@opendatalabs/personal-server-ts-core 1.33.7 → 1.34.0

package/dist/pdpp/client-identity.js

@@ -0,0 +1,196 @@
+/**
+ * Resolving a URL-hosted client identity, under a bounded fetch policy.
+ *
+ * §6 says a conforming AS MUST NOT reject a valid client ID metadata document
+ * solely because the client is not preregistered, and MUST accept a valid
+ * URL-hosted client identity unless local policy denies authorization. Before
+ * this, the AS validated `redirect_uri` only against a config-supplied
+ * registration, so an unregistered-but-valid client was refused for the one
+ * reason the spec names as insufficient.
+ *
+ * ── Why this is not just "fetch the client_id" ──────────────────────────────
+ *
+ * The AS is being handed a URL by an untrusted caller and asked to fetch it.
+ * That is a server-side request forgery primitive: without bounds, a client_id
+ * of `http://169.254.169.254/...` turns the AS into a proxy for whatever the
+ * deployment can reach. So this reuses `checkDeclarationUrl`, the same guard
+ * the declaration retrieval path already applies — https-only, no private or
+ * loopback literals, and the deployment's host allowlist unless it has
+ * explicitly opted into any HTTPS host.
+ *
+ * The response is size-capped and redirect-bounded for the same reason: an
+ * unbounded body is a memory exhaustion vector, and unbounded redirects defeat
+ * the host check by hopping somewhere it would have refused.
+ *
+ * ── Registration still wins ────────────────────────────────────────────────
+ *
+ * A locally registered client is resolved from config without any fetch at
+ * all. This path exists only for clients the deployment has NOT registered,
+ * and a deployment that wants registration-only behavior gets it by leaving
+ * the fetcher unset — in which case nothing here runs and the previous
+ * behavior is preserved exactly.
+ */
+import { checkDeclarationUrl, } from "./declaration.js";
+import { verifyClientIdDocument, } from "./client-metadata.js";
+/** Bodies larger than this are refused rather than buffered. */
+export const MAX_CLIENT_DOCUMENT_BYTES = 64 * 1024;
+/**
+ * Resolve a `client_id` URL into a redirect policy the AS can enforce.
+ *
+ * Returns the same `RegisteredRedirectPolicy` shape a config registration
+ * produces, so the caller's redirect validation is unchanged — a URL-hosted
+ * client is subject to exactly the same exact-match redirect rule as a
+ * registered one, rather than a looser path.
+ */
+export async function resolveUrlHostedClientIdentity(options) {
+    const { clientId, fetcher, policy } = options;
+    // A non-URL client_id is not a URL-hosted identity. Not an error here —
+    // the caller falls back to registration-only behavior.
+    let parsed;
+    try {
+        parsed = new URL(clientId);
+    }
+    catch {
+        return {
+            ok: false,
+            failure: {
+                code: "untrusted_client_url",
+                message: "client_id is not a URL-hosted identity",
+            },
+        };
+    }
+    // The SSRF gate, before any network call.
+    const urlProblem = checkDeclarationUrl(parsed.toString(), policy);
+    if (urlProblem) {
+        return {
+            ok: false,
+            failure: {
+                code: "untrusted_client_url",
+                message: urlProblem.message,
+            },
+        };
+    }
+    let retrieved;
+    try {
+        retrieved = await fetcher(parsed.toString());
+    }
+    catch (err) {
+        return {
+            ok: false,
+            failure: {
+                code: "fetch_failed",
+                message: err instanceof Error ? err.message : String(err),
+            },
+        };
+    }
+    if (!retrieved || retrieved.status !== 200) {
+        return {
+            ok: false,
+            failure: {
+                code: "fetch_failed",
+                message: `client_id document returned ${retrieved?.status ?? "no response"}`,
+            },
+        };
+    }
+    if (retrieved.body.length > MAX_CLIENT_DOCUMENT_BYTES) {
+        return {
+            ok: false,
+            failure: {
+                code: "too_large",
+                message: `client_id document exceeds ${MAX_CLIENT_DOCUMENT_BYTES} bytes`,
+            },
+        };
+    }
+    // A redirect may not escape the gate: re-check where we actually landed.
+    const finalProblem = checkDeclarationUrl(retrieved.finalUrl, policy);
+    if (finalProblem) {
+        return {
+            ok: false,
+            failure: {
+                code: "untrusted_client_url",
+                message: `client_id document redirected to an untrusted location: ${finalProblem.message}`,
+            },
+        };
+    }
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(retrieved.body);
+    }
+    catch {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "client_id document is not valid JSON",
+            },
+        };
+    }
+    // A JSON document need not be an object — `null`, an array, or a bare
+    // primitive all parse without error, and none of them can carry the
+    // fields below.
+    if (typeof parsedJson !== "object" || parsedJson === null) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "client_id document is not a JSON object",
+            },
+        };
+    }
+    const document = parsedJson;
+    if (!Array.isArray(document.redirect_uris)) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "client_id document declares no redirect_uris",
+            },
+        };
+    }
+    // A document that declares no usable name gets none, rather than an empty
+    // one. `resolveRequesterIdentity` falls back through inline metadata to the
+    // client_id itself, so an absent name must be absent -- a `{ name: "" }`
+    // would outrank the inline display and render a blank requester.
+    const documentName = typeof document.client_name === "string" && document.client_name.length > 0
+        ? document.client_name
+        : undefined;
+    // The identity check: the document must assert the URL it came from.
+    // Without this, any host could publish a document claiming to be someone
+    // else's client_id.
+    const candidate = {
+        client_id: String(document.client_id ?? ""),
+        ...(documentName && { display: { name: documentName } }),
+        https: true,
+        retrieved_from: retrieved.finalUrl,
+    };
+    const verified = verifyClientIdDocument(candidate);
+    if (!verified) {
+        return {
+            ok: false,
+            failure: {
+                code: "client_id_mismatch",
+                message: "client_id document does not assert the URL it was retrieved from",
+            },
+        };
+    }
+    const redirectUris = document.redirect_uris.filter((uri) => typeof uri === "string" && uri.length > 0);
+    if (redirectUris.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "client_id document declares no usable redirect_uris",
+            },
+        };
+    }
+    return {
+        ok: true,
+        policy: { client_id: clientId, redirect_uris: redirectUris },
+        verifiedDomain: verified.verifiedDomain,
+        // The same document that earned redirect admission, so the caller can
+        // resolve the displayed requester identity from it rather than from the
+        // client's inline assertion.
+        document: candidate,
+    };
+}
+//# sourceMappingURL=client-identity.js.map

package/dist/pdpp/client-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-identity.js","sourceRoot":"","sources":["../../src/pdpp/client-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EACL,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,GAEvB,MAAM,sBAAsB,CAAC;AAG9B,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAkDnD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAqC;IAErC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE9C,wEAAwE;IACxE,uDAAuD;IACvD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,wCAAwC;aAClD;SACF,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,+BAA+B,SAAS,EAAE,MAAM,IAAI,aAAa,EAAE;aAC7E;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,8BAA8B,yBAAyB,QAAQ;aACzE;SACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,2DAA2D,YAAY,CAAC,OAAO,EAAE;aAC3F;SACF,CAAC;IACJ,CAAC;IAED,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,sCAAsC;aAChD;SACF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,gBAAgB;IAChB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,yCAAyC;aACnD;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAIhB,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,8CAA8C;aACxD;SACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,YAAY,GAChB,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACzE,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IAEhB,qEAAqE;IACrE,yEAAyE;IACzE,oBAAoB;IACpB,MAAM,SAAS,GAA6B;QAC1C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAC3C,GAAG,CAAC,YAAY,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;QACxD,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,SAAS,CAAC,QAAQ;KACnC,CAAC;IACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EACL,kEAAkE;aACrE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAChD,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAClE,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,qDAAqD;aAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE;QAC5D,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,sEAAsE;QACtE,wEAAwE;QACxE,6BAA6B;QAC7B,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC"}

package/dist/pdpp/client-metadata.d.ts

@@ -0,0 +1,95 @@
+/**
+ * PDPP Core §6 requester-identity resolution.
+ *
+ * Two things the spec insists on keeping apart, and which are easy to conflate:
+ *
+ *   - **Verified domain control** means the AS retrieved this client's metadata
+ *     from the client_id URL over HTTPS and the document identified the same
+ *     client. It says the operator of that domain published this metadata. It
+ *     says nothing about the client's conduct or data practices.
+ *   - **App approval** means a local registration or trust-registry admission
+ *     decision — someone actually vetted the client.
+ *
+ * §6 obligation 5 requires the first to be rendered as a *named domain*
+ * ("Verified domain: example.com"), never as an unqualified "Verified app".
+ * `RequesterIdentity` therefore carries them as two separate fields, so a
+ * consent surface cannot render one as the other by accident.
+ */
+import type { RequesterIdentity } from "./review.js";
+import type { ClientDisplay } from "./types.js";
+/** Metadata the deployment holds locally, or a trust registry supplied. */
+export interface RegisteredClientMetadata {
+    client_id: string;
+    display: ClientDisplay;
+    /** True only when an admission decision was actually made. */
+    approved: boolean;
+}
+/**
+ * A client ID metadata document retrieved from the client_id URL.
+ *
+ * §6: the document is *valid* only when it was retrieved over HTTPS from the
+ * client_id URL itself and the `client_id` inside it is identical to that URL.
+ * That last check is what stops a document claiming to be a different client.
+ */
+export interface ClientIdMetadataDocument {
+    /** The URL the document was retrieved from. */
+    retrieved_from: string;
+    /** The client_id the document asserts. */
+    client_id: string;
+    /**
+     * Optional: a document may validly declare redirect_uris and no name. An
+     * absent name must stay absent rather than become `{ name: "" }`, which
+     * would outrank inline metadata in §6 precedence and render a blank
+     * requester on the consent surface.
+     */
+    display?: ClientDisplay;
+    /** Whether retrieval used HTTPS. */
+    https: boolean;
+}
+export interface ResolveRequesterInput {
+    client_id: string;
+    /** Highest precedence: local registration or trust registry. */
+    registered?: RegisteredClientMetadata;
+    /** Validated binding metadata, when the binding supplied one. */
+    document?: ClientIdMetadataDocument;
+    /** Lowest precedence: the client's own inline assertion. */
+    inline?: ClientDisplay;
+}
+/**
+ * Validate a client ID metadata document per §6.
+ *
+ * Returns the verified domain when all three conditions hold, otherwise null.
+ * A null result is not a rejection of the client — §6's interoperability
+ * obligation forbids rejecting a valid document merely for being
+ * unpreregistered, and a document that fails validation just means we fall
+ * through to a lower-precedence metadata source.
+ */
+export declare function verifyClientIdDocument(doc: ClientIdMetadataDocument): {
+    verifiedDomain: string;
+} | null;
+/**
+ * Resolve requester identity under §6's precedence:
+ *
+ *   local registration / trust registry
+ *     > validated software statement (not supported in this build)
+ *     > validated binding metadata (the client ID metadata document)
+ *     > inline `client_display`
+ *     > `client_id` fallback
+ *
+ * The display name always resolves to something: §6 obligation 2 requires the
+ * AS to display `client_id` when no name is available, so the consent surface
+ * is never left with nothing to render.
+ */
+export declare function resolveRequesterIdentity(input: ResolveRequesterInput): RequesterIdentity;
+/**
+ * Whether a client-supplied remote logo may be rendered directly.
+ *
+ * §6 obligation 6: `logo_uri` is untrusted content. An unverified client's
+ * remote logo must not be fetched into the consent UI — the surface generates
+ * a monogram from the display name instead. Proxied-and-approved assets are a
+ * deployment concern the caller signals explicitly.
+ */
+export declare function mayRenderRemoteLogo(identity: RequesterIdentity, options?: {
+    assetProxiedAndApproved?: boolean;
+}): boolean;
+//# sourceMappingURL=client-metadata.d.ts.map

package/dist/pdpp/client-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-metadata.d.ts","sourceRoot":"","sources":["../../src/pdpp/client-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,2EAA2E;AAC3E,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,iEAAiE;IACjE,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,wBAAwB,GAC5B;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsBnC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAC3B,iBAAiB,CAoBnB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAGT"}

package/dist/pdpp/client-metadata.js

@@ -0,0 +1,96 @@
+/**
+ * PDPP Core §6 requester-identity resolution.
+ *
+ * Two things the spec insists on keeping apart, and which are easy to conflate:
+ *
+ *   - **Verified domain control** means the AS retrieved this client's metadata
+ *     from the client_id URL over HTTPS and the document identified the same
+ *     client. It says the operator of that domain published this metadata. It
+ *     says nothing about the client's conduct or data practices.
+ *   - **App approval** means a local registration or trust-registry admission
+ *     decision — someone actually vetted the client.
+ *
+ * §6 obligation 5 requires the first to be rendered as a *named domain*
+ * ("Verified domain: example.com"), never as an unqualified "Verified app".
+ * `RequesterIdentity` therefore carries them as two separate fields, so a
+ * consent surface cannot render one as the other by accident.
+ */
+/**
+ * Validate a client ID metadata document per §6.
+ *
+ * Returns the verified domain when all three conditions hold, otherwise null.
+ * A null result is not a rejection of the client — §6's interoperability
+ * obligation forbids rejecting a valid document merely for being
+ * unpreregistered, and a document that fails validation just means we fall
+ * through to a lower-precedence metadata source.
+ */
+export function verifyClientIdDocument(doc) {
+    if (!doc.https)
+        return null;
+    let retrievedUrl;
+    try {
+        retrievedUrl = new URL(doc.retrieved_from);
+    }
+    catch {
+        return null;
+    }
+    if (retrievedUrl.protocol !== "https:")
+        return null;
+    // The identity check: the document's client_id must be the URL it came from.
+    // Compared as URLs so a trailing-slash difference is not a false negative.
+    let assertedUrl;
+    try {
+        assertedUrl = new URL(doc.client_id);
+    }
+    catch {
+        return null;
+    }
+    if (assertedUrl.toString() !== retrievedUrl.toString())
+        return null;
+    return { verifiedDomain: retrievedUrl.hostname };
+}
+/**
+ * Resolve requester identity under §6's precedence:
+ *
+ *   local registration / trust registry
+ *     > validated software statement (not supported in this build)
+ *     > validated binding metadata (the client ID metadata document)
+ *     > inline `client_display`
+ *     > `client_id` fallback
+ *
+ * The display name always resolves to something: §6 obligation 2 requires the
+ * AS to display `client_id` when no name is available, so the consent surface
+ * is never left with nothing to render.
+ */
+export function resolveRequesterIdentity(input) {
+    const verification = input.document
+        ? verifyClientIdDocument(input.document)
+        : null;
+    // Precedence order, highest first.
+    const display = input.registered?.display ??
+        (verification ? input.document?.display : undefined) ??
+        input.inline;
+    return {
+        client_id: input.client_id,
+        display_name: display?.name ?? input.client_id,
+        ...(display && { display }),
+        // Named, not asserted as blanket verification.
+        ...(verification && { verified_domain: verification.verifiedDomain }),
+        // Only a real admission decision counts. Domain control is not approval.
+        app_approved: input.registered?.approved ?? false,
+    };
+}
+/**
+ * Whether a client-supplied remote logo may be rendered directly.
+ *
+ * §6 obligation 6: `logo_uri` is untrusted content. An unverified client's
+ * remote logo must not be fetched into the consent UI — the surface generates
+ * a monogram from the display name instead. Proxied-and-approved assets are a
+ * deployment concern the caller signals explicitly.
+ */
+export function mayRenderRemoteLogo(identity, options = {}) {
+    if (options.assetProxiedAndApproved === true)
+        return true;
+    return identity.app_approved || identity.verified_domain !== undefined;
+}
+//# sourceMappingURL=client-metadata.js.map

package/dist/pdpp/client-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-metadata.js","sourceRoot":"","sources":["../../src/pdpp/client-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA8CH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAA6B;IAE7B,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,YAAiB,CAAC;IACtB,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEpD,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,EAAE,KAAK,YAAY,CAAC,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IAEpE,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA4B;IAE5B,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ;QACjC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC;IAET,mCAAmC;IACnC,MAAM,OAAO,GACX,KAAK,CAAC,UAAU,EAAE,OAAO;QACzB,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,KAAK,CAAC,MAAM,CAAC;IAEf,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,OAAO,EAAE,IAAI,IAAI,KAAK,CAAC,SAAS;QAC9C,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,+CAA+C;QAC/C,GAAG,CAAC,YAAY,IAAI,EAAE,eAAe,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC;QACrE,yEAAyE;QACzE,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,IAAI,KAAK;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAA2B,EAC3B,UAAiD,EAAE;IAEnD,IAAI,OAAO,CAAC,uBAAuB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,CAAC;AACzE,CAAC"}

package/dist/pdpp/commitments.d.ts

@@ -0,0 +1,75 @@
+/**
+ * PDPP v0.2 recipient commitments: resolving purpose and retention before the
+ * owner approves.
+ *
+ * The section this implements exists because of one asymmetry. An owner
+ * narrowing what they share is acting entirely within their own authority —
+ * nobody else has to agree to receive less. An owner *changing the terms of
+ * use* is proposing an obligation the recipient has to carry, and no amount of
+ * owner authority makes the recipient agree to it. v0.2 keeps those two apart
+ * deliberately: "The AS MUST NOT interpret narrower access as recipient
+ * acceptance of a new purpose or retention obligation."
+ *
+ * So commitments resolve from exactly two places — the client's own request,
+ * or standing terms the recipient authorized — and an owner condition covered
+ * by neither refuses issuance rather than being carried as though agreed.
+ *
+ * The important non-obvious case: a condition *favourable* to the owner is
+ * still a condition. An owner asking for a 7-day retention when the client
+ * requested 30 is asking for less, but it is still a term the recipient never
+ * accepted, and recording it as a grant constraint would claim an acceptance
+ * that does not exist. PDPP carries commitments; it cannot enforce the
+ * recipient's behavior after disclosure, which is exactly why the record of
+ * what they actually agreed to has to be honest.
+ */
+import type { OwnerConditions, RecipientTerms, Retention, SelectionRequest } from "./types.js";
+/**
+ * Sentinel terms identity for commitments that came from the selection request
+ * itself.
+ *
+ * The request *is* recipient authority — the client wrote it — so this is a
+ * real answer rather than a missing one. Recording it explicitly, rather than
+ * leaving the evidence absent, is what makes "no terms were consulted"
+ * distinguishable from "the evidence was never written".
+ */
+export declare const REQUEST_TERMS_ID = "urn:pdpp:recipient-terms:selection-request";
+/** The commitments that will be shown to the owner and written into the grant. */
+export interface ResolvedCommitments {
+    purpose_code: string;
+    purpose_description?: string;
+    retention?: Retention;
+    /** Identity and version of the authority these came from. */
+    evidence: {
+        id: string;
+        version: string;
+    };
+}
+export interface CommitmentsFailure {
+    code: "recipient_terms_unsupported";
+    message: string;
+}
+export type CommitmentsResult = {
+    ok: true;
+    commitments: ResolvedCommitments;
+} | {
+    ok: false;
+    failure: CommitmentsFailure;
+};
+export interface ResolveCommitmentsInput {
+    request: SelectionRequest;
+    /** Conditions the owner attached to their approval. */
+    ownerConditions?: OwnerConditions;
+    /** Standing terms the recipient authorized, when the deployment tracks them. */
+    standingTerms?: RecipientTerms;
+    /** The declaration revision, used as the request's own evidence version. */
+    declarationVersion: string;
+}
+/**
+ * Resolve purpose and retention from the request or applicable standing terms.
+ *
+ * Runs before the owner approves, never after: v0.2 requires the owner to see
+ * the resolved commitments in the final review, so a commitment resolved at
+ * issuance time would be one the owner never saw.
+ */
+export declare function resolveCommitments(input: ResolveCommitmentsInput): CommitmentsResult;
+//# sourceMappingURL=commitments.d.ts.map

package/dist/pdpp/commitments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitments.d.ts","sourceRoot":"","sources":["../../src/pdpp/commitments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,SAAS,EACT,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,+CAA+C,CAAC;AAE7E,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAM/C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,uDAAuD;IACvD,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,gFAAgF;IAChF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,uBAAuB,GAC7B,iBAAiB,CAyEnB"}

package/dist/pdpp/commitments.js

@@ -0,0 +1,113 @@
+/**
+ * PDPP v0.2 recipient commitments: resolving purpose and retention before the
+ * owner approves.
+ *
+ * The section this implements exists because of one asymmetry. An owner
+ * narrowing what they share is acting entirely within their own authority —
+ * nobody else has to agree to receive less. An owner *changing the terms of
+ * use* is proposing an obligation the recipient has to carry, and no amount of
+ * owner authority makes the recipient agree to it. v0.2 keeps those two apart
+ * deliberately: "The AS MUST NOT interpret narrower access as recipient
+ * acceptance of a new purpose or retention obligation."
+ *
+ * So commitments resolve from exactly two places — the client's own request,
+ * or standing terms the recipient authorized — and an owner condition covered
+ * by neither refuses issuance rather than being carried as though agreed.
+ *
+ * The important non-obvious case: a condition *favourable* to the owner is
+ * still a condition. An owner asking for a 7-day retention when the client
+ * requested 30 is asking for less, but it is still a term the recipient never
+ * accepted, and recording it as a grant constraint would claim an acceptance
+ * that does not exist. PDPP carries commitments; it cannot enforce the
+ * recipient's behavior after disclosure, which is exactly why the record of
+ * what they actually agreed to has to be honest.
+ */
+/**
+ * Sentinel terms identity for commitments that came from the selection request
+ * itself.
+ *
+ * The request *is* recipient authority — the client wrote it — so this is a
+ * real answer rather than a missing one. Recording it explicitly, rather than
+ * leaving the evidence absent, is what makes "no terms were consulted"
+ * distinguishable from "the evidence was never written".
+ */
+export const REQUEST_TERMS_ID = "urn:pdpp:recipient-terms:selection-request";
+function sameRetention(a, b) {
+    return a.max_duration === b.max_duration && a.on_expiry === b.on_expiry;
+}
+/**
+ * Resolve purpose and retention from the request or applicable standing terms.
+ *
+ * Runs before the owner approves, never after: v0.2 requires the owner to see
+ * the resolved commitments in the final review, so a commitment resolved at
+ * issuance time would be one the owner never saw.
+ */
+export function resolveCommitments(input) {
+    const { request, ownerConditions, standingTerms } = input;
+    // Absent any owner condition, the request's own terms stand and the client
+    // is self-evidently the authority for them.
+    let evidence = {
+        id: REQUEST_TERMS_ID,
+        version: input.declarationVersion,
+    };
+    let purposeCode = request.purpose_code;
+    let retention = request.retention;
+    // Error text is deliberately generic. v0.2: "Error descriptions MUST NOT
+    // reveal unapproved source, instance, record, or field existence." A
+    // rejection is a fine place to leak an inventory if the message names what
+    // the request touched, so this one names only the term class.
+    const refuse = (what) => ({
+        ok: false,
+        failure: {
+            code: "recipient_terms_unsupported",
+            message: `the requested ${what} is not covered by the recipient's applicable authority`,
+        },
+    });
+    if (ownerConditions?.purpose_code !== undefined) {
+        const proposed = ownerConditions.purpose_code;
+        const covered = proposed === request.purpose_code ||
+            standingTerms?.accepted_purpose_codes?.includes(proposed) === true;
+        if (!covered)
+            return refuse("purpose");
+        purposeCode = proposed;
+        // A purpose description authored for the client's own purpose code does
+        // not describe a different one. Dropping it is the honest outcome; the
+        // surface falls back to the code or its registry entry.
+        if (proposed !== request.purpose_code) {
+            evidence = termsEvidence(standingTerms, evidence);
+        }
+    }
+    if (ownerConditions?.retention !== undefined) {
+        const proposed = ownerConditions.retention;
+        const covered = (request.retention !== undefined &&
+            sameRetention(proposed, request.retention)) ||
+            standingTerms?.accepted_retention?.some((accepted) => sameRetention(proposed, accepted)) === true;
+        if (!covered)
+            return refuse("retention term");
+        retention = proposed;
+        if (request.retention === undefined ||
+            !sameRetention(proposed, request.retention)) {
+            evidence = termsEvidence(standingTerms, evidence);
+        }
+    }
+    const purposeDescription = purposeCode === request.purpose_code
+        ? request.purpose_description
+        : undefined;
+    return {
+        ok: true,
+        commitments: {
+            purpose_code: purposeCode,
+            ...(purposeDescription !== undefined && {
+                purpose_description: purposeDescription,
+            }),
+            ...(retention !== undefined && { retention }),
+            evidence,
+        },
+    };
+}
+function termsEvidence(standingTerms, fallback) {
+    if (!standingTerms)
+        return fallback;
+    return { id: standingTerms.id, version: standingTerms.version };
+}
+//# sourceMappingURL=commitments.js.map

package/dist/pdpp/commitments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitments.js","sourceRoot":"","sources":["../../src/pdpp/commitments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AASH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AAoB7E,SAAS,aAAa,CAAC,CAAY,EAAE,CAAY;IAC/C,OAAO,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAA8B;IAE9B,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAE1D,2EAA2E;IAC3E,4CAA4C;IAC5C,IAAI,QAAQ,GAAG;QACb,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,KAAK,CAAC,kBAAkB;KAClC,CAAC;IACF,IAAI,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IACvC,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAElC,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAqB,EAAE,CAAC,CAAC;QACnD,EAAE,EAAE,KAAK;QACT,OAAO,EAAE;YACP,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,iBAAiB,IAAI,yDAAyD;SACxF;KACF,CAAC,CAAC;IAEH,IAAI,eAAe,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO,CAAC,YAAY;YACjC,aAAa,EAAE,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,WAAW,GAAG,QAAQ,CAAC;QACvB,wEAAwE;QACxE,uEAAuE;QACvE,wDAAwD;QACxD,IAAI,QAAQ,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;YACtC,QAAQ,GAAG,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,eAAe,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC;QAC3C,MAAM,OAAO,GACX,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YAC9B,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7C,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnD,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAClC,KAAK,IAAI,CAAC;QACb,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC9C,SAAS,GAAG,QAAQ,CAAC;QACrB,IACE,OAAO,CAAC,SAAS,KAAK,SAAS;YAC/B,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAC3C,CAAC;YACD,QAAQ,GAAG,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GACtB,WAAW,KAAK,OAAO,CAAC,YAAY;QAClC,CAAC,CAAC,OAAO,CAAC,mBAAmB;QAC7B,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE;YACX,YAAY,EAAE,WAAW;YACzB,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI;gBACtC,mBAAmB,EAAE,kBAAkB;aACxC,CAAC;YACF,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7C,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,aAAyC,EACzC,QAAyC;IAEzC,IAAI,CAAC,aAAa;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;AAClE,CAAC"}