@certrev/cert-block 0.5.5 → 1.0.0

package/dist/verify/cache.js

@@ -13,9 +13,9 @@
  *      still recovering quickly (short negative TTL).
  *
  * It is deliberately tiny + dependency-free (a Map + timestamps) so it runs in any server
- * runtime (Node, edge, workerd). For multi-instance deployments this is per-instance L1;
- * pair with a shared CDN/KV cache (the Delivery API is CDN-cacheable on
- * `lifecycle.revision`) for L2 — see README.
+ * runtime (Node, edge, workerd). For multi-instance deployments this is per-instance L1 and
+ * nothing more: each instance keeps its own copy, so an L2 (the CDN in front of the Delivery
+ * API, which is cacheable on `lifecycle.revision`, or a shared KV) is the caller's to add.
  */
 export class TtlCache {
     store = new Map();
@@ -48,8 +48,14 @@ export class TtlCache {
      * TTL; if `isNegative(value)` returns true (e.g. a 'suppress' verdict) it's cached
      * with the shorter negative TTL so a transient failure recovers fast. A thrown loader
      * is NOT cached (it rejects all current waiters and the next call retries).
+     *
+     * `positiveTtlMs` overrides the cache's positive TTL FOR THIS WRITE only, so one caller
+     * can hold a verdict longer/shorter than the cache's default without owning the cache.
+     * It deliberately does NOT apply to a negative result: a caller asking for a 10-minute
+     * positive TTL is asking for fewer origin reads, not for a transient failure to be
+     * remembered for ten minutes (see the negative-TTL rationale in the module header).
      */
-    async getOrLoad(key, loader, isNegative) {
+    async getOrLoad(key, loader, isNegative, positiveTtlMs) {
         const cached = this.peek(key);
         if (cached !== undefined)
             return cached;
@@ -59,7 +65,7 @@ export class TtlCache {
         const promise = (async () => {
             const value = await loader();
             const negative = isNegative ? isNegative(value) : false;
-            this.set(key, value, negative);
+            this.set(key, value, negative, negative ? undefined : positiveTtlMs);
             return value;
         })().finally(() => {
             this.inflight.delete(key);
@@ -67,21 +73,36 @@ export class TtlCache {
         this.inflight.set(key, promise);
         return promise;
     }
-    /** Insert/overwrite an entry with the appropriate TTL. */
-    set(key, value, negative = false) {
+    /** Insert/overwrite an entry. `ttlMsOverride` replaces the TTL this write would otherwise
+     *  get (positive or negative); omit it for the cache's configured TTLs. */
+    set(key, value, negative = false, ttlMsOverride) {
         if (this.store.size >= this.maxEntries && !this.store.has(key)) {
             // Evict the oldest inserted key (Map preserves insertion order).
             const oldest = this.store.keys().next().value;
             if (oldest !== undefined)
                 this.store.delete(oldest);
         }
-        const ttl = negative ? this.negativeTtlMs : this.ttlMs;
+        const configured = negative ? this.negativeTtlMs : this.ttlMs;
+        const ttl = ttlMsOverride !== undefined && Number.isFinite(ttlMsOverride) ? ttlMsOverride : configured;
         this.store.set(key, { value, expiresAt: this.now() + ttl, negative });
     }
     /** Drop a key (e.g. on a known revocation push). */
     delete(key) {
         this.store.delete(key);
     }
+    /**
+     * Drop every key under a prefix. WHY it exists: a cache key identifies everything the
+     * cached value depends on, which for a verdict includes the live content hash the render
+     * observed — a fact a revocation webhook does not know. Invalidating by prefix lets the
+     * webhook drop a placement without having to reconstruct every render context that ever
+     * cached it.
+     */
+    deletePrefix(prefix) {
+        for (const key of this.store.keys()) {
+            if (key.startsWith(prefix))
+                this.store.delete(key);
+        }
+    }
     clear() {
         this.store.clear();
         this.inflight.clear();

package/dist/verify/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/verify/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAmBH,MAAM,OAAO,QAAQ;IACH,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAA;IACnC,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAA;IACxC,KAAK,CAAQ;IACb,aAAa,CAAQ;IACrB,UAAU,CAAQ;IAClB,GAAG,CAAc;IAElC,YAAY,OAAwB,EAAE;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAA;QACjC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,KAAK,CAAA;QAChD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAA;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAChC,CAAC;IAED,kFAAkF;IAClF,IAAI,CAAC,GAAW;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxB,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,MAAwB,EAAE,UAA8B;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAA;YAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACvD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC9B,OAAO,KAAK,CAAA;QACb,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,OAAO,CAAA;IACf,CAAC;IAED,0DAA0D;IAC1D,GAAG,CAAC,GAAW,EAAE,KAAQ,EAAE,QAAQ,GAAG,KAAK;QAC1C,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,iEAAiE;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;QACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,GAAW;QACjB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAED,KAAK;QACJ,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;IACvB,CAAC;CACD"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/verify/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAmBH,MAAM,OAAO,QAAQ;IACH,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAA;IACnC,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAA;IACxC,KAAK,CAAQ;IACb,aAAa,CAAQ;IACrB,UAAU,CAAQ;IAClB,GAAG,CAAc;IAElC,YAAY,OAAwB,EAAE;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAA;QACjC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,KAAK,CAAA;QAChD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAA;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAChC,CAAC;IAED,kFAAkF;IAClF,IAAI,CAAC,GAAW;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxB,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,SAAS,CACd,GAAW,EACX,MAAwB,EACxB,UAA8B,EAC9B,aAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAA;YAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACvD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;YACpE,OAAO,KAAK,CAAA;QACb,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,OAAO,CAAA;IACf,CAAC;IAED;+EAC2E;IAC3E,GAAG,CAAC,GAAW,EAAE,KAAQ,EAAE,QAAQ,GAAG,KAAK,EAAE,aAAsB;QAClE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,iEAAiE;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;QAC7D,MAAM,GAAG,GAAG,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAA;QACtG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,GAAW;QACjB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAc;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnD,CAAC;IACF,CAAC;IAED,KAAK;QACJ,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;IACvB,CAAC;CACD"}

package/dist/verify/fetch-with-deadline.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `fetchWithDeadline` — every network read on the render path gets a deadline.
+ *
+ * WHY: the verify layer runs INSIDE a server render (a Hydrogen loader, a Next server
+ * component, a Builder server fetch). A hung origin with no deadline holds that render open
+ * for as long as the runtime's socket timeout allows — one confirmed case was still pending
+ * at 45 SECONDS, i.e. a page that never answered because a decorative badge could not be
+ * verified. A badge is never worth a page: past the deadline the request is ABORTED (the
+ * connection goes back) and the caller fails closed, the same safe outcome as any other
+ * fetch failure.
+ *
+ * Two deliberate choices:
+ *   • The deadline is enforced by a RACE, not by the AbortSignal alone. A `fetchImpl` that
+ *     ignores its signal (a wrapper, a proxy, a non-conforming polyfill) must not be able to
+ *     hold a render open. The abort still fires, so a conforming implementation also releases
+ *     the socket rather than merely being abandoned.
+ *   • `setTimeout` + `AbortController`, not `AbortSignal.timeout()`. The one-liner reads
+ *     better but its timer is not the one a test's fake clock controls, and a deadline that
+ *     can only be tested by really waiting is a deadline nobody keeps tested.
+ */
+/**
+ * Default deadline for a render-path fetch. The Delivery API is CDN-cacheable and answers
+ * well under a second at p99; three seconds is generous for a cold origin and still bounded
+ * by what a page can afford to spend on a decoration whose failure mode is "render nothing".
+ * Callers on a tighter TTFB budget pass their own.
+ */
+export declare const DEFAULT_FETCH_TIMEOUT_MS = 3000;
+/**
+ * `fetchImpl(url, init)` with a hard deadline. Rejects when the deadline passes (after
+ * aborting the request); every caller on the verify path treats that rejection like any other
+ * fetch failure — fail closed. A non-finite or non-positive `timeoutMs` is an explicit opt-out
+ * (no deadline), for a caller that owns its own cancellation.
+ */
+export declare function fetchWithDeadline(fetchImpl: typeof fetch, url: string, init: RequestInit, timeoutMs?: number): Promise<Response>;
+//# sourceMappingURL=fetch-with-deadline.d.ts.map

package/dist/verify/fetch-with-deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-with-deadline.d.ts","sourceRoot":"","sources":["../../src/verify/fetch-with-deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAAQ,CAAA;AAE7C;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACtC,SAAS,EAAE,OAAO,KAAK,EACvB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,SAAS,GAAE,MAAiC,GAC1C,OAAO,CAAC,QAAQ,CAAC,CAmBnB"}

package/dist/verify/fetch-with-deadline.js

@@ -0,0 +1,55 @@
+/**
+ * `fetchWithDeadline` — every network read on the render path gets a deadline.
+ *
+ * WHY: the verify layer runs INSIDE a server render (a Hydrogen loader, a Next server
+ * component, a Builder server fetch). A hung origin with no deadline holds that render open
+ * for as long as the runtime's socket timeout allows — one confirmed case was still pending
+ * at 45 SECONDS, i.e. a page that never answered because a decorative badge could not be
+ * verified. A badge is never worth a page: past the deadline the request is ABORTED (the
+ * connection goes back) and the caller fails closed, the same safe outcome as any other
+ * fetch failure.
+ *
+ * Two deliberate choices:
+ *   • The deadline is enforced by a RACE, not by the AbortSignal alone. A `fetchImpl` that
+ *     ignores its signal (a wrapper, a proxy, a non-conforming polyfill) must not be able to
+ *     hold a render open. The abort still fires, so a conforming implementation also releases
+ *     the socket rather than merely being abandoned.
+ *   • `setTimeout` + `AbortController`, not `AbortSignal.timeout()`. The one-liner reads
+ *     better but its timer is not the one a test's fake clock controls, and a deadline that
+ *     can only be tested by really waiting is a deadline nobody keeps tested.
+ */
+/**
+ * Default deadline for a render-path fetch. The Delivery API is CDN-cacheable and answers
+ * well under a second at p99; three seconds is generous for a cold origin and still bounded
+ * by what a page can afford to spend on a decoration whose failure mode is "render nothing".
+ * Callers on a tighter TTFB budget pass their own.
+ */
+export const DEFAULT_FETCH_TIMEOUT_MS = 3_000;
+/**
+ * `fetchImpl(url, init)` with a hard deadline. Rejects when the deadline passes (after
+ * aborting the request); every caller on the verify path treats that rejection like any other
+ * fetch failure — fail closed. A non-finite or non-positive `timeoutMs` is an explicit opt-out
+ * (no deadline), for a caller that owns its own cancellation.
+ */
+export async function fetchWithDeadline(fetchImpl, url, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+        return fetchImpl(url, init);
+    const controller = new AbortController();
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new Error(`cert-block: fetch exceeded its ${timeoutMs}ms deadline — ${url}`));
+        }, timeoutMs);
+    });
+    try {
+        // Promise.race subscribes to both, so an abort-rejection that lands after the race has
+        // settled is still handled — it never surfaces as an unhandled rejection.
+        return await Promise.race([fetchImpl(url, { ...init, signal: controller.signal }), deadline]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=fetch-with-deadline.js.map

package/dist/verify/fetch-with-deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-with-deadline.js","sourceRoot":"","sources":["../../src/verify/fetch-with-deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,SAAuB,EACvB,GAAW,EACX,IAAiB,EACjB,YAAoB,wBAAwB;IAE5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAE9E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,IAAI,KAAgD,CAAA;IACpD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACvB,UAAU,CAAC,KAAK,EAAE,CAAA;YAClB,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,SAAS,iBAAiB,GAAG,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC,EAAE,SAAS,CAAC,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC;QACJ,uFAAuF;QACvF,0EAA0E;QAC1E,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC9F,CAAC;YAAS,CAAC;QACV,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC"}

package/dist/verify/get-verified-envelope.d.ts

@@ -16,8 +16,13 @@
  * JSON-LD; `{ decision: 'suppress', reason }` → render NOTHING. Any error (network,
  * malformed JSON, throwing resolver) collapses to a `suppress` verdict — never throws
  * into the render path, never renders an unverified credential.
+ *
+ * `verdict.reason` is the ONLY signal a consumer gets when a badge does not appear (this
+ * package logs nothing), so every failure path here reports what ACTUALLY failed rather than
+ * a convenient catch-all. Every fetch also carries a deadline: a hung origin fails closed at
+ * `timeoutMs` instead of holding the render open (see ./fetch-with-deadline).
  */
-import type { CertDeliveryEnvelope, CertVerdict, RenderContext, ResolvePublicKeyByKid } from '../contract/kernel.js';
+import type { CertDeliveryArtifact, CertVerdict, RenderContext, ResolvePublicKeyByKid } from '../contract/kernel.js';
 import { TtlCache } from './cache.js';
 /** Where the signed envelope comes from. Exactly one of the two source shapes. */
 export type EnvelopeSource = 
@@ -29,27 +34,31 @@ export type EnvelopeSource =
     readonly platform: string;
     readonly externalId: string;
 }
-/** PUSH/native: an envelope already read from a Shopify app-owned metafield (or any
+/** PUSH/native: an artifact already read from a Shopify app-owned metafield (or any
  *  native store). The caller fetched it via the Storefront API; we just verify it. The
- *  value may be the parsed envelope or its JSON string (metafields store strings). */
+ *  value may be the parsed artifact — a full envelope OR the slim revocation tombstone —
+ *  or its JSON string (metafields store strings). */
  | {
     readonly kind: 'metafield';
-    readonly value: CertDeliveryEnvelope | string | null | undefined;
+    readonly value: CertDeliveryArtifact | string | null | undefined;
 };
 export interface GetVerifiedEnvelopeOptions {
     readonly source: EnvelopeSource;
     /** kid → public-key resolver (see ./resolve-kid). Required: no verify without keys. */
     readonly resolveKid: ResolvePublicKeyByKid;
     /** Render context: the platform + externalId this edge IS, plus optional live hash. */
-    readonly context: Omit<RenderContext, 'now'> & {
-        readonly now?: Date;
-    };
+    readonly context: RenderContext;
     /** Injectable fetch for tests / non-global-fetch runtimes. */
     readonly fetchImpl?: typeof fetch;
     /** Cache override (per-instance). Defaults to the module-level shared cache. */
     readonly cache?: TtlCache<CertVerdict>;
-    /** Positive verdict TTL ms (default 60_000). */
+    /** TTL in ms for a RENDER verdict written by this call (default: the cache's own positive
+     *  TTL — 60_000 on the shared cache). A suppress verdict keeps the cache's short negative
+     *  TTL regardless, so a longer `ttlMs` can never make a transient failure sticky. */
     readonly ttlMs?: number;
+    /** Deadline in ms for the Delivery API fetch (default `DEFAULT_FETCH_TIMEOUT_MS`, 3s).
+     *  Ignored by the metafield source, which does no I/O. */
+    readonly timeoutMs?: number;
 }
 /** Module-level shared cache so all calls in a process coordinate by default. */
 declare const sharedVerdictCache: TtlCache<CertVerdict>;
@@ -59,7 +68,12 @@ declare const sharedVerdictCache: TtlCache<CertVerdict>;
  * single-flight keep the origin load bounded.
  */
 export declare function getVerifiedEnvelope(opts: GetVerifiedEnvelopeOptions): Promise<CertVerdict>;
-/** Expose the shared cache so a revocation webhook handler can invalidate proactively. */
+/**
+ * Expose the shared cache so a revocation webhook handler can invalidate proactively. Drops
+ * EVERY entry for this source at this placement, whatever live content hash each was cached
+ * under — the webhook knows the article, never the body hash a given render observed, and an
+ * invalidation that misses because of a hash mismatch is a revoked cert that keeps rendering.
+ */
 export declare function invalidateVerdict(source: EnvelopeSource, context: RenderContext, cache?: TtlCache<CertVerdict>): void;
 export { sharedVerdictCache };
 //# sourceMappingURL=get-verified-envelope.d.ts.map

package/dist/verify/get-verified-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-verified-envelope.d.ts","sourceRoot":"","sources":["../../src/verify/get-verified-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAEpH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC,kFAAkF;AAClF,MAAM,MAAM,cAAc;AACzB,2EAA2E;AACzE;IACA,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC1B;AACH;;sFAEsF;GACpF;IACA,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAC/D,CAAA;AAEJ,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;IAC1C,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;IACtE,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACjC,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;IACtC,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,iFAAiF;AACjF,QAAA,MAAM,kBAAkB,uBAAqE,CAAA;AAyE7F;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CAkChG;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAChC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,aAAa,EACtB,KAAK,GAAE,QAAQ,CAAC,WAAW,CAAsB,GAC/C,IAAI,CAEN;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAA"}
+{"version":3,"file":"get-verified-envelope.d.ts","sourceRoot":"","sources":["../../src/verify/get-verified-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACX,oBAAoB,EAEpB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGrC,kFAAkF;AAClF,MAAM,MAAM,cAAc;AACzB,2EAA2E;AACzE;IACA,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC1B;AACH;;;qDAGqD;GACnD;IACA,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAC/D,CAAA;AAEJ,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;IAC1C,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACjC,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;IACtC;;yFAEqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;8DAC0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,iFAAiF;AACjF,QAAA,MAAM,kBAAkB,uBAAqE,CAAA;AAwI7F;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BhG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAChC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,aAAa,EACtB,KAAK,GAAE,QAAQ,CAAC,WAAW,CAAsB,GAC/C,IAAI,CAEN;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAA"}

package/dist/verify/get-verified-envelope.js

@@ -16,24 +16,34 @@
  * JSON-LD; `{ decision: 'suppress', reason }` → render NOTHING. Any error (network,
  * malformed JSON, throwing resolver) collapses to a `suppress` verdict — never throws
  * into the render path, never renders an unverified credential.
+ *
+ * `verdict.reason` is the ONLY signal a consumer gets when a badge does not appear (this
+ * package logs nothing), so every failure path here reports what ACTUALLY failed rather than
+ * a convenient catch-all. Every fetch also carries a deadline: a hung origin fails closed at
+ * `timeoutMs` instead of holding the render open (see ./fetch-with-deadline).
  */
-import { verifyEnvelope } from '../contract/kernel.js';
+import { verifyArtifact } from '../contract/kernel.js';
 import { TtlCache } from './cache.js';
+import { DEFAULT_FETCH_TIMEOUT_MS, fetchWithDeadline } from './fetch-with-deadline.js';
 /** Module-level shared cache so all calls in a process coordinate by default. */
 const sharedVerdictCache = new TtlCache({ ttlMs: 60_000, negativeTtlMs: 5_000 });
 function suppress(reason) {
     return { decision: 'suppress', reason };
 }
-function parseEnvelope(value) {
-    if (value == null)
-        return null;
+/** Read the artifact out of a metafield value. Never throws. */
+function parseMetafieldValue(value) {
+    // Absent — never certified, or the app cleared the metafield (Shopify writes an empty
+    // string rather than deleting it). Nothing is published for this subject.
+    if (value == null || (typeof value === 'string' && value.trim() === '')) {
+        return { ok: false, reason: 'subject_mismatch' };
+    }
     if (typeof value !== 'string')
-        return value;
+        return { ok: true, artifact: value };
     try {
-        return JSON.parse(value);
+        return { ok: true, artifact: JSON.parse(value) };
     }
     catch {
-        return null;
+        return { ok: false, reason: 'unsupported_contract_version' };
     }
 }
 function deliveryApiUrl(s) {
@@ -63,25 +73,64 @@ function metafieldValueKey(value) {
     const s = typeof value === 'string' ? value : JSON.stringify(value);
     return fnv1a(s);
 }
-/** Stable cache key per (source identity × render externalId × envelope value). */
+/** WHICH artifact is being verified. For the delivery source that is the full URL — the base
+ *  URL is part of the identity (a staging portal and production serve DIFFERENT envelopes for
+ *  the same platform/externalId); for a metafield it's a hash of the value the caller passed. */
+function sourceKey(source) {
+    return source.kind === 'delivery_api' ? `api:${deliveryApiUrl(source)}` : `mf:${metafieldValueKey(source.value)}`;
+}
+/** WHERE it is being rendered. `now` is deliberately NOT part of the key: elapsed time is what
+ *  the TTL already bounds, and keying on an injected clock would turn the cache into a
+ *  permanent miss for every caller that passes one. */
+function placementKey(ctx) {
+    return `${encodeURIComponent(ctx.platform)}:${encodeURIComponent(ctx.externalId)}`;
+}
+/** Everything in the key ABOVE the live content hash — one placement, all of its hashes. */
+function placementPrefix(source, ctx) {
+    return `${sourceKey(source)}|${placementKey(ctx)}|`;
+}
+/**
+ * Stable cache key per (artifact identity × placement × live content hash) — i.e. every input
+ * the verdict actually depends on. Both source branches now key on the same three things: the
+ * old delivery key (`api:<platform>:<externalId>`) named neither the base URL nor the render
+ * context, so one entry was shared by a staging and a production portal, and — the dangerous
+ * one — a verdict computed while the article matched its `contentDigest` was served for a
+ * later render whose body had DRIFTED, rendering a credential the drift check would have
+ * suppressed. The live hash goes LAST so `invalidateVerdict` can drop a placement by prefix.
+ */
 function cacheKey(source, ctx) {
-    if (source.kind === 'delivery_api') {
-        return `api:${source.platform}:${source.externalId}`;
-    }
-    // Metafield: key on the rendering identity AND a short hash of the envelope value, so a
-    // push update (new envelope at the same placement) busts the entry, and verifying
-    // different envelopes against one render context never collides on a stale verdict.
-    return `mf:${ctx.platform}:${ctx.externalId}:${metafieldValueKey(source.value)}`;
+    return `${placementPrefix(source, ctx)}${ctx.liveContentHash ?? '-'}`;
 }
-async function fetchFromDeliveryApi(s, fetchImpl) {
-    const res = await fetchImpl(deliveryApiUrl(s), { headers: { accept: 'application/json' } });
-    if (!res.ok)
-        return null; // 404 / 410 (revoked, no longer served) → no envelope → suppress
+/** Fetch the artifact from the Delivery API. Never throws: every failure comes back as the
+ *  truthful suppress reason (see `SourceOutcome`). */
+async function fetchFromDeliveryApi(s, fetchImpl, timeoutMs) {
+    let res;
+    try {
+        res = await fetchWithDeadline(fetchImpl, deliveryApiUrl(s), { headers: { accept: 'application/json' } }, timeoutMs);
+    }
+    catch {
+        // Unreachable origin, DNS/TLS failure, or the deadline above. No transport member
+        // exists in the contract enum; this is the least-wrong one.
+        return { ok: false, reason: 'unsupported_contract_version' };
+    }
+    if (res.status === 404 || res.status === 410) {
+        // The API serves nothing for this (platform, externalId): never certified, or the
+        // placement was withdrawn. Revocation of a LIVE cert comes back 200 with a tombstone
+        // so a 4xx here is genuinely "no credential for this subject" — which is
+        // also the question the consumer needs to ask (is this the externalId I think it is?).
+        return { ok: false, reason: 'subject_mismatch' };
+    }
+    if (!res.ok) {
+        // 5xx / 429 / anything else: the origin is failing, not the credential. Transport gap
+        // again — same least-wrong member, and the short negative TTL keeps it recoverable.
+        return { ok: false, reason: 'unsupported_contract_version' };
+    }
     try {
-        return (await res.json());
+        return { ok: true, artifact: (await res.json()) };
     }
     catch {
-        return null;
+        // A body arrived and could not be parsed — here the reason is literally true.
+        return { ok: false, reason: 'unsupported_contract_version' };
     }
 }
 /**
@@ -96,33 +145,33 @@ export async function getVerifiedEnvelope(opts) {
     const key = cacheKey(opts.source, ctx);
     const isSuppress = (v) => v.decision !== 'render';
     return cache.getOrLoad(key, async () => {
-        let envelope;
-        try {
-            envelope =
-                opts.source.kind === 'delivery_api'
-                    ? await fetchFromDeliveryApi(opts.source, fetchImpl)
-                    : parseEnvelope(opts.source.value);
-        }
-        catch {
-            // Network/JSON failure → fail closed (do NOT render an unverified credential).
-            return suppress('unsupported_contract_version');
-        }
-        if (!envelope) {
-            // No envelope present (never certified / revoked + cleared / 404) → suppress.
-            return suppress('unsupported_contract_version');
-        }
+        const sourced = opts.source.kind === 'delivery_api'
+            ? await fetchFromDeliveryApi(opts.source, fetchImpl, opts.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS)
+            : parseMetafieldValue(opts.source.value);
+        if (!sourced.ok)
+            return suppress(sourced.reason);
+        // `verifyArtifact` — not `verifyEnvelope` — because the Delivery API answers a
+        // revoked cert with the slim signed TOMBSTONE. The envelope-only kernel
+        // still fails closed on one, but it reports it as an unparseable envelope; the
+        // artifact kernel verifies the tombstone's own signature + subject and says
+        // 'revoked', which is both true and the thing a consumer needs to hear.
         // The kernel itself never throws (it fails closed), but guard the resolver too.
         try {
-            return await verifyEnvelope(envelope, opts.resolveKid, ctx);
+            return await verifyArtifact(sourced.artifact, opts.resolveKid, ctx);
         }
         catch {
             return suppress('unknown_key');
         }
-    }, isSuppress);
+    }, isSuppress, opts.ttlMs);
 }
-/** Expose the shared cache so a revocation webhook handler can invalidate proactively. */
+/**
+ * Expose the shared cache so a revocation webhook handler can invalidate proactively. Drops
+ * EVERY entry for this source at this placement, whatever live content hash each was cached
+ * under — the webhook knows the article, never the body hash a given render observed, and an
+ * invalidation that misses because of a hash mismatch is a revoked cert that keeps rendering.
+ */
 export function invalidateVerdict(source, context, cache = sharedVerdictCache) {
-    cache.delete(cacheKey(source, context));
+    cache.deletePrefix(placementPrefix(source, context));
 }
 export { sharedVerdictCache };
 //# sourceMappingURL=get-verified-envelope.js.map

package/dist/verify/get-verified-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-verified-envelope.js","sourceRoot":"","sources":["../../src/verify/get-verified-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAkCrC,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,IAAI,QAAQ,CAAc,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;AAE7F,SAAS,QAAQ,CAChB,MAE2D;IAE3D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,KAAuD;IAC7E,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,CAAoD;IAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC1C,OAAO,GAAG,IAAI,yBAAyB,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAA;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,CAAS;IACvB,IAAI,CAAC,GAAG,UAAU,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACpB,kEAAkE;QAClE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC;AAED,6FAA6F;AAC7F,SAAS,iBAAiB,CAAC,KAAuD;IACjF,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,MAAM,CAAA;IAChC,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACnE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,MAAsB,EAAE,GAAkB;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,OAAO,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAA;IACrD,CAAC;IACD,wFAAwF;IACxF,kFAAkF;IAClF,oFAAoF;IACpF,OAAO,MAAM,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACjF,CAAC;AAED,KAAK,UAAU,oBAAoB,CAClC,CAAoD,EACpD,SAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAC3F,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA,CAAC,iEAAiE;IAC1F,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAgC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAA;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAA;IAC9C,MAAM,GAAG,GAAkB,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAEtC,MAAM,UAAU,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAE9D,OAAO,KAAK,CAAC,SAAS,CACrB,GAAG,EACH,KAAK,IAAI,EAAE;QACV,IAAI,QAAqC,CAAA;QACzC,IAAI,CAAC;YACJ,QAAQ;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc;oBAClC,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;oBACpD,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,+EAA+E;YAC/E,OAAO,QAAQ,CAAC,8BAA8B,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,8EAA8E;YAC9E,OAAO,QAAQ,CAAC,8BAA8B,CAAC,CAAA;QAChD,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC;YACJ,OAAO,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,QAAQ,CAAC,aAAa,CAAC,CAAA;QAC/B,CAAC;IACF,CAAC,EACD,UAAU,CACV,CAAA;AACF,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAChC,MAAsB,EACtB,OAAsB,EACtB,QAA+B,kBAAkB;IAEjD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAA"}
+{"version":3,"file":"get-verified-envelope.js","sourceRoot":"","sources":["../../src/verify/get-verified-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AASH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAwCtF,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,IAAI,QAAQ,CAAc,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;AAE7F,SAAS,QAAQ,CAAC,MAA0B;IAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACxC,CAAC;AAqBD,gEAAgE;AAChE,SAAS,mBAAmB,CAAC,KAAuD;IACnF,sFAAsF;IACtF,0EAA0E;IAC1E,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACjD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACnE,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,EAAE,CAAA;IACzE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;IAC7D,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,CAAoD;IAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC1C,OAAO,GAAG,IAAI,yBAAyB,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAA;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,CAAS;IACvB,IAAI,CAAC,GAAG,UAAU,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACpB,kEAAkE;QAClE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC;AAED,6FAA6F;AAC7F,SAAS,iBAAiB,CAAC,KAAuD;IACjF,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,MAAM,CAAA;IAChC,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACnE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC;AAED;;iGAEiG;AACjG,SAAS,SAAS,CAAC,MAAsB;IACxC,OAAO,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAClH,CAAC;AAED;;uDAEuD;AACvD,SAAS,YAAY,CAAC,GAAkB;IACvC,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;AACnF,CAAC;AAED,4FAA4F;AAC5F,SAAS,eAAe,CAAC,MAAsB,EAAE,GAAkB;IAClE,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAA;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,MAAsB,EAAE,GAAkB;IAC3D,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,eAAe,IAAI,GAAG,EAAE,CAAA;AACtE,CAAC;AAED;sDACsD;AACtD,KAAK,UAAU,oBAAoB,CAClC,CAAoD,EACpD,SAAuB,EACvB,SAAiB;IAEjB,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;IACpH,CAAC;IAAC,MAAM,CAAC;QACR,kFAAkF;QAClF,4DAA4D;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9C,kFAAkF;QAClF,qFAAqF;QACrF,yEAAyE;QACzE,uFAAuF;QACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACjD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,sFAAsF;QACtF,oFAAoF;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;IAC7D,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,EAAE,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACR,8EAA8E;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;IAC7D,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAgC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAA;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAA;IAC9C,MAAM,GAAG,GAAkB,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAEtC,MAAM,UAAU,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAE9D,OAAO,KAAK,CAAC,SAAS,CACrB,GAAG,EACH,KAAK,IAAI,EAAE;QACV,MAAM,OAAO,GACZ,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc;YAClC,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC;YAChG,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,+EAA+E;QAC/E,wEAAwE;QACxE,+EAA+E;QAC/E,4EAA4E;QAC5E,wEAAwE;QACxE,gFAAgF;QAChF,IAAI,CAAC;YACJ,OAAO,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,QAAQ,CAAC,aAAa,CAAC,CAAA;QAC/B,CAAC;IACF,CAAC,EACD,UAAU,EACV,IAAI,CAAC,KAAK,CACV,CAAA;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAChC,MAAsB,EACtB,OAAsB,EACtB,QAA+B,kBAAkB;IAEjD,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAA"}

package/dist/verify/resolve-kid.d.ts

@@ -26,6 +26,9 @@ export interface FetchingKidResolverOptions {
     readonly jwksUrl: string;
     /** Key-set cache TTL in ms (default 1h — keys rotate rarely). */
     readonly ttlMs?: number;
+    /** Deadline in ms for the JWKS fetch (default `DEFAULT_FETCH_TIMEOUT_MS`, 3s). This fetch
+     *  is on the render path too — a hung key endpoint must not hold a page open. */
+    readonly timeoutMs?: number;
     /** Injectable fetch for tests / non-global-fetch runtimes. */
     readonly fetchImpl?: typeof fetch;
 }

package/dist/verify/resolve-kid.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-kid.d.ts","sourceRoot":"","sources":["../../src/verify/resolve-kid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAGzF,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAA;AAOnF,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,qBAAqB,CAK3E;AAgCD,MAAM,WAAW,0BAA0B;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACjC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,qBAAqB,CAqB3F"}
+{"version":3,"file":"resolve-kid.d.ts","sourceRoot":"","sources":["../../src/verify/resolve-kid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAIzF,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAA;AAOnF,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,qBAAqB,CAK3E;AAgCD,MAAM,WAAW,0BAA0B;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;qFACiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACjC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,qBAAqB,CAiC3F"}

package/dist/verify/resolve-kid.js

@@ -18,6 +18,7 @@
  */
 import { base64urlDecode } from '@certrev/cert-contract';
 import { TtlCache } from './cache.js';
+import { DEFAULT_FETCH_TIMEOUT_MS, fetchWithDeadline } from './fetch-with-deadline.js';
 function asInput(v) {
     // A bare string is treated as PEM (the common deploy-config form).
     return typeof v === 'string' ? { format: 'pem', pem: v } : v;
@@ -54,14 +55,22 @@ export function fetchingKidResolver(opts) {
     const CACHE_KEY = opts.jwksUrl;
     async function loadKeySet() {
         const map = new Map();
-        const res = await fetchImpl(opts.jwksUrl, { headers: { accept: 'application/json' } });
-        if (!res.ok)
-            return map; // empty → every kid resolves null → fail closed
-        const doc = (await res.json());
-        for (const jwk of doc.keys ?? []) {
-            const input = jwkToInput(jwk);
-            if (input && jwk.kid)
-                map.set(jwk.kid, input);
+        try {
+            const res = await fetchWithDeadline(fetchImpl, opts.jwksUrl, { headers: { accept: 'application/json' } }, opts.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS);
+            if (!res.ok)
+                return map; // empty → every kid resolves null → fail closed
+            const doc = (await res.json());
+            for (const jwk of doc.keys ?? []) {
+                const input = jwkToInput(jwk);
+                if (input && jwk.kid)
+                    map.set(jwk.kid, input);
+            }
+        }
+        catch {
+            // Unreachable / deadline / unreadable body → the EMPTY key set below, negative-cached
+            // briefly. The resolver itself never throws: a kid that cannot be resolved must come
+            // back as null ('unknown_key' — true) rather than as an exception the caller has to
+            // remember to catch.
         }
         return map;
     }

package/dist/verify/resolve-kid.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-kid.js","sourceRoot":"","sources":["../../src/verify/resolve-kid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKrC,SAAS,OAAO,CAAC,CAAiC;IACjD,mEAAmE;IACnE,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IACnD,OAAO,CAAC,GAAG,EAAE,EAAE;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7B,CAAC,CAAA;AACF,CAAC;AAkBD,yFAAyF;AACzF,SAAS,gBAAgB,CAAC,MAAc;IACvC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,GAAiB;IACpC,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAA;IACnD,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAA;IACpD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAqC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAA;IAClG,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAA;IAE9B,KAAK,UAAU,UAAU;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiC,CAAA;QACpD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;QACtF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,GAAG,CAAA,CAAC,gDAAgD;QACxE,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAA;QACpD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,KAAK,IAAI,GAAG,CAAC,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,GAAG,CAAA;IACX,CAAC;IAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;QAChF,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IAC/B,CAAC,CAAA;AACF,CAAC"}
+{"version":3,"file":"resolve-kid.js","sourceRoot":"","sources":["../../src/verify/resolve-kid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAKtF,SAAS,OAAO,CAAC,CAAiC;IACjD,mEAAmE;IACnE,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IACnD,OAAO,CAAC,GAAG,EAAE,EAAE;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7B,CAAC,CAAA;AACF,CAAC;AAkBD,yFAAyF;AACzF,SAAS,gBAAgB,CAAC,MAAc;IACvC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,GAAiB;IACpC,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAA;IACnD,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAA;IACpD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAqC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAA;IAClG,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAA;IAE9B,KAAK,UAAU,UAAU;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiC,CAAA;QACpD,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAClC,SAAS,EACT,IAAI,CAAC,OAAO,EACZ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC3C,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAC1C,CAAA;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,GAAG,CAAA,CAAC,gDAAgD;YACxE,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAA;YACpD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,IAAI,KAAK,IAAI,GAAG,CAAC,GAAG;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9C,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,sFAAsF;YACtF,qFAAqF;YACrF,oFAAoF;YACpF,qBAAqB;QACtB,CAAC;QACD,OAAO,GAAG,CAAA;IACX,CAAC;IAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;QAChF,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IAC/B,CAAC,CAAA;AACF,CAAC"}

package/dist/webcomponent/certrev-badge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certrev-badge.d.ts","sourceRoot":"","sources":["../../src/webcomponent/certrev-badge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAe,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAI/E,eAAO,MAAM,iBAAiB,kBAAkB,CAAA;AAQhD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAE3E;AAED,qBAAa,mBAAoB,SAAQ,WAAW;IACnD,MAAM,KAAK,kBAAkB,IAAI,MAAM,EAAE,CAExC;IAED,iBAAiB,IAAI,IAAI;IAOzB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;YAQjF,oBAAoB;CA4BlC;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC"}
+{"version":3,"file":"certrev-badge.d.ts","sourceRoot":"","sources":["../../src/webcomponent/certrev-badge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAe,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAI/E,eAAO,MAAM,iBAAiB,kBAAkB,CAAA;AAQhD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAE3E;AAaD,qBAAa,mBAAoB,SAAQ,WAAW;IACnD,MAAM,KAAK,kBAAkB,IAAI,MAAM,EAAE,CAExC;IAED,iBAAiB,IAAI,IAAI;IAOzB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;YAQjF,oBAAoB;CAuClC;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC"}

package/dist/webcomponent/certrev-badge.js

@@ -36,6 +36,16 @@ let globalResolveKid = null;
 export function setCertRevKidResolver(resolver) {
     globalResolveKid = resolver;
 }
+/**
+ * `badge-style` is AUTHOR-typed markup, not signed data — a hand-written attribute on a page
+ * we don't control. Only the two real faces are honored; anything else (`"Full"`, a stray
+ * value, an empty attribute) reads as ABSENT, so the signed display config decides. The
+ * attribute was previously CAST (`as 'full' | 'compact' | null`), which let a typo travel
+ * into the renderer as if it were a face.
+ */
+function badgeStyleAttribute(value) {
+    return value === 'full' || value === 'compact' ? value : undefined;
+}
 export class CertRevBadgeElement extends HTMLElement {
     static get observedAttributes() {
         return ['delivery-api', 'platform', 'external-id', 'accent-color', 'badge-style', 'content-hash'];
@@ -83,8 +93,20 @@ export class CertRevBadgeElement extends HTMLElement {
         if (verdict.decision !== 'render')
             return;
         const accentColor = this.getAttribute('accent-color') ?? undefined;
-        const badgeStyle = this.getAttribute('badge-style') ?? undefined;
-        this.innerHTML = renderBadgeHtml(verdict.payload, { accentColor, badgeStyle });
+        const badgeStyle = badgeStyleAttribute(this.getAttribute('badge-style'));
+        // The render is INSIDE the fail-closed boundary too. `connectedCallback` `void`s this
+        // promise, so a throw from the renderer (a payload shape nothing runtime-validates —
+        // the kernel checks the signature, never `content`) would escape as an unhandled
+        // rejection instead of rendering nothing, which is the one behaviour this element
+        // documents. Compute first, assign after, so a failure leaves the element untouched.
+        let html;
+        try {
+            html = renderBadgeHtml(verdict.payload, { accentColor, badgeStyle });
+        }
+        catch {
+            return; // fail closed
+        }
+        this.innerHTML = html;
     }
 }
 /** Register the element. Idempotent + safe to call only in a browser/customElements env. */

package/dist/webcomponent/certrev-badge.js.map

@@ -1 +1 @@
-{"version":3,"file":"certrev-badge.js","sourceRoot":"","sources":["../../src/webcomponent/certrev-badge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAA;AAEhD;;;;GAIG;AACH,IAAI,gBAAgB,GAAiC,IAAI,CAAA;AACzD,MAAM,UAAU,qBAAqB,CAAC,QAA+B;IACpE,gBAAgB,GAAG,QAAQ,CAAA;AAC5B,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IACnD,MAAM,KAAK,kBAAkB;QAC5B,OAAO,CAAC,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,CAAC,CAAA;IAClG,CAAC;IAED,iBAAiB;QAChB,qFAAqF;QACrF,8EAA8E;QAC9E,IAAI,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC;YAAE,OAAM;QAChD,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAA;IACjC,CAAC;IAED,wBAAwB,CAAC,KAAa,EAAE,QAAuB,EAAE,QAAuB;QACvF,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAM;QACjC,mEAAmE;QACnE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAA;QACjC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,oBAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;YAAE,OAAM,CAAC,oCAAoC;QACrF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvB,qEAAqE;YACrE,OAAM;QACP,CAAC;QACD,IAAI,OAAoB,CAAA;QACxB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,mBAAmB,CAAC;gBACnC,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC/D,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE;oBACR,QAAQ;oBACR,UAAU;oBACV,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;iBAClD;aACD,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAM,CAAC,cAAc;QACtB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAM;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,SAAS,CAAA;QAClE,MAAM,UAAU,GAAI,IAAI,CAAC,YAAY,CAAC,aAAa,CAA+B,IAAI,SAAS,CAAA;QAC/F,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/E,CAAC;CACD;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB;IACjC,IAAI,OAAO,cAAc,KAAK,WAAW;QAAE,OAAM;IACjD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC5C,cAAc,CAAC,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IAC9D,CAAC;AACF,CAAC"}
+{"version":3,"file":"certrev-badge.js","sourceRoot":"","sources":["../../src/webcomponent/certrev-badge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAA;AAEhD;;;;GAIG;AACH,IAAI,gBAAgB,GAAiC,IAAI,CAAA;AACzD,MAAM,UAAU,qBAAqB,CAAC,QAA+B;IACpE,gBAAgB,GAAG,QAAQ,CAAA;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAoB;IAChD,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACnE,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IACnD,MAAM,KAAK,kBAAkB;QAC5B,OAAO,CAAC,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,CAAC,CAAA;IAClG,CAAC;IAED,iBAAiB;QAChB,qFAAqF;QACrF,8EAA8E;QAC9E,IAAI,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC;YAAE,OAAM;QAChD,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAA;IACjC,CAAC;IAED,wBAAwB,CAAC,KAAa,EAAE,QAAuB,EAAE,QAAuB;QACvF,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAM;QACjC,mEAAmE;QACnE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAA;QACjC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,oBAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;YAAE,OAAM,CAAC,oCAAoC;QACrF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvB,qEAAqE;YACrE,OAAM;QACP,CAAC;QACD,IAAI,OAAoB,CAAA;QACxB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,mBAAmB,CAAC;gBACnC,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC/D,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE;oBACR,QAAQ;oBACR,UAAU;oBACV,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;iBAClD;aACD,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAM,CAAC,cAAc;QACtB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAM;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,SAAS,CAAA;QAClE,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAA;QACxE,sFAAsF;QACtF,qFAAqF;QACrF,iFAAiF;QACjF,kFAAkF;QAClF,qFAAqF;QACrF,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACJ,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAA;QACrE,CAAC;QAAC,MAAM,CAAC;YACR,OAAM,CAAC,cAAc;QACtB,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;IACtB,CAAC;CACD;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB;IACjC,IAAI,OAAO,cAAc,KAAK,WAAW;QAAE,OAAM;IACjD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC5C,cAAc,CAAC,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IAC9D,CAAC;AACF,CAAC"}

package/dist/webcomponent/render-badge-html.d.ts

@@ -17,7 +17,7 @@ export interface RenderBadgeOptions {
     readonly accentColor?: string;
     readonly badgeStyle?: 'full' | 'compact';
     /**
-     * The brand render-def (WS6). ABSENT → the badge renders the CertREV preset
+     * The brand render-def. ABSENT → the badge renders the CertREV preset
      * default (theme output byte-identical to un-themed). PRESENT → validated
      * themeable tokens are emitted as `--certrev-*` CSS vars + subtractive
      * visibility applies. Mirrors `<CertBadge>`'s `renderDef` prop exactly.