agent-passport-system 7.0.0 → 7.2.0

package/dist/src/v2/authority-state/marker.js

@@ -0,0 +1,122 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. The marker constructor and the comparison, and nothing else.
+// See ./types.ts for the specification position. Concept source:
+// aeoess/agent-authority-lifecycle, invariant candidate CAND-08. Proposed.
+import { MONOTONICITY_OUTCOMES, STATE_MARKER_SCOPES, UNPLACEABLE_DISPOSITIONS, } from './types.js';
+/** Thrown when a caller asks for a marker the vocabulary does not allow. A shape rule
+ *  broken at construction is a programming error, not a verdict. Mirrors
+ *  `LifecycleStateError` in src/v2/lifecycle-state/. */
+export class AuthorityStateError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AuthorityStateError';
+        this.code = code;
+    }
+}
+/** Canonical unsigned decimal integer. Same pattern the authority vector's spend
+ *  quantities use: no sign, no leading zero, no separators. */
+const DECIMAL = /^(0|[1-9][0-9]*)$/;
+export function isStateMarkerScope(value) {
+    return typeof value === 'string' && STATE_MARKER_SCOPES.includes(value);
+}
+export function isMonotonicityOutcome(value) {
+    return typeof value === 'string' && MONOTONICITY_OUTCOMES.includes(value);
+}
+export function isUnplaceableDisposition(value) {
+    return typeof value === 'string' && UNPLACEABLE_DISPOSITIONS.includes(value);
+}
+/**
+ * Build a `StateMarker`, enforcing its shape rules.
+ *
+ * 1. `value` is a canonical unsigned decimal integer, as a string. A number would lose
+ *    exactness past 2^53 - 1 and would admit `1.0`, `1e3` and `-1`, none of which orders
+ *    the way a generation counter has to.
+ * 2. `scope` is one of the four. There is no fifth and there is no default: which thing a
+ *    generation is counted within is the choice the proposed text does not make, so it has
+ *    to be stated rather than assumed.
+ * 3. `scope_ref` is present and non-empty exactly when `scope` is not `global`. A
+ *    per-delegation marker that does not say which delegation cannot be compared against
+ *    anything.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle, `Authority epoch`.
+ */
+export function stateMarker(input) {
+    if (input === null || typeof input !== 'object') {
+        throw new AuthorityStateError('MARKER_MALFORMED', 'a state marker input must be an object');
+    }
+    if (typeof input.value !== 'string' || !DECIMAL.test(input.value)) {
+        throw new AuthorityStateError('MARKER_VALUE_NONCANONICAL', 'value must be a canonical unsigned decimal integer string');
+    }
+    if (!isStateMarkerScope(input.scope)) {
+        throw new AuthorityStateError('MARKER_SCOPE_UNKNOWN', `scope must be one of ${STATE_MARKER_SCOPES.join(', ')}`);
+    }
+    if (input.scope === 'global') {
+        if (input.scope_ref !== undefined) {
+            throw new AuthorityStateError('MARKER_SCOPE_REF_NOT_ALLOWED', 'a global marker names no scope_ref');
+        }
+        return Object.freeze({ value: input.value, scope: input.scope });
+    }
+    if (typeof input.scope_ref !== 'string' || input.scope_ref.length === 0) {
+        throw new AuthorityStateError('MARKER_SCOPE_REF_REQUIRED', `a ${input.scope} marker must name the scope_ref it is counted within`);
+    }
+    return Object.freeze({ value: input.value, scope: input.scope, scope_ref: input.scope_ref });
+}
+/** Whether two markers are counted in the same thing and can therefore be ordered. */
+export function sameScope(a, b) {
+    return a.scope === b.scope && (a.scope_ref ?? null) === (b.scope_ref ?? null);
+}
+/**
+ * Place a presented marker against what a verifier has established.
+ *
+ * | established | presented          | outcome       |
+ * |-------------|--------------------|---------------|
+ * | `null`      | any                | `unplaceable` |
+ * | any         | `null`             | `unplaceable` |
+ * | any         | a different scope  | `unplaceable` |
+ * | m           | >= m               | `forward`     |
+ * | m           | < m                | `regressed`   |
+ *
+ * Equal is `forward`, not a third thing: a view that has not moved has not gone backwards.
+ *
+ * `unplaceable` is where the honesty of the whole module sits. It is returned for a first
+ * read and for a cross-scope comparison, it is NOT a verdict, and nothing downstream turns
+ * it into one on its own. The proposed text gives a verifier with no prior observation
+ * nothing to compare against and does not say whether such a read is trusted or refused.
+ *
+ * Comparison is integer, through BigInt, never lexical: "10" is after "9".
+ *
+ * Never throws for a malformed marker. A marker this function cannot read is one it cannot
+ * place, which is `unplaceable`, and throwing on the read path of a state comparison would
+ * turn a data problem into a crash in a verifier.
+ */
+export function compareStateMarker(established, presented) {
+    if (!established || !presented)
+        return 'unplaceable';
+    if (typeof established.value !== 'string' || !DECIMAL.test(established.value))
+        return 'unplaceable';
+    if (typeof presented.value !== 'string' || !DECIMAL.test(presented.value))
+        return 'unplaceable';
+    if (!sameScope(established, presented))
+        return 'unplaceable';
+    return BigInt(presented.value) >= BigInt(established.value) ? 'forward' : 'regressed';
+}
+/**
+ * The high-water mark a verifier holds after reading a presented view.
+ *
+ * It only ever moves forward. A regressed view does not lower it, an unplaceable view does
+ * not replace it, and a verifier that had none adopts the presented one. This is the
+ * "monotonicity against what the verifier has established" limb of CAND-08, which is
+ * weaker than a rule against global truth and is the honest strength available: a verifier
+ * that has never seen the newer state cannot detect a regression and is not at fault.
+ */
+export function advanceHighWaterMark(established, presented) {
+    if (!presented)
+        return established ?? null;
+    if (!established)
+        return presented;
+    return compareStateMarker(established, presented) === 'forward' ? presented : established;
+}
+//# sourceMappingURL=marker.js.map

package/dist/src/v2/authority-state/marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marker.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/marker.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,iFAAiF;AACjF,iEAAiE;AACjE,2EAA2E;AAE3E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,GAKzB,MAAM,YAAY,CAAA;AAEnB;;wDAEwD;AACxD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAAQ;IAErB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED;+DAC+D;AAC/D,MAAM,OAAO,GAAG,mBAAmB,CAAA;AAEnC,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAChG,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,wBAA8C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACrG,CAAC;AAQD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAA;IAC7F,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,EAC3B,2DAA2D,CAC5D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,EACtB,wBAAwB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzD,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,EAC9B,oCAAoC,CACrC,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,EAC3B,KAAK,KAAK,CAAC,KAAK,sDAAsD,CACvE,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;AAC9F,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,CAAc,EAAE,CAAc;IACtD,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAA2C,EAC3C,SAAyC;IAEzC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS;QAAE,OAAO,aAAa,CAAA;IACpD,IAAI,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAA;IACnG,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAA;IAC/F,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC;QAAE,OAAO,aAAa,CAAA;IAC5D,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;AACvF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAA2C,EAC3C,SAAyC;IAEzC,IAAI,CAAC,SAAS;QAAE,OAAO,WAAW,IAAI,IAAI,CAAA;IAC1C,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAA;IAClC,OAAO,kBAAkB,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;AAC3F,CAAC"}

package/dist/src/v2/authority-state/report.d.ts

@@ -0,0 +1,55 @@
+import type { AuthorityValidationResult } from '../authority-delegation/types.js';
+import type { LifecycleMappingOptions } from '../lifecycle-state/map.js';
+import type { CompositeAuthorityResult, LifecycleStateResult } from '../lifecycle-state/types.js';
+import type { CorrectedRevocationView, MonotonicityOutcome, StateMarker } from './types.js';
+/** A chain result, the lifecycle vocabulary's reading of it, how the state view placed, and
+ *  the correction records that reference any revocation behind it.
+ *
+ *  Four fields, four separate claims, none merged into another. `chain` is byte for byte
+ *  what `verifyAuthorityDelegationChain` returned and a caller that reads only that field
+ *  sees exactly today's behaviour. */
+export interface AuthorityStateReport<TChain> extends CompositeAuthorityResult<TChain> {
+    /** How the presented state view placed against the verifier's established mark, or
+     *  `undefined` when no state comparison ran. */
+    readonly monotonicity?: MonotonicityOutcome;
+    /** The mark the verifier holds after this read. */
+    readonly highWaterMarkAfter?: StateMarker | null;
+    /** Revocations behind this result together with the withdrawals referencing them. Empty
+     *  or absent when none was submitted. A non-empty `accepted` list NEVER implies the chain
+     *  result would have been different. */
+    readonly corrections?: readonly CorrectedRevocationView[];
+}
+export interface AuthorityStateReportInput<TChain> {
+    readonly chain: TChain;
+    readonly lifecycle?: LifecycleStateResult;
+    readonly monotonicity?: MonotonicityOutcome;
+    readonly highWaterMarkAfter?: StateMarker | null;
+    readonly corrections?: readonly CorrectedRevocationView[];
+}
+/**
+ * Assemble the report.
+ *
+ * A pure structural constructor. It computes no verdict, consults no record and cannot
+ * change one: every field is what its own module already concluded. That is the shape of
+ * the doctrine it encodes. A later finding is a new record that references an earlier one
+ * and states its own effect, so the correction sits BESIDE the chain result rather than
+ * inside it, and a reader can present both and their relation.
+ */
+export declare function authorityStateReport<TChain>(input: AuthorityStateReportInput<TChain>): AuthorityStateReport<TChain>;
+/**
+ * The common case, in one call: take a chain result, express it in the lifecycle vocabulary
+ * and attach the state findings.
+ *
+ * Convenience over `mapAuthorityValidationToLifecycle` plus `authorityStateReport`, with no
+ * behaviour of its own. Read-only: the chain result is not mutated and is carried through
+ * unchanged.
+ *
+ * The property worth stating: for a chain whose root is revoked, the lifecycle verdict is
+ * `invalid` with reason `REVOKED` whether or not `corrections` carries an accepted
+ * withdrawal. An accepted correction does not move the verdict one step toward valid. It is
+ * reported, and reporting it is the whole of its effect here.
+ */
+export declare function reportAuthorityState(chain: AuthorityValidationResult, input?: Omit<AuthorityStateReportInput<AuthorityValidationResult>, 'chain' | 'lifecycle'> & {
+    readonly lifecycleOptions?: LifecycleMappingOptions;
+}): AuthorityStateReport<AuthorityValidationResult>;
+//# sourceMappingURL=report.d.ts.map

package/dist/src/v2/authority-state/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/report.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAEjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE3F;;;;;sCAKsC;AACtC,MAAM,WAAW,oBAAoB,CAAC,MAAM,CAAE,SAAQ,wBAAwB,CAAC,MAAM,CAAC;IACpF;oDACgD;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAC3C,mDAAmD;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAChD;;4CAEwC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAA;CAC1D;AAED,MAAM,WAAW,yBAAyB,CAAC,MAAM;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAA;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAChD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAA;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EACzC,KAAK,EAAE,yBAAyB,CAAC,MAAM,CAAC,GACvC,oBAAoB,CAAC,MAAM,CAAC,CAa9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,yBAAyB,EAChC,KAAK,GAAE,IAAI,CAAC,yBAAyB,CAAC,yBAAyB,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC,GAAG;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;CAC/C,GACL,oBAAoB,CAAC,yBAAyB,CAAC,CAQjD"}

package/dist/src/v2/authority-state/report.js

@@ -0,0 +1,51 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Reporting a chain result, a lifecycle verdict, the monotonicity finding
+// and any correction records TOGETHER, without any of them rewriting another.
+// See ./types.ts for the specification position. Proposed.
+import { mapAuthorityValidationToLifecycle } from '../lifecycle-state/map.js';
+/**
+ * Assemble the report.
+ *
+ * A pure structural constructor. It computes no verdict, consults no record and cannot
+ * change one: every field is what its own module already concluded. That is the shape of
+ * the doctrine it encodes. A later finding is a new record that references an earlier one
+ * and states its own effect, so the correction sits BESIDE the chain result rather than
+ * inside it, and a reader can present both and their relation.
+ */
+export function authorityStateReport(input) {
+    const report = { chain: input.chain };
+    if (input.lifecycle !== undefined)
+        report.lifecycle = input.lifecycle;
+    if (input.monotonicity !== undefined)
+        report.monotonicity = input.monotonicity;
+    if (input.highWaterMarkAfter !== undefined)
+        report.highWaterMarkAfter = input.highWaterMarkAfter;
+    if (input.corrections !== undefined)
+        report.corrections = Object.freeze([...input.corrections]);
+    return Object.freeze(report);
+}
+/**
+ * The common case, in one call: take a chain result, express it in the lifecycle vocabulary
+ * and attach the state findings.
+ *
+ * Convenience over `mapAuthorityValidationToLifecycle` plus `authorityStateReport`, with no
+ * behaviour of its own. Read-only: the chain result is not mutated and is carried through
+ * unchanged.
+ *
+ * The property worth stating: for a chain whose root is revoked, the lifecycle verdict is
+ * `invalid` with reason `REVOKED` whether or not `corrections` carries an accepted
+ * withdrawal. An accepted correction does not move the verdict one step toward valid. It is
+ * reported, and reporting it is the whole of its effect here.
+ */
+export function reportAuthorityState(chain, input = {}) {
+    return authorityStateReport({
+        chain,
+        lifecycle: mapAuthorityValidationToLifecycle(chain, input.lifecycleOptions ?? {}),
+        monotonicity: input.monotonicity,
+        highWaterMarkAfter: input.highWaterMarkAfter,
+        corrections: input.corrections,
+    });
+}
+//# sourceMappingURL=report.js.map

package/dist/src/v2/authority-state/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/report.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,4FAA4F;AAC5F,8EAA8E;AAC9E,2DAA2D;AAG3D,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAA;AA+B7E;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAwC;IAExC,MAAM,MAAM,GAMR,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;IAC1B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACrE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;IAC9E,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAA;IAChG,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAC/F,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgC,EAChC,KAAK,GAED,EAAE;IAEN,OAAO,oBAAoB,CAAC;QAC1B,KAAK;QACL,SAAS,EAAE,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACjF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAA;AACJ,CAAC"}

package/dist/src/v2/authority-state/retained.d.ts

@@ -0,0 +1,82 @@
+import type { AuthorityDelegationV1, RevocationResolution } from '../authority-delegation/types.js';
+import type { AuthorityRevocationVerificationOptions } from '../authority-revocation/verify.js';
+import type { MonotonicityOutcome, RetainedAuthorityState, StateMarker, UnplaceableDisposition } from './types.js';
+/**
+ * What the records a verifier RETAINED say about one delegation.
+ *
+ * Two answers only.
+ *
+ *  - `revoked`, when one retained record verifies against this delegation under
+ *    `verifyAuthorityRevocation`. The record is re-verified here rather than trusted: a
+ *    record that reached the retained set by some other route cannot assert a revocation,
+ *    which is the same discipline `createAuthorityRevocationResolver` applies to a stored
+ *    record.
+ *  - `unknown`, for everything else.
+ *
+ * NEVER `active`. A retained record set is not a store: it says nothing about the
+ * delegations it does not mention, so its silence is ignorance and not a finding. That is
+ * L7 ("a revocation answer that is unavailable or stale is indeterminate. It does not
+ * become active"), and it is why the two-verifier split in `RetainedAuthorityState` has
+ * any content at all. A verifier that kept the records answers `revoked`. A verifier that
+ * kept only the number answers `unknown`, which the chain verifier turns into
+ * `indeterminate` with `REVOCATION_UNKNOWN`. Those are different verifiers and reporting
+ * the same thing for both would be the error.
+ *
+ * Never throws. A retained set that cannot be read is one that establishes nothing.
+ */
+export declare function resolveUnderRetainedState(delegation: AuthorityDelegationV1, retained: RetainedAuthorityState, options: AuthorityRevocationVerificationOptions): RevocationResolution;
+export interface MonotonicRevocationResolverOptions {
+    /** The resolver for the state view actually presented, typically
+     *  `createAuthorityRevocationResolver(store, options)`. Consulted only when the presented
+     *  view is not behind what the verifier has established. */
+    readonly presented: (delegation: AuthorityDelegationV1) => RevocationResolution;
+    /** The marker the presented view carries, or `null` when it carries none. */
+    readonly presentedMarker: StateMarker | null;
+    /** What this verifier has established: the records it kept and the newest marker it saw. */
+    readonly retained: RetainedAuthorityState;
+    /** Key resolution for re-verifying retained records. */
+    readonly verification: AuthorityRevocationVerificationOptions;
+    /** REQUIRED, with no default. What to do when the presented view cannot be placed
+     *  against an established mark, which happens on a first read and on a cross-scope
+     *  comparison.
+     *
+     *  `read_presented` reads the view as current. `refuse` answers `unknown` for every
+     *  delegation, which the chain verifier turns into `indeterminate`. Both are defensible,
+     *  the outcomes differ, and neither the proposed text nor draft-03 chooses between them,
+     *  so this module does not choose either. The absence of a default is the point. */
+    readonly onUnplaceable: UnplaceableDisposition;
+}
+export interface MonotonicRevocationResolver {
+    /** The one-argument callable `verifyAuthorityDelegationChain` already takes. Pass it
+     *  straight through as `resolveRevocation`. */
+    readonly resolve: (delegation: AuthorityDelegationV1) => RevocationResolution;
+    /** How the presented view placed against the established mark. Reported so a caller can
+     *  say WHY it answered as it did, rather than only what it answered. */
+    readonly monotonicity: MonotonicityOutcome;
+    /** The mark the verifier holds after this read. Only ever moves forward. */
+    readonly highWaterMarkAfter: StateMarker | null;
+}
+/**
+ * Compose a presented state view, an established high-water mark and a retained record set
+ * into the resolver the chain verifier already takes.
+ *
+ * | monotonicity  | what `resolve` consults                                             |
+ * |---------------|---------------------------------------------------------------------|
+ * | `forward`     | the presented view, normally                                         |
+ * | `regressed`   | the retained records ONLY: `revoked` or `unknown`, never `active`     |
+ * | `unplaceable` | the presented view, or nothing, per `onUnplaceable`                   |
+ *
+ * The regressed row is CAND-08: a restore, a snapshot mount or a lagging replica presents
+ * state from before a revocation, and this refuses to read it as current rather than
+ * resolving the disagreement by recency of write. What it does NOT do is claim a revocation
+ * it cannot establish. A verifier that retained the record reports `revoked`; one that
+ * retained only the mark reports `unknown`, and `unknown` is not established, not false.
+ *
+ * Nothing here changes the chain verdict directly. The chain verifier decides that, from
+ * the answer this resolver gives it, exactly as it does today.
+ *
+ * Pure: no clock, no network, no randomness, no I/O. The marker and the record set are
+ * caller supplied, and `presented` is a caller-supplied callback.
+ */
+export declare function createMonotonicRevocationResolver(options: MonotonicRevocationResolverOptions): MonotonicRevocationResolver;
+//# sourceMappingURL=retained.d.ts.map

package/dist/src/v2/authority-state/retained.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retained.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/retained.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAEnG,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,mCAAmC,CAAA;AAE/F,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,sCAAsC,GAC9C,oBAAoB,CAUtB;AAED,MAAM,WAAW,kCAAkC;IACjD;;gEAE4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,qBAAqB,KAAK,oBAAoB,CAAA;IAC/E,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IAC5C,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;IACzC,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,sCAAsC,CAAA;IAC7D;;;;;;;wFAOoF;IACpF,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;CAC/C;AAED,MAAM,WAAW,2BAA2B;IAC1C;mDAC+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,qBAAqB,KAAK,oBAAoB,CAAA;IAC7E;4EACwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,kBAAkB,EAAE,WAAW,GAAG,IAAI,CAAA;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,2BAA2B,CAoB7B"}

package/dist/src/v2/authority-state/retained.js

@@ -0,0 +1,93 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Resolving revocation state under a retained high-water mark.
+// See ./types.ts for the specification position. Concept source:
+// aeoess/agent-authority-lifecycle, invariant candidate CAND-08 and invariants L7 and L11.
+// Proposed.
+//
+// WHAT THIS DOES NOT TOUCH. `AuthorityChainVerificationOptions` is unchanged. The existing
+// `createAuthorityRevocationResolver` is unchanged, and its one-argument shape is the shape
+// this module produces too: everything new closes over its own state and hands the chain
+// verifier back the same callable it already takes. That was the alternative to widening
+// the resolver signature, and widening it would have been a breaking change to an exported
+// API for the sake of a proposed feature.
+import { verifyAuthorityRevocation } from '../authority-revocation/verify.js';
+import { advanceHighWaterMark, compareStateMarker } from './marker.js';
+/**
+ * What the records a verifier RETAINED say about one delegation.
+ *
+ * Two answers only.
+ *
+ *  - `revoked`, when one retained record verifies against this delegation under
+ *    `verifyAuthorityRevocation`. The record is re-verified here rather than trusted: a
+ *    record that reached the retained set by some other route cannot assert a revocation,
+ *    which is the same discipline `createAuthorityRevocationResolver` applies to a stored
+ *    record.
+ *  - `unknown`, for everything else.
+ *
+ * NEVER `active`. A retained record set is not a store: it says nothing about the
+ * delegations it does not mention, so its silence is ignorance and not a finding. That is
+ * L7 ("a revocation answer that is unavailable or stale is indeterminate. It does not
+ * become active"), and it is why the two-verifier split in `RetainedAuthorityState` has
+ * any content at all. A verifier that kept the records answers `revoked`. A verifier that
+ * kept only the number answers `unknown`, which the chain verifier turns into
+ * `indeterminate` with `REVOCATION_UNKNOWN`. Those are different verifiers and reporting
+ * the same thing for both would be the error.
+ *
+ * Never throws. A retained set that cannot be read is one that establishes nothing.
+ */
+export function resolveUnderRetainedState(delegation, retained, options) {
+    try {
+        const records = retained?.records ?? [];
+        for (const record of records) {
+            if (verifyAuthorityRevocation(record, delegation, options).state === 'valid')
+                return 'revoked';
+        }
+        return 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * Compose a presented state view, an established high-water mark and a retained record set
+ * into the resolver the chain verifier already takes.
+ *
+ * | monotonicity  | what `resolve` consults                                             |
+ * |---------------|---------------------------------------------------------------------|
+ * | `forward`     | the presented view, normally                                         |
+ * | `regressed`   | the retained records ONLY: `revoked` or `unknown`, never `active`     |
+ * | `unplaceable` | the presented view, or nothing, per `onUnplaceable`                   |
+ *
+ * The regressed row is CAND-08: a restore, a snapshot mount or a lagging replica presents
+ * state from before a revocation, and this refuses to read it as current rather than
+ * resolving the disagreement by recency of write. What it does NOT do is claim a revocation
+ * it cannot establish. A verifier that retained the record reports `revoked`; one that
+ * retained only the mark reports `unknown`, and `unknown` is not established, not false.
+ *
+ * Nothing here changes the chain verdict directly. The chain verifier decides that, from
+ * the answer this resolver gives it, exactly as it does today.
+ *
+ * Pure: no clock, no network, no randomness, no I/O. The marker and the record set are
+ * caller supplied, and `presented` is a caller-supplied callback.
+ */
+export function createMonotonicRevocationResolver(options) {
+    const monotonicity = compareStateMarker(options.retained?.highWaterMark ?? null, options.presentedMarker);
+    const highWaterMarkAfter = advanceHighWaterMark(options.retained?.highWaterMark ?? null, options.presentedMarker);
+    const resolve = (delegation) => {
+        if (monotonicity === 'regressed') {
+            return resolveUnderRetainedState(delegation, options.retained, options.verification);
+        }
+        if (monotonicity === 'unplaceable' && options.onUnplaceable === 'refuse')
+            return 'unknown';
+        try {
+            return options.presented(delegation);
+        }
+        catch {
+            return 'unknown';
+        }
+    };
+    return Object.freeze({ resolve, monotonicity, highWaterMarkAfter });
+}
+//# sourceMappingURL=retained.js.map

package/dist/src/v2/authority-state/retained.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retained.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/retained.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,iFAAiF;AACjF,iEAAiE;AACjE,2FAA2F;AAC3F,YAAY;AACZ,EAAE;AACF,2FAA2F;AAC3F,4FAA4F;AAC5F,yFAAyF;AACzF,yFAAyF;AACzF,2FAA2F;AAC3F,0CAA0C;AAG1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAQtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAiC,EACjC,QAAgC,EAChC,OAA+C;IAE/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAA;QACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAA;QAChG,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAmCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAA2C;IAE3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IACzG,MAAM,kBAAkB,GAAG,oBAAoB,CAC7C,OAAO,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI,EACvC,OAAO,CAAC,eAAe,CACxB,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,UAAiC,EAAwB,EAAE;QAC1E,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QACtF,CAAC;QACD,IAAI,YAAY,KAAK,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC1F,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACrE,CAAC"}

package/dist/src/v2/authority-state/types.d.ts

@@ -0,0 +1,198 @@
+import type { AuthorityRevocationV1 } from '../authority-revocation/types.js';
+/** What a marker is counted within. Comparing two markers from different scopes orders
+ *  nothing, so the comparison reports `unplaceable` rather than inventing an order.
+ *
+ *  The proposed text names none of these. They exist because the fixture that forced this
+ *  module had to pick one (it picked a global integer on a state view) and recorded that
+ *  the choice was not read from the text. Carrying the scope makes that choice visible in
+ *  the record instead of implicit in the deployment. Proposed. */
+export declare const STATE_MARKER_SCOPES: readonly ['global', 'per_delegation', 'per_principal', 'per_store'];
+export type StateMarkerScope = (typeof STATE_MARKER_SCOPES)[number];
+/** A monotonic generation marker on authority state.
+ *
+ *  `value` is a canonical unsigned decimal integer, the same convention the seven-facet
+ *  authority vector already uses for spend quantities: no sign, no leading zero, no
+ *  separators, arbitrary width. It is a string rather than a number so a marker past
+ *  2^53 - 1 stays exact, and it is compared as an integer, never lexically.
+ *
+ *  Nothing here is signed and nothing here is a wire field. No delegation, revocation or
+ *  store in this SDK carries a marker, and none is being given one: a marker is state the
+ *  caller has about a state source, handed in at comparison time. Proposed. */
+export interface StateMarker {
+    readonly value: string;
+    readonly scope: StateMarkerScope;
+    /** Which delegation, principal or store this marker is counted within. Required on every
+     *  scope except `global`, where it is absent. */
+    readonly scope_ref?: string;
+}
+/** The result of placing a presented marker against what a verifier has established.
+ *
+ *  - `forward`      the presented marker advanced, or held equal. Read the view normally.
+ *  - `regressed`    the presented marker went backwards against an established high-water
+ *                   mark. CAND-08's refusal case.
+ *  - `unplaceable`  there is nothing to compare against, or the two markers are counted in
+ *                   different scopes. **Deliberately not a verdict.** A high-water mark has
+ *                   to start somewhere and neither the proposed text nor draft-03 says
+ *                   whether a first read is trusted or refused. Both are defensible and the
+ *                   outcomes differ, so this module reports the fact and the caller
+ *                   decides. See `UnplaceableDisposition`. */
+export declare const MONOTONICITY_OUTCOMES: readonly ['forward', 'regressed', 'unplaceable'];
+export type MonotonicityOutcome = (typeof MONOTONICITY_OUTCOMES)[number];
+/** What a caller wants done with an `unplaceable` presented view. Required, with no
+ *  default, because the SDK picking one would be the SDK deciding a question its own
+ *  concept source records as undecided. */
+export declare const UNPLACEABLE_DISPOSITIONS: readonly ['read_presented', 'refuse'];
+export type UnplaceableDisposition = (typeof UNPLACEABLE_DISPOSITIONS)[number];
+/** What a verifier has established about authority state, as TWO separate inputs.
+ *
+ *  Splitting them is the whole point of this type. Two verifiers can hold the same
+ *  high-water mark and give different answers about the same restored view: the one that
+ *  retained the revocation records it observed can establish a revocation from records and
+ *  answers `revoked`, and the one that retained only the number cannot, and answers
+ *  `unknown`, which draft-03 section 3.3 makes indeterminate. The proposed text does not
+ *  distinguish those two verifiers at all, and the distinction turns out to be the
+ *  substance of the rollback question. An API taking "the epoch" as one value cannot
+ *  express it.
+ *
+ *  `records` is not a store and does not behave like one. It can answer `revoked` and it
+ *  can answer `unknown`. It can never answer `active`: a retained record set says nothing
+ *  about the delegations it does not mention, which is the same reason absence from an
+ *  `AuthorityRevocationStore` is `unknown` rather than `active`. */
+export interface RetainedAuthorityState {
+    /** Revocation records the verifier retained at its high-water mark. Each is re-verified
+     *  against the delegation in front of it before it can produce a `revoked` answer, so a
+     *  record that reached this array by some other route still cannot assert one. */
+    readonly records: readonly AuthorityRevocationV1[];
+    /** The newest marker this verifier has established, or `null` if it has established
+     *  none. */
+    readonly highWaterMark: StateMarker | null;
+}
+/** Why a fenced write was refused.
+ *
+ *  - `stale_fencing_token`     the token went backwards against the highest already seen.
+ *                              The only one of the three the source states.
+ *  - `fencing_scope_mismatch`  the token is counted in a different scope from the log's, so
+ *                              it cannot be ordered against what the log holds.
+ *  - `fencing_token_unreadable` the token is absent or not a well-formed `StateMarker`.
+ *
+ *  A write path that cannot order a token is not fenced, so the second and third refuse
+ *  rather than guess. Neither is in any source; both are this module's choice. */
+export declare const FENCED_WRITE_REFUSAL_CODES: readonly ['stale_fencing_token', 'fencing_scope_mismatch', 'fencing_token_unreadable'];
+export type FencedWriteRefusalCode = (typeof FENCED_WRITE_REFUSAL_CODES)[number];
+/** An authority-state write carrying the token of whoever claims to be the current
+ *  publisher. */
+export interface FencedWrite<T> {
+    readonly token: StateMarker;
+    readonly payload: T;
+}
+/** What a fenced log reports about one write.
+ *
+ *  An EQUAL token is accepted, and that is not an oversight. The rule the source states is
+ *  about tokens going backwards, and an equal token has not gone backwards: it is the same
+ *  holder retrying, which makes a retry idempotent. */
+export type FencedWriteOutcome<T> = {
+    readonly accepted: true;
+    readonly published: StateMarker;
+    readonly payload: T;
+} | {
+    readonly accepted: false;
+    readonly code: FencedWriteRefusalCode;
+    readonly published: StateMarker | null;
+};
+/** The record type a withdrawal carries.
+ *
+ *  `proposed:` is load-bearing. Record fields, failure-class names and verifier semantics
+ *  are conformance vocabulary reserved to the maintainer, and neither draft-03 nor the
+ *  proposed text defines a record for withdrawing a recorded revocation or says what a
+ *  verifier should do with one. This is a placeholder to argue about, not APS vocabulary. */
+export declare const REVOCATION_WITHDRAWAL_RECORD_TYPE: 'proposed:aps:revocation-withdrawal:v0';
+export declare const REVOCATION_WITHDRAWAL_VERSION: '0';
+/** A record stating that a recorded revocation was published in error.
+ *
+ *  It REFERENCES the revocation and never removes it. Inside an `AuthorityRevocationStore`
+ *  irreversibility is already structural: the store exposes `track`, `tracks`, `get` and
+ *  `insertVerifiedRevocation`, there is no removal method, and this module does not add
+ *  one. Draft-03 section 3.5 states "Revocation is irreversible", and a removal method
+ *  would be one call away from breaking it.
+ *
+ *  NOT AUTHENTICATED BY THIS MODULE. There is no canonical preimage here, no signature
+ *  field, and no verification function, deliberately: minting the signed form of a record
+ *  type is the vocabulary decision this module is not entitled to make. A caller hands in a
+ *  withdrawal it has already authenticated, exactly as `insertVerifiedRevocation` takes a
+ *  revocation `recordAuthorityRevocation` has already verified. Whoever reaches
+ *  `evaluateRevocationWithdrawal` is the party asserting the record is genuine. */
+export interface RevocationWithdrawalV0 {
+    readonly record_type: typeof REVOCATION_WITHDRAWAL_RECORD_TYPE;
+    readonly version: typeof REVOCATION_WITHDRAWAL_VERSION;
+    /** The revocation this record withdraws: `sha256:<64 lowercase hex>`. */
+    readonly revocation_id: string;
+    /** The delegation that revocation named. Carried so a withdrawal that names a revocation
+     *  of a different delegation is refusable without a second lookup. */
+    readonly delegation_id: string;
+    /** Who states the withdrawal. Whether this party may is NOT decided here. */
+    readonly withdrawn_by: string;
+    /** Canonical UTC-millisecond time, supplied by the caller, never read from a clock. */
+    readonly withdrawn_at: string;
+    /** Machine-readable ground. No grammar is fixed for one and none is invented here. */
+    readonly reason_code: string;
+    /** OPTIONAL free-text detail. Absent means the key is not present at all. */
+    readonly detail?: string;
+}
+/** What an injected standing resolver may answer.
+ *
+ *  `unknown` is a first-class answer and is not `no_standing`. A verifier that cannot
+ *  establish whether the withdrawer had standing has not established that they lacked it,
+ *  and the refusal reason says which of the two happened. */
+export declare const WITHDRAWAL_STANDINGS: readonly ['has_standing', 'no_standing', 'unknown'];
+export type WithdrawalStanding = (typeof WITHDRAWAL_STANDINGS)[number];
+/** Decides whether a withdrawal's author may withdraw this revocation.
+ *
+ *  Injected, never hardcoded, and never read from the withdrawal record itself. Draft-03
+ *  section 3.5 states "Any delegation MAY be revoked by its issuer" and the SDK enforces
+ *  `revoker === issuer` for a revocation. Nothing anywhere states who may WITHDRAW one.
+ *  `withdrawalSignerIsRevoker` is supplied as one resolver, is what the forcing fixture
+ *  chose, and is a choice rather than a rule read from any text. */
+export type WithdrawalStandingResolver = (withdrawal: RevocationWithdrawalV0, revocation: AuthorityRevocationV1) => WithdrawalStanding;
+/** Why a withdrawal was accepted or refused. Stable, module-local codes. */
+export declare const WITHDRAWAL_OUTCOME_CODES: readonly [
+/** Accepted as a record. Accepted never means the revocation is gone. */
+'WITHDRAWAL_ACCEPTED', 
+/** The record is not a well-formed `RevocationWithdrawalV0`. */
+'WITHDRAWAL_SCHEMA_INVALID', 
+/** No revocation in the held set carries the `revocation_id` this record names. */
+'WITHDRAWAL_NAMES_NO_HELD_REVOCATION', 
+/** The named revocation exists but is a revocation of a different delegation. */
+'WITHDRAWAL_TARGET_MISMATCH', 
+/** The resolver established that this party may not withdraw this revocation. */
+'WITHDRAWAL_SIGNER_WITHOUT_STANDING', 
+/** The resolver could not establish standing either way. Not the same finding as the
+ *  one above, and reported as `not_established` rather than as a denial. */
+'WITHDRAWAL_STANDING_NOT_ESTABLISHED'];
+export type WithdrawalOutcomeCode = (typeof WITHDRAWAL_OUTCOME_CODES)[number];
+/** What `evaluateRevocationWithdrawal` concludes about one withdrawal record. */
+export interface WithdrawalEvaluation {
+    readonly accepted: boolean;
+    readonly reason_code: WithdrawalOutcomeCode;
+    /** What the resolver answered, or `null` when evaluation refused before asking it. */
+    readonly standing: WithdrawalStanding | null;
+    /** The record evaluated, unchanged. */
+    readonly withdrawal: RevocationWithdrawalV0;
+}
+/** The current position of one revocation together with every withdrawal referencing it.
+ *
+ *  This is CAND-02 made into a shape. The revocation is present, unchanged, whether or not
+ *  a withdrawal was accepted. A later finding is a new record that references the earlier
+ *  one and states its own effect; it is never an edit of the earlier one and never its
+ *  removal. A verifier that must report "revoked, and the revoker later said this was
+ *  recorded in error" reports exactly this. */
+export interface CorrectedRevocationView {
+    /** The revocation record, byte for byte what it was. */
+    readonly revocation: AuthorityRevocationV1;
+    /** Accepted withdrawals, in the order supplied. Non-empty does NOT make the revocation
+     *  ineffective and does NOT change any chain verdict. */
+    readonly accepted: readonly WithdrawalEvaluation[];
+    /** Refused withdrawals, each with the code saying why. A withdrawal that changes nothing
+     *  in silence is indistinguishable from one that was never submitted. */
+    readonly refused: readonly WithdrawalEvaluation[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/v2/authority-state/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/types.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;;;kEAMkE;AAClE,eAAO,MAAM,mBAAmB,YAAI,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,CAAU,CAAA;AAEtG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnE;;;;;;;;;+EAS+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC;qDACiD;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;8DAU8D;AAC9D,eAAO,MAAM,qBAAqB,YAAI,SAAS,EAAE,WAAW,EAAE,aAAa,CAAU,CAAA;AAErF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAExE;;2CAE2C;AAC3C,eAAO,MAAM,wBAAwB,YAAI,gBAAgB,EAAE,QAAQ,CAAU,CAAA;AAE7E,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9E;;;;;;;;;;;;;;oEAcoE;AACpE,MAAM,WAAW,sBAAsB;IACrC;;sFAEkF;IAClF,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;IAClD;gBACY;IACZ,QAAQ,CAAC,aAAa,EAAE,WAAW,GAAG,IAAI,CAAA;CAC3C;AAED;;;;;;;;;kFASkF;AAClF,eAAO,MAAM,0BAA0B,YACrC,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,CAClB,CAAA;AAEV,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhF;iBACiB;AACjB,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;CACpB;AAED;;;;uDAIuD;AACvD,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAC5B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAA;AAE/G;;;;;6FAK6F;AAC7F,eAAO,MAAM,iCAAiC,EAAG,uCAAgD,CAAA;AACjG,eAAO,MAAM,6BAA6B,EAAG,GAAY,CAAA;AAEzD;;;;;;;;;;;;;mFAamF;AACnF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,iCAAiC,CAAA;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,6BAA6B,CAAA;IACtD,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;0EACsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;6DAI6D;AAC7D,eAAO,MAAM,oBAAoB,YAAI,cAAc,EAAE,aAAa,EAAE,SAAS,CAAU,CAAA;AAEvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtE;;;;;;oEAMoE;AACpE,MAAM,MAAM,0BAA0B,GAAG,CACvC,UAAU,EAAE,sBAAsB,EAClC,UAAU,EAAE,qBAAqB,KAC9B,kBAAkB,CAAA;AAEvB,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB;AACnC,yEAAyE;AACzE,qBAAqB;AACrB,gEAAgE;AAChE,2BAA2B;AAC3B,mFAAmF;AACnF,qCAAqC;AACrC,iFAAiF;AACjF,4BAA4B;AAC5B,iFAAiF;AACjF,oCAAoC;AACpC;4EAC4E;AAC5E,qCAAqC,CAC7B,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;IAC3C,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC5C,uCAAuC;IACvC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAA;CAC5C;AAED;;;;;;+CAM+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;IAC1C;6DACyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAA;IAClD;6EACyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAClD"}