@adcp/sdk 16.0.0-beta.1 → 16.0.0-beta.3

package/dist/lib/identity-3.3/lifecycle.d.mts

@@ -1,6 +1,6 @@
 import type { PrincipalKind } from '../server/principal/types.mjs';
 import { TrustEvaluator } from './trust.mjs';
-import type { AgentOnboarding, AgentOnboardingRequirement, BillingParty, PrincipalRelationship, IdentityPrincipalChangedReason } from './types.mjs';
+import type { AgentOnboarding, AgentOnboardingRequirement, ObservedAgentOnboardingRequirement, BillingParty, PrincipalRelationship, IdentityPrincipalChangedReason } from './types.mjs';
 export interface OriginBinding {
     origin: string;
     operator: string;
@@ -47,10 +47,13 @@ export declare class InMemoryOriginIdentityStore implements OriginIdentityStore
     getApplication(origin: string): Promise<IdentityApplication | undefined>;
     compareAndSetApplication(origin: string, expectedRevision: number | undefined, application: IdentityApplication): Promise<boolean>;
 }
-/** Wrong-direction gates are ignored; unknown gates remain unsatisfied. */
-export declare function evaluateOnboardingRequirements(requirements: readonly AgentOnboardingRequirement[], direction: 'seller' | 'buyer', check: (requirement: AgentOnboardingRequirement) => Promise<boolean>): Promise<{
+/**
+ * Wrong-direction gates are ignored; unknown gates remain unsatisfied. Accepts
+ * requirements read off the wire, whose `kind` may be one this SDK does not know.
+ */
+export declare function evaluateOnboardingRequirements<R extends ObservedAgentOnboardingRequirement = AgentOnboardingRequirement>(requirements: readonly R[], direction: 'seller' | 'buyer', check: (requirement: R) => Promise<boolean>): Promise<{
     satisfied: boolean;
-    unsatisfied: AgentOnboardingRequirement[];
+    unsatisfied: R[];
 }>;
 export declare function validateAgentOnboarding(posture: AgentOnboarding, account: {
     sandbox?: boolean;
@@ -93,7 +96,16 @@ export declare class OriginIdentityLifecycle {
         migrationApproved?: boolean;
         sharedOrigin?: boolean;
     }): Promise<OriginBinding>;
-    /** Cryptographic verification does not call this. Authorization revalidates delisting. */
+    /**
+     * Cryptographic verification does not call this. Authorization revalidates
+     * delisting: the last record read does not list the origin (an empty
+     * `agents[]` retires it; a known delisting stays delisted through a failed
+     * refresh) and throws {@link TrustMembershipError}. An unreadable record
+     * (404/410 included) throws {@link TrustRecordUnavailableError} for spend;
+     * read-only and identity-configuration calls continue under the binding only
+     * while the last record read listed the origin and is within the evaluator's
+     * `maxOutageContinuationSeconds`.
+     */
     authorizeBound(originUrl: string, access?: {
         readOnly?: true;
         identityConfiguration?: true;

package/dist/lib/identity-3.3/lifecycle.d.ts

@@ -1,6 +1,6 @@
 import type { PrincipalKind } from '../server/principal/types';
 import { TrustEvaluator } from './trust';
-import type { AgentOnboarding, AgentOnboardingRequirement, BillingParty, PrincipalRelationship, IdentityPrincipalChangedReason } from './types';
+import type { AgentOnboarding, AgentOnboardingRequirement, ObservedAgentOnboardingRequirement, BillingParty, PrincipalRelationship, IdentityPrincipalChangedReason } from './types';
 export interface OriginBinding {
     origin: string;
     operator: string;
@@ -47,10 +47,13 @@ export declare class InMemoryOriginIdentityStore implements OriginIdentityStore
     getApplication(origin: string): Promise<IdentityApplication | undefined>;
     compareAndSetApplication(origin: string, expectedRevision: number | undefined, application: IdentityApplication): Promise<boolean>;
 }
-/** Wrong-direction gates are ignored; unknown gates remain unsatisfied. */
-export declare function evaluateOnboardingRequirements(requirements: readonly AgentOnboardingRequirement[], direction: 'seller' | 'buyer', check: (requirement: AgentOnboardingRequirement) => Promise<boolean>): Promise<{
+/**
+ * Wrong-direction gates are ignored; unknown gates remain unsatisfied. Accepts
+ * requirements read off the wire, whose `kind` may be one this SDK does not know.
+ */
+export declare function evaluateOnboardingRequirements<R extends ObservedAgentOnboardingRequirement = AgentOnboardingRequirement>(requirements: readonly R[], direction: 'seller' | 'buyer', check: (requirement: R) => Promise<boolean>): Promise<{
     satisfied: boolean;
-    unsatisfied: AgentOnboardingRequirement[];
+    unsatisfied: R[];
 }>;
 export declare function validateAgentOnboarding(posture: AgentOnboarding, account: {
     sandbox?: boolean;
@@ -93,7 +96,16 @@ export declare class OriginIdentityLifecycle {
         migrationApproved?: boolean;
         sharedOrigin?: boolean;
     }): Promise<OriginBinding>;
-    /** Cryptographic verification does not call this. Authorization revalidates delisting. */
+    /**
+     * Cryptographic verification does not call this. Authorization revalidates
+     * delisting: the last record read does not list the origin (an empty
+     * `agents[]` retires it; a known delisting stays delisted through a failed
+     * refresh) and throws {@link TrustMembershipError}. An unreadable record
+     * (404/410 included) throws {@link TrustRecordUnavailableError} for spend;
+     * read-only and identity-configuration calls continue under the binding only
+     * while the last record read listed the origin and is within the evaluator's
+     * `maxOutageContinuationSeconds`.
+     */
     authorizeBound(originUrl: string, access?: {
         readOnly?: true;
         identityConfiguration?: true;

package/dist/lib/identity-3.3/lifecycle.js

@@ -66,14 +66,20 @@ class InMemoryOriginIdentityStore {
   }
 }
 const BUYER_GATES = /* @__PURE__ */ new Set(["aao_verified", "storyboard", "sandbox", "experimental_feature"]);
-const SELLER_GATES = /* @__PURE__ */ new Set(["agent_identity", "grant", "billing_entity", "contract", "credit_application"]);
+const SELLER_GATES = /* @__PURE__ */ new Set([
+  "agent_identity",
+  "grant",
+  "billing_entity",
+  "contract",
+  "credit_application"
+]);
 async function evaluateOnboardingRequirements(requirements, direction, check) {
   const relevant = direction === "seller" ? SELLER_GATES : BUYER_GATES;
   const wrong = direction === "seller" ? BUYER_GATES : SELLER_GATES;
   const unsatisfied = [];
   for (const requirement of requirements) {
     if (wrong.has(requirement.kind)) continue;
-    const wellFormed = requirement.kind !== "aao_verified" || !!requirement.role && !!requirement.verification_modes?.length && !!requirement.specialisms?.length && !!requirement.adcp_version;
+    const wellFormed = requirement.kind !== "aao_verified" || !!requirement.role && !!requirement.verification_modes?.length && !!(requirement.verified_specialisms ?? requirement.specialisms)?.length && !!requirement.adcp_version;
     const hasId = !["storyboard", "experimental_feature"].includes(requirement.kind) || !!requirement.id;
     if (!relevant.has(requirement.kind) || !wellFormed || !hasId || !await check(requirement))
       unsatisfied.push(requirement);
@@ -126,13 +132,34 @@ class OriginIdentityLifecycle {
     await this.options.store.bind(binding);
     return binding;
   }
-  /** Cryptographic verification does not call this. Authorization revalidates delisting. */
+  /**
+   * Cryptographic verification does not call this. Authorization revalidates
+   * delisting: the last record read does not list the origin (an empty
+   * `agents[]` retires it; a known delisting stays delisted through a failed
+   * refresh) and throws {@link TrustMembershipError}. An unreadable record
+   * (404/410 included) throws {@link TrustRecordUnavailableError} for spend;
+   * read-only and identity-configuration calls continue under the binding only
+   * while the last record read listed the origin and is within the evaluator's
+   * `maxOutageContinuationSeconds`.
+   */
   async authorizeBound(originUrl, access) {
     const origin = (0, import_canonicalize.canonicalAgentOrigin)(originUrl);
     const binding = await this.options.store.getBinding(origin);
     if (!binding) throw new import_trust.IdentityAuthorizationError();
-    const trust = await this.options.trust.match(origin, "adcp:buying");
-    if (binding.operator !== trust.operator) throw new import_trust.IdentityAuthorizationError();
+    try {
+      let trust;
+      try {
+        trust = await this.options.trust.match(origin, "adcp:buying");
+      } catch (error) {
+        if (error instanceof import_trust.TrustMembershipError && error.membership === "absent")
+          throw Object.assign(new import_trust.TrustRecordUnavailableError(), { cause: error });
+        throw error;
+      }
+      if (binding.operator !== trust.operator) throw new import_trust.TrustMembershipError();
+    } catch (error) {
+      if (!(error instanceof import_trust.TrustRecordUnavailableError) || !error.lastKnownListed || !(access?.readOnly || access?.identityConfiguration))
+        throw error;
+    }
     const relationship = (await this.options.store.getApplication(origin))?.relationship;
     if (!access?.readOnly && relationship && (relationship.status !== "active" || relationship.expires_at && Date.parse(relationship.expires_at) <= this.now() * 1e3))
       throw new import_trust.IdentityAuthorizationError();

package/dist/lib/identity-3.3/lifecycle.mjs

@@ -2,7 +2,12 @@ import { randomUUID } from "crypto";
 import { parse as parseTld } from "tldts";
 import { canonicalAgentOrigin } from "../signing/agent-resolver/canonicalize.mjs";
 import { eTldPlusOne } from "../signing/agent-resolver/etld.mjs";
-import { IdentityAuthorizationError, validateIdentity33Schema } from "./trust.mjs";
+import {
+  IdentityAuthorizationError,
+  TrustMembershipError,
+  TrustRecordUnavailableError,
+  validateIdentity33Schema
+} from "./trust.mjs";
 class InMemoryOriginIdentityStore {
   durability = "process-local";
   bindings = /* @__PURE__ */ new Map();
@@ -40,14 +45,20 @@ class InMemoryOriginIdentityStore {
   }
 }
 const BUYER_GATES = /* @__PURE__ */ new Set(["aao_verified", "storyboard", "sandbox", "experimental_feature"]);
-const SELLER_GATES = /* @__PURE__ */ new Set(["agent_identity", "grant", "billing_entity", "contract", "credit_application"]);
+const SELLER_GATES = /* @__PURE__ */ new Set([
+  "agent_identity",
+  "grant",
+  "billing_entity",
+  "contract",
+  "credit_application"
+]);
 async function evaluateOnboardingRequirements(requirements, direction, check) {
   const relevant = direction === "seller" ? SELLER_GATES : BUYER_GATES;
   const wrong = direction === "seller" ? BUYER_GATES : SELLER_GATES;
   const unsatisfied = [];
   for (const requirement of requirements) {
     if (wrong.has(requirement.kind)) continue;
-    const wellFormed = requirement.kind !== "aao_verified" || !!requirement.role && !!requirement.verification_modes?.length && !!requirement.specialisms?.length && !!requirement.adcp_version;
+    const wellFormed = requirement.kind !== "aao_verified" || !!requirement.role && !!requirement.verification_modes?.length && !!(requirement.verified_specialisms ?? requirement.specialisms)?.length && !!requirement.adcp_version;
     const hasId = !["storyboard", "experimental_feature"].includes(requirement.kind) || !!requirement.id;
     if (!relevant.has(requirement.kind) || !wellFormed || !hasId || !await check(requirement))
       unsatisfied.push(requirement);
@@ -100,13 +111,34 @@ class OriginIdentityLifecycle {
     await this.options.store.bind(binding);
     return binding;
   }
-  /** Cryptographic verification does not call this. Authorization revalidates delisting. */
+  /**
+   * Cryptographic verification does not call this. Authorization revalidates
+   * delisting: the last record read does not list the origin (an empty
+   * `agents[]` retires it; a known delisting stays delisted through a failed
+   * refresh) and throws {@link TrustMembershipError}. An unreadable record
+   * (404/410 included) throws {@link TrustRecordUnavailableError} for spend;
+   * read-only and identity-configuration calls continue under the binding only
+   * while the last record read listed the origin and is within the evaluator's
+   * `maxOutageContinuationSeconds`.
+   */
   async authorizeBound(originUrl, access) {
     const origin = canonicalAgentOrigin(originUrl);
     const binding = await this.options.store.getBinding(origin);
     if (!binding) throw new IdentityAuthorizationError();
-    const trust = await this.options.trust.match(origin, "adcp:buying");
-    if (binding.operator !== trust.operator) throw new IdentityAuthorizationError();
+    try {
+      let trust;
+      try {
+        trust = await this.options.trust.match(origin, "adcp:buying");
+      } catch (error) {
+        if (error instanceof TrustMembershipError && error.membership === "absent")
+          throw Object.assign(new TrustRecordUnavailableError(), { cause: error });
+        throw error;
+      }
+      if (binding.operator !== trust.operator) throw new TrustMembershipError();
+    } catch (error) {
+      if (!(error instanceof TrustRecordUnavailableError) || !error.lastKnownListed || !(access?.readOnly || access?.identityConfiguration))
+        throw error;
+    }
     const relationship = (await this.options.store.getApplication(origin))?.relationship;
     if (!access?.readOnly && relationship && (relationship.status !== "active" || relationship.expires_at && Date.parse(relationship.expires_at) <= this.now() * 1e3))
       throw new IdentityAuthorizationError();

package/dist/lib/identity-3.3/revocation.d.mts

@@ -14,17 +14,33 @@ export interface MonotonicOriginRevocationStore {
     merge(origin: string, snapshot: OriginRevocationSnapshot): Promise<void>;
     get(origin: string, keyid: string): Promise<RevocationDetail | undefined>;
 }
+/**
+ * Process-local revocation history for development and tests. Public
+ * deployments need durable history (`createIdentity33StateStores`) so a
+ * restart never forgets a revocation.
+ *
+ * Capacity is bounded per origin, per operator (registrable domain) and in
+ * total. The operator budget stops one registrable domain's wildcard
+ * subdomains from filling the store alone; it does not reserve capacity for
+ * anyone else, so several operators together can still exhaust the total.
+ * Facts are never evicted to regain capacity; a refused merge fails closed.
+ */
 export declare class InMemoryOriginRevocationStore implements MonotonicOriginRevocationStore {
-    private readonly limits;
     readonly durability: "process-local";
     private readonly revoked;
+    private readonly originKeys;
+    private readonly operatorKeys;
+    private readonly limits;
     constructor(limits?: {
-        perOrigin: number;
-        total: number;
+        perOrigin?: number;
+        perOperator?: number;
+        total?: number;
     });
     merge(origin: string, snapshot: OriginRevocationSnapshot): Promise<void>;
     get(origin: string, keyid: string): Promise<RevocationDetail | undefined>;
 }
+/** See {@link OriginRevocationResolver.status}. */
+export type OriginRevocationStatus = 'revoked' | 'current' | 'absent' | 'unknown';
 export declare class OriginRevocationResolver {
     private readonly options;
     private readonly freshness;
@@ -33,6 +49,7 @@ export declare class OriginRevocationResolver {
     private readonly pending;
     private readonly failures;
     private readonly persistenceFailures;
+    private readonly absentUntil;
     constructor(options: {
         directory: import('../signing/web-bot-auth.mjs').SignatureDirectoryResolver;
         store: MonotonicOriginRevocationStore;
@@ -41,7 +58,26 @@ export declare class OriginRevocationResolver {
         fetchOptions?: Pick<SsrfFetchOptions, 'lookup' | 'trustedFetchFn'>;
         maxOrigins?: number;
     });
+    /**
+     * Compatibility wrapper over {@link status}: `true` when revoked, `false`
+     * when the list is current, and `revocation_unavailable` when the identity
+     * publishes no list (`absent`) or its status is not known (`unknown`).
+     */
     isRevoked(originUrl: string, keyid: string): Promise<boolean>;
+    /**
+     * Revocation status of `keyid` at `origin`:
+     * - `revoked`: a stored (permanent) revocation covers the key.
+     * - `current`: a signed list is current, or within `next_update` + grace.
+     * - `absent`: the origin serves no list (404/410). The identity is still
+     *   established but cannot be bound for spend.
+     * - `unknown`: no list could be verified and grace has passed (or there was
+     *   never a list). The identity is not established.
+     * Throws {@link WebBotAuthUnavailableError} (`revocation_persistence_failed`)
+     * when the history store fails: an infrastructure outage, never a
+     * revocation outcome.
+     */
+    status(originUrl: string, keyid: string): Promise<OriginRevocationStatus>;
+    private currentStatus;
     private readStored;
     private refresh;
     private now;

package/dist/lib/identity-3.3/revocation.d.ts

@@ -14,17 +14,33 @@ export interface MonotonicOriginRevocationStore {
     merge(origin: string, snapshot: OriginRevocationSnapshot): Promise<void>;
     get(origin: string, keyid: string): Promise<RevocationDetail | undefined>;
 }
+/**
+ * Process-local revocation history for development and tests. Public
+ * deployments need durable history (`createIdentity33StateStores`) so a
+ * restart never forgets a revocation.
+ *
+ * Capacity is bounded per origin, per operator (registrable domain) and in
+ * total. The operator budget stops one registrable domain's wildcard
+ * subdomains from filling the store alone; it does not reserve capacity for
+ * anyone else, so several operators together can still exhaust the total.
+ * Facts are never evicted to regain capacity; a refused merge fails closed.
+ */
 export declare class InMemoryOriginRevocationStore implements MonotonicOriginRevocationStore {
-    private readonly limits;
     readonly durability: "process-local";
     private readonly revoked;
+    private readonly originKeys;
+    private readonly operatorKeys;
+    private readonly limits;
     constructor(limits?: {
-        perOrigin: number;
-        total: number;
+        perOrigin?: number;
+        perOperator?: number;
+        total?: number;
     });
     merge(origin: string, snapshot: OriginRevocationSnapshot): Promise<void>;
     get(origin: string, keyid: string): Promise<RevocationDetail | undefined>;
 }
+/** See {@link OriginRevocationResolver.status}. */
+export type OriginRevocationStatus = 'revoked' | 'current' | 'absent' | 'unknown';
 export declare class OriginRevocationResolver {
     private readonly options;
     private readonly freshness;
@@ -33,6 +49,7 @@ export declare class OriginRevocationResolver {
     private readonly pending;
     private readonly failures;
     private readonly persistenceFailures;
+    private readonly absentUntil;
     constructor(options: {
         directory: import('../signing/web-bot-auth').SignatureDirectoryResolver;
         store: MonotonicOriginRevocationStore;
@@ -41,7 +58,26 @@ export declare class OriginRevocationResolver {
         fetchOptions?: Pick<SsrfFetchOptions, 'lookup' | 'trustedFetchFn'>;
         maxOrigins?: number;
     });
+    /**
+     * Compatibility wrapper over {@link status}: `true` when revoked, `false`
+     * when the list is current, and `revocation_unavailable` when the identity
+     * publishes no list (`absent`) or its status is not known (`unknown`).
+     */
     isRevoked(originUrl: string, keyid: string): Promise<boolean>;
+    /**
+     * Revocation status of `keyid` at `origin`:
+     * - `revoked`: a stored (permanent) revocation covers the key.
+     * - `current`: a signed list is current, or within `next_update` + grace.
+     * - `absent`: the origin serves no list (404/410). The identity is still
+     *   established but cannot be bound for spend.
+     * - `unknown`: no list could be verified and grace has passed (or there was
+     *   never a list). The identity is not established.
+     * Throws {@link WebBotAuthUnavailableError} (`revocation_persistence_failed`)
+     * when the history store fails: an infrastructure outage, never a
+     * revocation outcome.
+     */
+    status(originUrl: string, keyid: string): Promise<OriginRevocationStatus>;
+    private currentStatus;
     private readStored;
     private refresh;
     private now;

package/dist/lib/identity-3.3/revocation.js

@@ -45,28 +45,51 @@ const REASONS = [
   "keyCompromise"
 ];
 class InMemoryOriginRevocationStore {
-  constructor(limits = { perOrigin: 16384, total: 1e5 }) {
-    this.limits = limits;
-  }
-  limits;
   durability = "process-local";
   revoked = /* @__PURE__ */ new Map();
+  originKeys = /* @__PURE__ */ new Map();
+  operatorKeys = /* @__PURE__ */ new Map();
+  limits;
+  constructor(limits = {}) {
+    this.limits = {
+      perOrigin: limits.perOrigin ?? 16384,
+      perOperator: limits.perOperator ?? 16384,
+      total: limits.total ?? 1e5
+    };
+    if (Object.values(this.limits).some((value) => !Number.isSafeInteger(value) || value < 1))
+      throw new TypeError("Revocation limits must be positive safe integers");
+  }
   async merge(origin, snapshot) {
     origin = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+    const operator = operatorOf(origin);
     const additions = new Set(snapshot.revoked_kids.filter((kid) => !this.revoked.has(JSON.stringify([origin, kid]))));
-    const count = [...this.revoked.keys()].filter((key) => JSON.parse(key)[0] === origin).length;
-    if (count + additions.size > this.limits.perOrigin || this.revoked.size + additions.size > this.limits.total)
+    const originCount = this.originKeys.get(origin) ?? 0, operatorCount = this.operatorKeys.get(operator) ?? 0;
+    if (originCount + additions.size > this.limits.perOrigin || operatorCount + additions.size > this.limits.perOperator || this.revoked.size + additions.size > this.limits.total)
       throw new import_web_bot_auth.WebBotAuthError(403, "revocation_storage_limit");
     for (const kid of snapshot.revoked_kids) {
       const key = JSON.stringify([origin, kid]), prior = this.revoked.get(key), detail = snapshot.revocation_details?.[kid] ?? {};
       this.revoked.set(key, (0, import_revocation2.mergeRevocationDetails)(prior, detail));
     }
+    if (additions.size) {
+      this.originKeys.set(origin, originCount + additions.size);
+      this.operatorKeys.set(operator, operatorCount + additions.size);
+    }
   }
   async get(origin, keyid) {
     const entry = this.revoked.get(JSON.stringify([(0, import_canonicalize.canonicalAgentOrigin)(origin), keyid]));
     return entry && { ...entry };
   }
 }
+function operatorOf(origin) {
+  try {
+    return (0, import_etld.eTldPlusOne)(origin);
+  } catch {
+    return new URL(origin).hostname;
+  }
+}
+const MAX_POLLING_SECONDS = 1800;
+class RevocationListAbsentError extends Error {
+}
 class OriginRevocationResolver {
   constructor(options) {
     this.options = options;
@@ -82,31 +105,73 @@ class OriginRevocationResolver {
   pending = /* @__PURE__ */ new Map();
   failures = /* @__PURE__ */ new Map();
   persistenceFailures = /* @__PURE__ */ new Set();
+  absentUntil = /* @__PURE__ */ new Map();
+  /**
+   * Compatibility wrapper over {@link status}: `true` when revoked, `false`
+   * when the list is current, and `revocation_unavailable` when the identity
+   * publishes no list (`absent`) or its status is not known (`unknown`).
+   */
   async isRevoked(originUrl, keyid) {
+    const state = await this.status(originUrl, keyid);
+    if (state === "revoked") return true;
+    if (state === "current") return false;
+    throw new import_web_bot_auth.WebBotAuthError(403, state === "absent" ? "revocation_absent" : "revocation_unavailable");
+  }
+  /**
+   * Revocation status of `keyid` at `origin`:
+   * - `revoked`: a stored (permanent) revocation covers the key.
+   * - `current`: a signed list is current, or within `next_update` + grace.
+   * - `absent`: the origin serves no list (404/410). The identity is still
+   *   established but cannot be bound for spend.
+   * - `unknown`: no list could be verified and grace has passed (or there was
+   *   never a list). The identity is not established.
+   * Throws {@link WebBotAuthUnavailableError} (`revocation_persistence_failed`)
+   * when the history store fails: an infrastructure outage, never a
+   * revocation outcome.
+   */
+  async status(originUrl, keyid) {
+    try {
+      return await this.currentStatus(originUrl, keyid);
+    } catch (error) {
+      if (error instanceof import_web_bot_auth.WebBotAuthError && error.reason === "revocation_persistence_failed")
+        throw new import_web_bot_auth.WebBotAuthUnavailableError("revocation_persistence_failed", error);
+      throw error;
+    }
+  }
+  async currentStatus(originUrl, keyid) {
     const origin = (0, import_canonicalize.canonicalAgentOrigin)(originUrl), now = this.now();
-    if (await this.readStored(origin, keyid)) return true;
+    if (await this.readStored(origin, keyid)) return "revoked";
+    const settled = async () => {
+      if (await this.readStored(origin, keyid)) return "revoked";
+      if ((this.absentUntil.get(origin) ?? 0) > now) return "absent";
+      return (this.freshness.get(origin) ?? 0) > now || (this.graceUntil.get(origin) ?? 0) > now ? "current" : "unknown";
+    };
     if ((this.freshness.get(origin) ?? 0) <= now) {
       if ((this.failures.get(origin) ?? 0) > now) {
         if (this.persistenceFailures.has(origin)) throw new import_web_bot_auth.WebBotAuthError(403, "revocation_persistence_failed");
-        if ((this.graceUntil.get(origin) ?? 0) > now) return false;
-        throw new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");
+        return settled();
       }
       let promise = this.pending.get(origin);
       if (!promise) {
-        if (this.pending.size >= 16 || [...this.pending.keys()].filter((pendingOrigin) => (0, import_etld.eTldPlusOne)(pendingOrigin) === (0, import_etld.eTldPlusOne)(origin)).length >= 2) {
-          throw new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");
+        if (this.pending.size >= 16 || [...this.pending.keys()].filter((pendingOrigin) => operatorOf(pendingOrigin) === operatorOf(origin)).length >= 2) {
+          return settled();
         }
         promise = this.refresh(origin).catch((error) => {
           if (this.failures.size >= (this.options.maxOrigins ?? 1e3)) {
             const oldest = this.failures.keys().next().value;
             this.failures.delete(oldest);
             this.persistenceFailures.delete(oldest);
+            this.absentUntil.delete(oldest);
           }
           this.failures.set(origin, now + 60);
           if (error instanceof import_web_bot_auth.WebBotAuthError && error.reason === "revocation_persistence_failed") {
             this.persistenceFailures.add(origin);
             this.graceUntil.delete(origin);
           }
+          if (error.cause instanceof RevocationListAbsentError) {
+            this.absentUntil.set(origin, now + 60);
+            this.graceUntil.delete(origin);
+          }
           throw error;
         });
         this.pending.set(origin, promise);
@@ -115,12 +180,11 @@ class OriginRevocationResolver {
         await promise;
       } catch (error) {
         if (error instanceof import_web_bot_auth.WebBotAuthError && error.reason === "revocation_persistence_failed") throw error;
-        if ((this.graceUntil.get(origin) ?? 0) <= now) throw error;
       } finally {
         if (this.pending.get(origin) === promise) this.pending.delete(origin);
       }
     }
-    return !!await this.readStored(origin, keyid);
+    return settled();
   }
   async readStored(origin, keyid) {
     try {
@@ -138,6 +202,7 @@ class OriginRevocationResolver {
         maxBodyBytes: 256 * 1024,
         timeoutMs: 1e4
       });
+      if (response.status === 404 || response.status === 410) throw new RevocationListAbsentError();
       if (response.status !== 200) throw new Error("Unavailable revocation list");
       const body = new TextDecoder("utf-8", { fatal: true }).decode(response.body);
       let tokens;
@@ -163,9 +228,9 @@ class OriginRevocationResolver {
           if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
             continue;
           await this.options.directory.resolve(header.kid, origin);
-          const proof = this.options.directory.getAuditProof(origin);
-          if (!proof || new URL(proof.request.url).origin !== origin) continue;
-          const checked = (0, import_web_bot_auth.verifySignatureDirectory)(proof, this.now(), this.options.directory.allowsTestKeys);
+          const checked = this.options.directory.getVerifiedDirectory(origin);
+          if (!checked || new URL(checked.proof.request.url).origin !== origin || checked.expires <= this.now())
+            continue;
           const jwk = checked.keys.find((key) => key.kid === header.kid);
           if (!jwk) continue;
           const result = await (0, import_jose.compactVerify)(token, await (0, import_jose.importJWK)(jwk, header.alg), {
@@ -182,7 +247,8 @@ class OriginRevocationResolver {
         32
       );
       const updated = Date.parse(snapshot.updated) / 1e3, next = Date.parse(snapshot.next_update) / 1e3, now = this.now();
-      if (snapshot.issuer !== origin || !Number.isFinite(updated) || !Number.isFinite(next) || updated > now || next <= now || next <= updated || next > now + 1800 || !Array.isArray(snapshot.revoked_kids) || snapshot.revoked_kids.length > 4096 || snapshot.revoked_kids.some((k) => typeof k !== "string" || k.length > 256) || updated < (this.updated.get(origin) ?? 0))
+      if (snapshot.issuer !== origin || !Number.isFinite(updated) || !Number.isFinite(next) || // Tolerate a publisher clock slightly ahead, as for request `created`.
+      updated > now + 60 || next <= now || next <= updated || !Array.isArray(snapshot.revoked_kids) || snapshot.revoked_kids.length > 4096 || snapshot.revoked_kids.some((k) => typeof k !== "string" || k.length > 256) || updated < (this.updated.get(origin) ?? 0))
         throw new Error("Invalid revocation snapshot");
       for (const [kid, detail] of Object.entries(snapshot.revocation_details ?? {}))
         if (!snapshot.revoked_kids.includes(kid) || !detail || detail.reason && !REASONS.includes(detail.reason) || detail.invalidity_date && !Number.isFinite(Date.parse(detail.invalidity_date)))
@@ -200,11 +266,15 @@ class OriginRevocationResolver {
         this.updated.delete(oldest);
         this.graceUntil.delete(oldest);
       }
-      this.graceUntil.set(origin, next + 4 * (this.options.pollingIntervalSeconds ?? 300));
+      this.graceUntil.set(
+        origin,
+        Math.min(next, now + MAX_POLLING_SECONDS) + 4 * (this.options.pollingIntervalSeconds ?? 300)
+      );
       this.updated.set(origin, updated);
       this.freshness.set(origin, Math.min(next, now + (this.options.pollingIntervalSeconds ?? 300)));
       this.failures.delete(origin);
       this.persistenceFailures.delete(origin);
+      this.absentUntil.delete(origin);
     } catch (cause) {
       if (cause instanceof import_web_bot_auth.WebBotAuthError && cause.reason === "revocation_persistence_failed") throw cause;
       const error = new import_web_bot_auth.WebBotAuthError(403, "revocation_unavailable");