@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/dist/lib/identity-3.3/revocation.d.ts

@@ -0,0 +1,86 @@
+import { type JWK } from 'jose';
+import { type SsrfFetchOptions } from '../net';
+import type { RevocationDetail } from './types';
+export interface OriginRevocationSnapshot {
+    issuer: string;
+    updated: string;
+    next_update: string;
+    revoked_kids: string[];
+    revoked_jtis?: string[];
+    revocation_details?: Record<string, RevocationDetail>;
+}
+export interface MonotonicOriginRevocationStore {
+    /** Merge atomically and persist forever. Never replace with a new snapshot. */
+    merge(origin: string, snapshot: OriginRevocationSnapshot): Promise<void>;
+    get(origin: string, keyid: string): Promise<RevocationDetail | undefined>;
+}
+/**
+ * Process-local revocation history for development and tests. Public
+ * deployments need durable history (`createIdentity33StateStores`) so a
+ * restart never forgets a revocation.
+ *
+ * Capacity is bounded per origin, per operator (registrable domain) and in
+ * total. The operator budget stops one registrable domain's wildcard
+ * subdomains from filling the store alone; it does not reserve capacity for
+ * anyone else, so several operators together can still exhaust the total.
+ * Facts are never evicted to regain capacity; a refused merge fails closed.
+ */
+export declare class InMemoryOriginRevocationStore implements MonotonicOriginRevocationStore {
+    readonly durability: "process-local";
+    private readonly revoked;
+    private readonly originKeys;
+    private readonly operatorKeys;
+    private readonly limits;
+    constructor(limits?: {
+        perOrigin?: number;
+        perOperator?: number;
+        total?: number;
+    });
+    merge(origin: string, snapshot: OriginRevocationSnapshot): Promise<void>;
+    get(origin: string, keyid: string): Promise<RevocationDetail | undefined>;
+}
+/** See {@link OriginRevocationResolver.status}. */
+export type OriginRevocationStatus = 'revoked' | 'current' | 'absent' | 'unknown';
+export declare class OriginRevocationResolver {
+    private readonly options;
+    private readonly freshness;
+    private readonly updated;
+    private readonly graceUntil;
+    private readonly pending;
+    private readonly failures;
+    private readonly persistenceFailures;
+    private readonly absentUntil;
+    constructor(options: {
+        directory: import('../signing/web-bot-auth').SignatureDirectoryResolver;
+        store: MonotonicOriginRevocationStore;
+        pollingIntervalSeconds?: number;
+        now?: () => number;
+        fetchOptions?: Pick<SsrfFetchOptions, 'lookup' | 'trustedFetchFn'>;
+        maxOrigins?: number;
+    });
+    /**
+     * Compatibility wrapper over {@link status}: `true` when revoked, `false`
+     * when the list is current, and `revocation_unavailable` when the identity
+     * publishes no list (`absent`) or its status is not known (`unknown`).
+     */
+    isRevoked(originUrl: string, keyid: string): Promise<boolean>;
+    /**
+     * Revocation status of `keyid` at `origin`:
+     * - `revoked`: a stored (permanent) revocation covers the key.
+     * - `current`: a signed list is current, or within `next_update` + grace.
+     * - `absent`: the origin serves no list (404/410). The identity is still
+     *   established but cannot be bound for spend.
+     * - `unknown`: no list could be verified and grace has passed (or there was
+     *   never a list). The identity is not established.
+     * Throws {@link WebBotAuthUnavailableError} (`revocation_persistence_failed`)
+     * when the history store fails: an infrastructure outage, never a
+     * revocation outcome.
+     */
+    status(originUrl: string, keyid: string): Promise<OriginRevocationStatus>;
+    private currentStatus;
+    private readStored;
+    private refresh;
+    private now;
+}
+/** Publish a signed list even when there are no revoked keys; refresh before next_update. */
+export declare function createSignedOriginRevocationList(snapshot: OriginRevocationSnapshot, privateKey: JWK): Promise<string>;

package/dist/lib/identity-3.3/revocation.js

@@ -0,0 +1,308 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var revocation_exports = {};
+__export(revocation_exports, {
+  InMemoryOriginRevocationStore: () => InMemoryOriginRevocationStore,
+  OriginRevocationResolver: () => OriginRevocationResolver,
+  createSignedOriginRevocationList: () => createSignedOriginRevocationList,
+  mergeRevocationDetail: () => import_revocation.mergeRevocationDetails
+});
+module.exports = __toCommonJS(revocation_exports);
+var import_etld = require('../signing/agent-resolver/etld.js');
+var import_jose = require("jose");
+var import_net = require('../net/index.js');
+var import_canonicalize = require('../signing/agent-resolver/canonicalize.js');
+var import_strict_json = require('../signing/agent-resolver/strict-json.js');
+var import_web_bot_auth = require('../signing/web-bot-auth.js');
+var import_revocation = require('../signing/revocation.js');
+var import_revocation2 = require('../signing/revocation.js');
+const REASONS = [
+  "removeFromCRL",
+  "unspecified",
+  "superseded",
+  "cessationOfOperation",
+  "affiliationChanged",
+  "certificateHold",
+  "privilegeWithdrawn",
+  "aACompromise",
+  "cACompromise",
+  "keyCompromise"
+];
+class InMemoryOriginRevocationStore {
+  durability = "process-local";
+  revoked = /* @__PURE__ */ new Map();
+  originKeys = /* @__PURE__ */ new Map();
+  operatorKeys = /* @__PURE__ */ new Map();
+  limits;
+  constructor(limits = {}) {
+    this.limits = {
+      perOrigin: limits.perOrigin ?? 16384,
+      perOperator: limits.perOperator ?? 16384,
+      total: limits.total ?? 1e5
+    };
+    if (Object.values(this.limits).some((value) => !Number.isSafeInteger(value) || value < 1))
+      throw new TypeError("Revocation limits must be positive safe integers");
+  }
+  async merge(origin, snapshot) {
+    origin = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+    const operator = operatorOf(origin);
+    const additions = new Set(snapshot.revoked_kids.filter((kid) => !this.revoked.has(JSON.stringify([origin, kid]))));
+    const originCount = this.originKeys.get(origin) ?? 0, operatorCount = this.operatorKeys.get(operator) ?? 0;
+    if (originCount + additions.size > this.limits.perOrigin || operatorCount + additions.size > this.limits.perOperator || this.revoked.size + additions.size > this.limits.total)
+      throw new import_web_bot_auth.WebBotAuthError(403, "revocation_storage_limit");
+    for (const kid of snapshot.revoked_kids) {
+      const key = JSON.stringify([origin, kid]), prior = this.revoked.get(key), detail = snapshot.revocation_details?.[kid] ?? {};
+      this.revoked.set(key, (0, import_revocation2.mergeRevocationDetails)(prior, detail));
+    }
+    if (additions.size) {
+      this.originKeys.set(origin, originCount + additions.size);
+      this.operatorKeys.set(operator, operatorCount + additions.size);
+    }
+  }
+  async get(origin, keyid) {
+    const entry = this.revoked.get(JSON.stringify([(0, import_canonicalize.canonicalAgentOrigin)(origin), keyid]));
+    return entry && { ...entry };
+  }
+}
+function operatorOf(origin) {
+  try {
+    return (0, import_etld.eTldPlusOne)(origin);
+  } catch {
+    return new URL(origin).hostname;
+  }
+}
+const MAX_POLLING_SECONDS = 1800;
+class RevocationListAbsentError extends Error {
+}
+class OriginRevocationResolver {
+  constructor(options) {
+    this.options = options;
+    if (!(options.directory instanceof import_web_bot_auth.SignatureDirectoryResolver))
+      throw new TypeError("Origin revocation requires a verified SignatureDirectoryResolver");
+    if (!Number.isFinite(options.pollingIntervalSeconds ?? 300) || (options.pollingIntervalSeconds ?? 300) < 60 || (options.pollingIntervalSeconds ?? 300) > 1800)
+      throw new TypeError("Invalid revocation polling interval");
+  }
+  options;
+  freshness = /* @__PURE__ */ new Map();
+  updated = /* @__PURE__ */ new Map();
+  graceUntil = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  failures = /* @__PURE__ */ new Map();
+  persistenceFailures = /* @__PURE__ */ new Set();
+  absentUntil = /* @__PURE__ */ new Map();
+  /**
+   * Compatibility wrapper over {@link status}: `true` when revoked, `false`
+   * when the list is current, and `revocation_unavailable` when the identity
+   * publishes no list (`absent`) or its status is not known (`unknown`).
+   */
+  async isRevoked(originUrl, keyid) {
+    const state = await this.status(originUrl, keyid);
+    if (state === "revoked") return true;
+    if (state === "current") return false;
+    throw new import_web_bot_auth.WebBotAuthError(403, state === "absent" ? "revocation_absent" : "revocation_unavailable");
+  }
+  /**
+   * Revocation status of `keyid` at `origin`:
+   * - `revoked`: a stored (permanent) revocation covers the key.
+   * - `current`: a signed list is current, or within `next_update` + grace.
+   * - `absent`: the origin serves no list (404/410). The identity is still
+   *   established but cannot be bound for spend.
+   * - `unknown`: no list could be verified and grace has passed (or there was
+   *   never a list). The identity is not established.
+   * Throws {@link WebBotAuthUnavailableError} (`revocation_persistence_failed`)
+   * when the history store fails: an infrastructure outage, never a
+   * revocation outcome.
+   */
+  async status(originUrl, keyid) {
+    try {
+      return await this.currentStatus(originUrl, keyid);
+    } catch (error) {
+      if (error instanceof import_web_bot_auth.WebBotAuthError && error.reason === "revocation_persistence_failed")
+        throw new import_web_bot_auth.WebBotAuthUnavailableError("revocation_persistence_failed", error);
+      throw error;
+    }
+  }
+  async currentStatus(originUrl, keyid) {
+    const origin = (0, import_canonicalize.canonicalAgentOrigin)(originUrl), now = this.now();
+    if (await this.readStored(origin, keyid)) return "revoked";
+    const settled = async () => {
+      if (await this.readStored(origin, keyid)) return "revoked";
+      if ((this.absentUntil.get(origin) ?? 0) > now) return "absent";
+      return (this.freshness.get(origin) ?? 0) > now || (this.graceUntil.get(origin) ?? 0) > now ? "current" : "unknown";
+    };
+    if ((this.freshness.get(origin) ?? 0) <= now) {
+      if ((this.failures.get(origin) ?? 0) > now) {
+        if (this.persistenceFailures.has(origin)) throw new import_web_bot_auth.WebBotAuthError(403, "revocation_persistence_failed");
+        return settled();
+      }
+      let promise = this.pending.get(origin);
+      if (!promise) {
+        if (this.pending.size >= 16 || [...this.pending.keys()].filter((pendingOrigin) => operatorOf(pendingOrigin) === operatorOf(origin)).length >= 2) {
+          return settled();
+        }
+        promise = this.refresh(origin).catch((error) => {
+          if (this.failures.size >= (this.options.maxOrigins ?? 1e3)) {
+            const oldest = this.failures.keys().next().value;
+            this.failures.delete(oldest);
+            this.persistenceFailures.delete(oldest);
+            this.absentUntil.delete(oldest);
+          }
+          this.failures.set(origin, now + 60);
+          if (error instanceof import_web_bot_auth.WebBotAuthError && error.reason === "revocation_persistence_failed") {
+            this.persistenceFailures.add(origin);
+            this.graceUntil.delete(origin);
+          }
+          if (error.cause instanceof RevocationListAbsentError) {
+            this.absentUntil.set(origin, now + 60);
+            this.graceUntil.delete(origin);
+          }
+          throw error;
+        });
+        this.pending.set(origin, promise);
+      }
+      try {
+        await promise;
+      } catch (error) {
+        if (error instanceof import_web_bot_auth.WebBotAuthError && error.reason === "revocation_persistence_failed") throw error;
+      } finally {
+        if (this.pending.get(origin) === promise) this.pending.delete(origin);
+      }
+    }
+    return settled();
+  }
+  async readStored(origin, keyid) {
+    try {
+      return await this.options.store.get(origin, keyid);
+    } catch (cause) {
+      const error = new import_web_bot_auth.WebBotAuthError(403, "revocation_persistence_failed");
+      Object.defineProperty(error, "cause", { value: cause });
+      throw error;
+    }
+  }
+  async refresh(origin) {
+    try {
+      const response = await (0, import_net.ssrfSafeFetch)(origin + "/.well-known/governance-revocations.json", {
+        ...this.options.fetchOptions,
+        maxBodyBytes: 256 * 1024,
+        timeoutMs: 1e4
+      });
+      if (response.status === 404 || response.status === 410) throw new RevocationListAbsentError();
+      if (response.status !== 200) throw new Error("Unavailable revocation list");
+      const body = new TextDecoder("utf-8", { fatal: true }).decode(response.body);
+      let tokens;
+      if (body.trim().startsWith("{")) {
+        const envelope = (0, import_strict_json.parseStrictJson)(body, 32);
+        if (typeof envelope.jws === "string") tokens = [envelope.jws];
+        else {
+          if ("header" in envelope) throw new Error("Revocation metadata must be protected");
+          const signatures = envelope.signatures ?? (envelope.protected && envelope.signature ? [{ protected: envelope.protected, signature: envelope.signature }] : []);
+          if (typeof envelope.payload !== "string" || !Array.isArray(signatures) || !signatures.length || signatures.length > 64)
+            throw new Error("Invalid JWS revocation envelope");
+          tokens = signatures.map((signature) => {
+            if (typeof signature.protected !== "string" || typeof signature.signature !== "string" || signature.header !== void 0)
+              throw new Error("Revocation metadata must be protected");
+            return `${signature.protected}.${envelope.payload}.${signature.signature}`;
+          });
+        }
+      } else tokens = [body.trim()];
+      let verifiedPayload;
+      for (const token of tokens) {
+        try {
+          const header = (0, import_jose.decodeProtectedHeader)(token);
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
+            continue;
+          await this.options.directory.resolve(header.kid, origin);
+          const checked = this.options.directory.getVerifiedDirectory(origin);
+          if (!checked || new URL(checked.proof.request.url).origin !== origin || checked.expires <= this.now())
+            continue;
+          const jwk = checked.keys.find((key) => key.kid === header.kid);
+          if (!jwk) continue;
+          const result = await (0, import_jose.compactVerify)(token, await (0, import_jose.importJWK)(jwk, header.alg), {
+            algorithms: ["EdDSA", "ES256"]
+          });
+          verifiedPayload = result.payload;
+          break;
+        } catch {
+        }
+      }
+      if (!verifiedPayload) throw new Error("No valid protected revocation signature");
+      const snapshot = (0, import_strict_json.parseStrictJson)(
+        new TextDecoder("utf-8", { fatal: true }).decode(verifiedPayload),
+        32
+      );
+      const updated = Date.parse(snapshot.updated) / 1e3, next = Date.parse(snapshot.next_update) / 1e3, now = this.now();
+      if (snapshot.issuer !== origin || !Number.isFinite(updated) || !Number.isFinite(next) || // Tolerate a publisher clock slightly ahead, as for request `created`.
+      updated > now + 60 || next <= now || next <= updated || !Array.isArray(snapshot.revoked_kids) || snapshot.revoked_kids.length > 4096 || snapshot.revoked_kids.some((k) => typeof k !== "string" || k.length > 256) || updated < (this.updated.get(origin) ?? 0))
+        throw new Error("Invalid revocation snapshot");
+      for (const [kid, detail] of Object.entries(snapshot.revocation_details ?? {}))
+        if (!snapshot.revoked_kids.includes(kid) || !detail || detail.reason && !REASONS.includes(detail.reason) || detail.invalidity_date && !Number.isFinite(Date.parse(detail.invalidity_date)))
+          throw new Error("Invalid revocation detail");
+      try {
+        await this.options.store.merge(origin, snapshot);
+      } catch (cause) {
+        const error = new import_web_bot_auth.WebBotAuthError(403, "revocation_persistence_failed");
+        Object.defineProperty(error, "cause", { value: cause });
+        throw error;
+      }
+      if (!this.freshness.has(origin) && this.freshness.size >= (this.options.maxOrigins ?? 1e3)) {
+        const oldest = this.freshness.keys().next().value;
+        this.freshness.delete(oldest);
+        this.updated.delete(oldest);
+        this.graceUntil.delete(oldest);
+      }
+      this.graceUntil.set(
+        origin,
+        Math.min(next, now + MAX_POLLING_SECONDS) + 4 * (this.options.pollingIntervalSeconds ?? 300)
+      );
+      this.updated.set(origin, updated);
+      this.freshness.set(origin, Math.min(next, now + (this.options.pollingIntervalSeconds ?? 300)));
+      this.failures.delete(origin);
+      this.persistenceFailures.delete(origin);
+      this.absentUntil.delete(origin);
+    } catch (cause) {
+      if (cause instanceof import_web_bot_auth.WebBotAuthError && cause.reason === "revocation_persistence_failed") throw cause;
+      const error = new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");
+      Object.defineProperty(error, "cause", { value: cause });
+      throw error;
+    }
+  }
+  now() {
+    const now = (this.options.now ?? (() => Date.now() / 1e3))();
+    if (!Number.isFinite(now)) throw new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");
+    return now;
+  }
+}
+async function createSignedOriginRevocationList(snapshot, privateKey) {
+  const issuer = (0, import_canonicalize.canonicalAgentOrigin)(snapshot.issuer), now = Date.now() / 1e3;
+  if (issuer !== snapshot.issuer || !Number.isFinite(Date.parse(snapshot.updated)) || !Number.isFinite(Date.parse(snapshot.next_update)) || Date.parse(snapshot.updated) / 1e3 > now || Date.parse(snapshot.next_update) / 1e3 <= now || Date.parse(snapshot.next_update) / 1e3 > now + 1800 || !Array.isArray(snapshot.revoked_kids))
+    throw new TypeError("Invalid origin revocation snapshot");
+  const kid = (0, import_web_bot_auth.jwkThumbprint)(privateKey);
+  if (privateKey.kid && privateKey.kid !== kid)
+    throw new TypeError("Revocation signing kid must be the JWK thumbprint");
+  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.crv === "P-256" ? "ES256" : void 0;
+  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or P-256 key");
+  return new import_jose.CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await (0, import_jose.importJWK)(privateKey, alg));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  InMemoryOriginRevocationStore,
+  OriginRevocationResolver,
+  createSignedOriginRevocationList,
+  mergeRevocationDetail
+});

package/dist/lib/identity-3.3/revocation.mjs

@@ -0,0 +1,286 @@
+import { eTldPlusOne } from "../signing/agent-resolver/etld.mjs";
+import { CompactSign, compactVerify, decodeProtectedHeader, importJWK } from "jose";
+import { ssrfSafeFetch } from "../net/index.mjs";
+import { canonicalAgentOrigin } from "../signing/agent-resolver/canonicalize.mjs";
+import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
+import {
+  SignatureDirectoryResolver,
+  WebBotAuthError,
+  WebBotAuthUnavailableError,
+  jwkThumbprint
+} from "../signing/web-bot-auth.mjs";
+const REASONS = [
+  "removeFromCRL",
+  "unspecified",
+  "superseded",
+  "cessationOfOperation",
+  "affiliationChanged",
+  "certificateHold",
+  "privilegeWithdrawn",
+  "aACompromise",
+  "cACompromise",
+  "keyCompromise"
+];
+import { mergeRevocationDetails } from "../signing/revocation.mjs";
+import { mergeRevocationDetails as mergeRevocationDetail } from "../signing/revocation.mjs";
+class InMemoryOriginRevocationStore {
+  durability = "process-local";
+  revoked = /* @__PURE__ */ new Map();
+  originKeys = /* @__PURE__ */ new Map();
+  operatorKeys = /* @__PURE__ */ new Map();
+  limits;
+  constructor(limits = {}) {
+    this.limits = {
+      perOrigin: limits.perOrigin ?? 16384,
+      perOperator: limits.perOperator ?? 16384,
+      total: limits.total ?? 1e5
+    };
+    if (Object.values(this.limits).some((value) => !Number.isSafeInteger(value) || value < 1))
+      throw new TypeError("Revocation limits must be positive safe integers");
+  }
+  async merge(origin, snapshot) {
+    origin = canonicalAgentOrigin(origin);
+    const operator = operatorOf(origin);
+    const additions = new Set(snapshot.revoked_kids.filter((kid) => !this.revoked.has(JSON.stringify([origin, kid]))));
+    const originCount = this.originKeys.get(origin) ?? 0, operatorCount = this.operatorKeys.get(operator) ?? 0;
+    if (originCount + additions.size > this.limits.perOrigin || operatorCount + additions.size > this.limits.perOperator || this.revoked.size + additions.size > this.limits.total)
+      throw new WebBotAuthError(403, "revocation_storage_limit");
+    for (const kid of snapshot.revoked_kids) {
+      const key = JSON.stringify([origin, kid]), prior = this.revoked.get(key), detail = snapshot.revocation_details?.[kid] ?? {};
+      this.revoked.set(key, mergeRevocationDetail(prior, detail));
+    }
+    if (additions.size) {
+      this.originKeys.set(origin, originCount + additions.size);
+      this.operatorKeys.set(operator, operatorCount + additions.size);
+    }
+  }
+  async get(origin, keyid) {
+    const entry = this.revoked.get(JSON.stringify([canonicalAgentOrigin(origin), keyid]));
+    return entry && { ...entry };
+  }
+}
+function operatorOf(origin) {
+  try {
+    return eTldPlusOne(origin);
+  } catch {
+    return new URL(origin).hostname;
+  }
+}
+const MAX_POLLING_SECONDS = 1800;
+class RevocationListAbsentError extends Error {
+}
+class OriginRevocationResolver {
+  constructor(options) {
+    this.options = options;
+    if (!(options.directory instanceof SignatureDirectoryResolver))
+      throw new TypeError("Origin revocation requires a verified SignatureDirectoryResolver");
+    if (!Number.isFinite(options.pollingIntervalSeconds ?? 300) || (options.pollingIntervalSeconds ?? 300) < 60 || (options.pollingIntervalSeconds ?? 300) > 1800)
+      throw new TypeError("Invalid revocation polling interval");
+  }
+  options;
+  freshness = /* @__PURE__ */ new Map();
+  updated = /* @__PURE__ */ new Map();
+  graceUntil = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  failures = /* @__PURE__ */ new Map();
+  persistenceFailures = /* @__PURE__ */ new Set();
+  absentUntil = /* @__PURE__ */ new Map();
+  /**
+   * Compatibility wrapper over {@link status}: `true` when revoked, `false`
+   * when the list is current, and `revocation_unavailable` when the identity
+   * publishes no list (`absent`) or its status is not known (`unknown`).
+   */
+  async isRevoked(originUrl, keyid) {
+    const state = await this.status(originUrl, keyid);
+    if (state === "revoked") return true;
+    if (state === "current") return false;
+    throw new WebBotAuthError(403, state === "absent" ? "revocation_absent" : "revocation_unavailable");
+  }
+  /**
+   * Revocation status of `keyid` at `origin`:
+   * - `revoked`: a stored (permanent) revocation covers the key.
+   * - `current`: a signed list is current, or within `next_update` + grace.
+   * - `absent`: the origin serves no list (404/410). The identity is still
+   *   established but cannot be bound for spend.
+   * - `unknown`: no list could be verified and grace has passed (or there was
+   *   never a list). The identity is not established.
+   * Throws {@link WebBotAuthUnavailableError} (`revocation_persistence_failed`)
+   * when the history store fails: an infrastructure outage, never a
+   * revocation outcome.
+   */
+  async status(originUrl, keyid) {
+    try {
+      return await this.currentStatus(originUrl, keyid);
+    } catch (error) {
+      if (error instanceof WebBotAuthError && error.reason === "revocation_persistence_failed")
+        throw new WebBotAuthUnavailableError("revocation_persistence_failed", error);
+      throw error;
+    }
+  }
+  async currentStatus(originUrl, keyid) {
+    const origin = canonicalAgentOrigin(originUrl), now = this.now();
+    if (await this.readStored(origin, keyid)) return "revoked";
+    const settled = async () => {
+      if (await this.readStored(origin, keyid)) return "revoked";
+      if ((this.absentUntil.get(origin) ?? 0) > now) return "absent";
+      return (this.freshness.get(origin) ?? 0) > now || (this.graceUntil.get(origin) ?? 0) > now ? "current" : "unknown";
+    };
+    if ((this.freshness.get(origin) ?? 0) <= now) {
+      if ((this.failures.get(origin) ?? 0) > now) {
+        if (this.persistenceFailures.has(origin)) throw new WebBotAuthError(403, "revocation_persistence_failed");
+        return settled();
+      }
+      let promise = this.pending.get(origin);
+      if (!promise) {
+        if (this.pending.size >= 16 || [...this.pending.keys()].filter((pendingOrigin) => operatorOf(pendingOrigin) === operatorOf(origin)).length >= 2) {
+          return settled();
+        }
+        promise = this.refresh(origin).catch((error) => {
+          if (this.failures.size >= (this.options.maxOrigins ?? 1e3)) {
+            const oldest = this.failures.keys().next().value;
+            this.failures.delete(oldest);
+            this.persistenceFailures.delete(oldest);
+            this.absentUntil.delete(oldest);
+          }
+          this.failures.set(origin, now + 60);
+          if (error instanceof WebBotAuthError && error.reason === "revocation_persistence_failed") {
+            this.persistenceFailures.add(origin);
+            this.graceUntil.delete(origin);
+          }
+          if (error.cause instanceof RevocationListAbsentError) {
+            this.absentUntil.set(origin, now + 60);
+            this.graceUntil.delete(origin);
+          }
+          throw error;
+        });
+        this.pending.set(origin, promise);
+      }
+      try {
+        await promise;
+      } catch (error) {
+        if (error instanceof WebBotAuthError && error.reason === "revocation_persistence_failed") throw error;
+      } finally {
+        if (this.pending.get(origin) === promise) this.pending.delete(origin);
+      }
+    }
+    return settled();
+  }
+  async readStored(origin, keyid) {
+    try {
+      return await this.options.store.get(origin, keyid);
+    } catch (cause) {
+      const error = new WebBotAuthError(403, "revocation_persistence_failed");
+      Object.defineProperty(error, "cause", { value: cause });
+      throw error;
+    }
+  }
+  async refresh(origin) {
+    try {
+      const response = await ssrfSafeFetch(origin + "/.well-known/governance-revocations.json", {
+        ...this.options.fetchOptions,
+        maxBodyBytes: 256 * 1024,
+        timeoutMs: 1e4
+      });
+      if (response.status === 404 || response.status === 410) throw new RevocationListAbsentError();
+      if (response.status !== 200) throw new Error("Unavailable revocation list");
+      const body = new TextDecoder("utf-8", { fatal: true }).decode(response.body);
+      let tokens;
+      if (body.trim().startsWith("{")) {
+        const envelope = parseStrictJson(body, 32);
+        if (typeof envelope.jws === "string") tokens = [envelope.jws];
+        else {
+          if ("header" in envelope) throw new Error("Revocation metadata must be protected");
+          const signatures = envelope.signatures ?? (envelope.protected && envelope.signature ? [{ protected: envelope.protected, signature: envelope.signature }] : []);
+          if (typeof envelope.payload !== "string" || !Array.isArray(signatures) || !signatures.length || signatures.length > 64)
+            throw new Error("Invalid JWS revocation envelope");
+          tokens = signatures.map((signature) => {
+            if (typeof signature.protected !== "string" || typeof signature.signature !== "string" || signature.header !== void 0)
+              throw new Error("Revocation metadata must be protected");
+            return `${signature.protected}.${envelope.payload}.${signature.signature}`;
+          });
+        }
+      } else tokens = [body.trim()];
+      let verifiedPayload;
+      for (const token of tokens) {
+        try {
+          const header = decodeProtectedHeader(token);
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
+            continue;
+          await this.options.directory.resolve(header.kid, origin);
+          const checked = this.options.directory.getVerifiedDirectory(origin);
+          if (!checked || new URL(checked.proof.request.url).origin !== origin || checked.expires <= this.now())
+            continue;
+          const jwk = checked.keys.find((key) => key.kid === header.kid);
+          if (!jwk) continue;
+          const result = await compactVerify(token, await importJWK(jwk, header.alg), {
+            algorithms: ["EdDSA", "ES256"]
+          });
+          verifiedPayload = result.payload;
+          break;
+        } catch {
+        }
+      }
+      if (!verifiedPayload) throw new Error("No valid protected revocation signature");
+      const snapshot = parseStrictJson(
+        new TextDecoder("utf-8", { fatal: true }).decode(verifiedPayload),
+        32
+      );
+      const updated = Date.parse(snapshot.updated) / 1e3, next = Date.parse(snapshot.next_update) / 1e3, now = this.now();
+      if (snapshot.issuer !== origin || !Number.isFinite(updated) || !Number.isFinite(next) || // Tolerate a publisher clock slightly ahead, as for request `created`.
+      updated > now + 60 || next <= now || next <= updated || !Array.isArray(snapshot.revoked_kids) || snapshot.revoked_kids.length > 4096 || snapshot.revoked_kids.some((k) => typeof k !== "string" || k.length > 256) || updated < (this.updated.get(origin) ?? 0))
+        throw new Error("Invalid revocation snapshot");
+      for (const [kid, detail] of Object.entries(snapshot.revocation_details ?? {}))
+        if (!snapshot.revoked_kids.includes(kid) || !detail || detail.reason && !REASONS.includes(detail.reason) || detail.invalidity_date && !Number.isFinite(Date.parse(detail.invalidity_date)))
+          throw new Error("Invalid revocation detail");
+      try {
+        await this.options.store.merge(origin, snapshot);
+      } catch (cause) {
+        const error = new WebBotAuthError(403, "revocation_persistence_failed");
+        Object.defineProperty(error, "cause", { value: cause });
+        throw error;
+      }
+      if (!this.freshness.has(origin) && this.freshness.size >= (this.options.maxOrigins ?? 1e3)) {
+        const oldest = this.freshness.keys().next().value;
+        this.freshness.delete(oldest);
+        this.updated.delete(oldest);
+        this.graceUntil.delete(oldest);
+      }
+      this.graceUntil.set(
+        origin,
+        Math.min(next, now + MAX_POLLING_SECONDS) + 4 * (this.options.pollingIntervalSeconds ?? 300)
+      );
+      this.updated.set(origin, updated);
+      this.freshness.set(origin, Math.min(next, now + (this.options.pollingIntervalSeconds ?? 300)));
+      this.failures.delete(origin);
+      this.persistenceFailures.delete(origin);
+      this.absentUntil.delete(origin);
+    } catch (cause) {
+      if (cause instanceof WebBotAuthError && cause.reason === "revocation_persistence_failed") throw cause;
+      const error = new WebBotAuthError(403, "revocation_unavailable");
+      Object.defineProperty(error, "cause", { value: cause });
+      throw error;
+    }
+  }
+  now() {
+    const now = (this.options.now ?? (() => Date.now() / 1e3))();
+    if (!Number.isFinite(now)) throw new WebBotAuthError(403, "revocation_unavailable");
+    return now;
+  }
+}
+async function createSignedOriginRevocationList(snapshot, privateKey) {
+  const issuer = canonicalAgentOrigin(snapshot.issuer), now = Date.now() / 1e3;
+  if (issuer !== snapshot.issuer || !Number.isFinite(Date.parse(snapshot.updated)) || !Number.isFinite(Date.parse(snapshot.next_update)) || Date.parse(snapshot.updated) / 1e3 > now || Date.parse(snapshot.next_update) / 1e3 <= now || Date.parse(snapshot.next_update) / 1e3 > now + 1800 || !Array.isArray(snapshot.revoked_kids))
+    throw new TypeError("Invalid origin revocation snapshot");
+  const kid = jwkThumbprint(privateKey);
+  if (privateKey.kid && privateKey.kid !== kid)
+    throw new TypeError("Revocation signing kid must be the JWK thumbprint");
+  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.crv === "P-256" ? "ES256" : void 0;
+  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or P-256 key");
+  return new CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await importJWK(privateKey, alg));
+}
+export {
+  InMemoryOriginRevocationStore,
+  OriginRevocationResolver,
+  createSignedOriginRevocationList,
+  mergeRevocationDetails as mergeRevocationDetail
+};