@adcp/sdk 15.9.0 → 16.0.0-beta.1

package/dist/lib/identity-3.3/revocation.js

@@ -0,0 +1,238 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var revocation_exports = {};
+__export(revocation_exports, {
+  InMemoryOriginRevocationStore: () => InMemoryOriginRevocationStore,
+  OriginRevocationResolver: () => OriginRevocationResolver,
+  createSignedOriginRevocationList: () => createSignedOriginRevocationList,
+  mergeRevocationDetail: () => import_revocation.mergeRevocationDetails
+});
+module.exports = __toCommonJS(revocation_exports);
+var import_etld = require('../signing/agent-resolver/etld.js');
+var import_jose = require("jose");
+var import_net = require('../net/index.js');
+var import_canonicalize = require('../signing/agent-resolver/canonicalize.js');
+var import_strict_json = require('../signing/agent-resolver/strict-json.js');
+var import_web_bot_auth = require('../signing/web-bot-auth.js');
+var import_revocation = require('../signing/revocation.js');
+var import_revocation2 = require('../signing/revocation.js');
+const REASONS = [
+  "removeFromCRL",
+  "unspecified",
+  "superseded",
+  "cessationOfOperation",
+  "affiliationChanged",
+  "certificateHold",
+  "privilegeWithdrawn",
+  "aACompromise",
+  "cACompromise",
+  "keyCompromise"
+];
+class InMemoryOriginRevocationStore {
+  constructor(limits = { perOrigin: 16384, total: 1e5 }) {
+    this.limits = limits;
+  }
+  limits;
+  durability = "process-local";
+  revoked = /* @__PURE__ */ new Map();
+  async merge(origin, snapshot) {
+    origin = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+    const additions = new Set(snapshot.revoked_kids.filter((kid) => !this.revoked.has(JSON.stringify([origin, kid]))));
+    const count = [...this.revoked.keys()].filter((key) => JSON.parse(key)[0] === origin).length;
+    if (count + additions.size > this.limits.perOrigin || this.revoked.size + additions.size > this.limits.total)
+      throw new import_web_bot_auth.WebBotAuthError(403, "revocation_storage_limit");
+    for (const kid of snapshot.revoked_kids) {
+      const key = JSON.stringify([origin, kid]), prior = this.revoked.get(key), detail = snapshot.revocation_details?.[kid] ?? {};
+      this.revoked.set(key, (0, import_revocation2.mergeRevocationDetails)(prior, detail));
+    }
+  }
+  async get(origin, keyid) {
+    const entry = this.revoked.get(JSON.stringify([(0, import_canonicalize.canonicalAgentOrigin)(origin), keyid]));
+    return entry && { ...entry };
+  }
+}
+class OriginRevocationResolver {
+  constructor(options) {
+    this.options = options;
+    if (!(options.directory instanceof import_web_bot_auth.SignatureDirectoryResolver))
+      throw new TypeError("Origin revocation requires a verified SignatureDirectoryResolver");
+    if (!Number.isFinite(options.pollingIntervalSeconds ?? 300) || (options.pollingIntervalSeconds ?? 300) < 60 || (options.pollingIntervalSeconds ?? 300) > 1800)
+      throw new TypeError("Invalid revocation polling interval");
+  }
+  options;
+  freshness = /* @__PURE__ */ new Map();
+  updated = /* @__PURE__ */ new Map();
+  graceUntil = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  failures = /* @__PURE__ */ new Map();
+  persistenceFailures = /* @__PURE__ */ new Set();
+  async isRevoked(originUrl, keyid) {
+    const origin = (0, import_canonicalize.canonicalAgentOrigin)(originUrl), now = this.now();
+    if (await this.readStored(origin, keyid)) return true;
+    if ((this.freshness.get(origin) ?? 0) <= now) {
+      if ((this.failures.get(origin) ?? 0) > now) {
+        if (this.persistenceFailures.has(origin)) throw new import_web_bot_auth.WebBotAuthError(403, "revocation_persistence_failed");
+        if ((this.graceUntil.get(origin) ?? 0) > now) return false;
+        throw new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");
+      }
+      let promise = this.pending.get(origin);
+      if (!promise) {
+        if (this.pending.size >= 16 || [...this.pending.keys()].filter((pendingOrigin) => (0, import_etld.eTldPlusOne)(pendingOrigin) === (0, import_etld.eTldPlusOne)(origin)).length >= 2) {
+          throw new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");
+        }
+        promise = this.refresh(origin).catch((error) => {
+          if (this.failures.size >= (this.options.maxOrigins ?? 1e3)) {
+            const oldest = this.failures.keys().next().value;
+            this.failures.delete(oldest);
+            this.persistenceFailures.delete(oldest);
+          }
+          this.failures.set(origin, now + 60);
+          if (error instanceof import_web_bot_auth.WebBotAuthError && error.reason === "revocation_persistence_failed") {
+            this.persistenceFailures.add(origin);
+            this.graceUntil.delete(origin);
+          }
+          throw error;
+        });
+        this.pending.set(origin, promise);
+      }
+      try {
+        await promise;
+      } catch (error) {
+        if (error instanceof import_web_bot_auth.WebBotAuthError && error.reason === "revocation_persistence_failed") throw error;
+        if ((this.graceUntil.get(origin) ?? 0) <= now) throw error;
+      } finally {
+        if (this.pending.get(origin) === promise) this.pending.delete(origin);
+      }
+    }
+    return !!await this.readStored(origin, keyid);
+  }
+  async readStored(origin, keyid) {
+    try {
+      return await this.options.store.get(origin, keyid);
+    } catch (cause) {
+      const error = new import_web_bot_auth.WebBotAuthError(403, "revocation_persistence_failed");
+      Object.defineProperty(error, "cause", { value: cause });
+      throw error;
+    }
+  }
+  async refresh(origin) {
+    try {
+      const response = await (0, import_net.ssrfSafeFetch)(origin + "/.well-known/governance-revocations.json", {
+        ...this.options.fetchOptions,
+        maxBodyBytes: 256 * 1024,
+        timeoutMs: 1e4
+      });
+      if (response.status !== 200) throw new Error("Unavailable revocation list");
+      const body = new TextDecoder("utf-8", { fatal: true }).decode(response.body);
+      let tokens;
+      if (body.trim().startsWith("{")) {
+        const envelope = (0, import_strict_json.parseStrictJson)(body, 32);
+        if (typeof envelope.jws === "string") tokens = [envelope.jws];
+        else {
+          if ("header" in envelope) throw new Error("Revocation metadata must be protected");
+          const signatures = envelope.signatures ?? (envelope.protected && envelope.signature ? [{ protected: envelope.protected, signature: envelope.signature }] : []);
+          if (typeof envelope.payload !== "string" || !Array.isArray(signatures) || !signatures.length || signatures.length > 64)
+            throw new Error("Invalid JWS revocation envelope");
+          tokens = signatures.map((signature) => {
+            if (typeof signature.protected !== "string" || typeof signature.signature !== "string" || signature.header !== void 0)
+              throw new Error("Revocation metadata must be protected");
+            return `${signature.protected}.${envelope.payload}.${signature.signature}`;
+          });
+        }
+      } else tokens = [body.trim()];
+      let verifiedPayload;
+      for (const token of tokens) {
+        try {
+          const header = (0, import_jose.decodeProtectedHeader)(token);
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
+            continue;
+          await this.options.directory.resolve(header.kid, origin);
+          const proof = this.options.directory.getAuditProof(origin);
+          if (!proof || new URL(proof.request.url).origin !== origin) continue;
+          const checked = (0, import_web_bot_auth.verifySignatureDirectory)(proof, this.now(), this.options.directory.allowsTestKeys);
+          const jwk = checked.keys.find((key) => key.kid === header.kid);
+          if (!jwk) continue;
+          const result = await (0, import_jose.compactVerify)(token, await (0, import_jose.importJWK)(jwk, header.alg), {
+            algorithms: ["EdDSA", "ES256"]
+          });
+          verifiedPayload = result.payload;
+          break;
+        } catch {
+        }
+      }
+      if (!verifiedPayload) throw new Error("No valid protected revocation signature");
+      const snapshot = (0, import_strict_json.parseStrictJson)(
+        new TextDecoder("utf-8", { fatal: true }).decode(verifiedPayload),
+        32
+      );
+      const updated = Date.parse(snapshot.updated) / 1e3, next = Date.parse(snapshot.next_update) / 1e3, now = this.now();
+      if (snapshot.issuer !== origin || !Number.isFinite(updated) || !Number.isFinite(next) || updated > now || next <= now || next <= updated || next > now + 1800 || !Array.isArray(snapshot.revoked_kids) || snapshot.revoked_kids.length > 4096 || snapshot.revoked_kids.some((k) => typeof k !== "string" || k.length > 256) || updated < (this.updated.get(origin) ?? 0))
+        throw new Error("Invalid revocation snapshot");
+      for (const [kid, detail] of Object.entries(snapshot.revocation_details ?? {}))
+        if (!snapshot.revoked_kids.includes(kid) || !detail || detail.reason && !REASONS.includes(detail.reason) || detail.invalidity_date && !Number.isFinite(Date.parse(detail.invalidity_date)))
+          throw new Error("Invalid revocation detail");
+      try {
+        await this.options.store.merge(origin, snapshot);
+      } catch (cause) {
+        const error = new import_web_bot_auth.WebBotAuthError(403, "revocation_persistence_failed");
+        Object.defineProperty(error, "cause", { value: cause });
+        throw error;
+      }
+      if (!this.freshness.has(origin) && this.freshness.size >= (this.options.maxOrigins ?? 1e3)) {
+        const oldest = this.freshness.keys().next().value;
+        this.freshness.delete(oldest);
+        this.updated.delete(oldest);
+        this.graceUntil.delete(oldest);
+      }
+      this.graceUntil.set(origin, next + 4 * (this.options.pollingIntervalSeconds ?? 300));
+      this.updated.set(origin, updated);
+      this.freshness.set(origin, Math.min(next, now + (this.options.pollingIntervalSeconds ?? 300)));
+      this.failures.delete(origin);
+      this.persistenceFailures.delete(origin);
+    } catch (cause) {
+      if (cause instanceof import_web_bot_auth.WebBotAuthError && cause.reason === "revocation_persistence_failed") throw cause;
+      const error = new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");
+      Object.defineProperty(error, "cause", { value: cause });
+      throw error;
+    }
+  }
+  now() {
+    const now = (this.options.now ?? (() => Date.now() / 1e3))();
+    if (!Number.isFinite(now)) throw new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");
+    return now;
+  }
+}
+async function createSignedOriginRevocationList(snapshot, privateKey) {
+  const issuer = (0, import_canonicalize.canonicalAgentOrigin)(snapshot.issuer), now = Date.now() / 1e3;
+  if (issuer !== snapshot.issuer || !Number.isFinite(Date.parse(snapshot.updated)) || !Number.isFinite(Date.parse(snapshot.next_update)) || Date.parse(snapshot.updated) / 1e3 > now || Date.parse(snapshot.next_update) / 1e3 <= now || Date.parse(snapshot.next_update) / 1e3 > now + 1800 || !Array.isArray(snapshot.revoked_kids))
+    throw new TypeError("Invalid origin revocation snapshot");
+  const kid = (0, import_web_bot_auth.jwkThumbprint)(privateKey);
+  if (privateKey.kid && privateKey.kid !== kid)
+    throw new TypeError("Revocation signing kid must be the JWK thumbprint");
+  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.crv === "P-256" ? "ES256" : void 0;
+  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or P-256 key");
+  return new import_jose.CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await (0, import_jose.importJWK)(privateKey, alg));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  InMemoryOriginRevocationStore,
+  OriginRevocationResolver,
+  createSignedOriginRevocationList,
+  mergeRevocationDetail
+});

package/dist/lib/identity-3.3/revocation.mjs

@@ -0,0 +1,216 @@
+import { eTldPlusOne } from "../signing/agent-resolver/etld.mjs";
+import { CompactSign, compactVerify, decodeProtectedHeader, importJWK } from "jose";
+import { ssrfSafeFetch } from "../net/index.mjs";
+import { canonicalAgentOrigin } from "../signing/agent-resolver/canonicalize.mjs";
+import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
+import {
+  SignatureDirectoryResolver,
+  WebBotAuthError,
+  verifySignatureDirectory,
+  jwkThumbprint
+} from "../signing/web-bot-auth.mjs";
+const REASONS = [
+  "removeFromCRL",
+  "unspecified",
+  "superseded",
+  "cessationOfOperation",
+  "affiliationChanged",
+  "certificateHold",
+  "privilegeWithdrawn",
+  "aACompromise",
+  "cACompromise",
+  "keyCompromise"
+];
+import { mergeRevocationDetails } from "../signing/revocation.mjs";
+import { mergeRevocationDetails as mergeRevocationDetail } from "../signing/revocation.mjs";
+class InMemoryOriginRevocationStore {
+  constructor(limits = { perOrigin: 16384, total: 1e5 }) {
+    this.limits = limits;
+  }
+  limits;
+  durability = "process-local";
+  revoked = /* @__PURE__ */ new Map();
+  async merge(origin, snapshot) {
+    origin = canonicalAgentOrigin(origin);
+    const additions = new Set(snapshot.revoked_kids.filter((kid) => !this.revoked.has(JSON.stringify([origin, kid]))));
+    const count = [...this.revoked.keys()].filter((key) => JSON.parse(key)[0] === origin).length;
+    if (count + additions.size > this.limits.perOrigin || this.revoked.size + additions.size > this.limits.total)
+      throw new WebBotAuthError(403, "revocation_storage_limit");
+    for (const kid of snapshot.revoked_kids) {
+      const key = JSON.stringify([origin, kid]), prior = this.revoked.get(key), detail = snapshot.revocation_details?.[kid] ?? {};
+      this.revoked.set(key, mergeRevocationDetail(prior, detail));
+    }
+  }
+  async get(origin, keyid) {
+    const entry = this.revoked.get(JSON.stringify([canonicalAgentOrigin(origin), keyid]));
+    return entry && { ...entry };
+  }
+}
+class OriginRevocationResolver {
+  constructor(options) {
+    this.options = options;
+    if (!(options.directory instanceof SignatureDirectoryResolver))
+      throw new TypeError("Origin revocation requires a verified SignatureDirectoryResolver");
+    if (!Number.isFinite(options.pollingIntervalSeconds ?? 300) || (options.pollingIntervalSeconds ?? 300) < 60 || (options.pollingIntervalSeconds ?? 300) > 1800)
+      throw new TypeError("Invalid revocation polling interval");
+  }
+  options;
+  freshness = /* @__PURE__ */ new Map();
+  updated = /* @__PURE__ */ new Map();
+  graceUntil = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  failures = /* @__PURE__ */ new Map();
+  persistenceFailures = /* @__PURE__ */ new Set();
+  async isRevoked(originUrl, keyid) {
+    const origin = canonicalAgentOrigin(originUrl), now = this.now();
+    if (await this.readStored(origin, keyid)) return true;
+    if ((this.freshness.get(origin) ?? 0) <= now) {
+      if ((this.failures.get(origin) ?? 0) > now) {
+        if (this.persistenceFailures.has(origin)) throw new WebBotAuthError(403, "revocation_persistence_failed");
+        if ((this.graceUntil.get(origin) ?? 0) > now) return false;
+        throw new WebBotAuthError(403, "revocation_unavailable");
+      }
+      let promise = this.pending.get(origin);
+      if (!promise) {
+        if (this.pending.size >= 16 || [...this.pending.keys()].filter((pendingOrigin) => eTldPlusOne(pendingOrigin) === eTldPlusOne(origin)).length >= 2) {
+          throw new WebBotAuthError(403, "revocation_unavailable");
+        }
+        promise = this.refresh(origin).catch((error) => {
+          if (this.failures.size >= (this.options.maxOrigins ?? 1e3)) {
+            const oldest = this.failures.keys().next().value;
+            this.failures.delete(oldest);
+            this.persistenceFailures.delete(oldest);
+          }
+          this.failures.set(origin, now + 60);
+          if (error instanceof WebBotAuthError && error.reason === "revocation_persistence_failed") {
+            this.persistenceFailures.add(origin);
+            this.graceUntil.delete(origin);
+          }
+          throw error;
+        });
+        this.pending.set(origin, promise);
+      }
+      try {
+        await promise;
+      } catch (error) {
+        if (error instanceof WebBotAuthError && error.reason === "revocation_persistence_failed") throw error;
+        if ((this.graceUntil.get(origin) ?? 0) <= now) throw error;
+      } finally {
+        if (this.pending.get(origin) === promise) this.pending.delete(origin);
+      }
+    }
+    return !!await this.readStored(origin, keyid);
+  }
+  async readStored(origin, keyid) {
+    try {
+      return await this.options.store.get(origin, keyid);
+    } catch (cause) {
+      const error = new WebBotAuthError(403, "revocation_persistence_failed");
+      Object.defineProperty(error, "cause", { value: cause });
+      throw error;
+    }
+  }
+  async refresh(origin) {
+    try {
+      const response = await ssrfSafeFetch(origin + "/.well-known/governance-revocations.json", {
+        ...this.options.fetchOptions,
+        maxBodyBytes: 256 * 1024,
+        timeoutMs: 1e4
+      });
+      if (response.status !== 200) throw new Error("Unavailable revocation list");
+      const body = new TextDecoder("utf-8", { fatal: true }).decode(response.body);
+      let tokens;
+      if (body.trim().startsWith("{")) {
+        const envelope = parseStrictJson(body, 32);
+        if (typeof envelope.jws === "string") tokens = [envelope.jws];
+        else {
+          if ("header" in envelope) throw new Error("Revocation metadata must be protected");
+          const signatures = envelope.signatures ?? (envelope.protected && envelope.signature ? [{ protected: envelope.protected, signature: envelope.signature }] : []);
+          if (typeof envelope.payload !== "string" || !Array.isArray(signatures) || !signatures.length || signatures.length > 64)
+            throw new Error("Invalid JWS revocation envelope");
+          tokens = signatures.map((signature) => {
+            if (typeof signature.protected !== "string" || typeof signature.signature !== "string" || signature.header !== void 0)
+              throw new Error("Revocation metadata must be protected");
+            return `${signature.protected}.${envelope.payload}.${signature.signature}`;
+          });
+        }
+      } else tokens = [body.trim()];
+      let verifiedPayload;
+      for (const token of tokens) {
+        try {
+          const header = decodeProtectedHeader(token);
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
+            continue;
+          await this.options.directory.resolve(header.kid, origin);
+          const proof = this.options.directory.getAuditProof(origin);
+          if (!proof || new URL(proof.request.url).origin !== origin) continue;
+          const checked = verifySignatureDirectory(proof, this.now(), this.options.directory.allowsTestKeys);
+          const jwk = checked.keys.find((key) => key.kid === header.kid);
+          if (!jwk) continue;
+          const result = await compactVerify(token, await importJWK(jwk, header.alg), {
+            algorithms: ["EdDSA", "ES256"]
+          });
+          verifiedPayload = result.payload;
+          break;
+        } catch {
+        }
+      }
+      if (!verifiedPayload) throw new Error("No valid protected revocation signature");
+      const snapshot = parseStrictJson(
+        new TextDecoder("utf-8", { fatal: true }).decode(verifiedPayload),
+        32
+      );
+      const updated = Date.parse(snapshot.updated) / 1e3, next = Date.parse(snapshot.next_update) / 1e3, now = this.now();
+      if (snapshot.issuer !== origin || !Number.isFinite(updated) || !Number.isFinite(next) || updated > now || next <= now || next <= updated || next > now + 1800 || !Array.isArray(snapshot.revoked_kids) || snapshot.revoked_kids.length > 4096 || snapshot.revoked_kids.some((k) => typeof k !== "string" || k.length > 256) || updated < (this.updated.get(origin) ?? 0))
+        throw new Error("Invalid revocation snapshot");
+      for (const [kid, detail] of Object.entries(snapshot.revocation_details ?? {}))
+        if (!snapshot.revoked_kids.includes(kid) || !detail || detail.reason && !REASONS.includes(detail.reason) || detail.invalidity_date && !Number.isFinite(Date.parse(detail.invalidity_date)))
+          throw new Error("Invalid revocation detail");
+      try {
+        await this.options.store.merge(origin, snapshot);
+      } catch (cause) {
+        const error = new WebBotAuthError(403, "revocation_persistence_failed");
+        Object.defineProperty(error, "cause", { value: cause });
+        throw error;
+      }
+      if (!this.freshness.has(origin) && this.freshness.size >= (this.options.maxOrigins ?? 1e3)) {
+        const oldest = this.freshness.keys().next().value;
+        this.freshness.delete(oldest);
+        this.updated.delete(oldest);
+        this.graceUntil.delete(oldest);
+      }
+      this.graceUntil.set(origin, next + 4 * (this.options.pollingIntervalSeconds ?? 300));
+      this.updated.set(origin, updated);
+      this.freshness.set(origin, Math.min(next, now + (this.options.pollingIntervalSeconds ?? 300)));
+      this.failures.delete(origin);
+      this.persistenceFailures.delete(origin);
+    } catch (cause) {
+      if (cause instanceof WebBotAuthError && cause.reason === "revocation_persistence_failed") throw cause;
+      const error = new WebBotAuthError(403, "revocation_unavailable");
+      Object.defineProperty(error, "cause", { value: cause });
+      throw error;
+    }
+  }
+  now() {
+    const now = (this.options.now ?? (() => Date.now() / 1e3))();
+    if (!Number.isFinite(now)) throw new WebBotAuthError(403, "revocation_unavailable");
+    return now;
+  }
+}
+async function createSignedOriginRevocationList(snapshot, privateKey) {
+  const issuer = canonicalAgentOrigin(snapshot.issuer), now = Date.now() / 1e3;
+  if (issuer !== snapshot.issuer || !Number.isFinite(Date.parse(snapshot.updated)) || !Number.isFinite(Date.parse(snapshot.next_update)) || Date.parse(snapshot.updated) / 1e3 > now || Date.parse(snapshot.next_update) / 1e3 <= now || Date.parse(snapshot.next_update) / 1e3 > now + 1800 || !Array.isArray(snapshot.revoked_kids))
+    throw new TypeError("Invalid origin revocation snapshot");
+  const kid = jwkThumbprint(privateKey);
+  if (privateKey.kid && privateKey.kid !== kid)
+    throw new TypeError("Revocation signing kid must be the JWK thumbprint");
+  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.crv === "P-256" ? "ES256" : void 0;
+  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or P-256 key");
+  return new CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await importJWK(privateKey, alg));
+}
+export {
+  InMemoryOriginRevocationStore,
+  OriginRevocationResolver,
+  createSignedOriginRevocationList,
+  mergeRevocationDetails as mergeRevocationDetail
+};