAM,aAAa,OAAO,MAAM,CAAC;GACjC,IAAI,CAAC,WAAW,KAAK,UAAU,GAAG,OAAO;GACzC,MAAM,OAAO,MAAM,gBAAgB,UAAU;GAC7C,MAAM,SAAS,MAAM,MAAM,KAAK,IAAI;GACpC,IAAI,WAAW,MAAM,OAAO;GAC5B,MAAM,SAAS,kBAAkB,MAAM;GACvC,IAAI,OAAO,mBAAmB,MAC5B,OAAO,aAAa,2BAA2B,yCAAyC;GAC1F,IAAI,OAAO,SAAS,OAAO;GAC3B,MAAM,SAAS,MAAM,SAAS,MAAM;GACpC,IAAI,CAAC,UAAU,OAAO,YAAY,OAAO,SAAS,OAAO;GACzD,OAAO,OAAO,OAAO;IACnB,MAAM;IACN,UAAU,OAAO;IACjB,SAAS,OAAO;IAChB,cAAc,OAAO,OAAO,CAAC,CAAC;IAC9B,sBAAsB;GACxB,CAAC;EACH;EACA,OAAO,QAAuD;GAC5D,OAAO,MAAM,OAAO,gBAAgB,MAAM,CAAC;EAC7C;CACF,CAAC;AACH;;AAGA,SAAgB,yCAAqE;CACnF,MAAM,0BAAU,IAAI,IAAmD;CACvE,OAAO;EACL,MAAM,KAAK,MAAM;GACf,OAAO,QAAQ,IAAI,IAAI,KAAK;EAC9B;EACA,MAAM,OAAO,QAAQ;GACnB,IAAI,QAAQ,IAAI,OAAO,cAAc,GAAG,OAAO;GAC/C,QAAQ,IAAI,OAAO,gBAAgB,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;GAC/D,OAAO;EACT;EACA,MAAM,OAAO,QAAQ;GACnB,KAAK,MAAM,CAAC,MAAM,WAAW,SAC3B,IACE,OAAO,gBAAgB,OAAO,eAC9B,OAAO,kBAAkB,OAAO,iBAChC,CAAC,OAAO,SAER,QAAQ,IAAI,MAAM,OAAO,OAAO;IAAE,GAAG;IAAQ,SAAS;GAAK,CAAC,CAAC;EAEnE;CACF;AACF"}