@xyo-network/event-kit-protocol 2.2.0 → 2.2.1

package/dist/neutral/grantEvidence.d.ts

@@ -12,8 +12,10 @@ export interface DeploymentGrantAuthorizerOptions {
  *
  * - **Aboutness.** The requested publisher must match both the Claim's
  *   `subject` and the grant object's `publisher` field.
- * - **Negation.** A grant is disabled by a further claim, by the *same pinned
- *   controller*, of a revocation object referencing that grant's hash.
+ * - **Negation.** A grant is disabled when the pinned controller has Claim
+ *   membership for the recomputed canonical hash of
+ *   `{ schema: grant.revocation, grant: <object hash> }` under the publisher
+ *   subject. Declared schema and body resolution are not consulted.
  *   Revocations from any other source are ignored.
  */
 export declare function createDeploymentGrantAuthorizer(options: DeploymentGrantAuthorizerOptions): DeploymentGrantAuthorizer;

package/dist/neutral/grantEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grantEvidence.d.ts","sourceRoot":"","sources":["../../src/grantEvidence.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAGV,yBAAyB,EAE1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAEV,4BAA4B,EAC7B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAA;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,yBAAyB,CAgD3B"}
+{"version":3,"file":"grantEvidence.d.ts","sourceRoot":"","sources":["../../src/grantEvidence.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAGV,yBAAyB,EAE1B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAEV,4BAA4B,EAC7B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAA;CAC9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,yBAAyB,CAsD3B"}

package/dist/neutral/index.d.ts

@@ -19,6 +19,8 @@ export { createMemoryWakeQueue } from './memoryWakeQueue.ts';
 export type { BeginPublisherEndpointChallengeAttemptInput, BeginPublisherEndpointChallengeAttemptResult, CompletePublisherEndpointChallengeInput, CompletePublisherEndpointChallengeResult, IssuePublisherEndpointChallengeInput, IssuePublisherEndpointChallengeResult, PublisherEncryptionKeyLookup, PublisherEncryptionKeyStore, PublisherEndpointChallengeRecord, PublisherEndpointChallengeState, PublisherEndpointChallengeStore, } from './publisherHandshakeStores.ts';
 export type { BeginPublisherEndpointChallengeAttemptApiInput, BeginPublisherEndpointChallengeAttemptApiResult, CompletePublisherEndpointChallengeApiInput, CompletePublisherEndpointChallengeApiResult, CompletePublisherEndpointChallengeFailure, CompletePublisherEndpointChallengeFailureReason, CompletePublisherEndpointChallengeSuccess, IssuePublisherEndpointChallengeApiInput, IssuePublisherEndpointChallengeApiResult, PublisherEndpointChallengeContext, PublisherSubscriptionCandidate, PublisherSubscriptionValidation, PublisherSubscriptionValidationFailure, PublisherSubscriptionValidationFailureReason, ValidatedPublisherSubscription, } from './publisherSubscription.ts';
 export { beginPublisherEndpointChallengeAttempt, completePublisherEndpointChallenge, endpointChallengeMatchesPublisherContext, issuePublisherEndpointChallenge, validateAndDecryptPublisherSubscription, } from './publisherSubscription.ts';
+export type { RecomputableRevocationKind } from './revocationRecognition.ts';
+export { recomputableRevocationHash } from './revocationRecognition.ts';
 export * from './sourceWakeActivation.ts';
 export * from './sourceWakeIdentity.ts';
 export { StaleWakeLeaseError } from './staleWakeLeaseError.ts';

package/dist/neutral/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,oCAAoC,EACpC,mCAAmC,EACnC,mCAAmC,EACnC,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,6BAA6B,EAC7B,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,cAAc,0BAA0B,CAAA;AACxC,OAAO,EACL,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,oCAAoC,EACpC,iCAAiC,EACjC,2BAA2B,EAC3B,oBAAoB,EACpB,qCAAqC,EACrC,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,sBAAsB,EACtB,gCAAgC,EAChC,eAAe,EACf,yBAAyB,EACzB,gCAAgC,EAChC,0CAA0C,EAC1C,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,iCAAiC,EACjC,yBAAyB,EACzB,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAA;AAChF,YAAY,EACV,eAAe,EACf,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EACV,2CAA2C,EAC3C,4CAA4C,EAC5C,uCAAuC,EACvC,wCAAwC,EACxC,oCAAoC,EACpC,qCAAqC,EACrC,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,8CAA8C,EAC9C,+CAA+C,EAC/C,0CAA0C,EAC1C,2CAA2C,EAC3C,yCAAyC,EACzC,+CAA+C,EAC/C,yCAAyC,EACzC,uCAAuC,EACvC,wCAAwC,EACxC,iCAAiC,EACjC,8BAA8B,EAC9B,+BAA+B,EAC/B,sCAAsC,EACtC,4CAA4C,EAC5C,8BAA8B,GAC/B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,wCAAwC,EACxC,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,4BAA4B,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAA;AACtG,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC/D,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,gCAAgC,EAChC,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gCAAgC,EAChC,kCAAkC,EAClC,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,4BAA4B,EAC5B,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,yCAAyC,EACzC,+BAA+B,GAChC,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,oCAAoC,EACpC,mCAAmC,EACnC,mCAAmC,EACnC,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,6BAA6B,EAC7B,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,cAAc,0BAA0B,CAAA;AACxC,OAAO,EACL,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,oCAAoC,EACpC,iCAAiC,EACjC,2BAA2B,EAC3B,oBAAoB,EACpB,qCAAqC,EACrC,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,sBAAsB,EACtB,gCAAgC,EAChC,eAAe,EACf,yBAAyB,EACzB,gCAAgC,EAChC,0CAA0C,EAC1C,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,iCAAiC,EACjC,yBAAyB,EACzB,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAA;AAChF,YAAY,EACV,eAAe,EACf,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,YAAY,EACV,2CAA2C,EAC3C,4CAA4C,EAC5C,uCAAuC,EACvC,wCAAwC,EACxC,oCAAoC,EACpC,qCAAqC,EACrC,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,8CAA8C,EAC9C,+CAA+C,EAC/C,0CAA0C,EAC1C,2CAA2C,EAC3C,yCAAyC,EACzC,+CAA+C,EAC/C,yCAAyC,EACzC,uCAAuC,EACvC,wCAAwC,EACxC,iCAAiC,EACjC,8BAA8B,EAC9B,+BAA+B,EAC/B,sCAAsC,EACtC,4CAA4C,EAC5C,8BAA8B,GAC/B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,wCAAwC,EACxC,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,4BAA4B,CAAA;AACnC,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AACvE,cAAc,2BAA2B,CAAA;AACzC,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAA;AACtG,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC/D,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,gCAAgC,EAChC,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gCAAgC,EAChC,kCAAkC,EAClC,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,4BAA4B,EAC5B,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,yCAAyC,EACzC,+BAA+B,GAChC,MAAM,2BAA2B,CAAA"}

package/dist/neutral/index.mjs

@@ -1919,11 +1919,59 @@ function filterWithinServicePolicy(service, plaintext) {
   return service.deliveryMode === filter.deliveryMode && JSON.stringify(service.bestEffort) === JSON.stringify(filter.bestEffort) && filter.maxPositionsPerWake <= service.limits.maxPositionsPerWake && service.events.some((event) => wakeSourcesEqual(event.source, filter.source));
 }
 
+// src/revocationRecognition.ts
+import {
+  HashZod as HashZod7,
+  PublisherEncryptionKeyRevocationSchema as PublisherEncryptionKeyRevocationSchema2,
+  PublisherEncryptionKeyRevocationZod as PublisherEncryptionKeyRevocationZod2,
+  PublisherServiceRevocationSchema as PublisherServiceRevocationSchema2,
+  PublisherServiceRevocationZod as PublisherServiceRevocationZod2,
+  WakeGrantRevocationSchema as WakeGrantRevocationSchema3,
+  WakeGrantRevocationZod as WakeGrantRevocationZod2,
+  WakeSubscriptionAcceptanceRevocationSchema as WakeSubscriptionAcceptanceRevocationSchema2,
+  WakeSubscriptionAcceptanceRevocationZod as WakeSubscriptionAcceptanceRevocationZod2,
+  WakeSubscriptionRevocationSchema as WakeSubscriptionRevocationSchema2,
+  WakeSubscriptionRevocationZod as WakeSubscriptionRevocationZod2
+} from "@xyo-network/event-kit-schemas";
+import { PayloadBuilder as PayloadBuilder6 } from "@xyo-network/sdk";
+async function recomputableRevocationHash(kind, targetHash) {
+  return await PayloadBuilder6.dataHash(revocationPayload(kind, HashZod7.parse(targetHash)));
+}
+function revocationPayload(kind, target) {
+  switch (kind) {
+    case "acceptance":
+      return WakeSubscriptionAcceptanceRevocationZod2.parse({
+        acceptance: target,
+        schema: WakeSubscriptionAcceptanceRevocationSchema2
+      });
+    case "grant":
+      return WakeGrantRevocationZod2.parse({
+        grant: target,
+        schema: WakeGrantRevocationSchema3
+      });
+    case "key":
+      return PublisherEncryptionKeyRevocationZod2.parse({
+        key: target,
+        schema: PublisherEncryptionKeyRevocationSchema2
+      });
+    case "service":
+      return PublisherServiceRevocationZod2.parse({
+        schema: PublisherServiceRevocationSchema2,
+        service: target
+      });
+    case "subscription":
+      return WakeSubscriptionRevocationZod2.parse({
+        schema: WakeSubscriptionRevocationSchema2,
+        subscription: target
+      });
+  }
+}
+
 // src/sourceWakeActivation.ts
 import {
   ChainIdZod as ChainIdZod3,
   DeploymentIdZod as DeploymentIdZod3,
-  HashZod as HashZod7,
+  HashZod as HashZod8,
   NonnegativeJsonSafeIntegerZod as NonnegativeJsonSafeIntegerZod4,
   NormalizedAddressZod as NormalizedAddressZod7,
   PositiveJsonSafeIntegerZod as PositiveJsonSafeIntegerZod2
@@ -1938,11 +1986,11 @@ var SourceWakeSubscriptionActivationZod = z4.strictObject({
   publisher: NormalizedAddressZod7,
   deploymentId: DeploymentIdZod3,
   queueId: z4.string().min(1).max(255).optional(),
-  sourceHash: HashZod7,
-  filterHash: HashZod7,
-  subscriptionHash: HashZod7,
-  serviceHash: HashZod7,
-  grantHash: HashZod7
+  sourceHash: HashZod8,
+  filterHash: HashZod8,
+  subscriptionHash: HashZod8,
+  serviceHash: HashZod8,
+  grantHash: HashZod8
 }).refine(
   (value) => value.activeFromBlock <= value.atBlock && value.atBlock < value.expiresAtBlock,
   "Subscription must be active at the exact finalized authorization snapshot"
@@ -1957,12 +2005,10 @@ import {
 // src/grantEvidence.ts
 import {
   asWakeGrantObject,
-  asWakeGrantRevocation,
   DeploymentIdZod as DeploymentIdZod4,
-  HashZod as HashZod8,
+  HashZod as HashZod9,
   NormalizedAddressZod as NormalizedAddressZod8,
-  WakeGrantObjectSchema as WakeGrantObjectSchema3,
-  WakeGrantRevocationSchema as WakeGrantRevocationSchema3
+  WakeGrantObjectSchema as WakeGrantObjectSchema3
 } from "@xyo-network/event-kit-schemas";
 function createDeploymentGrantAuthorizer(options) {
   const { viewer } = options;
@@ -1978,7 +2024,13 @@ function createDeploymentGrantAuthorizer(options) {
         ...request.exactGrantHash === void 0 ? {} : { objectHash: request.exactGrantHash },
         subject: request.publisher
       });
-      const revokedGrantHashes = await readRevocations(viewer, request.controller, request.publisher, atBlock);
+      const revokedGrantHashes = await readRevocations(
+        viewer,
+        request.controller,
+        request.publisher,
+        atBlock,
+        claims
+      );
       let evidence;
       for (const claim of claims) {
         evidence = await resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes);
@@ -2007,21 +2059,24 @@ function createDeploymentGrantAuthorizer(options) {
     }
   });
 }
-async function readRevocations(viewer, controller, subject, atBlock) {
+async function readRevocations(viewer, controller, subject, atBlock, grantClaims) {
   const revoked = /* @__PURE__ */ new Set();
-  const claims = await viewer.claims(controller, {
-    declaredObjectSchemaPrefix: WakeGrantRevocationSchema3,
-    subject
-  });
-  for (const claim of claims) {
-    if (!isLiveClaim(claim, controller, subject, WakeGrantRevocationSchema3, atBlock)) continue;
-    const object = await viewer.object(claim.objectHash);
-    if (object?.assurance !== "resolved" || object.declaredSchema !== WakeGrantRevocationSchema3 || object.objectHash !== claim.objectHash || !isRecord3(object.params) || Object.hasOwn(object.params, "schema")) continue;
-    const revocation = asWakeGrantRevocation({ ...object.params, schema: object.declaredSchema });
-    if (revocation !== void 0) revoked.add(revocation.grant);
+  for (const claim of grantClaims) {
+    if (!isLiveClaim(claim, controller, subject, WakeGrantObjectSchema3, atBlock)) continue;
+    if (await controllerRevokedGrant(viewer, controller, subject, claim.objectHash, atBlock)) {
+      revoked.add(claim.objectHash);
+    }
   }
   return revoked;
 }
+async function controllerRevokedGrant(viewer, controller, subject, grantHash, atBlock) {
+  const objectHash = await recomputableRevocationHash("grant", grantHash);
+  const claims = await viewer.claims(controller, { objectHash, subject });
+  return claims.some((claim) => isRevocationMembership(claim, controller, subject, objectHash, atBlock));
+}
+function isRevocationMembership(claim, controller, subject, objectHash, atBlock) {
+  return claim.source === controller && claim.subject === subject && claim.objectHash === objectHash && isNonnegativeSafeInteger5(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger5(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod9.safeParse(claim.firstEventHash).success && HashZod9.safeParse(claim.objectHash).success;
+}
 async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHashes) {
   if (!isLiveClaim(claim, request.controller, request.publisher, WakeGrantObjectSchema3, atBlock)) return void 0;
   if (revokedGrantHashes.has(claim.objectHash)) return void 0;
@@ -2044,7 +2099,7 @@ async function resolveEvidence(viewer, claim, request, atBlock, revokedGrantHash
   });
 }
 function isLiveClaim(claim, controller, subject, declaredObjectSchema, atBlock) {
-  return claim.source === controller && claim.subject === subject && claim.declaredObjectSchema === declaredObjectSchema && isNonnegativeSafeInteger5(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger5(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod8.safeParse(claim.firstEventHash).success && HashZod8.safeParse(claim.objectHash).success;
+  return claim.source === controller && claim.subject === subject && claim.declaredObjectSchema === declaredObjectSchema && isNonnegativeSafeInteger5(claim.firstBlock) && claim.firstBlock <= atBlock && isNonnegativeSafeInteger5(claim.lastBlock) && claim.lastBlock >= claim.firstBlock && HashZod9.safeParse(claim.firstEventHash).success && HashZod9.safeParse(claim.objectHash).success;
 }
 function parseExactGrantObject(object, expectedObjectHash) {
   if (object?.assurance !== "resolved") return void 0;
@@ -2056,7 +2111,7 @@ function parseExactGrantObject(object, expectedObjectHash) {
   });
 }
 function assertValidRequest(request) {
-  if (request.exactGrantHash !== void 0 && !HashZod8.safeParse(request.exactGrantHash).success) {
+  if (request.exactGrantHash !== void 0 && !HashZod9.safeParse(request.exactGrantHash).success) {
     throw new TypeError("Exact grant hash must be canonical lowercase hexadecimal");
   }
   if (!NormalizedAddressZod8.safeParse(request.controller).success) {
@@ -2192,6 +2247,7 @@ export {
   issuePublisherEndpointChallenge,
   parseAdmittedWake,
   parseBestEffortSecurityState,
+  recomputableRevocationHash,
   resolvePreferredEncryptionKey,
   selectPublisherService,
   selectSubscriptionActivation,