@grantex/sdk 0.5.1 → 0.7.0

package/dist/resources/scim.js

@@ -14,7 +14,7 @@ export class ScimClient {
     }
     /** Revoke a SCIM token by ID. */
     revokeToken(tokenId) {
-        return this.#http.delete(`/v1/scim/tokens/${tokenId}`);
+        return this.#http.delete(`/v1/scim/tokens/${encodeURIComponent(tokenId)}`);
     }
     // ── SCIM 2.0 Users ────────────────────────────────────────────────────
     /** List provisioned users (SCIM 2.0 ListResponse). */
@@ -29,7 +29,7 @@ export class ScimClient {
     }
     /** Get a single provisioned user by ID. */
     getUser(userId) {
-        return this.#http.get(`/scim/v2/Users/${userId}`);
+        return this.#http.get(`/scim/v2/Users/${encodeURIComponent(userId)}`);
     }
     /** Provision a new user. */
     createUser(params) {
@@ -37,15 +37,15 @@ export class ScimClient {
     }
     /** Full replace of a user (PUT). */
     replaceUser(userId, params) {
-        return this.#http.put(`/scim/v2/Users/${userId}`, params);
+        return this.#http.put(`/scim/v2/Users/${encodeURIComponent(userId)}`, params);
     }
     /** Partial update via SCIM Operations (PATCH). */
     updateUser(userId, operations) {
-        return this.#http.patch(`/scim/v2/Users/${userId}`, { Operations: operations });
+        return this.#http.patch(`/scim/v2/Users/${encodeURIComponent(userId)}`, { Operations: operations });
     }
     /** Deprovision a user (DELETE). */
     deleteUser(userId) {
-        return this.#http.delete(`/scim/v2/Users/${userId}`);
+        return this.#http.delete(`/scim/v2/Users/${encodeURIComponent(userId)}`);
     }
 }
 //# sourceMappingURL=scim.js.map

package/dist/resources/scim.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim.js","sourceRoot":"","sources":["../../src/resources/scim.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,UAAU;IACZ,KAAK,CAAa;IAE3B,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,yEAAyE;IAEzE,2EAA2E;IAC3E,WAAW,CAAC,MAA6B;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,yEAAyE;IACzE,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,iBAAiB,CAAC,CAAC;IACnE,CAAC;IAED,iCAAiC;IACjC,WAAW,CAAC,OAAe;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAO,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,yEAAyE;IAEzE,sDAAsD;IACtD,SAAS,CAAC,MAAgD;QACxD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACtF,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,KAAK,CAAC,CAAC,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAChG,CAAC;IAED,2CAA2C;IAC3C,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,4BAA4B;IAC5B,UAAU,CAAC,MAA4B;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAW,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,oCAAoC;IACpC,WAAW,CAAC,MAAc,EAAE,MAA4B;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,kBAAkB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,kDAAkD;IAClD,UAAU,CACR,MAAc,EACd,UAAgE;QAEhE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,kBAAkB,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,mCAAmC;IACnC,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAO,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"scim.js","sourceRoot":"","sources":["../../src/resources/scim.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,UAAU;IACZ,KAAK,CAAa;IAE3B,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,yEAAyE;IAEzE,2EAA2E;IAC3E,WAAW,CAAC,MAA6B;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,yEAAyE;IACzE,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,iBAAiB,CAAC,CAAC;IACnE,CAAC;IAED,iCAAiC;IACjC,WAAW,CAAC,OAAe;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAO,mBAAmB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,yEAAyE;IAEzE,sDAAsD;IACtD,SAAS,CAAC,MAAgD;QACxD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACtF,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,KAAK,CAAC,CAAC,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAChG,CAAC;IAED,2CAA2C;IAC3C,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,4BAA4B;IAC5B,UAAU,CAAC,MAA4B;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAW,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,oCAAoC;IACpC,WAAW,CAAC,MAAc,EAAE,MAA4B;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,kDAAkD;IAClD,UAAU,CACR,MAAc,EACd,UAAgE;QAEhE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,mCAAmC;IACnC,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;CACF"}

package/dist/resources/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/resources/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGvH,qBAAa,YAAY;;IAIvB,YAAY,IAAI,EAAE,UAAU,EAE3B;IAED,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAEpE;IAEK,OAAO,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAexE;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAIlD;IAED,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErC;CACF"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/resources/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGvH,qBAAa,YAAY;;IAIvB,YAAY,IAAI,EAAE,UAAU,EAE3B;IAED,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAMpE;IAEK,OAAO,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAexE;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAIlD;IAED,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErC;CACF"}

package/dist/resources/tokens.js

@@ -6,7 +6,11 @@ export class TokensClient {
         this.#http = http;
     }
     exchange(params) {
-        return this.#http.post('/v1/token', params);
+        // Authorization codes are single-use and the server has no idempotent
+        // replay for the exchange (unlike refresh): a retried request whose first
+        // attempt committed would fail with "code already used" and lose the
+        // tokens. Never retry; let the caller surface the error.
+        return this.#http.post('/v1/token', params, { retry: false });
     }
     async refresh(params) {
         const now = Date.now();

package/dist/resources/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/resources/tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,OAAO,YAAY;IACd,KAAK,CAAa;IAClB,iBAAiB,GAAG,IAAI,GAAG,EAA8C,CAAC;IAEnF,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,MAA2B;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,WAAW,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAA0B;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACpD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc;eACvC,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,mBAAmB,EAAE,IAAI,EAAE;YACvF,OAAO,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,mBAAmB,EAAE;YAC/D,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,mBAAmB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;CACF"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/resources/tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,OAAO,YAAY;IACd,KAAK,CAAa;IAClB,iBAAiB,GAAG,IAAI,GAAG,EAA8C,CAAC;IAEnF,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,MAA2B;QAClC,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,yDAAyD;QACzD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAA0B;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACpD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc;eACvC,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,mBAAmB,EAAE,IAAI,EAAE;YACvF,OAAO,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,mBAAmB,EAAE;YAC/D,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,mBAAmB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/resources/vault.js

@@ -21,11 +21,11 @@ export class VaultClient {
     }
     /** Get credential metadata by ID (no raw token). */
     get(credentialId) {
-        return this.#http.get(`/v1/vault/credentials/${credentialId}`);
+        return this.#http.get(`/v1/vault/credentials/${encodeURIComponent(credentialId)}`);
     }
     /** Delete a credential from the vault. */
     delete(credentialId) {
-        return this.#http.delete(`/v1/vault/credentials/${credentialId}`);
+        return this.#http.delete(`/v1/vault/credentials/${encodeURIComponent(credentialId)}`);
     }
     /**
      * Exchange a grant token for an upstream credential.

package/dist/resources/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/resources/vault.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,WAAW;IACb,KAAK,CAAa;IAClB,QAAQ,CAAS;IAE1B,YAAY,IAAgB,EAAE,OAAe;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,MAA6B;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACnF,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,MAAM,GAA+B,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CACnB,wBAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,GAAG,CAAC,YAAoB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,yBAAyB,YAAY,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,0CAA0C;IAC1C,MAAM,CAAC,YAAoB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CACZ,UAAkB,EAClB,MAAgC;QAEhC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,gCAAgC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GACX,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;gBACnD,CAAC,CAAC,MAAM,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAyC,CAAC;IAChE,CAAC;CACF"}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/resources/vault.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,WAAW;IACb,KAAK,CAAa;IAClB,QAAQ,CAAS;IAE1B,YAAY,IAAgB,EAAE,OAAe;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,MAA6B;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACnF,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,MAAM,GAA+B,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CACnB,wBAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,GAAG,CAAC,YAAoB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,yBAAyB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,0CAA0C;IAC1C,MAAM,CAAC,YAAoB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CACZ,UAAkB,EAClB,MAAgC;QAEhC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,gCAAgC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GACX,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;gBACnD,CAAC,CAAC,MAAM,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAyC,CAAC;IAChE,CAAC;CACF"}

package/dist/resources/webauthn.d.ts

@@ -1,8 +1,13 @@
 import type { HttpClient } from '../http.js';
-import type { WebAuthnRegistrationOptions, WebAuthnRegistrationVerifyParams, WebAuthnCredential, ListWebAuthnCredentialsResponse } from '../types.js';
+import type { WebAuthnRegistrationOptions, WebAuthnRegistrationVerifyParams, WebAuthnCredential, ListWebAuthnCredentialsResponse, WebAuthnEnrollmentSession } from '../types.js';
 export declare class WebAuthnClient {
     #private;
     constructor(http: HttpClient);
+    /** Issue a one-use hosted enrollment link after authenticating the principal in your application. */
+    createEnrollmentSession(params: {
+        principalId: string;
+        authRequestId?: string;
+    }): Promise<WebAuthnEnrollmentSession>;
     registerOptions(params: {
         principalId: string;
     }): Promise<WebAuthnRegistrationOptions>;

package/dist/resources/webauthn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/resources/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,EAClB,+BAA+B,EAChC,MAAM,aAAa,CAAC;AAErB,qBAAa,cAAc;;IAGzB,YAAY,IAAI,EAAE,UAAU,EAE3B;IAED,eAAe,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAErF;IAED,cAAc,CAAC,MAAM,EAAE,gCAAgC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEpF;IAED,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAI7E;IAED,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;CACF"}
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/resources/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,EAClB,+BAA+B,EAC/B,yBAAyB,EAC1B,MAAM,aAAa,CAAC;AAErB,qBAAa,cAAc;;IAGzB,YAAY,IAAI,EAAE,UAAU,EAE3B;IAED,qGAAqG;IACrG,uBAAuB,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAEnH;IAED,eAAe,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAErF;IAED,cAAc,CAAC,MAAM,EAAE,gCAAgC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEpF;IAED,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAI7E;IAED,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;CACF"}

package/dist/resources/webauthn.js

@@ -3,6 +3,10 @@ export class WebAuthnClient {
     constructor(http) {
         this.#http = http;
     }
+    /** Issue a one-use hosted enrollment link after authenticating the principal in your application. */
+    createEnrollmentSession(params) {
+        return this.#http.post('/v1/webauthn/enrollment-sessions', params);
+    }
     registerOptions(params) {
         return this.#http.post('/v1/webauthn/register/options', params);
     }
@@ -13,7 +17,7 @@ export class WebAuthnClient {
         return this.#http.get(`/v1/webauthn/credentials?principalId=${encodeURIComponent(principalId)}`);
     }
     deleteCredential(credentialId) {
-        return this.#http.delete(`/v1/webauthn/credentials/${credentialId}`);
+        return this.#http.delete(`/v1/webauthn/credentials/${encodeURIComponent(credentialId)}`);
     }
 }
 //# sourceMappingURL=webauthn.js.map

package/dist/resources/webauthn.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/resources/webauthn.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,cAAc;IAChB,KAAK,CAAa;IAE3B,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,eAAe,CAAC,MAA+B;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,+BAA+B,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IAED,cAAc,CAAC,MAAwC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,8BAA8B,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CACnB,wCAAwC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAO,4BAA4B,YAAY,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/resources/webauthn.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,cAAc;IAChB,KAAK,CAAa;IAE3B,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,qGAAqG;IACrG,uBAAuB,CAAC,MAAuD;QAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IAED,eAAe,CAAC,MAA+B;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,+BAA+B,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IAED,cAAc,CAAC,MAAwC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,8BAA8B,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CACnB,wCAAwC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAO,4BAA4B,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;CACF"}

package/dist/resources/webhooks.js

@@ -10,7 +10,7 @@ export class WebhooksClient {
         return this.#http.get('/v1/webhooks');
     }
     delete(webhookId) {
-        return this.#http.delete(`/v1/webhooks/${webhookId}`);
+        return this.#http.delete(`/v1/webhooks/${encodeURIComponent(webhookId)}`);
     }
 }
 //# sourceMappingURL=webhooks.js.map

package/dist/resources/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/resources/webhooks.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,cAAc;IAChB,KAAK,CAAa;IAE3B,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,MAA2B;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;CACF"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/resources/webhooks.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,cAAc;IAChB,KAAK,CAAa;IAE3B,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,MAA2B;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;CACF"}

package/dist/revocations/feed.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The revocation feed client (PRD G-6).
+ *
+ * It takes a snapshot of everything currently revoked, then follows the live
+ * stream, so `enforce()` can deny a call on a grant that was revoked seconds
+ * ago without a network round trip per call.
+ *
+ * The important part is what happens when it cannot keep up. The feed records
+ * when it last heard from the auth service; if that is longer ago than
+ * `staleAfterMs`, it reports itself stale and `enforce()` denies rather than
+ * allowing calls on information it knows may be out of date.
+ */
+import type { HttpClient } from '../http.js';
+import { type CredentialRef, type RevocationMatch } from './set.js';
+export interface RevocationFeedOptions {
+    /**
+     * How long the feed may go without hearing from the auth service before it
+     * is stale and calls fail closed. Default 5000 ms.
+     */
+    staleAfterMs?: number;
+    /** Delay before reconnecting a dropped stream. Default 500 ms. */
+    reconnectDelayMs?: number;
+    /** `stream` (Server-Sent Events) or `poll` (long polling). Default `stream`, falling back to `poll`. */
+    transport?: 'stream' | 'poll';
+}
+export type FeedUnavailableReason = 'disabled' | 'not_ready' | 'unauthorized' | 'network';
+export interface RevocationFeedState {
+    /** A snapshot has been read at least once. */
+    synced: boolean;
+    /**
+     * When the feed last heard from the auth service, on a monotonic clock
+     * (0 if never). Comparable with `performance.now()`, not with `Date.now()`.
+     */
+    freshAt: number;
+    /** Feed position of the last entry applied. */
+    cursor: number;
+    /** Identifiers currently known to be revoked or suspended. */
+    known: number;
+    /** Why the feed is not usable, if it is not. */
+    unavailable: FeedUnavailableReason | null;
+}
+export declare class RevocationFeed {
+    #private;
+    constructor(http: HttpClient, options?: RevocationFeedOptions);
+    get staleAfterMs(): number;
+    state(): RevocationFeedState;
+    /** Synced recently enough to be trusted. */
+    isFresh(now?: number): boolean;
+    /** Why this credential must not be used, according to what the feed knows. */
+    match(ref: CredentialRef, now?: number): RevocationMatch | null;
+    /** Start following the feed. Idempotent. */
+    start(): void;
+    /** Stop following, and forget what was known (a restarted feed re-reads the snapshot). */
+    stop(): Promise<void>;
+    /**
+     * Wait until the feed is fresh, or the timeout passes. Returns whether it is
+     * fresh: `false` means callers must fail closed.
+     */
+    ready(timeoutMs?: number): Promise<boolean>;
+}
+//# sourceMappingURL=feed.d.ts.map

package/dist/revocations/feed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed.d.ts","sourceRoot":"","sources":["../../src/revocations/feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAc,KAAK,aAAa,EAAwB,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAEtG,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC3C;AAqBD,qBAAa,cAAc;;IAkBzB,YAAY,IAAI,EAAE,UAAU,EAAE,OAAO,GAAE,qBAA0B,EAKhE;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,KAAK,IAAI,mBAAmB,CAQ3B;IAED,4CAA4C;IAC5C,OAAO,CAAC,GAAG,GAAE,MAAuB,GAAG,OAAO,CAE7C;IAED,8EAA8E;IAC9E,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,GAAE,MAAmB,GAAG,eAAe,GAAG,IAAI,CAE1E;IAED,4CAA4C;IAC5C,KAAK,IAAI,IAAI,CAKZ;IAED,0FAA0F;IACpF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1B;IAED;;;OAGG;IACG,KAAK,CAAC,SAAS,GAAE,MAA2B,GAAG,OAAO,CAAC,OAAO,CAAC,CAepE;CAqJF"}

package/dist/revocations/feed.js

@@ -0,0 +1,282 @@
+import { RevokedSet } from './set.js';
+/**
+ * Freshness is measured on a monotonic clock: a wall-clock jump backwards
+ * must not make a stale feed look current.
+ */
+const monotonicNow = () => (typeof performance !== 'undefined' && typeof performance.now === 'function' ? performance.now() : Date.now());
+const DEFAULT_STALE_AFTER_MS = 5_000;
+const DEFAULT_RECONNECT_DELAY_MS = 500;
+const MAX_RECONNECT_DELAY_MS = 30_000;
+const PRUNE_INTERVAL_MS = 60_000;
+export class RevocationFeed {
+    #http;
+    #set = new RevokedSet();
+    #staleAfterMs;
+    #reconnectDelayMs;
+    #transport;
+    #running = false;
+    #synced = false;
+    #freshAt = 0;
+    #cursor = 0;
+    #unavailable = null;
+    #controller = null;
+    #loop = null;
+    #reader = null;
+    #prunedAt = 0;
+    #waiters = [];
+    constructor(http, options = {}) {
+        this.#http = http;
+        this.#staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
+        this.#reconnectDelayMs = options.reconnectDelayMs ?? DEFAULT_RECONNECT_DELAY_MS;
+        this.#transport = options.transport ?? 'stream';
+    }
+    get staleAfterMs() {
+        return this.#staleAfterMs;
+    }
+    state() {
+        return {
+            synced: this.#synced,
+            freshAt: this.#freshAt,
+            cursor: this.#cursor,
+            known: this.#set.size,
+            unavailable: this.#unavailable,
+        };
+    }
+    /** Synced recently enough to be trusted. */
+    isFresh(now = monotonicNow()) {
+        return this.#synced && this.#unavailable === null && now - this.#freshAt <= this.#staleAfterMs;
+    }
+    /** Why this credential must not be used, according to what the feed knows. */
+    match(ref, now = Date.now()) {
+        return this.#set.match(ref, now);
+    }
+    /** Start following the feed. Idempotent. */
+    start() {
+        if (this.#running)
+            return;
+        this.#running = true;
+        this.#controller = new AbortController();
+        this.#loop = this.#run().catch(() => { });
+    }
+    /** Stop following, and forget what was known (a restarted feed re-reads the snapshot). */
+    async stop() {
+        this.#running = false;
+        this.#controller?.abort();
+        // An open stream is not interrupted by aborting a fetch that already
+        // resolved, so release the reader too.
+        await this.#reader?.cancel().catch(() => { });
+        const loop = this.#loop;
+        this.#loop = null;
+        this.#synced = false;
+        this.#freshAt = 0;
+        this.#set.clear();
+        this.#wake();
+        if (loop)
+            await loop;
+    }
+    /**
+     * Wait until the feed is fresh, or the timeout passes. Returns whether it is
+     * fresh: `false` means callers must fail closed.
+     */
+    async ready(timeoutMs = this.#staleAfterMs) {
+        this.start();
+        const deadline = monotonicNow() + timeoutMs;
+        for (;;) {
+            if (this.isFresh())
+                return true;
+            if (this.#unavailable !== null || monotonicNow() >= deadline)
+                return this.isFresh();
+            await new Promise((resolve) => {
+                const timer = setTimeout(resolve, Math.min(50, Math.max(1, deadline - monotonicNow())));
+                timer.unref?.();
+                this.#waiters.push(() => {
+                    clearTimeout(timer);
+                    resolve();
+                });
+            });
+        }
+    }
+    #wake() {
+        const waiters = this.#waiters;
+        this.#waiters = [];
+        for (const waiter of waiters)
+            waiter();
+    }
+    #touch() {
+        this.#freshAt = monotonicNow();
+        // Entries whose credential has expired can no longer be used; dropping
+        // them here bounds the set without a timer of its own.
+        if (this.#freshAt - this.#prunedAt > PRUNE_INTERVAL_MS) {
+            this.#set.prune();
+            this.#prunedAt = this.#freshAt;
+        }
+        this.#unavailable = null;
+        this.#wake();
+    }
+    async #run() {
+        let delay = this.#reconnectDelayMs;
+        while (this.#running) {
+            try {
+                await this.#snapshot();
+                delay = this.#reconnectDelayMs;
+                if (this.#transport === 'stream') {
+                    const streamed = await this.#stream();
+                    if (!streamed)
+                        await this.#poll();
+                    // A stream that ended cleanly (a server restart, a proxy timeout)
+                    // must not be reconnected in a tight loop.
+                    else if (this.#running)
+                        await sleep(this.#reconnectDelayMs, this.#controller?.signal);
+                }
+                else {
+                    await this.#poll();
+                }
+            }
+            catch (err) {
+                this.#unavailable = classify(err);
+                this.#synced = false;
+                this.#wake();
+                await sleep(delay, this.#controller?.signal);
+                delay = Math.min(delay * 2, MAX_RECONNECT_DELAY_MS);
+            }
+        }
+    }
+    async #snapshot() {
+        let pageToken;
+        let cursor = 0;
+        // Collected first and swapped in once every page has arrived. A snapshot
+        // is the whole truth about what is revoked *now*, so applying it on top
+        // of what the set already held kept anything resumed while this client
+        // was disconnected — denied until it expired. Swapping only after the
+        // last page means a failure part way through leaves the previous set
+        // intact rather than a half-built one.
+        const entries = [];
+        do {
+            // `pageToken` is empty only on the first pass; the loop condition ends
+            // it otherwise. The previous null/undefined pair was half redundant,
+            // which is what the static analysis was pointing at.
+            const query = pageToken ? `?pageToken=${encodeURIComponent(pageToken)}` : '';
+            const page = await this.#http.get(`/v1/revocations${query}`);
+            entries.push(...page.entries);
+            cursor = page.cursor;
+            pageToken = page.nextPageToken;
+        } while (pageToken);
+        this.#set.replaceAll(entries);
+        this.#set.prune();
+        this.#cursor = cursor;
+        this.#synced = true;
+        this.#touch();
+    }
+    /** Follow the Server-Sent Events stream. Returns false if streaming is not usable here. */
+    async #stream() {
+        const response = await this.#http.rawGet(`/v1/revocations/stream?since=${this.#cursor}`, this.#controller?.signal);
+        if (!response.ok)
+            throw httpError(response.status);
+        if (!response.body)
+            return false;
+        const reader = response.body.getReader();
+        this.#reader = reader;
+        const decoder = new TextDecoder();
+        let buffer = '';
+        // A half-open socket delivers nothing and never ends. Heartbeats are due
+        // every second, so silence for twice the staleness bound means the
+        // connection is gone: drop it and let the loop reconnect.
+        const silenceLimit = Math.max(2 * this.#staleAfterMs, 1_000);
+        let watchdog = setTimeout(() => void reader.cancel().catch(() => { }), silenceLimit);
+        watchdog.unref?.();
+        try {
+            while (this.#running) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                clearTimeout(watchdog);
+                watchdog = setTimeout(() => void reader.cancel().catch(() => { }), silenceLimit);
+                watchdog.unref?.();
+                buffer += decoder.decode(value, { stream: true });
+                let index = buffer.indexOf('\n\n');
+                while (index !== -1) {
+                    this.#handleEvent(buffer.slice(0, index));
+                    buffer = buffer.slice(index + 2);
+                    index = buffer.indexOf('\n\n');
+                }
+            }
+        }
+        finally {
+            clearTimeout(watchdog);
+            this.#reader = null;
+            reader.releaseLock();
+            await response.body.cancel().catch(() => { });
+        }
+        return true;
+    }
+    #handleEvent(block) {
+        let event = 'message';
+        let data = '';
+        for (const line of block.split('\n')) {
+            if (line.startsWith('event:'))
+                event = line.slice(6).trim();
+            else if (line.startsWith('data:'))
+                data += line.slice(5).trim();
+        }
+        if (event === 'heartbeat' || event === 'ready') {
+            this.#touch();
+            return;
+        }
+        if (event !== 'revocation' || data.length === 0)
+            return;
+        try {
+            const entry = JSON.parse(data);
+            this.#set.apply(entry);
+            if (entry.seq > this.#cursor)
+                this.#cursor = entry.seq;
+            this.#touch();
+        }
+        catch {
+            // A line we cannot read is not evidence that nothing is revoked; the
+            // next heartbeat decides freshness.
+        }
+    }
+    /** Long-poll fallback for runtimes without streaming response bodies. */
+    async #poll() {
+        const wait = Math.max(1, Math.floor(this.#staleAfterMs / 2 / 1000));
+        while (this.#running) {
+            const page = await this.#http.get(`/v1/revocations?since=${this.#cursor}&wait=${wait}`);
+            this.#set.applyAll(page.entries);
+            if (page.cursor > this.#cursor)
+                this.#cursor = page.cursor;
+            for (const entry of page.entries)
+                if (entry.seq > this.#cursor)
+                    this.#cursor = entry.seq;
+            this.#touch();
+        }
+    }
+}
+function httpError(status) {
+    const error = new Error(`revocation feed responded ${status}`);
+    error.status = status;
+    return error;
+}
+function classify(err) {
+    const status = err?.statusCode
+        ?? err?.status;
+    if (status === 404)
+        return 'disabled';
+    if (status === 503)
+        return 'not_ready';
+    if (status === 401 || status === 403)
+        return 'unauthorized';
+    return 'network';
+}
+async function sleep(ms, signal) {
+    if (signal?.aborted)
+        return;
+    await new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref?.();
+        signal?.addEventListener('abort', () => {
+            clearTimeout(timer);
+            resolve();
+        }, { once: true });
+    });
+}
+//# sourceMappingURL=feed.js.map

package/dist/revocations/feed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed.js","sourceRoot":"","sources":["../../src/revocations/feed.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,UAAU,EAAkE,MAAM,UAAU,CAAC;AAuCtG;;;GAGG;AACH,MAAM,YAAY,GAAG,GAAW,EAAE,CAChC,CAAC,OAAO,WAAW,KAAK,WAAW,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAEjH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,cAAc;IAChB,KAAK,CAAa;IAClB,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;IACxB,aAAa,CAAS;IACtB,iBAAiB,CAAS;IAC1B,UAAU,CAAoB;IAEvC,QAAQ,GAAG,KAAK,CAAC;IACjB,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,CAAC,CAAC;IACZ,YAAY,GAAiC,IAAI,CAAC;IAClD,WAAW,GAA2B,IAAI,CAAC;IAC3C,KAAK,GAAyB,IAAI,CAAC;IACnC,OAAO,GAAmD,IAAI,CAAC;IAC/D,SAAS,GAAG,CAAC,CAAC;IACd,QAAQ,GAAsB,EAAE,CAAC;IAEjC,YAAY,IAAgB,EAAE,OAAO,GAA0B,EAAE;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;QACpE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAChF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAClD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK;QACH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,YAAY;SAC/B,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,OAAO,CAAC,GAAG,GAAW,YAAY,EAAE;QAClC,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC;IACjG,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,GAAkB,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,4CAA4C;IAC5C,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA0C,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QAC1B,qEAAqE;QACrE,uCAAuC;QACvC,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAwB,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,SAAS,GAAW,IAAI,CAAC,aAAa;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,YAAY,EAAE,GAAG,SAAS,CAAC;QAC5C,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,YAAY,EAAE,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACpF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;gBACxF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE;oBACtB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;QAC/B,uEAAuE;QACvE,uDAAuD;QACvD,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,iBAAiB,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAC/B,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;oBACtC,IAAI,CAAC,QAAQ;wBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAClC,kEAAkE;oBAClE,2CAA2C;yBACtC,IAAI,IAAI,CAAC,QAAQ;wBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBACxF,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAC7C,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,sBAAsB,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,SAAoC,CAAC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,uCAAuC;QACvC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,GAAG,CAAC;YACF,uEAAuE;YACvE,qEAAqE;YACrE,qDAAqD;YACrD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,kBAAkB,KAAK,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC;QACjC,CAAC,QAAQ,SAAS,EAAE;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CACtC,gCAAgC,IAAI,CAAC,OAAO,EAAE,EAC9C,IAAI,CAAC,WAAW,EAAE,MAAM,CACzB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,yEAAyE;QACzE,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAwB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC1G,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvB,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAwB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;gBACtG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;gBACnB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,IAAI,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACnC,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACpB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC1C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBACjC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAwB,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,KAAa;QACxB,IAAI,KAAK,GAAG,SAAS,CAAC;QACtB,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACvD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvB,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,yBAAyB,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO;oBAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;YACzF,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IAC9D,KAAqC,CAAC,MAAM,GAAG,MAAM,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,MAAM,GAAI,GAAuD,EAAE,UAAU;WAC7E,GAAkC,EAAE,MAAM,CAAC;IACjD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC;IACtC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IACnD,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO;IAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;YACrC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/revocations/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Revocation checking for `enforce()` (PRD G-6).
+ *
+ * - `offline` (default): no check. A revoked grant's token stays
+ *   cryptographically valid until it expires, which is why the other two modes
+ *   exist.
+ * - `feed`: follow the revocation feed and keep an in-memory set of revoked
+ *   grants and tokens. Denies within seconds of a revocation, with no network
+ *   call on the hot path, and fails closed when the feed goes stale.
+ * - `online`: ask the auth service about the grant on every call. Simplest,
+ *   slowest, and denies when the service cannot be reached.
+ */
+export declare const REVOCATION_CHECK_MODES: readonly ['offline', 'online', 'feed'];
+export type RevocationCheckMode = (typeof REVOCATION_CHECK_MODES)[number];
+export declare function isRevocationCheckMode(value: unknown): value is RevocationCheckMode;
+export { RevokedSet } from './set.js';
+export type { CredentialRef, RevocationAction, RevocationEntry, RevocationMatch } from './set.js';
+export { RevocationFeed } from './feed.js';
+export type { FeedUnavailableReason, RevocationFeedOptions, RevocationFeedState } from './feed.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/revocations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/revocations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,YAAI,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAC7E,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF;AAED,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC"}

package/dist/revocations/index.js

@@ -0,0 +1,19 @@
+/**
+ * Revocation checking for `enforce()` (PRD G-6).
+ *
+ * - `offline` (default): no check. A revoked grant's token stays
+ *   cryptographically valid until it expires, which is why the other two modes
+ *   exist.
+ * - `feed`: follow the revocation feed and keep an in-memory set of revoked
+ *   grants and tokens. Denies within seconds of a revocation, with no network
+ *   call on the hot path, and fails closed when the feed goes stale.
+ * - `online`: ask the auth service about the grant on every call. Simplest,
+ *   slowest, and denies when the service cannot be reached.
+ */
+export const REVOCATION_CHECK_MODES = ['offline', 'online', 'feed'];
+export function isRevocationCheckMode(value) {
+    return typeof value === 'string' && REVOCATION_CHECK_MODES.includes(value);
+}
+export { RevokedSet } from './set.js';
+export { RevocationFeed } from './feed.js';
+//# sourceMappingURL=index.js.map

package/dist/revocations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/revocations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAG7E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,sBAA4C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpG,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}