@prampta/sdk 0.8.0 → 0.8.1

package/dist/index.d.mts

@@ -32,6 +32,8 @@ declare class TrustedRegistryDirectory {
     assertEndpoint(subject: string, baseUrl: string): void;
     /** V-10: use only AFTER independently verifying the object's signature. */
     assertSigner(code: string, keyId: string): void;
+    /** V-14 */
+    private assertNotRevoked;
     assertDecision(subject: string, license: string | null, keyId: string, baseUrl: string): void;
 }
 

package/dist/index.d.ts

@@ -32,6 +32,8 @@ declare class TrustedRegistryDirectory {
     assertEndpoint(subject: string, baseUrl: string): void;
     /** V-10: use only AFTER independently verifying the object's signature. */
     assertSigner(code: string, keyId: string): void;
+    /** V-14 */
+    private assertNotRevoked;
     assertDecision(subject: string, license: string | null, keyId: string, baseUrl: string): void;
 }
 

package/dist/index.js

@@ -140,16 +140,18 @@ function registryNamespace(code) {
   return "";
 }
 var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
-  constructor(registries, sequence, snapshotHash, seal) {
+  constructor(registries, revokedKeys, sequence, snapshotHash, seal) {
     this.sequence = sequence;
     this.snapshotHash = snapshotHash;
     if (seal !== verifiedConstruction) fail("Construct directories through signature verification");
     this.#registries = registries;
+    this.#revokedKeys = new Set(revokedKeys);
     Object.freeze(this);
   }
   sequence;
   snapshotHash;
   #registries;
+  #revokedKeys;
   static async verify(input, options) {
     const min = options.minSequence ?? 0;
     if (!Number.isSafeInteger(min) || min < 0) fail("minSequence must be a nonnegative safe integer");
@@ -189,6 +191,16 @@ var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
       }
     }
     if (!prefixes.has("")) fail("Missing origin namespace");
+    for (const r of d.registries) {
+      if (r.revoked !== void 0 && !(r.revoked && typeof r.revoked === "object" && typeof r.revoked.at === "string")) {
+        fail("Invalid registry revocation");
+      }
+    }
+    if (d.revoked_keys !== void 0 && !(Array.isArray(d.revoked_keys) && d.revoked_keys.every(
+      (k) => k && /^pg-ed25519:[0-9a-f]{32}$/.test(String(k.key_id)) && typeof k.at === "string"
+    ))) {
+      fail("Invalid revoked key list");
+    }
     const publicKey = hexBytes(options.stewardPublicKeyHex, 32);
     const hash = await sha256(publicKey);
     const fp = "pg-ed25519:" + hash.slice(0, 32);
@@ -206,7 +218,13 @@ var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
     if (!valid) fail("Invalid directory signature");
     const snapshotHash = await sha256(message);
     if (previous && previous.sequence === d.sequence && previous.hash !== snapshotHash) fail("Directory equivocation detected");
-    return new _TrustedRegistryDirectory(d.registries, d.sequence, snapshotHash, verifiedConstruction);
+    return new _TrustedRegistryDirectory(
+      d.registries,
+      (d.revoked_keys ?? []).map((k) => k.key_id),
+      d.sequence,
+      snapshotHash,
+      verifiedConstruction
+    );
   }
   registryFor(code) {
     const prefix = registryNamespace(code);
@@ -222,7 +240,13 @@ var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
   }
   /** V-10: use only AFTER independently verifying the object's signature. */
   assertSigner(code, keyId) {
-    if (!this.registryFor(code).key_fingerprints.includes(keyId)) fail("Registry issuer/key mismatch");
+    const owner = this.registryFor(code);
+    if (!owner.key_fingerprints.includes(keyId)) fail("Registry issuer/key mismatch");
+    this.assertNotRevoked(owner, keyId);
+  }
+  /** V-14 */
+  assertNotRevoked(owner, keyId) {
+    if (owner.revoked || this.#revokedKeys.has(keyId)) fail("Revoked registry or key");
   }
   assertDecision(subject, license, keyId, baseUrl) {
     this.assertEndpoint(subject, baseUrl);
@@ -230,6 +254,7 @@ var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
     else {
       const owner = this.#registries.find((r) => apiUrl(r.api) === apiUrl(baseUrl));
       if (!owner?.key_fingerprints.includes(keyId)) fail("Registry issuer/key mismatch");
+      this.assertNotRevoked(owner, keyId);
     }
     if (license) {
       this.assertEndpoint(license, baseUrl);

package/dist/index.mjs

@@ -85,16 +85,18 @@ function registryNamespace(code) {
   return "";
 }
 var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
-  constructor(registries, sequence, snapshotHash, seal) {
+  constructor(registries, revokedKeys, sequence, snapshotHash, seal) {
     this.sequence = sequence;
     this.snapshotHash = snapshotHash;
     if (seal !== verifiedConstruction) fail("Construct directories through signature verification");
     this.#registries = registries;
+    this.#revokedKeys = new Set(revokedKeys);
     Object.freeze(this);
   }
   sequence;
   snapshotHash;
   #registries;
+  #revokedKeys;
   static async verify(input, options) {
     const min = options.minSequence ?? 0;
     if (!Number.isSafeInteger(min) || min < 0) fail("minSequence must be a nonnegative safe integer");
@@ -134,6 +136,16 @@ var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
       }
     }
     if (!prefixes.has("")) fail("Missing origin namespace");
+    for (const r of d.registries) {
+      if (r.revoked !== void 0 && !(r.revoked && typeof r.revoked === "object" && typeof r.revoked.at === "string")) {
+        fail("Invalid registry revocation");
+      }
+    }
+    if (d.revoked_keys !== void 0 && !(Array.isArray(d.revoked_keys) && d.revoked_keys.every(
+      (k) => k && /^pg-ed25519:[0-9a-f]{32}$/.test(String(k.key_id)) && typeof k.at === "string"
+    ))) {
+      fail("Invalid revoked key list");
+    }
     const publicKey = hexBytes(options.stewardPublicKeyHex, 32);
     const hash = await sha256(publicKey);
     const fp = "pg-ed25519:" + hash.slice(0, 32);
@@ -151,7 +163,13 @@ var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
     if (!valid) fail("Invalid directory signature");
     const snapshotHash = await sha256(message);
     if (previous && previous.sequence === d.sequence && previous.hash !== snapshotHash) fail("Directory equivocation detected");
-    return new _TrustedRegistryDirectory(d.registries, d.sequence, snapshotHash, verifiedConstruction);
+    return new _TrustedRegistryDirectory(
+      d.registries,
+      (d.revoked_keys ?? []).map((k) => k.key_id),
+      d.sequence,
+      snapshotHash,
+      verifiedConstruction
+    );
   }
   registryFor(code) {
     const prefix = registryNamespace(code);
@@ -167,7 +185,13 @@ var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
   }
   /** V-10: use only AFTER independently verifying the object's signature. */
   assertSigner(code, keyId) {
-    if (!this.registryFor(code).key_fingerprints.includes(keyId)) fail("Registry issuer/key mismatch");
+    const owner = this.registryFor(code);
+    if (!owner.key_fingerprints.includes(keyId)) fail("Registry issuer/key mismatch");
+    this.assertNotRevoked(owner, keyId);
+  }
+  /** V-14 */
+  assertNotRevoked(owner, keyId) {
+    if (owner.revoked || this.#revokedKeys.has(keyId)) fail("Revoked registry or key");
   }
   assertDecision(subject, license, keyId, baseUrl) {
     this.assertEndpoint(subject, baseUrl);
@@ -175,6 +199,7 @@ var TrustedRegistryDirectory = class _TrustedRegistryDirectory {
     else {
       const owner = this.#registries.find((r) => apiUrl(r.api) === apiUrl(baseUrl));
       if (!owner?.key_fingerprints.includes(keyId)) fail("Registry issuer/key mismatch");
+      this.assertNotRevoked(owner, keyId);
     }
     if (license) {
       this.assertEndpoint(license, baseUrl);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prampta/sdk",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "PRAMPTA SDK — authorization before generation",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "@noble/ed25519": "^3.1.0",
-    "@pregen/verify": "^0.4.0"
+    "@pregen/verify": "^0.5.0"
   },
   "repository": {
     "type": "git",