@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/dist/lib/identity-3.3/store.d.ts

@@ -0,0 +1,24 @@
+import type { AdcpStateStore } from '../server/state-store';
+import { type MonotonicOriginRevocationStore } from './revocation';
+import type { OriginIdentityStore } from './lifecycle';
+/** CAS-backed stores work with the SDK's PostgresStateStore and custom shared backends. */
+export declare function createIdentity33StateStores(options: {
+    store: AdcpStateStore;
+    tenantId: string;
+    collection?: string;
+    /** Separate capacity for bound and unbound origins. Raising limits preserves every existing fact. */
+    revocationLimits?: {
+        keys?: number;
+        origins?: number;
+        operatorKeys?: number;
+        operatorOrigins?: number;
+        originKeys?: number;
+    };
+}): {
+    identity: OriginIdentityStore;
+    authorityHistory: {
+        has(operator: string): Promise<boolean>;
+        mark(operator: string): Promise<void>;
+    };
+    revocations: MonotonicOriginRevocationStore;
+};

package/dist/lib/identity-3.3/store.js

@@ -0,0 +1,191 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var store_exports = {};
+__export(store_exports, {
+  createIdentity33StateStores: () => createIdentity33StateStores
+});
+module.exports = __toCommonJS(store_exports);
+var import_crypto = require("crypto");
+var import_canonicalize = require('../signing/agent-resolver/canonicalize.js');
+var import_etld = require('../signing/agent-resolver/etld.js');
+var import_trust = require('./trust.js');
+var import_revocation = require('./revocation.js');
+function createIdentity33StateStores(options) {
+  const { store, tenantId } = options, collection = options.collection ?? "identity33";
+  if (!tenantId || tenantId.length > 255 || !store.getWithVersion || !store.putIfMatch)
+    throw new TypeError("Identity stores require trusted tenantId and atomic getWithVersion/putIfMatch");
+  const revocationLimits = {
+    keys: 1e5,
+    origins: 1e4,
+    operatorKeys: 16384,
+    operatorOrigins: 256,
+    originKeys: 16384,
+    ...options.revocationLimits
+  };
+  if (Object.values(revocationLimits).some((value) => !Number.isSafeInteger(value) || value < 1))
+    throw new TypeError("Revocation limits must be positive safe integers");
+  const id = (kind, key) => (0, import_crypto.createHash)("sha256").update(JSON.stringify([tenantId, kind, key])).digest("hex");
+  async function update(kind, key, change) {
+    const keyId = id(kind, key);
+    for (let attempt = 0; attempt < 10; attempt++) {
+      const prior = await store.getWithVersion(collection, keyId);
+      if (prior && prior.data.tenantId !== tenantId) throw new import_trust.IdentityAuthorizationError();
+      const next = await change(prior?.data ?? null);
+      if ((await store.putIfMatch(collection, keyId, next, prior?.version ?? null)).ok) return next;
+    }
+    throw new import_trust.IdentityAuthorizationError();
+  }
+  function operatorOf(origin) {
+    try {
+      return (0, import_etld.eTldPlusOne)(origin);
+    } catch {
+      return void 0;
+    }
+  }
+  async function readLedger(operator) {
+    const row = await store.get(collection, id("operator", operator));
+    if (row && (row.schemaVersion !== 1 || row.tenantId !== tenantId || row.operator !== operator || !row.bindings || typeof row.bindings !== "object"))
+      throw new import_trust.IdentityAuthorizationError();
+    return row;
+  }
+  async function writeBinding(binding, quota) {
+    if ((0, import_canonicalize.canonicalAgentOrigin)(binding.origin) !== binding.origin || operatorOf(binding.origin) !== binding.operator || !binding.principalId || !binding.audit?.approvedBy || !binding.audit.reason || !Number.isFinite(Date.parse(binding.audit.approvedAt)))
+      throw new import_trust.IdentityAuthorizationError();
+    const ledger = await update("operator", binding.operator, (prior) => {
+      if (prior && (prior.schemaVersion !== 1 || prior.operator !== binding.operator || !prior.bindings))
+        throw new import_trust.IdentityAuthorizationError();
+      const value = prior ?? { schemaVersion: 1, tenantId, operator: binding.operator, bindings: {} };
+      const existing = value.bindings[binding.origin];
+      if (existing) {
+        if (quota !== void 0 || JSON.stringify(existing) !== JSON.stringify(binding))
+          throw new import_trust.IdentityAuthorizationError();
+        return value;
+      }
+      if (quota !== void 0 && (!binding.openAccess || !Number.isInteger(quota) || quota < 1 || Object.values(value.bindings).filter((b) => b.openAccess).length >= quota))
+        throw new import_trust.IdentityAuthorizationError();
+      return { ...value, bindings: { ...value.bindings, [binding.origin]: structuredClone(binding) } };
+    });
+    return structuredClone(ledger.bindings[binding.origin]);
+  }
+  const identity = {
+    async getBinding(origin) {
+      origin = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+      const operator = operatorOf(origin);
+      if (!operator) return void 0;
+      const binding = (await readLedger(operator))?.bindings[origin];
+      return binding && structuredClone(binding);
+    },
+    async bind(binding) {
+      await writeBinding(binding);
+    },
+    bindOpen: (binding, quota) => writeBinding(binding, quota),
+    async getApplication(origin) {
+      const row = await store.get(collection, id("application", (0, import_canonicalize.canonicalAgentOrigin)(origin)));
+      if (!row) return void 0;
+      if (row.tenantId !== tenantId || row.schemaVersion !== 1 || row.origin !== (0, import_canonicalize.canonicalAgentOrigin)(origin) || !row.application)
+        throw new import_trust.IdentityAuthorizationError();
+      return structuredClone(row.application);
+    },
+    async compareAndSetApplication(origin, expectedRevision, application) {
+      origin = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+      const keyId = id("application", origin);
+      const prior = await store.getWithVersion(collection, keyId);
+      if (prior && (prior.data.tenantId !== tenantId || prior.data.origin !== origin))
+        throw new import_trust.IdentityAuthorizationError();
+      const current = prior?.data.application;
+      if (current?.revision !== expectedRevision || application.revision !== (expectedRevision ?? 0) + 1) return false;
+      return (await store.putIfMatch(
+        collection,
+        keyId,
+        { schemaVersion: 1, tenantId, origin, application: structuredClone(application) },
+        prior?.version ?? null
+      )).ok;
+    }
+  };
+  const authorityHistory = {
+    async has(operator) {
+      return (await readLedger((0, import_etld.eTldPlusOne)(operator)))?.authoritativeTrustSeen === true;
+    },
+    async mark(operator) {
+      operator = (0, import_etld.eTldPlusOne)(operator);
+      await update("operator", operator, (prior) => ({
+        ...prior ?? { schemaVersion: 1, tenantId, operator, bindings: {} },
+        authoritativeTrustSeen: true
+      }));
+    }
+  };
+  async function reserveRevocationBudget(origin, keys) {
+    const operator = (0, import_etld.eTldPlusOne)(origin);
+    const binding = await identity.getBinding(origin);
+    const hasBinding = !!binding && !binding.openAccess;
+    await update("revocation-budget", "tenant", (prior) => {
+      const budget = prior ?? { schemaVersion: 1, tenantId, origins: {}, keys: 0 };
+      if (budget.schemaVersion !== 1 || !budget.origins || !Number.isSafeInteger(budget.keys) || budget.boundKeys !== void 0 && !Number.isSafeInteger(budget.boundKeys))
+        throw new import_trust.IdentityAuthorizationError();
+      const previous = budget.origins[origin], desired = Math.max(previous?.keys ?? 0, keys), delta = desired - (previous?.keys ?? 0), bound = previous?.bound === true || hasBinding, boundKeys = (budget.boundKeys ?? 0) + (bound ? desired - (previous?.bound ? previous.keys : 0) : 0), totalKeys = budget.keys + delta;
+      const entries = Object.values(budget.origins), pool = entries.filter((entry) => entry.bound === true === bound), owned = pool.filter((entry) => entry.operator === operator), newPoolMember = !previous || previous.bound === true !== bound;
+      if (newPoolMember && (pool.length >= revocationLimits.origins || owned.length >= revocationLimits.operatorOrigins) || (bound ? boundKeys : totalKeys - boundKeys) > revocationLimits.keys || owned.reduce((sum, entry) => sum + entry.keys, 0) + (newPoolMember ? desired : delta) > revocationLimits.operatorKeys)
+        throw new import_trust.IdentityAuthorizationError();
+      return {
+        ...budget,
+        keys: totalKeys,
+        boundKeys,
+        origins: { ...budget.origins, [origin]: { operator, keys: desired, bound } }
+      };
+    });
+  }
+  const revocations = {
+    async get(origin, keyid) {
+      origin = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+      const row = await store.get(collection, id("revocations", origin));
+      if (row && (row.schemaVersion !== 1 || row.tenantId !== tenantId || row.origin !== origin || !row.revoked))
+        throw new import_trust.IdentityAuthorizationError();
+      const detail = row && Object.hasOwn(row.revoked, keyid) ? row.revoked[keyid] : void 0;
+      return detail && { ...detail };
+    },
+    async merge(origin, snapshot) {
+      origin = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+      if (!snapshot.revoked_kids.length) return;
+      await update("revocations", origin, async (prior) => {
+        if (prior && (prior.schemaVersion !== 1 || prior.origin !== origin || !prior.revoked))
+          throw new import_trust.IdentityAuthorizationError();
+        const revoked = { ...prior?.revoked ?? {} };
+        const additions = new Set(snapshot.revoked_kids.filter((kid) => !Object.hasOwn(revoked, kid)));
+        if (Object.keys(revoked).length + additions.size > revocationLimits.originKeys)
+          throw new import_trust.IdentityAuthorizationError();
+        for (const kid of snapshot.revoked_kids) {
+          const previous = Object.hasOwn(revoked, kid) ? revoked[kid] : void 0;
+          Object.defineProperty(revoked, kid, {
+            value: (0, import_revocation.mergeRevocationDetail)(previous, snapshot.revocation_details?.[kid] ?? {}),
+            enumerable: true,
+            configurable: true,
+            writable: true
+          });
+        }
+        await reserveRevocationBudget(origin, Object.keys(revoked).length);
+        return { schemaVersion: 1, tenantId, origin, revoked };
+      });
+    }
+  };
+  return { identity, authorityHistory, revocations };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createIdentity33StateStores
+});

package/dist/lib/identity-3.3/store.mjs

@@ -0,0 +1,169 @@
+import { createHash } from "crypto";
+import { canonicalAgentOrigin } from "../signing/agent-resolver/canonicalize.mjs";
+import { eTldPlusOne } from "../signing/agent-resolver/etld.mjs";
+import { IdentityAuthorizationError } from "./trust.mjs";
+import {
+  mergeRevocationDetail
+} from "./revocation.mjs";
+function createIdentity33StateStores(options) {
+  const { store, tenantId } = options, collection = options.collection ?? "identity33";
+  if (!tenantId || tenantId.length > 255 || !store.getWithVersion || !store.putIfMatch)
+    throw new TypeError("Identity stores require trusted tenantId and atomic getWithVersion/putIfMatch");
+  const revocationLimits = {
+    keys: 1e5,
+    origins: 1e4,
+    operatorKeys: 16384,
+    operatorOrigins: 256,
+    originKeys: 16384,
+    ...options.revocationLimits
+  };
+  if (Object.values(revocationLimits).some((value) => !Number.isSafeInteger(value) || value < 1))
+    throw new TypeError("Revocation limits must be positive safe integers");
+  const id = (kind, key) => createHash("sha256").update(JSON.stringify([tenantId, kind, key])).digest("hex");
+  async function update(kind, key, change) {
+    const keyId = id(kind, key);
+    for (let attempt = 0; attempt < 10; attempt++) {
+      const prior = await store.getWithVersion(collection, keyId);
+      if (prior && prior.data.tenantId !== tenantId) throw new IdentityAuthorizationError();
+      const next = await change(prior?.data ?? null);
+      if ((await store.putIfMatch(collection, keyId, next, prior?.version ?? null)).ok) return next;
+    }
+    throw new IdentityAuthorizationError();
+  }
+  function operatorOf(origin) {
+    try {
+      return eTldPlusOne(origin);
+    } catch {
+      return void 0;
+    }
+  }
+  async function readLedger(operator) {
+    const row = await store.get(collection, id("operator", operator));
+    if (row && (row.schemaVersion !== 1 || row.tenantId !== tenantId || row.operator !== operator || !row.bindings || typeof row.bindings !== "object"))
+      throw new IdentityAuthorizationError();
+    return row;
+  }
+  async function writeBinding(binding, quota) {
+    if (canonicalAgentOrigin(binding.origin) !== binding.origin || operatorOf(binding.origin) !== binding.operator || !binding.principalId || !binding.audit?.approvedBy || !binding.audit.reason || !Number.isFinite(Date.parse(binding.audit.approvedAt)))
+      throw new IdentityAuthorizationError();
+    const ledger = await update("operator", binding.operator, (prior) => {
+      if (prior && (prior.schemaVersion !== 1 || prior.operator !== binding.operator || !prior.bindings))
+        throw new IdentityAuthorizationError();
+      const value = prior ?? { schemaVersion: 1, tenantId, operator: binding.operator, bindings: {} };
+      const existing = value.bindings[binding.origin];
+      if (existing) {
+        if (quota !== void 0 || JSON.stringify(existing) !== JSON.stringify(binding))
+          throw new IdentityAuthorizationError();
+        return value;
+      }
+      if (quota !== void 0 && (!binding.openAccess || !Number.isInteger(quota) || quota < 1 || Object.values(value.bindings).filter((b) => b.openAccess).length >= quota))
+        throw new IdentityAuthorizationError();
+      return { ...value, bindings: { ...value.bindings, [binding.origin]: structuredClone(binding) } };
+    });
+    return structuredClone(ledger.bindings[binding.origin]);
+  }
+  const identity = {
+    async getBinding(origin) {
+      origin = canonicalAgentOrigin(origin);
+      const operator = operatorOf(origin);
+      if (!operator) return void 0;
+      const binding = (await readLedger(operator))?.bindings[origin];
+      return binding && structuredClone(binding);
+    },
+    async bind(binding) {
+      await writeBinding(binding);
+    },
+    bindOpen: (binding, quota) => writeBinding(binding, quota),
+    async getApplication(origin) {
+      const row = await store.get(collection, id("application", canonicalAgentOrigin(origin)));
+      if (!row) return void 0;
+      if (row.tenantId !== tenantId || row.schemaVersion !== 1 || row.origin !== canonicalAgentOrigin(origin) || !row.application)
+        throw new IdentityAuthorizationError();
+      return structuredClone(row.application);
+    },
+    async compareAndSetApplication(origin, expectedRevision, application) {
+      origin = canonicalAgentOrigin(origin);
+      const keyId = id("application", origin);
+      const prior = await store.getWithVersion(collection, keyId);
+      if (prior && (prior.data.tenantId !== tenantId || prior.data.origin !== origin))
+        throw new IdentityAuthorizationError();
+      const current = prior?.data.application;
+      if (current?.revision !== expectedRevision || application.revision !== (expectedRevision ?? 0) + 1) return false;
+      return (await store.putIfMatch(
+        collection,
+        keyId,
+        { schemaVersion: 1, tenantId, origin, application: structuredClone(application) },
+        prior?.version ?? null
+      )).ok;
+    }
+  };
+  const authorityHistory = {
+    async has(operator) {
+      return (await readLedger(eTldPlusOne(operator)))?.authoritativeTrustSeen === true;
+    },
+    async mark(operator) {
+      operator = eTldPlusOne(operator);
+      await update("operator", operator, (prior) => ({
+        ...prior ?? { schemaVersion: 1, tenantId, operator, bindings: {} },
+        authoritativeTrustSeen: true
+      }));
+    }
+  };
+  async function reserveRevocationBudget(origin, keys) {
+    const operator = eTldPlusOne(origin);
+    const binding = await identity.getBinding(origin);
+    const hasBinding = !!binding && !binding.openAccess;
+    await update("revocation-budget", "tenant", (prior) => {
+      const budget = prior ?? { schemaVersion: 1, tenantId, origins: {}, keys: 0 };
+      if (budget.schemaVersion !== 1 || !budget.origins || !Number.isSafeInteger(budget.keys) || budget.boundKeys !== void 0 && !Number.isSafeInteger(budget.boundKeys))
+        throw new IdentityAuthorizationError();
+      const previous = budget.origins[origin], desired = Math.max(previous?.keys ?? 0, keys), delta = desired - (previous?.keys ?? 0), bound = previous?.bound === true || hasBinding, boundKeys = (budget.boundKeys ?? 0) + (bound ? desired - (previous?.bound ? previous.keys : 0) : 0), totalKeys = budget.keys + delta;
+      const entries = Object.values(budget.origins), pool = entries.filter((entry) => entry.bound === true === bound), owned = pool.filter((entry) => entry.operator === operator), newPoolMember = !previous || previous.bound === true !== bound;
+      if (newPoolMember && (pool.length >= revocationLimits.origins || owned.length >= revocationLimits.operatorOrigins) || (bound ? boundKeys : totalKeys - boundKeys) > revocationLimits.keys || owned.reduce((sum, entry) => sum + entry.keys, 0) + (newPoolMember ? desired : delta) > revocationLimits.operatorKeys)
+        throw new IdentityAuthorizationError();
+      return {
+        ...budget,
+        keys: totalKeys,
+        boundKeys,
+        origins: { ...budget.origins, [origin]: { operator, keys: desired, bound } }
+      };
+    });
+  }
+  const revocations = {
+    async get(origin, keyid) {
+      origin = canonicalAgentOrigin(origin);
+      const row = await store.get(collection, id("revocations", origin));
+      if (row && (row.schemaVersion !== 1 || row.tenantId !== tenantId || row.origin !== origin || !row.revoked))
+        throw new IdentityAuthorizationError();
+      const detail = row && Object.hasOwn(row.revoked, keyid) ? row.revoked[keyid] : void 0;
+      return detail && { ...detail };
+    },
+    async merge(origin, snapshot) {
+      origin = canonicalAgentOrigin(origin);
+      if (!snapshot.revoked_kids.length) return;
+      await update("revocations", origin, async (prior) => {
+        if (prior && (prior.schemaVersion !== 1 || prior.origin !== origin || !prior.revoked))
+          throw new IdentityAuthorizationError();
+        const revoked = { ...prior?.revoked ?? {} };
+        const additions = new Set(snapshot.revoked_kids.filter((kid) => !Object.hasOwn(revoked, kid)));
+        if (Object.keys(revoked).length + additions.size > revocationLimits.originKeys)
+          throw new IdentityAuthorizationError();
+        for (const kid of snapshot.revoked_kids) {
+          const previous = Object.hasOwn(revoked, kid) ? revoked[kid] : void 0;
+          Object.defineProperty(revoked, kid, {
+            value: mergeRevocationDetail(previous, snapshot.revocation_details?.[kid] ?? {}),
+            enumerable: true,
+            configurable: true,
+            writable: true
+          });
+        }
+        await reserveRevocationBudget(origin, Object.keys(revoked).length);
+        return { schemaVersion: 1, tenantId, origin, revoked };
+      });
+    }
+  };
+  return { identity, authorityHistory, revocations };
+}
+export {
+  createIdentity33StateStores
+};

package/dist/lib/identity-3.3/trust.d.mts

@@ -0,0 +1,155 @@
+import { type SsrfFetchOptions } from '../net/index.mjs';
+import type { TrustRecord, TrustAgent, AgentGrantDeniedDetails } from './types.mjs';
+export declare function validateIdentity33Schema(id: string, value: unknown): boolean;
+export declare class IdentityAuthorizationError extends Error {
+    readonly code = "PERMISSION_DENIED";
+    readonly details: AgentGrantDeniedDetails | undefined;
+    constructor(reason?: 'authorization_failed' | 'grant_absent');
+}
+/**
+ * The trust record could not be read (transport error, outage, capacity,
+ * invalid content). A fetch failure is never absence or delisting: spend
+ * fails closed with a retryable SERVICE_UNAVAILABLE, other calls continue
+ * under an existing binding.
+ */
+export declare class TrustRecordUnavailableError extends IdentityAuthorizationError {
+    readonly transient: true;
+    /**
+     * Set by `match()`: the last record read for this operator listed the origin
+     * with the role and is still within the seller's outage bound
+     * (`maxOutageContinuationSeconds` past its freshness). Only then may non-spend
+     * calls continue under a binding.
+     */
+    lastKnownListed: boolean;
+    constructor();
+}
+/**
+ * The operator's last record read does not list the origin with the required
+ * role (`unlisted`; operators retire agents by publishing an empty `agents[]`),
+ * or the operator has never published one (`absent`).
+ */
+export declare class TrustMembershipError extends IdentityAuthorizationError {
+    readonly membership: 'unlisted' | 'absent';
+    constructor(membership?: 'unlisted' | 'absent');
+}
+/** Schema plus semantic checks; publication never includes identity keys. */
+export declare function validateTrustRecord(value: unknown): asserts value is TrustRecord;
+export declare function createTrustRecord(record: TrustRecord): TrustRecord;
+export type TrustFetchResult = {
+    status: 'present';
+    operator: string;
+    record: TrustRecord;
+    checkedAt: number;
+    freshUntil: number;
+} | {
+    status: 'absent';
+    operator: string;
+    checkedAt: number;
+    freshUntil: number;
+};
+export interface TrustEvaluatorOptions {
+    /** Matches configured revocation polling: one minute through thirty minutes. */
+    pollingIntervalSeconds?: number;
+    /**
+     * Seller policy: how long past the last listing record's freshness a bound
+     * origin's non-spend calls may continue while its operator's record cannot
+     * be read. Spend never continues on an outage. Default four polling
+     * intervals.
+     */
+    maxOutageContinuationSeconds?: number;
+    now?: () => number;
+    fetchOptions?: Pick<SsrfFetchOptions, 'lookup' | 'trustedFetchFn'>;
+    maxEntries?: number;
+    /**
+     * Process-local authority history only: operators remembered per hosting
+     * provider, i.e. per ICANN registrable domain of a PSL PRIVATE-section name
+     * (every `*.vercel.app`, `*.s3.<region>.amazonaws.com` or
+     * `*.<project>.platformsh.site` operator shares one budget). ICANN
+     * registrable domains each count once. Default 32.
+     */
+    maxAuthoritativeOperatorsPerPrivateSuffix?: number;
+    /**
+     * Process-local authority history only: total slots all PRIVATE-section
+     * operators may hold together, so registrants of ICANN domains always keep
+     * headroom. Default half of `maxEntries`.
+     */
+    maxPrivateAuthoritativeOperators?: number;
+    maxConcurrentFetches?: number;
+    /** Share authoritative-history across restarts/replicas when legacy fallback is enabled. */
+    authorityHistory?: {
+        has(operator: string): Promise<boolean>;
+        mark(operator: string): Promise<void>;
+    };
+}
+/** Used by binding/grants/onboarding, never by cryptographic verification. */
+export declare class TrustEvaluator {
+    private readonly options;
+    private readonly cache;
+    private readonly negative;
+    private readonly pending;
+    private readonly urlRequests;
+    /** Keyed by (operator, host): one operator's authoritative_location hops never spend another's budget. */
+    private readonly hostRates;
+    private readonly authoritativeOperators;
+    /** Remembered authoritative operators per budget group (see authorityGroup). */
+    private readonly authorityGroups;
+    private privateAuthorityOperators;
+    readonly pollingIntervalSeconds: number;
+    readonly maxOutageContinuationSeconds: number;
+    constructor(options?: TrustEvaluatorOptions);
+    get(domainOrOrigin: string, force?: boolean): Promise<TrustFetchResult>;
+    match(origin: string, role: string, countries?: readonly string[]): Promise<{
+        operator: string;
+        agent: TrustAgent;
+        record: TrustRecord;
+        freshUntil: number;
+    }>;
+    invalidate(domain: string): void;
+    /**
+     * Record that `operator` served a trust record. With durable history the
+     * in-memory set is only a cache and may evict; without it, nothing is
+     * evicted and an operator over its group budget or the total is refused.
+     */
+    private rememberAuthority;
+    /**
+     * Process-local view only. With durable `authorityHistory` this set is a
+     * cache and may have evicted an operator that durable history still records.
+     */
+    hasAuthoritativeRecord(domain: string): boolean;
+    private now;
+    private request;
+    private fetch;
+}
+export interface DemandGrantClaim {
+    /** Only pass identity from an actual verifier. */
+    signerOrigin: string;
+    brand: {
+        domain: string;
+        brand_id?: string;
+        countries?: readonly string[];
+    };
+    accountOperator: string;
+    scope: string;
+}
+export interface DemandGrantAuthorization {
+    source: 'implicit' | 'trust' | 'seller' | 'legacy';
+    operator: string;
+    expiresAt?: number;
+    checkedAt: number;
+    chain: string[];
+}
+export interface DemandGrantOptions {
+    evaluator: TrustEvaluator;
+    now?: () => number;
+    /** Only evaluated for nonexclusive uncovered claims, never fetch failures. */
+    sellerAuthorization?: (claim: DemandGrantClaim) => Promise<boolean>;
+    /** Only for authoritative absence; never after a 200 or an exclusive record. */
+    legacyAuthorization?: (claim: DemandGrantClaim) => Promise<boolean>;
+    /** Seller-verified brand identity resolution, including the house's child-brand ID. Never accept a buyer-selected authorizer. */
+    resolveBrandHouse?: (brand: DemandGrantClaim['brand']) => Promise<{
+        domain: string;
+        brand_id: string;
+    } | undefined>;
+}
+/** Always invoke before sync_accounts side effects and before spend. No account mutation. */
+export declare function authorizeDemandGrant(claim: DemandGrantClaim, options: DemandGrantOptions): Promise<DemandGrantAuthorization>;