@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/errors/catalog.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Typed error catalog mapping to Vana Data Portability Protocol spec §8.2.
+ */
+export declare class ProtocolError extends Error {
+    readonly code: number;
+    readonly errorCode: string;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(code: number, errorCode: string, message: string, details?: Record<string, unknown> | undefined);
+    toJSON(): Record<string, unknown>;
+}
+export declare class MissingAuthError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class InvalidSignatureError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class UnregisteredBuilderError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class NotOwnerError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class ExpiredTokenError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class GrantRequiredError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class GrantExpiredError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class GrantRevokedError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class ScopeMismatchError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class GrantOwnerMismatchError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class FeeRequiredError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class PsUnavailableError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class ServerNotConfiguredError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class SignedArtifactMissingError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class SignedArtifactInvalidError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class ServerSigningUnavailableError extends ProtocolError {
+    constructor();
+}
+export declare class ContentTooLargeError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class LineageInvalidError extends ProtocolError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+export declare class LineageScopeUnderSourcePrefixError extends ProtocolError {
+    constructor(details: {
+        scope: string;
+        sourceScope: string;
+    });
+}
+export declare class LineageSourceUnknownError extends ProtocolError {
+    constructor(details: {
+        unknown: string[];
+    });
+}
+export declare class LineageSourceLookupFailedError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class LineageUnavailableError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class LineageGatewayError extends ProtocolError {
+    constructor(details: {
+        status: number;
+        body: unknown;
+    });
+}
+export declare class LineageCascadeUnavailableError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class InvalidCascadeError extends ProtocolError {
+    constructor(details: {
+        cascade: string;
+    });
+}
+export declare class DeleteTombstoneFailedError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class DataDeletedError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class DerivativeQuestionInvalidError extends ProtocolError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+export declare class DerivativeQuestionNotFoundError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class DerivativeDerivedScopeRequiredError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+export declare class DerivativeCycleError extends ProtocolError {
+    constructor(details: {
+        derivedScope: string;
+        path: string[];
+    });
+}
+export declare class DerivativeSourceNotGrantedError extends ProtocolError {
+    constructor(details: {
+        scopes: string[];
+    });
+}
+export declare class DerivativeComputeUnavailableError extends ProtocolError {
+    constructor(details?: Record<string, unknown>);
+}
+//# sourceMappingURL=catalog.d.ts.map

package/dist/errors/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/errors/catalog.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,aAAc,SAAQ,KAAK;aAEpB,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,MAAM;aAEjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAHjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjC,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;IAMnD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAUlC;AAID,qBAAa,gBAAiB,SAAQ,aAAa;gBACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,qBAAsB,SAAQ,aAAa;gBAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,wBAAyB,SAAQ,aAAa;gBAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,aAAc,SAAQ,aAAa;gBAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,iBAAkB,SAAQ,aAAa;gBACtC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAID,qBAAa,kBAAmB,SAAQ,aAAa;gBACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,iBAAkB,SAAQ,aAAa;gBACtC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,iBAAkB,SAAQ,aAAa;gBACtC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,kBAAmB,SAAQ,aAAa;gBACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,uBAAwB,SAAQ,aAAa;gBAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAED,qBAAa,gBAAiB,SAAQ,aAAa;gBACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,kBAAmB,SAAQ,aAAa;gBACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAED,qBAAa,wBAAyB,SAAQ,aAAa;gBAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,0BAA2B,SAAQ,aAAa;gBAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAED,qBAAa,0BAA2B,SAAQ,aAAa;gBAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAED,qBAAa,6BAA8B,SAAQ,aAAa;;CAQ/D;AAID,qBAAa,oBAAqB,SAAQ,aAAa;gBACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAID,qBAAa,mBAAoB,SAAQ,aAAa;gBACxC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG/D;AAED,qBAAa,kCAAmC,SAAQ,aAAa;gBACvD,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;CAQ5D;AAED,qBAAa,yBAA0B,SAAQ,aAAa;gBAC9C,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;CAQ3C;AAED,qBAAa,8BAA+B,SAAQ,aAAa;gBACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAED,qBAAa,uBAAwB,SAAQ,aAAa;gBAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAED,qBAAa,mBAAoB,SAAQ,aAAa;gBACxC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE;CAQvD;AAED,qBAAa,8BAA+B,SAAQ,aAAa;gBACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAED,qBAAa,mBAAoB,SAAQ,aAAa;gBACxC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;CAQzC;AAID,qBAAa,0BAA2B,SAAQ,aAAa;gBAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAID,qBAAa,gBAAiB,SAAQ,aAAa;gBACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAID,qBAAa,8BAA+B,SAAQ,aAAa;gBACnD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG/D;AAED,qBAAa,+BAAgC,SAAQ,aAAa;gBACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG9C;AAED,qBAAa,mCAAoC,SAAQ,aAAa;gBACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C;AAED,qBAAa,oBAAqB,SAAQ,aAAa;gBACzC,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE;CAQ9D;AAED,qBAAa,+BAAgC,SAAQ,aAAa;gBACpD,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;CAQ1C;AAED,qBAAa,iCAAkC,SAAQ,aAAa;gBACtD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ9C"}

package/dist/errors/catalog.js

@@ -0,0 +1,198 @@
+/**
+ * Typed error catalog mapping to Vana Data Portability Protocol spec §8.2.
+ */
+export class ProtocolError extends Error {
+    code;
+    errorCode;
+    details;
+    constructor(code, errorCode, message, details) {
+        super(message);
+        this.code = code;
+        this.errorCode = errorCode;
+        this.details = details;
+        this.name = this.constructor.name;
+    }
+    toJSON() {
+        return {
+            error: {
+                code: this.code,
+                errorCode: this.errorCode,
+                message: this.message,
+                ...(this.details !== undefined && { details: this.details }),
+            },
+        };
+    }
+}
+// 401 — Authentication errors
+export class MissingAuthError extends ProtocolError {
+    constructor(details) {
+        super(401, "MISSING_AUTH", "Missing authentication", details);
+    }
+}
+export class InvalidSignatureError extends ProtocolError {
+    constructor(details) {
+        super(401, "INVALID_SIGNATURE", "Invalid signature", details);
+    }
+}
+export class UnregisteredBuilderError extends ProtocolError {
+    constructor(details) {
+        super(401, "UNREGISTERED_BUILDER", "Unregistered builder", details);
+    }
+}
+export class NotOwnerError extends ProtocolError {
+    constructor(details) {
+        super(401, "NOT_OWNER", "Not the owner", details);
+    }
+}
+export class ExpiredTokenError extends ProtocolError {
+    constructor(details) {
+        super(401, "EXPIRED_TOKEN", "Token has expired", details);
+    }
+}
+// 403 — Authorization/grant errors
+export class GrantRequiredError extends ProtocolError {
+    constructor(details) {
+        super(403, "GRANT_REQUIRED", "Grant required", details);
+    }
+}
+export class GrantExpiredError extends ProtocolError {
+    constructor(details) {
+        super(403, "GRANT_EXPIRED", "Grant has expired", details);
+    }
+}
+export class GrantRevokedError extends ProtocolError {
+    constructor(details) {
+        super(403, "GRANT_REVOKED", "Grant has been revoked", details);
+    }
+}
+export class ScopeMismatchError extends ProtocolError {
+    constructor(details) {
+        super(403, "SCOPE_MISMATCH", "Scope not granted", details);
+    }
+}
+export class GrantOwnerMismatchError extends ProtocolError {
+    constructor(details) {
+        super(403, "GRANT_OWNER_MISMATCH", "Grant was not issued by this server's owner", details);
+    }
+}
+export class FeeRequiredError extends ProtocolError {
+    constructor(details) {
+        super(403, "FEE_REQUIRED", "Required fee has not been paid", details);
+    }
+}
+export class PsUnavailableError extends ProtocolError {
+    constructor(details) {
+        super(503, "PS_UNAVAILABLE", "Personal Server runtime unavailable", details);
+    }
+}
+export class ServerNotConfiguredError extends ProtocolError {
+    constructor(details) {
+        super(500, "SERVER_NOT_CONFIGURED", "Server is not configured", details);
+    }
+}
+export class SignedArtifactMissingError extends ProtocolError {
+    constructor(details) {
+        super(403, "SIGNED_ARTIFACT_MISSING", "Signed artifact is missing", details);
+    }
+}
+export class SignedArtifactInvalidError extends ProtocolError {
+    constructor(details) {
+        super(403, "SIGNED_ARTIFACT_INVALID", "Signed artifact is invalid", details);
+    }
+}
+export class ServerSigningUnavailableError extends ProtocolError {
+    constructor() {
+        super(500, "SERVER_SIGNING_UNAVAILABLE", "Server signing is unavailable in this runtime");
+    }
+}
+// 413 — Payload errors
+export class ContentTooLargeError extends ProtocolError {
+    constructor(details) {
+        super(413, "CONTENT_TOO_LARGE", "Content too large", details);
+    }
+}
+// Derivative data / lineage (see docs/derivative-data-api.md)
+export class LineageInvalidError extends ProtocolError {
+    constructor(message, details) {
+        super(400, "LINEAGE_INVALID", message, details);
+    }
+}
+export class LineageScopeUnderSourcePrefixError extends ProtocolError {
+    constructor(details) {
+        super(400, "LINEAGE_SCOPE_UNDER_SOURCE_PREFIX", `Derived scope "${details.scope}" shares its first segment with source scope "${details.sourceScope}"; a wildcard grant on that namespace would read both. Name derivatives under their own namespace.`, details);
+    }
+}
+export class LineageSourceUnknownError extends ProtocolError {
+    constructor(details) {
+        super(422, "LINEAGE_SOURCE_UNKNOWN", "One or more lineage sources are not data points of this owner", details);
+    }
+}
+export class LineageSourceLookupFailedError extends ProtocolError {
+    constructor(details) {
+        super(502, "LINEAGE_SOURCE_LOOKUP_FAILED", "Could not resolve a lineage source at the gateway", details);
+    }
+}
+export class LineageUnavailableError extends ProtocolError {
+    constructor(details) {
+        super(503, "LINEAGE_UNAVAILABLE", "This server is not configured to reach the gateway lineage graph (gateway URL or server signing key missing)", details);
+    }
+}
+export class LineageGatewayError extends ProtocolError {
+    constructor(details) {
+        super(502, "LINEAGE_GATEWAY_ERROR", `Gateway lineage request failed with status ${details.status}`, details);
+    }
+}
+export class LineageCascadeUnavailableError extends ProtocolError {
+    constructor(details) {
+        super(501, "LINEAGE_CASCADE_UNAVAILABLE", "DELETE ?cascade=lineage is specified but not implemented yet: the lineage walk that finds every derivative is missing. Delete scopes one at a time; each single-scope delete is durable.", details);
+    }
+}
+export class InvalidCascadeError extends ProtocolError {
+    constructor(details) {
+        super(400, "INVALID_CASCADE", 'Unsupported cascade mode; the only supported value is "lineage"', details);
+    }
+}
+// 502 - Upstream (gateway) errors
+export class DeleteTombstoneFailedError extends ProtocolError {
+    constructor(details) {
+        super(502, "DELETE_TOMBSTONE_FAILED", "Gateway did not acknowledge the deletion tombstone; nothing was deleted", details);
+    }
+}
+// 410 - Deleted resources
+export class DataDeletedError extends ProtocolError {
+    constructor(details) {
+        super(410, "DATA_DELETED", "Data point has been deleted", details);
+    }
+}
+// Derivative compute (see docs/derivative-data-api.md, "Compute")
+export class DerivativeQuestionInvalidError extends ProtocolError {
+    constructor(message, details) {
+        super(400, "DERIVATIVE_QUESTION_INVALID", message, details);
+    }
+}
+export class DerivativeQuestionNotFoundError extends ProtocolError {
+    constructor(details) {
+        super(404, "DERIVATIVE_QUESTION_NOT_FOUND", "Question not found", details);
+    }
+}
+export class DerivativeDerivedScopeRequiredError extends ProtocolError {
+    constructor(details) {
+        super(400, "DERIVATIVE_DERIVED_SCOPE_REQUIRED", "Listing questions as a builder needs a derived scope: add ?derivedScope=<scope>. The unfiltered list is the owner's", details);
+    }
+}
+export class DerivativeCycleError extends ProtocolError {
+    constructor(details) {
+        super(409, "DERIVATIVE_CYCLE", `Registering this question would make "${details.derivedScope}" a transitive source of itself; recompute would never settle`, details);
+    }
+}
+export class DerivativeSourceNotGrantedError extends ProtocolError {
+    constructor(details) {
+        super(403, "DERIVATIVE_SOURCE_NOT_GRANTED", "The builder's grant does not cover reading every source scope of this question", details);
+    }
+}
+export class DerivativeComputeUnavailableError extends ProtocolError {
+    constructor(details) {
+        super(503, "DERIVATIVE_COMPUTE_UNAVAILABLE", "This server has no derivative compute configured", details);
+    }
+}
+//# sourceMappingURL=catalog.js.map

package/dist/errors/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/errors/catalog.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEpB;IACA;IAEA;IAJlB,YACkB,IAAY,EACZ,SAAiB,EACjC,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,SAAI,GAAJ,IAAI,CAAQ;QACZ,cAAS,GAAT,SAAS,CAAQ;QAEjB,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;aAC7D;SACF,CAAC;IACJ,CAAC;CACF;AAED,8BAA8B;AAE9B,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACjD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IACtD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,aAAa;IACzD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,aAAa;IAC9C,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,mCAAmC;AAEnC,MAAM,OAAO,kBAAmB,SAAQ,aAAa;IACnD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,aAAa;IACnD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,aAAa;IACxD,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,sBAAsB,EACtB,6CAA6C,EAC7C,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACjD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,aAAa;IACnD,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,gBAAgB,EAChB,qCAAqC,EACrC,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,aAAa;IACzD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,aAAa;IAC3D,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,yBAAyB,EACzB,4BAA4B,EAC5B,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,aAAa;IAC3D,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,yBAAyB,EACzB,4BAA4B,EAC5B,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,aAAa;IAC9D;QACE,KAAK,CACH,GAAG,EACH,4BAA4B,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;CACF;AAED,uBAAuB;AAEvB,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAED,8DAA8D;AAE9D,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IACpD,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,OAAO,kCAAmC,SAAQ,aAAa;IACnE,YAAY,OAA+C;QACzD,KAAK,CACH,GAAG,EACH,mCAAmC,EACnC,kBAAkB,OAAO,CAAC,KAAK,iDAAiD,OAAO,CAAC,WAAW,oGAAoG,EACvM,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,aAAa;IAC1D,YAAY,OAA8B;QACxC,KAAK,CACH,GAAG,EACH,wBAAwB,EACxB,+DAA+D,EAC/D,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,8BAA+B,SAAQ,aAAa;IAC/D,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,8BAA8B,EAC9B,mDAAmD,EACnD,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,aAAa;IACxD,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,qBAAqB,EACrB,8GAA8G,EAC9G,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IACpD,YAAY,OAA0C;QACpD,KAAK,CACH,GAAG,EACH,uBAAuB,EACvB,8CAA8C,OAAO,CAAC,MAAM,EAAE,EAC9D,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,8BAA+B,SAAQ,aAAa;IAC/D,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,6BAA6B,EAC7B,0LAA0L,EAC1L,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IACpD,YAAY,OAA4B;QACtC,KAAK,CACH,GAAG,EACH,iBAAiB,EACjB,iEAAiE,EACjE,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,kCAAkC;AAElC,MAAM,OAAO,0BAA2B,SAAQ,aAAa;IAC3D,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,yBAAyB,EACzB,yEAAyE,EACzE,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,0BAA0B;AAE1B,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACjD,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,6BAA6B,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;CACF;AAED,kEAAkE;AAElE,MAAM,OAAO,8BAA+B,SAAQ,aAAa;IAC/D,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,GAAG,EAAE,6BAA6B,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,MAAM,OAAO,+BAAgC,SAAQ,aAAa;IAChE,YAAY,OAAiC;QAC3C,KAAK,CAAC,GAAG,EAAE,+BAA+B,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,MAAM,OAAO,mCAAoC,SAAQ,aAAa;IACpE,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,mCAAmC,EACnC,qHAAqH,EACrH,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,YAAY,OAAiD;QAC3D,KAAK,CACH,GAAG,EACH,kBAAkB,EAClB,yCAAyC,OAAO,CAAC,YAAY,+DAA+D,EAC5H,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,+BAAgC,SAAQ,aAAa;IAChE,YAAY,OAA6B;QACvC,KAAK,CACH,GAAG,EACH,+BAA+B,EAC/B,gFAAgF,EAChF,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,iCAAkC,SAAQ,aAAa;IAClE,YAAY,OAAiC;QAC3C,KAAK,CACH,GAAG,EACH,gCAAgC,EAChC,kDAAkD,EAClD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/errors/pdpp-catalog.d.ts

@@ -0,0 +1,36 @@
+/**
+ * PDPP error catalog, spec-core.md Section 8 "Errors". This is a NEW,
+ * separate catalog — it does NOT replace `./catalog.ts`, which serves the
+ * existing non-PDPP Vana/DPP callers.
+ *
+ * Error shape is fixed by the spec:
+ *   { error: { type, code, message, param?, request_id } }
+ */
+export type PdppErrorType = "invalid_request_error" | "authentication_error" | "permission_error" | "not_found_error" | "gone_error" | "rate_limit_error" | "api_error";
+export type PdppErrorCode = "invalid_cursor" | "invalid_request" | "invalid_expand" | "unknown_field" | "unsupported_version" | "authentication_error" | "authorization_state.unsupported_legacy_shape" | "field_not_granted" | "insufficient_scope" | "grant_stream_not_allowed" | "grant_time_range_exceeded" | "grant_expired" | "grant_revoked" | "grant_invalid" | "blob_not_found" | "not_found" | "cursor_expired" | "rate_limit_exceeded" | "api_error";
+export interface PdppErrorBody {
+    error: {
+        type: PdppErrorType;
+        code: PdppErrorCode;
+        message: string;
+        param?: string;
+        request_id: string;
+    };
+}
+/**
+ * A PDPP §8 error. `status` is derived from `code` per the spec's Errors
+ * table; callers should not need to pass it explicitly, but MAY override for
+ * a future code this catalog doesn't yet know (fails loudly instead of
+ * silently defaulting to 500 for a real, known code).
+ */
+export declare class PdppError extends Error {
+    readonly status: number;
+    readonly code: PdppErrorCode;
+    readonly type: PdppErrorType;
+    readonly param?: string;
+    constructor(code: PdppErrorCode, message: string, options?: {
+        param?: string;
+    });
+    toJSON(requestId: string): PdppErrorBody;
+}
+//# sourceMappingURL=pdpp-catalog.d.ts.map

package/dist/errors/pdpp-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-catalog.d.ts","sourceRoot":"","sources":["../../src/errors/pdpp-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,aAAa,GACrB,uBAAuB,GACvB,sBAAsB,GACtB,kBAAkB,GAClB,iBAAiB,GACjB,YAAY,GACZ,kBAAkB,GAClB,WAAW,CAAC;AAEhB,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,sBAAsB,GACtB,8CAA8C,GAC9C,mBAAmB,GACnB,oBAAoB,GACpB,0BAA0B,GAC1B,2BAA2B,GAC3B,eAAe,GACf,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,WAAW,GACX,gBAAgB,GAChB,qBAAqB,GACrB,WAAW,CAAC;AA8ChB,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QACL,IAAI,EAAE,aAAa,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,aAAa,CAAC;IACpC,SAAgB,IAAI,EAAE,aAAa,CAAC;IACpC,SAAgB,KAAK,CAAC,EAAE,MAAM,CAAC;gBAG7B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAU9B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa;CAWzC"}

package/dist/errors/pdpp-catalog.js

@@ -0,0 +1,82 @@
+/**
+ * PDPP error catalog, spec-core.md Section 8 "Errors". This is a NEW,
+ * separate catalog — it does NOT replace `./catalog.ts`, which serves the
+ * existing non-PDPP Vana/DPP callers.
+ *
+ * Error shape is fixed by the spec:
+ *   { error: { type, code, message, param?, request_id } }
+ */
+const STATUS_BY_CODE = {
+    invalid_cursor: 400,
+    invalid_request: 400,
+    invalid_expand: 400,
+    unknown_field: 400,
+    unsupported_version: 400,
+    authentication_error: 401,
+    "authorization_state.unsupported_legacy_shape": 401,
+    field_not_granted: 403,
+    insufficient_scope: 403,
+    grant_stream_not_allowed: 403,
+    grant_time_range_exceeded: 403,
+    grant_expired: 403,
+    grant_revoked: 403,
+    grant_invalid: 403,
+    blob_not_found: 404,
+    not_found: 404,
+    cursor_expired: 410,
+    rate_limit_exceeded: 429,
+    api_error: 500,
+};
+const TYPE_BY_CODE = {
+    invalid_cursor: "invalid_request_error",
+    invalid_request: "invalid_request_error",
+    invalid_expand: "invalid_request_error",
+    unknown_field: "invalid_request_error",
+    unsupported_version: "invalid_request_error",
+    authentication_error: "authentication_error",
+    "authorization_state.unsupported_legacy_shape": "authentication_error",
+    field_not_granted: "permission_error",
+    insufficient_scope: "permission_error",
+    grant_stream_not_allowed: "permission_error",
+    grant_time_range_exceeded: "permission_error",
+    grant_expired: "permission_error",
+    grant_revoked: "permission_error",
+    grant_invalid: "permission_error",
+    blob_not_found: "not_found_error",
+    not_found: "not_found_error",
+    cursor_expired: "gone_error",
+    rate_limit_exceeded: "rate_limit_error",
+    api_error: "api_error",
+};
+/**
+ * A PDPP §8 error. `status` is derived from `code` per the spec's Errors
+ * table; callers should not need to pass it explicitly, but MAY override for
+ * a future code this catalog doesn't yet know (fails loudly instead of
+ * silently defaulting to 500 for a real, known code).
+ */
+export class PdppError extends Error {
+    status;
+    code;
+    type;
+    param;
+    constructor(code, message, options) {
+        super(message);
+        this.name = "PdppError";
+        this.code = code;
+        this.status = STATUS_BY_CODE[code];
+        this.type = TYPE_BY_CODE[code];
+        this.param = options?.param;
+    }
+    toJSON(requestId) {
+        return {
+            error: {
+                type: this.type,
+                code: this.code,
+                message: this.message,
+                ...(this.param !== undefined && { param: this.param }),
+                request_id: requestId,
+            },
+        };
+    }
+}
+//# sourceMappingURL=pdpp-catalog.js.map

package/dist/errors/pdpp-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-catalog.js","sourceRoot":"","sources":["../../src/errors/pdpp-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgCH,MAAM,cAAc,GAAkC;IACpD,cAAc,EAAE,GAAG;IACnB,eAAe,EAAE,GAAG;IACpB,cAAc,EAAE,GAAG;IACnB,aAAa,EAAE,GAAG;IAClB,mBAAmB,EAAE,GAAG;IACxB,oBAAoB,EAAE,GAAG;IACzB,8CAA8C,EAAE,GAAG;IACnD,iBAAiB,EAAE,GAAG;IACtB,kBAAkB,EAAE,GAAG;IACvB,wBAAwB,EAAE,GAAG;IAC7B,yBAAyB,EAAE,GAAG;IAC9B,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,GAAG;IACnB,SAAS,EAAE,GAAG;IACd,cAAc,EAAE,GAAG;IACnB,mBAAmB,EAAE,GAAG;IACxB,SAAS,EAAE,GAAG;CACf,CAAC;AAEF,MAAM,YAAY,GAAyC;IACzD,cAAc,EAAE,uBAAuB;IACvC,eAAe,EAAE,uBAAuB;IACxC,cAAc,EAAE,uBAAuB;IACvC,aAAa,EAAE,uBAAuB;IACtC,mBAAmB,EAAE,uBAAuB;IAC5C,oBAAoB,EAAE,sBAAsB;IAC5C,8CAA8C,EAAE,sBAAsB;IACtE,iBAAiB,EAAE,kBAAkB;IACrC,kBAAkB,EAAE,kBAAkB;IACtC,wBAAwB,EAAE,kBAAkB;IAC5C,yBAAyB,EAAE,kBAAkB;IAC7C,aAAa,EAAE,kBAAkB;IACjC,aAAa,EAAE,kBAAkB;IACjC,aAAa,EAAE,kBAAkB;IACjC,cAAc,EAAE,iBAAiB;IACjC,SAAS,EAAE,iBAAiB;IAC5B,cAAc,EAAE,YAAY;IAC5B,mBAAmB,EAAE,kBAAkB;IACvC,SAAS,EAAE,WAAW;CACvB,CAAC;AAYF;;;;;GAKG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClB,MAAM,CAAS;IACf,IAAI,CAAgB;IACpB,IAAI,CAAgB;IACpB,KAAK,CAAU;IAE/B,YACE,IAAmB,EACnB,OAAe,EACf,OAA4B;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtD,UAAU,EAAE,SAAS;aACtB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/grants/index.d.ts

@@ -0,0 +1,5 @@
+export { GRANT_REGISTRATION_TYPES, GRANT_REVOCATION_TYPES, grantRegistrationDomain, grantRevocationDomain, isDataPortabilityGatewayConfig, verifyGrantRegistration, type DataPortabilityGatewayConfig, type GrantRegistrationMessage, type GrantRevocationMessage, type VerifyGrantRegistrationInput, type VerifyGrantRegistrationResult, } from "@opendatalabs/vana-sdk/browser";
+export type { GatewayGrantResponse, GatewayGrantStatus, GatewayGrantFee, GrantListItem, } from "@opendatalabs/vana-sdk/browser";
+export { createPdppGrantBinding, samePermission, verifyPdppGrantBinding, type ChainPermissionRef, type CreateBindingInput, type PdppGrantBinding, type VerifyBindingInput, } from "./pdpp-binding.js";
+export { createInMemoryPdppGrantBindingStore, type PdppGrantBindingStore, } from "./pdpp-binding-store.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/grants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/grants/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAC;AAQxC,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,aAAa,GACd,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,EACnC,KAAK,qBAAqB,GAC3B,MAAM,yBAAyB,CAAC"}

package/dist/grants/index.js

@@ -0,0 +1,6 @@
+export { GRANT_REGISTRATION_TYPES, GRANT_REVOCATION_TYPES, grantRegistrationDomain, grantRevocationDomain, isDataPortabilityGatewayConfig, verifyGrantRegistration, } from "@opendatalabs/vana-sdk/browser";
+// §6 — the PDPP↔chain grant binding. Keyed by existing chain permission
+// identity; adds no field to any signed struct.
+export { createPdppGrantBinding, samePermission, verifyPdppGrantBinding, } from "./pdpp-binding.js";
+export { createInMemoryPdppGrantBindingStore, } from "./pdpp-binding-store.js";
+//# sourceMappingURL=index.js.map

package/dist/grants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/grants/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,8BAA8B,EAC9B,uBAAuB,GAMxB,MAAM,gCAAgC,CAAC;AAexC,wEAAwE;AACxE,gDAAgD;AAChD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,sBAAsB,GAKvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,GAEpC,MAAM,yBAAyB,CAAC"}

package/dist/grants/pdpp-binding-store.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Durable retention for PDPP ↔ chain grant bindings (scope §6).
+ *
+ * The binding record is the only thing that crosses the gateway/chain
+ * boundary on our side; record payloads stay in PS storage and never enter
+ * this store. What is retained here is an identity join — PDPP grant id,
+ * chain permission ref, owner, grantee — and nothing about the data itself.
+ *
+ * ## Append-only by construction
+ *
+ * The port exposes `put` and `get` but no `update` and no `delete`. That is
+ * deliberate, and it is the mechanism that makes §6's revocation semantics
+ * correct rather than merely intended:
+ *
+ *   - A binding asserts a *historical* fact ("this consent authorized this
+ *     permission"), which does not stop being true when the grant is revoked.
+ *   - Revocation is a *current* fact, and lives on the chain grant, read live
+ *     at verification time.
+ *
+ * If revocation were mirrored into this store, the two would have to be kept
+ * in sync, and every window where they disagreed would be a window where a
+ * revoked grant still read as live. Not storing the status at all removes that
+ * class of bug instead of managing it.
+ *
+ * `putBinding` rejects a conflicting rewrite for the same key rather than
+ * overwriting, so a second binding cannot silently retarget an existing PDPP
+ * grant at a different permission, owner, or app.
+ */
+import { type ChainPermissionRef, type PdppGrantBinding } from "./pdpp-binding.js";
+/**
+ * Durable storage for grant bindings.
+ *
+ * Implementations back this with the deployment's real store (SQLite on
+ * desktop, the supplied runtime's durable state in Enclave). The interface is
+ * intentionally tiny so both can implement it without sharing a schema.
+ */
+export interface PdppGrantBindingStore {
+    /**
+     * Retain a binding. Idempotent for an identical re-put; throws on a
+     * conflicting one.
+     */
+    putBinding(binding: PdppGrantBinding): void;
+    /** Look up by the PDPP grant id (the consent artifact). */
+    getByPdppGrantId(pdppGrantId: string): PdppGrantBinding | null;
+    /** Look up by chain permission identity. */
+    getByPermission(permission: ChainPermissionRef): PdppGrantBinding | null;
+}
+/**
+ * In-memory implementation, used by tests and by callers that have no durable
+ * store yet.
+ *
+ * This is a real implementation of the port's semantics — including the
+ * conflict rejection — not a stub that accepts everything. Tests exercising it
+ * are therefore testing the actual binding rules; only the persistence medium
+ * differs from a deployed store.
+ */
+export declare function createInMemoryPdppGrantBindingStore(): PdppGrantBindingStore;
+//# sourceMappingURL=pdpp-binding-store.d.ts.map

package/dist/grants/pdpp-binding-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-binding-store.d.ts","sourceRoot":"","sources":["../../src/grants/pdpp-binding-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C,2DAA2D;IAC3D,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAC/D,4CAA4C;IAC5C,eAAe,CAAC,UAAU,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,IAAI,CAAC;CAC1E;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,IAAI,qBAAqB,CAsC3E"}

package/dist/grants/pdpp-binding-store.js

@@ -0,0 +1,97 @@
+/**
+ * Durable retention for PDPP ↔ chain grant bindings (scope §6).
+ *
+ * The binding record is the only thing that crosses the gateway/chain
+ * boundary on our side; record payloads stay in PS storage and never enter
+ * this store. What is retained here is an identity join — PDPP grant id,
+ * chain permission ref, owner, grantee — and nothing about the data itself.
+ *
+ * ## Append-only by construction
+ *
+ * The port exposes `put` and `get` but no `update` and no `delete`. That is
+ * deliberate, and it is the mechanism that makes §6's revocation semantics
+ * correct rather than merely intended:
+ *
+ *   - A binding asserts a *historical* fact ("this consent authorized this
+ *     permission"), which does not stop being true when the grant is revoked.
+ *   - Revocation is a *current* fact, and lives on the chain grant, read live
+ *     at verification time.
+ *
+ * If revocation were mirrored into this store, the two would have to be kept
+ * in sync, and every window where they disagreed would be a window where a
+ * revoked grant still read as live. Not storing the status at all removes that
+ * class of bug instead of managing it.
+ *
+ * `putBinding` rejects a conflicting rewrite for the same key rather than
+ * overwriting, so a second binding cannot silently retarget an existing PDPP
+ * grant at a different permission, owner, or app.
+ */
+import { InvalidSignatureError } from "../errors/catalog.js";
+import { samePermission, } from "./pdpp-binding.js";
+/**
+ * True when two bindings agree on every field that defines the binding.
+ *
+ * `granteeAddress` is compared, which makes grantee rotation an explicit
+ * conflict rather than a silent follow. That is deliberate. Context Gateway
+ * holds one Privy-custodied wallet per app, keyed `(ownerType, ownerId)` with
+ * a DB unique index, and its schema *models* rotation (`isCurrent` plus a
+ * partial unique index) although no code path performs one today — so the
+ * address is currently immutable per app in practice but not by design.
+ *
+ * If rotation ever ships, a rotated wallet is a different grantee, and the
+ * owner's existing consent must not transfer to it without a new decision.
+ * Rejecting the rewrite surfaces that as a failure instead of quietly
+ * repointing a retained grant at an address the owner never approved.
+ */
+function bindingsAgree(a, b) {
+    return (a.pdppGrantId === b.pdppGrantId &&
+        samePermission(a.permission, b.permission) &&
+        a.ownerAddress.toLowerCase() === b.ownerAddress.toLowerCase() &&
+        a.granteeAddress.toLowerCase() === b.granteeAddress.toLowerCase() &&
+        a.pdppClientId === b.pdppClientId);
+}
+function permissionKey(p) {
+    return `${p.chainId}:${p.contractAddress.toLowerCase()}:${p.permissionId}`;
+}
+/**
+ * In-memory implementation, used by tests and by callers that have no durable
+ * store yet.
+ *
+ * This is a real implementation of the port's semantics — including the
+ * conflict rejection — not a stub that accepts everything. Tests exercising it
+ * are therefore testing the actual binding rules; only the persistence medium
+ * differs from a deployed store.
+ */
+export function createInMemoryPdppGrantBindingStore() {
+    const byGrantId = new Map();
+    const byPermission = new Map();
+    return {
+        putBinding(binding) {
+            const existingByGrant = byGrantId.get(binding.pdppGrantId);
+            if (existingByGrant && !bindingsAgree(existingByGrant, binding)) {
+                throw new InvalidSignatureError({
+                    reason: "A different binding already exists for this PDPP grant id",
+                    pdppGrantId: binding.pdppGrantId,
+                });
+            }
+            const key = permissionKey(binding.permission);
+            const existingByPermission = byPermission.get(key);
+            if (existingByPermission &&
+                !bindingsAgree(existingByPermission, binding)) {
+                throw new InvalidSignatureError({
+                    reason: "A different binding already exists for this permission",
+                    permission: key,
+                });
+            }
+            byGrantId.set(binding.pdppGrantId, binding);
+            byPermission.set(key, binding);
+        },
+        getByPdppGrantId(pdppGrantId) {
+            return byGrantId.get(pdppGrantId) ?? null;
+        },
+        getByPermission(permission) {
+            return byPermission.get(permissionKey(permission)) ?? null;
+        },
+    };
+}
+//# sourceMappingURL=pdpp-binding-store.js.map

package/dist/grants/pdpp-binding-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-binding-store.js","sourceRoot":"","sources":["../../src/grants/pdpp-binding-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EACL,cAAc,GAGf,MAAM,mBAAmB,CAAC;AAqB3B;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,CAAmB,EAAE,CAAmB;IAC7D,OAAO,CACL,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAC/B,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;QAC1C,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE;QACjE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,CAAqB;IAC1C,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEzD,OAAO;QACL,UAAU,CAAC,OAAyB;YAClC,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,eAAe,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,MAAM,EAAE,2DAA2D;oBACnE,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,oBAAoB,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnD,IACE,oBAAoB;gBACpB,CAAC,aAAa,CAAC,oBAAoB,EAAE,OAAO,CAAC,EAC7C,CAAC;gBACD,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,MAAM,EAAE,wDAAwD;oBAChE,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5C,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QAED,gBAAgB,CAAC,WAAmB;YAClC,OAAO,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;QAED,eAAe,CAAC,UAA8B;YAC5C,OAAO,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}