@opendatalabs/personal-server-ts-core 1.33.8 → 1.34.1

package/dist/pdpp/tokens.d.ts

@@ -0,0 +1,181 @@
+/**
+ * PDPP grant-bound token issuance, introspection, and revocation (§8, §9 AS
+ * items 8–10, 18–20; delivery scope §2).
+ *
+ * This module is the single token-validation authority. The RS resolves every
+ * request through `resolveToken` and enforces only from the result — §8 is
+ * explicit that the separated RS must not make a second AS lookup while
+ * handling a request, and that a co-located RS may use a local equivalent.
+ * `resolveToken` is that local equivalent, and `introspect` is the same
+ * decision rendered onto the RFC 7662 wire shape. They share one code path so
+ * the two deployments cannot drift apart.
+ *
+ * Revocation is immediate here by construction: resolution reads current store
+ * state on every call rather than trusting a cached decision, so a revoked
+ * grant reports `active: false` on the very next call. The 60-second bound in
+ * §8 is the RS's positive-result cache, not slack in the AS.
+ */
+import { type PdppAuthStore } from "./store.js";
+import { type AccessMode, type Grant, type PdppAuthorizationDetail, type PdppAuthorizationEntry, type PdppIntrospectionResponse, type PdppTokenContext } from "./types.js";
+/** Default client access-token lifetime. Short: the refresh path renews it. */
+export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS: number;
+/** How long an authorization code stays redeemable. RFC 6749 §4.1.2 suggests <=10 min. */
+export declare const AUTHORIZATION_CODE_TTL_SECONDS = 60;
+export interface TokenIssuanceResult {
+    access_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+    /** Present only for continuous grants (§9 AS item 20). */
+    refresh_token?: string;
+    /** Echoed so a client can bind its own state to the grant. */
+    grant_id: string;
+    /**
+     * The approved RFC 9396 detail, as granted. RFC 9396 §7 requires the token
+     * response to return `authorization_details` as granted by the resource
+     * owner and assigned to the access token — the same projection introspection
+     * carries.
+     *
+     * One element per covered grant, each in its own revision's shape: a v0.1
+     * grant yields the v0.1 projection, a v0.2 grant yields `{ type, grant }`
+     * with the complete grant. v0.2 forbids a lossy summary, and the v0.1
+     * projection is one, so the two cannot share a shape.
+     */
+    authorization_details: PdppAuthorizationEntry[];
+}
+export type TokenFailureCode = "invalid_grant" | "invalid_request";
+export interface TokenFailure {
+    code: TokenFailureCode;
+    message: string;
+}
+export type TokenResult = {
+    ok: true;
+    issued: TokenIssuanceResult;
+} | {
+    ok: false;
+    failure: TokenFailure;
+};
+/**
+ * Whether a grant may carry a refresh token.
+ *
+ * §9 AS item 20: refresh tokens are issued only for `continuous` grants, or
+ * for a grant package only when *every* child grant is continuous. A
+ * single-use grant with a refresh token would be a contradiction — the grant
+ * is consumed at first issuance, so there is nothing left to refresh into.
+ */
+export declare function mayIssueRefreshToken(accessModes: AccessMode[]): boolean;
+export interface PdppTokenServiceOptions {
+    accessTokenTtlSeconds?: number;
+}
+export declare class PdppTokenService {
+    private readonly store;
+    private readonly accessTtl;
+    constructor(store: PdppAuthStore, options?: PdppTokenServiceOptions);
+    /**
+     * Issue the first client token for a grant, redeeming an authorization code.
+     *
+     * The code is consumed atomically before anything else happens (§9 AS item
+     * 19) and a single-use grant is consumed atomically with the token insert
+     * (§9 AS item 10). Both preconditions live in SQL WHERE clauses, so a
+     * concurrent duplicate redemption loses the race rather than double-issuing.
+     */
+    redeemAuthorizationCode(input: {
+        code: string;
+        clientId: string;
+        redirectUri: string;
+        /** RFC 7636 verifier. Required when the code was issued with a challenge. */
+        codeVerifier?: string;
+        now?: Date;
+    }): TokenResult;
+    /**
+     * Rotate a refresh token within its family.
+     *
+     * Reuse of a superseded token revokes the family and every family-linked
+     * access token inside `rotateRefreshToken`, then this returns
+     * `invalid_grant`, which is what §9 AS item 20 requires: reject the reuse
+     * and require fresh authorization.
+     */
+    refresh(input: {
+        refreshToken: string;
+        now?: Date;
+    }): TokenResult;
+    /**
+     * Mint an access token (and, for continuous grants, a refresh token) bound
+     * to a grant.
+     *
+     * `existingFamilyId` carries a rotation into the same family so reuse
+     * detection keeps working across the whole chain; a first issuance creates
+     * the family.
+     */
+    private mintForGrant;
+    /**
+     * The single shared token-validation path (§8 "Grant enforcement").
+     *
+     * Reads live store state every call. That is what makes revocation immediate
+     * in introspection (§9 AS item 8) — there is no AS-side cache to invalidate.
+     */
+    resolveToken(accessToken: string, now?: Date): PdppTokenContext;
+    /**
+     * RFC 7662 introspection.
+     *
+     * An inactive token yields exactly `{ active: false }`. RFC 7662 §2.2 is
+     * clear that the response must not distinguish revoked from expired from
+     * never-issued — the reason stays internal (`resolveToken`) for the
+     * co-located RS, which needs it to pick 403 `grant_revoked`.
+     */
+    introspect(accessToken: string, now?: Date): PdppIntrospectionResponse;
+    /** Revoke a grant and every linked token family. Immediate (§2, §9 item 8). */
+    revokeGrant(grantId: string, now?: Date): boolean;
+    /**
+     * Issue an owner token for a subject.
+     *
+     * An owner token carries no grant (§8 "Authentication"): it scopes to a
+     * single subject's data store, and the RS derives subject scope from it
+     * rather than synthesizing a grant. It is also what authenticates a consent
+     * decision — see `approval.ts` for why the AS requires this rather than
+     * trusting the consent UI's affiliation.
+     *
+     * How the owner *obtains* this token is out of scope for Core; this build
+     * mints it from the already-authenticated owner session paths.
+     */
+    issueOwnerToken(input: {
+        subjectId: string;
+        sourceId?: string;
+        instanceIds?: string[];
+        ttlSeconds?: number;
+        now?: Date;
+    }): {
+        access_token: string;
+        token_type: "Bearer";
+        expires_in: number;
+    };
+    /** Revoke a single access token without touching its grant. */
+    revokeAccessToken(token: string, now?: Date): boolean;
+}
+/**
+ * Project a grant onto the RFC 9396 detail the introspection response carries.
+ *
+ * Note what is absent: `client_claims` and `retention` are not enforcement
+ * fields. §6 keeps claims outside introspection rights and RS enforcement
+ * entirely; retention is a policy commitment PDPP does not technically
+ * enforce, so including it would invite an RS to act on it.
+ */
+/**
+ * Project a grant onto the `authorization_details` element for *its own*
+ * revision.
+ *
+ * v0.1 gets the narrow enforcement projection below, unchanged. v0.2 gets
+ * `{ type, grant }` carrying the complete immutable grant, because v0.2 makes
+ * the result the client's source of truth and forbids substituting the
+ * original selection request or a lossy summary — and the v0.1 projection is
+ * precisely a lossy summary. It drops `retention`, `expires_at`, the resolved
+ * client identity, and the requested-vs-approved record, so a v0.2 client
+ * receiving it could not tell a narrowed grant from an unnarrowed one.
+ *
+ * Branching on the grant rather than on a caller-supplied flag is what keeps
+ * the two revisions from drifting: the same function serves the token response
+ * and introspection, so a client and an authenticated RS cannot be handed
+ * different facts about one grant.
+ */
+export declare function toAuthorizationEntry(grant: Grant): PdppAuthorizationEntry;
+export declare function toAuthorizationDetail(grant: Grant): PdppAuthorizationDetail;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/pdpp/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/pdpp/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,KAAK,EAEV,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,eAAO,MAAM,gCAAgC,QAAU,CAAC;AAExD,0FAA0F;AAC1F,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;OAUG;IACH,qBAAqB,EAAE,sBAAsB,EAAE,CAAC;CACjD;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAEvE;AAaD,MAAM,WAAW,uBAAuB;IACtC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,gBAAgB;IAIzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAHxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGhB,KAAK,EAAE,aAAa,EACrC,OAAO,GAAE,uBAA4B;IAMvC;;;;;;;OAOG;IACH,uBAAuB,CAAC,KAAK,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,6EAA6E;QAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,WAAW;IA6Ef;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,GAAG,WAAW;IAuCjE;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;IAwEpB;;;;;OAKG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,gBAAgB;IA8E3E;;;;;;;OAOG;IACH,UAAU,CACR,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,GACrB,yBAAyB;IA8B5B,+EAA+E;IAC/E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO;IAI7D;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,KAAK,EAAE;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAsBtE,+DAA+D;IAC/D,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO;CAGlE;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,sBAAsB,CAKzE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAW3E"}

package/dist/pdpp/tokens.js

@@ -0,0 +1,419 @@
+/**
+ * PDPP grant-bound token issuance, introspection, and revocation (§8, §9 AS
+ * items 8–10, 18–20; delivery scope §2).
+ *
+ * This module is the single token-validation authority. The RS resolves every
+ * request through `resolveToken` and enforces only from the result — §8 is
+ * explicit that the separated RS must not make a second AS lookup while
+ * handling a request, and that a co-located RS may use a local equivalent.
+ * `resolveToken` is that local equivalent, and `introspect` is the same
+ * decision rendered onto the RFC 7662 wire shape. They share one code path so
+ * the two deployments cannot drift apart.
+ *
+ * Revocation is immediate here by construction: resolution reads current store
+ * state on every call rather than trusting a cached decision, so a revoked
+ * grant reports `active: false` on the very next call. The 60-second bound in
+ * §8 is the RS's positive-result cache, not slack in the AS.
+ */
+import { verifyCodeVerifier } from "./pkce.js";
+import { newOpaqueToken, } from "./store.js";
+import { isV02Grant, PDPP_DATA_ACCESS_TYPE, PDPP_DATA_ACCESS_TYPE_V02, } from "./types.js";
+/** Default client access-token lifetime. Short: the refresh path renews it. */
+export const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+/** How long an authorization code stays redeemable. RFC 6749 §4.1.2 suggests <=10 min. */
+export const AUTHORIZATION_CODE_TTL_SECONDS = 60;
+/**
+ * Whether a grant may carry a refresh token.
+ *
+ * §9 AS item 20: refresh tokens are issued only for `continuous` grants, or
+ * for a grant package only when *every* child grant is continuous. A
+ * single-use grant with a refresh token would be a contradiction — the grant
+ * is consumed at first issuance, so there is nothing left to refresh into.
+ */
+export function mayIssueRefreshToken(accessModes) {
+    return accessModes.length > 0 && accessModes.every((m) => m === "continuous");
+}
+function grantInactiveReason(store, stored, now) {
+    const status = store.grantStatus(stored, now);
+    if (status === "revoked")
+        return "grant_revoked";
+    if (status === "expired")
+        return "grant_expired";
+    return null;
+}
+export class PdppTokenService {
+    store;
+    accessTtl;
+    constructor(store, options = {}) {
+        this.store = store;
+        this.accessTtl =
+            options.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+    }
+    /**
+     * Issue the first client token for a grant, redeeming an authorization code.
+     *
+     * The code is consumed atomically before anything else happens (§9 AS item
+     * 19) and a single-use grant is consumed atomically with the token insert
+     * (§9 AS item 10). Both preconditions live in SQL WHERE clauses, so a
+     * concurrent duplicate redemption loses the race rather than double-issuing.
+     */
+    redeemAuthorizationCode(input) {
+        const now = input.now ?? new Date();
+        const record = this.store.consumeAuthCode(input.code, now);
+        if (!record) {
+            // Unknown, expired, or already redeemed — deliberately one answer, so a
+            // replay cannot be distinguished from a bad code.
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: "authorization code is invalid, expired, or already redeemed",
+                },
+            };
+        }
+        // RFC 6749 §4.1.3: the client and redirect_uri must match the ones the
+        // code was issued to. The code is already burned at this point, which is
+        // correct — a mismatched redemption attempt must not leave it redeemable.
+        if (record.clientId !== input.clientId) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: "authorization code was not issued to this client",
+                },
+            };
+        }
+        if (record.redirectUri !== input.redirectUri) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: "redirect_uri does not match the authorization request",
+                },
+            };
+        }
+        // RFC 7636 §4.6. Checked after the code is burned, like the client and
+        // redirect checks above: an attacker who intercepted the code must not be
+        // able to probe verifiers against a code that stays alive between guesses.
+        // One wrong verifier costs them the code.
+        const pkceFailure = verifyCodeVerifier(input.codeVerifier, record.codeChallenge, record.codeChallengeMethod);
+        if (pkceFailure) {
+            return {
+                ok: false,
+                failure: { code: "invalid_grant", message: pkceFailure.message },
+            };
+        }
+        const stored = this.store.getGrant(record.grantId);
+        if (!stored) {
+            return {
+                ok: false,
+                failure: { code: "invalid_grant", message: "grant not found" },
+            };
+        }
+        const inactive = grantInactiveReason(this.store, stored, now);
+        if (inactive) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: `grant is ${inactive === "grant_revoked" ? "revoked" : "expired"}`,
+                },
+            };
+        }
+        return this.mintForGrant(stored, now);
+    }
+    /**
+     * Rotate a refresh token within its family.
+     *
+     * Reuse of a superseded token revokes the family and every family-linked
+     * access token inside `rotateRefreshToken`, then this returns
+     * `invalid_grant`, which is what §9 AS item 20 requires: reject the reuse
+     * and require fresh authorization.
+     */
+    refresh(input) {
+        const now = input.now ?? new Date();
+        const rotation = this.store.rotateRefreshToken(input.refreshToken, now);
+        if (!rotation.ok) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: rotation.reason === "reuse_detected"
+                        ? "refresh token reuse detected; the token family has been revoked and fresh authorization is required"
+                        : "refresh token is unknown or its family is revoked",
+                },
+            };
+        }
+        const stored = this.store.getGrant(rotation.grantId);
+        if (!stored) {
+            return {
+                ok: false,
+                failure: { code: "invalid_grant", message: "grant not found" },
+            };
+        }
+        const inactive = grantInactiveReason(this.store, stored, now);
+        if (inactive) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: `grant is ${inactive === "grant_revoked" ? "revoked" : "expired"}`,
+                },
+            };
+        }
+        return this.mintForGrant(stored, now, rotation.familyId);
+    }
+    /**
+     * Mint an access token (and, for continuous grants, a refresh token) bound
+     * to a grant.
+     *
+     * `existingFamilyId` carries a rotation into the same family so reuse
+     * detection keeps working across the whole chain; a first issuance creates
+     * the family.
+     */
+    mintForGrant(stored, now, existingFamilyId) {
+        const { grant } = stored;
+        const continuous = mayIssueRefreshToken([grant.access_mode]);
+        let familyId = existingFamilyId ?? null;
+        if (continuous && familyId === null) {
+            familyId = this.store.createRefreshFamily(grant.grant_id);
+        }
+        const accessToken = newOpaqueToken("pdpp_at");
+        // A token must never outlive the grant it is bound to. Clamping here means
+        // the RS's `min(token_exp, 60s)` cache bound can never extend access past
+        // grant expiry either.
+        const ttlExpiry = new Date(now.getTime() + this.accessTtl * 1000);
+        const grantExpiry = grant.expires_at ? new Date(grant.expires_at) : null;
+        const effectiveExpiry = grantExpiry && grantExpiry < ttlExpiry ? grantExpiry : ttlExpiry;
+        const issued = this.store.issueAccessToken({
+            token: accessToken,
+            grantId: grant.grant_id,
+            subjectId: stored.subjectId,
+            clientId: grant.client.client_id,
+            tokenKind: "client",
+            familyId,
+            expiresAt: effectiveExpiry.toISOString(),
+            // A single-use grant is consumed exactly at first client-token issuance.
+            // A rotation is never a first issuance, so it never re-consumes.
+            consumeSingleUse: grant.access_mode === "single_use" && existingFamilyId === undefined,
+            now,
+        });
+        if (!issued) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: "single_use grant has already been consumed; no further access tokens may be issued against it",
+                },
+            };
+        }
+        const expiresIn = Math.max(1, Math.floor((effectiveExpiry.getTime() - now.getTime()) / 1000));
+        let refreshToken;
+        if (continuous && familyId) {
+            refreshToken = newOpaqueToken("pdpp_rt");
+            this.store.insertRefreshToken(refreshToken, familyId, now);
+        }
+        return {
+            ok: true,
+            issued: {
+                access_token: accessToken,
+                token_type: "Bearer",
+                expires_in: expiresIn,
+                ...(refreshToken && { refresh_token: refreshToken }),
+                grant_id: grant.grant_id,
+                authorization_details: [toAuthorizationEntry(grant)],
+            },
+        };
+    }
+    /**
+     * The single shared token-validation path (§8 "Grant enforcement").
+     *
+     * Reads live store state every call. That is what makes revocation immediate
+     * in introspection (§9 AS item 8) — there is no AS-side cache to invalidate.
+     */
+    resolveToken(accessToken, now = new Date()) {
+        const record = this.store.getAccessToken(accessToken);
+        if (!record) {
+            return { active: false, inactiveReason: "unknown" };
+        }
+        // Grant state is checked BEFORE the token's own revocation flag, because
+        // revoking a grant also marks its linked tokens revoked. Checking the
+        // token first would report `revoked` for what is really a grant
+        // revocation, and the RS keys 403 `grant_revoked` off this exact reason
+        // (§2 revocation propagation) — it would return the wrong error.
+        if (record.tokenKind === "client" && record.grantId) {
+            const stored = this.store.getGrant(record.grantId);
+            if (!stored) {
+                return { active: false, inactiveReason: "unknown" };
+            }
+            const grantInactive = grantInactiveReason(this.store, stored, now);
+            if (grantInactive) {
+                return { active: false, inactiveReason: grantInactive };
+            }
+        }
+        if (record.revokedAt) {
+            return { active: false, inactiveReason: "revoked" };
+        }
+        if (record.expiresAt && Date.parse(record.expiresAt) <= now.getTime()) {
+            return { active: false, inactiveReason: "expired" };
+        }
+        // A token minted into a family that was later burned by reuse detection is
+        // dead even if its own row was not individually marked — belt and braces
+        // against a token inserted concurrently with the family revocation.
+        if (record.familyId && this.store.isFamilyRevoked(record.familyId)) {
+            return { active: false, inactiveReason: "revoked" };
+        }
+        if (record.tokenKind === "owner") {
+            // An owner token carries no grant. The RS derives subject scope from
+            // `subjectId` and must not synthesize a grant for it (§8).
+            return {
+                active: true,
+                tokenKind: "owner",
+                subjectId: record.subjectId,
+                ...(record.ownerSourceId && { sourceId: record.ownerSourceId }),
+                ...(record.ownerInstanceIds && {
+                    instanceIds: record.ownerInstanceIds,
+                }),
+                ...(record.expiresAt && { expiresAt: record.expiresAt }),
+            };
+        }
+        if (!record.grantId) {
+            // A client token with no grant link is unusable by definition.
+            return { active: false, inactiveReason: "unknown" };
+        }
+        const stored = this.store.getGrant(record.grantId);
+        if (!stored) {
+            return { active: false, inactiveReason: "unknown" };
+        }
+        const inactive = grantInactiveReason(this.store, stored, now);
+        if (inactive) {
+            // grant_revoked is the reason the RS turns into 403 grant_revoked.
+            return { active: false, inactiveReason: inactive };
+        }
+        return {
+            active: true,
+            tokenKind: "client",
+            subjectId: stored.subjectId,
+            grant: stored.grant,
+            clientId: stored.grant.client.client_id,
+            ...(record.expiresAt && { expiresAt: record.expiresAt }),
+        };
+    }
+    /**
+     * RFC 7662 introspection.
+     *
+     * An inactive token yields exactly `{ active: false }`. RFC 7662 §2.2 is
+     * clear that the response must not distinguish revoked from expired from
+     * never-issued — the reason stays internal (`resolveToken`) for the
+     * co-located RS, which needs it to pick 403 `grant_revoked`.
+     */
+    introspect(accessToken, now = new Date()) {
+        const context = this.resolveToken(accessToken, now);
+        if (!context.active) {
+            return { active: false };
+        }
+        const base = {
+            active: true,
+            pdpp_token_kind: context.tokenKind,
+            subject_id: context.subjectId,
+            ...(context.sourceId && { source_id: context.sourceId }),
+            ...(context.instanceIds && { instance_ids: context.instanceIds }),
+            ...(context.expiresAt && {
+                exp: Math.floor(Date.parse(context.expiresAt) / 1000),
+            }),
+        };
+        if (context.tokenKind === "owner" || !context.grant) {
+            return base;
+        }
+        return {
+            ...base,
+            grant_id: context.grant.grant_id,
+            client_id: context.grant.client.client_id,
+            // The complete resolved enforcement context, in one response (§9 item 18).
+            authorization_details: [toAuthorizationEntry(context.grant)],
+        };
+    }
+    /** Revoke a grant and every linked token family. Immediate (§2, §9 item 8). */
+    revokeGrant(grantId, now = new Date()) {
+        return this.store.revokeGrant(grantId, now);
+    }
+    /**
+     * Issue an owner token for a subject.
+     *
+     * An owner token carries no grant (§8 "Authentication"): it scopes to a
+     * single subject's data store, and the RS derives subject scope from it
+     * rather than synthesizing a grant. It is also what authenticates a consent
+     * decision — see `approval.ts` for why the AS requires this rather than
+     * trusting the consent UI's affiliation.
+     *
+     * How the owner *obtains* this token is out of scope for Core; this build
+     * mints it from the already-authenticated owner session paths.
+     */
+    issueOwnerToken(input) {
+        const now = input.now ?? new Date();
+        const ttl = input.ttlSeconds ?? this.accessTtl;
+        const token = newOpaqueToken("pdpp_ot");
+        const expiresAt = new Date(now.getTime() + ttl * 1000);
+        this.store.issueAccessToken({
+            token,
+            grantId: null,
+            subjectId: input.subjectId,
+            clientId: null,
+            tokenKind: "owner",
+            ownerSourceId: input.sourceId,
+            ownerInstanceIds: input.instanceIds,
+            expiresAt: expiresAt.toISOString(),
+            consumeSingleUse: false,
+            now,
+        });
+        return { access_token: token, token_type: "Bearer", expires_in: ttl };
+    }
+    /** Revoke a single access token without touching its grant. */
+    revokeAccessToken(token, now = new Date()) {
+        return this.store.revokeAccessToken(token, now);
+    }
+}
+/**
+ * Project a grant onto the RFC 9396 detail the introspection response carries.
+ *
+ * Note what is absent: `client_claims` and `retention` are not enforcement
+ * fields. §6 keeps claims outside introspection rights and RS enforcement
+ * entirely; retention is a policy commitment PDPP does not technically
+ * enforce, so including it would invite an RS to act on it.
+ */
+/**
+ * Project a grant onto the `authorization_details` element for *its own*
+ * revision.
+ *
+ * v0.1 gets the narrow enforcement projection below, unchanged. v0.2 gets
+ * `{ type, grant }` carrying the complete immutable grant, because v0.2 makes
+ * the result the client's source of truth and forbids substituting the
+ * original selection request or a lossy summary — and the v0.1 projection is
+ * precisely a lossy summary. It drops `retention`, `expires_at`, the resolved
+ * client identity, and the requested-vs-approved record, so a v0.2 client
+ * receiving it could not tell a narrowed grant from an unnarrowed one.
+ *
+ * Branching on the grant rather than on a caller-supplied flag is what keeps
+ * the two revisions from drifting: the same function serves the token response
+ * and introspection, so a client and an authenticated RS cannot be handed
+ * different facts about one grant.
+ */
+export function toAuthorizationEntry(grant) {
+    if (isV02Grant(grant)) {
+        return { type: PDPP_DATA_ACCESS_TYPE_V02, grant };
+    }
+    return toAuthorizationDetail(grant);
+}
+export function toAuthorizationDetail(grant) {
+    return {
+        type: PDPP_DATA_ACCESS_TYPE,
+        source: grant.source,
+        purpose_code: grant.purpose_code,
+        ...(grant.purpose_description && {
+            purpose_description: grant.purpose_description,
+        }),
+        access_mode: grant.access_mode,
+        streams: grant.streams,
+    };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/pdpp/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/pdpp/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,cAAc,GAGf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,yBAAyB,GAQ1B,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,CAAC;AAExD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAmCjD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAyB;IAC5D,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAoB,EACpB,MAAmB,EACnB,GAAS;IAET,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACjD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,MAAM,OAAO,gBAAgB;IAIR;IAHF,SAAS,CAAS;IAEnC,YACmB,KAAoB,EACrC,UAAmC,EAAE;QADpB,UAAK,GAAL,KAAK,CAAe;QAGrC,IAAI,CAAC,SAAS;YACZ,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,uBAAuB,CAAC,KAOvB;QACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wEAAwE;YACxE,kDAAkD;YAClD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EACL,6DAA6D;iBAChE;aACF,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,kDAAkD;iBAC5D;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,uDAAuD;iBACjE;aACF,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,WAAW,GAAG,kBAAkB,CACpC,KAAK,CAAC,YAAY,EAClB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE;aACjE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,YAAY,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;iBAC5E;aACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,KAA2C;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAExE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EACL,QAAQ,CAAC,MAAM,KAAK,gBAAgB;wBAClC,CAAC,CAAC,qGAAqG;wBACvG,CAAC,CAAC,mDAAmD;iBAC1D;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,YAAY,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;iBAC5E;aACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;OAOG;IACK,YAAY,CAClB,MAAmB,EACnB,GAAS,EACT,gBAAyB;QAEzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAE7D,IAAI,QAAQ,GAAkB,gBAAgB,IAAI,IAAI,CAAC;QACvD,IAAI,UAAU,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9C,2EAA2E;QAC3E,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,MAAM,eAAe,GACnB,WAAW,IAAI,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACzC,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YAChC,SAAS,EAAE,QAAQ;YACnB,QAAQ;YACR,SAAS,EAAE,eAAe,CAAC,WAAW,EAAE;YACxC,yEAAyE;YACzE,iEAAiE;YACjE,gBAAgB,EACd,KAAK,CAAC,WAAW,KAAK,YAAY,IAAI,gBAAgB,KAAK,SAAS;YACtE,GAAG;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EACL,+FAA+F;iBAClG;aACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAC/D,CAAC;QAEF,IAAI,YAAgC,CAAC;QACrC,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAC3B,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,SAAS;gBACrB,GAAG,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;gBACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,qBAAqB,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;aACrD;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,WAAmB,EAAE,MAAY,IAAI,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,gEAAgE;QAChE,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;YACtD,CAAC;YACD,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACnE,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACtE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACjC,qEAAqE;YACrE,2DAA2D;YAC3D,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/D,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI;oBAC7B,WAAW,EAAE,MAAM,CAAC,gBAAgB;iBACrC,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;aACzD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,+DAA+D;YAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,mEAAmE;YACnE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;QACrD,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS;YACvC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CACR,WAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,IAAI,GAA8B;YACtC,MAAM,EAAE,IAAI;YACZ,eAAe,EAAE,OAAO,CAAC,SAAS;YAClC,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxD,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YACjE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI;gBACvB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;aACtD,CAAC;SACH,CAAC;QAEF,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS;YACzC,2EAA2E;YAC3E,qBAAqB,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,OAAe,EAAE,MAAY,IAAI,IAAI,EAAE;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,KAMf;QACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QAEvD,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC1B,KAAK;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,OAAO;YAClB,aAAa,EAAE,KAAK,CAAC,QAAQ;YAC7B,gBAAgB,EAAE,KAAK,CAAC,WAAW;YACnC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,gBAAgB,EAAE,KAAK;YACvB,GAAG;SACJ,CAAC,CAAC;QAEH,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACxE,CAAC;IAED,+DAA+D;IAC/D,iBAAiB,CAAC,KAAa,EAAE,MAAY,IAAI,IAAI,EAAE;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;CACF;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAY;IAC/C,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAY;IAChD,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI;YAC/B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC;QACF,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}