@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/payment/x402.js

@@ -0,0 +1,402 @@
+/**
+ * X402 payment challenge / verification for builder reads.
+ *
+ * The personal server speaks an x402-style payment dance to builders on
+ * GET /v1/data/:scope. When a request arrives without (or with an invalid)
+ * X-PAYMENT header the server issues a 402 challenge: a server-signed
+ * RECORD_DATA_ACCESS attestation plus the canonical GenericPayment message
+ * the builder must EIP-712 sign. The builder retries with the signed
+ * message in X-PAYMENT; the server validates locally, then forwards to
+ * `POST /v1/escrow/pay` on the gateway. On 2xx the read proceeds; on
+ * 4xx/5xx the server responds with a fresh challenge.
+ *
+ * This module is wire-format only — it doesn't talk to the gateway or the
+ * storage layer. Callers in `api/index.ts` glue it to `gateway.getGrant`
+ * (for fee discovery), `IndexEntry.dataPointId/version` (for accessRecord
+ * binding), and a direct `fetch` to the gateway for payment forwarding.
+ */
+import { GENERIC_PAYMENT_TYPES, RECORD_DATA_ACCESS_TYPES, dataRegistryDomain, escrowPaymentDomain, } from "@opendatalabs/vana-sdk/browser";
+import { recoverTypedDataAddress } from "viem";
+// Per-event recordId on the access attestation. 32 cryptographically random
+// bytes — collision-resistant under the DataRegistryV2 `_usedRecordIds`
+// set the contract pins per access event.
+export function generateRecordId() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return ("0x" +
+        Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join(""));
+}
+// Build a fresh paymentNonce: high 32 bits = Date.now() (ms-monotonic), low
+// 32 bits = cryptographic randomness (within-ms collision avoidance). Yields
+// a strictly-increasing uint256 across ms ticks while keeping per-ms
+// collision probability negligible. Serialized as a decimal string on the
+// wire so the gateway's `^[1-9]\d*$` regex accepts it.
+//
+// Caveat: server-clock regressions can break monotonicity; the gateway
+// rejects out-of-order nonces with 409 and the builder retries.
+export function nextPaymentNonce() {
+    const rand = new Uint32Array(1);
+    crypto.getRandomValues(rand);
+    return (BigInt(Date.now()) << 32n) + BigInt(rand[0]);
+}
+// Recover the millisecond timestamp encoded in the high 32 bits of a nonce
+// generated by `nextPaymentNonce`. Used for the optional freshness check
+// during X-PAYMENT validation.
+export function paymentNonceIssueTimeMs(nonce) {
+    return nonce >> 32n;
+}
+const CHALLENGE_TTL_SECONDS = 300; // 5 min — challenges are stateless; this
+// is purely advisory for clients.
+const NONCE_FRESHNESS_MS = 600_000; // accept paymentNonces issued within
+// the last 10 minutes (or up to 1 min in the future — clock skew tolerance).
+const NONCE_FUTURE_SKEW_MS = 60_000;
+const BYTES32_REGEX = /^0x[0-9a-fA-F]{64}$/;
+const ADDRESS_REGEX = /^0x[0-9a-fA-F]{40}$/;
+const SIGNATURE_REGEX = /^0x[0-9a-fA-F]{130}$/;
+const POSITIVE_DECIMAL_INT_REGEX = /^[1-9]\d*$/;
+const NON_NEGATIVE_DECIMAL_INT_REGEX = /^(0|[1-9]\d*)$/;
+export async function buildChallenge(input) {
+    const now = input.now?.() ?? new Date();
+    const expiresAt = Math.floor(now.getTime() / 1000) + CHALLENGE_TTL_SECONDS;
+    const generateNonce = input.generateNonce ?? nextPaymentNonce;
+    const generateRecord = input.generateRecordIdFn ?? generateRecordId;
+    // The canary `totalDue` already accounts for paymentStatus (registration
+    // is omitted when grant.paymentStatus === 'paid'). SDK comment: "snapshot
+    // — clients shouldn't cache across requests", so the caller re-fetches.
+    const amount = input.grant.fee.totalDue;
+    const registrationOwed = input.grant.paymentStatus !== "paid";
+    const asset = input.grant.fee.asset;
+    let accessRecord;
+    if (input.serverSigner &&
+        input.serverOwner &&
+        input.entry &&
+        input.entry.dataPointId !== null) {
+        const recordId = generateRecord();
+        const version = BigInt(input.entry.version);
+        const signature = await input.serverSigner.signRecordDataAccess({
+            ownerAddress: input.serverOwner,
+            scope: input.entry.scope,
+            version,
+            accessor: input.builder,
+            recordId,
+        });
+        accessRecord = {
+            dataPointId: input.entry.dataPointId,
+            version: version.toString(),
+            accessor: input.builder,
+            recordId,
+            signature,
+        };
+    }
+    const message = {
+        payerAddress: input.builder,
+        opType: "grant",
+        opId: input.grantId,
+        asset,
+        amount,
+        paymentNonce: generateNonce().toString(),
+    };
+    return {
+        x402Version: 1,
+        error: "PAYMENT_REQUIRED",
+        accepts: [
+            {
+                scheme: "vana-escrow-grant",
+                network: input.network,
+                asset,
+                amount,
+                domain: escrowPaymentDomain(input.gatewayConfig),
+                types: GENERIC_PAYMENT_TYPES,
+                message,
+                breakdown: {
+                    registrationFee: registrationOwed
+                        ? input.grant.fee.registrationFee
+                        : "0",
+                    dataAccessFee: input.grant.fee.dataAccessFee,
+                    registrationOwed,
+                },
+                ...(accessRecord ? { accessRecord } : {}),
+                expiresAt,
+            },
+        ],
+    };
+}
+// Decode base64 to UTF-8. Tolerates standard + url-safe alphabets so clients
+// can use either. Uses the universally-available `atob` + Web text codecs
+// rather than Node's Buffer so this module remains browser-safe (consumed
+// by ps-lite as well as the Node server).
+function base64decode(input) {
+    let s = input.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = (4 - (s.length % 4)) % 4;
+    s += "=".repeat(pad);
+    const binString = atob(s);
+    const bytes = Uint8Array.from(binString, (c) => c.codePointAt(0) ?? 0);
+    return new TextDecoder().decode(bytes);
+}
+function base64encode(input) {
+    const bytes = new TextEncoder().encode(input);
+    let binString = "";
+    for (const b of bytes)
+        binString += String.fromCodePoint(b);
+    return btoa(binString);
+}
+/**
+ * Parse the X-PAYMENT header value. Returns `null` if missing/malformed —
+ * the caller should treat that as "no payment provided" and issue a 402.
+ */
+export function parsePaymentHeader(headerValue) {
+    if (!headerValue)
+        return null;
+    let decoded;
+    try {
+        decoded = base64decode(headerValue.trim());
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(decoded);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const obj = parsed;
+    if (obj["x402Version"] !== 1)
+        return null;
+    if (obj["scheme"] !== "vana-escrow-grant")
+        return null;
+    if (typeof obj["network"] !== "string")
+        return null;
+    const payload = obj["payload"];
+    if (!payload || typeof payload !== "object")
+        return null;
+    const p = payload;
+    const message = p["message"];
+    if (!message || typeof message !== "object")
+        return null;
+    const m = message;
+    if (typeof m["payerAddress"] !== "string" ||
+        !ADDRESS_REGEX.test(m["payerAddress"]) ||
+        typeof m["opType"] !== "string" ||
+        typeof m["opId"] !== "string" ||
+        !BYTES32_REGEX.test(m["opId"]) ||
+        typeof m["asset"] !== "string" ||
+        !ADDRESS_REGEX.test(m["asset"]) ||
+        typeof m["amount"] !== "string" ||
+        !NON_NEGATIVE_DECIMAL_INT_REGEX.test(m["amount"]) ||
+        typeof m["paymentNonce"] !== "string" ||
+        !POSITIVE_DECIMAL_INT_REGEX.test(m["paymentNonce"])) {
+        return null;
+    }
+    if (typeof p["signature"] !== "string" ||
+        !SIGNATURE_REGEX.test(p["signature"])) {
+        return null;
+    }
+    const accessRecordRaw = p["accessRecord"];
+    let accessRecord;
+    if (accessRecordRaw !== undefined) {
+        if (!accessRecordRaw || typeof accessRecordRaw !== "object")
+            return null;
+        const ar = accessRecordRaw;
+        if (typeof ar["dataPointId"] !== "string" ||
+            !BYTES32_REGEX.test(ar["dataPointId"]) ||
+            typeof ar["version"] !== "string" ||
+            !POSITIVE_DECIMAL_INT_REGEX.test(ar["version"]) ||
+            typeof ar["accessor"] !== "string" ||
+            !ADDRESS_REGEX.test(ar["accessor"]) ||
+            typeof ar["recordId"] !== "string" ||
+            !BYTES32_REGEX.test(ar["recordId"]) ||
+            typeof ar["signature"] !== "string" ||
+            !SIGNATURE_REGEX.test(ar["signature"])) {
+            return null;
+        }
+        accessRecord = {
+            dataPointId: ar["dataPointId"],
+            version: ar["version"],
+            accessor: ar["accessor"],
+            recordId: ar["recordId"],
+            signature: ar["signature"],
+        };
+    }
+    return {
+        x402Version: 1,
+        scheme: "vana-escrow-grant",
+        network: obj["network"],
+        payload: {
+            message: {
+                payerAddress: m["payerAddress"],
+                opType: m["opType"],
+                opId: m["opId"],
+                asset: m["asset"],
+                amount: m["amount"],
+                paymentNonce: m["paymentNonce"],
+            },
+            signature: p["signature"],
+            ...(accessRecord ? { accessRecord } : {}),
+        },
+    };
+}
+/**
+ * Encode an X402Payment back to a base64 header value. Useful for client
+ * code (the personal server only decodes here; this is exported for tests
+ * and downstream builders that want a shared serializer).
+ */
+export function encodePaymentHeader(payment) {
+    return base64encode(JSON.stringify(payment));
+}
+/**
+ * Validate a parsed X-PAYMENT against the live grant + entry state. On
+ * success the caller forwards the payment verbatim to the gateway. Any
+ * failure should result in a fresh 402 challenge.
+ *
+ * Replay defense is layered: gateway enforces per-(payer, opType, nonce)
+ * uniqueness via DB constraint and per-recordId uniqueness via the on-chain
+ * `_usedRecordIds` set. Local checks here catch obvious malformed echoes
+ * before they reach the gateway.
+ */
+export async function verifyPayment(input) {
+    const { payment, grant, builder } = input;
+    const msg = payment.payload.message;
+    // Builder identity: the payment must claim the authenticated signer.
+    // Recovery below cryptographically pins this.
+    if (msg.payerAddress.toLowerCase() !== builder.toLowerCase()) {
+        return {
+            ok: false,
+            reason: "payerAddress does not match authenticated builder",
+        };
+    }
+    if (msg.opType !== "grant") {
+        return { ok: false, reason: `Unsupported opType: ${msg.opType}` };
+    }
+    if (msg.opId.toLowerCase() !== input.grantId.toLowerCase()) {
+        return { ok: false, reason: "opId does not match the request's grantId" };
+    }
+    // Amount + asset must match the gateway's canonical values. Re-fetched
+    // per request, so a builder echoing stale amounts gets rejected here
+    // before we hit the gateway.
+    if (msg.asset.toLowerCase() !== grant.fee.asset.toLowerCase()) {
+        return { ok: false, reason: "asset does not match grant fee asset" };
+    }
+    if (msg.amount !== grant.fee.totalDue) {
+        return {
+            ok: false,
+            reason: `amount ${msg.amount} != grant.fee.totalDue ${grant.fee.totalDue}`,
+        };
+    }
+    // Stateless freshness check: extract the issue-time from the high 32 bits
+    // of paymentNonce and require it within the last ~10 minutes. Cheap; no
+    // server state. Catches replays of captured X-PAYMENTs far in the past.
+    let nonceBig;
+    try {
+        nonceBig = BigInt(msg.paymentNonce);
+    }
+    catch {
+        return { ok: false, reason: "paymentNonce is not a valid uint256" };
+    }
+    const issueMs = paymentNonceIssueTimeMs(nonceBig);
+    const nowMs = BigInt(input.nowMs?.() ?? Date.now());
+    if (issueMs > nowMs + BigInt(NONCE_FUTURE_SKEW_MS)) {
+        return { ok: false, reason: "paymentNonce timestamp is in the future" };
+    }
+    if (nowMs - issueMs > BigInt(NONCE_FRESHNESS_MS)) {
+        return {
+            ok: false,
+            reason: "paymentNonce is older than the freshness window",
+        };
+    }
+    // GenericPayment signature recovery — must recover to the builder.
+    let recoveredPayer;
+    try {
+        recoveredPayer = await recoverTypedDataAddress({
+            domain: escrowPaymentDomain(input.gatewayConfig),
+            types: GENERIC_PAYMENT_TYPES,
+            primaryType: "GenericPayment",
+            message: {
+                payerAddress: msg.payerAddress,
+                opType: msg.opType,
+                opId: msg.opId,
+                asset: msg.asset,
+                amount: BigInt(msg.amount),
+                paymentNonce: nonceBig,
+            },
+            signature: payment.payload.signature,
+        });
+    }
+    catch {
+        return { ok: false, reason: "GenericPayment signature recovery failed" };
+    }
+    if (recoveredPayer.toLowerCase() !== builder.toLowerCase()) {
+        return {
+            ok: false,
+            reason: "GenericPayment signer does not match authenticated builder",
+        };
+    }
+    // AccessRecord echo (when present) — verify the server actually signed it
+    // and the binding fields match the entry being served.
+    if (payment.payload.accessRecord) {
+        const ar = payment.payload.accessRecord;
+        if (!input.entry) {
+            return {
+                ok: false,
+                reason: "accessRecord supplied but no entry to bind it to",
+            };
+        }
+        if (input.entry.dataPointId === null) {
+            return {
+                ok: false,
+                reason: "accessRecord supplied but entry has no dataPointId yet",
+            };
+        }
+        if (ar.dataPointId.toLowerCase() !== input.entry.dataPointId.toLowerCase()) {
+            return {
+                ok: false,
+                reason: "accessRecord.dataPointId does not match entry",
+            };
+        }
+        if (ar.version !== String(input.entry.version)) {
+            return { ok: false, reason: "accessRecord.version does not match entry" };
+        }
+        if (ar.accessor.toLowerCase() !== builder.toLowerCase()) {
+            return {
+                ok: false,
+                reason: "accessRecord.accessor does not match authenticated builder",
+            };
+        }
+        if (!input.serverOwner) {
+            return {
+                ok: false,
+                reason: "serverOwner required to verify accessRecord signature",
+            };
+        }
+        let recoveredServer;
+        try {
+            recoveredServer = await recoverTypedDataAddress({
+                domain: dataRegistryDomain(input.gatewayConfig),
+                types: RECORD_DATA_ACCESS_TYPES,
+                primaryType: "RecordDataAccess",
+                message: {
+                    ownerAddress: input.serverOwner,
+                    scope: input.entry.scope,
+                    version: BigInt(ar.version),
+                    accessor: ar.accessor,
+                    recordId: ar.recordId,
+                },
+                signature: ar.signature,
+            });
+        }
+        catch {
+            return { ok: false, reason: "accessRecord signature recovery failed" };
+        }
+        if (recoveredServer.toLowerCase() !== input.serverAddress.toLowerCase()) {
+            return {
+                ok: false,
+                reason: "accessRecord signer is not this personal server",
+            };
+        }
+    }
+    return { ok: true, payment };
+}
+//# sourceMappingURL=x402.js.map

package/dist/payment/x402.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x402.js","sourceRoot":"","sources":["../../src/payment/x402.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,GAGpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAwB,MAAM,MAAM,CAAC;AAGrE,4EAA4E;AAC5E,wEAAwE;AACxE,0CAA0C;AAC1C,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI;QACV,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAC5D,EAAE,CACH,CAAkB,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,0EAA0E;AAC1E,uDAAuD;AACvD,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,+BAA+B;AAC/B,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,KAAK,IAAI,GAAG,CAAC;AACtB,CAAC;AAoGD,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,yCAAyC;AAC5E,kCAAkC;AAClC,MAAM,kBAAkB,GAAG,OAAO,CAAC,CAAC,qCAAqC;AACzE,6EAA6E;AAC7E,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAC5C,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAChD,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;AAsCxD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B;IAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,qBAAqB,CAAC;IAC3E,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC;IAC9D,MAAM,cAAc,GAAG,KAAK,CAAC,kBAAkB,IAAI,gBAAgB,CAAC;IAEpE,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;IACxC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAsB,CAAC;IAErD,IAAI,YAA0C,CAAC;IAC/C,IACE,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,EAChC,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,oBAAoB,CAAC;YAC9D,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;YACxB,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,QAAQ;SACT,CAAC,CAAC;QACH,YAAY,GAAG;YACb,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC3B,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,QAAQ;YACR,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAuB;QAClC,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,KAAK,CAAC,OAAO;QACnB,KAAK;QACL,MAAM;QACN,YAAY,EAAE,aAAa,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,CAAC;QACd,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE;YACP;gBACE,MAAM,EAAE,mBAAmB;gBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK;gBACL,MAAM;gBACN,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC;gBAChD,KAAK,EAAE,qBAAqB;gBAC5B,OAAO;gBACP,SAAS,EAAE;oBACT,eAAe,EAAE,gBAAgB;wBAC/B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe;wBACjC,CAAC,CAAC,GAAG;oBACP,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa;oBAC5C,gBAAgB;iBACjB;gBACD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,SAAS;aACV;SACF;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,0EAA0E;AAC1E,0EAA0E;AAC1E,0CAA0C;AAC1C,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAsC;IAEtC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IACE,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ;QACrC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC7B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ;QACrC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EACnD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;QAClC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EACrC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,YAA0C,CAAC;IAC/C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,IAAI,OAAO,eAAe,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzE,MAAM,EAAE,GAAG,eAA0C,CAAC;QACtD,IACE,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,QAAQ;YACrC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;YACtC,OAAO,EAAE,CAAC,SAAS,CAAC,KAAK,QAAQ;YACjC,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ;YAClC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ;YAClC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ;YACnC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EACtC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,YAAY,GAAG;YACb,WAAW,EAAE,EAAE,CAAC,aAAa,CAAkB;YAC/C,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC;YACtB,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAkB;YACzC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAkB;YACzC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAkB;SAC5C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;QACvB,OAAO,EAAE;YACP,OAAO,EAAE;gBACP,YAAY,EAAE,CAAC,CAAC,cAAc,CAAkB;gBAChD,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;gBACnB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAkB;gBAChC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAkB;gBAClC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;gBACnB,YAAY,EAAE,CAAC,CAAC,cAAc,CAAC;aAChC;YACD,SAAS,EAAE,CAAC,CAAC,WAAW,CAAkB;YAC1C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAoB;IACtD,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/C,CAAC;AA8BD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;IAEpC,qEAAqE;IACrE,8CAA8C;IAC9C,IAAI,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mDAAmD;SAC5D,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC5E,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,6BAA6B;IAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,0BAA0B,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;SAC3E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,cAA6B,CAAC;IAClC,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,uBAAuB,CAAC;YAC7C,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC;YAChD,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,gBAAgB;YAC7B,OAAO,EAAE;gBACP,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1B,YAAY,EAAE,QAAQ;aACvB;YACD,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;SACrC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4DAA4D;SACrE,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kDAAkD;aAC3D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wDAAwD;aACjE,CAAC;QACJ,CAAC;QACD,IACE,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EACtE,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,+CAA+C;aACxD,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4DAA4D;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,uDAAuD;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,eAA8B,CAAC;QACnC,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,uBAAuB,CAAC;gBAC9C,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;gBAC/C,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,kBAAkB;gBAC/B,OAAO,EAAE;oBACP,YAAY,EAAE,KAAK,CAAC,WAAW;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;oBACxB,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC;oBAC3B,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,QAAQ,EAAE,EAAE,CAAC,QAAQ;iBACtB;gBACD,SAAS,EAAE,EAAE,CAAC,SAAS;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,eAAe,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACxE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iDAAiD;aAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/pdpp/approval.d.ts

@@ -0,0 +1,182 @@
+/**
+ * Authorization sessions and authenticated owner approval.
+ *
+ * This is the module that decides whether a consent decision is real. The
+ * threat it exists to stop is an approval that looks right — correct session,
+ * correct review digest, arriving from the first-party consent UI — but that
+ * no authenticated owner actually made.
+ *
+ * The rule: **affiliation is not authentication.** The AS does not accept an
+ * approval because it came from an allowlisted origin, a first-party console,
+ * a shared UI/server secret, or a signed assertion from the consent broker
+ * saying "the owner agreed". Each of those authenticates a *channel* or
+ * delegates the decision to a browser-reachable component; compromise it and
+ * it mints approvals for any subject. Instead, the owner authenticates to the
+ * PS itself, and the resulting owner token — resolved through the same token
+ * service the RS uses — is what authorizes the decision. The consent UI
+ * forwards that token; it can never substitute for it.
+ *
+ * Two independent checks must both pass, and neither implies the other:
+ *
+ *   1. The caller presents an active token with `pdpp_token_kind: "owner"`
+ *      whose `subject_id` equals the session's subject. Possession of the
+ *      session id is not authority over it.
+ *   2. The presented `review_digest` matches a re-derivation over what is
+ *      about to be issued (§7 staleness). Authenticating the owner does not
+ *      excuse approving something other than what they reviewed.
+ */
+import { type ConsentReviewModel, type RequesterIdentity } from "./review.js";
+import { type ConsentEvidence } from "./issuance.js";
+import { type InstanceInventory } from "./resolve.js";
+import type { PdppTokenService } from "./tokens.js";
+import type { DeclarationSnapshot, Grant, SelectionRequest } from "./types.js";
+/** How long an owner has to act on a consent screen before it goes stale. */
+export declare const REVIEW_SESSION_TTL_SECONDS: number;
+export type SessionState = "pending" | "approved" | "denied";
+export interface AuthorizationSession {
+    session_id: string;
+    /** The subject this session belongs to. An approval must authenticate as this. */
+    subject_id: string;
+    request: SelectionRequest;
+    snapshot: DeclarationSnapshot;
+    requester: RequesterIdentity;
+    redirect_uri: string;
+    state_param?: string;
+    /** RFC 7636 challenge, carried to the authorization code minted on approval. */
+    code_challenge?: string;
+    code_challenge_method?: string;
+    expires_at: string;
+    status: SessionState;
+    /** AS-policy grant expiry carried into issuance. */
+    grant_expires_at?: string;
+    stream_descriptions?: Record<string, string>;
+}
+export type ApprovalFailureCode = 
+/** No owner token, an inactive one, a client token, or the wrong subject. */
+"unauthorized" | "session_not_found" | "stale_review" | "ai_training_consent_required" | "access_denied" | "invalid_request";
+export interface ApprovalFailure {
+    code: ApprovalFailureCode;
+    message: string;
+}
+export type ApprovalResult = {
+    ok: true;
+    grant: Grant;
+    consentEvidence: ConsentEvidence;
+} | {
+    ok: false;
+    failure: ApprovalFailure;
+};
+/**
+ * In-memory pending-session store. Sessions are short-lived and pre-decision,
+ * so they hold no issued authority — losing them on restart costs an owner a
+ * re-click, not a grant. Issued grants and tokens go to SQLite, where
+ * durability actually matters.
+ */
+export declare class AuthorizationSessionStore {
+    private readonly sessions;
+    create(input: {
+        subjectId: string;
+        request: SelectionRequest;
+        snapshot: DeclarationSnapshot;
+        requester: RequesterIdentity;
+        redirectUri: string;
+        stateParam?: string;
+        codeChallenge?: string;
+        codeChallengeMethod?: string;
+        grantExpiresAt?: string;
+        streamDescriptions?: Record<string, string>;
+        now?: Date;
+    }): AuthorizationSession;
+    get(sessionId: string): AuthorizationSession | null;
+    setStatus(sessionId: string, status: SessionState): void;
+}
+/**
+ * A stream the owner must pick an instance for before the review can resolve.
+ *
+ * §6 is strict that omitting `instance_ids` never means fan-in, so a stream
+ * with several eligible handles and none named is a decision only the owner
+ * can make. Surfacing the candidates as first-class review data is what turns
+ * that from a dead-end resolution failure into a consent step: the UI renders
+ * the choice, the owner picks, and the pick flows back through
+ * `instanceChoices` on the next review fetch and on approval.
+ */
+export interface InstanceChoice {
+    stream: string;
+    candidates: string[];
+}
+export interface ReviewFetchResult {
+    session_id: string;
+    /** Present only once every stream resolves. Absent while a choice is pending. */
+    review?: ConsentReviewModel;
+    /**
+     * Non-empty when the owner must choose instance handles before there is a
+     * decision to review. The UI collects these and re-fetches with the picks.
+     */
+    instance_choice_required?: InstanceChoice[];
+    expires_at: string;
+}
+/**
+ * Build the review an authenticated owner sees.
+ *
+ * Resolution runs here against current inventory, so the digest the owner is
+ * handed reflects the world as it is right now. If it changes before they
+ * approve, `approveAuthorization` will re-derive a different digest and reject.
+ */
+export declare function fetchReview(input: {
+    sessions: AuthorizationSessionStore;
+    tokens: PdppTokenService;
+    sessionId: string;
+    ownerToken: string | undefined;
+    inventory: InstanceInventory;
+    /** The owner's instance picks, keyed by stream, from a prior choice step. */
+    instanceChoices?: Record<string, string[]>;
+    now?: Date;
+}): {
+    ok: true;
+    result: ReviewFetchResult;
+} | {
+    ok: false;
+    failure: ApprovalFailure;
+};
+/**
+ * Approve an authorization: authenticate the owner, then issue.
+ *
+ * Order is deliberate. Authentication runs before anything else, so an
+ * unauthenticated caller cannot learn from the error whether their digest was
+ * fresh — a spoofed approval with a perfectly valid digest gets the same
+ * `unauthorized` as one with a garbage digest.
+ */
+export declare function approveAuthorization(input: {
+    sessions: AuthorizationSessionStore;
+    tokens: PdppTokenService;
+    sessionId: string;
+    ownerToken: string | undefined;
+    reviewDigest: string;
+    inventory: InstanceInventory;
+    /**
+     * The owner's instance picks, which must match the ones the review was
+     * rendered with. They feed resolution, so they land inside the recomputed
+     * digest — a different pick than the owner reviewed fails as stale rather
+     * than silently issuing a grant over another instance.
+     */
+    instanceChoices?: Record<string, string[]>;
+    explicitAiTrainingConsent?: boolean;
+    now?: Date;
+}): ApprovalResult;
+/**
+ * Deny an authorization. Terminal, and retains no consent evidence — there is
+ * nothing the owner consented to, so there is nothing to hold evidence of.
+ */
+export declare function denyAuthorization(input: {
+    sessions: AuthorizationSessionStore;
+    tokens: PdppTokenService;
+    sessionId: string;
+    ownerToken: string | undefined;
+    now?: Date;
+}): {
+    ok: true;
+} | {
+    ok: false;
+    failure: ApprovalFailure;
+};
+//# sourceMappingURL=approval.d.ts.map

package/dist/pdpp/approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../src/pdpp/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE/E,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,QAAU,CAAC;AAElD,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,mBAAmB;AAC7B,6EAA6E;AAC3E,cAAc,GACd,mBAAmB,GACnB,cAAc,GACd,8BAA8B,GAC9B,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,eAAe,EAAE,eAAe,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;IAEpE,MAAM,CAAC,KAAK,EAAE;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,oBAAoB;IA2BxB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAInD,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI;CAIzD;AA8ED;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAsDD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GACG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAuE1C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,EAAE,yBAAyB,CAAC;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,iBAAiB,CAAC;IAC7B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,cAAc,CA0EjB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAuBzD"}