agent-passport-system 7.0.0 → 7.2.0

package/dist/src/v2/authority-revocation/issue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/issue.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAY7E,OAAO,KAAK,EAA6B,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElF,mFAAmF;AACnF,MAAM,WAAW,6BAA6B;IAC5C;;;;;yDAKqD;IACrD,GAAG,EAAE,MAAM,CAAA;IACX,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAA;IACf;;uFAEmF;IACnF,mBAAmB,EAAE,MAAM,CAAA;IAC3B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,qBAAqB,EACjC,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAmEvB"}

package/dist/src/v2/authority-revocation/issue.js

@@ -0,0 +1,111 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { authorityDelegationBody, computeAuthorityDelegationId, } from '../authority-delegation/canonical.js';
+import { snapshotPlainData } from '../authority-delegation/plain-data.js';
+import { isCanonicalTimestamp, validateAuthorityDelegationShape, } from '../authority-delegation/schema.js';
+import { computeAuthorityRevocationCascadeTransactionIdForWrite, computeAuthorityRevocationIdForWrite, signAuthorityRevocation, } from './canonical.js';
+import { validateAuthorityRevocationShape } from './schema.js';
+import { AUTHORITY_REVOCATION_RECORD_TYPE, AUTHORITY_REVOCATION_VERSION, } from './types.js';
+/**
+ * Mint a draft-03 section 3.5.1 direct revocation for one AuthorityDelegationV1.
+ *
+ * Section 3.5 line 634 states the only authorization rule this function applies: "Any
+ * delegation MAY be revoked by its issuer." The exact comparison is
+ * `input.revoker === delegation.issuer`, where `delegation` is the target record passed
+ * in by the caller and `issuer` is its own member. The record being minted is never
+ * consulted for its own authorization: a field a would-be revoker writes inside its own
+ * record cannot make that revoker the issuer of somebody else's delegation.
+ *
+ * The target's `delegation_id` is recomputed from its body before that comparison. A
+ * `delegation_id` sits outside the delegation's own identifier preimage, so a record
+ * whose claimed identifier does not match its body has an unauthenticated `issuer` too,
+ * and refusing there is what keeps the revoker check meaningful.
+ *
+ * What this function does NOT establish: that the holder of `privateKey` is in fact
+ * `input.revoker`, or that `input.verification_method` is one of that party's keys. An
+ * identifier-to-key binding is a resolver's answer, not a local one, and no string shape
+ * imposed on `verification_method` here could stand in for it. verifyAuthorityRevocation()
+ * makes that check, resolving the method under the TARGET delegation's `issuer` at
+ * `revoked_at`. Issuance can only refuse to mint a record that is already unverifiable; it
+ * cannot promise the record will verify.
+ *
+ * Nothing about a cascade over descendants is emitted here. This function produces one
+ * record about one delegation. Enforcement against descendants comes from chain
+ * verification, which rejects any chain containing a revoked ancestor.
+ *
+ * Throws on refusal; each message names its code in parentheses.
+ */
+export function issueAuthorityRevocation(delegation, input, privateKey) {
+    // Each member is read exactly once, so a getter or Proxy trap cannot answer one way
+    // when a value is checked and another way when it is hashed and signed.
+    const read = (key) => {
+        try {
+            return input ? input[key] : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const now = read('now');
+    const revoker = read('revoker');
+    const verificationMethod = read('verification_method');
+    const reasonCode = read('reason_code');
+    const hasDetail = (() => {
+        try {
+            return !!input && Object.prototype.hasOwnProperty.call(input, 'detail');
+        }
+        catch {
+            return false;
+        }
+    })();
+    const detail = hasDetail ? read('detail') : undefined;
+    const nonce = read('nonce');
+    if (!isCanonicalTimestamp(now)) {
+        throw new Error('authority revocation now must be a canonical UTC-millisecond timestamp (NONCANONICAL_VALUE)');
+    }
+    const target = snapshotPlainData(delegation);
+    const targetFailures = validateAuthorityDelegationShape(target);
+    if (targetFailures.length > 0) {
+        throw new Error(`authority revocation target delegation invalid (${targetFailures[0].code})`);
+    }
+    if (computeAuthorityDelegationId(authorityDelegationBody(target)) !== target.delegation_id) {
+        throw new Error('authority revocation target content address does not match its body (TARGET_ID_MISMATCH)');
+    }
+    // Draft section 3.5: a delegation may be revoked by its issuer. The compared fields are
+    // the caller's claimed revoker and the TARGET delegation's own `issuer` member.
+    if (typeof revoker !== 'string' || revoker !== target.issuer) {
+        throw new Error('authority revocation revoker is not the target delegation issuer (REVOKER_NOT_ISSUER)');
+    }
+    const origin = {
+        record_type: AUTHORITY_REVOCATION_RECORD_TYPE,
+        version: AUTHORITY_REVOCATION_VERSION,
+        delegation_id: target.delegation_id,
+        revoker,
+        verification_method: verificationMethod,
+        revoked_at: now,
+        reason_code: reasonCode,
+        ...(hasDetail ? { detail: detail } : {}),
+        nonce: nonce,
+    };
+    const body = {
+        ...origin,
+        cascade_transaction_id: computeAuthorityRevocationCascadeTransactionIdForWrite(origin),
+    };
+    // Shape is judged on the finished record, so the probe carries placeholder values in
+    // exactly the two members that are not derivable yet. Both are replaced below.
+    const probe = {
+        ...body,
+        revocation_id: `sha256:${'0'.repeat(64)}`,
+        signature: '0'.repeat(128),
+    };
+    const failures = validateAuthorityRevocationShape(probe);
+    if (failures.length > 0) {
+        throw new Error(`authority revocation invalid: ${failures[0].message} (${failures[0].code})`);
+    }
+    const unsigned = {
+        ...body,
+        revocation_id: computeAuthorityRevocationIdForWrite(body),
+    };
+    return { ...unsigned, signature: signAuthorityRevocation(unsigned, privateKey) };
+}
+//# sourceMappingURL=issue.js.map

package/dist/src/v2/authority-revocation/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/issue.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EACL,oBAAoB,EACpB,gCAAgC,GACjC,MAAM,mCAAmC,CAAA;AAE1C,OAAO,EACL,sDAAsD,EACtD,oCAAoC,EACpC,uBAAuB,GACxB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EACL,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,YAAY,CAAA;AAyBnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAiC,EACjC,KAAoC,EACpC,UAAkB;IAElB,oFAAoF;IACpF,wEAAwE;IACxE,MAAM,IAAI,GAAG,CAAC,GAAwC,EAAW,EAAE;QACjE,IAAI,CAAC;YAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;IAC1E,CAAC,CAAA;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,MAAM,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;QACtB,IAAI,CAAC;YAAC,OAAO,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IACxG,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAE3B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAA;IAChH,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAA0B,CAAA;IACrE,MAAM,cAAc,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAA;IAC/D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mDAAmD,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,4BAA4B,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAA;IAC7G,CAAC;IAED,wFAAwF;IACxF,gFAAgF;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAA;IAC1G,CAAC;IACD,MAAM,MAAM,GAAuC;QACjD,WAAW,EAAE,gCAAgC;QAC7C,OAAO,EAAE,4BAA4B;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,OAAO;QACP,mBAAmB,EAAE,kBAA4B;QACjD,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,UAAoB;QACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,EAAE,KAAe;KACvB,CAAA;IACD,MAAM,IAAI,GAA8B;QACtC,GAAG,MAAM;QACT,sBAAsB,EAAE,sDAAsD,CAAC,MAAM,CAAC;KACvF,CAAA;IAED,qFAAqF;IACrF,+EAA+E;IAC/E,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI;QACP,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACzC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;KACF,CAAA;IAC1B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,MAAM,QAAQ,GAA6C;QACzD,GAAG,IAAI;QACP,aAAa,EAAE,oCAAoC,CAAC,IAAI,CAAC;KAC1D,CAAA;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAA;AAClF,CAAC"}

package/dist/src/v2/authority-revocation/record.d.ts

@@ -0,0 +1,69 @@
+import type { AuthorityDelegationV1 } from '../authority-delegation/types.js';
+import type { AuthorityRevocationVerificationOptions } from './verify.js';
+import type { AuthorityRevocationStore, AuthorityRevocationV1, AuthorityRevocationVerificationResult } from './types.js';
+/**
+ * What recordAuthorityRevocation() answers. Discriminated on `recorded`, so a caller
+ * cannot read `stored` without having decided which case it is in.
+ *
+ *  - `recorded: true` — the candidate verified against its target. `stored` is what the
+ *    store holds for that delegation now, and `inserted` says whether this call is the
+ *    one that wrote it. `inserted: false` with `recorded: true` is the ordinary
+ *    first-wins case: a valid revocation arrived second and the earlier record stands.
+ *  - `recorded: false` — the candidate did not verify. `stored` is `undefined`, always,
+ *    including when the store already holds a valid record for the same delegation. A
+ *    rejected request is never handed somebody else's record as though it were its own
+ *    result; `verification` carries the failures that rejected it.
+ *
+ * `verification` is the candidate's own result in both cases, never a result borrowed
+ * from a record already held.
+ */
+export type AuthorityRevocationRecordResult = {
+    recorded: true;
+    inserted: boolean;
+    stored: AuthorityRevocationV1;
+    verification: AuthorityRevocationVerificationResult;
+} | {
+    recorded: false;
+    inserted: false;
+    stored: undefined;
+    verification: AuthorityRevocationVerificationResult;
+};
+/**
+ * Verify one candidate revocation against the delegation it names and, only then, offer
+ * it to `store` for the delegation's first-wins slot. The one supported way a revocation
+ * enters a store.
+ *
+ * The defect this closes: a store's write primitive takes a record and a record alone,
+ * and a store can verify nothing, because verification needs the target delegation and a
+ * key resolver and a store holds neither. A write path reachable with an arbitrary object
+ * therefore lets any object take the first-wins slot for a delegation, and because that
+ * slot is irreversible (INV-5), the delegation can never afterwards record the valid
+ * revocation that would have revoked it. The resolver's own re-verification keeps such a
+ * record from ever reading as 'revoked', so the damage is not a false revocation; it is a
+ * permanently blocked real one. Verification belongs before the write, which is here.
+ *
+ * Order of operations:
+ *
+ *  1. snapshot the candidate as plain JSON data, once
+ *  2. verify that snapshot against `delegation` under `options`
+ *  3. on anything but `valid`, return `recorded: false` with that verification result and
+ *     no record, having touched the store not at all
+ *  4. on `valid`, hand the SNAPSHOT to store.insertVerifiedRevocation() and report what
+ *     the store says it now holds
+ *
+ * Step 1 and step 4 use the same snapshot, so the bytes the store keeps are exactly the
+ * bytes that were verified. Passing the caller's original value instead would let a
+ * getter or a Proxy trap answer one way for the verifier and another for the store.
+ *
+ * `options` is the same key resolution the resolver takes; the key is resolved under the
+ * TARGET delegation's issuer, at the revocation's own `revoked_at`. See
+ * verifyAuthorityRevocation().
+ *
+ * Does not throw on a bad candidate: an unusable candidate, an unusable target and an
+ * unusable resolver are all verification results, and verifyAuthorityRevocation() does
+ * not throw. An exception raised by `store` itself is not caught. A store that cannot
+ * complete a write has not produced a verification outcome, and reporting its failure as
+ * one would be a lie about the record rather than about the store.
+ */
+export declare function recordAuthorityRevocation(store: AuthorityRevocationStore, delegation: AuthorityDelegationV1, candidate: unknown, options: AuthorityRevocationVerificationOptions): AuthorityRevocationRecordResult;
+//# sourceMappingURL=record.d.ts.map

package/dist/src/v2/authority-revocation/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/record.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,aAAa,CAAA;AACzE,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACrB,qCAAqC,EACtC,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,+BAA+B,GACvC;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,qBAAqB,CAAA;IAC7B,YAAY,EAAE,qCAAqC,CAAA;CACpD,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;IACf,QAAQ,EAAE,KAAK,CAAA;IACf,MAAM,EAAE,SAAS,CAAA;IACjB,YAAY,EAAE,qCAAqC,CAAA;CACpD,CAAA;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,qBAAqB,EACjC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,sCAAsC,GAC9C,+BAA+B,CAQjC"}

package/dist/src/v2/authority-revocation/record.js

@@ -0,0 +1,51 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { snapshotPlainData } from '../authority-delegation/plain-data.js';
+import { verifyAuthorityRevocation } from './verify.js';
+/**
+ * Verify one candidate revocation against the delegation it names and, only then, offer
+ * it to `store` for the delegation's first-wins slot. The one supported way a revocation
+ * enters a store.
+ *
+ * The defect this closes: a store's write primitive takes a record and a record alone,
+ * and a store can verify nothing, because verification needs the target delegation and a
+ * key resolver and a store holds neither. A write path reachable with an arbitrary object
+ * therefore lets any object take the first-wins slot for a delegation, and because that
+ * slot is irreversible (INV-5), the delegation can never afterwards record the valid
+ * revocation that would have revoked it. The resolver's own re-verification keeps such a
+ * record from ever reading as 'revoked', so the damage is not a false revocation; it is a
+ * permanently blocked real one. Verification belongs before the write, which is here.
+ *
+ * Order of operations:
+ *
+ *  1. snapshot the candidate as plain JSON data, once
+ *  2. verify that snapshot against `delegation` under `options`
+ *  3. on anything but `valid`, return `recorded: false` with that verification result and
+ *     no record, having touched the store not at all
+ *  4. on `valid`, hand the SNAPSHOT to store.insertVerifiedRevocation() and report what
+ *     the store says it now holds
+ *
+ * Step 1 and step 4 use the same snapshot, so the bytes the store keeps are exactly the
+ * bytes that were verified. Passing the caller's original value instead would let a
+ * getter or a Proxy trap answer one way for the verifier and another for the store.
+ *
+ * `options` is the same key resolution the resolver takes; the key is resolved under the
+ * TARGET delegation's issuer, at the revocation's own `revoked_at`. See
+ * verifyAuthorityRevocation().
+ *
+ * Does not throw on a bad candidate: an unusable candidate, an unusable target and an
+ * unusable resolver are all verification results, and verifyAuthorityRevocation() does
+ * not throw. An exception raised by `store` itself is not caught. A store that cannot
+ * complete a write has not produced a verification outcome, and reporting its failure as
+ * one would be a lie about the record rather than about the store.
+ */
+export function recordAuthorityRevocation(store, delegation, candidate, options) {
+    const snapshot = snapshotPlainData(candidate);
+    const verification = verifyAuthorityRevocation(snapshot, delegation, options);
+    if (!verification.valid) {
+        return { recorded: false, inserted: false, stored: undefined, verification };
+    }
+    const { inserted, stored } = store.insertVerifiedRevocation(snapshot);
+    return { recorded: true, inserted, stored, verification };
+}
+//# sourceMappingURL=record.js.map

package/dist/src/v2/authority-revocation/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/record.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAEzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAsCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAA+B,EAC/B,UAAiC,EACjC,SAAkB,EAClB,OAA+C;IAE/C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,yBAAyB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC7E,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAA;IAC9E,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,wBAAwB,CAAC,QAAiC,CAAC,CAAA;IAC9F,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;AAC3D,CAAC"}

package/dist/src/v2/authority-revocation/resolver.d.ts

@@ -0,0 +1,30 @@
+import type { AuthorityDelegationV1, RevocationResolution } from '../authority-delegation/types.js';
+import type { AuthorityRevocationVerificationOptions } from './verify.js';
+import type { AuthorityRevocationStore } from './types.js';
+/**
+ * Adapt an AuthorityRevocationStore to the resolver verifyAuthorityDelegationChain and
+ * issueSubAuthorityDelegation already take.
+ *
+ * The three answers, and what each one costs to earn:
+ *
+ *  - 'revoked' only when the store holds a record for this delegation AND that record
+ *    verifies against this delegation under verifyAuthorityRevocation(). A stored record
+ *    that does not verify yields 'unknown', not 'revoked' and not 'active': the store has
+ *    an opinion this resolver cannot confirm, which is exactly indeterminate.
+ *  - 'active' only when the store says it tracks this delegation and holds no revocation
+ *    for it. Absence from a store is never 'active' on its own. A store that has never
+ *    heard of a delegation has not said the delegation is unrevoked.
+ *  - 'unknown' for everything else, including a store that throws and a delegation whose
+ *    `delegation_id` does not recompute from its own body.
+ *
+ * The chain verifier treats 'unknown' as indeterminate (REVOCATION_UNKNOWN) and
+ * issueSubAuthorityDelegation refuses to mint under anything but 'active', so the
+ * fail-closed direction is already theirs; this resolver only has to avoid manufacturing
+ * an 'active' it cannot support.
+ *
+ * Never throws. A resolver that threw would be caught by both callers and read as
+ * 'unknown' anyway, so it returns 'unknown' in the open rather than through a catch in
+ * somebody else's code.
+ */
+export declare function createAuthorityRevocationResolver(store: AuthorityRevocationStore, options: AuthorityRevocationVerificationOptions): (delegation: AuthorityDelegationV1) => RevocationResolution;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/src/v2/authority-revocation/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,aAAa,CAAA;AACzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,wBAAwB,EAC/B,OAAO,EAAE,sCAAsC,GAC9C,CAAC,UAAU,EAAE,qBAAqB,KAAK,oBAAoB,CAoB7D"}

package/dist/src/v2/authority-revocation/resolver.js

@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { authorityDelegationBody, computeAuthorityDelegationId, } from '../authority-delegation/canonical.js';
+import { verifyAuthorityRevocation } from './verify.js';
+/**
+ * Adapt an AuthorityRevocationStore to the resolver verifyAuthorityDelegationChain and
+ * issueSubAuthorityDelegation already take.
+ *
+ * The three answers, and what each one costs to earn:
+ *
+ *  - 'revoked' only when the store holds a record for this delegation AND that record
+ *    verifies against this delegation under verifyAuthorityRevocation(). A stored record
+ *    that does not verify yields 'unknown', not 'revoked' and not 'active': the store has
+ *    an opinion this resolver cannot confirm, which is exactly indeterminate.
+ *  - 'active' only when the store says it tracks this delegation and holds no revocation
+ *    for it. Absence from a store is never 'active' on its own. A store that has never
+ *    heard of a delegation has not said the delegation is unrevoked.
+ *  - 'unknown' for everything else, including a store that throws and a delegation whose
+ *    `delegation_id` does not recompute from its own body.
+ *
+ * The chain verifier treats 'unknown' as indeterminate (REVOCATION_UNKNOWN) and
+ * issueSubAuthorityDelegation refuses to mint under anything but 'active', so the
+ * fail-closed direction is already theirs; this resolver only has to avoid manufacturing
+ * an 'active' it cannot support.
+ *
+ * Never throws. A resolver that threw would be caught by both callers and read as
+ * 'unknown' anyway, so it returns 'unknown' in the open rather than through a catch in
+ * somebody else's code.
+ */
+export function createAuthorityRevocationResolver(store, options) {
+    return (delegation) => {
+        try {
+            // A claimed delegation_id sits outside the delegation's own identifier preimage.
+            // Looking a revocation up by an unauthenticated label would let a caller ask about
+            // one delegation while presenting another.
+            const delegationId = computeAuthorityDelegationId(authorityDelegationBody(delegation));
+            if (delegationId !== delegation.delegation_id)
+                return 'unknown';
+            const record = store.get(delegationId);
+            if (record !== undefined) {
+                return verifyAuthorityRevocation(record, delegation, options).state === 'valid'
+                    ? 'revoked'
+                    : 'unknown';
+            }
+            return store.tracks(delegationId) ? 'active' : 'unknown';
+        }
+        catch {
+            return 'unknown';
+        }
+    };
+}
+//# sourceMappingURL=resolver.js.map

package/dist/src/v2/authority-revocation/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/resolver.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,sCAAsC,CAAA;AAK7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAIvD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,KAA+B,EAC/B,OAA+C;IAE/C,OAAO,CAAC,UAAiC,EAAwB,EAAE;QACjE,IAAI,CAAC;YACH,iFAAiF;YACjF,mFAAmF;YACnF,2CAA2C;YAC3C,MAAM,YAAY,GAAG,4BAA4B,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAA;YACtF,IAAI,YAAY,KAAK,UAAU,CAAC,aAAa;gBAAE,OAAO,SAAS,CAAA;YAE/D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,OAAO;oBAC7E,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS,CAAA;YACf,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/src/v2/authority-revocation/schema.d.ts

@@ -0,0 +1,15 @@
+import type { AuthorityRevocationFailure, AuthorityRevocationV1 } from './types.js';
+/**
+ * Closed-schema and canonical-value validation for an in-memory decoded revocation.
+ *
+ * Snapshots `value` to plain JSON data first (see authority-delegation/plain-data.ts) and
+ * judges only that snapshot, so a getter or Proxy trap in the caller's argument is read
+ * at most once and cannot answer this function's checks differently from the value a
+ * caller goes on to hash.
+ *
+ * Returns every failure it finds rather than the first, matching
+ * validateAuthorityDelegationShape(). The caller decides which one it reports.
+ */
+export declare function validateAuthorityRevocationShape(value: unknown): AuthorityRevocationFailure[];
+export declare function isAuthorityRevocationV1(value: unknown): value is AuthorityRevocationV1;
+//# sourceMappingURL=schema.d.ts.map

package/dist/src/v2/authority-revocation/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/schema.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,0BAA0B,EAE1B,qBAAqB,EACtB,MAAM,YAAY,CAAA;AAqCnB;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,EAAE,CA2D7F;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAEtF"}

package/dist/src/v2/authority-revocation/schema.js

@@ -0,0 +1,107 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { snapshotPlainData } from '../authority-delegation/plain-data.js';
+import { isCanonicalTimestamp } from '../authority-delegation/schema.js';
+import { AUTHORITY_REVOCATION_RECORD_TYPE, AUTHORITY_REVOCATION_VERSION, } from './types.js';
+const CONTENT_ADDRESS = /^sha256:[0-9a-f]{64}$/;
+const HEX_32 = /^[0-9a-f]{32}$/;
+const HEX_128 = /^[0-9a-f]{128}$/;
+/** Every member a valid record may carry. A member outside this list is SCHEMA_INVALID:
+ *  the schema is closed, so an unknown field cannot ride inside a signed preimage
+ *  unnoticed. `detail` is the only OPTIONAL one. */
+const REQUIRED_KEYS = [
+    'record_type',
+    'version',
+    'revocation_id',
+    'delegation_id',
+    'revoker',
+    'verification_method',
+    'revoked_at',
+    'reason_code',
+    'cascade_transaction_id',
+    'nonce',
+    'signature',
+];
+const OPTIONAL_KEYS = ['detail'];
+function failure(code, message) {
+    return { code, message };
+}
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : null;
+}
+/**
+ * Closed-schema and canonical-value validation for an in-memory decoded revocation.
+ *
+ * Snapshots `value` to plain JSON data first (see authority-delegation/plain-data.ts) and
+ * judges only that snapshot, so a getter or Proxy trap in the caller's argument is read
+ * at most once and cannot answer this function's checks differently from the value a
+ * caller goes on to hash.
+ *
+ * Returns every failure it finds rather than the first, matching
+ * validateAuthorityDelegationShape(). The caller decides which one it reports.
+ */
+export function validateAuthorityRevocationShape(value) {
+    const failures = [];
+    const top = record(snapshotPlainData(value));
+    if (!top)
+        return [failure('SCHEMA_INVALID', 'revocation must be a JSON object')];
+    if (top.record_type !== AUTHORITY_REVOCATION_RECORD_TYPE) {
+        return [failure('UNSUPPORTED_RECORD_TYPE', `record_type must be ${AUTHORITY_REVOCATION_RECORD_TYPE}`)];
+    }
+    if (top.version !== AUTHORITY_REVOCATION_VERSION) {
+        return [failure('UNSUPPORTED_VERSION', `version must be ${AUTHORITY_REVOCATION_VERSION}`)];
+    }
+    for (const key of REQUIRED_KEYS) {
+        if (!Object.prototype.hasOwnProperty.call(top, key)) {
+            failures.push(failure('SCHEMA_INVALID', `${key} is required`));
+        }
+    }
+    const allowed = new Set([...REQUIRED_KEYS, ...OPTIONAL_KEYS]);
+    for (const key of Object.keys(top)) {
+        if (!allowed.has(key))
+            failures.push(failure('SCHEMA_INVALID', `unknown member ${key}`));
+    }
+    if (typeof top.revocation_id !== 'string' || !CONTENT_ADDRESS.test(top.revocation_id)) {
+        failures.push(failure('SCHEMA_INVALID', 'revocation_id must be sha256:<64 lowercase hex>'));
+    }
+    if (typeof top.delegation_id !== 'string' || !CONTENT_ADDRESS.test(top.delegation_id)) {
+        failures.push(failure('SCHEMA_INVALID', 'delegation_id must be sha256:<64 lowercase hex>'));
+    }
+    if (typeof top.cascade_transaction_id !== 'string' || !CONTENT_ADDRESS.test(top.cascade_transaction_id)) {
+        failures.push(failure('SCHEMA_INVALID', 'cascade_transaction_id must be sha256:<64 lowercase hex>'));
+    }
+    if (typeof top.revoker !== 'string' || top.revoker.length === 0) {
+        failures.push(failure('SCHEMA_INVALID', 'revoker must be a non-empty string'));
+    }
+    // Nothing here judges whether the method belongs to the revoker. That is decided only by
+    // key resolution against the target delegation's `issuer` at `revoked_at`, which
+    // verifyAuthorityRevocation() performs; a local string shape cannot establish it, and a
+    // method identifier need not be a fragment of the identifier that controls it.
+    if (typeof top.verification_method !== 'string' || top.verification_method.length === 0) {
+        failures.push(failure('SCHEMA_INVALID', 'verification_method must be a non-empty string'));
+    }
+    if (!isCanonicalTimestamp(top.revoked_at)) {
+        failures.push(failure('NONCANONICAL_VALUE', 'revoked_at must be a canonical UTC-millisecond timestamp'));
+    }
+    // The draft names a machine-readable reason code and fixes no grammar for one, so no
+    // grammar is invented here.
+    if (typeof top.reason_code !== 'string' || top.reason_code.length === 0) {
+        failures.push(failure('SCHEMA_INVALID', 'reason_code must be a non-empty string'));
+    }
+    if (Object.prototype.hasOwnProperty.call(top, 'detail') && typeof top.detail !== 'string') {
+        failures.push(failure('SCHEMA_INVALID', 'detail, when present, must be a string'));
+    }
+    if (typeof top.nonce !== 'string' || !HEX_32.test(top.nonce)) {
+        failures.push(failure('NONCANONICAL_VALUE', 'nonce must be 32 lowercase hex characters'));
+    }
+    if (typeof top.signature !== 'string' || !HEX_128.test(top.signature)) {
+        failures.push(failure('SCHEMA_INVALID', 'signature must be 128 lowercase hex characters'));
+    }
+    return failures;
+}
+export function isAuthorityRevocationV1(value) {
+    return validateAuthorityRevocationShape(value).length === 0;
+}
+//# sourceMappingURL=schema.js.map

package/dist/src/v2/authority-revocation/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/schema.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AACxE,OAAO,EACL,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,YAAY,CAAA;AAOnB,MAAM,eAAe,GAAG,uBAAuB,CAAA;AAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAA;AAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAA;AAEjC;;oDAEoD;AACpD,MAAM,aAAa,GAAG;IACpB,aAAa;IACb,SAAS;IACT,eAAe;IACf,eAAe;IACf,SAAS;IACT,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,wBAAwB;IACxB,OAAO;IACP,WAAW;CACH,CAAA;AACV,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAU,CAAA;AAEzC,SAAS,OAAO,CACd,IAAoC,EACpC,OAAe;IAEf,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAA;AACV,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,MAAM,QAAQ,GAAiC,EAAE,CAAA;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC,CAAA;IAEhF,IAAI,GAAG,CAAC,WAAW,KAAK,gCAAgC,EAAE,CAAC;QACzD,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,uBAAuB,gCAAgC,EAAE,CAAC,CAAC,CAAA;IACxG,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,4BAA4B,EAAE,CAAC;QACjD,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,mBAAmB,4BAA4B,EAAE,CAAC,CAAC,CAAA;IAC5F,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,aAAa,EAAE,GAAG,aAAa,CAAC,CAAC,CAAA;IACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,EAAE,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC,CAAA;IAC7F,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC,CAAA;IAC7F,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACxG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC,CAAA;IACtG,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,CAAC,CAAA;IAChF,CAAC;IACD,yFAAyF;IACzF,iFAAiF;IACjF,wFAAwF;IACxF,+EAA+E;IAC/E,IAAI,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ,IAAI,GAAG,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,0DAA0D,CAAC,CAAC,CAAA;IAC1G,CAAC;IACD,qFAAqF;IACrF,4BAA4B;IAC5B,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC,CAAA;IAC3F,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AAC7D,CAAC"}

package/dist/src/v2/authority-revocation/store.d.ts

@@ -0,0 +1,55 @@
+import type { AuthorityRevocationInsertion, AuthorityRevocationStore, AuthorityRevocationV1 } from './types.js';
+/**
+ * Reference AuthorityRevocationStore holding every record in this process's heap.
+ *
+ * For tests, fixtures and local reference use. It is not a persistence layer and does not
+ * become one: the records live in two Maps and are gone when the process exits, when the
+ * object is garbage collected, or when a second process asks the same question. Draft
+ * section 3.5.1 makes cascade completion depend on a descendant's revocation being
+ * PERSISTENT, and nothing here can establish that, which is why this module emits no
+ * completion record.
+ *
+ * Behavior this class fixes, none of it settled by draft text:
+ *
+ *  - First verified revocation for a delegation wins. INV-5 makes revocation
+ *    irreversible, and a store that let a second record displace the first would make the
+ *    recorded revocation time, reason and revoker mutable after the fact.
+ *  - insertVerifiedRevocation() for a delegation that already has a record reports
+ *    `inserted: false` and returns the record already held, and the caller's record is
+ *    discarded. A repeated request is therefore idempotent in what the store reports, not
+ *    in the bytes the caller minted: two calls with different nonces mint two different
+ *    valid records, and the store keeps the first.
+ *  - insertVerifiedRevocation() brings its target into the tracked view. Recording a
+ *    revocation for a delegation is a statement that this store has an opinion about that
+ *    delegation.
+ *
+ * insertVerifiedRevocation() is a persistence primitive and not an entry point. It does
+ * not verify, and a store cannot: verification needs the target delegation and a key
+ * resolver, neither of which is here. recordAuthorityRevocation() in record.ts is the
+ * one supported way in; it verifies against the target and calls this method only on a
+ * `valid` result. Nothing about that split relaxes the resolver, which still verifies on
+ * the way out, so a record that reached this store by some other route still cannot
+ * produce a 'revoked' answer.
+ */
+export declare class InMemoryAuthorityRevocationStore implements AuthorityRevocationStore {
+    private readonly tracked;
+    private readonly records;
+    /** Bring `delegationId` into this store's view with no revocation recorded for it.
+     *
+     *  Not part of AuthorityRevocationStore: how a store learns which delegations it covers
+     *  is an implementation's own business, and a database-backed store would answer
+     *  tracks() from its own rows rather than from a method like this one. */
+    track(delegationId: string): void;
+    tracks(delegationId: string): boolean;
+    get(delegationId: string): AuthorityRevocationV1 | undefined;
+    /** See AuthorityRevocationStore.insertVerifiedRevocation for the contract, including
+     *  that `revocation` must already have been verified against its target delegation by
+     *  recordAuthorityRevocation().
+     *
+     *  The read of the existing record and the write are one synchronous statement sequence
+     *  with no await and no callback between them, so on this single-threaded runtime no
+     *  other caller can interleave and no second caller can observe `inserted: true` for a
+     *  delegation whose slot is already taken. */
+    insertVerifiedRevocation(revocation: AuthorityRevocationV1): AuthorityRevocationInsertion;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/src/v2/authority-revocation/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,4BAA4B,EAC5B,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,gCAAiC,YAAW,wBAAwB;IAC/E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IAEnE;;;;8EAI0E;IAC1E,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAEhC;IAED,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAEpC;IAED,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAE3D;IAED;;;;;;;kDAO8C;IAC9C,wBAAwB,CAAC,UAAU,EAAE,qBAAqB,GAAG,4BAA4B,CAMxF;CACF"}

package/dist/src/v2/authority-revocation/store.js

@@ -0,0 +1,69 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Reference AuthorityRevocationStore holding every record in this process's heap.
+ *
+ * For tests, fixtures and local reference use. It is not a persistence layer and does not
+ * become one: the records live in two Maps and are gone when the process exits, when the
+ * object is garbage collected, or when a second process asks the same question. Draft
+ * section 3.5.1 makes cascade completion depend on a descendant's revocation being
+ * PERSISTENT, and nothing here can establish that, which is why this module emits no
+ * completion record.
+ *
+ * Behavior this class fixes, none of it settled by draft text:
+ *
+ *  - First verified revocation for a delegation wins. INV-5 makes revocation
+ *    irreversible, and a store that let a second record displace the first would make the
+ *    recorded revocation time, reason and revoker mutable after the fact.
+ *  - insertVerifiedRevocation() for a delegation that already has a record reports
+ *    `inserted: false` and returns the record already held, and the caller's record is
+ *    discarded. A repeated request is therefore idempotent in what the store reports, not
+ *    in the bytes the caller minted: two calls with different nonces mint two different
+ *    valid records, and the store keeps the first.
+ *  - insertVerifiedRevocation() brings its target into the tracked view. Recording a
+ *    revocation for a delegation is a statement that this store has an opinion about that
+ *    delegation.
+ *
+ * insertVerifiedRevocation() is a persistence primitive and not an entry point. It does
+ * not verify, and a store cannot: verification needs the target delegation and a key
+ * resolver, neither of which is here. recordAuthorityRevocation() in record.ts is the
+ * one supported way in; it verifies against the target and calls this method only on a
+ * `valid` result. Nothing about that split relaxes the resolver, which still verifies on
+ * the way out, so a record that reached this store by some other route still cannot
+ * produce a 'revoked' answer.
+ */
+export class InMemoryAuthorityRevocationStore {
+    tracked = new Set();
+    records = new Map();
+    /** Bring `delegationId` into this store's view with no revocation recorded for it.
+     *
+     *  Not part of AuthorityRevocationStore: how a store learns which delegations it covers
+     *  is an implementation's own business, and a database-backed store would answer
+     *  tracks() from its own rows rather than from a method like this one. */
+    track(delegationId) {
+        this.tracked.add(delegationId);
+    }
+    tracks(delegationId) {
+        return this.tracked.has(delegationId);
+    }
+    get(delegationId) {
+        return this.records.get(delegationId);
+    }
+    /** See AuthorityRevocationStore.insertVerifiedRevocation for the contract, including
+     *  that `revocation` must already have been verified against its target delegation by
+     *  recordAuthorityRevocation().
+     *
+     *  The read of the existing record and the write are one synchronous statement sequence
+     *  with no await and no callback between them, so on this single-threaded runtime no
+     *  other caller can interleave and no second caller can observe `inserted: true` for a
+     *  delegation whose slot is already taken. */
+    insertVerifiedRevocation(revocation) {
+        const existing = this.records.get(revocation.delegation_id);
+        if (existing)
+            return { inserted: false, stored: existing };
+        this.records.set(revocation.delegation_id, revocation);
+        this.tracked.add(revocation.delegation_id);
+        return { inserted: true, stored: revocation };
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/src/v2/authority-revocation/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/store.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAQtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,gCAAgC;IAC1B,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IAC3B,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAA;IAEnE;;;;8EAI0E;IAC1E,KAAK,CAAC,YAAoB;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,CAAC,YAAoB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACvC,CAAC;IAED,GAAG,CAAC,YAAoB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;kDAO8C;IAC9C,wBAAwB,CAAC,UAAiC;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;QAC3D,IAAI,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;QACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;QAC1C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/C,CAAC;CACF"}