@zadq/x402 0.0.0-stage → 0.1.0

package/dist/holder/holder.js

@@ -0,0 +1,381 @@
+// The seller's holder: the accountable party's own identity credential,
+// held in the seller's infrastructure over MintID's holder library process
+// (the identity class: issuance from the operator's offer, witness refresh,
+// bound presentations, self-check, self-revocation). Restated from MintID's
+// holder-library contract, cited by name; this module carries no
+// cryptography and no chain or relay client of its own.
+//
+// Where things live: the credential and its link secret inside the holder
+// process; the custody encoding under the seller's own key (custody.ts);
+// state only — offered / held / revoked — at the verification service,
+// which never sees a key, a code, a proof or the encoding.
+//
+// Graceful degradation: a middleware without a credential emits the v0
+// object only and every payment proceeds as before; a holder that cannot
+// present answers the verification service's challenge with a refusal, and
+// the verdict on the endpoint falls back to the v0 standing. Nothing blocks.
+import { CredentialRevokedError, HolderError, HolderLibraryError, HolderStepError, OfferError, } from "./errors.js";
+/** The identity credential's configuration id at the issuer's metadata. */
+export const IDENTITY_CONFIGURATION_ID = 'mintid_identity_v1';
+export const CREDENTIAL_FORMAT = 'mintid/anoncreds-v2';
+export const PROOF_TYPE = 'mintid_blind_request';
+export const PRE_AUTHORIZED_GRANT = 'urn:ietf:params:oauth:grant-type:pre-authorized_code';
+export const METADATA_PATH = '/.well-known/openid-credential-issuer';
+/** The issuer's public build information: names the chain it anchors on. */
+export const BUILD_INFO_PATH = '/v0/build-info';
+/** A presentation lives ten seconds from the challenge; the holder answers well inside it. */
+export const PRESENTATION_WINDOW_MS = 10_000;
+/**
+ * Reads the operator's hand-out in any of its forms — the dashboard's
+ * `{offer, expiresAt, credential}`, the issuer's `{credential_offer,
+ * expires_at}`, or the bare offer — and refuses anything that is not a
+ * pre-authorized MintID identity offer, or one already past its expiry.
+ */
+export function readCredentialOffer(input, now = new Date()) {
+    let value = input;
+    if (typeof value === 'string') {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            throw new OfferError('the hand-out is not JSON');
+        }
+    }
+    if (typeof value !== 'object' || value === null)
+        throw new OfferError('the hand-out is not an object');
+    const outer = value;
+    let expiresAt;
+    let offer;
+    if (typeof outer['offer'] === 'object' && outer['offer'] !== null) {
+        offer = outer['offer'];
+        if (typeof outer['expiresAt'] === 'string')
+            expiresAt = new Date(outer['expiresAt']);
+    }
+    else if (typeof outer['credential_offer'] === 'object' && outer['credential_offer'] !== null) {
+        offer = outer['credential_offer'];
+        if (typeof outer['expires_at'] === 'number')
+            expiresAt = new Date(outer['expires_at'] * 1000);
+    }
+    else {
+        offer = outer;
+    }
+    const issuer = String(offer['credential_issuer'] ?? '').replace(/\/+$/, '');
+    const grants = offer['grants'];
+    const code = grants?.[PRE_AUTHORIZED_GRANT]?.['pre-authorized_code'];
+    if (!issuer.startsWith('http') || typeof code !== 'string' || code === '') {
+        throw new OfferError('not a pre-authorized MintID credential offer');
+    }
+    const ids = offer['credential_configuration_ids'];
+    if (!Array.isArray(ids) || !ids.includes(IDENTITY_CONFIGURATION_ID)) {
+        throw new OfferError('the offer does not carry the MintID identity credential');
+    }
+    if (expiresAt !== undefined && (Number.isNaN(expiresAt.getTime()) || expiresAt <= now)) {
+        throw new OfferError('the offer has expired with the verification behind it — re-verify');
+    }
+    return expiresAt === undefined ? { offer } : { offer, expiresAt };
+}
+export class SellerHolder {
+    rpc;
+    handle;
+    fetchImpl;
+    custody;
+    // The issuer's self-revocation material for the root of the last adopted
+    // witness — served with the witness answer, cached in memory only (the
+    // custody encoding is the library's). Public, the same for every holder.
+    material;
+    constructor(rpc, handle, options) {
+        this.rpc = rpc;
+        this.handle = handle;
+        this.fetchImpl = options.fetch ?? fetch;
+        this.custody = options.custody;
+    }
+    /**
+     * Redeem the operator's offer, once: issuer metadata → the one-shot
+     * grant (with its nonce) → the library's blinded request → the
+     * credential → the library completes and holds it. The custody encoding
+     * is saved when a store is given. `OfferError` on a hand-out of another
+     * class, `HolderStepError` on a terminal issuer refusal (an offer past
+     * its verification's expiry answers 409 `session_reuse_expired`; the way
+     * back is a new verification, never a retry).
+     */
+    static async issue(handout, rpc, options = {}) {
+        const fetchImpl = options.fetch ?? fetch;
+        const { offer } = readCredentialOffer(handout);
+        const issuerUrl = String(offer['credential_issuer']).replace(/\/+$/, '');
+        const grants = offer['grants'];
+        const code = String(grants[PRE_AUTHORIZED_GRANT]?.['pre-authorized_code']);
+        const meta = await getJson(fetchImpl, 'metadata', issuerUrl + METADATA_PATH);
+        if (meta.status !== 200)
+            throw new HolderStepError('metadata', meta.status, meta.body);
+        const configs = meta.body['credential_configurations_supported'];
+        const definition = configs?.[IDENTITY_CONFIGURATION_ID]?.['issuer_definition'];
+        const grantEndpoint = meta.body['token_endpoint'];
+        const credentialEndpoint = meta.body['credential_endpoint'];
+        if (typeof definition !== 'string' ||
+            typeof grantEndpoint !== 'string' ||
+            typeof credentialEndpoint !== 'string') {
+            throw new HolderStepError('metadata', meta.status, { error: 'incomplete metadata' });
+        }
+        const grant = await getJson(fetchImpl, 'grant', grantEndpoint, postJson({ grant_type: PRE_AUTHORIZED_GRANT, 'pre-authorized_code': code }));
+        if (grant.status !== 200)
+            throw new HolderStepError('grant', grant.status, grant.body);
+        const flow = await rpc.call('issue_begin', {
+            issuer_definition: definition,
+            c_nonce: grant.body['c_nonce'],
+        });
+        const cred = await getJson(fetchImpl, 'credential', credentialEndpoint, postJson({
+            format: CREDENTIAL_FORMAT,
+            credential_configuration_id: IDENTITY_CONFIGURATION_ID,
+            proof: { proof_type: PROOF_TYPE, request: flow['request'] },
+        }, { authorization: `Bearer ${String(grant.body['access_token'])}` }));
+        if (cred.status !== 200)
+            throw new HolderStepError('credential', cred.status, cred.body);
+        const done = await rpc.call('issue_complete', {
+            flow: flow['flow'],
+            credential: cred.body['credential'],
+            credential_id: cred.body['credential_id'],
+            witness_endpoint: String(cred.body['witness_endpoint'] ?? ''),
+        });
+        const holder = new SellerHolder(rpc, Number(done['holder']), options);
+        await holder.persist();
+        return holder;
+    }
+    /** Resume from the custody store (or a custody encoding given directly). */
+    static async load(rpc, options = {}) {
+        const encoding = options.encoding ?? (await options.custody?.load());
+        if (!encoding)
+            throw new OfferError('no custody encoding to load — issue from an offer first');
+        const out = await rpc.call('load', { storage: encoding });
+        return new SellerHolder(rpc, Number(out['holder']), options);
+    }
+    /** Custody encoding — it contains the link secret; keep it sealed, never log it. */
+    async storage() {
+        return String((await this.rpc.call('storage', { holder: this.handle }))['storage']);
+    }
+    /** Writes the current custody encoding to the store, when one is configured. */
+    async persist() {
+        if (this.custody)
+            await this.custody.save(await this.storage());
+    }
+    async info() {
+        return (await this.rpc.call('info', { holder: this.handle }));
+    }
+    /**
+     * Fresh witness material from the issuer, adopted once a finalized root
+     * anchors it. Run it on your cadence — sized to how often roots are
+     * published — and right before presenting: a stale witness fails closed.
+     * `CredentialRevokedError` once the issuer serves none (revoked, or
+     * expired with its verification).
+     */
+    async refreshWitness() {
+        const endpoint = (await this.info()).witness_endpoint;
+        if (!endpoint)
+            throw new HolderStepError('witness', 0, { error: 'no witness endpoint' });
+        const { status, body } = await getJson(this.fetchImpl, 'witness', endpoint);
+        if (status !== 200)
+            throw new HolderStepError('witness', status, body);
+        const state = String(body['status'] ?? '');
+        const witness = body['witness'];
+        const root = body['root'];
+        if (state !== 'active' || typeof witness !== 'string') {
+            throw new CredentialRevokedError(`issuer reports status ${JSON.stringify(state)}`);
+        }
+        if (!body['usable'] || !root) {
+            return { status: state, usable: false, refreshed: false, rootHeight: null, statusRoot: null };
+        }
+        await this.rpc.call('refresh_witness', {
+            holder: this.handle,
+            issuer_definition: body['issuer_definition'],
+            witness,
+            root_height: Number(root.height),
+            root: String(root.root),
+        });
+        await this.persist();
+        // The issuer serves the root's self-revocation material with the
+        // witness: keep it, only when it names the adopted root.
+        const material = body['self_revoke_context'];
+        if (typeof material === 'object' &&
+            material !== null &&
+            material['status_root'] === String(root.root)) {
+            this.material = material;
+        }
+        return {
+            status: state,
+            usable: true,
+            refreshed: true,
+            rootHeight: Number(root.height),
+            statusRoot: String(root.root),
+        };
+    }
+    /**
+     * One bound, ten-second envelope for a verifier's challenge — the
+     * `createChallenge` answer as received (`{request, signature_hex}`) or
+     * its `request` object. The library refuses (naming an output key at
+     * most) when the credential cannot satisfy the policy: nothing is sent.
+     */
+    async present(challenge) {
+        const c = challenge;
+        const request = typeof c['request'] === 'object' && c['request'] !== null ? c['request'] : c;
+        return (await this.rpc.call('present', {
+            holder: this.handle,
+            request,
+        }));
+    }
+    /**
+     * The presentation endpoint's whole answer to the verification service's
+     * challenge (`POST` of the issued challenge, byte for byte): the witness
+     * is refreshed first, then one envelope is built. A witness endpoint that
+     * cannot be reached is not a refusal — the holder presents against the
+     * root it holds and the verifier decides. Refusals are value-free reason
+     * codes: `challenge_malformed` (400), `challenge_expired`,
+     * `credential_revoked`, `holder_refused` (409). Nothing of the exchange
+     * is logged here, and nothing is retried: the next cadence brings the
+     * next challenge.
+     */
+    async answerChallenge(body, now = new Date()) {
+        const challenge = readIssuedChallenge(body);
+        if (challenge === undefined) {
+            return { status: 400, body: { error: 'refused', reason: 'challenge_malformed' } };
+        }
+        if (challenge.request.expires_at * 1000 <= now.getTime()) {
+            return { status: 409, body: { error: 'refused', reason: 'challenge_expired' } };
+        }
+        try {
+            await this.refreshWitness();
+        }
+        catch (err) {
+            if (err instanceof CredentialRevokedError) {
+                return { status: 409, body: { error: 'refused', reason: 'credential_revoked' } };
+            }
+            if (err instanceof HolderLibraryError) {
+                return {
+                    status: 409,
+                    body: { error: 'refused', reason: 'holder_refused', detail: err.text },
+                };
+            }
+            if (!(err instanceof HolderStepError))
+                throw err;
+            // The issuer's witness endpoint did not answer: present with the held witness.
+        }
+        try {
+            return { status: 200, body: await this.present(challenge) };
+        }
+        catch (err) {
+            if (err instanceof HolderLibraryError) {
+                return {
+                    status: 409,
+                    body: { error: 'refused', reason: 'holder_refused', detail: err.text },
+                };
+            }
+            throw err;
+        }
+    }
+    /** The library's own consistency check under a caller nonce (hex); rejects otherwise. */
+    async selfCheck(nonce = randomNonceHex()) {
+        await this.rpc.call('self_check', { holder: this.handle, nonce });
+    }
+    /** The self-revocation material cached by the last witness refresh, if any. */
+    selfRevokeContext() {
+        return this.material;
+    }
+    /**
+     * The chain the issuer anchors on, from its public build information
+     * (the issuer is where the witness endpoint lives). `HolderStepError`
+     * when it cannot be read.
+     */
+    async chainId() {
+        const endpoint = (await this.info()).witness_endpoint;
+        if (!endpoint)
+            throw new HolderStepError('build-info', 0, { error: 'no witness endpoint' });
+        const { status, body } = await getJson(this.fetchImpl, 'build-info', new URL(endpoint).origin + BUILD_INFO_PATH);
+        if (status !== 200 || typeof body['chain_id'] !== 'string' || body['chain_id'] === '') {
+            throw new HolderStepError('build-info', status, { error: 'no chain id' });
+        }
+        return body['chain_id'];
+    }
+    /**
+     * Builds the credential's self-revocation against the issuer's published
+     * anchoring of a finalized root — the material cached by the last witness
+     * refresh unless the caller passes its own. From this call on the holder
+     * refuses to present, also after a reload from custody (the store is
+     * updated). The message revokes nothing until a privacy relay submits it
+     * and the chain records it: `revokeCredential` (killswitch.ts) is the
+     * product kill switch that does both and reports; this method is the
+     * primitive under it.
+     */
+    async selfRevoke(context) {
+        const anchoring = context.anchoring ?? this.material;
+        if (!anchoring) {
+            throw new HolderError('no self-revocation material: refresh the witness first, or pass the issuer anchoring');
+        }
+        const full = { chain_id: context.chain_id, anchoring };
+        const root = context.status_root ?? anchoring['status_root'];
+        if (typeof root === 'string' && root !== '')
+            full['status_root'] = root;
+        const out = (await this.rpc.call('self_revoke', {
+            holder: this.handle,
+            context: full,
+        }));
+        await this.persist();
+        return out;
+    }
+    /** Forget the credential inside the process (its secret with it). The custody store is untouched. */
+    async close() {
+        await this.rpc.call('drop', { holder: this.handle });
+    }
+}
+/**
+ * Reads the verification service's `POST` body as an issued challenge:
+ * `{request, signature_hex}`, or the bare request. Returns `undefined` for
+ * anything that is not a presentation request (no nonce, no audience, no
+ * expiry, no policy) — the endpoint answers 400 and moves on.
+ */
+export function readIssuedChallenge(body) {
+    if (typeof body !== 'object' || body === null)
+        return undefined;
+    const outer = body;
+    const request = (typeof outer['request'] === 'object' && outer['request'] !== null ? outer['request'] : outer);
+    const hex = (v) => typeof v === 'string' && /^[0-9a-f]{64}$/.test(v);
+    if (typeof request['session_id'] !== 'string' ||
+        !hex(request['nonce']) ||
+        !hex(request['verifier_id']) ||
+        typeof request['audience'] !== 'string' ||
+        typeof request['expires_at'] !== 'number' ||
+        !Array.isArray(request['claim_policy']) ||
+        request['claim_policy'].length === 0) {
+        return undefined;
+    }
+    return {
+        request: request,
+        signature_hex: typeof outer['signature_hex'] === 'string' ? outer['signature_hex'] : '',
+    };
+}
+function randomNonceHex() {
+    const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+async function getJson(fetchImpl, step, url, init = {}) {
+    let response;
+    try {
+        response = await fetchImpl(url, init);
+    }
+    catch (cause) {
+        throw new HolderStepError(step, 0, { error: String(cause) });
+    }
+    let body = {};
+    try {
+        const text = await response.text();
+        body = text ? JSON.parse(text) : {};
+    }
+    catch {
+        body = { error: 'non_json_response' };
+    }
+    return { status: response.status, body };
+}
+function postJson(body, headers = {}) {
+    return {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...headers },
+        body: JSON.stringify(body),
+    };
+}

package/dist/holder/index.d.ts

@@ -0,0 +1,8 @@
+export { CredentialRevokedError, HolderError, HolderLibraryError, HolderStepError, OfferError, } from './errors.js';
+export { HOLDER_BINARY_ENV, HOLDER_PROTOCOL, HolderProcess, type HolderParams, type HolderRpc, } from './process.js';
+export { custodyKeyFromHex, fileCustodyStore, memoryCustodyStore, sealedCustodyStore, type CustodyKey, type CustodyStore, } from './custody.js';
+export { BUILD_INFO_PATH, CREDENTIAL_FORMAT, IDENTITY_CONFIGURATION_ID, METADATA_PATH, PRE_AUTHORIZED_GRANT, PRESENTATION_WINDOW_MS, PROOF_TYPE, SellerHolder, readCredentialOffer, readIssuedChallenge, type CredentialOffer, type Fetch, type HolderOptions, } from './holder.js';
+export type { ChallengeAnswer, ClaimPredicate, HolderInfo, IssuedChallenge, PresentationEnvelope, PresentationRequest, SelfRevocation, SelfRevokeContext, SelfRevokeMaterial, WitnessState, } from './types.js';
+export { CHAIN_ID_ENV, CHAIN_RPC_ENV, CONFIRM_ATTEMPTS, CONFIRM_INTERVAL_MS, DEFAULT_JITTER_MS, EFFECT_BOUND, RELAY_SUBMIT_PATH, RELAY_URL_ENV, RelayRefusedError, confirmSelfRevocation, revokeCredential, submitSelfRevocation, type Confirmation, type ConfirmOptions, type KillSwitchOptions, type KillSwitchReport, type RelayAnswer, type RelayOutcome, type SubmitOptions, } from './killswitch.js';
+export { RECORDED_NULLIFIERS_QUERY, decodeRecordedNullifiers, encodeIssuerQuery, readRecordedNullifiers, type ChainReadOptions, type RecordedState, } from './chain.js';
+export { CUSTODY_FILE_ENV, CUSTODY_KEY_ENV, DASHBOARD_REVOKED_STATE, DASHBOARD_SELLER_ENV, DASHBOARD_SESSION_ENV, DASHBOARD_URL_ENV, reportToDashboard, runKillSwitch, type CliReport, type KillSwitchDeps, type KillSwitchEnv, type KillSwitchIO, } from './cli.js';

package/dist/holder/index.js

@@ -0,0 +1,14 @@
+// The seller-side holder module: the accountable party's identity credential
+// held in the seller's own infrastructure over MintID's holder library
+// process. Node-only (it spawns the holder process); the rest of this
+// repository stays platform-neutral.
+export { CredentialRevokedError, HolderError, HolderLibraryError, HolderStepError, OfferError, } from "./errors.js";
+export { HOLDER_BINARY_ENV, HOLDER_PROTOCOL, HolderProcess, } from "./process.js";
+export { custodyKeyFromHex, fileCustodyStore, memoryCustodyStore, sealedCustodyStore, } from "./custody.js";
+export { BUILD_INFO_PATH, CREDENTIAL_FORMAT, IDENTITY_CONFIGURATION_ID, METADATA_PATH, PRE_AUTHORIZED_GRANT, PRESENTATION_WINDOW_MS, PROOF_TYPE, SellerHolder, readCredentialOffer, readIssuedChallenge, } from "./holder.js";
+// The kill switch: self-revocation through the privacy relay, confirmed on
+// the chain, reported value-free (killswitch.ts); the issuer-scoped chain
+// read under it (chain.ts).
+export { CHAIN_ID_ENV, CHAIN_RPC_ENV, CONFIRM_ATTEMPTS, CONFIRM_INTERVAL_MS, DEFAULT_JITTER_MS, EFFECT_BOUND, RELAY_SUBMIT_PATH, RELAY_URL_ENV, RelayRefusedError, confirmSelfRevocation, revokeCredential, submitSelfRevocation, } from "./killswitch.js";
+export { RECORDED_NULLIFIERS_QUERY, decodeRecordedNullifiers, encodeIssuerQuery, readRecordedNullifiers, } from "./chain.js";
+export { CUSTODY_FILE_ENV, CUSTODY_KEY_ENV, DASHBOARD_REVOKED_STATE, DASHBOARD_SELLER_ENV, DASHBOARD_SESSION_ENV, DASHBOARD_URL_ENV, reportToDashboard, runKillSwitch, } from "./cli.js";

package/dist/holder/killswitch.d.ts

@@ -0,0 +1,139 @@
+import { HolderError } from './errors.js';
+import type { SellerHolder } from './holder.js';
+import { type RecordedState } from './chain.js';
+import type { SelfRevocation } from './types.js';
+export type Fetch = typeof fetch;
+/** The relay's submission path (relay contract v0). */
+export declare const RELAY_SUBMIT_PATH = "/v1/self-revocations";
+/** Environment variables the middleware host is configured with. */
+export declare const RELAY_URL_ENV = "MINTID_RELAY_URL";
+export declare const CHAIN_RPC_ENV = "MINTID_CHAIN_RPC";
+export declare const CHAIN_ID_ENV = "MINTID_CHAIN_ID";
+/** A random delay before the revocation is built and sent: up to a minute by default. */
+export declare const DEFAULT_JITTER_MS = 60000;
+/** The confirmation read: about one block, in a few short reads. */
+export declare const CONFIRM_ATTEMPTS = 4;
+export declare const CONFIRM_INTERVAL_MS = 750;
+/**
+ * The published effect bound, restated from the substrate's operational
+ * rules: a status root every 30 s, a root accepted for at most 180 s (a
+ * presentation against an older root is refused, so a recorded revocation
+ * is effective everywhere within that bound once the issuer folds it at
+ * its next root); a revoked principal's agents follow over the next roots,
+ * about four minutes.
+ */
+export declare const EFFECT_BOUND: {
+    readonly statusRootSeconds: 30;
+    readonly rootAcceptedSeconds: 180;
+    readonly agentCascadeSeconds: 240;
+};
+/** What the relay answered, in the contract's own words. */
+export type RelayOutcome = 'recorded' | 'queued' | 'inclusion_timeout' | 'nullifier_recorded' | 'duplicate_submission';
+export type RelayAnswer = {
+    outcome: RelayOutcome;
+    txHash?: string;
+    height?: number;
+};
+/** A relay refusal: the contract's bare reason code and stage, nothing of the message. */
+export declare class RelayRefusedError extends HolderError {
+    readonly status: number;
+    readonly code: string;
+    readonly stage: string;
+    /** Worth a retry, here or at another relay (`busy`, `chain_unavailable`, caps). */
+    readonly retryable: boolean;
+    readonly retryAfterMs: number | undefined;
+    constructor(status: number, code: string, stage: string, retryAfterMs?: number);
+}
+export type SubmitOptions = {
+    /** The relay's own transport — never the holder's issuer transport. */
+    fetch?: Fetch;
+    timeoutMs?: number;
+};
+/**
+ * Hands the self-revocation to the privacy relay: `{message}` with the five
+ * message fields only, no header beyond the content type. The relay checks
+ * the proof with the chain's rules, pays for the transaction and submits
+ * it; this side signs nothing and holds no account. `RelayRefusedError` on
+ * a refusal; every accepted answer (recorded, queued, already recorded,
+ * already in flight, broadcast but not yet seen) still needs the chain read.
+ */
+export declare function submitSelfRevocation(relayUrl: string, revocation: SelfRevocation, options?: SubmitOptions): Promise<RelayAnswer>;
+export type ConfirmOptions = {
+    /** The chain read's transport — a path of its own if the caller's address matters. */
+    fetch?: Fetch;
+    attempts?: number;
+    intervalMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+};
+export type Confirmation = {
+    state: RecordedState;
+} | {
+    state: 'unconfirmed';
+    reason: 'no_chain_endpoint' | 'chain_unreachable' | 'not_recorded';
+};
+/**
+ * Asks a node of the chain whether the revocation is there — for about one
+ * block — reading the issuer's recorded set and finding the holder's own
+ * value locally, so the node never learns which one. `pending` once
+ * recorded, `folded` once the issuer's next root has folded it; otherwise
+ * `unconfirmed` with the reason (no node named, node unreachable, not
+ * recorded yet).
+ */
+export declare function confirmSelfRevocation(rpcUrl: string | undefined, revocation: SelfRevocation, options?: ConfirmOptions): Promise<Confirmation>;
+/** What the kill switch reports to the seller — value-free. */
+export type KillSwitchReport = {
+    /**
+     * `revoked`: the chain holds the record and the issuer has folded it —
+     * the credential presents nowhere. `pending`: the chain holds the record;
+     * it lands at the issuer's next root, within the bound. `unconfirmed`:
+     * the relay accepted the submission but no node showed the record within
+     * the read window (or none was named) — check again, or resubmit through
+     * a relay; both are safe.
+     */
+    state: 'revoked' | 'pending' | 'unconfirmed';
+    relay: RelayOutcome;
+    chain: RecordedState | 'not_recorded' | 'unread';
+    reason?: 'no_chain_endpoint' | 'chain_unreachable' | 'not_recorded';
+    txHash?: string;
+    height?: number;
+    /** The holder refuses to present from now on, whatever the chain shows. */
+    holderRefusesToPresent: true;
+    effect: typeof EFFECT_BOUND;
+};
+export type KillSwitchOptions = {
+    relayUrl?: string;
+    chainRpc?: string;
+    chainId?: string;
+    /** Upper bound of the random delay before the revocation is built and sent; 0 disables it. */
+    jitterMs?: number;
+    /** The relay's transport; the chain read's transport. Neither is the issuer's. */
+    relayFetch?: Fetch;
+    chainFetch?: Fetch;
+    confirmAttempts?: number;
+    confirmIntervalMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    /** Uniform in [0, 1); injected by tests. */
+    random?: () => number;
+};
+/**
+ * The product kill switch, end to end, where the key is:
+ *
+ * 1. a random delay, so the moment the seller decided is not the moment
+ *    the chain records (the relay shuffles what it holds; this adds the
+ *    seller's own slack);
+ * 2. a fresh witness from the issuer, so the self-revocation is built
+ *    against the root the chain currently holds (the material comes with
+ *    the witness answer; no other call);
+ * 3. the self-revocation, built by the holder library — from that moment
+ *    the holder refuses to present, also after a reload from custody;
+ * 4. the submission through the privacy relay; a refusal for a root the
+ *    chain no longer holds rebuilds against the current one, once;
+ * 5. the confirmation read on the chain, issuer-scoped.
+ *
+ * Configuration: `relayUrl` (or `MINTID_RELAY_URL`), `chainRpc` (or
+ * `MINTID_CHAIN_RPC`; without it the report is `unconfirmed`,
+ * `no_chain_endpoint`), `chainId` (or `MINTID_CHAIN_ID`, else the issuer's
+ * public build information). The client never bypasses the relay to the
+ * chain: it holds no account and signs nothing.
+ */
+export declare function revokeCredential(holder: SellerHolder, options?: KillSwitchOptions): Promise<KillSwitchReport>;