@caracalai/revocation 0.1.2 → 0.1.4-rc.1

package/README.md

@@ -0,0 +1,7 @@
+# Caracal Revocation for TypeScript
+
+TypeScript revocation lookup interface and in-memory default for Caracal resource servers.
+
+The in-memory store is process-local. Distributed production deployments should use a connector-backed store and fail closed when revocation cannot be checked or writes cannot be confirmed.
+
+Docs: https://caracal.run/sdks/revocation/

package/dist/iface.d.ts

@@ -1,5 +1,7 @@
 export interface RevocationStore {
     isRevoked: (sid: string) => boolean | Promise<boolean>;
-    markRevoked: (sid: string, ttlMs?: number) => void;
+    markRevoked: (sid: string, ttlMs?: number) => void | Promise<void>;
+    currentDelegationEpoch?: (zoneId: string) => number | Promise<number>;
+    markDelegationEpoch?: (zoneId: string, epoch: number, ttlMs?: number) => void | Promise<void>;
 }
 //# sourceMappingURL=iface.d.ts.map

package/dist/iface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iface.d.ts","sourceRoot":"","sources":["../src/iface.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtD,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CACnD"}
+{"version":3,"file":"iface.d.ts","sourceRoot":"","sources":["../src/iface.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtD,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACrE,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9F"}

package/dist/index.js

@@ -1,7 +1,7 @@
 // Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
 // Caracal, a product of Garudex Labs
 //
-// @caracalai/revocation — revocation iface and in-memory default.
+// @caracalai/revocation: revocation iface and in-memory default.
 export * from './iface.js';
 export * from './inmem.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,kEAAkE;AAElE,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA"}

package/dist/inmem.d.ts

@@ -1,6 +1,7 @@
 import type { RevocationStore } from './iface.js';
 export declare class InMemoryRevocationStore implements RevocationStore {
     private readonly entries;
+    private readonly delegationEpochs;
     private readonly defaultTtlMs;
     private readonly maxEntries;
     constructor(opts?: {
@@ -9,8 +10,9 @@ export declare class InMemoryRevocationStore implements RevocationStore {
     });
     isRevoked(sid: string): boolean;
     markRevoked(sid: string, ttlMs?: number): void;
+    currentDelegationEpoch(zoneId: string): number;
+    markDelegationEpoch(zoneId: string, epoch: number, ttlMs?: number): void;
     size(): number;
     private reapExpired;
-    private evictOldest;
 }
 //# sourceMappingURL=inmem.d.ts.map

package/dist/inmem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inmem.d.ts","sourceRoot":"","sources":["../src/inmem.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO;IAKrE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU/B,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAQ9C,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,WAAW;CAIpB"}
+{"version":3,"file":"inmem.d.ts","sourceRoot":"","sources":["../src/inmem.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+C;IAChF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO;IAKrE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU/B,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAQ9C,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAU9C,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IASxE,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,WAAW;CAOpB"}

package/dist/inmem.js

@@ -4,6 +4,7 @@
 // In-memory RevocationStore with per-entry TTLs and bounded capacity.
 export class InMemoryRevocationStore {
     entries = new Map();
+    delegationEpochs = new Map();
     defaultTtlMs;
     maxEntries;
     constructor(opts = {}) {
@@ -24,10 +25,29 @@ export class InMemoryRevocationStore {
         if (this.entries.size >= this.maxEntries) {
             this.reapExpired();
             if (this.entries.size >= this.maxEntries)
-                this.evictOldest();
+                throw new Error('Revocation store capacity exceeded');
         }
         this.entries.set(sid, { expiresAt: Date.now() + (ttlMs ?? this.defaultTtlMs) });
     }
+    currentDelegationEpoch(zoneId) {
+        const entry = this.delegationEpochs.get(zoneId);
+        if (!entry)
+            return 0;
+        if (entry.expiresAt <= Date.now()) {
+            this.delegationEpochs.delete(zoneId);
+            return 0;
+        }
+        return entry.epoch;
+    }
+    markDelegationEpoch(zoneId, epoch, ttlMs) {
+        const current = this.currentDelegationEpoch(zoneId);
+        if (epoch <= current)
+            return;
+        this.delegationEpochs.set(zoneId, {
+            epoch,
+            expiresAt: Date.now() + (ttlMs ?? this.defaultTtlMs),
+        });
+    }
     size() {
         return this.entries.size;
     }
@@ -38,10 +58,5 @@ export class InMemoryRevocationStore {
                 this.entries.delete(sid);
         }
     }
-    evictOldest() {
-        const it = this.entries.keys().next();
-        if (!it.done)
-            this.entries.delete(it.value);
-    }
 }
 //# sourceMappingURL=inmem.js.map

package/dist/inmem.js.map

@@ -1 +1 @@
-{"version":3,"file":"inmem.js","sourceRoot":"","sources":["../src/inmem.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,sEAAsE;AAQtE,MAAM,OAAO,uBAAuB;IACjB,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAA;IAClC,YAAY,CAAQ;IACpB,UAAU,CAAQ;IAEnC,YAAY,OAAuD,EAAE;QACnE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAA;IAC9C,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA;QACxB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,WAAW,CAAC,GAAW,EAAE,KAAc;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,EAAE,CAAA;YAClB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,WAAW,EAAE,CAAA;QAC9D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEO,WAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC;CACF"}
+{"version":3,"file":"inmem.js","sourceRoot":"","sources":["../src/inmem.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,sEAAsE;AAQtE,MAAM,OAAO,uBAAuB;IACjB,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAA;IAClC,gBAAgB,GAAG,IAAI,GAAG,EAAqC,CAAA;IAC/D,YAAY,CAAQ;IACpB,UAAU,CAAQ;IAEnC,YAAY,OAAuD,EAAE;QACnE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAA;IAC9C,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA;QACxB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,WAAW,CAAC,GAAW,EAAE,KAAc;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,EAAE,CAAA;YAClB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACjG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,sBAAsB,CAAC,MAAc;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAA;QACpB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACpC,OAAO,CAAC,CAAA;QACV,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED,mBAAmB,CAAC,MAAc,EAAE,KAAa,EAAE,KAAc;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,KAAK,IAAI,OAAO;YAAE,OAAM;QAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE;YAChC,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;SACrD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEO,WAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;CAEF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caracalai/revocation",
-  "version": "0.1.2",
+  "version": "0.1.4-rc.1",
   "description": "Caracal revocation lookup interface and in-memory default.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/Garudex-Labs/caracal",