@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/pdpp/store.js

@@ -0,0 +1,501 @@
+/**
+ * Persisted PDPP authorization state: declarations, grants, authorization
+ * codes, and the token/refresh-family graph.
+ *
+ * SQLite via better-sqlite3, matching `../storage/index/schema.ts`. The choice
+ * is not incidental: three requirements in §7/§9 are atomicity requirements,
+ * and a JSON file (the pattern `server/src/token-store.ts` uses for session
+ * tokens) cannot express them without a lock of its own.
+ *
+ *   - §9 AS item 10: a `single_use` grant is consumed *atomically* with first
+ *     client-token issuance.
+ *   - §9 AS item 19: an authorization code is consumed *atomically* on first
+ *     successful redemption; every later redemption fails.
+ *   - §9 AS item 20: refresh reuse revokes the family and all linked tokens.
+ *
+ * Each is implemented as a conditional UPDATE inside a transaction, where the
+ * WHERE clause carries the precondition. `changes === 0` then means "someone
+ * else won the race", which is the only correct answer — checking state and
+ * then writing it would be exactly the TOCTOU bug these items exist to close.
+ *
+ * Tokens are stored as SHA-256 hashes, never plaintext, so a store dump does
+ * not yield usable credentials (§10 "Token security").
+ */
+import { createHash, randomBytes } from "node:crypto";
+import Database from "better-sqlite3";
+/**
+ * Persisted-state contract version. §7 "Version layering" and §9 AS item 21
+ * require the reader to reject state it cannot validate against a supported
+ * contract, and forbid reconstructing missing facts from current config.
+ */
+export const PDPP_AUTH_STATE_VERSION = 1;
+export class UnsupportedAuthStateError extends Error {
+    foundVersion;
+    supportedVersion;
+    constructor(foundVersion, supportedVersion = PDPP_AUTH_STATE_VERSION) {
+        super(`Persisted PDPP authorization state is version ${foundVersion}, which this build cannot validate ` +
+            `(supports ${supportedVersion}). Migrate from retained facts or require fresh consent; ` +
+            `authorization facts must not be reconstructed from current configuration.`);
+        this.foundVersion = foundVersion;
+        this.supportedVersion = supportedVersion;
+        this.name = "UnsupportedAuthStateError";
+    }
+}
+const SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS pdpp_state_meta (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  version INTEGER NOT NULL
+);
+
+-- The exact retained declaration snapshot. Keyed by (source_id, version) so a
+-- later revision is a new row and never overwrites the snapshot an issued
+-- grant was resolved against (§9 AS item 16).
+CREATE TABLE IF NOT EXISTS pdpp_declarations (
+  source_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  digest TEXT NOT NULL,
+  snapshot_json TEXT NOT NULL,
+  -- The exact retrieved bytes. snapshot_json is the parsed snapshot, so
+  -- re-digesting it does not reproduce digest. Without the original document
+  -- the retained digest is unverifiable from the store alone, which is the
+  -- gap this column closes. Nullable because rows retained before this
+  -- column existed have no document to recover; readers must treat NULL as
+  -- cannot-verify, never as verified.
+  document TEXT,
+  retrieved_at TEXT NOT NULL,
+  PRIMARY KEY (source_id, version)
+);
+
+CREATE TABLE IF NOT EXISTS pdpp_grants (
+  grant_id TEXT PRIMARY KEY,
+  subject_id TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  source_id TEXT NOT NULL,
+  declaration_version TEXT NOT NULL,
+  access_mode TEXT NOT NULL CHECK (access_mode IN ('single_use','continuous')),
+  grant_json TEXT NOT NULL,
+  issued_at TEXT NOT NULL,
+  expires_at TEXT,
+  revoked_at TEXT,
+  -- Set atomically with first client-token issuance for single_use grants.
+  consumed_at TEXT,
+  review_digest TEXT NOT NULL,
+  -- Consent evidence: the normalized bound claims, kept out of grant_json so
+  -- they cannot leak into introspection or RS enforcement (§6 client claims).
+  consent_evidence_json TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_pdpp_grants_subject ON pdpp_grants (subject_id);
+
+CREATE TABLE IF NOT EXISTS pdpp_auth_codes (
+  code_hash TEXT PRIMARY KEY,
+  grant_id TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  expires_at TEXT NOT NULL,
+  redeemed_at TEXT,
+  FOREIGN KEY (grant_id) REFERENCES pdpp_grants (grant_id)
+);
+
+-- One row per refresh-token family. Rotation supersedes a token within the
+-- family; reuse of a superseded token kills the whole family (§9 AS item 20).
+CREATE TABLE IF NOT EXISTS pdpp_refresh_families (
+  family_id TEXT PRIMARY KEY,
+  grant_id TEXT NOT NULL,
+  revoked_at TEXT,
+  FOREIGN KEY (grant_id) REFERENCES pdpp_grants (grant_id)
+);
+
+CREATE TABLE IF NOT EXISTS pdpp_refresh_tokens (
+  token_hash TEXT PRIMARY KEY,
+  family_id TEXT NOT NULL,
+  issued_at TEXT NOT NULL,
+  -- Non-null once rotated out. Presenting a superseded token is reuse.
+  superseded_at TEXT,
+  FOREIGN KEY (family_id) REFERENCES pdpp_refresh_families (family_id)
+);
+
+CREATE TABLE IF NOT EXISTS pdpp_access_tokens (
+  token_hash TEXT PRIMARY KEY,
+  grant_id TEXT,
+  subject_id TEXT NOT NULL,
+  client_id TEXT,
+  token_kind TEXT NOT NULL CHECK (token_kind IN ('owner','client')),
+  family_id TEXT,
+  issued_at TEXT NOT NULL,
+  expires_at TEXT,
+  revoked_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_pdpp_access_grant ON pdpp_access_tokens (grant_id);
+CREATE INDEX IF NOT EXISTS idx_pdpp_access_family ON pdpp_access_tokens (family_id);
+`;
+export function hashToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+export function newOpaqueToken(prefix) {
+    return `${prefix}_${randomBytes(32).toString("hex")}`;
+}
+/**
+ * Open (and if needed create) the PDPP authorization store.
+ *
+ * Rejects a store whose persisted version this build cannot validate, before
+ * any caller reads authorization facts out of it. That is §9 AS item 21: the
+ * failure is loud and up front, not a silently-degraded read path.
+ */
+export function openPdppAuthStore(dbPath) {
+    const db = new Database(dbPath);
+    db.pragma("journal_mode = WAL");
+    // Transactions here express atomicity guarantees; a torn write would defeat
+    // exactly the single-use and code-consumption invariants they protect.
+    db.pragma("synchronous = FULL");
+    db.pragma("foreign_keys = ON");
+    db.exec(SCHEMA_SQL);
+    // Additive column migration. `CREATE TABLE IF NOT EXISTS` above does not
+    // alter an existing table, so a database created before `document` existed
+    // still lacks it. Adding a nullable column is backward compatible in both
+    // directions: an older build ignores it, and this build treats NULL as
+    // "not verifiable from the store" rather than as a failure. That is why
+    // this does NOT bump PDPP_AUTH_STATE_VERSION, which would throw
+    // UnsupportedAuthStateError and refuse to boot an existing deployment.
+    const declarationColumns = db
+        .prepare("PRAGMA table_info(pdpp_declarations)")
+        .all();
+    if (!declarationColumns.some((column) => column.name === "document")) {
+        db.exec("ALTER TABLE pdpp_declarations ADD COLUMN document TEXT");
+    }
+    const meta = db
+        .prepare("SELECT version FROM pdpp_state_meta WHERE id = 1")
+        .get();
+    if (meta === undefined) {
+        db.prepare("INSERT INTO pdpp_state_meta (id, version) VALUES (1, ?)").run(PDPP_AUTH_STATE_VERSION);
+    }
+    else if (meta.version !== PDPP_AUTH_STATE_VERSION) {
+        db.close();
+        throw new UnsupportedAuthStateError(meta.version);
+    }
+    return new PdppAuthStore(db);
+}
+export class PdppAuthStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    close() {
+        this.db.close();
+    }
+    // -- declarations -------------------------------------------------------
+    /**
+     * Retain a declaration snapshot, and the exact bytes it was parsed from.
+     *
+     * Idempotent per (source_id, version): a re-retrieval of the same revision
+     * must not disturb the retained facts an issued grant points at, so the
+     * first snapshot wins and is never overwritten.
+     *
+     * The one exception is BACKFILLING `document`. A deployment that retained a
+     * version before this column existed has a NULL document, and a plain
+     * `DO NOTHING` would leave it NULL forever — the existing row would keep
+     * winning on every restart, so the digest would stay unverifiable until the
+     * declaration version happened to change. `COALESCE` fills it in once and
+     * then never changes it, so backfill happens exactly when it is missing and
+     * the retained bytes remain immutable thereafter.
+     */
+    retainDeclaration(snapshot, document) {
+        this.db
+            .prepare(`INSERT INTO pdpp_declarations
+           (source_id, version, digest, snapshot_json, document, retrieved_at)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT (source_id, version) DO UPDATE SET
+           document = COALESCE(pdpp_declarations.document, excluded.document)`)
+            .run(snapshot.source_id, snapshot.version, snapshot.digest, JSON.stringify(snapshot), document ?? null, new Date().toISOString());
+    }
+    getDeclaration(sourceId, version) {
+        const row = this.db
+            .prepare("SELECT snapshot_json FROM pdpp_declarations WHERE source_id = ? AND version = ?")
+            .get(sourceId, version);
+        return row ? JSON.parse(row.snapshot_json) : null;
+    }
+    /**
+     * The exact retrieved bytes a retained declaration was parsed from.
+     *
+     * Returns null when this row predates the `document` column and has not been
+     * backfilled. A caller MUST treat null as "cannot verify from the store",
+     * never as "verified" — the whole point of this accessor is that re-digesting
+     * `snapshot_json` would silently produce a different value than the retained
+     * `digest`.
+     */
+    getDeclarationDocument(sourceId, version) {
+        const row = this.db
+            .prepare("SELECT document FROM pdpp_declarations WHERE source_id = ? AND version = ?")
+            .get(sourceId, version);
+        return row?.document ?? null;
+    }
+    // -- grants -------------------------------------------------------------
+    insertGrant(input) {
+        const { grant } = input;
+        this.db
+            .prepare(`INSERT INTO pdpp_grants
+           (grant_id, subject_id, client_id, source_id, declaration_version,
+            access_mode, grant_json, issued_at, expires_at, review_digest,
+            consent_evidence_json)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(grant.grant_id, input.subjectId, grant.client.client_id, grant.source.id, grant.source_declaration.version, grant.access_mode, JSON.stringify(grant), grant.issued_at, grant.expires_at ?? null, input.reviewDigest, input.consentEvidence ? JSON.stringify(input.consentEvidence) : null);
+    }
+    getGrant(grantId) {
+        const row = this.db
+            .prepare("SELECT * FROM pdpp_grants WHERE grant_id = ?")
+            .get(grantId);
+        if (!row)
+            return null;
+        return {
+            grant: JSON.parse(row.grant_json),
+            subjectId: row.subject_id,
+            clientId: row.client_id,
+            reviewDigest: row.review_digest,
+            issuedAt: row.issued_at,
+            expiresAt: row.expires_at,
+            revokedAt: row.revoked_at,
+            consumedAt: row.consumed_at,
+        };
+    }
+    listGrantsForSubject(subjectId) {
+        const rows = this.db
+            .prepare("SELECT * FROM pdpp_grants WHERE subject_id = ? ORDER BY issued_at DESC")
+            .all(subjectId);
+        return rows.map((row) => ({
+            grant: JSON.parse(row.grant_json),
+            subjectId: row.subject_id,
+            clientId: row.client_id,
+            reviewDigest: row.review_digest,
+            issuedAt: row.issued_at,
+            expiresAt: row.expires_at,
+            revokedAt: row.revoked_at,
+            consumedAt: row.consumed_at,
+        }));
+    }
+    /**
+     * Grant lifecycle (§9 AS item 8). Revoked beats expired: once an owner
+     * revokes, that is the fact worth reporting, and it does not become
+     * "expired" later just because the clock passed.
+     */
+    grantStatus(stored, now = new Date()) {
+        if (stored.revokedAt)
+            return "revoked";
+        if (stored.expiresAt && Date.parse(stored.expiresAt) <= now.getTime()) {
+            return "expired";
+        }
+        return "active";
+    }
+    /**
+     * Revoke a grant and everything linked to it, in one transaction.
+     *
+     * §2 of the delivery scope: the AS marks the grant and every linked token
+     * family inactive *immediately*. Doing this in one transaction means there
+     * is no window where the grant reads revoked but a linked access token still
+     * introspects active.
+     *
+     * Returns false if the grant does not exist or was already revoked, so a
+     * double revoke is not reported as a fresh one.
+     */
+    revokeGrant(grantId, now = new Date()) {
+        const at = now.toISOString();
+        const tx = this.db.transaction(() => {
+            const result = this.db
+                .prepare("UPDATE pdpp_grants SET revoked_at = ? WHERE grant_id = ? AND revoked_at IS NULL")
+                .run(at, grantId);
+            if (result.changes === 0)
+                return false;
+            this.db
+                .prepare("UPDATE pdpp_access_tokens SET revoked_at = ? WHERE grant_id = ? AND revoked_at IS NULL")
+                .run(at, grantId);
+            this.db
+                .prepare("UPDATE pdpp_refresh_families SET revoked_at = ? WHERE grant_id = ? AND revoked_at IS NULL")
+                .run(at, grantId);
+            return true;
+        });
+        return tx();
+    }
+    // -- authorization codes ------------------------------------------------
+    insertAuthCode(code, record) {
+        this.db
+            .prepare(`INSERT INTO pdpp_auth_codes
+           (code_hash, grant_id, client_id, redirect_uri, code_challenge,
+            code_challenge_method, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(hashToken(code), record.grantId, record.clientId, record.redirectUri, record.codeChallenge, record.codeChallengeMethod, record.expiresAt);
+    }
+    /**
+     * Consume an authorization code atomically (§9 AS item 19).
+     *
+     * The `redeemed_at IS NULL` predicate lives in the UPDATE, so two concurrent
+     * redemptions of the same code cannot both see it unredeemed. Exactly one
+     * gets `changes === 1`; the loser gets null and the caller returns
+     * `invalid_grant`. An expired code fails the same way, and a replayed code
+     * never issues a second token.
+     */
+    consumeAuthCode(code, now = new Date()) {
+        const hash = hashToken(code);
+        const at = now.toISOString();
+        const tx = this.db.transaction(() => {
+            const result = this.db
+                .prepare(`UPDATE pdpp_auth_codes SET redeemed_at = ?
+           WHERE code_hash = ? AND redeemed_at IS NULL AND expires_at > ?`)
+                .run(at, hash, at);
+            if (result.changes === 0)
+                return null;
+            const row = this.db
+                .prepare("SELECT * FROM pdpp_auth_codes WHERE code_hash = ?")
+                .get(hash);
+            return {
+                grantId: row.grant_id,
+                clientId: row.client_id,
+                redirectUri: row.redirect_uri,
+                codeChallenge: row.code_challenge,
+                codeChallengeMethod: row.code_challenge_method,
+                expiresAt: row.expires_at,
+            };
+        });
+        return tx();
+    }
+    // -- tokens -------------------------------------------------------------
+    /**
+     * Consume a `single_use` grant atomically with the first client access token
+     * (§9 AS item 10 / §7 access modes).
+     *
+     * Both the consumption and the token insert happen in one transaction with
+     * the precondition in the UPDATE's WHERE clause, so a second concurrent
+     * issuance attempt finds `changes === 0` and issues nothing. A `continuous`
+     * grant skips the consume step and may issue repeatedly.
+     *
+     * Returns false when the grant was already consumed — the caller maps that
+     * to `invalid_grant`. Note §7: the RS still honors tokens already issued
+     * against a consumed grant until they expire or are revoked; consumption
+     * blocks *new* token issuance, not use of the existing token.
+     */
+    issueAccessToken(input) {
+        const now = input.now ?? new Date();
+        const at = now.toISOString();
+        const tx = this.db.transaction(() => {
+            if (input.consumeSingleUse) {
+                if (!input.grantId)
+                    return false;
+                const consumed = this.db
+                    .prepare(`UPDATE pdpp_grants SET consumed_at = ?
+             WHERE grant_id = ? AND consumed_at IS NULL
+               AND access_mode = 'single_use' AND revoked_at IS NULL`)
+                    .run(at, input.grantId);
+                if (consumed.changes === 0)
+                    return false;
+            }
+            this.db
+                .prepare(`INSERT INTO pdpp_access_tokens
+             (token_hash, grant_id, subject_id, client_id, token_kind,
+              family_id, issued_at, expires_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(hashToken(input.token), input.grantId, input.subjectId, input.clientId, input.tokenKind, input.familyId ?? null, at, input.expiresAt);
+            return true;
+        });
+        return tx();
+    }
+    getAccessToken(token) {
+        const row = this.db
+            .prepare("SELECT * FROM pdpp_access_tokens WHERE token_hash = ?")
+            .get(hashToken(token));
+        if (!row)
+            return null;
+        return {
+            tokenHash: row.token_hash,
+            grantId: row.grant_id,
+            subjectId: row.subject_id,
+            clientId: row.client_id,
+            tokenKind: row.token_kind,
+            familyId: row.family_id,
+            issuedAt: row.issued_at,
+            expiresAt: row.expires_at,
+            revokedAt: row.revoked_at,
+        };
+    }
+    // -- refresh families ---------------------------------------------------
+    createRefreshFamily(grantId) {
+        const familyId = `rfam_${randomBytes(16).toString("hex")}`;
+        this.db
+            .prepare("INSERT INTO pdpp_refresh_families (family_id, grant_id) VALUES (?, ?)")
+            .run(familyId, grantId);
+        return familyId;
+    }
+    insertRefreshToken(token, familyId, now = new Date()) {
+        this.db
+            .prepare("INSERT INTO pdpp_refresh_tokens (token_hash, family_id, issued_at) VALUES (?, ?, ?)")
+            .run(hashToken(token), familyId, now.toISOString());
+    }
+    /**
+     * Rotate a refresh token, detecting reuse (§9 AS item 20).
+     *
+     * Three outcomes:
+     *   - `{ ok: true }`: the presented token was current; it is superseded and
+     *     the caller issues a replacement in the same family.
+     *   - `{ ok: false, reason: "reuse_detected" }`: the token was already
+     *     superseded. The family and every family-linked access token are
+     *     revoked here, atomically, before returning. The caller returns
+     *     `invalid_grant` and the client must obtain fresh authorization.
+     *   - `{ ok: false, reason: "unknown" | "family_revoked" }`: nothing to
+     *     rotate.
+     *
+     * Reuse revoking the family is the whole point: an attacker who replays a
+     * stolen refresh token and a legitimate client who replays after a dropped
+     * response are indistinguishable, so the safe response is to kill both and
+     * force a fresh grant-backed authorization.
+     */
+    rotateRefreshToken(presented, now = new Date()) {
+        const hash = hashToken(presented);
+        const at = now.toISOString();
+        const tx = this.db.transaction(() => {
+            const row = this.db
+                .prepare(`SELECT t.token_hash, t.family_id, t.superseded_at,
+                  f.revoked_at AS family_revoked_at, f.grant_id
+           FROM pdpp_refresh_tokens t
+           JOIN pdpp_refresh_families f ON f.family_id = t.family_id
+           WHERE t.token_hash = ?`)
+                .get(hash);
+            if (!row)
+                return { ok: false, reason: "unknown" };
+            if (row.family_revoked_at) {
+                return { ok: false, reason: "family_revoked" };
+            }
+            if (row.superseded_at) {
+                // Reuse. Burn the family and every access token issued under it.
+                this.db
+                    .prepare("UPDATE pdpp_refresh_families SET revoked_at = ? WHERE family_id = ?")
+                    .run(at, row.family_id);
+                this.db
+                    .prepare(`UPDATE pdpp_access_tokens SET revoked_at = ?
+             WHERE family_id = ? AND revoked_at IS NULL`)
+                    .run(at, row.family_id);
+                return { ok: false, reason: "reuse_detected" };
+            }
+            this.db
+                .prepare("UPDATE pdpp_refresh_tokens SET superseded_at = ? WHERE token_hash = ?")
+                .run(at, hash);
+            return {
+                ok: true,
+                familyId: row.family_id,
+                grantId: row.grant_id,
+            };
+        });
+        return tx();
+    }
+    /** Revoke one access token. Returns false if unknown or already revoked. */
+    revokeAccessToken(token, now = new Date()) {
+        const result = this.db
+            .prepare("UPDATE pdpp_access_tokens SET revoked_at = ? WHERE token_hash = ? AND revoked_at IS NULL")
+            .run(now.toISOString(), hashToken(token));
+        return result.changes > 0;
+    }
+    isFamilyRevoked(familyId) {
+        const row = this.db
+            .prepare("SELECT revoked_at FROM pdpp_refresh_families WHERE family_id = ?")
+            .get(familyId);
+        return row ? row.revoked_at !== null : true;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/pdpp/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/pdpp/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAQtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEvC;IACA;IAFX,YACW,YAAoB,EACpB,mBAA2B,uBAAuB;QAE3D,KAAK,CACH,iDAAiD,YAAY,qCAAqC;YAChG,aAAa,gBAAgB,2DAA2D;YACxF,2EAA2E,CAC9E,CAAC;QAPO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,qBAAgB,GAAhB,gBAAgB,CAAkC;QAO3D,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwFlB,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,GAAG,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AA8CD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAChC,4EAA4E;IAC5E,uEAAuE;IACvE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAChC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC/B,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAEpB,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,gEAAgE;IAChE,uEAAuE;IACvE,MAAM,kBAAkB,GAAG,EAAE;SAC1B,OAAO,CAAC,sCAAsC,CAAC;SAC/C,GAAG,EAAwB,CAAC;IAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;QACrE,EAAE,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,kDAAkD,CAAC;SAC3D,GAAG,EAAqC,CAAC;IAE5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CACvE,uBAAuB,CACxB,CAAC;IACJ,CAAC;SAAM,IAAI,IAAI,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;QACpD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAEtD,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;IAED,0EAA0E;IAE1E;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,QAA6B,EAAE,QAAiB;QAChE,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;8EAIsE,CACvE;aACA,GAAG,CACF,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,MAAM,EACf,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EACxB,QAAQ,IAAI,IAAI,EAChB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CACzB,CAAC;IACN,CAAC;IAED,cAAc,CACZ,QAAgB,EAChB,OAAe;QAEf,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,iFAAiF,CAClF;aACA,GAAG,CAAC,QAAQ,EAAE,OAAO,CAA0C,CAAC;QACnE,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAyB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAgB,EAAE,OAAe;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,4EAA4E,CAC7E;aACA,GAAG,CAAC,QAAQ,EAAE,OAAO,CAA4C,CAAC;QACrE,OAAO,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED,0EAA0E;IAE1E,WAAW,CAAC,KAMX;QACC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;kDAI0C,CAC3C;aACA,GAAG,CACF,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,CAAC,SAAS,EACtB,KAAK,CAAC,MAAM,CAAC,EAAE,EACf,KAAK,CAAC,kBAAkB,CAAC,OAAO,EAChC,KAAK,CAAC,WAAW,EACjB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CACrE,CAAC;IACN,CAAC;IAED,QAAQ,CAAC,OAAe;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,8CAA8C,CAAC;aACvD,GAAG,CAAC,OAAO,CAAyB,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAU;YAC1C,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,SAAiB;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,wEAAwE,CACzE;aACA,GAAG,CAAC,SAAS,CAAe,CAAC;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAU;YAC1C,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,MAAmB,EAAE,MAAY,IAAI,IAAI,EAAE;QACrD,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACvC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACtE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;OAUG;IACH,WAAW,CAAC,OAAe,EAAE,MAAY,IAAI,IAAI,EAAE;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAY,EAAE;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;iBACnB,OAAO,CACN,iFAAiF,CAClF;iBACA,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEvC,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN,wFAAwF,CACzF;iBACA,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpB,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN,2FAA2F,CAC5F;iBACA,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED,0EAA0E;IAE1E,cAAc,CAAC,IAAY,EAAE,MAAsB;QACjD,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;sCAG8B,CAC/B;aACA,GAAG,CACF,SAAS,CAAC,IAAI,CAAC,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,SAAS,CACjB,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;QAClD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAA0B,EAAE;YACzD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;iBACnB,OAAO,CACN;0EACgE,CACjE;iBACA,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEtC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;iBAChB,OAAO,CAAC,mDAAmD,CAAC;iBAC5D,GAAG,CAAC,IAAI,CAOV,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,GAAG,CAAC,QAAQ;gBACrB,QAAQ,EAAE,GAAG,CAAC,SAAS;gBACvB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,aAAa,EAAE,GAAG,CAAC,cAAc;gBACjC,mBAAmB,EAAE,GAAG,CAAC,qBAAqB;gBAC9C,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED,0EAA0E;IAE1E;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,KAWhB;QACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAE7B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAY,EAAE;YAC3C,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;qBACrB,OAAO,CACN;;qEAEyD,CAC1D;qBACA,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC1B,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;YAC3C,CAAC;YAED,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;;2CAGiC,CAClC;iBACA,GAAG,CACF,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EACtB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,IAAI,IAAI,EACtB,EAAE,EACF,KAAK,CAAC,SAAS,CAChB,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAYV,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;IAED,0EAA0E;IAE1E,mBAAmB,CAAC,OAAe;QACjC,MAAM,QAAQ,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,EAAE;aACJ,OAAO,CACN,uEAAuE,CACxE;aACA,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kBAAkB,CAChB,KAAa,EACb,QAAgB,EAChB,MAAY,IAAI,IAAI,EAAE;QAEtB,IAAI,CAAC,EAAE;aACJ,OAAO,CACN,qFAAqF,CACtF;aACA,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAChB,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE;QAItB,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAE7B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;iBAChB,OAAO,CACN;;;;kCAIwB,CACzB;iBACA,GAAG,CAAC,IAAI,CAOE,CAAC;YAEd,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;YAEpE,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC1B,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,gBAAyB,EAAE,CAAC;YACnE,CAAC;YAED,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACtB,iEAAiE;gBACjE,IAAI,CAAC,EAAE;qBACJ,OAAO,CACN,qEAAqE,CACtE;qBACA,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1B,IAAI,CAAC,EAAE;qBACJ,OAAO,CACN;wDAC4C,CAC7C;qBACA,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1B,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,gBAAyB,EAAE,CAAC;YACnE,CAAC;YAED,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN,uEAAuE,CACxE;iBACA,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,IAAa;gBACjB,QAAQ,EAAE,GAAG,CAAC,SAAS;gBACvB,OAAO,EAAE,GAAG,CAAC,QAAQ;aACtB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,iBAAiB,CAAC,KAAa,EAAE,MAAY,IAAI,IAAI,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN,0FAA0F,CAC3F;aACA,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,eAAe,CAAC,QAAgB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,kEAAkE,CACnE;aACA,GAAG,CAAC,QAAQ,CAA8C,CAAC;QAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;CACF"}

package/dist/pdpp/tokens.d.ts

@@ -0,0 +1,149 @@
+/**
+ * PDPP grant-bound token issuance, introspection, and revocation (§8, §9 AS
+ * items 8–10, 18–20; delivery scope §2).
+ *
+ * This module is the single token-validation authority. The RS resolves every
+ * request through `resolveToken` and enforces only from the result — §8 is
+ * explicit that the separated RS must not make a second AS lookup while
+ * handling a request, and that a co-located RS may use a local equivalent.
+ * `resolveToken` is that local equivalent, and `introspect` is the same
+ * decision rendered onto the RFC 7662 wire shape. They share one code path so
+ * the two deployments cannot drift apart.
+ *
+ * Revocation is immediate here by construction: resolution reads current store
+ * state on every call rather than trusting a cached decision, so a revoked
+ * grant reports `active: false` on the very next call. The 60-second bound in
+ * §8 is the RS's positive-result cache, not slack in the AS.
+ */
+import { type PdppAuthStore } from "./store.js";
+import { type AccessMode, type Grant, type PdppAuthorizationDetail, type PdppIntrospectionResponse, type PdppTokenContext } from "./types.js";
+/** Default client access-token lifetime. Short: the refresh path renews it. */
+export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS: number;
+/** How long an authorization code stays redeemable. RFC 6749 §4.1.2 suggests <=10 min. */
+export declare const AUTHORIZATION_CODE_TTL_SECONDS = 60;
+export interface TokenIssuanceResult {
+    access_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+    /** Present only for continuous grants (§9 AS item 20). */
+    refresh_token?: string;
+    /** Echoed so a client can bind its own state to the grant. */
+    grant_id: string;
+}
+export type TokenFailureCode = "invalid_grant" | "invalid_request";
+export interface TokenFailure {
+    code: TokenFailureCode;
+    message: string;
+}
+export type TokenResult = {
+    ok: true;
+    issued: TokenIssuanceResult;
+} | {
+    ok: false;
+    failure: TokenFailure;
+};
+/**
+ * Whether a grant may carry a refresh token.
+ *
+ * §9 AS item 20: refresh tokens are issued only for `continuous` grants, or
+ * for a grant package only when *every* child grant is continuous. A
+ * single-use grant with a refresh token would be a contradiction — the grant
+ * is consumed at first issuance, so there is nothing left to refresh into.
+ */
+export declare function mayIssueRefreshToken(accessModes: AccessMode[]): boolean;
+export interface PdppTokenServiceOptions {
+    accessTokenTtlSeconds?: number;
+}
+export declare class PdppTokenService {
+    private readonly store;
+    private readonly accessTtl;
+    constructor(store: PdppAuthStore, options?: PdppTokenServiceOptions);
+    /**
+     * Issue the first client token for a grant, redeeming an authorization code.
+     *
+     * The code is consumed atomically before anything else happens (§9 AS item
+     * 19) and a single-use grant is consumed atomically with the token insert
+     * (§9 AS item 10). Both preconditions live in SQL WHERE clauses, so a
+     * concurrent duplicate redemption loses the race rather than double-issuing.
+     */
+    redeemAuthorizationCode(input: {
+        code: string;
+        clientId: string;
+        redirectUri: string;
+        /** RFC 7636 verifier. Required when the code was issued with a challenge. */
+        codeVerifier?: string;
+        now?: Date;
+    }): TokenResult;
+    /**
+     * Rotate a refresh token within its family.
+     *
+     * Reuse of a superseded token revokes the family and every family-linked
+     * access token inside `rotateRefreshToken`, then this returns
+     * `invalid_grant`, which is what §9 AS item 20 requires: reject the reuse
+     * and require fresh authorization.
+     */
+    refresh(input: {
+        refreshToken: string;
+        now?: Date;
+    }): TokenResult;
+    /**
+     * Mint an access token (and, for continuous grants, a refresh token) bound
+     * to a grant.
+     *
+     * `existingFamilyId` carries a rotation into the same family so reuse
+     * detection keeps working across the whole chain; a first issuance creates
+     * the family.
+     */
+    private mintForGrant;
+    /**
+     * The single shared token-validation path (§8 "Grant enforcement").
+     *
+     * Reads live store state every call. That is what makes revocation immediate
+     * in introspection (§9 AS item 8) — there is no AS-side cache to invalidate.
+     */
+    resolveToken(accessToken: string, now?: Date): PdppTokenContext;
+    /**
+     * RFC 7662 introspection.
+     *
+     * An inactive token yields exactly `{ active: false }`. RFC 7662 §2.2 is
+     * clear that the response must not distinguish revoked from expired from
+     * never-issued — the reason stays internal (`resolveToken`) for the
+     * co-located RS, which needs it to pick 403 `grant_revoked`.
+     */
+    introspect(accessToken: string, now?: Date): PdppIntrospectionResponse;
+    /** Revoke a grant and every linked token family. Immediate (§2, §9 item 8). */
+    revokeGrant(grantId: string, now?: Date): boolean;
+    /**
+     * Issue an owner token for a subject.
+     *
+     * An owner token carries no grant (§8 "Authentication"): it scopes to a
+     * single subject's data store, and the RS derives subject scope from it
+     * rather than synthesizing a grant. It is also what authenticates a consent
+     * decision — see `approval.ts` for why the AS requires this rather than
+     * trusting the consent UI's affiliation.
+     *
+     * How the owner *obtains* this token is out of scope for Core; this build
+     * mints it from the already-authenticated owner session paths.
+     */
+    issueOwnerToken(input: {
+        subjectId: string;
+        ttlSeconds?: number;
+        now?: Date;
+    }): {
+        access_token: string;
+        token_type: "Bearer";
+        expires_in: number;
+    };
+    /** Revoke a single access token without touching its grant. */
+    revokeAccessToken(token: string, now?: Date): boolean;
+}
+/**
+ * Project a grant onto the RFC 9396 detail the introspection response carries.
+ *
+ * Note what is absent: `client_claims` and `retention` are not enforcement
+ * fields. §6 keeps claims outside introspection rights and RS enforcement
+ * entirely; retention is a policy commitment PDPP does not technically
+ * enforce, so including it would invite an RS to act on it.
+ */
+export declare function toAuthorizationDetail(grant: Grant): PdppAuthorizationDetail;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/pdpp/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/pdpp/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,KAAK,EAEV,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,eAAO,MAAM,gCAAgC,QAAU,CAAC;AAExD,0FAA0F;AAC1F,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAEvE;AAaD,MAAM,WAAW,uBAAuB;IACtC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,gBAAgB;IAIzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAHxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGhB,KAAK,EAAE,aAAa,EACrC,OAAO,GAAE,uBAA4B;IAMvC;;;;;;;OAOG;IACH,uBAAuB,CAAC,KAAK,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,6EAA6E;QAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,WAAW;IA6Ef;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,GAAG,WAAW;IAuCjE;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;IAuEpB;;;;;OAKG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,gBAAgB;IA0E3E;;;;;;;OAOG;IACH,UAAU,CACR,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,GACrB,yBAAyB;IA4B5B,+EAA+E;IAC/E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO;IAI7D;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,KAAK,EAAE;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAoBtE,+DAA+D;IAC/D,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO;CAGlE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAW3E"}