@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/policy/signed-artifacts.js

@@ -0,0 +1,110 @@
+import { BUILDER_REGISTRATION_TYPES, builderRegistrationDomain, verifyGrantRegistration, } from "@opendatalabs/vana-sdk/browser";
+import { encodeAbiParameters, isAddressEqual, keccak256, recoverTypedDataAddress, toHex, } from "viem";
+import { publicKeyToAddress } from "viem/accounts";
+import { GrantRevokedError, SignedArtifactInvalidError, SignedArtifactMissingError, } from "../errors/catalog.js";
+const DOMAIN_TYPE = "DataPortabilityDomain(uint256 chainId,address verifyingContract)";
+const DOMAIN_TYPE_HASH = keccak256(toHex(DOMAIN_TYPE));
+function grantExpiryToUint256(value) {
+    if (value === null || value === "" || value === "0")
+        return "0";
+    if (/^\d+$/u.test(value))
+        return value;
+    const millis = Date.parse(value);
+    if (!Number.isNaN(millis))
+        return String(Math.floor(millis / 1000));
+    throw new SignedArtifactInvalidError({ artifact: "grant" });
+}
+export async function verifySignedArtifacts(input) {
+    // TODO(step-4): revokedAt is Gateway-attested; verify revocation on-chain (contract s1 step 6).
+    if (input.grant.revokedAt !== null) {
+        throw new GrantRevokedError({ grantId: input.grant.id });
+    }
+    if (!input.grant.signature || !input.builder.signature) {
+        throw new SignedArtifactMissingError();
+    }
+    let grant;
+    try {
+        grant = await verifyGrantRegistration({
+            gatewayConfig: input.gatewayConfig,
+            grantorAddress: input.grant.grantorAddress,
+            granteeId: input.grant.granteeId,
+            scopes: input.grant.scopes,
+            grantVersion: input.grant.grantVersion,
+            expiresAt: grantExpiryToUint256(input.grant.expiresAt),
+            signature: input.grant.signature,
+        });
+    }
+    catch {
+        throw new SignedArtifactInvalidError({ artifact: "grant" });
+    }
+    if (!grant.valid ||
+        !sameAddress(grant.grantorAddress, input.ownerAddress) ||
+        !sameAddress(grant.grantorAddress, input.grant.grantorAddress)) {
+        throw new SignedArtifactInvalidError({ artifact: "grant" });
+    }
+    let recoveredBuilder;
+    let publicKeyAddress;
+    let builderId;
+    try {
+        recoveredBuilder = await recoverTypedDataAddress({
+            domain: builderRegistrationDomain(input.gatewayConfig),
+            types: BUILDER_REGISTRATION_TYPES,
+            primaryType: "BuilderRegistration",
+            message: {
+                ownerAddress: input.builder.ownerAddress,
+                granteeAddress: input.builder.granteeAddress,
+                publicKey: input.builder.publicKey,
+                appUrl: input.builder.appUrl,
+            },
+            signature: input.builder.signature,
+        });
+        publicKeyAddress = publicKeyToAddress(input.builder.publicKey);
+        builderId = deriveBuilderId(input.builder, input.gatewayConfig);
+    }
+    catch {
+        throw new SignedArtifactInvalidError({ artifact: "builder" });
+    }
+    if (!sameAddress(recoveredBuilder, input.builder.ownerAddress) ||
+        !sameAddress(publicKeyAddress, input.builder.granteeAddress) ||
+        // id is not signed; rebinding it to the signed fields stops a Gateway from
+        // pairing an attacker's signed builder with the owner's grant.
+        builderId.toLowerCase() !== input.builder.id.toLowerCase() ||
+        builderId.toLowerCase() !== input.grant.granteeId.toLowerCase()) {
+        throw new SignedArtifactInvalidError({ artifact: "builder" });
+    }
+}
+export function deriveBuilderId(builder, gatewayConfig) {
+    const domain = builderRegistrationDomain(gatewayConfig);
+    if (domain.chainId === undefined || domain.verifyingContract === undefined) {
+        throw new Error("Builder registration domain is incomplete");
+    }
+    // Gateway/on-chain IDs use this custom domain separator, distinct from the
+    // standard EIP-712 domain hash used to verify the builder signature above.
+    const domainSeparator = keccak256(encodeAbiParameters([
+        { name: "typeHash", type: "bytes32" },
+        { name: "chainId", type: "uint256" },
+        { name: "verifyingContract", type: "address" },
+    ], [DOMAIN_TYPE_HASH, BigInt(domain.chainId), domain.verifyingContract]));
+    return keccak256(encodeAbiParameters([
+        { name: "domainSeparator", type: "bytes32" },
+        { name: "owner", type: "address" },
+        { name: "granteeAddress", type: "address" },
+        { name: "publicKey", type: "string" },
+        { name: "appUrl", type: "string" },
+    ], [
+        domainSeparator,
+        builder.ownerAddress,
+        builder.granteeAddress,
+        builder.publicKey,
+        builder.appUrl,
+    ]));
+}
+function sameAddress(left, right) {
+    try {
+        return isAddressEqual(left, right);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=signed-artifacts.js.map

package/dist/policy/signed-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-artifacts.js","sourceRoot":"","sources":["../../src/policy/signed-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,GAIxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,KAAK,GAGN,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAK9B,MAAM,WAAW,GACf,kEAAkE,CAAC;AACrE,MAAM,gBAAgB,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AAEvD,SAAS,oBAAoB,CAAC,KAAoB;IAChD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAChE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAEpE,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9D,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B;IAE1B,gGAAgG;IAChG,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,0BAA0B,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,uBAAuB,CAAC;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAyB;YACrD,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAA0B;YACjD,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YAC1B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,SAAS,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAA0B;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IACE,CAAC,KAAK,CAAC,KAAK;QACZ,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;QACtD,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,gBAAyB,CAAC;IAC9B,IAAI,gBAAyB,CAAC;IAC9B,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,uBAAuB,CAAC;YAC/C,MAAM,EAAE,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC;YACtD,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE;gBACP,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAuB;gBACnD,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAyB;gBACvD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;aAC7B;YACD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAA0B;SACpD,CAAC,CAAC;QACH,gBAAgB,GAAG,kBAAkB,CACnC,KAAK,CAAC,OAAO,CAAC,SAA0B,CACzC,CAAC;QACF,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IACE,CAAC,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1D,CAAC,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAC5D,2EAA2E;QAC3E,+DAA+D;QAC/D,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE;QAC1D,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAC/D,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAGC,EACD,aAA2C;IAE3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,SAAS,CAC/B,mBAAmB,CACjB;QACE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;QACrC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;KAC/C,EACD,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CACrE,CACF,CAAC;IAEF,OAAO,SAAS,CACd,mBAAmB,CACjB;QACE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnC,EACD;QACE,eAAe;QACf,OAAO,CAAC,YAAuB;QAC/B,OAAO,CAAC,cAAyB;QACjC,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,MAAM;KACf,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAe,EAAE,KAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/ports/index.d.ts

@@ -0,0 +1,243 @@
+import type { Builder, DataFileEnvelope, DataPointListResult, DataPointRecord, GatewayGrantResponse, ListDataPointsOptions, Schema, ServerInfo } from "@opendatalabs/vana-sdk/browser";
+import type { WriteResult } from "../storage/hierarchy/index.js";
+import type { DataBlockManifest, DataScopeBlock, ReadScopeBlocksResponse } from "../storage/blocks/index.js";
+import type { IndexEntry, NewIndexEntry, ScopeSummary } from "../storage/index/types.js";
+export interface ProtocolGatewayPort {
+    getBuilder(address: string): Promise<Builder | null>;
+    getGrant(grantId: string): Promise<GatewayGrantResponse | null>;
+    getSchemaForScope(scope: string): Promise<Schema | null>;
+    getServer(address: string): Promise<ServerInfo | null>;
+    getDataPoint(dataPointId: string): Promise<DataPointRecord | null>;
+    listDataPointsByOwner(owner: string, cursor: string | null, options?: ListDataPointsOptions): Promise<DataPointListResult>;
+}
+export interface GrantVerifierPort {
+    getGrant(grantId: string): Promise<GatewayGrantResponse | null>;
+}
+export interface AuthSessionVerifierPort {
+    getBuilder(address: string): Promise<Builder | null>;
+}
+export interface FileRegistrySyncRegistryPort {
+    getDataPoint(dataPointId: string): Promise<DataPointRecord | null>;
+    listDataPointsByOwner(owner: string, cursor: string | null, options?: ListDataPointsOptions): Promise<DataPointListResult>;
+}
+export interface PlatformCryptoPort {
+    randomBytes(length: number): Uint8Array;
+}
+export interface RuntimeStoragePort {
+    kind: "node-fs-sqlite" | "browser-indexeddb-opfs" | "custom";
+}
+export interface DataStorageListOptions {
+    limit?: number;
+    offset?: number;
+}
+export interface DataStorageScopeListOptions extends DataStorageListOptions {
+    scopePrefix?: string;
+}
+export interface DataStorageEntryLookup {
+    scope: string;
+    fileId?: string;
+    at?: string;
+}
+export interface DataStorageEnvelopePreview {
+    text: string;
+    truncated: boolean;
+}
+export interface DataStoragePort extends RuntimeStoragePort {
+    listScopes(options: DataStorageScopeListOptions): {
+        scopes: ScopeSummary[];
+        total: number;
+    };
+    listVersions(scope: string, options: DataStorageListOptions): IndexEntry[];
+    countVersions(scope: string): number;
+    findEntry(lookup: DataStorageEntryLookup): IndexEntry | undefined;
+    findByFileId(fileId: string): IndexEntry | undefined;
+    /** Dedup lookup for the download worker: find an entry by its DPv2 data-point id. */
+    findByDataPointId(dataPointId: string): IndexEntry | undefined;
+    findUnsynced(options?: {
+        limit?: number;
+    }): IndexEntry[];
+    readEnvelope(scope: string, collectedAt: string): Promise<DataFileEnvelope>;
+    /** Read the stored JSON envelope without parsing its potentially large data. */
+    readEnvelopeBytes?(scope: string, collectedAt: string): Promise<Uint8Array>;
+    /** Open a fresh byte stream for the stored JSON envelope. May be called twice. */
+    readEnvelopeStream?(scope: string, collectedAt: string): Promise<ReadableStream<Uint8Array>>;
+    readEnvelopePreview?(scope: string, collectedAt: string, options: {
+        maxBytes: number;
+    }): Promise<DataStorageEnvelopePreview>;
+    readScopeBlocks?(scope: string, collectedAt: string, options: {
+        cursor?: string;
+        maxBytes: number;
+        /**
+         * Block-addressed read: return only these blocks, in this order. When
+         * set, `cursor` is ignored and no `nextCursor` is produced; `maxBytes`
+         * still applies and any ids it cuts off are reported as warnings.
+         */
+        blockIds?: readonly string[];
+    }): Promise<ReadScopeBlocksResponse>;
+    /**
+     * Read a scope's block manifest (table of contents) without reading any block
+     * values. Returns null when the scope has no manifest yet.
+     */
+    readBlockManifest?(scope: string, collectedAt: string): Promise<DataBlockManifest | null>;
+    hasScopeBlocks?(scope: string, collectedAt: string): boolean | Promise<boolean>;
+    canReadScopeBlocks?(scope: string, collectedAt: string): boolean | Promise<boolean>;
+    writeEnvelope(envelope: DataFileEnvelope): Promise<WriteResult>;
+    writeBlockManifest?(scope: string, collectedAt: string, manifest: DataBlockManifest, blocks: DataScopeBlock[]): Promise<void>;
+    insertEntry(entry: NewIndexEntry): IndexEntry | Promise<IndexEntry>;
+    updateFileId(path: string, fileId: string): boolean | Promise<boolean>;
+    /** Highest stored DPv2 `version` for a scope; 0 if none. */
+    findLatestVersionByScope(scope: string): number | Promise<number>;
+    /** Stamps the DPv2 dataPointId on an entry after registerDataPoint. */
+    updateDataPointId(path: string, dataPointId: string): boolean | Promise<boolean>;
+    /**
+     * Rewrites the DPv2 `version` on an entry. Used when the upload worker
+     * rebases a registration onto the registry's live version after a
+     * stale-expectedVersion conflict — the blob key embeds the version, so
+     * the local row must follow the registered one.
+     */
+    updateEntryVersion(path: string, version: number): boolean | Promise<boolean>;
+    deleteScope(scope: string): Promise<number>;
+    /**
+     * Delete a single version (index entry + its local blob) by its gateway fileId.
+     * Returns true if a local copy existed and was removed, false if none was present (no-op).
+     * Used by sync delete-reconciliation to drop a copy the gateway reports as deleted.
+     */
+    deleteByFileId(fileId: string): Promise<boolean>;
+    /**
+     * Delete a single version (index entry + its local blob + block sidecars)
+     * by its DPv2 identity (scope, collectedAt). Returns true if a local copy
+     * existed and was removed, false if none was present (no-op). Used by sync
+     * deletion reconciliation to drop the exact versions a gateway tombstone
+     * covers while leaving a newer local re-ingest in place.
+     */
+    deleteVersion(scope: string, collectedAt: string): Promise<boolean>;
+    /**
+     * Drop a single unsynced index entry by path, WITHOUT touching any blob.
+     * Used by the upload worker to evict an orphaned row whose local payload
+     * file is already gone (e.g. a manual `data/<scope>` deletion): the row can
+     * never upload, so retrying it head-blocks the scope forever. Returns true
+     * if a row was removed. No-op-safe when the path is unknown.
+     */
+    dropUnsyncedEntry?(path: string): boolean | Promise<boolean>;
+}
+export interface RuntimeAvailabilityPort {
+    isAvailable(): boolean | Promise<boolean>;
+}
+/**
+ * A gateway data-point row as seen by sync, including the deletion marker the
+ * plain SDK `DataPointRecord` does not model. `deletedAt` is null while the
+ * point is live and an ISO timestamp once the owner has tombstoned it.
+ */
+export interface DataPointFeedRecord extends DataPointRecord {
+    deletedAt: string | null;
+}
+export interface DataPointFeedListOptions extends ListDataPointsOptions {
+    /**
+     * Ask the gateway to include tombstoned rows (with `deletedAt` set). Sync
+     * always passes true: deletions must reach every replica or the local copy
+     * would be re-uploaded and resurrect the point.
+     */
+    includeDeleted?: boolean;
+}
+export interface DataPointFeedListResult {
+    dataPoints: DataPointFeedRecord[];
+    cursor: string | null;
+}
+/**
+ * Deletion-aware view of the gateway data-point registry. Mirrors the SDK
+ * `GatewayClient` listing/lookup shape but surfaces `deletedAt`, which the
+ * SDK client (3.14) neither requests (`includeDeleted`) nor types.
+ */
+export interface DataPointFeedPort {
+    listDataPointsByOwner(owner: string, cursor: string | null, options?: DataPointFeedListOptions): Promise<DataPointFeedListResult>;
+    /**
+     * Current registry row for (owner, scope), deleted or not. Null when the
+     * point was never registered. A tombstoned point comes back with
+     * `deletedAt` set (never as a thrown 410).
+     */
+    getDataPoint(input: {
+        ownerAddress: string;
+        scope: string;
+    }): Promise<DataPointFeedRecord | null>;
+}
+export type TombstoneOutcome = {
+    status: "tombstoned";
+    dataPointId: string;
+    /** The tombstone's own version (previous current + 1). */
+    version: string;
+    deletedAt: string | null;
+} | {
+    status: "already-deleted";
+    dataPointId: string;
+    /**
+     * The winning tombstone's registry version as the gateway reports it
+     * (possibly higher than the version this replica attempted), or null
+     * when the gateway did not say. Null means the covered key range is
+     * unknown, so callers defer enumeration rather than guess.
+     */
+    version: string | null;
+    deletedAt: string | null;
+} | {
+    /** The gateway has no row for (owner, scope): nothing to tombstone. */
+    status: "not-registered";
+    dataPointId: string;
+};
+export interface DeleteBlobVersionsOutcome {
+    /** Versions whose blob existed and was deleted. */
+    deleted: string[];
+    /** Versions with no blob in storage (404): nothing to do, counts as done. */
+    missing: string[];
+    /** Versions whose delete failed (rate limit, 5xx, network); retry later. */
+    failed: Array<{
+        version: string;
+        error: string;
+    }>;
+}
+/**
+ * Remote side of durable deletion. `tombstone` is the durable fact (an
+ * owner-signed AddData with the tombstone commitments, recorded by the
+ * gateway); `deleteBlobVersions` removes the ciphertext of exactly the given
+ * versions, one exact-key delete per version, never a scope-wide prefix: a
+ * re-add registered after the tombstone lives under a higher version key and
+ * is untouched by construction. Callers MUST run tombstone first: a blob
+ * delete without a tombstone leaves a live registry row every replica would
+ * 404 on and then wedge.
+ */
+export interface DeleteDataPort {
+    tombstone(scope: string): Promise<TombstoneOutcome>;
+    deleteBlobVersions(scope: string, versions: string[]): Promise<DeleteBlobVersionsOutcome>;
+}
+/**
+ * Blob deletion work still to do after a tombstone landed, in one of three
+ * shapes:
+ *   - an exact key: `{ scope, version }`;
+ *   - a contiguous version range `{ scope, version: null, range }` (both
+ *     bounds inclusive, decimal strings): the registry versions a tombstone
+ *     covers, kept as bounds so a large tombstone version never has to be
+ *     materialised key by key; passes take keys from the head and advance
+ *     `from`;
+ *   - an unexpanded marker `{ scope, version: null }` (no range): the gateway
+ *     did not report the tombstone's version, so the covered range is not
+ *     known yet; the retry expands it once the registry answers.
+ */
+export interface PendingBlobDeletion {
+    scope: string;
+    version: string | null;
+    range?: {
+        from: string;
+        to: string;
+    };
+}
+/**
+ * Durable retry marker for blob deletions that could not complete AFTER the
+ * gateway tombstone landed (storage failure, rate limit, or a batch larger
+ * than one pass may send). The tombstone already makes the deletion stick;
+ * this only exists so later sync cycles finish removing the ciphertext, key
+ * by key.
+ */
+export interface PendingBlobDeletionStore {
+    list(): Promise<PendingBlobDeletion[]>;
+    add(keys: PendingBlobDeletion[]): Promise<void>;
+    remove(keys: PendingBlobDeletion[]): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/ports/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,EACN,UAAU,EACX,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAChE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACvD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACnE,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACnE,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;CACzC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,GAAG,wBAAwB,GAAG,QAAQ,CAAC;CAC9D;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,UAAU,CAAC,OAAO,EAAE,2BAA2B,GAAG;QAChD,MAAM,EAAE,YAAY,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,UAAU,EAAE,CAAC;IAC3E,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,SAAS,CAAC,MAAM,EAAE,sBAAsB,GAAG,UAAU,GAAG,SAAS,CAAC;IAClE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IACrD,qFAAqF;IACrF,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/D,YAAY,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,EAAE,CAAC;IACzD,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5E,gFAAgF;IAChF,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,kFAAkF;IAClF,kBAAkB,CAAC,CACjB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACvC,mBAAmB,CAAC,CAClB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvC,eAAe,CAAC,CACd,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC9B,GACA,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC;;;OAGG;IACH,iBAAiB,CAAC,CAChB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACrC,cAAc,CAAC,CACb,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,kBAAkB,CAAC,CACjB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,aAAa,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,kBAAkB,CAAC,CACjB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,cAAc,EAAE,GACvB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,4DAA4D;IAC5D,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,uEAAuE;IACvE,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACrE;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACD;IACE,MAAM,EAAE,iBAAiB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACD;IACE,uEAAuE;IACvE,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,yBAAyB;IACxC,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,kBAAkB,CAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/ports/index.js

@@ -0,0 +1,7 @@
+export {};
+// FeeVerifier was the pre-X402 hook that gated reads on grant.paymentStatus
+// via a side-channel call to the gateway. Replaced by the X402 layer on
+// GET /v1/data/:scope (see packages/core/src/payment/x402.ts), which
+// forwards the builder's signed payment to gateway.payForOperation as part
+// of the read response cycle. Reads no longer block on prior paymentStatus.
+//# sourceMappingURL=index.js.map

package/dist/ports/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":";AA6TA,4EAA4E;AAC5E,wEAAwE;AACxE,qEAAqE;AACrE,2EAA2E;AAC3E,4EAA4E"}

package/dist/ports/pdpp-auth.d.ts

@@ -0,0 +1,103 @@
+/**
+ * PDPP AS -> RS seam types, MIRRORED from `pdpp-ps-auth-v2-0917`'s published
+ * contract (`~/code/pdpp/local/conformance-fleet-0917/ps-auth-contract.md`,
+ * branch `feat/pdpp-as-grants`), not authored here.
+ *
+ * The AS lane owns `packages/core/src/pdpp/**` on its own branch. That branch
+ * is not merged as of this lane's implementation, so these types are a local
+ * mirror this lane's route/enforcement layer codes against now. When the AS
+ * branch merges, this file should be deleted and its imports repointed at
+ * `@opendatalabs/personal-server-ts-core/pdpp` — the shapes below are meant
+ * to be identical, not a superset or a simplification.
+ *
+ * DO NOT widen these beyond the AS contract. In particular:
+ * - `TimeConstraint.until` is EXCLUSIVE (`record[field] < until`), not `<=`.
+ * - Field projection, instance scoping, and time constraint are PER STREAM
+ *   (`StreamGrant`), not grant-wide.
+ */
+export type PdppTokenKind = "owner" | "client";
+export type AccessMode = "single_use" | "continuous";
+export type SourceKind = "connector" | "provider_native";
+export interface TimeConstraint {
+    /** Frozen declaration field the bounds are evaluated against. */
+    field: string;
+    /** Inclusive lower bound (record[field] >= since). ISO 8601. */
+    since?: string;
+    /** Exclusive upper bound (record[field] < until). ISO 8601. */
+    until?: string;
+}
+export interface StreamGrant {
+    name: string;
+    instance_ids: string[];
+    fields: string[];
+    time_constraint?: TimeConstraint;
+    /** Canonical key strings. Absent means all records. */
+    resources?: string[];
+}
+export interface ClientDisplay {
+    name?: string;
+    [key: string]: unknown;
+}
+export interface Grant {
+    version: string;
+    grant_id: string;
+    issued_at: string;
+    subject: {
+        id: string;
+    };
+    client: {
+        client_id: string;
+        client_display?: ClientDisplay;
+    };
+    source: {
+        kind: SourceKind;
+        id: string;
+    };
+    source_declaration: {
+        version: string;
+    };
+    purpose_code: string;
+    purpose_description?: string;
+    access_mode: AccessMode;
+    streams: StreamGrant[];
+    selection_preset?: string;
+    retention?: {
+        max_duration: string;
+        on_expiry: "delete" | "anonymize";
+    };
+    expires_at?: string;
+}
+export type PdppInactiveReason = "unknown" | "expired" | "revoked" | "grant_revoked" | "grant_expired";
+export interface PdppTokenContext {
+    active: boolean;
+    /**
+     * Optional to match the real AS lane's type exactly (`feat/pdpp-as-grants`,
+     * `packages/core/src/pdpp/types.ts`): an inactive token's context may omit
+     * this entirely. Route code must not assume it is present without also
+     * checking `active`.
+     */
+    tokenKind?: PdppTokenKind;
+    subjectId?: string;
+    /** Client tokens only. */
+    grant?: Grant;
+    clientId?: string;
+    expiresAt?: string;
+    inactiveReason?: PdppInactiveReason;
+}
+/**
+ * The single call this lane's route layer makes per request. A co-located
+ * AS+RS deployment resolves this locally (Core §8 permits this); a separated
+ * deployment would call RFC 7662 introspection instead — that wire path is
+ * the AS lane's concern, not this lane's.
+ */
+export interface PdppAuthorizationService {
+    resolveToken(accessToken: string): Promise<PdppTokenContext>;
+}
+/** Looks up the StreamGrant entry for a stream name, or undefined if not granted. */
+export declare function findStreamGrant(grant: Grant, stream: string): StreamGrant | undefined;
+/**
+ * Evaluates a TimeConstraint against a record's field value. `since` is
+ * inclusive; `until` is EXCLUSIVE per the AS contract (not `<=`).
+ */
+export declare function withinTimeConstraint(value: string | undefined, constraint: TimeConstraint | undefined): boolean;
+//# sourceMappingURL=pdpp-auth.d.ts.map

package/dist/ports/pdpp-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-auth.d.ts","sourceRoot":"","sources":["../../src/ports/pdpp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC/C,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,YAAY,CAAC;AACrD,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,aAAa,CAAA;KAAE,CAAC;IAC9D,MAAM,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,kBAAkB,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,QAAQ,GAAG,WAAW,CAAA;KAAE,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,kBAAkB,GAC5B,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;AAExE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC9D;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,WAAW,GAAG,SAAS,CAEzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,UAAU,EAAE,cAAc,GAAG,SAAS,GACrC,OAAO,CAMT"}

package/dist/ports/pdpp-auth.js

@@ -0,0 +1,37 @@
+/**
+ * PDPP AS -> RS seam types, MIRRORED from `pdpp-ps-auth-v2-0917`'s published
+ * contract (`~/code/pdpp/local/conformance-fleet-0917/ps-auth-contract.md`,
+ * branch `feat/pdpp-as-grants`), not authored here.
+ *
+ * The AS lane owns `packages/core/src/pdpp/**` on its own branch. That branch
+ * is not merged as of this lane's implementation, so these types are a local
+ * mirror this lane's route/enforcement layer codes against now. When the AS
+ * branch merges, this file should be deleted and its imports repointed at
+ * `@opendatalabs/personal-server-ts-core/pdpp` — the shapes below are meant
+ * to be identical, not a superset or a simplification.
+ *
+ * DO NOT widen these beyond the AS contract. In particular:
+ * - `TimeConstraint.until` is EXCLUSIVE (`record[field] < until`), not `<=`.
+ * - Field projection, instance scoping, and time constraint are PER STREAM
+ *   (`StreamGrant`), not grant-wide.
+ */
+/** Looks up the StreamGrant entry for a stream name, or undefined if not granted. */
+export function findStreamGrant(grant, stream) {
+    return grant.streams.find((s) => s.name === stream);
+}
+/**
+ * Evaluates a TimeConstraint against a record's field value. `since` is
+ * inclusive; `until` is EXCLUSIVE per the AS contract (not `<=`).
+ */
+export function withinTimeConstraint(value, constraint) {
+    if (!constraint)
+        return true;
+    if (value === undefined)
+        return false;
+    if (constraint.since !== undefined && value < constraint.since)
+        return false;
+    if (constraint.until !== undefined && value >= constraint.until)
+        return false;
+    return true;
+}
+//# sourceMappingURL=pdpp-auth.js.map

package/dist/ports/pdpp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-auth.js","sourceRoot":"","sources":["../../src/ports/pdpp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA4EH,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAC7B,KAAY,EACZ,MAAc;IAEd,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAyB,EACzB,UAAsC;IAEtC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,UAAU,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,UAAU,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/ports/pdpp-auth.test-utils.d.ts

@@ -0,0 +1,9 @@
+import type { PdppAuthorizationService, PdppTokenContext } from "./pdpp-auth.js";
+/**
+ * Deterministic fixture PdppAuthorizationService for this lane's own route
+ * tests. NOT a real AS integration — maps fixed token strings to fixed
+ * PdppTokenContext values. When the AS lane's real implementation exists,
+ * this is what gets swapped, not the PdppAuthorizationService interface.
+ */
+export declare function createFixtureAuthorizationService(tokens: Record<string, PdppTokenContext>): PdppAuthorizationService;
+//# sourceMappingURL=pdpp-auth.test-utils.d.ts.map

package/dist/ports/pdpp-auth.test-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-auth.test-utils.d.ts","sourceRoot":"","sources":["../../src/ports/pdpp-auth.test-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACvC,wBAAwB,CAY1B"}

package/dist/ports/pdpp-auth.test-utils.js

@@ -0,0 +1,18 @@
+/**
+ * Deterministic fixture PdppAuthorizationService for this lane's own route
+ * tests. NOT a real AS integration — maps fixed token strings to fixed
+ * PdppTokenContext values. When the AS lane's real implementation exists,
+ * this is what gets swapped, not the PdppAuthorizationService interface.
+ */
+export function createFixtureAuthorizationService(tokens) {
+    return {
+        async resolveToken(accessToken) {
+            return (tokens[accessToken] ?? {
+                active: false,
+                tokenKind: "client",
+                subjectId: "",
+            });
+        },
+    };
+}
+//# sourceMappingURL=pdpp-auth.test-utils.js.map

package/dist/ports/pdpp-auth.test-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-auth.test-utils.js","sourceRoot":"","sources":["../../src/ports/pdpp-auth.test-utils.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAwC;IAExC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,WAAmB;YACpC,OAAO,CACL,MAAM,CAAC,WAAW,CAAC,IAAI;gBACrB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,EAAE;aACd,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}