@coordination-network/revocation-registry 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ethereum Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,147 @@
+# @coordination-network/revocation-registry
+
+A revocation registry in TypeScript: a [LeanIMT+](https://pse.dev/blog/lean-imt-plus-efficient-merkle-tree-for-membership-and-non-membership-proofs) whose leaves are the revocation commitments of revoked credentials.
+
+Revoking a credential inserts its commitment. Proving a credential is still valid means proving its commitment is **absent** from the registry, which a single Merkle proof of the commitment's predecessor establishes. That proof is the witness a zero-knowledge circuit consumes to show the same thing without revealing which credential is being presented.
+
+## Where the registry lives
+
+`RevocationRegistry` is a complete implementation of the structure, not a client for a particular backend: it reads and writes nothing external. What changes between deployments is only which copy is authoritative.
+
+### On chain, the intended deployment
+
+[`contracts`](../contracts) holds the authoritative registry, and it is what the rest of this design assumes. It gives you three things that matter here:
+
+- **Everyone sees the same root.** The chain settles it, so an issuer cannot show one root to one verifier and a different one to another, and a verifier checks any root it is handed with a single `isValidRoot` call.
+- **The registry is readable without any service.** The full leaf table is on chain, so a holder can always rebuild the tree even if every indexer and snapshot host is down.
+- **Every revocation is publicly auditable.** Each one is a transaction with a timestamp that anyone can inspect after the fact.
+
+This package is the off-chain half of that deployment, in both directions. An issuer uses it to compute the predecessor index a revocation transaction needs. A holder uses it to rebuild the tree and generate a proof locally, which is what keeps presentation private: they read the whole public registry and never disclose which commitment they care about.
+
+### In a server, which works the same way
+
+Nothing here depends on the contracts, so a service can hold the authoritative registry itself: keep a `RevocationRegistry`, revoke into it, and publish the root and the leaf slots. Persist it with `export()` / `import()`, or rebuild it from your own records at startup. Holders then rebuild from what you publish and prove exactly as they would against a chain. The structure, the hashes and the proofs are identical: the same commitments applied in the same order produce the same root wherever the registry is held, which the cross-language tests in both packages pin against each other.
+
+The one thing that changes is who a verifier trusts for the root. On chain that question is settled. With a server, a verifier accepting a root is taking the operator's word that it is the current one. Signing published roots helps, since it proves a root came from the operator, but it does not stop the operator handing one root to one verifier and a different one to another.
+
+It also matters who runs the server. Every presentation needs someone to answer "is this root still valid?", and if the issuer runs the server, the issuer answers. It still cannot tell which credential is being presented, but it sees that one is, when, and who is asking, and presentations stop while the server is down. On chain the issuer is never involved.
+
+### Either way
+
+Only the authoritative copy is authoritative. Every other copy, including one you just rebuilt, is trusted for **availability only, never integrity**: compare `root` against the root the authority publishes before using a proof built from it.
+
+## Install
+
+```bash
+yarn add @coordination-network/revocation-registry
+```
+
+## Usage
+
+### Revoking
+
+```ts
+import { RevocationRegistry } from "@coordination-network/revocation-registry"
+
+const registry = new RevocationRegistry(commitments)
+
+registry.revoke(revocationCommitment)
+
+// registry.root is the new revocation root to publish
+```
+
+Order matters. The tree is position-addressable, so the same commitments inserted in a different order produce a different root. When rebuilding a registry that already exists, supply the commitments in the order that registry inserted them.
+
+### Proving a credential is not revoked
+
+```ts
+const registry = new RevocationRegistry(commitments)
+
+// Only trusted for availability: pin it to the authority before using it.
+if (registry.root !== publishedRoot) throw new Error("stale registry")
+
+const proof = registry.generateProof(revocationCommitment)
+
+// proof.proofType === 1 means the commitment is absent, so the credential is not revoked.
+```
+
+This package stops at the proof. Shaping it for a particular proving system belongs to whichever circuit consumes it.
+
+### Rebuilding a registry
+
+There are three ways to reconstruct a registry, and which one you need depends on whether anything has ever been un-revoked.
+
+| Input                                  | Rebuilds                      | Use when                                                                      |
+| -------------------------------------- | ----------------------------- | ----------------------------------------------------------------------------- |
+| `new RevocationRegistry(commitments)`  | Registries with no tombstones | Nothing has ever been un-revoked                                              |
+| `RevocationRegistry.fromLeaves(slots)` | Any registry                  | Always correct; the authority publishes `leafSlots`, or the chain's `getLeaf` |
+| `RevocationRegistry.import(snapshot)`  | Any registry                  | You already hold a snapshot                                                   |
+
+The constructor takes only the commitments that are still revoked, which is lossy. An un-revocation tombstones a slot, and a tombstoned slot still occupies a Merkle position, so replaying the surviving commitments produces a **different root** and every proof built from it fails. Nothing warns you except the root comparison.
+
+`leafSlots` is the lossless view: every physical slot in index order, sentinel and tombstones included. It is exactly what the on-chain registry exposes as `getLeaf(registryId, i)` for `i` in `0..getRevocationTreeLeafCount(registryId) - 1`.
+
+```ts
+// Authority publishes
+const slots = registry.leafSlots
+
+// Anyone rebuilds the identical tree
+const rebuilt = RevocationRegistry.fromLeaves(slots)
+```
+
+`fromLeaves` recomputes every hash from the slots rather than taking node data on trust, so unlike a snapshot there is nothing in the input to tamper with beyond the slots themselves. Compare `root` against the authority either way: that is what catches missing or reordered slots.
+
+### Snapshots
+
+Replaying every revocation since genesis gets slow. `export()` serializes the whole tree, hashes included, and `import()` rebuilds it without rehashing, so a service can publish periodic snapshots and a holder can sync from the latest one plus the few revocations after it.
+
+`import()` validates by default that the serialized leaves and hashes agree with each other, which rejects a tampered snapshot. That is an internal-consistency check, not proof of authenticity: still compare `root` against the authority.
+
+A snapshot carries the node hashes, so it is larger than the leaf slots and lets a publisher hand you hashes you did not derive. `fromLeaves` is the leaner and more suspicious option; `import` is the faster one when you produced the snapshot yourself.
+
+### Predecessor indices, for constrained backends
+
+`revoke` finds a commitment's predecessor itself, so most callers never need these.
+
+They exist because some authoritative implementations cannot afford to search. The on-chain registry is the example: it validates a caller-supplied predecessor index in `O(1)` rather than scanning, which is what bounds a write to `O(depth)` storage writes. Compute the index here and pass it in:
+
+```ts
+// Revoking one commitment
+const lowLeafIndex = registry.lowLeafIndexOf(revocationCommitment)
+// revocation.revoke(registryId, revocationCommitment, lowLeafIndex)
+
+// Revoking a batch: each index is computed against the state after the earlier ones
+const lowLeafIndices = registry.lowLeafIndicesOf(revocationCommitments)
+// revocation.revokeMany(registryId, revocationCommitments, lowLeafIndices)
+
+// Un-revoking, or replacing a commitment
+const predecessor = registry.predecessorIndexOf(revocationCommitment)
+// revocation.unrevoke(registryId, revocationCommitment, predecessor)
+```
+
+An index is only valid against the tree state the write applies to. If another revocation lands first, the on-chain call reverts with `InvalidLowLeaf` and the index has to be recomputed against the new state.
+
+## API
+
+| Member                                                               | Purpose                                                                               |
+| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| `new RevocationRegistry(commitments?)`                               | Create a registry, optionally pre-loaded. Order must match the authority.             |
+| `root`, `depth`, `size`, `commitments`, `leaves`                     | Registry state. `root` is `0` while empty.                                            |
+| `leafSlots`                                                          | Every physical slot, sentinel and tombstones included. Lossless.                      |
+| `isRevoked(c)`, `indexOf(c)`                                         | Membership lookups.                                                                   |
+| `revoke(c)`, `revokeMany(cs)`                                        | Insert commitments.                                                                   |
+| `unrevoke(c)`, `updateCommitment(old, new)`                          | Undo or replace a revocation.                                                         |
+| `generateProof(c)`                                                   | Membership (`proofType: 0`) or non-membership (`proofType: 1`) proof.                 |
+| `verifyProof(p)`, `RevocationRegistry.verifyProof(p)`                | Against this registry's root, or against the proof's own root.                        |
+| `lowLeafIndexOf(c)`, `lowLeafIndicesOf(cs)`, `predecessorIndexOf(c)` | Predecessor indices for backends that validate rather than search.                    |
+| `export()`, `RevocationRegistry.import(s, validate?)`                | Snapshots.                                                                            |
+| `RevocationRegistry.fromLeaves(slots)`                               | Rebuild any registry from its leaf slots, tombstones included.                        |
+| `toCommitment(v)`, `toFieldElement(v)`                               | Coerce and validate a commitment, or any field element, against the registry's rules. |
+
+## Notes
+
+- Commitments must be non-zero and below the BN254 scalar field order. Zero is reserved for the sentinel leaf and for tombstones. Above the field order, two distinct values can reduce to the same field element, which would let one revocation silently cover an unrelated credential and would break the sorted ordering a non-membership proof relies on.
+- An empty registry cannot produce proofs. Nothing has been revoked, so a verifier should treat that as "no revocations", not as a failure.
+- Revocation is normally permanent. `unrevoke` exists because the structure supports it, but an un-revoked credential becomes valid again for every verifier still accepting an older root, and it leaves a tombstone that rules out rebuilding from `commitments` alone.
+- `indexOf` returns a physical slot, never a position in `commitments`. The two always differ by at least one, because slot 0 is the sentinel.
+- `revocationHashes` is the Poseidon pair every implementation of a registry must agree on: 3-input for leaves, 2-input for internal nodes. `tests/cross-language.test.ts` pins the resulting roots against the Solidity implementation.

package/dist/index.cjs

@@ -0,0 +1,463 @@
+'use strict';
+
+var poseidon2 = require('poseidon-lite/poseidon2');
+var poseidon3 = require('poseidon-lite/poseidon3');
+var leanImtPlus = require('@zk-kit/lean-imt-plus');
+
+/**
+ * The BN254 (alt_bn128) scalar field order. Every commitment stored in a
+ * revocation registry, and every hash the tree produces, is an element of this
+ * field. It matches `SNARK_SCALAR_FIELD` in the LeanIMT+ Solidity library and
+ * the field a BN254 zero-knowledge circuit works over.
+ */
+const SNARK_SCALAR_FIELD = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+/**
+ * Domain-separation tag mixed into every leaf commitment as the third input of
+ * the 3-input leaf hash. Kept here so callers can reproduce a leaf commitment
+ * without depending on LeanIMT+ internals.
+ */
+const TAG_LEAF = 1n;
+/**
+ * Proof discriminator. `MEMBERSHIP` proves the commitment is in the registry
+ * (the credential is revoked); `NON_MEMBERSHIP` proves it is absent (the
+ * credential is not revoked). A holder proving a valid credential always
+ * produces a `NON_MEMBERSHIP` proof.
+ */
+const PROOF_TYPE = {
+    MEMBERSHIP: 0,
+    NON_MEMBERSHIP: 1
+};
+/**
+ * Physical index of the sentinel leaf, which the first revocation creates. The
+ * sentinel holds `{ value: 0, nextValue: firstRealCommitment }` and is the
+ * predecessor of the smallest commitment in the registry.
+ */
+const SENTINEL_INDEX = 0;
+/**
+ * Version tag of the snapshot format produced by `export` and accepted by
+ * `import`. It must match the version the underlying LeanIMT+ writes, which
+ * enforces it on import.
+ */
+const SNAPSHOT_VERSION = 1;
+
+/**
+ * The hash pair every revocation registry uses, in every language.
+ *
+ * - `leaf` is a 3-input Poseidon over `(value, nextValue, TAG_LEAF)`. It matches
+ *   `PoseidonT4` in the LeanIMT+ Solidity library and `poseidon::bn254::hash_3`
+ *   in a BN254 Poseidon circuit.
+ * - `internal` is a 2-input Poseidon for inner nodes. It matches `PoseidonT3`
+ *   and `poseidon::bn254::hash_2`.
+ *
+ * The differing arity is what domain-separates a leaf commitment from an
+ * internal-node hash, which closes the second-preimage attack in which an
+ * attacker repackages an internal node as a leaf. All three implementations
+ * must agree on this pair or their roots will not match.
+ */
+const revocationHashes = {
+    leaf: (a, b, c) => poseidon3.poseidon3([a, b, c]),
+    internal: (a, b) => poseidon2.poseidon2([a, b])
+};
+
+/**
+ * Coerces a value to a BN254 field element, rejecting anything outside the
+ * field.
+ *
+ * Every leaf field and every hash the registry produces must be a field element:
+ * outside that range two distinct values reduce to the same element, which would
+ * let one revocation silently cover an unrelated credential and would break the
+ * sorted ordering a non-membership proof relies on.
+ *
+ * Zero is accepted, because the sentinel and tombstone leaf slots hold it. Use
+ * {@link toCommitment} for anything that must be a real commitment.
+ *
+ * @param value The value, as a bigint, number or decimal string.
+ * @returns The value as a bigint.
+ */
+function toFieldElement(value) {
+    const element = BigInt(value);
+    if (element < 0n) {
+        throw new Error("RevocationRegistry: a field element must not be negative");
+    }
+    if (element >= SNARK_SCALAR_FIELD) {
+        throw new Error("RevocationRegistry: a field element must be less than the SNARK scalar field order");
+    }
+    return element;
+}
+/**
+ * Coerces a value to a revocation commitment, rejecting anything the registry
+ * cannot hold as one.
+ *
+ * A commitment must be a field element, for the reason given on
+ * {@link toFieldElement}, and must additionally be non-zero, because zero is
+ * reserved for the sentinel leaf and for tombstones.
+ *
+ * These are the rules of the structure itself, so every implementation of a
+ * registry enforces them.
+ *
+ * @param value The commitment, as a bigint, number or decimal string.
+ * @returns The commitment as a bigint.
+ */
+function toCommitment(value) {
+    const commitment = BigInt(value);
+    if (commitment <= 0n) {
+        throw new Error("RevocationRegistry: a commitment must be greater than zero");
+    }
+    return toFieldElement(commitment);
+}
+
+/**
+ * A revocation registry: a
+ * {@link https://pse.dev/blog/lean-imt-plus-efficient-merkle-tree-for-membership-and-non-membership-proofs | LeanIMT+}
+ * whose leaves are the revocation commitments of revoked credentials.
+ *
+ * The class is a self-contained implementation of the structure, not a client
+ * for any particular backend. It can hold a registry outright, which is what a
+ * service that publishes revocations from its own database does, or mirror one
+ * whose authoritative copy lives elsewhere, which is what a holder does before
+ * building a proof. Nothing here reads or writes anything external.
+ *
+ * Two operations serve the two roles:
+ *
+ * - **Issuer.** {@link revoke} inserts a commitment. Where the authoritative
+ *   registry is a separate system that validates a predecessor index rather than
+ *   searching for one, {@link lowLeafIndexOf} computes that index.
+ * - **Holder.** {@link generateProof} produces a proof about a commitment. A
+ *   non-membership proof (`proofType: 1`) is what shows a credential is not
+ *   revoked, and is the witness a zero-knowledge circuit consumes to show it
+ *   without revealing the commitment.
+ *
+ * When this instance is a mirror rather than the authority, it is trusted for
+ * availability only, never for integrity: compare {@link root} against the root
+ * the authority reports before using any proof built from it. Building the tree
+ * locally is also what keeps a holder private, since they read the whole public
+ * registry and never disclose which commitment they care about.
+ *
+ * An empty registry has a root of `0` and cannot produce proofs: nothing has
+ * been revoked yet, so there is nothing to prove against. Verifiers must handle
+ * that case as "no revocations", not as a failure.
+ */
+class RevocationRegistry {
+    /**
+     * Creates a registry, optionally pre-loaded with revoked commitments.
+     * Passing the full list is more efficient than revoking them one by one,
+     * because each affected internal node is rehashed at most once.
+     *
+     * The tree is position-addressable, so a different insertion order produces
+     * a different root even for the same set of commitments. When rebuilding a
+     * registry that already exists elsewhere, the commitments must be supplied
+     * in the order that registry inserted them.
+     *
+     * This reconstructs a registry only while nothing has ever been un-revoked.
+     * An un-revocation leaves a tombstoned slot behind, and that slot still
+     * occupies a Merkle position, so replaying the surviving commitments would
+     * produce a different root. Use {@link RevocationRegistry.fromLeaves} or
+     * {@link RevocationRegistry.import} for a registry that may have tombstones.
+     *
+     * @param commitments Revoked commitments, in insertion order.
+     */
+    constructor(commitments = []) {
+        this.leanIMTPlus = new leanImtPlus.LeanIMTPlus(revocationHashes, commitments.map(toCommitment));
+    }
+    /** The current revocation root. `0` while the registry is empty. */
+    get root() {
+        return this.leanIMTPlus.root ?? 0n;
+    }
+    /** The current tree depth. */
+    get depth() {
+        return this.leanIMTPlus.depth;
+    }
+    /** The number of revoked commitments, excluding the sentinel and tombstones. */
+    get size() {
+        return this.leanIMTPlus.size;
+    }
+    /**
+     * The revoked commitments in insertion order. Reading `.value` off each leaf
+     * gives the commitments; `.nextValue` exposes the sorted linked list the
+     * non-membership proof relies on.
+     */
+    get leaves() {
+        return this.leanIMTPlus.leaves;
+    }
+    /**
+     * The revoked commitments, in insertion order. Excludes the sentinel and any
+     * tombstones, so this is a lossy view of the tree: it round-trips through the
+     * constructor only while nothing has been un-revoked. See
+     * {@link leafSlots}.
+     */
+    get commitments() {
+        return this.leanIMTPlus.leaves.map((leaf) => leaf.value);
+    }
+    /**
+     * Every physical leaf slot in index order, sentinel and tombstones included.
+     *
+     * This is the lossless view of the registry and the counterpart of
+     * {@link RevocationRegistry.fromLeaves}: an authority publishes these slots,
+     * and anyone can rebuild the exact same tree from them. It mirrors what the
+     * on-chain registry exposes through `getLeaf`.
+     *
+     * Prefer {@link commitments} to enumerate what is revoked. This walks the
+     * whole tree, so treat it as a publishing operation rather than a hot path.
+     */
+    get leafSlots() {
+        const { leaves } = JSON.parse(this.export());
+        return leaves.map(({ value, nextValue }) => ({ value: BigInt(value), nextValue: BigInt(nextValue) }));
+    }
+    /** Returns true if the commitment has been revoked. */
+    isRevoked(commitment) {
+        return this.leanIMTPlus.has(toCommitment(commitment));
+    }
+    /**
+     * Returns the physical leaf index of a revoked commitment, or `-1` if it is
+     * not revoked.
+     *
+     * This is a slot in the tree, never a position in {@link commitments}. The
+     * two always differ by at least one, because slot 0 is the sentinel, and
+     * they drift further apart with every tombstone.
+     */
+    indexOf(commitment) {
+        return this.leanIMTPlus.indexOf(toCommitment(commitment));
+    }
+    /**
+     * Revokes a credential by inserting its commitment.
+     *
+     * @param commitment The revocation commitment of the credential.
+     */
+    revoke(commitment) {
+        this.leanIMTPlus.insert(toCommitment(commitment));
+    }
+    /**
+     * Revokes several credentials in one pass. Cheaper than calling
+     * {@link revoke} once per commitment, because each affected internal node is
+     * rehashed at most once.
+     *
+     * Not transactional: if a commitment mid-batch is rejected, the earlier ones
+     * have already been applied. Validate with {@link isRevoked} first when the
+     * input is untrusted.
+     *
+     * @param commitments The revocation commitments, in insertion order.
+     */
+    revokeMany(commitments) {
+        this.leanIMTPlus.insertMany(commitments.map(toCommitment));
+    }
+    /**
+     * Un-revokes a credential, tombstoning its slot.
+     *
+     * Revocation is normally permanent, and a registry that never un-revokes is
+     * the simpler thing to reason about: an un-revoked credential becomes valid
+     * again for every verifier that has not yet seen the new root. The operation
+     * is exposed because the underlying tree supports it and some issuers need
+     * to undo a mistaken revocation, but reach for it deliberately.
+     *
+     * It also leaves a tombstoned slot behind, after which the registry can no
+     * longer be rebuilt from {@link commitments} alone. Publish the leaf slots
+     * (see {@link RevocationRegistry.fromLeaves}) or a snapshot instead.
+     *
+     * @param commitment The revocation commitment to un-revoke.
+     */
+    unrevoke(commitment) {
+        this.leanIMTPlus.remove(toCommitment(commitment));
+    }
+    /**
+     * Replaces a revoked commitment with another one, in place, reusing the old
+     * physical slot. Cheaper than an {@link unrevoke} followed by a
+     * {@link revoke}, which would tombstone a slot and append a new one.
+     *
+     * @param oldCommitment The revoked commitment to replace.
+     * @param newCommitment The commitment to put in its place.
+     */
+    updateCommitment(oldCommitment, newCommitment) {
+        this.leanIMTPlus.update(toCommitment(oldCommitment), toCommitment(newCommitment));
+    }
+    /**
+     * Generates a proof for a commitment: a non-membership proof
+     * (`proofType: 1`) if the credential is not revoked, a membership proof
+     * (`proofType: 0`) if it is.
+     *
+     * The proof carries the root it was built against. It proves nothing until
+     * the verifier independently accepts that root as one the authoritative
+     * registry currently publishes.
+     *
+     * @param commitment The revocation commitment of the credential.
+     * @returns The revocation proof.
+     */
+    generateProof(commitment) {
+        if (this.root === 0n) {
+            throw new Error("RevocationRegistry: cannot generate a proof against an empty registry");
+        }
+        return this.leanIMTPlus.generateProof(toCommitment(commitment));
+    }
+    /**
+     * Verifies a proof against this tree's current root. Use the static
+     * {@link RevocationRegistry.verifyProof} to check a proof without a local tree.
+     */
+    verifyProof(proof) {
+        return proof.root === this.root && this.leanIMTPlus.verifyProof(proof);
+    }
+    /**
+     * Verifies that a proof is internally consistent with the root it carries.
+     *
+     * This does not bind the proof to any registry: the caller supplies
+     * `proof.root`, so on its own this returns true for a proof against an
+     * attacker-chosen root. Always compare `proof.root` against a root you
+     * independently accept.
+     */
+    static verifyProof(proof) {
+        return leanImtPlus.LeanIMTPlus.verifyProof(proof, revocationHashes);
+    }
+    /**
+     * Returns the physical index of the low leaf of a commitment: the
+     * predecessor a constrained implementation needs supplied rather than
+     * searched for.
+     *
+     * {@link revoke} does not need this, since it finds the predecessor itself.
+     * It exists for registries whose authoritative implementation validates a
+     * caller-supplied index in O(1) instead of searching, which is how a version
+     * that has to bound its own cost per write is built. Such an index is only
+     * valid against the tree state the write applies to, so if another revocation
+     * lands first it must be recomputed against the new state.
+     *
+     * @param commitment The commitment about to be revoked.
+     * @returns The physical index of its predecessor, or `0` for the first
+     * revocation, where the argument is ignored and the sentinel is created.
+     */
+    lowLeafIndexOf(commitment) {
+        const value = toCommitment(commitment);
+        if (this.root === 0n) {
+            return SENTINEL_INDEX;
+        }
+        const proof = this.leanIMTPlus.generateProof(value);
+        if (proof.proofType === PROOF_TYPE.MEMBERSHIP) {
+            throw new Error("RevocationRegistry: the commitment has already been revoked");
+        }
+        // Not `proof.leafIndex`: that is the compacted Merkle path, which skips the
+        // levels where the leaf's ancestor had no sibling, so it does not equal the
+        // physical slot. Resolve the slot from the low leaf's value instead. A low
+        // leaf holding zero is the sentinel, which always sits at index 0.
+        return proof.leaf.value === 0n ? SENTINEL_INDEX : this.leanIMTPlus.indexOf(proof.leaf.value);
+    }
+    /**
+     * Returns the low leaf indices for a batch of commitments, as a batched
+     * write expects them: index `i` is computed against the tree state after
+     * commitments `0..i-1` have been inserted.
+     *
+     * Computed on a throwaway copy, so this tree is left untouched.
+     *
+     * @param commitments The commitments about to be revoked, in insertion order.
+     */
+    lowLeafIndicesOf(commitments) {
+        const scratch = RevocationRegistry.import(this.export(), false);
+        return commitments.map((commitment) => {
+            const index = scratch.lowLeafIndexOf(commitment);
+            scratch.revoke(commitment);
+            return index;
+        });
+    }
+    /**
+     * Returns the physical index of the leaf whose `nextValue` is this
+     * commitment. The counterpart of {@link lowLeafIndexOf} for un-revoking and
+     * for replacing a commitment.
+     *
+     * Returns `0` when the commitment is the smallest in the registry, because
+     * the sentinel at index 0 is then its predecessor.
+     *
+     * @param commitment A revoked commitment.
+     */
+    predecessorIndexOf(commitment) {
+        const value = toCommitment(commitment);
+        if (!this.leanIMTPlus.has(value)) {
+            throw new Error("RevocationRegistry: the commitment has not been revoked");
+        }
+        const predecessor = this.leanIMTPlus.leaves.find((leaf) => leaf.nextValue === value);
+        return predecessor === undefined ? SENTINEL_INDEX : this.leanIMTPlus.indexOf(predecessor.value);
+    }
+    /**
+     * Serializes the whole tree, hashes included.
+     *
+     * This is the snapshot format: publishing a snapshot lets a holder rebuild a
+     * large registry without replaying every revocation since genesis. A snapshot
+     * is trusted for availability only, so an importing client must still compare
+     * {@link root} against the root the authoritative registry publishes.
+     */
+    export() {
+        return this.leanIMTPlus.export();
+    }
+    /**
+     * Rebuilds a tree from {@link export} output.
+     *
+     * @param snapshot The serialized tree.
+     * @param validate Recompute every commitment and check it against the
+     * serialized hashes, rejecting a tampered snapshot. Defaults to `true`; pass
+     * `false` only for data you produced yourself.
+     */
+    static import(snapshot, validate = true) {
+        const tree = new RevocationRegistry();
+        tree.leanIMTPlus = leanImtPlus.LeanIMTPlus.import(revocationHashes, snapshot, { validate });
+        return tree;
+    }
+    /**
+     * Rebuilds a registry from its full physical leaf slots, sentinel and
+     * tombstones included.
+     *
+     * This is the reconstruction path that always works. The constructor takes
+     * only the active commitments, which is enough only while no commitment has
+     * ever been un-revoked: an un-revocation leaves a tombstoned slot behind, and
+     * a slot still occupies a Merkle position, so a registry that has one cannot
+     * be reproduced from its commitments alone.
+     *
+     * The leaf slots are exactly what an authoritative registry can publish
+     * verbatim: {@link leafSlots} here, or `getLeaf(registryId, i)` for `i` in
+     * `0..getRevocationTreeLeafCount(registryId) - 1` on chain.
+     *
+     * Hashes are recomputed here rather than taken on trust, so unlike a snapshot
+     * the input carries no node data to tamper with. The caller must still
+     * compare {@link root} against the root the authority publishes, which is
+     * what detects missing or reordered slots.
+     *
+     * @param leaves The physical leaf slots, in index order starting at the
+     * sentinel.
+     * @returns The reconstructed registry.
+     */
+    static fromLeaves(leaves) {
+        if (leaves.length === 0) {
+            return new RevocationRegistry();
+        }
+        const records = leaves.map(({ value, nextValue }) => ({
+            value: toFieldElement(value),
+            nextValue: toFieldElement(nextValue)
+        }));
+        if (records[0].value !== 0n) {
+            throw new Error("RevocationRegistry: the leaf at index 0 must be the sentinel, whose value is zero");
+        }
+        // Rebuild every level of the LeanIMT, promoting an unpaired node unchanged.
+        const nodes = [records.map((leaf) => revocationHashes.leaf(leaf.value, leaf.nextValue, TAG_LEAF))];
+        while (nodes[nodes.length - 1].length > 1) {
+            const level = nodes[nodes.length - 1];
+            const parents = [];
+            for (let i = 0; i < level.length; i += 2) {
+                parents.push(i + 1 < level.length ? revocationHashes.internal(level[i], level[i + 1]) : level[i]);
+            }
+            nodes.push(parents);
+        }
+        const snapshot = JSON.stringify({
+            version: SNAPSHOT_VERSION,
+            nodes: nodes.map((level) => level.map(String)),
+            leaves: records.map(({ value, nextValue }) => ({
+                value: value.toString(),
+                nextValue: nextValue.toString()
+            }))
+        });
+        // The node hashes were just derived from the leaves, so re-validating them
+        // would be circular. Integrity comes from comparing the root to the authority.
+        return RevocationRegistry.import(snapshot, false);
+    }
+}
+
+exports.PROOF_TYPE = PROOF_TYPE;
+exports.RevocationRegistry = RevocationRegistry;
+exports.SNAPSHOT_VERSION = SNAPSHOT_VERSION;
+exports.SNARK_SCALAR_FIELD = SNARK_SCALAR_FIELD;
+exports.TAG_LEAF = TAG_LEAF;
+exports.revocationHashes = revocationHashes;
+exports.toCommitment = toCommitment;
+exports.toFieldElement = toFieldElement;