@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/pdpp/resolve.js

@@ -0,0 +1,218 @@
+/**
+ * PDPP Core §6→§7 resolution: turn a validated selection request into the
+ * explicit grant facts that get frozen at issuance.
+ *
+ * Every request-only convenience dies here. Wildcards and presets expand to
+ * concrete stream rows, views resolve to field lists, omitted fields become
+ * the declaration's full field set, omitted instance handles resolve against
+ * the owner's connection inventory, and `time_range` freezes against the
+ * declaration's `consent_time_field`. §7 is explicit that none of these
+ * conveniences are continuing authority in the grant — the RS must never have
+ * to resolve anything, which is also what the AS→RS contract promises.
+ *
+ * Resolution runs against the same retained snapshot `selection.ts` validated
+ * against. Passing a newer declaration here is the bug §9 AS item 16 exists to
+ * prevent: it would let a later declaration widen an in-flight authorization.
+ */
+function failure(code, message, extra) {
+    return { ok: false, failure: { code, message, ...extra } };
+}
+/** Stable de-duplication. Grant field and instance lists must be unique (§7). */
+function unique(values) {
+    return Array.from(new Set(values));
+}
+/**
+ * Resolve the field allowlist for one stream.
+ *
+ * Schema-required fields are unioned in unconditionally: §6 calls them the
+ * per-stream consent floor, because a record missing them is not a valid
+ * record of that stream. That means a client asking for fewer fields than the
+ * floor gets the floor, not an error.
+ */
+function resolveFields(request, declared, snapshot) {
+    let requested;
+    if (request.view !== undefined) {
+        const view = snapshot.views?.find((v) => v.name === request.view);
+        if (!view) {
+            return {
+                ok: false,
+                failure: {
+                    code: "unknown_view",
+                    message: `view '${request.view}' is not defined for this source`,
+                    stream: declared.name,
+                },
+            };
+        }
+        requested = view.fields;
+    }
+    else if (request.fields !== undefined) {
+        requested = request.fields;
+    }
+    else {
+        // §6 "Note on defaults": omitting both asks the AS to resolve all
+        // permitted fields from the retained snapshot.
+        requested = declared.fields;
+    }
+    // Intersect with the declared schema before adding the floor, so a view or
+    // allowlist can never introduce a field the snapshot does not define.
+    const permitted = requested.filter((f) => declared.fields.includes(f));
+    const fields = unique([...permitted, ...declared.required_fields]);
+    if (fields.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "empty_field_set",
+                message: `stream '${declared.name}' resolved to an empty field set`,
+                stream: declared.name,
+            },
+        };
+    }
+    return { ok: true, fields };
+}
+/**
+ * Resolve instance handles for one stream.
+ *
+ * Three outcomes, per §6 and §7: explicit handles are verified for
+ * eligibility; a single eligible handle resolves automatically; anything else
+ * is an owner choice the AS must surface before the final approval surface.
+ */
+function resolveInstances(request, streamName, inventory) {
+    const eligible = inventory.eligibleFor(streamName);
+    if (request.instance_ids !== undefined && request.instance_ids.length > 0) {
+        const ineligible = request.instance_ids.filter((id) => !eligible.includes(id));
+        if (ineligible.length > 0) {
+            return {
+                ok: false,
+                failure: {
+                    code: "unknown_instance",
+                    message: `stream '${streamName}' requests instance handles that are not eligible: ${ineligible.join(", ")}`,
+                    stream: streamName,
+                },
+            };
+        }
+        // Explicitly listing more than one handle is how a client asks for
+        // fan-in, and it is allowed precisely because it is explicit.
+        return { ok: true, instanceIds: unique(request.instance_ids) };
+    }
+    if (eligible.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "no_eligible_instance",
+                message: `stream '${streamName}' has no connected instance to authorize`,
+                stream: streamName,
+            },
+        };
+    }
+    if (eligible.length > 1) {
+        // Omission never means fan-in. The owner picks.
+        return {
+            ok: false,
+            failure: {
+                code: "instance_choice_required",
+                message: `stream '${streamName}' has ${eligible.length} eligible instances and the request named none`,
+                stream: streamName,
+                candidates: eligible,
+            },
+        };
+    }
+    return { ok: true, instanceIds: [eligible[0]] };
+}
+/**
+ * Freeze `time_range` into the grant's `time_constraint`, binding the
+ * declaration's `consent_time_field` as the field the RS evaluates against.
+ * Freezing the field name (not just the bounds) is what stops a later
+ * declaration that renames its time field from silently re-scoping the grant.
+ */
+function resolveTimeConstraint(request, declared) {
+    if (!request.time_range)
+        return undefined;
+    const { since, until } = request.time_range;
+    if (since === undefined && until === undefined)
+        return undefined;
+    // Validation already rejected time_range on a stream with no time field.
+    const field = declared.consent_time_field;
+    if (!field)
+        return undefined;
+    return {
+        field,
+        ...(since !== undefined && { since }),
+        ...(until !== undefined && { until }),
+    };
+}
+function resolveOneStream(request, declared, snapshot, inventory) {
+    const fields = resolveFields(request, declared, snapshot);
+    if (!fields.ok)
+        return fields;
+    const instances = resolveInstances(request, declared.name, inventory);
+    if (!instances.ok)
+        return instances;
+    const timeConstraint = resolveTimeConstraint(request, declared);
+    return {
+        ok: true,
+        stream: {
+            name: declared.name,
+            instance_ids: instances.instanceIds,
+            fields: fields.fields,
+            ...(timeConstraint && { time_constraint: timeConstraint }),
+            ...(request.resources && { resources: unique(request.resources) }),
+        },
+    };
+}
+/**
+ * Expand the request's stream selections into the concrete list to resolve.
+ *
+ * A wildcard entry fans out to every declared stream, carrying its own
+ * per-stream parameters with it — §6 says a wildcard's `instance_ids` apply to
+ * every expanded stream, and each handle is then verified per stream by
+ * `resolveInstances`. A preset expands from the snapshot instead.
+ */
+function expandSelections(request, snapshot) {
+    if (request.selection_preset !== undefined) {
+        const preset = snapshot.selection_presets?.find((p) => p.name === request.selection_preset);
+        return preset ? preset.streams : [];
+    }
+    const streams = request.streams ?? [];
+    const wildcard = streams.find((s) => s.name === "*");
+    if (wildcard) {
+        return snapshot.streams.map((declared) => ({
+            ...wildcard,
+            name: declared.name,
+            // A wildcard cannot carry a view (validation rejects that pairing), and
+            // its time_range only applies to streams that can accept one. Dropping
+            // it for time-incapable streams is what makes `{"name":"*"}` with a
+            // time_range usable on a mixed-capability source at all.
+            ...(wildcard.time_range && !declared.consent_time_field
+                ? { time_range: undefined }
+                : {}),
+        }));
+    }
+    return streams;
+}
+/**
+ * Resolve every enforcement axis for a validated selection request.
+ *
+ * Call this before showing the final approval surface: §7 requires the
+ * approval artifact to contain the exact resolved instance handles, stream
+ * names, fields, resources, and temporal bounds, which only exist once this
+ * has run.
+ */
+export function resolveSelection(request, snapshot, inventory) {
+    const selections = expandSelections(request, snapshot);
+    if (selections.length === 0) {
+        return failure("unknown_stream", "the selection resolved to no streams against the retained snapshot");
+    }
+    const resolved = [];
+    for (const selection of selections) {
+        const declared = snapshot.streams.find((s) => s.name === selection.name);
+        if (!declared) {
+            return failure("unknown_stream", `stream '${selection.name}' is not declared by the retained snapshot`, { stream: selection.name });
+        }
+        const result = resolveOneStream(selection, declared, snapshot, inventory);
+        if (!result.ok)
+            return { ok: false, failure: result.failure };
+        resolved.push(result.stream);
+    }
+    return { ok: true, streams: resolved };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/pdpp/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/pdpp/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA2CH,SAAS,OAAO,CACd,IAA2B,EAC3B,OAAe,EACf,KAAkC;IAElC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,OAAsB,EACtB,QAAwB,EACxB,QAA6B;IAE7B,IAAI,SAAmB,CAAC;IAExB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,kCAAkC;oBAChE,MAAM,EAAE,QAAQ,CAAC,IAAI;iBACtB;aACF,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,kEAAkE;QAClE,+CAA+C;QAC/C,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,WAAW,QAAQ,CAAC,IAAI,kCAAkC;gBACnE,MAAM,EAAE,QAAQ,CAAC,IAAI;aACtB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAAsB,EACtB,UAAkB,EAClB,SAA4B;IAI5B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAC5C,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC/B,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,UAAU,sDAAsD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC3G,MAAM,EAAE,UAAU;iBACnB;aACF,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,8DAA8D;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,WAAW,UAAU,0CAA0C;gBACxE,MAAM,EAAE,UAAU;aACnB;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,gDAAgD;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,WAAW,UAAU,SAAS,QAAQ,CAAC,MAAM,gDAAgD;gBACtG,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,QAAQ;aACrB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,OAAsB,EACtB,QAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,yEAAyE;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO;QACL,KAAK;QACL,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAsB,EACtB,QAAwB,EACxB,QAA6B,EAC7B,SAA4B;IAI5B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,SAAS,CAAC,WAAW;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,cAAc,IAAI,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,OAAyB,EACzB,QAA6B;IAE7B,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,gBAAgB,CAC3C,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzC,GAAG,QAAQ;YACX,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,yDAAyD;YACzD,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,kBAAkB;gBACrD,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE;gBAC3B,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAyB,EACzB,QAA6B,EAC7B,SAA4B;IAE5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,gBAAgB,EAChB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,OAAO,CACZ,gBAAgB,EAChB,WAAW,SAAS,CAAC,IAAI,4CAA4C,EACrE,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,CAC3B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC"}

package/dist/pdpp/review.d.ts

@@ -0,0 +1,155 @@
+/**
+ * PDPP Core §6/§7 consent review model and immutable review digest.
+ *
+ * Two jobs here, and they are related:
+ *
+ * 1. Build the review model Account/Web renders. §6 forbids flattening the
+ *    consent surface: requester identity, declaration-authored data
+ *    descriptions, structured policy declarations, and attributed client
+ *    claims are four distinct categories, and a client claim must never be
+ *    rendered in the same register as a protocol-enforced term. The model
+ *    below keeps them in four separate fields so a renderer cannot
+ *    accidentally merge them.
+ *
+ * 2. Compute a digest over the decision fields. §7 requires the approval
+ *    mutation to bind to an immutable review revision or digest, and to reject
+ *    approval if eligibility or the reviewed revision changed in the meantime.
+ *    That is what stops a resolved-then-widened race: the owner approves a
+ *    digest, and issuance re-derives the digest from what it is about to issue.
+ *    If they differ, the approval is stale and dies.
+ *
+ * The digest covers exactly the decision fields §7 enumerates, plus the
+ * normalized client claims when they were rendered. It deliberately does NOT
+ * cover `issued_at` or `grant_id`, which do not exist yet at review time.
+ */
+import { type ClientClaims, type ClientDisplay, type DeclarationSnapshot, type Retention, type SelectionRequest, type StreamGrant } from "./types.js";
+/** How the AS resolved requester identity, and how much it actually knows. */
+export interface RequesterIdentity {
+    client_id: string;
+    /** Resolved per §6 precedence. Falls back to `client_id` when nothing else exists. */
+    display_name: string;
+    display?: ClientDisplay;
+    /**
+     * §6 obligation 5: verified domain control is named, never presented as an
+     * unqualified "verified app". Absent means no positive trust signal, and the
+     * surface must show an unverified indicator.
+     */
+    verified_domain?: string;
+    /** True only for a local registration or trust-registry admission decision. */
+    app_approved: boolean;
+}
+/** One stream row as the owner reviews it, with declaration-authored copy. */
+export interface ReviewStream {
+    name: string;
+    /** Declaration-authored description. Its own category — not a client claim. */
+    description?: string;
+    instance_ids: string[];
+    fields: string[];
+    time_constraint?: {
+        field: string;
+        since?: string;
+        until?: string;
+    };
+    resources?: string[];
+}
+/**
+ * The four semantic categories §6 requires a conformant consent surface to
+ * keep distinct. A renderer that wants to flatten them has to do so
+ * deliberately; it cannot do so by accident.
+ */
+export interface ConsentReviewModel {
+    /** Category 1: who is asking. */
+    requester: RequesterIdentity;
+    /** Category 2: declaration-authored data descriptions + protocol-enforced terms. */
+    data: {
+        source: {
+            kind: string;
+            id: string;
+        };
+        source_declaration_version: string;
+        access_mode: "single_use" | "continuous";
+        streams: ReviewStream[];
+        expires_at?: string;
+    };
+    /** Category 3: structured policy declarations. */
+    policy: {
+        purpose_code: string;
+        purpose_description?: string;
+        /**
+         * True when the code is absent from the PDPP registry. §9 AS item 6:
+         * this drives *rendering* (show the description or raw URI), never
+         * rejection.
+         */
+        purpose_unregistered: boolean;
+        retention?: Retention;
+        /**
+         * §6: the sole purpose code with a protocol-level consent requirement.
+         * The surface must collect explicit affirmative consent when this is set.
+         */
+        requires_explicit_ai_training_consent: boolean;
+    };
+    /** Category 4: attributed, unverifiable, non-enforceable client claims. */
+    client_claims?: {
+        /** Always rendered as "<name> says:" — never as a protocol term. */
+        attributed_to: string;
+        commitments: string[];
+    };
+    /** Digest over the decision fields. The approval must carry this back. */
+    review_digest: string;
+}
+export declare function isRegisteredPurposeCode(code: string): boolean;
+/**
+ * Normalize client claims before binding. §6 requires the *normalized exact*
+ * claims to be bound into the approval artifact, so the digest has to be
+ * computed over a canonical form — otherwise re-rendering with different
+ * whitespace would spuriously invalidate an approval.
+ */
+export declare function normalizeClientClaims(claims: ClientClaims | undefined): string[] | undefined;
+/**
+ * The exact set of fields the digest covers. Kept as its own type so that
+ * adding a decision field to the grant without adding it here is a visible
+ * omission rather than a silent hole in the binding.
+ */
+interface ReviewDecisionFields {
+    subject_id: string;
+    client_id: string;
+    source_id: string;
+    source_kind: string;
+    source_declaration_version: string;
+    /** The digest of the retained snapshot, so a re-fetched declaration cannot pass. */
+    declaration_digest: string;
+    purpose_code: string;
+    purpose_description?: string;
+    access_mode: string;
+    streams: StreamGrant[];
+    retention?: Retention;
+    expires_at?: string;
+    /** Bound with attribution when rendered; stays outside the grant regardless. */
+    client_claims?: {
+        attributed_to: string;
+        commitments: string[];
+    };
+}
+export declare function computeReviewDigest(fields: ReviewDecisionFields): string;
+export interface BuildReviewInput {
+    subjectId: string;
+    request: SelectionRequest;
+    snapshot: DeclarationSnapshot;
+    /** The output of `resolveSelection` — fully concrete. */
+    resolvedStreams: StreamGrant[];
+    requester: RequesterIdentity;
+    /** AS-policy grant expiry, when the deployment sets one. */
+    expiresAt?: string;
+    /** Declaration-authored stream descriptions, keyed by stream name. */
+    streamDescriptions?: Record<string, string>;
+}
+/**
+ * Build the review model and its binding digest.
+ *
+ * The digest is computed from the same resolved streams that will be issued.
+ * `issueGrant` recomputes it and refuses to issue if it moved — see
+ * `issuance.ts`.
+ */
+export declare function buildConsentReview(input: BuildReviewInput): ConsentReviewModel;
+export {};
+//# sourceMappingURL=review.d.ts.map

package/dist/pdpp/review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/pdpp/review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,oFAAoF;IACpF,IAAI,EAAE;QACJ,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACrC,0BAA0B,EAAE,MAAM,CAAC;QACnC,WAAW,EAAE,YAAY,GAAG,YAAY,CAAC;QACzC,OAAO,EAAE,YAAY,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,kDAAkD;IAClD,MAAM,EAAE;QACN,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;WAIG;QACH,oBAAoB,EAAE,OAAO,CAAC;QAC9B,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB;;;WAGG;QACH,qCAAqC,EAAE,OAAO,CAAC;KAChD,CAAC;IACF,2EAA2E;IAC3E,aAAa,CAAC,EAAE;QACd,oEAAoE;QACpE,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;CACvB;AAeD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,MAAM,EAAE,GAAG,SAAS,CAOtB;AAED;;;;GAIG;AACH,UAAU,oBAAoB;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B,EAAE,MAAM,CAAC;IACnC,oFAAoF;IACpF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,aAAa,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAClE;AAwBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAIxE;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,yDAAyD;IACzD,eAAe,EAAE,WAAW,EAAE,CAAC;IAC/B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,gBAAgB,GACtB,kBAAkB,CAuDpB"}

package/dist/pdpp/review.js

@@ -0,0 +1,142 @@
+/**
+ * PDPP Core §6/§7 consent review model and immutable review digest.
+ *
+ * Two jobs here, and they are related:
+ *
+ * 1. Build the review model Account/Web renders. §6 forbids flattening the
+ *    consent surface: requester identity, declaration-authored data
+ *    descriptions, structured policy declarations, and attributed client
+ *    claims are four distinct categories, and a client claim must never be
+ *    rendered in the same register as a protocol-enforced term. The model
+ *    below keeps them in four separate fields so a renderer cannot
+ *    accidentally merge them.
+ *
+ * 2. Compute a digest over the decision fields. §7 requires the approval
+ *    mutation to bind to an immutable review revision or digest, and to reject
+ *    approval if eligibility or the reviewed revision changed in the meantime.
+ *    That is what stops a resolved-then-widened race: the owner approves a
+ *    digest, and issuance re-derives the digest from what it is about to issue.
+ *    If they differ, the approval is stale and dies.
+ *
+ * The digest covers exactly the decision fields §7 enumerates, plus the
+ * normalized client claims when they were rendered. It deliberately does NOT
+ * cover `issued_at` or `grant_id`, which do not exist yet at review time.
+ */
+import { createHash } from "node:crypto";
+import { AI_TRAINING_PURPOSE, } from "./types.js";
+/**
+ * Purpose codes in the Appendix A initial registry. Membership drives display
+ * only. An unrecognized code is displayed from its description or raw URI and
+ * is never a rejection reason on its own (§9 AS item 6).
+ */
+const REGISTERED_PURPOSE_CODES = new Set([
+    "https://pdpp.dev/purpose/personalization",
+    "https://pdpp.dev/purpose/analytics",
+    "https://pdpp.dev/purpose/research",
+    "https://pdpp.dev/purpose/portability",
+    "https://pdpp.dev/purpose/ai_training",
+]);
+export function isRegisteredPurposeCode(code) {
+    return REGISTERED_PURPOSE_CODES.has(code);
+}
+/**
+ * Normalize client claims before binding. §6 requires the *normalized exact*
+ * claims to be bound into the approval artifact, so the digest has to be
+ * computed over a canonical form — otherwise re-rendering with different
+ * whitespace would spuriously invalidate an approval.
+ */
+export function normalizeClientClaims(claims) {
+    const commitments = claims?.commitments;
+    if (!commitments || commitments.length === 0)
+        return undefined;
+    const normalized = commitments
+        .map((c) => c.trim().replace(/\s+/g, " "))
+        .filter((c) => c.length > 0);
+    return normalized.length > 0 ? normalized : undefined;
+}
+/**
+ * Deterministic serialization. `JSON.stringify` preserves insertion order, so
+ * we sort keys explicitly — two structurally identical decisions must produce
+ * one digest regardless of how the objects were built.
+ */
+function canonicalize(value) {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value) ?? "null";
+    }
+    if (Array.isArray(value)) {
+        // Array order is meaningful (a field list's order is part of the decision
+        // the owner saw), so we do not sort array members.
+        return `[${value.map(canonicalize).join(",")}]`;
+    }
+    const entries = Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries
+        .map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`)
+        .join(",")}}`;
+}
+export function computeReviewDigest(fields) {
+    return createHash("sha256")
+        .update(canonicalize(fields), "utf8")
+        .digest("hex");
+}
+/**
+ * Build the review model and its binding digest.
+ *
+ * The digest is computed from the same resolved streams that will be issued.
+ * `issueGrant` recomputes it and refuses to issue if it moved — see
+ * `issuance.ts`.
+ */
+export function buildConsentReview(input) {
+    const { request, snapshot, resolvedStreams, requester } = input;
+    const normalizedClaims = normalizeClientClaims(request.client_claims);
+    const boundClaims = normalizedClaims
+        ? { attributed_to: requester.display_name, commitments: normalizedClaims }
+        : undefined;
+    const review_digest = computeReviewDigest({
+        subject_id: input.subjectId,
+        client_id: requester.client_id,
+        source_id: snapshot.source_id,
+        source_kind: snapshot.source_kind,
+        source_declaration_version: snapshot.version,
+        declaration_digest: snapshot.digest,
+        purpose_code: request.purpose_code,
+        purpose_description: request.purpose_description,
+        access_mode: request.access_mode,
+        streams: resolvedStreams,
+        retention: request.retention,
+        expires_at: input.expiresAt,
+        client_claims: boundClaims,
+    });
+    return {
+        requester,
+        data: {
+            source: { kind: snapshot.source_kind, id: snapshot.source_id },
+            source_declaration_version: snapshot.version,
+            access_mode: request.access_mode,
+            streams: resolvedStreams.map((s) => ({
+                name: s.name,
+                ...(input.streamDescriptions?.[s.name] && {
+                    description: input.streamDescriptions[s.name],
+                }),
+                instance_ids: s.instance_ids,
+                fields: s.fields,
+                ...(s.time_constraint && { time_constraint: s.time_constraint }),
+                ...(s.resources && { resources: s.resources }),
+            })),
+            ...(input.expiresAt && { expires_at: input.expiresAt }),
+        },
+        policy: {
+            purpose_code: request.purpose_code,
+            ...(request.purpose_description && {
+                purpose_description: request.purpose_description,
+            }),
+            purpose_unregistered: !isRegisteredPurposeCode(request.purpose_code),
+            ...(request.retention && { retention: request.retention }),
+            requires_explicit_ai_training_consent: request.purpose_code === AI_TRAINING_PURPOSE,
+        },
+        ...(boundClaims && { client_claims: boundClaims }),
+        review_digest,
+    };
+}
+//# sourceMappingURL=review.js.map

package/dist/pdpp/review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../src/pdpp/review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,GAOpB,MAAM,YAAY,CAAC;AAwEpB;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,0CAA0C;IAC1C,oCAAoC;IACpC,mCAAmC;IACnC,sCAAsC;IACtC,sCAAsC;CACvC,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAgC;IAEhC,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,CAAC;IACxC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,UAAU,GAAG,WAAW;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAyBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,0EAA0E;QAC1E,mDAAmD;QACnD,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,IAAI,OAAO;SACf,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;SACpC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAEhE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,gBAAgB;QAClC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE;QAC1E,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,aAAa,GAAG,mBAAmB,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,0BAA0B,EAAE,QAAQ,CAAC,OAAO;QAC5C,kBAAkB,EAAE,QAAQ,CAAC,MAAM;QACnC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,IAAI,EAAE;YACJ,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE;YAC9D,0BAA0B,EAAE,QAAQ,CAAC,OAAO;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACxC,WAAW,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;iBAC9C,CAAC;gBACF,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;gBAChE,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACxD;QACD,MAAM,EAAE;YACN,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI;gBACjC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC;YACF,oBAAoB,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC;YACpE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1D,qCAAqC,EACnC,OAAO,CAAC,YAAY,KAAK,mBAAmB;SAC/C;QACD,GAAG,CAAC,WAAW,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;QAClD,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/pdpp/selection.d.ts

@@ -0,0 +1,43 @@
+/**
+ * PDPP Core §6 selection-request validation.
+ *
+ * This is the shape gate that runs before consent. It answers one question:
+ * is this request expressible against the retained declaration snapshot? It
+ * does not resolve anything — `resolve.ts` does that, and only against the
+ * same snapshot this module validated against.
+ *
+ * "Fails neutrally" in §6 means the both/neither `streams`/`selection_preset`
+ * failure is a Source validation failure the binding maps to an error code; it
+ * must not leak which of the two the client got wrong, and it must not depend
+ * on any owner-specific state. We return a binding-neutral failure and let the
+ * OAuth/RAR layer map it to RFC 9396 `invalid_authorization_details`.
+ */
+import { type DeclarationSnapshot, type SelectionRequest } from "./types.js";
+/**
+ * Binding-neutral validation failure codes. The OAuth/RAR binding maps these
+ * to wire errors in `../../../server/src/routes/pdpp-authorize.ts`; Core
+ * itself stays binding-neutral (§9 AS item 5).
+ */
+export type SelectionFailureCode = 
+/** Both or neither of `streams` and `selection_preset`. */
+"source_validation_failed" | "unknown_stream" | "unknown_preset" | "unknown_view" | "unknown_field" | "unsupported_selection_parameter" | "invalid_resource_key" | "invalid_request";
+export interface SelectionFailure {
+    code: SelectionFailureCode;
+    message: string;
+}
+export type SelectionValidation = {
+    ok: true;
+} | {
+    ok: false;
+    failure: SelectionFailure;
+};
+/**
+ * Validate one selection request against the retained declaration snapshot.
+ *
+ * The caller must have already retrieved and pinned `snapshot`; this function
+ * never fetches. §9 AS item 16 requires that the same snapshot carry through
+ * consent and issuance, so passing a freshly fetched declaration here and a
+ * different one to `resolveGrant` would defeat the whole guarantee.
+ */
+export declare function validateSelectionRequest(request: SelectionRequest, snapshot: DeclarationSnapshot): SelectionValidation;
+//# sourceMappingURL=selection.d.ts.map

package/dist/pdpp/selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection.d.ts","sourceRoot":"","sources":["../../src/pdpp/selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EAEtB,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,MAAM,oBAAoB;AAC9B,2DAA2D;AACzD,0BAA0B,GAC1B,gBAAgB,GAChB,gBAAgB,GAChB,cAAc,GACd,eAAe,GACf,iCAAiC,GACjC,sBAAsB,GACtB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,mBAAmB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAsK1D;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,mBAAmB,GAC5B,mBAAmB,CAwGrB"}