@adcp/sdk 14.0.0-rc.39 → 14.0.0-rc.40

package/dist/lib/supply-path/fetch-evidence.js

@@ -0,0 +1,293 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var fetch_evidence_exports = {};
+__export(fetch_evidence_exports, {
+  SupplyPathEvidenceSession: () => SupplyPathEvidenceSession,
+  boundedOption: () => boundedOption
+});
+module.exports = __toCommonJS(fetch_evidence_exports);
+var import_revocations = require('./revocations.js');
+var import_abort = require('../protocols/abort.js');
+var import_node_crypto = require("node:crypto");
+var import_secure_json_parse = require("secure-json-parse");
+var import_ssrf_fetch = require('../net/ssrf-fetch.js');
+var import_adagents_redirects = require('../discovery/adagents-redirects.js');
+var import_revocations2 = require('./revocations.js');
+var import_validation = require('./validation.js');
+function boundedOption(value, fallback, maximum, name) {
+  if (value === void 0) return fallback;
+  if (!Number.isSafeInteger(value) || value <= 0 || value > maximum)
+    throw new TypeError(`${name} must be an integer between 1 and ${maximum}`);
+  return value;
+}
+class SupplyPathEvidenceSession {
+  constructor(options) {
+    this.options = options;
+    this.timeoutMs = boundedOption(options.timeoutMs, 15e3, 6e4, "timeoutMs");
+    this.deadlineAt = Date.now() + this.timeoutMs;
+    this.maxBodyBytes = boundedOption(options.maxBodyBytes, 256 * 1024, 20 * 1024 * 1024, "maxBodyBytes");
+    this.signal = this.controller.signal;
+    this.abort = () => this.controller.abort(options.signal?.reason);
+    options.signal?.addEventListener("abort", this.abort, { once: true });
+    if (options.signal?.aborted) this.abort();
+    this.timer = setTimeout(
+      () => this.controller.abort(new Error("Supply-path verification deadline exceeded")),
+      this.timeoutMs
+    );
+  }
+  options;
+  evidence = [];
+  crossOriginAuthorities = /* @__PURE__ */ new Set();
+  observedRevocations = /* @__PURE__ */ new Map();
+  revocations = /* @__PURE__ */ new Map();
+  signal;
+  maxBodyBytes;
+  timeoutMs;
+  deadlineAt;
+  timer;
+  controller = new AbortController();
+  abort;
+  responses = /* @__PURE__ */ new Map();
+  provenance = /* @__PURE__ */ new WeakMap();
+  observedBytes = 0;
+  documents = /* @__PURE__ */ new Map();
+  close() {
+    clearTimeout(this.timer);
+    this.controller.abort(new Error("Supply-path evidence session closed"));
+    this.options.signal?.removeEventListener("abort", this.abort);
+  }
+  /** Enforce the absolute deadline even while synchronous evidence evaluation blocks timer delivery. */
+  assertActive() {
+    this.signal.throwIfAborted();
+    if (Date.now() >= this.deadlineAt) {
+      this.controller.abort(new Error("Supply-path verification deadline exceeded"));
+      this.signal.throwIfAborted();
+    }
+  }
+  adagents(publisher) {
+    let pending = this.documents.get(publisher);
+    if (!pending) {
+      pending = this.readAndRemember(publisher);
+      this.documents.set(publisher, pending);
+    }
+    return pending;
+  }
+  read(publisher, kind, url, pointer = false) {
+    const key = JSON.stringify([publisher, kind, url, pointer]);
+    let pending = this.responses.get(key);
+    if (!pending) {
+      pending = this.fetchEvidence(publisher, kind, url, pointer);
+      this.responses.set(key, pending);
+    }
+    return pending;
+  }
+  async fetchEvidence(publisher, kind, url, pointer = false) {
+    this.assertActive();
+    try {
+      if (this.observedBytes >= 64 * 1024 * 1024) throw new Error("evidence_budget_exceeded");
+      const parsed = new URL(url);
+      if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash || parsed.port && parsed.port !== "443") {
+        throw new Error("invalid_evidence_url");
+      }
+      const response = await (0, import_adagents_redirects.ssrfSafeFetchAdAgents)(
+        url,
+        {
+          timeoutMs: this.timeoutMs,
+          maxBodyBytes: this.maxBodyBytes,
+          signal: this.signal,
+          trustedFetchFn: this.options.trustedFetchFn,
+          headers: { Accept: kind === "adagents" ? "application/json" : "text/plain", "Cache-Control": "no-cache" }
+        },
+        pointer ? { mode: "none" } : { mode: "same-origin", originUrl: url, maxRedirects: 3 },
+        (result) => {
+          this.observedBytes += result.body.byteLength;
+          const evidence = {
+            kind,
+            publisher_domain: publisher,
+            requested_url: url,
+            resolved_url: result.url,
+            fetched_at: (/* @__PURE__ */ new Date()).toISOString(),
+            status: result.status,
+            byte_length: result.body.byteLength,
+            sha256: (0, import_node_crypto.createHash)("sha256").update(result.body).digest("hex"),
+            connection_pinned: result.connectionPinned,
+            ...result.status >= 300 && result.status < 400 && result.headers.location ? { delegated_to: result.headers.location } : {},
+            ...this.options.retainEvidenceBodies ? { body_base64: Buffer.from(result.body).toString("base64") } : {}
+          };
+          this.evidence.push(evidence);
+          this.provenance.set(result, evidence);
+          if (this.observedBytes > 64 * 1024 * 1024) throw new Error("evidence_budget_exceeded");
+        }
+      );
+      if (response.status === 404 && kind !== "adagents") return { ...response, body: new Uint8Array() };
+      if (response.status !== 200) return null;
+      const contentType = response.headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
+      const validType = kind === "adagents" ? contentType === "application/json" || contentType?.endsWith("+json") : contentType === "text/plain";
+      if (!validType) throw new Error("invalid_content_type");
+      return response;
+    } catch (error) {
+      this.signal.throwIfAborted();
+      const rawCauseCode = (0, import_validation.record)(error) && typeof error.code === "string" ? error.code.toUpperCase() : void 0;
+      const causeCode = rawCauseCode && /^(?:E[A-Z0-9_]{2,40}|CERT_[A-Z0-9_]{2,40})$/.test(rawCauseCode) ? rawCauseCode : void 0;
+      const code = error instanceof import_ssrf_fetch.SsrfRefusedError || error instanceof import_adagents_redirects.AdAgentsRedirectRefusedError ? error.code : error instanceof Error && ["invalid_evidence_url", "invalid_content_type", "evidence_budget_exceeded"].includes(error.message) ? error.message : "fetch_failed";
+      this.evidence.push({
+        kind,
+        publisher_domain: publisher,
+        requested_url: url,
+        fetched_at: (/* @__PURE__ */ new Date()).toISOString(),
+        error: code,
+        ...causeCode ? { cause_code: causeCode } : {}
+      });
+      if (error instanceof import_ssrf_fetch.SsrfRefusedError && !import_ssrf_fetch.SSRF_TRANSIENT_CODES.has(error.code)) throw error;
+      return null;
+    }
+  }
+  async parseManifest(publisher, response) {
+    this.assertActive();
+    let document;
+    try {
+      document = (0, import_secure_json_parse.parse)(new TextDecoder("utf-8", { fatal: true }).decode(response.body));
+      if (!(0, import_validation.record)(document)) throw new Error("not_object");
+    } catch {
+      this.documentError(publisher, response, "invalid_document");
+      return null;
+    }
+    this.assertActive();
+    const denials = (0, import_revocations2.parseRevocations)(document.revoked_publisher_domains);
+    if (denials === null) {
+      this.documentError(publisher, response, "invalid_revocations");
+      throw new TypeError(
+        `Invalid revoked_publisher_domains in adagents.json for ${publisher}; verification refused, correct the publisher's revocation declaration`
+      );
+    }
+    this.observedRevocations.set(publisher, [...this.observedRevocations.get(publisher) ?? [], ...denials]);
+    if (denials.length) await this.rememberRevocations(publisher);
+    return document;
+  }
+  documentError(publisher, response, error) {
+    this.evidence.push({
+      kind: "adagents",
+      publisher_domain: publisher,
+      requested_url: response.url,
+      fetched_at: (/* @__PURE__ */ new Date()).toISOString(),
+      error
+    });
+  }
+  async readAdagents(publisher) {
+    const url = `https://${publisher}/.well-known/adagents.json`;
+    const initial = await this.read(publisher, "adagents", url);
+    if (!initial) return null;
+    let authorityLocation = url;
+    let documentResponse = initial;
+    let manifest = await this.parseManifest(publisher, initial);
+    if (!manifest) return null;
+    if (manifest.authoritative_location !== void 0 || manifest.superseded_by !== void 0) {
+      const target = manifest.authoritative_location ?? manifest.superseded_by;
+      if (typeof target !== "string" || target.length > 8192 || manifest.authoritative_location !== void 0 && (manifest.authorized_agents !== void 0 || manifest.superseded_by !== void 0)) {
+        this.documentError(publisher, initial, "ambiguous_authoritative_pointer");
+        return null;
+      }
+      const evidence = this.provenance.get(initial);
+      if (evidence) evidence.delegated_to = target;
+      let location;
+      try {
+        location = new URL(target);
+      } catch {
+        this.documentError(publisher, initial, "invalid_authoritative_location");
+        return null;
+      }
+      if (location.protocol !== "https:" || location.username || location.password || location.href.includes("#") || location.port && location.port !== "443") {
+        this.documentError(publisher, initial, "invalid_authoritative_location");
+        return null;
+      }
+      authorityLocation = location.href;
+      await this.checkAuthority(publisher, authorityLocation, "check");
+      const response = await this.read(publisher, "adagents", target, true);
+      if (!response) return null;
+      documentResponse = response;
+      manifest = await this.parseManifest(publisher, response);
+      if (!manifest) return null;
+      if (manifest.authoritative_location !== void 0 || manifest.superseded_by !== void 0) {
+        this.documentError(publisher, response, "chained_authoritative_pointer");
+        return null;
+      }
+    } else {
+      await this.checkAuthority(publisher, authorityLocation, "check");
+    }
+    if (!Array.isArray(manifest.authorized_agents) || !manifest.authorized_agents.every((entry) => (0, import_validation.record)(entry) && (0, import_validation.agentIdentity)(entry.url))) {
+      this.documentError(publisher, documentResponse, "malformed_authorized_agents");
+      return null;
+    }
+    await this.checkAuthority(publisher, authorityLocation, "observe");
+    if (new URL(authorityLocation).origin !== new URL(url).origin) this.crossOriginAuthorities.add(publisher);
+    return manifest;
+  }
+  async checkAuthority(publisher, location, operation) {
+    let accepted;
+    try {
+      accepted = await (0, import_abort.withAbortSignal)(
+        [this.signal],
+        void 0,
+        () => (this.options.authorityStore ?? import_revocations.defaultSupplyPathAuthorities)[operation](publisher, location)
+      );
+    } catch (cause) {
+      this.signal.throwIfAborted();
+      throw new Error(
+        `Supply-path authority storage failed for ${publisher}; inspect error.cause and restore store availability or capacity without discarding existing pins`,
+        { cause }
+      );
+    }
+    this.signal.throwIfAborted();
+    if (!accepted)
+      throw new TypeError(
+        `Authoritative location changed for ${publisher}; independently confirm the publisher migration before updating its pin`
+      );
+  }
+  async readAndRemember(publisher) {
+    const manifest = await this.readAdagents(publisher);
+    const effective = await this.rememberRevocations(publisher);
+    return manifest ? { ...manifest, revoked_publisher_domains: effective } : null;
+  }
+  async rememberRevocations(publisher) {
+    const observed = this.observedRevocations.get(publisher) ?? [];
+    let held;
+    try {
+      held = await (0, import_abort.withAbortSignal)(
+        [this.signal],
+        void 0,
+        () => (this.options.revocationStore ?? import_revocations2.defaultSupplyPathRevocations).observe(publisher, observed)
+      );
+    } catch (cause) {
+      this.signal.throwIfAborted();
+      throw new Error(
+        `Supply-path revocation storage failed for ${publisher}; inspect error.cause and restore store availability or capacity without discarding held revocations`,
+        { cause }
+      );
+    }
+    this.signal.throwIfAborted();
+    const effective = [...new Map([...held, ...observed].map((entry) => [entry.publisher_domain, entry])).values()];
+    this.revocations.set(publisher, effective);
+    return effective;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SupplyPathEvidenceSession,
+  boundedOption
+});

package/dist/lib/supply-path/fetch-evidence.mjs

@@ -0,0 +1,268 @@
+import { defaultSupplyPathAuthorities } from "./revocations.mjs";
+import { withAbortSignal } from "../protocols/abort.mjs";
+import { createHash } from "node:crypto";
+import { parse } from "secure-json-parse";
+import { SsrfRefusedError, SSRF_TRANSIENT_CODES } from "../net/ssrf-fetch.mjs";
+import { ssrfSafeFetchAdAgents, AdAgentsRedirectRefusedError } from "../discovery/adagents-redirects.mjs";
+import { defaultSupplyPathRevocations, parseRevocations } from "./revocations.mjs";
+import { agentIdentity, record } from "./validation.mjs";
+function boundedOption(value, fallback, maximum, name) {
+  if (value === void 0) return fallback;
+  if (!Number.isSafeInteger(value) || value <= 0 || value > maximum)
+    throw new TypeError(`${name} must be an integer between 1 and ${maximum}`);
+  return value;
+}
+class SupplyPathEvidenceSession {
+  constructor(options) {
+    this.options = options;
+    this.timeoutMs = boundedOption(options.timeoutMs, 15e3, 6e4, "timeoutMs");
+    this.deadlineAt = Date.now() + this.timeoutMs;
+    this.maxBodyBytes = boundedOption(options.maxBodyBytes, 256 * 1024, 20 * 1024 * 1024, "maxBodyBytes");
+    this.signal = this.controller.signal;
+    this.abort = () => this.controller.abort(options.signal?.reason);
+    options.signal?.addEventListener("abort", this.abort, { once: true });
+    if (options.signal?.aborted) this.abort();
+    this.timer = setTimeout(
+      () => this.controller.abort(new Error("Supply-path verification deadline exceeded")),
+      this.timeoutMs
+    );
+  }
+  options;
+  evidence = [];
+  crossOriginAuthorities = /* @__PURE__ */ new Set();
+  observedRevocations = /* @__PURE__ */ new Map();
+  revocations = /* @__PURE__ */ new Map();
+  signal;
+  maxBodyBytes;
+  timeoutMs;
+  deadlineAt;
+  timer;
+  controller = new AbortController();
+  abort;
+  responses = /* @__PURE__ */ new Map();
+  provenance = /* @__PURE__ */ new WeakMap();
+  observedBytes = 0;
+  documents = /* @__PURE__ */ new Map();
+  close() {
+    clearTimeout(this.timer);
+    this.controller.abort(new Error("Supply-path evidence session closed"));
+    this.options.signal?.removeEventListener("abort", this.abort);
+  }
+  /** Enforce the absolute deadline even while synchronous evidence evaluation blocks timer delivery. */
+  assertActive() {
+    this.signal.throwIfAborted();
+    if (Date.now() >= this.deadlineAt) {
+      this.controller.abort(new Error("Supply-path verification deadline exceeded"));
+      this.signal.throwIfAborted();
+    }
+  }
+  adagents(publisher) {
+    let pending = this.documents.get(publisher);
+    if (!pending) {
+      pending = this.readAndRemember(publisher);
+      this.documents.set(publisher, pending);
+    }
+    return pending;
+  }
+  read(publisher, kind, url, pointer = false) {
+    const key = JSON.stringify([publisher, kind, url, pointer]);
+    let pending = this.responses.get(key);
+    if (!pending) {
+      pending = this.fetchEvidence(publisher, kind, url, pointer);
+      this.responses.set(key, pending);
+    }
+    return pending;
+  }
+  async fetchEvidence(publisher, kind, url, pointer = false) {
+    this.assertActive();
+    try {
+      if (this.observedBytes >= 64 * 1024 * 1024) throw new Error("evidence_budget_exceeded");
+      const parsed = new URL(url);
+      if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash || parsed.port && parsed.port !== "443") {
+        throw new Error("invalid_evidence_url");
+      }
+      const response = await ssrfSafeFetchAdAgents(
+        url,
+        {
+          timeoutMs: this.timeoutMs,
+          maxBodyBytes: this.maxBodyBytes,
+          signal: this.signal,
+          trustedFetchFn: this.options.trustedFetchFn,
+          headers: { Accept: kind === "adagents" ? "application/json" : "text/plain", "Cache-Control": "no-cache" }
+        },
+        pointer ? { mode: "none" } : { mode: "same-origin", originUrl: url, maxRedirects: 3 },
+        (result) => {
+          this.observedBytes += result.body.byteLength;
+          const evidence = {
+            kind,
+            publisher_domain: publisher,
+            requested_url: url,
+            resolved_url: result.url,
+            fetched_at: (/* @__PURE__ */ new Date()).toISOString(),
+            status: result.status,
+            byte_length: result.body.byteLength,
+            sha256: createHash("sha256").update(result.body).digest("hex"),
+            connection_pinned: result.connectionPinned,
+            ...result.status >= 300 && result.status < 400 && result.headers.location ? { delegated_to: result.headers.location } : {},
+            ...this.options.retainEvidenceBodies ? { body_base64: Buffer.from(result.body).toString("base64") } : {}
+          };
+          this.evidence.push(evidence);
+          this.provenance.set(result, evidence);
+          if (this.observedBytes > 64 * 1024 * 1024) throw new Error("evidence_budget_exceeded");
+        }
+      );
+      if (response.status === 404 && kind !== "adagents") return { ...response, body: new Uint8Array() };
+      if (response.status !== 200) return null;
+      const contentType = response.headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
+      const validType = kind === "adagents" ? contentType === "application/json" || contentType?.endsWith("+json") : contentType === "text/plain";
+      if (!validType) throw new Error("invalid_content_type");
+      return response;
+    } catch (error) {
+      this.signal.throwIfAborted();
+      const rawCauseCode = record(error) && typeof error.code === "string" ? error.code.toUpperCase() : void 0;
+      const causeCode = rawCauseCode && /^(?:E[A-Z0-9_]{2,40}|CERT_[A-Z0-9_]{2,40})$/.test(rawCauseCode) ? rawCauseCode : void 0;
+      const code = error instanceof SsrfRefusedError || error instanceof AdAgentsRedirectRefusedError ? error.code : error instanceof Error && ["invalid_evidence_url", "invalid_content_type", "evidence_budget_exceeded"].includes(error.message) ? error.message : "fetch_failed";
+      this.evidence.push({
+        kind,
+        publisher_domain: publisher,
+        requested_url: url,
+        fetched_at: (/* @__PURE__ */ new Date()).toISOString(),
+        error: code,
+        ...causeCode ? { cause_code: causeCode } : {}
+      });
+      if (error instanceof SsrfRefusedError && !SSRF_TRANSIENT_CODES.has(error.code)) throw error;
+      return null;
+    }
+  }
+  async parseManifest(publisher, response) {
+    this.assertActive();
+    let document;
+    try {
+      document = parse(new TextDecoder("utf-8", { fatal: true }).decode(response.body));
+      if (!record(document)) throw new Error("not_object");
+    } catch {
+      this.documentError(publisher, response, "invalid_document");
+      return null;
+    }
+    this.assertActive();
+    const denials = parseRevocations(document.revoked_publisher_domains);
+    if (denials === null) {
+      this.documentError(publisher, response, "invalid_revocations");
+      throw new TypeError(
+        `Invalid revoked_publisher_domains in adagents.json for ${publisher}; verification refused, correct the publisher's revocation declaration`
+      );
+    }
+    this.observedRevocations.set(publisher, [...this.observedRevocations.get(publisher) ?? [], ...denials]);
+    if (denials.length) await this.rememberRevocations(publisher);
+    return document;
+  }
+  documentError(publisher, response, error) {
+    this.evidence.push({
+      kind: "adagents",
+      publisher_domain: publisher,
+      requested_url: response.url,
+      fetched_at: (/* @__PURE__ */ new Date()).toISOString(),
+      error
+    });
+  }
+  async readAdagents(publisher) {
+    const url = `https://${publisher}/.well-known/adagents.json`;
+    const initial = await this.read(publisher, "adagents", url);
+    if (!initial) return null;
+    let authorityLocation = url;
+    let documentResponse = initial;
+    let manifest = await this.parseManifest(publisher, initial);
+    if (!manifest) return null;
+    if (manifest.authoritative_location !== void 0 || manifest.superseded_by !== void 0) {
+      const target = manifest.authoritative_location ?? manifest.superseded_by;
+      if (typeof target !== "string" || target.length > 8192 || manifest.authoritative_location !== void 0 && (manifest.authorized_agents !== void 0 || manifest.superseded_by !== void 0)) {
+        this.documentError(publisher, initial, "ambiguous_authoritative_pointer");
+        return null;
+      }
+      const evidence = this.provenance.get(initial);
+      if (evidence) evidence.delegated_to = target;
+      let location;
+      try {
+        location = new URL(target);
+      } catch {
+        this.documentError(publisher, initial, "invalid_authoritative_location");
+        return null;
+      }
+      if (location.protocol !== "https:" || location.username || location.password || location.href.includes("#") || location.port && location.port !== "443") {
+        this.documentError(publisher, initial, "invalid_authoritative_location");
+        return null;
+      }
+      authorityLocation = location.href;
+      await this.checkAuthority(publisher, authorityLocation, "check");
+      const response = await this.read(publisher, "adagents", target, true);
+      if (!response) return null;
+      documentResponse = response;
+      manifest = await this.parseManifest(publisher, response);
+      if (!manifest) return null;
+      if (manifest.authoritative_location !== void 0 || manifest.superseded_by !== void 0) {
+        this.documentError(publisher, response, "chained_authoritative_pointer");
+        return null;
+      }
+    } else {
+      await this.checkAuthority(publisher, authorityLocation, "check");
+    }
+    if (!Array.isArray(manifest.authorized_agents) || !manifest.authorized_agents.every((entry) => record(entry) && agentIdentity(entry.url))) {
+      this.documentError(publisher, documentResponse, "malformed_authorized_agents");
+      return null;
+    }
+    await this.checkAuthority(publisher, authorityLocation, "observe");
+    if (new URL(authorityLocation).origin !== new URL(url).origin) this.crossOriginAuthorities.add(publisher);
+    return manifest;
+  }
+  async checkAuthority(publisher, location, operation) {
+    let accepted;
+    try {
+      accepted = await withAbortSignal(
+        [this.signal],
+        void 0,
+        () => (this.options.authorityStore ?? defaultSupplyPathAuthorities)[operation](publisher, location)
+      );
+    } catch (cause) {
+      this.signal.throwIfAborted();
+      throw new Error(
+        `Supply-path authority storage failed for ${publisher}; inspect error.cause and restore store availability or capacity without discarding existing pins`,
+        { cause }
+      );
+    }
+    this.signal.throwIfAborted();
+    if (!accepted)
+      throw new TypeError(
+        `Authoritative location changed for ${publisher}; independently confirm the publisher migration before updating its pin`
+      );
+  }
+  async readAndRemember(publisher) {
+    const manifest = await this.readAdagents(publisher);
+    const effective = await this.rememberRevocations(publisher);
+    return manifest ? { ...manifest, revoked_publisher_domains: effective } : null;
+  }
+  async rememberRevocations(publisher) {
+    const observed = this.observedRevocations.get(publisher) ?? [];
+    let held;
+    try {
+      held = await withAbortSignal(
+        [this.signal],
+        void 0,
+        () => (this.options.revocationStore ?? defaultSupplyPathRevocations).observe(publisher, observed)
+      );
+    } catch (cause) {
+      this.signal.throwIfAborted();
+      throw new Error(
+        `Supply-path revocation storage failed for ${publisher}; inspect error.cause and restore store availability or capacity without discarding held revocations`,
+        { cause }
+      );
+    }
+    this.signal.throwIfAborted();
+    const effective = [...new Map([...held, ...observed].map((entry) => [entry.publisher_domain, entry])).values()];
+    this.revocations.set(publisher, effective);
+    return effective;
+  }
+}
+export {
+  SupplyPathEvidenceSession,
+  boundedOption
+};

package/dist/lib/supply-path/index.d.mts

@@ -0,0 +1,6 @@
+export * from './types.mjs';
+export { verifySupplyPath } from './verify.mjs';
+export { evaluateSupplyPath, parseInventoryPartnerDomains, SUPPLY_PATH_STATES } from './evaluate.mjs';
+export { annotateProductsSupplyPaths, type AnnotatedSupplyPathProduct, type ListProductsResponseWithSupplyPath, type ProductSupplyPathAnnotation, type ProductSupplyPathOptions, } from './products.mjs';
+export { InMemorySupplyPathRevocationStore, type SupplyPathRevocationStore, type SupplyPathRevocation, } from './revocations.mjs';
+export { defaultSupplyPathAuthorities, InMemorySupplyPathAuthorityStore, type SupplyPathAuthorityStore, } from './revocations.mjs';

package/dist/lib/supply-path/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types';
+export { verifySupplyPath } from './verify';
+export { evaluateSupplyPath, parseInventoryPartnerDomains, SUPPLY_PATH_STATES } from './evaluate';
+export { annotateProductsSupplyPaths, type AnnotatedSupplyPathProduct, type ListProductsResponseWithSupplyPath, type ProductSupplyPathAnnotation, type ProductSupplyPathOptions, } from './products';
+export { InMemorySupplyPathRevocationStore, type SupplyPathRevocationStore, type SupplyPathRevocation, } from './revocations';
+export { defaultSupplyPathAuthorities, InMemorySupplyPathAuthorityStore, type SupplyPathAuthorityStore, } from './revocations';

package/dist/lib/supply-path/index.js

@@ -0,0 +1,49 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var supply_path_exports = {};
+__export(supply_path_exports, {
+  InMemorySupplyPathAuthorityStore: () => import_revocations2.InMemorySupplyPathAuthorityStore,
+  InMemorySupplyPathRevocationStore: () => import_revocations.InMemorySupplyPathRevocationStore,
+  SUPPLY_PATH_STATES: () => import_evaluate.SUPPLY_PATH_STATES,
+  annotateProductsSupplyPaths: () => import_products.annotateProductsSupplyPaths,
+  defaultSupplyPathAuthorities: () => import_revocations2.defaultSupplyPathAuthorities,
+  evaluateSupplyPath: () => import_evaluate.evaluateSupplyPath,
+  parseInventoryPartnerDomains: () => import_evaluate.parseInventoryPartnerDomains,
+  verifySupplyPath: () => import_verify.verifySupplyPath
+});
+module.exports = __toCommonJS(supply_path_exports);
+__reExport(supply_path_exports, require('./types.js'), module.exports);
+var import_verify = require('./verify.js');
+var import_evaluate = require('./evaluate.js');
+var import_products = require('./products.js');
+var import_revocations = require('./revocations.js');
+var import_revocations2 = require('./revocations.js');
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  InMemorySupplyPathAuthorityStore,
+  InMemorySupplyPathRevocationStore,
+  SUPPLY_PATH_STATES,
+  annotateProductsSupplyPaths,
+  defaultSupplyPathAuthorities,
+  evaluateSupplyPath,
+  parseInventoryPartnerDomains,
+  verifySupplyPath,
+  ...require('./types.js')
+});

package/dist/lib/supply-path/index.mjs

@@ -0,0 +1,23 @@
+export * from "./types.mjs";
+import { verifySupplyPath } from "./verify.mjs";
+import { evaluateSupplyPath, parseInventoryPartnerDomains, SUPPLY_PATH_STATES } from "./evaluate.mjs";
+import {
+  annotateProductsSupplyPaths
+} from "./products.mjs";
+import {
+  InMemorySupplyPathRevocationStore
+} from "./revocations.mjs";
+import {
+  defaultSupplyPathAuthorities,
+  InMemorySupplyPathAuthorityStore
+} from "./revocations.mjs";
+export {
+  InMemorySupplyPathAuthorityStore,
+  InMemorySupplyPathRevocationStore,
+  SUPPLY_PATH_STATES,
+  annotateProductsSupplyPaths,
+  defaultSupplyPathAuthorities,
+  evaluateSupplyPath,
+  parseInventoryPartnerDomains,
+  verifySupplyPath
+};