Fixes for remaining issues

core/auth/scopes.ts

@@ -41,3 +41,35 @@ export function isStrictScopeSuperset(
   }
   return false;
 }
+
+/**
+ * Scope to persist after a successful token grant (RFC 6749 §5.1).
+ * When the AS returns `scope`, it is the authoritative full grant.
+ * When `scope` is omitted on success, granted equals what was requested.
+ */
+export function resolvePersistedScopeAfterGrant(
+  grantedScope: string | undefined,
+  requestedScope: string | undefined,
+): string | undefined {
+  const granted = grantedScope?.trim();
+  if (granted) {
+    return granted;
+  }
+  const requested = requestedScope?.trim();
+  return requested || undefined;
+}
+
+/**
+ * Scope coverage for satisfaction checks: prefer the token's explicit grant;
+ * when omitted, fall back to stored scope (RFC implied grant on prior success).
+ */
+export function resolveEffectiveGrantedScope(
+  storedScope: string | undefined,
+  tokenScope: string | undefined,
+): string | undefined {
+  const granted = tokenScope?.trim();
+  if (granted) {
+    return granted;
+  }
+  return computeScopeUnion(storedScope, tokenScope);
+}