@atrib/verify 0.1.0

package/dist/index.js

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0
+// @atrib/verify. Merchant verification library
+// Verifier (primary export)
+export { AtribVerifier } from './verifier.js';
+// Per-record verification (single AtribRecord; surfaces D044 provenance
+// annotations). Distinct from AtribVerifier.verify which operates on a
+// settlement RecommendationDocument. Other per-record annotations the
+// README mentions (informed_by_resolution, capability_check, etc.) are
+// pending; see DECISIONS.md for the planned reconciliation.
+export { verifyRecord } from './verify-record.js';
+// Calculation algorithm (§4.6). pure function, exported for direct use
+export { calculate, DEFAULT_POLICY, isValidPolicy } from './calculate.js';
+// Recommendation document signing/verification (§4.7)
+export { signRecommendation, verifyRecommendationSignature, recommendationSigningInput, distributionsMatch, } from './recommendation.js';
+// Policy builder (compose policies from templates)
+export { buildPolicy, policyFrom } from './policy-builder.js';
+// Graph fetch (advanced usage)
+export { fetchGraph, fetchSessionPolicyRecord, fetchPolicyDocument } from './graph-fetch.js';
+// Revocation registry (§1.9)
+export { buildRevocationRegistry, applyRevocation } from './revocations.js';
+// Identity resolution (§6.3 9-step verifier consultation)
+export { resolveIdentity } from './resolve-identity.js';
+export { graphLabelFromEventTypeUri } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAG7C,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,4DAA4D;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOjD,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AA+BvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}

package/dist/policy-builder.d.ts

@@ -0,0 +1,26 @@
+import type { PolicyDocument, Modifier, PolicyConstraints } from './types.js';
+type EdgeWeightOverrides = Partial<Record<string, number>>;
+/**
+ * Build a policy document by combining a base policy with overrides.
+ *
+ * - `edge_weights`: merged (override values replace base values per key)
+ * - `modifiers`: concatenated (base first, then additions)
+ * - `constraints`: merged (override values replace base values per key)
+ * - `role`, `distribution`: override replaces base if provided
+ *
+ * Throws if the resulting policy fails validation.
+ */
+export declare function buildPolicy(base: PolicyDocument, overrides: {
+    role?: PolicyDocument['role'];
+    edge_weights?: EdgeWeightOverrides;
+    modifiers?: Modifier[];
+    constraints?: Partial<PolicyConstraints>;
+    distribution?: PolicyDocument['distribution'];
+}): PolicyDocument;
+/**
+ * Start from the default policy and apply overrides.
+ * Shorthand for `buildPolicy(DEFAULT_POLICY, overrides)`.
+ */
+export declare function policyFrom(overrides: Parameters<typeof buildPolicy>[1]): PolicyDocument;
+export {};
+//# sourceMappingURL=policy-builder.d.ts.map

package/dist/policy-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-builder.d.ts","sourceRoot":"","sources":["../src/policy-builder.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAE7E,KAAK,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAE1D;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE;IACT,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;IAC7B,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACxC,YAAY,CAAC,EAAE,cAAc,CAAC,cAAc,CAAC,CAAA;CAC9C,GACA,cAAc,CAqBhB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAEvF"}

package/dist/policy-builder.js

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Policy builder. helper for composing policy documents from templates.
+ *
+ * Combines a base policy with overrides for edge weights, modifiers,
+ * and constraints. Fields from the override replace fields in the base;
+ * modifiers are concatenated (base modifiers first, then override modifiers).
+ */
+import { DEFAULT_POLICY, isValidPolicy } from './calculate.js';
+/**
+ * Build a policy document by combining a base policy with overrides.
+ *
+ * - `edge_weights`: merged (override values replace base values per key)
+ * - `modifiers`: concatenated (base first, then additions)
+ * - `constraints`: merged (override values replace base values per key)
+ * - `role`, `distribution`: override replaces base if provided
+ *
+ * Throws if the resulting policy fails validation.
+ */
+export function buildPolicy(base, overrides) {
+    const result = {
+        spec_version: 'atrib/1.0',
+        edge_weights: {
+            ...base.edge_weights,
+            ...overrides.edge_weights,
+        },
+        modifiers: [...(base.modifiers ?? []), ...(overrides.modifiers ?? [])],
+        constraints: {
+            ...base.constraints,
+            ...overrides.constraints,
+        },
+    };
+    if (overrides.role ?? base.role)
+        result.role = overrides.role ?? base.role;
+    if (overrides.distribution ?? base.distribution)
+        result.distribution = overrides.distribution ?? base.distribution;
+    if (!isValidPolicy(result)) {
+        throw new Error('buildPolicy: resulting policy is invalid (check weights, constraints)');
+    }
+    return result;
+}
+/**
+ * Start from the default policy and apply overrides.
+ * Shorthand for `buildPolicy(DEFAULT_POLICY, overrides)`.
+ */
+export function policyFrom(overrides) {
+    return buildPolicy(DEFAULT_POLICY, overrides);
+}
+//# sourceMappingURL=policy-builder.js.map

package/dist/policy-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-builder.js","sourceRoot":"","sources":["../src/policy-builder.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAK9D;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,IAAoB,EACpB,SAMC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE;YACZ,GAAG,IAAI,CAAC,YAAY;YACpB,GAAG,SAAS,CAAC,YAAY;SAC1B;QACD,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACtE,WAAW,EAAE;YACX,GAAG,IAAI,CAAC,WAAW;YACnB,GAAG,SAAS,CAAC,WAAW;SACzB;KACF,CAAA;IACD,IAAI,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAA;IAC1E,IAAI,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAA;IAElH,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IAED,OAAO,MAAwB,CAAA;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,SAA4C;IACrE,OAAO,WAAW,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;AAC/C,CAAC"}

package/dist/recommendation.d.ts

@@ -0,0 +1,29 @@
+import type { RecommendationDocument } from './types.js';
+/**
+ * Compute the canonical signing input for a recommendation: JCS-canonicalize
+ * the document with the `signature` field omitted.
+ */
+export declare function recommendationSigningInput(doc: Omit<RecommendationDocument, 'signature'> & {
+    signature?: string;
+}): Uint8Array;
+/**
+ * Sign a recommendation document with a 32-byte Ed25519 seed.
+ * Returns a copy of the document with the `signature` field populated.
+ */
+export declare function signRecommendation(doc: Omit<RecommendationDocument, 'signature'>, privateKey: Uint8Array): Promise<RecommendationDocument>;
+/**
+ * Verify the Ed25519 signature on a recommendation document.
+ *
+ * @param doc. the document with `signature` populated
+ * @param publicKey. base64url-encoded 32-byte public key of `calculated_by`
+ * @returns true iff the signature is valid
+ */
+export declare function verifyRecommendationSignature(doc: RecommendationDocument, publicKey: string): Promise<boolean>;
+/**
+ * Compare two distributions for equality within the §4.7.3 tolerance of 1e-9.
+ *
+ * Returns true iff both have identical keys AND every value matches within
+ * the tolerance.
+ */
+export declare function distributionsMatch(a: Record<string, number>, b: Record<string, number>, tolerance?: number): boolean;
+//# sourceMappingURL=recommendation.d.ts.map

package/dist/recommendation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommendation.d.ts","sourceRoot":"","sources":["../src/recommendation.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAMxD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,UAAU,CAQZ;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EAC9C,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAUjC;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzB,SAAS,SAAO,GACf,OAAO,CAcT"}

package/dist/recommendation.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Settlement recommendation document signing & verification (§4.7).
+ *
+ * Uses the same Ed25519 + JCS canonicalization machinery as @atrib/mcp.
+ */
+import * as ed from '@noble/ed25519';
+import { sha512 } from '@noble/hashes/sha2.js';
+import canonicalize from 'canonicalize';
+import { base64urlEncode, base64urlDecode } from '@atrib/mcp';
+// @noble/ed25519 v2 requires setting the sha512 sync function (same as @atrib/mcp)
+ed.etc.sha512Sync = (...m) => sha512(ed.etc.concatBytes(...m));
+ed.etc.sha512Async = async (...m) => sha512(ed.etc.concatBytes(...m));
+/**
+ * Compute the canonical signing input for a recommendation: JCS-canonicalize
+ * the document with the `signature` field omitted.
+ */
+export function recommendationSigningInput(doc) {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const { signature: _sig, ...rest } = doc;
+    const canonical = canonicalize(rest);
+    if (!canonical) {
+        throw new Error('failed to canonicalize recommendation document');
+    }
+    return new TextEncoder().encode(canonical);
+}
+/**
+ * Sign a recommendation document with a 32-byte Ed25519 seed.
+ * Returns a copy of the document with the `signature` field populated.
+ */
+export async function signRecommendation(doc, privateKey) {
+    if (privateKey.length !== 32) {
+        throw new Error('privateKey must be 32 bytes');
+    }
+    const message = recommendationSigningInput(doc);
+    const sigBytes = await ed.signAsync(message, privateKey);
+    return {
+        ...doc,
+        signature: base64urlEncode(sigBytes),
+    };
+}
+/**
+ * Verify the Ed25519 signature on a recommendation document.
+ *
+ * @param doc. the document with `signature` populated
+ * @param publicKey. base64url-encoded 32-byte public key of `calculated_by`
+ * @returns true iff the signature is valid
+ */
+export async function verifyRecommendationSignature(doc, publicKey) {
+    try {
+        if (!doc.signature)
+            return false;
+        const pubBytes = base64urlDecode(publicKey);
+        if (pubBytes.length !== 32)
+            return false;
+        const sigBytes = base64urlDecode(doc.signature);
+        if (sigBytes.length !== 64)
+            return false;
+        const message = recommendationSigningInput(doc);
+        return await ed.verifyAsync(sigBytes, message, pubBytes);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Compare two distributions for equality within the §4.7.3 tolerance of 1e-9.
+ *
+ * Returns true iff both have identical keys AND every value matches within
+ * the tolerance.
+ */
+export function distributionsMatch(a, b, tolerance = 1e-9) {
+    const aKeys = Object.keys(a).sort();
+    const bKeys = Object.keys(b).sort();
+    if (aKeys.length !== bKeys.length)
+        return false;
+    for (let i = 0; i < aKeys.length; i++) {
+        if (aKeys[i] !== bKeys[i])
+            return false;
+        const av = a[aKeys[i]];
+        const bv = b[bKeys[i]];
+        // NaN never matches anything (including itself). calculations producing
+        // NaN are bugs and must surface as verification failures.
+        if (Number.isNaN(av) || Number.isNaN(bv))
+            return false;
+        if (Math.abs(av - bv) > tolerance)
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=recommendation.js.map

package/dist/recommendation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommendation.js","sourceRoot":"","sources":["../src/recommendation.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,YAAY,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAG7D,mFAAmF;AACnF,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAC9D,EAAE,CAAC,GAAG,CAAC,WAAW,GAAG,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAErE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAuE;IAEvE,6DAA6D;IAC7D,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAA8C,EAC9C,UAAsB;IAEtB,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACxD,OAAO;QACL,GAAG,GAAG;QACN,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAA2B,EAC3B,SAAiB;IAEjB,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,KAAK,CAAA;QAChC,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAA;QAC/C,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,CAAyB,EACzB,CAAyB,EACzB,SAAS,GAAG,IAAI;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAE,CAAA;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAE,CAAA;QACxB,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QACtD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,SAAS;YAAE,OAAO,KAAK,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/resolve-identity.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Identity resolution per spec §6.3 — the 9-step verifier consultation
+ * algorithm. The verifier consults the directory for a record's
+ * creator_key and surfaces an `identity_resolution` object.
+ *
+ * This implementation is the LEGIBLE PARTIAL: steps 6 (directory
+ * lookup), 8 (parse claim), and 9 (revocation cross-check) are wired
+ * end-to-end. Steps 1-5 (anchor freshness, witness coverage, directory
+ * checkpoint signature, append-only consistency) and step 7 (AKD proof
+ * validation) require heavier cryptographic infrastructure and are
+ * surfaced as explicit warnings rather than falsely claimed as passing.
+ *
+ * Per §5.8 degradation contract: this function never throws. Network
+ * failures, malformed responses, and timeout conditions all produce
+ * warnings in the returned object.
+ */
+import type { RevocationEntry } from './revocations.js';
+/** Identity claim shape from spec §6.1. Mirrored here to avoid an import cycle with @atrib/directory. */
+export interface IdentityClaim {
+    creator_key: string;
+    claim_type: 'self_attested' | 'domain_verified' | 'did_resolved';
+    claim_method: string;
+    claim_subject: Record<string, unknown>;
+    capabilities?: CapabilityEnvelope;
+    signature: string;
+}
+/** Capability envelope per §6.7 / D051. */
+export interface CapabilityEnvelope {
+    tool_names?: string[];
+    max_amount?: {
+        currency: string;
+        value: number;
+    };
+    counterparties?: string[];
+    event_types?: string[];
+    expires_at?: number;
+}
+export type IdentityResolutionMethod = 'directory_lookup' | 'no_anchor_available' | 'no_claim_registered' | 'rejected';
+export interface KeyRevocationStatus {
+    reason: 'rotation' | 'retirement' | 'compromise';
+    /** Log index of the revocation, used to derive timestamp ordering. */
+    revoked_at_log_index: number;
+    /** True when the record being resolved was signed AFTER revocation (post-revocation). */
+    since_revocation: boolean;
+}
+export interface IdentityResolution {
+    identity_resolved: IdentityClaim | null;
+    identity_resolution_method: IdentityResolutionMethod;
+    capability_envelope: CapabilityEnvelope | null;
+    key_revocation_status: KeyRevocationStatus | null;
+    /**
+     * lookup_proof_valid: per §6.3 step 7. NULL when the lookup returned
+     * non-membership (no proof to validate) or when the verifier hasn't
+     * implemented AKD proof validation in JS. The directory returns a
+     * proof bytes blob; validation requires the AKD WASM bridge in the
+     * verifier process. Currently null for both reasons; warnings flag
+     * which one applies.
+     */
+    lookup_proof_valid: boolean | null;
+    /** §6.3 step 5 — currently not checked; reflected in warnings. */
+    append_only_consistent: boolean | null;
+    /** §6.3 step 1 — currently not checked; reflected in warnings. */
+    anchor: null;
+    warnings: string[];
+}
+export interface ResolveIdentityOptions {
+    /** Directory base URL (e.g., https://directory.atrib.dev/v6). */
+    directoryEndpoint?: string;
+    /** Record timestamp (ms) — for the revocation since/before comparison. */
+    recordTimestamp?: number;
+    /**
+     * Record's log_index — for revocation ordering per §1.9.3 since the
+     * authoritative ordering is by log_index, not timestamp.
+     */
+    recordLogIndex?: number | null;
+    /** Pre-built revocation registry from a log scan (recommended). */
+    revocations?: Map<string, RevocationEntry>;
+    /** AbortSignal for timeout / cancellation. */
+    signal?: AbortSignal;
+    /** Override fetch (testing). */
+    fetchImpl?: typeof fetch;
+}
+export declare function resolveIdentity(creatorKey: string, opts?: ResolveIdentityOptions): Promise<IdentityResolution>;
+//# sourceMappingURL=resolve-identity.d.ts.map

package/dist/resolve-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-identity.d.ts","sourceRoot":"","sources":["../src/resolve-identity.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,yGAAyG;AACzG,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAChE,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC,kBAAkB,GAClB,qBAAqB,GACrB,qBAAqB,GACrB,UAAU,CAAA;AAEd,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,CAAA;IAChD,sEAAsE;IACtE,oBAAoB,EAAE,MAAM,CAAA;IAC5B,yFAAyF;IACzF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,aAAa,GAAG,IAAI,CAAA;IACvC,0BAA0B,EAAE,wBAAwB,CAAA;IACpD,mBAAmB,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC9C,qBAAqB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACjD;;;;;;;OAOG;IACH,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAA;IAClC,kEAAkE;IAClE,sBAAsB,EAAE,OAAO,GAAG,IAAI,CAAA;IACtC,kEAAkE;IAClE,MAAM,EAAE,IAAI,CAAA;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,mEAAmE;IACnE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC1C,8CAA8C;IAC9C,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAID,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAmG7B"}

package/dist/resolve-identity.js

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: Apache-2.0
+const DEFAULT_DIRECTORY = 'https://directory.atrib.dev/v6';
+export async function resolveIdentity(creatorKey, opts = {}) {
+    const warnings = [];
+    const directoryEndpoint = opts.directoryEndpoint ?? DEFAULT_DIRECTORY;
+    const fetchFn = opts.fetchImpl ?? fetch;
+    // Steps not yet implemented — flag once, up front, so consumers can
+    // distinguish "verifier didn't check this" from "verifier checked
+    // this and it passed."
+    warnings.push('step-1-anchor-not-checked: anchor freshness not verified by this implementation');
+    warnings.push('step-3-witness-not-checked: witness coverage not verified by this implementation');
+    warnings.push('step-4-checkpoint-signature-not-checked: directory checkpoint signature not verified by this implementation');
+    warnings.push('step-5-append-only-not-checked: append-only consistency not verified by this implementation');
+    warnings.push('step-7-akd-proof-not-validated: AKD lookup proof returned but not cryptographically validated');
+    // Step 6: directory lookup
+    let lookupBody = {};
+    try {
+        const url = `${directoryEndpoint.replace(/\/$/, '')}/lookup/${encodeURIComponent(creatorKey)}`;
+        const res = await fetchFn(url, {
+            headers: { accept: 'application/json' },
+            ...(opts.signal ? { signal: opts.signal } : {}),
+        });
+        if (res.status === 404) {
+            // Non-membership. The endpoint returns { found: false } body.
+            lookupBody = { found: false };
+        }
+        else if (!res.ok) {
+            warnings.push(`step-6-directory-error: ${res.status} ${res.statusText}`);
+            const status = applyRevocationOnly(creatorKey, opts, warnings);
+            return {
+                identity_resolved: null,
+                identity_resolution_method: 'rejected',
+                capability_envelope: null,
+                key_revocation_status: status,
+                lookup_proof_valid: null,
+                append_only_consistent: null,
+                anchor: null,
+                warnings,
+            };
+        }
+        else {
+            lookupBody = await res.json();
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        warnings.push(`step-6-directory-error: ${msg}`);
+        const status = applyRevocationOnly(creatorKey, opts, warnings);
+        return {
+            identity_resolved: null,
+            identity_resolution_method: 'rejected',
+            capability_envelope: null,
+            key_revocation_status: status,
+            lookup_proof_valid: null,
+            append_only_consistent: null,
+            anchor: null,
+            warnings,
+        };
+    }
+    // Non-membership branch
+    if (lookupBody.found === false) {
+        return {
+            identity_resolved: null,
+            identity_resolution_method: 'no_claim_registered',
+            capability_envelope: null,
+            key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
+            lookup_proof_valid: null,
+            append_only_consistent: null,
+            anchor: null,
+            warnings,
+        };
+    }
+    // Step 8: parse claim. The directory already returned a parsed JSON
+    // claim object; spec-conformance check is delegated to the schema
+    // already applied by the directory. We do a minimal sanity check.
+    const claim = lookupBody.claim;
+    if (!claim || typeof claim !== 'object' || claim.creator_key !== creatorKey) {
+        warnings.push('step-8-claim-malformed: lookup returned but claim payload is missing or wrong creator_key');
+        return {
+            identity_resolved: null,
+            identity_resolution_method: 'rejected',
+            capability_envelope: null,
+            key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
+            lookup_proof_valid: null,
+            append_only_consistent: null,
+            anchor: null,
+            warnings,
+        };
+    }
+    return {
+        identity_resolved: claim,
+        identity_resolution_method: 'directory_lookup',
+        capability_envelope: claim.capabilities ?? null,
+        key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
+        lookup_proof_valid: null,
+        append_only_consistent: null,
+        anchor: null,
+        warnings,
+    };
+}
+/**
+ * Step 9 helper: cross-check the revocation registry. since_revocation
+ * is true when the record's log_index is strictly greater than the
+ * revocation's log_index.
+ */
+function applyRevocationOnly(creatorKey, opts, warnings) {
+    if (!opts.revocations) {
+        warnings.push('step-9-revocation-not-checked: no revocation registry supplied');
+        return null;
+    }
+    const entry = opts.revocations.get(creatorKey);
+    if (!entry)
+        return null;
+    const sinceRevocation = typeof opts.recordLogIndex === 'number' && opts.recordLogIndex > entry.log_index;
+    return {
+        reason: entry.revocation_reason,
+        revoked_at_log_index: entry.log_index,
+        since_revocation: sinceRevocation,
+    };
+}
+//# sourceMappingURL=resolve-identity.js.map

package/dist/resolve-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-identity.js","sourceRoot":"","sources":["../src/resolve-identity.ts"],"names":[],"mappings":"AAAA,sCAAsC;AA6FtC,MAAM,iBAAiB,GAAG,gCAAgC,CAAA;AAE1D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,OAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAA;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAEvC,oEAAoE;IACpE,kEAAkE;IAClE,uBAAuB;IACvB,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;IAChG,QAAQ,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;IACjG,QAAQ,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAA;IAC5H,QAAQ,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAA;IAC5G,QAAQ,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAA;IAE9G,2BAA2B;IAC3B,IAAI,UAAU,GAAiF,EAAE,CAAA;IACjG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAA;QAC9F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,8DAA8D;YAC9D,UAAU,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QAC/B,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC9D,OAAO;gBACL,iBAAiB,EAAE,IAAI;gBACvB,0BAA0B,EAAE,UAAU;gBACtC,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,kBAAkB,EAAE,IAAI;gBACxB,sBAAsB,EAAE,IAAI;gBAC5B,MAAM,EAAE,IAAI;gBACZ,QAAQ;aACT,CAAA;QACH,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuB,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtD,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC9D,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,UAAU;YACtC,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,MAAM;YAC7B,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,qBAAqB;YACjD,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;YACtE,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,oEAAoE;IACpE,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC5E,QAAQ,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAA;QAC1G,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,UAAU;YACtC,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;YACtE,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,KAAK;QACxB,0BAA0B,EAAE,kBAAkB;QAC9C,mBAAmB,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QAC/C,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;QACtE,kBAAkB,EAAE,IAAI;QACxB,sBAAsB,EAAE,IAAI;QAC5B,MAAM,EAAE,IAAI;QACZ,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,IAA4B,EAC5B,QAAkB;IAElB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;QAC/E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,eAAe,GACnB,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,SAAS,CAAA;IAClF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,iBAAiB;QAC/B,oBAAoB,EAAE,KAAK,CAAC,SAAS;QACrC,gBAAgB,EAAE,eAAe;KAClC,CAAA;AACH,CAAC"}

package/dist/revocations.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Revocation registry per spec §1.9.
+ *
+ * A "key_revocation" record retires a creator_key at a specific log_index.
+ * Records signed by that key with log_index >= R are flagged
+ * 'revoked_after_revocation' and MUST NOT contribute to attribution
+ * calculations (§4.6). Records with log_index < R retain their state.
+ *
+ * Why a registry: per-record verification needs to know "was this signer
+ * retired before this record was committed?" The answer requires knowing
+ * about every key_revocation in the log. Build the registry once over the
+ * full log; consult it per record.
+ */
+import type { VerificationState } from './types.js';
+/** Reasons per §1.9.1. */
+export type RevocationReason = 'rotation' | 'retirement' | 'compromise';
+/** A single key_revocation event extracted from a log entry. */
+export interface RevocationEntry {
+    /** Base64url Ed25519 pubkey being retired. */
+    revoked_key: string;
+    /** Log index at which the revocation was committed. Records with log_index >= R for revoked_key are post-revocation. */
+    log_index: number;
+    /** Reason per §1.9.1. */
+    revocation_reason: RevocationReason;
+    /** Successor key when revocation_reason='rotation'. */
+    successor_key?: string;
+    /** Emergency-key signer when revocation_reason='compromise' AND signed by an emergency key. */
+    emergency_signed_by?: string;
+}
+/**
+ * The minimal record shape this module needs. Avoids depending on the
+ * full @atrib/mcp record type so callers in graph-node + verify can
+ * consume their own decoded forms.
+ */
+export interface MinimalRecord {
+    event_type?: string | null;
+    event_type_uri?: string | null;
+    creator_key?: string | null;
+    log_index?: number | null;
+    revoked_key?: string;
+    revocation_reason?: string;
+    successor_key?: string;
+    emergency_signed_by?: string;
+}
+/**
+ * Scan a list of records for valid key_revocation entries and return a
+ * registry indexed by revoked_key. When the same key is revoked more
+ * than once (which the spec doesn't strictly forbid but is unusual),
+ * the EARLIEST revocation wins — once retired, a key cannot be
+ * un-retired by a later record.
+ *
+ * Records that look like revocations but lack required fields, or have
+ * non-numeric log_index, are skipped silently. Cryptographic validity
+ * (signature checks per §1.9.2 signing rules) is the caller's job —
+ * this module only registers what the records claim.
+ */
+export declare function buildRevocationRegistry(records: MinimalRecord[]): Map<string, RevocationEntry>;
+/**
+ * Apply a revocation registry to a node's verification state. Returns
+ * the new state. Per §1.9.3:
+ *   - creator_key revoked AND log_index >= revocation log_index
+ *     → 'revoked_after_revocation'
+ *   - otherwise → unchanged
+ *
+ * The current state ('signature_valid', 'log_committed', etc.) is
+ * preserved for pre-revocation records — those remain valid.
+ */
+export declare function applyRevocation(node: {
+    creator_key: string | null;
+    log_index: number | null;
+    verification_state: VerificationState;
+}, registry: Map<string, RevocationEntry>): VerificationState;
+//# sourceMappingURL=revocations.d.ts.map

package/dist/revocations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocations.d.ts","sourceRoot":"","sources":["../src/revocations.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEnD,0BAA0B;AAC1B,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,CAAA;AAEvE,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAA;IACnB,wHAAwH;IACxH,SAAS,EAAE,MAAM,CAAA;IACjB,yBAAyB;IACzB,iBAAiB,EAAE,gBAAgB,CAAA;IACnC,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+FAA+F;IAC/F,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAmB9F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAA;CAAE,EACrG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACrC,iBAAiB,CAcnB"}

package/dist/revocations.js

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: Apache-2.0
+const KEY_REVOCATION_URI = 'https://atrib.dev/v1/types/key_revocation';
+function isRevocationRecord(r) {
+    // The record may carry the type as either the short label ('key_revocation'),
+    // the canonical URI ('https://atrib.dev/v1/types/key_revocation'), or via
+    // a separate event_type_uri field (e.g., when the source surfaces both
+    // a short label in event_type and the full URI alongside).
+    if (r.event_type === 'key_revocation')
+        return true;
+    if (r.event_type === KEY_REVOCATION_URI)
+        return true;
+    if (r.event_type_uri === KEY_REVOCATION_URI)
+        return true;
+    return false;
+}
+/**
+ * Scan a list of records for valid key_revocation entries and return a
+ * registry indexed by revoked_key. When the same key is revoked more
+ * than once (which the spec doesn't strictly forbid but is unusual),
+ * the EARLIEST revocation wins — once retired, a key cannot be
+ * un-retired by a later record.
+ *
+ * Records that look like revocations but lack required fields, or have
+ * non-numeric log_index, are skipped silently. Cryptographic validity
+ * (signature checks per §1.9.2 signing rules) is the caller's job —
+ * this module only registers what the records claim.
+ */
+export function buildRevocationRegistry(records) {
+    const registry = new Map();
+    for (const r of records) {
+        if (!isRevocationRecord(r))
+            continue;
+        if (typeof r.revoked_key !== 'string' || r.revoked_key.length === 0)
+            continue;
+        if (typeof r.log_index !== 'number')
+            continue;
+        const reason = r.revocation_reason;
+        if (reason !== 'rotation' && reason !== 'retirement' && reason !== 'compromise')
+            continue;
+        const existing = registry.get(r.revoked_key);
+        if (existing && existing.log_index <= r.log_index)
+            continue; // earlier revocation wins
+        registry.set(r.revoked_key, {
+            revoked_key: r.revoked_key,
+            log_index: r.log_index,
+            revocation_reason: reason,
+            ...(r.successor_key ? { successor_key: r.successor_key } : {}),
+            ...(r.emergency_signed_by ? { emergency_signed_by: r.emergency_signed_by } : {}),
+        });
+    }
+    return registry;
+}
+/**
+ * Apply a revocation registry to a node's verification state. Returns
+ * the new state. Per §1.9.3:
+ *   - creator_key revoked AND log_index >= revocation log_index
+ *     → 'revoked_after_revocation'
+ *   - otherwise → unchanged
+ *
+ * The current state ('signature_valid', 'log_committed', etc.) is
+ * preserved for pre-revocation records — those remain valid.
+ */
+export function applyRevocation(node, registry) {
+    if (!node.creator_key)
+        return node.verification_state;
+    if (node.log_index === null)
+        return node.verification_state;
+    const entry = registry.get(node.creator_key);
+    if (!entry)
+        return node.verification_state;
+    if (node.log_index < entry.log_index)
+        return node.verification_state;
+    // The revocation record itself is the one at log_index === entry.log_index;
+    // it does NOT flag itself as revoked (it's the act of retirement, not a
+    // post-retirement record). Spec §1.9.3 says "log_index >= R" but the
+    // implicit reading is "for OTHER records signed by revoked_key" — the
+    // revocation record's own state is unaffected. To be safe + spec-aligned,
+    // we apply only when this is a strictly post-revocation record.
+    if (node.log_index === entry.log_index)
+        return node.verification_state;
+    return 'revoked_after_revocation';
+}
+//# sourceMappingURL=revocations.js.map

package/dist/revocations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocations.js","sourceRoot":"","sources":["../src/revocations.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAmDtC,MAAM,kBAAkB,GAAG,2CAA2C,CAAA;AAEtE,SAAS,kBAAkB,CAAC,CAAgB;IAC1C,8EAA8E;IAC9E,0EAA0E;IAC1E,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC,CAAC,UAAU,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,CAAC,CAAC,UAAU,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAA;IACpD,IAAI,CAAC,CAAC,cAAc,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAA;IACxD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAwB;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAA;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAAE,SAAQ;QACpC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC7E,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,SAAQ;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAA;QAClC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,YAAY;YAAE,SAAQ;QACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS;YAAE,SAAQ,CAAC,0BAA0B;QACtF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,iBAAiB,EAAE,MAAM;YACzB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAqG,EACrG,QAAsC;IAEtC,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,kBAAkB,CAAA;IACrD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,kBAAkB,CAAA;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,kBAAkB,CAAA;IAC1C,IAAI,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,kBAAkB,CAAA;IACpE,4EAA4E;IAC5E,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,kBAAkB,CAAA;IACtE,OAAO,0BAA0B,CAAA;AACnC,CAAC"}