@opendatalabs/personal-server-ts-core 1.33.7 → 1.34.0

package/dist/pdpp/declaration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration.js","sourceRoot":"","sources":["../../src/pdpp/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAOhC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AA4ClD;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,IAAI,GACR,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,gEAAgE;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACnD,+CAA+C;QAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,MAA8B;IAE9B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,8BAA8B,GAAG,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,uCAAuC,GAAG,CAAC,QAAQ,EAAE;SAC/D,CAAC;IACJ,CAAC;IAED,IACE,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,CAAC,MAAM,CAAC,uBAAuB,EAC/B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,8DAA8D,GAAG,CAAC,QAAQ,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,qBAAqB,GAAG,CAAC,QAAQ,wDAAwD;aACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEzD,yDAAyD;IACzD,MAAM,MAAM,GAAI,GAAqC,CAAC,MAAM,EAAE,EAAE,CAAC;IACjE,MAAM,IAAI,GAAI,GAA+B,CAAC,SAAS,CAAC;IACxD,MAAM,EAAE,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,6BAA6B,CACpC,GAA2B;IAE3B,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAE9D,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAA0C,CAAC;IAChE,MAAM,kBAAkB,GAAI,GAAyC;SAClE,mBAAmB,CAAC;IAEvB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,GAA8B,CAAC;YAC9C,gEAAgE;YAChE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAEhD,MAAM,MAAM,GAAG,MAAM,CAAC,MAET,CAAC;YACd,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAEzD,OAAO;gBACL,GAAG,MAAM;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;gBAC5C,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAC7C,CAAC,CAAE,MAAM,CAAC,QAAqB;oBAC/B,CAAC,CAAC,EAAE;aACP,CAAC;QACJ,CAAC,CAAC;QACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAEhB,OAAO;QACL,GAAG,GAAG;QACN,GAAG,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAChD,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,kBAAkB,KAAK,QAAQ,IAAI;YAC5C,OAAO,EAAE,kBAAkB;SAC5B,CAAC;QACF,OAAO;KACkB,CAAC;AAC9B,CAAC;AAED,6DAA6D;AAC7D,MAAM,cAAc,GAAG,8CAA8C,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,kBAAkB,CAAC,MAAe;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,4BAA4B,MAAM,CAAC,OAAO,CAAC,kCAAkC,cAAc,EAAE,CAAC;IACvG,CAAC;IAED,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,aAAa,CAAU,EAAE,CAAC;QACvD,MAAM,KAAK,GAAI,IAAgC,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,mBAAmB,OAAO,KAAK,KAAK,4CAA4C,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAA+B,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,aAAa;IACb,OAAO;IACP,SAAS;IACT,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;IACT,OAAO;IACP,WAAW;IACX,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,OAAO,GAAG,0CAA0C,CAAC;AAE3D;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAC9B,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAC/B,MAA+B;IAE/B,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBAAE,SAAS;YACtD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAGrC,CAAC;YACF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChE,OAAO,4BAA4B,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAChI,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,IAAa;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,UAAU,GAAI,IAAiC,CAAC,UAAU,CAAC;IACjE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAI,UAAsC,CAAC,SAAS,CAAC;QACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG;gBACjB,GAAG,CAAC,OAAQ,MAA8B,CAAC,KAAK,KAAK,QAAQ;oBAC3D,CAAC,CAAC,CAAE,MAA4B,CAAC,KAAK,CAAC;oBACvC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAE,MAA6B,CAAC,IAAI,CAAC;oBACpD,CAAC,CAAG,MAA8B,CAAC,IAAI,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAChB;oBAChB,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,mBAAmB,GAAG,yCAAyC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAA+B,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAYD;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAA8C,CAAC;IACzE,MAAM,OAAO,GAAoB;QAC/B,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/D,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;KACnE,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,gBAAwB,EACxB,cAAuB;IAEvB,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,cAAc,KAAK,SAAS,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,sDAAsD;aAChE;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAA2B,CAAC;IAChC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,+BAA+B;aACzC;SACF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,oCAAoC;IACpC,EAAE;IACF,sEAAsE;IACtE,yEAAyE;IACzE,iCAAiC;IACjC,8EAA8E;IAC9E,0DAA0D;IAC1D,wEAAwE;IACxE,uEAAuE;IACvE,gEAAgE;IAChE,EAAE;IACF,oEAAoE;IACpE,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,0EAA0E;IAC1E,8CAA8C;IAC9C,GAAG,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAEzC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,kCAAkC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,GAAG,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,mCAAmC,GAAG,CAAC,SAAS,4BAA4B,gBAAgB,GAAG;aACzG;SACF,CAAC;IACJ,CAAC;IAED,IACE,GAAG,CAAC,WAAW,KAAK,WAAW;QAC/B,GAAG,CAAC,WAAW,KAAK,iBAAiB,EACrC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,8DAA8D;aACxE;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,gCAAgC;aAC1C;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,iCAAiC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,mCAAmC;iBAC7C;aACF,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,8BAA8B;iBACzD;aACF,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAExB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,sBAAsB;iBACjD;aACF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAkB,CAAC;QACpC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrD,CAAC,CAAE,CAAC,CAAC,eAA4B;YACjC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,6DAA6D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC5G;aACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,2BAA2B;iBACtD;aACF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,yBAAyB;QACzB,EAAE;QACF,mEAAmE;QACnE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,aAAa,GAAI,CAAC,CAAC,WAAwB,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC3B,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,2DAA2D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAChH;aACF,CAAC;QACJ,CAAC;QACD,IACE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC,YAAY,sCAAsC;iBACxG;aACF,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,eAAe;QACf,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,6CAA6C;QAC7C,EAAE;QACF,iEAAiE;QACjE,wCAAwC;QACxC,IACE,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;YACxC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,EACtC,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,+BAA+B,CAAC,CAAC,kBAAkB,sCAAsC;iBACpH;aACF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,mBAAmB;QACnB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE;wBACP,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,MAAM,aAAa,EAAE;qBAChD;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE;iBAClD;aACF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,IACE,CAAC,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC,SAAS,KAAK,eAAe;YAC/B,CAAC,CAAC,SAAS,KAAK,aAAa,EAC7B,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,qCAAqC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG;iBACtF;aACF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM;YACN,eAAe,EAAE,cAAc;YAC/B,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,EAAE;YACF,uEAAuE;YACvE,kEAAkE;YAClE,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;gBACnC,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI;gBACrC,SAAS,EAAE,CAAC,CAAC,SAA4C;aAC1D,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ,IAAI;gBAC9C,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;aACzC,CAAC;YACF,WAAW,EAAE,CAAC,CAAC,WAAuB;YACtC,qEAAqE;YACrE,wEAAwE;YACxE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;gBACnD,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiC,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBACzD,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAoC,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAClD,CAAC,CAAE,GAAG,CAAC,iBAGF;QACL,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE;4BACP,IAAI,EAAE,kBAAkB;4BACxB,OAAO,EAAE,qBAAqB,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,IAAI,kBAAkB;yBAC1F;qBACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAI,GAAwC,CAAC,OAAO;QACzE,EAAE,IAAI,CAAC;IAET,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACR,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAyB;YAC1C,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM;YACN,OAAO;YACP,mEAAmE;YACnE,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,CAAC,OAAO,iBAAiB,KAAK,QAAQ;gBACvC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI;gBAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;aACrC,CAAC;YACJ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI;gBAC9B,KAAK,EAAE,GAAG,CAAC,KAAqC;aACjD,CAAC;YACF,GAAG,CAAC,OAAO,IAAI;gBACb,iBAAiB,EAAE,OAAmD;aACvE,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CACvB,QAAkB,EAClB,KAAa;IAEb,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAW,EACX,gBAAwB,EACxB,MAA8B,EAC9B,UAAqE,EAAE;IAEvE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAEjE,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAEpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,4BAA4B,CAC7B,CAAC;QAEF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;gBAChC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAkC,GAAa,CAAC,OAAO,EAAE;iBACnE;aACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE;wBACP,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,8CAA8C;qBACxD;iBACF,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,uCAAuC,QAAQ,CAAC,MAAM,EAAE;iBAClE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,qBAAqB,EAAE,CAAC;YACrE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,uBAAuB,qBAAqB,QAAQ;iBAC9D;aACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,2EAA2E;QAC3E,oBAAoB;QACpB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,uBAAuB,qBAAqB,QAAQ;iBAC9D;aACF,CAAC;QACJ,CAAC;QAED,OAAO,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE;YACP,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,kCAAkC,aAAa,YAAY;SACrE;KACF,CAAC;AACJ,CAAC"}

package/dist/pdpp/index.d.ts

@@ -0,0 +1,37 @@
+/**
+ * PDPP Core v0.1.0 Authorization Server.
+ *
+ * Public seam for the PDPP AS: selection validation, axis resolution, consent
+ * review, grant issuance, grant-bound tokens, introspection, and revocation.
+ * The Resource Server consumes `PdppTokenService.resolveToken` (co-located) or
+ * `introspect` (separated) and enforces only from that result.
+ */
+export { PDPP_DATA_ACCESS_TYPE, PDPP_DATA_ACCESS_TYPE_V02, PDPP_GRANT_VERSION, PDPP_GRANT_VERSION_V02, PDPP_API_VERSION, AI_TRAINING_PURPOSE, isV02Grant, } from "./types.js";
+export type { AccessMode, ClientClaims, ClientDisplay, DeclarationSnapshot, DeclaredPreset, DeclaredStream, DeclaredView, Grant, GrantStatus, InactiveReason, PdppAuthorizationDetail, PdppAuthorizationEntry, PdppAuthorizationResultV02, PdppIntrospectionResponse, PdppTokenContext, PdppTokenKind, OwnerConditions, RecipientTerms, RequestedSelection, RequestedStream, Retention, SelectionRequest, SourceKind, StreamGrant, StreamMinimum, StreamRequest, TimeConstraint, TimeRange, } from "./types.js";
+export { validateSelectionRequest } from "./selection.js";
+export type { SelectionFailure, SelectionFailureCode, SelectionValidation, } from "./selection.js";
+export { REQUEST_TERMS_ID, resolveCommitments } from "./commitments.js";
+export type { CommitmentsFailure, CommitmentsResult, ResolveCommitmentsInput, ResolvedCommitments, } from "./commitments.js";
+export { resolveSelection } from "./resolve.js";
+export type { InstanceInventory, OwnerChoices, ResolutionFailure, ResolutionFailureCode, ResolutionResult, } from "./resolve.js";
+export { buildConsentReview, computeReviewDigest, isRegisteredPurposeCode, normalizeClientClaims, } from "./review.js";
+export type { BuildReviewInput, ConsentReviewModel, ExistingGrant, RequesterIdentity, ReviewStream, } from "./review.js";
+export { issueGrant } from "./issuance.js";
+export type { ConsentEvidence, IssuanceFailure, IssuanceFailureCode, IssuanceResult, IssueGrantInput, } from "./issuance.js";
+export { AUTHORIZATION_CODE_TTL_SECONDS, DEFAULT_ACCESS_TOKEN_TTL_SECONDS, mayIssueRefreshToken, PdppTokenService, toAuthorizationDetail, toAuthorizationEntry, } from "./tokens.js";
+export type { TokenFailure, TokenFailureCode, TokenIssuanceResult, TokenResult, PdppTokenServiceOptions, } from "./tokens.js";
+export { approveAuthorization, AuthorizationSessionStore, denyAuthorization, fetchReview, REVIEW_SESSION_TTL_SECONDS, } from "./approval.js";
+export type { ApprovalFailure, ApprovalFailureCode, ApprovalResult, AuthorizationSession, InstanceChoice, ReviewFetchResult, SessionState, } from "./approval.js";
+export { REDIRECT_FAILURES_ARE_NEVER_REDIRECTED, validateRedirectUri, } from "./redirect.js";
+export type { RedirectFailure, RedirectFailureCode, RegisteredRedirectPolicy, } from "./redirect.js";
+export { computeS256Challenge, PKCE_METHOD_S256, validateCodeChallenge, verifyCodeVerifier, } from "./pkce.js";
+export type { PkceFailure, PkceFailureCode } from "./pkce.js";
+export { hashToken, newOpaqueToken, openPdppAuthStore, PdppAuthStore, PDPP_AUTH_STATE_VERSION, UnsupportedAuthStateError, } from "./store.js";
+export type { AccessTokenRecord, AuthCodeRecord, StoredGrant, } from "./store.js";
+export { checkDeclarationUrl, computeDeclarationDigest, declaredSourceId, DECLARATION_FETCH_TIMEOUT_MS, MAX_DECLARATION_BYTES, MAX_REDIRECTS, parseDeclaration, retrieveDeclaration, } from "./declaration.js";
+export type { DeclarationFailure, DeclarationFailureCode, DeclarationFetcher, DeclarationResult, DeclarationTrustPolicy, } from "./declaration.js";
+export { MAX_CLIENT_DOCUMENT_BYTES, resolveUrlHostedClientIdentity, } from "./client-identity.js";
+export type { ClientDocumentFetcher, ClientIdentityFailure, ClientIdentityFailureCode, ClientIdentityResult, } from "./client-identity.js";
+export { mayRenderRemoteLogo, resolveRequesterIdentity, verifyClientIdDocument, } from "./client-metadata.js";
+export type { ClientIdMetadataDocument, RegisteredClientMetadata, ResolveRequesterInput, } from "./client-metadata.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/pdpp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pdpp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,UAAU,EACV,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,KAAK,EACL,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sCAAsC,EACtC,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE9D,OAAO,EACL,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}

package/dist/pdpp/index.js

@@ -0,0 +1,23 @@
+/**
+ * PDPP Core v0.1.0 Authorization Server.
+ *
+ * Public seam for the PDPP AS: selection validation, axis resolution, consent
+ * review, grant issuance, grant-bound tokens, introspection, and revocation.
+ * The Resource Server consumes `PdppTokenService.resolveToken` (co-located) or
+ * `introspect` (separated) and enforces only from that result.
+ */
+export { PDPP_DATA_ACCESS_TYPE, PDPP_DATA_ACCESS_TYPE_V02, PDPP_GRANT_VERSION, PDPP_GRANT_VERSION_V02, PDPP_API_VERSION, AI_TRAINING_PURPOSE, isV02Grant, } from "./types.js";
+export { validateSelectionRequest } from "./selection.js";
+export { REQUEST_TERMS_ID, resolveCommitments } from "./commitments.js";
+export { resolveSelection } from "./resolve.js";
+export { buildConsentReview, computeReviewDigest, isRegisteredPurposeCode, normalizeClientClaims, } from "./review.js";
+export { issueGrant } from "./issuance.js";
+export { AUTHORIZATION_CODE_TTL_SECONDS, DEFAULT_ACCESS_TOKEN_TTL_SECONDS, mayIssueRefreshToken, PdppTokenService, toAuthorizationDetail, toAuthorizationEntry, } from "./tokens.js";
+export { approveAuthorization, AuthorizationSessionStore, denyAuthorization, fetchReview, REVIEW_SESSION_TTL_SECONDS, } from "./approval.js";
+export { REDIRECT_FAILURES_ARE_NEVER_REDIRECTED, validateRedirectUri, } from "./redirect.js";
+export { computeS256Challenge, PKCE_METHOD_S256, validateCodeChallenge, verifyCodeVerifier, } from "./pkce.js";
+export { hashToken, newOpaqueToken, openPdppAuthStore, PdppAuthStore, PDPP_AUTH_STATE_VERSION, UnsupportedAuthStateError, } from "./store.js";
+export { checkDeclarationUrl, computeDeclarationDigest, declaredSourceId, DECLARATION_FETCH_TIMEOUT_MS, MAX_DECLARATION_BYTES, MAX_REDIRECTS, parseDeclaration, retrieveDeclaration, } from "./declaration.js";
+export { MAX_CLIENT_DOCUMENT_BYTES, resolveUrlHostedClientIdentity, } from "./client-identity.js";
+export { mayRenderRemoteLogo, resolveRequesterIdentity, verifyClientIdDocument, } from "./client-metadata.js";
+//# sourceMappingURL=index.js.map

package/dist/pdpp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pdpp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,GACX,MAAM,YAAY,CAAC;AAgCpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAO1D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AASrB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAS3C,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AASrB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAWvB,OAAO,EACL,sCAAsC,EACtC,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAOpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC"}

package/dist/pdpp/issuance.d.ts

@@ -0,0 +1,126 @@
+/**
+ * PDPP Core §7 grant issuance.
+ *
+ * Issuance is the moment every request-only convenience becomes a frozen fact.
+ * The guard that matters most here is staleness: §7 requires the AS to reject
+ * approval if instance eligibility or the reviewed revision changed between
+ * the owner seeing the review surface and the approval landing.
+ *
+ * We enforce that by recomputing the review digest from what we are about to
+ * issue and comparing it to the digest the owner approved. Any drift — a newly
+ * connected instance changing an auto-resolved handle, a re-fetched
+ * declaration, an edited field list — moves the digest and kills the approval.
+ * This is a re-derivation, not a stored-value comparison, so it catches drift
+ * in inputs that were never persisted alongside the approval.
+ */
+import { computeReviewDigest, type RequesterIdentity } from "./review.js";
+import { type InstanceInventory, type OwnerChoices } from "./resolve.js";
+import { type DeclarationSnapshot, type Grant, type OwnerConditions, type RecipientTerms, type SelectionRequest } from "./types.js";
+export type IssuanceFailureCode = 
+/** The reviewed revision or instance eligibility moved before approval. */
+"stale_approval"
+/** purpose/ai_training without explicit affirmative consent. */
+ | "ai_training_consent_required" | "resolution_failed"
+/**
+ * v0.2: an owner condition on purpose or retention that the recipient's
+ * applicable authority does not cover. Distinct from `access_denied` (a data
+ * selection the request's own requirements refuse): this one is about the
+ * terms of use, and only the recipient can resolve it.
+ */
+ | "recipient_terms_unsupported" | "access_denied";
+export interface IssuanceFailure {
+    code: IssuanceFailureCode;
+    message: string;
+}
+export type IssuanceResult = {
+    ok: true;
+    grant: Grant;
+    consentEvidence: ConsentEvidence;
+} | {
+    ok: false;
+    failure: IssuanceFailure;
+};
+/**
+ * Retained consent evidence. §6 requires the normalized exact client claims,
+ * with attribution, to be bound into the final approval artifact and preserved
+ * here — while staying outside the grant, introspection, and RS enforcement.
+ * Keeping them in a separate structure from `Grant` is what makes that
+ * separation structural rather than a convention someone can forget.
+ */
+export interface ConsentEvidence {
+    review_digest: string;
+    approved_at: string;
+    /** The exact snapshot identity consent was given against. */
+    declaration: {
+        source_id: string;
+        version: string;
+        digest: string;
+    };
+    client_claims?: {
+        attributed_to: string;
+        commitments: string[];
+    };
+    /** Recorded only for purpose codes that require it. */
+    explicit_ai_training_consent?: boolean;
+    /**
+     * v0.2: the terms identity and version the commitments resolved from.
+     *
+     * v0.2 requires the AS to "retain the evidence identifying those terms and
+     * their version with the consent evidence". The version is the load-bearing
+     * half: a terms document can change, and without recording which text was in
+     * force at approval, "the recipient agreed" is unfalsifiable later.
+     *
+     * This lives in the consent evidence and NOT in the grant. v0.2 is explicit
+     * that Core represents commitments through its existing purpose and
+     * retention fields and defines no additional terms object; a terms member on
+     * the grant would read as a constraint the RS should enforce, which it is
+     * not.
+     */
+    recipient_terms?: {
+        id: string;
+        version: string;
+    };
+}
+export interface IssueGrantInput {
+    subjectId: string;
+    request: SelectionRequest;
+    /** The retained snapshot — the same one validation and review ran against. */
+    snapshot: DeclarationSnapshot;
+    /** Instance inventory as of *now*, re-read at approval time on purpose. */
+    inventory: InstanceInventory;
+    /**
+     * v0.2 owner narrowing. Ignored for a v0.1 request, and bound into the
+     * review digest either way, so an approval cannot carry a narrowing the
+     * owner never reviewed.
+     */
+    ownerChoices?: OwnerChoices;
+    /** v0.2: conditions the owner attached beyond narrowing the data. */
+    ownerConditions?: OwnerConditions;
+    /** v0.2: standing terms the recipient authorized, when the AS tracks them. */
+    standingTerms?: RecipientTerms;
+    requester: RequesterIdentity;
+    /** The digest the owner actually approved. */
+    approvedReviewDigest: string;
+    /**
+     * Explicit affirmative consent for `purpose/ai_training`. Required only for
+     * that code (§6 AI training consent); ignored otherwise.
+     */
+    explicitAiTrainingConsent?: boolean;
+    /** AS-policy grant expiry. Absent means the grant never expires. */
+    expiresAt?: string;
+    streamDescriptions?: Record<string, string>;
+    now?: Date;
+}
+/**
+ * Resolve, re-verify the approval, and issue.
+ *
+ * Deliberately re-runs resolution against the *current* inventory rather than
+ * trusting the streams captured at review time. If the owner connected or
+ * disconnected an instance while the consent screen was open, resolution now
+ * produces different handles, the recomputed digest diverges, and we reject.
+ * Trusting the review-time streams would issue a grant the owner never saw.
+ */
+export declare function issueGrant(input: IssueGrantInput): IssuanceResult;
+/** Re-export so callers get the digest helper from the issuance seam. */
+export { computeReviewDigest };
+//# sourceMappingURL=issuance.d.ts.map

package/dist/pdpp/issuance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuance.d.ts","sourceRoot":"","sources":["../../src/pdpp/issuance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAEL,mBAAmB,EAEnB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,KAAK,EACV,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB;AAC7B,2EAA2E;AACzE,gBAAgB;AAClB,gEAAgE;GAC9D,8BAA8B,GAC9B,mBAAmB;AACrB;;;;;GAKG;GACD,6BAA6B,GAC7B,eAAe,CAAC;AAEpB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,eAAe,EAAE,eAAe,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,WAAW,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,aAAa,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjE,uDAAuD;IACvD,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,iBAAiB,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,qEAAqE;IACrE,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,8EAA8E;IAC9E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,8CAA8C;IAC9C,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAMD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,CAmKjE;AAED,yEAAyE;AACzE,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/pdpp/issuance.js

@@ -0,0 +1,180 @@
+/**
+ * PDPP Core §7 grant issuance.
+ *
+ * Issuance is the moment every request-only convenience becomes a frozen fact.
+ * The guard that matters most here is staleness: §7 requires the AS to reject
+ * approval if instance eligibility or the reviewed revision changed between
+ * the owner seeing the review surface and the approval landing.
+ *
+ * We enforce that by recomputing the review digest from what we are about to
+ * issue and comparing it to the digest the owner approved. Any drift — a newly
+ * connected instance changing an auto-resolved handle, a re-fetched
+ * declaration, an edited field list — moves the digest and kills the approval.
+ * This is a re-derivation, not a stored-value comparison, so it catches drift
+ * in inputs that were never persisted alongside the approval.
+ */
+import { randomBytes } from "node:crypto";
+import { buildConsentReview, computeReviewDigest, normalizeClientClaims, } from "./review.js";
+import { resolveCommitments } from "./commitments.js";
+import { resolveSelection, } from "./resolve.js";
+import { AI_TRAINING_PURPOSE, PDPP_DATA_ACCESS_TYPE_V02, PDPP_GRANT_VERSION, PDPP_GRANT_VERSION_V02, } from "./types.js";
+function newGrantId() {
+    return `grt_${randomBytes(12).toString("hex")}`;
+}
+/**
+ * Resolve, re-verify the approval, and issue.
+ *
+ * Deliberately re-runs resolution against the *current* inventory rather than
+ * trusting the streams captured at review time. If the owner connected or
+ * disconnected an instance while the consent screen was open, resolution now
+ * produces different handles, the recomputed digest diverges, and we reject.
+ * Trusting the review-time streams would issue a grant the owner never saw.
+ */
+export function issueGrant(input) {
+    const now = input.now ?? new Date();
+    const resolution = resolveSelection(input.request, input.snapshot, input.inventory, input.ownerChoices);
+    if (!resolution.ok) {
+        // v0.2 splits these deliberately. An unsatisfiable required minimum, a
+        // declined required stream, or an empty approval is a *refusal* — the
+        // request was well-formed and the owner decided; the two are simply
+        // incompatible, and the OAuth binding reports it as `access_denied`. Every
+        // other resolution failure is drift the owner can recover from by
+        // re-reviewing, and stays `resolution_failed`.
+        const refused = resolution.failure.code === "minimum_not_met" ||
+            resolution.failure.code === "required_stream_declined" ||
+            resolution.failure.code === "no_streams_approved";
+        return {
+            ok: false,
+            failure: {
+                code: refused ? "access_denied" : "resolution_failed",
+                message: resolution.failure.message,
+            },
+        };
+    }
+    // Resolve the recipient commitments before deriving the review. v0.2
+    // requires them resolved *before* owner approval, and an owner condition
+    // outside the recipient's authority means there was never a valid review to
+    // approve -- so this refuses rather than silently falling back to the
+    // client's original terms.
+    const commitmentsResult = resolveCommitments({
+        request: input.request,
+        ownerConditions: input.ownerConditions,
+        standingTerms: input.standingTerms,
+        declarationVersion: input.snapshot.version,
+    });
+    if (!commitmentsResult.ok) {
+        return {
+            ok: false,
+            failure: {
+                code: "recipient_terms_unsupported",
+                message: commitmentsResult.failure.message,
+            },
+        };
+    }
+    const commitments = commitmentsResult.commitments;
+    // Gated on the RESOLVED purpose, not the requested one. Under v0.2 an owner
+    // condition can substitute the purpose code when the recipient's authority
+    // covers it, so checking the request here would let `ai_training` arrive as
+    // a substitution and skip the one purpose code Core gives a protocol-level
+    // consent requirement.
+    if (commitments.purpose_code === AI_TRAINING_PURPOSE &&
+        input.explicitAiTrainingConsent !== true) {
+        return {
+            ok: false,
+            failure: {
+                code: "ai_training_consent_required",
+                message: "purpose/ai_training requires explicit affirmative consent before a grant may be issued",
+            },
+        };
+    }
+    // Re-derive the review the owner would see from what we are about to issue.
+    const review = buildConsentReview({
+        commitments,
+        subjectId: input.subjectId,
+        request: input.request,
+        snapshot: input.snapshot,
+        resolvedStreams: resolution.streams,
+        omittedStreams: resolution.omittedStreams,
+        requestedStreams: resolution.requestedStreams,
+        requester: input.requester,
+        expiresAt: input.expiresAt,
+        streamDescriptions: input.streamDescriptions,
+    });
+    if (review.review_digest !== input.approvedReviewDigest) {
+        return {
+            ok: false,
+            failure: {
+                code: "stale_approval",
+                message: "the reviewed selection or instance eligibility changed before approval; a new review is required",
+            },
+        };
+    }
+    const isV02 = input.request.type === PDPP_DATA_ACCESS_TYPE_V02;
+    const grant = {
+        version: isV02 ? PDPP_GRANT_VERSION_V02 : PDPP_GRANT_VERSION,
+        grant_id: newGrantId(),
+        issued_at: now.toISOString(),
+        subject: { id: input.subjectId },
+        client: {
+            client_id: input.requester.client_id,
+            // §7: retained client_display is the AS-resolved identity, not raw
+            // inline input. `requester.display` already went through resolution.
+            ...(input.requester.display && {
+                client_display: input.requester.display,
+            }),
+        },
+        // Provenance comes from the accepted declaration, never from the request.
+        source: { kind: input.snapshot.source_kind, id: input.snapshot.source_id },
+        source_declaration: { version: input.snapshot.version },
+        // The *resolved* commitments, not the raw request: an owner condition
+        // covered by the recipient's authority is the commitment that was
+        // reviewed, so it is the one that belongs in the grant.
+        purpose_code: commitments.purpose_code,
+        ...(commitments.purpose_description && {
+            purpose_description: commitments.purpose_description,
+        }),
+        access_mode: input.request.access_mode,
+        streams: resolution.streams,
+        ...(input.request.selection_preset && {
+            selection_preset: input.request.selection_preset,
+        }),
+        ...(commitments.retention && { retention: commitments.retention }),
+        ...(input.expiresAt && { expires_at: input.expiresAt }),
+        // v0.2: what was asked for, beside what was approved. The client must be
+        // able to work from the owner's actual approval *including* any narrowing,
+        // and §7 forbids it reconstructing that from its own copy of the request.
+        ...(isV02 &&
+            resolution.requestedStreams && {
+            requested: {
+                streams: resolution.requestedStreams,
+                ...(resolution.omittedStreams && {
+                    omitted_streams: resolution.omittedStreams,
+                }),
+            },
+        }),
+    };
+    const normalizedClaims = normalizeClientClaims(input.request.client_claims);
+    const consentEvidence = {
+        review_digest: review.review_digest,
+        approved_at: now.toISOString(),
+        declaration: {
+            source_id: input.snapshot.source_id,
+            version: input.snapshot.version,
+            digest: input.snapshot.digest,
+        },
+        ...(normalizedClaims && {
+            client_claims: {
+                attributed_to: input.requester.display_name,
+                commitments: normalizedClaims,
+            },
+        }),
+        ...(commitments.purpose_code === AI_TRAINING_PURPOSE && {
+            explicit_ai_training_consent: true,
+        }),
+        recipient_terms: commitments.evidence,
+    };
+    return { ok: true, grant, consentEvidence };
+}
+/** Re-export so callers get the digest helper from the issuance seam. */
+export { computeReviewDigest };
+//# sourceMappingURL=issuance.js.map

package/dist/pdpp/issuance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuance.js","sourceRoot":"","sources":["../../src/pdpp/issuance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,GAMvB,MAAM,YAAY,CAAC;AAyFpB,SAAS,UAAU;IACjB,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAEpC,MAAM,UAAU,GAAG,gBAAgB,CACjC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,2EAA2E;QAC3E,kEAAkE;QAClE,+CAA+C;QAC/C,MAAM,OAAO,GACX,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,iBAAiB;YAC7C,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,0BAA0B;YACtD,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mBAAmB;gBACrD,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO;aACpC;SACF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,2BAA2B;IAC3B,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,OAAO;aAC3C;SACF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,CAAC;IAElD,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,uBAAuB;IACvB,IACE,WAAW,CAAC,YAAY,KAAK,mBAAmB;QAChD,KAAK,CAAC,yBAAyB,KAAK,IAAI,EACxC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EACL,wFAAwF;aAC3F;SACF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,WAAW;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,UAAU,CAAC,OAAO;QACnC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EACL,kGAAkG;aACrG;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC;IAE/D,MAAM,KAAK,GAAU;QACnB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,kBAAkB;QAC5D,QAAQ,EAAE,UAAU,EAAE;QACtB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;QAChC,MAAM,EAAE;YACN,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;YACpC,mEAAmE;YACnE,qEAAqE;YACrE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,IAAI;gBAC7B,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;aACxC,CAAC;SACH;QACD,0EAA0E;QAC1E,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC1E,kBAAkB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;QACvD,sEAAsE;QACtE,kEAAkE;QAClE,wDAAwD;QACxD,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,GAAG,CAAC,WAAW,CAAC,mBAAmB,IAAI;YACrC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;SACrD,CAAC;QACF,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,IAAI;YACpC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;SACjD,CAAC;QACF,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACvD,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,GAAG,CAAC,KAAK;YACP,UAAU,CAAC,gBAAgB,IAAI;YAC7B,SAAS,EAAE;gBACT,OAAO,EAAE,UAAU,CAAC,gBAAgB;gBACpC,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI;oBAC/B,eAAe,EAAE,UAAU,CAAC,cAAc;iBAC3C,CAAC;aACH;SACF,CAAC;KACL,CAAC;IAEF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAoB;QACvC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QAC9B,WAAW,EAAE;YACX,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;YACnC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;SAC9B;QACD,GAAG,CAAC,gBAAgB,IAAI;YACtB,aAAa,EAAE;gBACb,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;gBAC3C,WAAW,EAAE,gBAAgB;aAC9B;SACF,CAAC;QACF,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,mBAAmB,IAAI;YACtD,4BAA4B,EAAE,IAAI;SACnC,CAAC;QACF,eAAe,EAAE,WAAW,CAAC,QAAQ;KACtC,CAAC;IAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED,yEAAyE;AACzE,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/pdpp/pkce.d.ts

@@ -0,0 +1,53 @@
+/**
+ * PKCE (RFC 7636) for the PDPP authorization-code flow.
+ *
+ * PDPP clients are public clients: a browser app or a desktop tool holds no
+ * client secret, so `client_id` + `redirect_uri` alone do not prove that the
+ * party redeeming a code is the party that requested it. An attacker who
+ * intercepts the code — a malicious app registered on the same custom URI
+ * scheme, a leaked Referer, a shoulder-surfed loopback redirect — can redeem
+ * it and receive a grant-bound token. RFC 7636 §1 describes exactly this.
+ *
+ * PKCE closes it: the client sends a challenge up front and must present the
+ * verifier at redemption. The AS binds the two. An intercepted code is useless
+ * without the verifier, which never leaves the requesting client.
+ *
+ * Only S256 is supported. `plain` is in RFC 7636 for constrained clients that
+ * cannot compute SHA-256, and it defeats the purpose here: an attacker who
+ * sees the challenge in the authorization request has the verifier. RFC 7636
+ * §4.2 says a server MUST support S256 and clients MUST use it where they can;
+ * for a protocol carrying personal data there is no reason to accept the weak
+ * mode, so this AS declines `plain` explicitly rather than silently.
+ */
+/** The only challenge method this AS accepts. */
+export declare const PKCE_METHOD_S256 = "S256";
+/**
+ * base64url per RFC 7636 §appendix A: standard base64 with `+/` mapped to
+ * `-_` and padding stripped. Node's `base64url` encoding already does this.
+ */
+export declare function computeS256Challenge(verifier: string): string;
+export type PkceFailureCode = "missing_verifier" | "invalid_verifier" | "unsupported_method" | "missing_challenge";
+export interface PkceFailure {
+    code: PkceFailureCode;
+    message: string;
+}
+/**
+ * Validate a challenge at authorization time.
+ *
+ * Rejecting an unsupported method here, rather than at redemption, means a
+ * client learns its flow is unusable before the owner is asked to consent to
+ * anything — failing after consent would waste a real human decision.
+ */
+export declare function validateCodeChallenge(challenge: string | undefined, method: string | undefined, options: {
+    required: boolean;
+}): PkceFailure | null;
+/**
+ * Verify a presented verifier against the stored challenge at redemption.
+ *
+ * The comparison is constant-time. A challenge is not a secret in the way a
+ * password is — it is already public in the authorization request — but the
+ * verifier is, and an early-exit comparison over attacker-chosen input is a
+ * habit worth not forming in an authorization server.
+ */
+export declare function verifyCodeVerifier(verifier: string | undefined, storedChallenge: string | null, storedMethod: string | null): PkceFailure | null;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/pdpp/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/pdpp/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAKvC;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,GAC7B,WAAW,GAAG,IAAI,CAoBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,GAC1B,WAAW,GAAG,IAAI,CA8CpB"}

package/dist/pdpp/pkce.js

@@ -0,0 +1,109 @@
+/**
+ * PKCE (RFC 7636) for the PDPP authorization-code flow.
+ *
+ * PDPP clients are public clients: a browser app or a desktop tool holds no
+ * client secret, so `client_id` + `redirect_uri` alone do not prove that the
+ * party redeeming a code is the party that requested it. An attacker who
+ * intercepts the code — a malicious app registered on the same custom URI
+ * scheme, a leaked Referer, a shoulder-surfed loopback redirect — can redeem
+ * it and receive a grant-bound token. RFC 7636 §1 describes exactly this.
+ *
+ * PKCE closes it: the client sends a challenge up front and must present the
+ * verifier at redemption. The AS binds the two. An intercepted code is useless
+ * without the verifier, which never leaves the requesting client.
+ *
+ * Only S256 is supported. `plain` is in RFC 7636 for constrained clients that
+ * cannot compute SHA-256, and it defeats the purpose here: an attacker who
+ * sees the challenge in the authorization request has the verifier. RFC 7636
+ * §4.2 says a server MUST support S256 and clients MUST use it where they can;
+ * for a protocol carrying personal data there is no reason to accept the weak
+ * mode, so this AS declines `plain` explicitly rather than silently.
+ */
+import { createHash, timingSafeEqual } from "node:crypto";
+/** The only challenge method this AS accepts. */
+export const PKCE_METHOD_S256 = "S256";
+/** RFC 7636 §4.1: the verifier is 43–128 characters of unreserved ASCII. */
+const VERIFIER_RE = /^[A-Za-z0-9\-._~]{43,128}$/;
+/**
+ * base64url per RFC 7636 §appendix A: standard base64 with `+/` mapped to
+ * `-_` and padding stripped. Node's `base64url` encoding already does this.
+ */
+export function computeS256Challenge(verifier) {
+    return createHash("sha256").update(verifier, "ascii").digest("base64url");
+}
+/**
+ * Validate a challenge at authorization time.
+ *
+ * Rejecting an unsupported method here, rather than at redemption, means a
+ * client learns its flow is unusable before the owner is asked to consent to
+ * anything — failing after consent would waste a real human decision.
+ */
+export function validateCodeChallenge(challenge, method, options) {
+    if (challenge === undefined || challenge.length === 0) {
+        if (!options.required)
+            return null;
+        return {
+            code: "missing_challenge",
+            message: "code_challenge is required for the authorization code flow",
+        };
+    }
+    // An absent method defaults to `plain` under RFC 7636 §4.3. We do not accept
+    // plain, so an omitted method is an explicit error rather than a silent
+    // downgrade to the mode we refuse.
+    if (method !== PKCE_METHOD_S256) {
+        return {
+            code: "unsupported_method",
+            message: `code_challenge_method must be ${PKCE_METHOD_S256}; 'plain' is not accepted`,
+        };
+    }
+    return null;
+}
+/**
+ * Verify a presented verifier against the stored challenge at redemption.
+ *
+ * The comparison is constant-time. A challenge is not a secret in the way a
+ * password is — it is already public in the authorization request — but the
+ * verifier is, and an early-exit comparison over attacker-chosen input is a
+ * habit worth not forming in an authorization server.
+ */
+export function verifyCodeVerifier(verifier, storedChallenge, storedMethod) {
+    if (storedChallenge === null || storedChallenge.length === 0) {
+        // The code was issued without PKCE. Whether that is allowed is the
+        // authorization endpoint's decision (see `validateCodeChallenge`); by the
+        // time a code exists, there is nothing to verify against.
+        return null;
+    }
+    if (storedMethod !== PKCE_METHOD_S256) {
+        // A stored non-S256 method means the code was minted by a path that did
+        // not enforce the method check. Fail closed rather than honouring it.
+        return {
+            code: "unsupported_method",
+            message: "authorization code carries an unsupported code_challenge_method",
+        };
+    }
+    if (verifier === undefined || verifier.length === 0) {
+        return {
+            code: "missing_verifier",
+            message: "code_verifier is required to redeem this authorization code",
+        };
+    }
+    if (!VERIFIER_RE.test(verifier)) {
+        // Enforcing the shape stops a trivially-guessable short verifier from
+        // being accepted just because it happens to hash correctly.
+        return {
+            code: "invalid_verifier",
+            message: "code_verifier must be 43-128 characters of [A-Za-z0-9-._~] (RFC 7636 §4.1)",
+        };
+    }
+    const computed = computeS256Challenge(verifier);
+    const a = Buffer.from(computed, "utf8");
+    const b = Buffer.from(storedChallenge, "utf8");
+    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+        return {
+            code: "invalid_verifier",
+            message: "code_verifier does not match the code_challenge",
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=pkce.js.map

package/dist/pdpp/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pdpp/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6B,EAC7B,MAA0B,EAC1B,OAA8B;IAE9B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,4DAA4D;SACtE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,iCAAiC,gBAAgB,2BAA2B;SACtF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,eAA8B,EAC9B,YAA2B;IAE3B,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,mEAAmE;QACnE,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;QACtC,wEAAwE;QACxE,sEAAsE;QACtE,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EACL,iEAAiE;SACpE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,6DAA6D;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,sEAAsE;QACtE,4DAA4D;QAC5D,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,4EAA4E;SAC/E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,iDAAiD;SAC3D,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}