@poppykit/server 0.2.0 → 0.3.0

package/API.md

@@ -18,6 +18,11 @@ idempotency and reconciliation. Existing issuers implement `ExternalAuthorityAda
 and do not need the optional reference issuer. Your framework owns HTTPS routing,
 trusted public URLs, ingress limits, request cancellation and private-error handling.
 
+Direct reference issuers now require `authorizationResultCipher` before
+`beginAuthorization`; same-decision `completeAuthorization` recovers the encrypted
+callback through its original validity window. See [AUTH.md](AUTH.md) for custody,
+revocation and one-time exchange limits. No package subpath or driver contract changed.
+
 Run the [quickstart](examples/quickstart.mjs) without a listener or external service.
 
 The optional Postgres entry point ships its adapters, `createPostgresPool`,

package/AUTH.md

@@ -12,6 +12,43 @@ The host authenticates the human and protects consent with its own browser
 session/CSRF controls; pass a high-entropy browser binding. Registered callback
 URLs must be HTTPS on the client metadata domain and exactly match registration.
 
+Direct hosts must configure `authorizationResultCipher: { seal, open }` with
+synchronous authenticated encryption and a durable protected key before calling
+`beginAuthorization`. Hosts already using the optional client provider can reuse
+its `createResultCipher` instance. Other hosts supply the same structural contract;
+no client package or database driver is loaded by the reference issuer.
+
+`completeAuthorization(id, browserBinding, decision)` commits one decision and
+an encrypted callback receipt atomically. Repeating the same decision returns
+the same URL after restart; changed browser/account/scopes/decision and stale
+account revocation/reset fail. Approval recovery expires at the earlier of the
+original authorization deadline and code expiry; denial uses the original deadline.
+Recovery never mints a replacement code or extends consent. The host must retain
+its authenticated owner/installation/session binding and chosen decision durably,
+then reconcile delivery outside transactions. Never retry an uncertain code exchange.
+
+`withCurrent` checks token, Session and grant expiry immediately before protected
+actions, including after body reads and long-poll waits. Streams close at token
+expiry and recheck current authority for each emitted frame; reconnect with fresh
+authentication. `withAccepted` intentionally ignores admission-token expiry while
+preserving the accepted scope ceiling, reset generation and configured revocation policy.
+
+Account Token rotation retains all issued hashes through the fixed grant lifetime.
+Replaying any ancestor revokes its entire lineage and signs its Sessions out;
+rotation never extends the grant. Client authentication remains mandatory, while
+Session Tokens can move to a new DPoP key as the protocol permits. Shared provider
+signing does not bind a copied refresh token to one provider enrollment. Keep
+tokens secret and serialize rotation; never retry a lost token response blindly.
+Bounded database cleanup removes hashes only after their lineage is expired,
+revoked or absent. No plaintext callback code is persisted.
+
+Upgrade prerequisite: older issuers discarded ancestors beyond the previous hash.
+Those missing hashes cannot be reconstructed by this update. Before public
+enablement, revoke every pre-upgrade live lineage through the issuer's normal
+revocation/disconnect flow and require fresh consent, or prove it has expired.
+Until then, the full-ancestor guarantee applies only to newly created lineages.
+This update does not reset stored data or silently revoke legacy grants.
+
 Enable reference Device sign-in with `device: { endpoint, verificationUri,
 scopes }`. Route the configured device endpoint to `deviceAuthorization`.
 On the human page call `beginDeviceAuthorization(userCode, browserBinding)` and

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.3.0
+
+Require Node 24 >=24.22.1 within 24.x. Enforce current-token expiry after waits and
+at streamed delivery while preserving already-accepted work's authority ceiling.
+Deduplicate reserved string output IDs and retain refresh-token ancestors through
+fixed grant expiry so replay revokes descendants. Direct Sign-In hosts must supply
+the documented durable `authorizationResultCipher`; identical decisions recover
+their original encrypted callback. Before public enablement, revoke pre-upgrade
+live grant lineages and obtain fresh consent, or prove their fixed expiry.
+Required release verification now includes isolated PostgreSQL contracts.
+
 ## 0.2.0 (release candidate)
 
 Add bundled Postgres company stores/coordinator with explicit migrations, atomic host transaction composition, savepoints and pool lifecycle.

package/CONTRIBUTING.md

@@ -5,8 +5,8 @@ and [guides](https://personalagentprotocol.org/docs/0.2/guides). Tests/snapshots
 supporting evidence. Demo/business workflows and individual extensions are excluded.
 Code is [MIT](LICENSE); confirm rights for third-party contributions.
 
-Use Node 24.12.0, TypeScript 5.9.3 and @types/node 24.10.0.
-Install the packageManager-pinned pnpm and run pnpm install --frozen-lockfile.
+Use Node 24.22.1, TypeScript 5.9.3 and @types/node 24.10.0.
+Install the packageManager-pinned pnpm and run pnpm install --frozen-lockfile --ignore-scripts.
 
 ```sh
 npm run typecheck
@@ -36,3 +36,11 @@ Preserve credential/destination validation, private errors and persisted data.
 Report checks actually run and limits. Use Issues for non-sensitive defects and
 [SECURITY.md](SECURITY.md) for vulnerabilities. Follow [RELEASING.md](RELEASING.md)
 before tagging/publishing; obtain explicit owner authorization.
+
+Required CI also runs scripts/postgres-ci.mjs in a dedicated disposable PostgreSQL17
+cluster with POPPY_DISPOSABLE_POSTGRES=1, D1_LOCAL=1 and explicit loopback PGHOST,
+PGPORT, PGUSER, PGPASSWORD, PGDATABASE. Build production/tests first; use a fresh
+database without SDK schemas. Never point it at shared/cloud data. It migrates
+only this package's schemas, runs all named durable suites, rejects skips/missing
+discovery and leaves cluster destruction to its owner. Default source-suite skips
+do not replace this gate. See the workflow for the pinned image and setup.

package/DELIVERY.md

@@ -53,8 +53,9 @@ SQLite reconciliation; deployments can implement the same notification contract
 with their own distributed adapter. Lost/duplicate hints cannot erase a commit.
 SQLite event windows and append operations do not reload complete event histories.
 
-Server streams default to 30 seconds and apply pull backpressure, rechecking
-current authority before further pages. This bounded-connection policy omits
+Server streams default to 30 seconds, end earlier at token expiry and apply pull
+backpressure, rechecking current authority before every emitted frame. Reconnect
+with a fresh credential and the last handled event ID. This bounded-connection policy omits
 periodic idle comments; proxies may close an idle stream sooner, and the client
 reconnects. Longer-lived deployments should supply heartbeat handling at their
 HTTP adapter. Hosts must propagate disconnect/AbortSignal and body cancellation.

package/README.md

@@ -6,14 +6,14 @@ supplies accounts, consent UI, agent, business tools and HTTPS routing. [MIT](LI
 
 ## Install
 
-Version 0.2.0 is a release candidate until its publishing workflow completes.
+This source contains unreleased repairs; final version selection and publication are pending.
 
-Requires Node **24.12.0+** and ESM. CI tests Node 24.12.0 on Linux, macOS and Windows;
-later majors are not separately certified. SQLite is optional/experimental and
+Requires Node **24.x, at least 24.22.1**, and ESM. CI tests Node 24.22.1 on Linux, macOS and Windows;
+other Node majors are unsupported. SQLite is optional/experimental and
 requires local filesystem locking.
 
 ```sh
-npm install @poppykit/server@0.2.0
+npm install @poppykit/server
 ```
 
 ## Configure a service

package/RELEASING.md

@@ -6,7 +6,7 @@ changing runtime APIs. Each new version needs its own source/artifact evidence.
 
 ## Before tagging
 
-- Confirm npm ownership, unused versions, supported Node 24.12.0 and npm>=11.5.1.
+- Confirm npm ownership, unused versions, supported Node 24.x (at least 24.22.1) and npm>=11.5.1.
   Keep the pinned compiler/dependencies; do not upgrade tooling during a release.
 - Update version, changelog and shipped docs. CLI's client dependency and both
   candidate JSON files must match exact final SDK versions/full source SHAs.
@@ -47,7 +47,7 @@ guard requires its tested client tarball integrity to equal the published one.
    ```
 
 4. Wait for candidate, fast, contracts, integration, packaged-linux/windows/macos,
-   validation and gate to succeed. Missing, failed, canceled or skipped prerequisites
+   validation, postgres and gate to succeed. The postgres job uses its own disposable PostgreSQL17 cluster and the same-run checked candidate/harness; zero discovery or any skipped database case fails. Missing, failed, canceled or skipped prerequisites
    fail closed. Then follow the Actions environment-approval link. Do not bypass it.
 5. The publisher rechecks source/tag/ref/version, trusted manifest digest, unchanged
    tarball metadata/bytes, owner enablement, registry absence and dependency integrity.

package/STORAGE.md

@@ -1,10 +1,10 @@
 # Company persistence and authorization
 
-Request paths use targeted domain selections, not whole-state rewrites. Node 24.12.0 or later is required.
+Request paths use targeted domain selections, not whole-state rewrites. Node 24.x, at least 24.22.1, is required.
 The optional `@poppykit/server/sqlite` entry point exports `SqliteCompanyDatabase`.
 The core and reference issuer entry points do not import SQLite. Consumers can
 implement `ConversationStore`, `IssuerStore` and `AuthorityCoordinator` themselves.
-The tested Node 24.12.0 runtime marks `node:sqlite` experimental.
+The tested Node 24.22.1 runtime marks `node:sqlite` experimental.
 
 ```ts
 import { SqliteCompanyDatabase } from '@poppykit/server/sqlite';
@@ -35,7 +35,7 @@ with correct SQLite locks; network-mounted multi-host SQLite is unsupported.
 ## Domain records and guarantees
 
 Every primary key includes a namespace (use the exact full issuer). Sessions,
-grants, current/previous token hashes, authorization requests, codes, access-token
+grants, every live-lineage Account Token hash, authorization requests, codes, access-token
 hashes, replay keys, conversation metadata, shared account bindings, message
 receipts and work intent are separate records. Ordered events are a separate table
 keyed by namespace/conversation/sequence. Indexes cover client, account, grant,
@@ -71,7 +71,9 @@ its own idempotency key (such as the stable work ID), or the application must re
 an uncertain result for reconciliation. Never claim universal exactly-once execution.
 
 `cleanup(namespace, now, limit)` bounds deletion to at most 1000 expired short-lived
-codes, authorizations, access tokens or replay entries. It does not delete grants,
+codes, authorizations, access tokens, replay entries or expired/revoked/orphaned
+Account Token hashes. Every used hash for a live lineage remains replay-detectable
+through its fixed expiry; retained size follows rotation volume. It does not delete grants,
 work intent, message receipts or conversation events. Receipt identity remains
 through retention for the conversation lifetime. Finished work pruning is
 per selected conversation binding group; unrelated conversation growth cannot
@@ -116,7 +118,7 @@ reset or history deletion was added.
 `@poppykit/server/postgres` ships `PostgresCompanyDatabase`, explicit migrations,
 and `createPostgresPool` in this package. Install optional peer `pg@8.23.1` when
 using that subpath. Core/reference-auth imports load neither database driver.
-Supported baseline: Node 24.12+, PostgreSQL 17, including Supabase transaction pooling.
+Supported baseline: Node 24.x (at least 24.22.1), PostgreSQL 17, including Supabase transaction pooling.
 No application, Google login or Supabase Auth dependency is required.
 
 ```ts

package/dist/adapter-contract.js

@@ -50,7 +50,7 @@ function serviceOn(store, clock) {
             return principal;
         },
     };
-    return createConversationService({ endpoint, store, authenticator, policy, clock, leaseMs: 1000 });
+    return createConversationService({ endpoint, store, authenticator, policy, clock, leaseMs: 1000, supportedScopes: ['poppy:read'] });
 }
 async function call(service, path, as, body, query = '') {
     const response = await service.handle(new Request(`${endpoint}${path}${query}`, {
@@ -145,6 +145,33 @@ export function runConversationAdapterContract(fixture) {
         const events = (await call(b, `/${id}/events`, 'signedOut')).body.events;
         assert.equal(events.filter(event => event.message?.id === reply.id).length, 1);
     }));
+    test('adapter contract: reserved output IDs persist atomic reply and prompt receipts across handles', () => withFixture(async ({ store, second }) => {
+        const a = serviceOn(store, clock);
+        const id = (await call(a, '', 'signedOut', { message })).body.conversation_id;
+        const work = (await a.claim());
+        for (const outputId of ['__proto__', 'constructor', 'ordinary']) {
+            const b = serviceOn(second, clock);
+            const value = { ...reply, id: `reply_${outputId}` };
+            await a.reply(work, outputId, value);
+            await b.reply(work, outputId, value);
+            await assert.rejects(b.reply(work, outputId, { ...value, text: 'changed' }), { code: 'output_conflict' });
+            await a.requestAuthorization(work, `auth_${outputId}`, ['poppy:read']);
+            await b.requestAuthorization(work, `auth_${outputId}`, ['poppy:read']);
+            await a.requestUser(work, `user_${outputId}`, outputId);
+            await b.requestUser(work, `user_${outputId}`, outputId);
+            await assert.rejects(b.requestUser(work, `user_${outputId}`, 'changed'), { code: 'output_conflict' });
+            const persisted = await second.inspect();
+            const receipt = persisted.work.find(row => row.id === work.workId);
+            assert.ok(Object.hasOwn(receipt.outputs, outputId));
+        }
+        const events = (await call(serviceOn(second, clock), `/${id}/events`, 'signedOut')).body.events;
+        assert.equal(events.filter(event => event.message?.role === 'company').length, 3);
+        assert.equal(events.filter(event => event.type === 'authorization').length, 3);
+        assert.equal(events.filter(event => event.type === 'user_requested').length, 3);
+        clock.t += 1000;
+        await serviceOn(second, clock).claim();
+        await assert.rejects(a.reply(work, '__proto__', reply), { code: 'stale_work' });
+    }));
     test('adapter contract: a waited POST committed before a crash is recovered unchanged on the other handle', () => withFixture(async ({ store, second }) => {
         const crashing = serviceOn({ read: () => store.inspect(), transaction: (_selection, change) => store.adminTransaction(change).then(() => { throw new Error('crash after commit'); }) }, clock);
         await assert.rejects(call(crashing, '', 'signedOut', { message }, '?wait=10'), { message: 'crash after commit' });

package/dist/conversation/service.js

@@ -391,7 +391,7 @@ export function createConversationService(options) {
             if (!streaming) {
                 const deadline = Date.now() + read.waitSeconds * 1000, logicalDeadline = clock.now() + read.waitSeconds * 1000;
                 while (!first.events.length && Date.now() < deadline && clock.now() < logicalDeadline && !signal.aborted) {
-                    await wait(Math.min(pollIntervalMs, deadline - Date.now(), logicalDeadline - clock.now()), seen);
+                    await wait(Math.min(pollIntervalMs, deadline - Date.now(), logicalDeadline - clock.now(), principal.tokenExpiresAt - clock.now()), seen);
                     seen = revision;
                     if (signal.aborted)
                         throw signal.reason;
@@ -401,12 +401,18 @@ export function createConversationService(options) {
                 cleanup();
                 return json(200, first);
             }
-            lifetime = setTimeout(cleanup, streamMs);
-            const encoder = new TextEncoder(), deadline = Date.now() + streamMs;
+            const duration = Math.max(0, Math.min(streamMs, principal.tokenExpiresAt - clock.now()));
+            lifetime = setTimeout(cleanup, duration);
+            const encoder = new TextEncoder(), deadline = Date.now() + duration;
             let pending = first, index = 0, bytes = 0, cancelled = false;
             const stream = new ReadableStream({
                 async pull(target) {
                     try {
+                        if (clock.now() >= principal.tokenExpiresAt) {
+                            cleanup();
+                            target.close();
+                            return;
+                        }
                         signal.throwIfAborted();
                         while (index >= pending.events.length) {
                             if (Date.now() >= deadline || pending.status === 'closed' && !pending.has_more) {
@@ -421,6 +427,7 @@ export function createConversationService(options) {
                             pending = await deliver();
                             index = 0;
                         }
+                        await policy.withCurrent(principal, [], async () => { });
                         const event = pending.events[index++];
                         const frame = encoder.encode('id: ' + event.id + '\ndata: ' + JSON.stringify(event) + '\n\n');
                         bytes += frame.byteLength;
@@ -433,7 +440,7 @@ export function createConversationService(options) {
                         target.enqueue(frame);
                     }
                     catch (error) {
-                        const expired = stop.signal.aborted && !request.signal.aborted;
+                        const expired = (stop.signal.aborted || clock.now() >= principal.tokenExpiresAt) && !request.signal.aborted;
                         cleanup();
                         if (cancelled)
                             return;
@@ -570,7 +577,7 @@ export function createConversationService(options) {
     function firstOutput(work, outputId, payload) {
         const previous = own(work.outputs, outputId);
         if (previous === undefined) {
-            work.outputs[outputId] = payload;
+            work.outputs = { ...work.outputs, [outputId]: payload };
             return true;
         }
         if (previous !== payload)

package/dist/postgres.js

@@ -240,8 +240,8 @@ export class PostgresCompanyDatabase {
             }
             if (selection.kind === 'authorize') {
                 await get('signIns', clientRevisionKey(selection.clientId));
-                const pending = (await this.sqlGet("SELECT count(*) AS n FROM poppy_server.records WHERE ns=$1 AND kind='authorizations' AND ((body::jsonb#>>'{expiresAt}')::double precision)>$2", [namespace, selection.at]));
-                const client = (await this.sqlGet("SELECT count(*) AS n FROM poppy_server.records WHERE ns=$1 AND kind='authorizations' AND (body::jsonb#>>'{clientId}')=$2 AND ((body::jsonb#>>'{expiresAt}')::double precision)>$3", [namespace, selection.clientId, selection.at]));
+                const pending = (await this.sqlGet("SELECT count(*) AS n FROM poppy_server.records WHERE ns=$1 AND kind='authorizations' AND body::jsonb->'completion' IS NULL AND ((body::jsonb#>>'{expiresAt}')::double precision)>$2", [namespace, selection.at]));
+                const client = (await this.sqlGet("SELECT count(*) AS n FROM poppy_server.records WHERE ns=$1 AND kind='authorizations' AND body::jsonb->'completion' IS NULL AND (body::jsonb#>>'{clientId}')=$2 AND ((body::jsonb#>>'{expiresAt}')::double precision)>$3", [namespace, selection.clientId, selection.at]));
                 state.limits = { sessions: 0, earliestSessionExpiry: 0, pending: Number(pending.n), pendingForClient: Number(client.n) };
             }
             if (selection.kind === 'disconnect') {
@@ -293,8 +293,9 @@ export class PostgresCompanyDatabase {
             throw new TypeError('cleanup limit');
         return this.run(async () => {
             await this.db.lock(JSON.stringify([namespace, 'issuer']));
-            const rows = await this.sqlAll(`SELECT kind,id FROM poppy_server.records WHERE ns=$1 AND
-        ((kind IN ('authorizations','codes','accessTokens') AND ((body::jsonb#>>'{expiresAt}')::double precision)<=$2) OR (kind='signIns' AND ((body::jsonb#>>'{expiresAt}')::double precision)+30000<$3) OR (kind='replay' AND (body::jsonb#>>'{}')::double precision<$4)) LIMIT $5`, [namespace, now, now, now, limit]);
+            const rows = await this.sqlAll(`SELECT kind,id FROM poppy_server.records AS retained WHERE ns=$1 AND
+        ((kind IN ('authorizations','codes','accessTokens') AND ((body::jsonb#>>'{expiresAt}')::double precision)<=$2) OR (kind='signIns' AND ((body::jsonb#>>'{expiresAt}')::double precision)+30000<$3) OR (kind='replay' AND (body::jsonb#>>'{}')::double precision<$4)
+        OR (kind='refreshTokens' AND NOT EXISTS (SELECT 1 FROM poppy_server.records AS lineage WHERE lineage.ns=retained.ns AND lineage.kind='grants' AND lineage.id=retained.body::jsonb#>>'{}' AND (lineage.body::jsonb->>'expiresAt')::double precision>$5 AND lineage.body::jsonb->>'revoked'='false'))) LIMIT $6`, [namespace, now, now, now, now, limit]);
             for (const row of rows)
                 await this.sqlRun("DELETE FROM poppy_server.records WHERE ns=$1 AND kind=$2 AND id=$3", [namespace, row.kind, row.id]);
             return rows.length;

package/dist/reference-auth/index.d.ts

@@ -41,6 +41,10 @@ interface AuthorizationRecord {
     browserHash: string;
     expiresAt: number;
     revision: number;
+    completion?: {
+        decisionHash: string;
+        callback: string;
+    };
 }
 interface CodeRecord {
     clientId: string;
@@ -156,6 +160,11 @@ export interface ReferenceIssuerOptions {
         dpop: boolean;
     }[];
     metadata: MetadataResolver;
+    /** Required for Direct Sign-In: synchronous authenticated encryption with a durable host-owned key. */
+    authorizationResultCipher?: {
+        seal(value: string): string;
+        open(value: string): string;
+    };
     store: IssuerStore;
     coordinator: AuthorityCoordinator;
     now: () => number;

package/dist/reference-auth/index.js

@@ -661,8 +661,7 @@ export function createReferenceIssuer(options) {
                 if (!scopes.every(item => lineage.scopes.includes(item)))
                     throw new TokenError('invalid_scope');
                 const successor = random(32);
-                // Older hashes are forgotten: the previous one is enough to revoke after a lost rotation response.
-                delete draft.refreshTokens[lineage.previousHash];
+                // Retain ancestors until the fixed grant expiry so every replay can revoke its descendants.
                 lineage.previousHash = lineage.refreshHash;
                 lineage.refreshHash = tokenHash(successor);
                 draft.refreshTokens[lineage.refreshHash] = grantId;
@@ -702,9 +701,9 @@ export function createReferenceIssuer(options) {
             const presented = tokenHash(refreshToken);
             const grantId = own(draft.refreshTokens, presented);
             const lineage = grantId === undefined ? undefined : own(draft.grants, grantId);
-            // Reuse of the previous Account Token (e.g. a retry after a lost response) revokes the lineage, so its Sessions
+            // Reuse of any ancestor Account Token (e.g. a retry after a lost response) revokes the lineage, so its Sessions
             // continue signed out instead of staying bound to a successor nobody holds (RFC 9700 4.14.2).
-            if (lineage && lineage.clientId === clientId && presented === lineage.previousHash) {
+            if (lineage && lineage.clientId === clientId && presented !== lineage.refreshHash) {
                 revokeGrant(draft, grantId);
                 return null;
             }
@@ -777,7 +776,7 @@ export function createReferenceIssuer(options) {
             const state = await read({ kind: 'principal', sessionId: principal.sessionId, ...(principal.grantId ? { grantId: principal.grantId } : {}) });
             const session = own(state.sessions, principal.sessionId);
             if (principal.issuer !== issuer || principal.issuerGeneration !== state.generation || !session || session.clientId !== principal.clientId
-                || session.expiresAt <= now() || session.userId !== principal.userId || !liveGrant(state, principal))
+                || principal.tokenExpiresAt <= now() || session.expiresAt <= now() || session.userId !== principal.userId || !liveGrant(state, principal))
                 throw new AuthorityError('invalid_token');
             requireScopes(principal.scopes, scopes);
             return action();
@@ -858,6 +857,8 @@ export function createReferenceIssuer(options) {
         // Validates the whole request before persisting anything; the host renders login and consent from the view.
         // Unauthenticated: hosts must rate-limit their /authorize route; the pending cap only bounds state and coordinator time.
         async beginAuthorization(request, browserBinding) {
+            if (!options.authorizationResultCipher)
+                throw new TypeError('authorizationResultCipher is required for Direct Sign-In');
             if (typeof browserBinding !== 'string' || !browserBinding)
                 throw new TypeError('browserBinding');
             const params = uniqueParams(new URL(request.url).searchParams, () => new AuthorizationError('invalid_request'));
@@ -905,7 +906,7 @@ export function createReferenceIssuer(options) {
                 const at = now();
                 prune(draft, at);
                 // shortcut: an unauthenticated caller can fill one client's slots for AUTHORIZATION_MS (10 minutes); hosts must rate-limit /authorize.
-                const pending = Object.values(draft.authorizations);
+                const pending = Object.values(draft.authorizations).filter(record => !record.completion);
                 if ((draft.limits?.pending ?? pending.length) >= maxPending || (draft.limits?.pendingForClient ?? pending.filter(record => record.clientId === clientId).length) >= maxPendingPerClient)
                     throw fail('temporarily_unavailable');
                 const id = random(16);
@@ -914,8 +915,11 @@ export function createReferenceIssuer(options) {
                 return { id, clientId, clientName: client.client_name, scopes, expiresAt };
             });
         },
-        // Consumes the authorization once; the browser binding is checked before deny as well as approve.
+        // Commit once; a bound identical decision can recover the encrypted callback without minting another code.
         async completeAuthorization(id, browserBinding, decision) {
+            const cipher = options.authorizationResultCipher;
+            if (!cipher)
+                throw new TypeError('authorizationResultCipher is required for Direct Sign-In');
             if (typeof id !== 'string' || typeof browserBinding !== 'string')
                 throw new AuthorizationError('invalid_request');
             const snapshot = own((await read({ kind: 'authorization', id })).authorizations, id);
@@ -924,21 +928,32 @@ export function createReferenceIssuer(options) {
                 const record = own(draft.authorizations, id);
                 if (!record || record.expiresAt <= now() || record.browserHash !== tokenHash(browserBinding))
                     throw new AuthorizationError('invalid_request');
-                const fields = { state: record.state, iss: issuer };
-                if ('denied' in decision && decision.denied === true) {
-                    delete draft.authorizations[id];
-                    return callback(record.redirectUri, { error: 'access_denied', ...fields });
-                }
+                const denied = 'denied' in decision && decision.denied === true;
                 const { accountId, scopes } = decision;
                 // Partial consent narrows; the host may never grant more than was requested.
-                if (typeof accountId !== 'string' || !accountId || !Array.isArray(scopes) || !scopes.length || !scopes.every(scope => record.scopes.includes(scope)))
+                if (!denied && (typeof accountId !== 'string' || !accountId || !Array.isArray(scopes) || !scopes.length || !scopes.every(scope => record.scopes.includes(scope))))
                     throw new TypeError('decision');
-                if (!consentCurrent(draft, record.clientId, accountId, record.revision))
+                if (!denied && !consentCurrent(draft, record.clientId, accountId, record.revision))
                     throw new AuthorizationError('invalid_request');
-                delete draft.authorizations[id];
+                const granted = denied ? [] : [...new Set(scopes)].sort();
+                const decisionHash = tokenHash(JSON.stringify(denied ? { denied: true } : { accountId, scopes: granted }));
+                if (record.completion) {
+                    if (record.completion.decisionHash !== decisionHash)
+                        throw new AuthorizationError('invalid_request');
+                    return cipher.open(record.completion.callback);
+                }
+                const fields = { state: record.state, iss: issuer };
+                if (denied) {
+                    const href = callback(record.redirectUri, { error: 'access_denied', ...fields });
+                    record.completion = { decisionHash, callback: cipher.seal(href) };
+                    return href;
+                }
                 const code = random(32);
-                draft.codes[tokenHash(code)] = { clientId: record.clientId, redirectUri: record.redirectUri, codeChallenge: record.codeChallenge, accountId, scopes: [...new Set(scopes)], expiresAt: now() + CODE_MS, grantId: null, revision: record.revision };
-                return callback(record.redirectUri, { code, ...fields });
+                record.expiresAt = Math.min(record.expiresAt, now() + CODE_MS);
+                draft.codes[tokenHash(code)] = { clientId: record.clientId, redirectUri: record.redirectUri, codeChallenge: record.codeChallenge, accountId: accountId, scopes: granted, expiresAt: record.expiresAt, grantId: null, revision: record.revision };
+                const href = callback(record.redirectUri, { code, ...fields });
+                record.completion = { decisionHash, callback: cipher.seal(href) };
+                return href;
             });
             return new URL(href);
         },

package/dist/sqlite.js

@@ -307,8 +307,8 @@ export class SqliteCompanyDatabase {
             }
             if (selection.kind === 'authorize') {
                 get('signIns', clientRevisionKey(selection.clientId));
-                const pending = this.db.prepare("SELECT count(*) AS n FROM records WHERE ns=? AND kind='authorizations' AND json_extract(body,'$.expiresAt')>?").get(namespace, selection.at);
-                const client = this.db.prepare("SELECT count(*) AS n FROM records WHERE ns=? AND kind='authorizations' AND json_extract(body,'$.clientId')=? AND json_extract(body,'$.expiresAt')>?").get(namespace, selection.clientId, selection.at);
+                const pending = this.db.prepare("SELECT count(*) AS n FROM records WHERE ns=? AND kind='authorizations' AND json_extract(body,'$.completion') IS NULL AND json_extract(body,'$.expiresAt')>?").get(namespace, selection.at);
+                const client = this.db.prepare("SELECT count(*) AS n FROM records WHERE ns=? AND kind='authorizations' AND json_extract(body,'$.completion') IS NULL AND json_extract(body,'$.clientId')=? AND json_extract(body,'$.expiresAt')>?").get(namespace, selection.clientId, selection.at);
                 state.limits = { sessions: 0, earliestSessionExpiry: 0, pending: Number(pending.n), pendingForClient: Number(client.n) };
             }
             if (selection.kind === 'disconnect') {
@@ -359,8 +359,9 @@ export class SqliteCompanyDatabase {
         if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
             throw new TypeError('cleanup limit');
         return this.run(async () => {
-            const rows = this.db.prepare(`SELECT kind,id FROM records WHERE ns=? AND
-        ((kind IN ('authorizations','codes','accessTokens') AND json_extract(body,'$.expiresAt')<=?) OR (kind='signIns' AND json_extract(body,'$.expiresAt')+30000<?) OR (kind='replay' AND CAST(body AS REAL)<?)) LIMIT ?`).all(namespace, now, now, now, limit);
+            const rows = this.db.prepare(`SELECT kind,id FROM records AS retained WHERE ns=? AND
+        ((kind IN ('authorizations','codes','accessTokens') AND json_extract(body,'$.expiresAt')<=?) OR (kind='signIns' AND json_extract(body,'$.expiresAt')+30000<?) OR (kind='replay' AND CAST(body AS REAL)<?)
+        OR (kind='refreshTokens' AND NOT EXISTS (SELECT 1 FROM records AS lineage WHERE lineage.ns=retained.ns AND lineage.kind='grants' AND lineage.id=json_extract(retained.body,'$') AND json_extract(lineage.body,'$.expiresAt')>? AND json_extract(lineage.body,'$.revoked')=0))) LIMIT ?`).all(namespace, now, now, now, now, limit);
             for (const row of rows)
                 this.db.prepare('DELETE FROM records WHERE ns=? AND kind=? AND id=?').run(namespace, row.kind, row.id);
             return rows.length;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poppykit/server",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": false,
   "description": "Personal Agent Protocol company SDK",
   "repository": {
@@ -9,7 +9,7 @@
   },
   "type": "module",
   "engines": {
-    "node": ">=24.12.0"
+    "node": ">=24.22.1 <25"
   },
   "packageManager": "pnpm@11.25.0",
   "scripts": {