burnledger 0.4.0 → 0.6.0

package/dist/esm/http.d.ts

@@ -1,19 +1,32 @@
 /** HTTP transport layer wrapping native fetch.
  *
  * Handles: Bearer auth, response envelope unwrapping, retry on 5xx/transport
- * errors, Retry-After respect on 429, and raw byte streaming for PDFs.
+ * errors and on 429, and raw byte streaming for PDFs.
+ *
+ * Retry delay: a `Retry-After` header (delta-seconds or HTTP-date) is honoured
+ * when the server sends one and it is at most `MAX_RETRY_AFTER`; otherwise
+ * exponential backoff with jitter. A 429 with no usable `Retry-After`, one
+ * beyond the cap, or one on the last attempt throws `RateLimitError` with
+ * `retryAfter` populated so the caller can decide.
  */
+/** Longest Retry-After, in seconds, the transport will wait on before
+ * throwing instead: a server asking for minutes gets the error and the
+ * number rather than a promise nobody can cancel. */
+export declare const MAX_RETRY_AFTER = 30;
 export interface TransportOptions {
     baseUrl: string;
     apiKey: string;
     timeout: number;
     maxRetries: number;
+    /** Team to act as. Omit to let the API use the caller's default team. */
+    teamId?: string;
 }
 export declare class Transport {
     private readonly baseUrl;
     private readonly apiKey;
     private readonly timeout;
     private readonly maxRetries;
+    private readonly teamId?;
     constructor(opts: TransportOptions);
     /** Make a request and return the unwrapped `data` field. */
     request(method: string, path: string, opts?: {
@@ -32,4 +45,11 @@ export declare class Transport {
         authenticated?: boolean;
     }): Promise<Uint8Array>;
 }
+/** Seconds to wait per the Retry-After header (RFC 9110 §10.2.3).
+ *
+ * Accepts both forms the header allows: non-negative delta-seconds and an
+ * HTTP-date, converted to seconds from now (a date already past reads as 0).
+ * Anything else is treated as absent.
+ */
+export declare function parseRetryAfter(resp: Response): number | undefined;
 //# sourceMappingURL=http.d.ts.map

package/dist/esm/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,IAAI,EAAE,gBAAgB,EAKjC;IAED,4DAA4D;IACtD,OAAO,CACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;QACzC,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,GACA,OAAO,CAAC,OAAO,CAAC,CAGlB;IAED,6EAA6E;IACvE,UAAU,CACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;QACzC,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,GACA,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyFlC;IAED,+DAA+D;IACzD,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,UAAU,CAAC,CAwBrB;CACF"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;qDAEqD;AACrD,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAKpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IAEjC,YAAY,IAAI,EAAE,gBAAgB,EAMjC;IAED,4DAA4D;IACtD,OAAO,CACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;QACzC,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,GACA,OAAO,CAAC,OAAO,CAAC,CAGlB;IAED,6EAA6E;IACvE,UAAU,CACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;QACzC,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,GACA,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA0GlC;IAED,+DAA+D;IACzD,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,UAAU,CAAC,CA6BrB;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAYlE"}

package/dist/esm/http.js

@@ -1,19 +1,35 @@
 /** HTTP transport layer wrapping native fetch.
  *
  * Handles: Bearer auth, response envelope unwrapping, retry on 5xx/transport
- * errors, Retry-After respect on 429, and raw byte streaming for PDFs.
+ * errors and on 429, and raw byte streaming for PDFs.
+ *
+ * Retry delay: a `Retry-After` header (delta-seconds or HTTP-date) is honoured
+ * when the server sends one and it is at most `MAX_RETRY_AFTER`; otherwise
+ * exponential backoff with jitter. A 429 with no usable `Retry-After`, one
+ * beyond the cap, or one on the last attempt throws `RateLimitError` with
+ * `retryAfter` populated so the caller can decide.
  */
 import { raiseForError } from "./errors.js";
+/** Longest Retry-After, in seconds, the transport will wait on before
+ * throwing instead: a server asking for minutes gets the error and the
+ * number rather than a promise nobody can cancel. */
+export const MAX_RETRY_AFTER = 30;
 export class Transport {
     baseUrl;
     apiKey;
     timeout;
     maxRetries;
+    // Which team the caller is acting as. The API resolves scope from this
+    // header and otherwise falls back to the caller's default team, so a member
+    // of more than one team who does not send it silently acts as whichever they
+    // joined first.
+    teamId;
     constructor(opts) {
         this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
         this.apiKey = opts.apiKey;
         this.timeout = opts.timeout;
         this.maxRetries = opts.maxRetries;
+        this.teamId = opts.teamId;
     }
     /** Make a request and return the unwrapped `data` field. */
     async request(method, path, opts) {
@@ -28,6 +44,12 @@ export class Transport {
         };
         if (authenticated) {
             headers["Authorization"] = `Bearer ${this.apiKey}`;
+            // Alongside the key, never without it: the header names the scope the
+            // caller is acting in, which is meaningless for an unauthenticated
+            // request and is not a second credential.
+            if (this.teamId) {
+                headers["X-Team-ID"] = this.teamId;
+            }
         }
         let url = `${this.baseUrl}${path}`;
         if (opts?.params) {
@@ -48,13 +70,13 @@ export class Transport {
             headers["Idempotency-Key"] = randomIdempotencyKey();
         }
         let lastError;
+        // Delay before the next attempt when the server named one; undefined
+        // means fall back to backoff.
+        let retryAfter;
         for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
             if (attempt > 0) {
-                // Backoff with ±25% jitter so coordinated 5xx events don't produce
-                // a synchronized retry storm from every client at the same instant.
-                const base = 500 * 2 ** (attempt - 1);
-                const jitter = base * 0.25 * (Math.random() * 2 - 1);
-                await sleep(base + jitter);
+                await sleep(retryDelayMs(attempt, retryAfter));
+                retryAfter = undefined;
             }
             const controller = new AbortController();
             const timer = setTimeout(() => controller.abort(), this.timeout * 1000);
@@ -78,8 +100,17 @@ export class Transport {
             if (resp.status === 204) {
                 return {};
             }
+            retryAfter = parseRetryAfter(resp);
             if (resp.status === 429) {
-                const retryAfter = parseRetryAfter(resp);
+                // Only on the server's say-so: without Retry-After there is no delay
+                // known to be enough, and beyond the cap the caller gets the number
+                // (RateLimitError.retryAfter) rather than a hung promise.
+                if (retryAfter !== undefined &&
+                    retryAfter <= MAX_RETRY_AFTER &&
+                    attempt < this.maxRetries) {
+                    lastError = new Error(`Server error ${resp.status}`);
+                    continue;
+                }
                 const errorBody = await safeJson(resp);
                 raiseForError(resp.status, errorBody, retryAfter);
             }
@@ -101,6 +132,11 @@ export class Transport {
         const headers = {};
         if (authenticated) {
             headers["Authorization"] = `Bearer ${this.apiKey}`;
+            // A downloaded certificate is as team-scoped as the JSON one; omitting
+            // the header here would hand a member their default team's PDF.
+            if (this.teamId) {
+                headers["X-Team-ID"] = this.teamId;
+            }
         }
         const url = `${this.baseUrl}${path}`;
         const controller = new AbortController();
@@ -119,12 +155,39 @@ export class Transport {
         return new Uint8Array(await resp.arrayBuffer());
     }
 }
-function parseRetryAfter(resp) {
-    const raw = resp.headers.get("Retry-After");
-    if (raw == null)
+/** Seconds to wait per the Retry-After header (RFC 9110 §10.2.3).
+ *
+ * Accepts both forms the header allows: non-negative delta-seconds and an
+ * HTTP-date, converted to seconds from now (a date already past reads as 0).
+ * Anything else is treated as absent.
+ */
+export function parseRetryAfter(resp) {
+    const raw = resp.headers.get("Retry-After")?.trim();
+    if (!raw)
         return undefined;
-    const n = Number(raw);
-    return Number.isFinite(n) ? n : undefined;
+    if (/^\d+(\.\d+)?$/.test(raw)) {
+        return Number(raw);
+    }
+    // Every HTTP-date form (IMF-fixdate, RFC 850, asctime) opens with a weekday
+    // name; Date.parse alone would also read "-3" or "2099" as a year.
+    if (!/^[A-Za-z]{3}/.test(raw))
+        return undefined;
+    const when = Date.parse(raw);
+    if (Number.isNaN(when))
+        return undefined;
+    return Math.max(0, (when - Date.now()) / 1000);
+}
+/** Milliseconds to sleep before retry `attempt` (1-based). A server-supplied
+ * delay within the cap wins; otherwise exponential backoff with ±25% jitter so
+ * coordinated 5xx events don't produce a synchronized retry storm from every
+ * client at the same instant. */
+function retryDelayMs(attempt, retryAfter) {
+    if (retryAfter !== undefined && retryAfter <= MAX_RETRY_AFTER) {
+        return retryAfter * 1000;
+    }
+    const base = Math.min(500 * 2 ** (attempt - 1), MAX_RETRY_AFTER * 1000);
+    const jitter = base * 0.25 * (Math.random() * 2 - 1);
+    return base + jitter;
 }
 async function safeJson(resp) {
     // Read once. resp.json() consumes the stream on failure too — calling

package/dist/esm/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAS5C,MAAM,OAAO,SAAS;IACH,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,UAAU,CAAS;IAEpC,YAAY,IAAsB;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAIC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAQ,QAAoC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,UAAU,CACd,MAAc,EACd,IAAY,EACZ,IAIC;QAED,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC;QAClD,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QACrD,CAAC;QAED,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;YACD,GAAG,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,GACR,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YACpC,yEAAyE;YACzE,yEAAyE;YACzE,sBAAsB;YACtB,OAAO,CAAC,iBAAiB,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,mEAAmE;gBACnE,oEAAoE;gBACpE,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrD,MAAM,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;YAC7B,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CACpB,CAAC;YAEF,IAAI,IAAc,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBACtB,MAAM;oBACN,OAAO;oBACP,IAAI;oBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChE,SAAS;YACX,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpD,SAAS,GAAG,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,UAAU,GAAG,CAAC,cAAc,SAAS,EAAE,OAAO,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,IAAY,EACZ,IAAkC;QAElC,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC;QAClD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QAExE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAED,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IACpC,sEAAsE;IACtE,qEAAqE;IACrE,6BAA6B;IAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;SAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,SAAS,oBAAoB;IAC3B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,YAAY;IAC1C,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,aAAa;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;qDAEqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAWlC,MAAM,OAAO,SAAS;IACH,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,UAAU,CAAS;IACpC,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,gBAAgB;IACC,MAAM,CAAU;IAEjC,YAAY,IAAsB;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAIC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAQ,QAAoC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,UAAU,CACd,MAAc,EACd,IAAY,EACZ,IAIC;QAED,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC;QAClD,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,sEAAsE;YACtE,mEAAmE;YACnE,0CAA0C;YAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;YACD,GAAG,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,GACR,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YACpC,yEAAyE;YACzE,yEAAyE;YACzE,sBAAsB;YACtB,OAAO,CAAC,iBAAiB,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,SAA4B,CAAC;QACjC,qEAAqE;QACrE,8BAA8B;QAC9B,IAAI,UAA8B,CAAC;QAEnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;gBAC/C,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CACpB,CAAC;YAEF,IAAI,IAAc,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBACtB,MAAM;oBACN,OAAO;oBACP,IAAI;oBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChE,SAAS;YACX,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,oEAAoE;gBACpE,0DAA0D;gBAC1D,IACE,UAAU,KAAK,SAAS;oBACxB,UAAU,IAAI,eAAe;oBAC7B,OAAO,GAAG,IAAI,CAAC,UAAU,EACzB,CAAC;oBACD,SAAS,GAAG,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;oBACrD,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpD,SAAS,GAAG,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,UAAU,GAAG,CAAC,cAAc,SAAS,EAAE,OAAO,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,IAAY,EACZ,IAAkC;QAElC,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC;QAClD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,uEAAuE;YACvE,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QAExE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;iCAGiC;AACjC,SAAS,YAAY,CAAC,OAAe,EAAE,UAA8B;IACnE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,IAAI,eAAe,EAAE,CAAC;QAC9D,OAAO,UAAU,GAAG,IAAI,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,GAAG,MAAM,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IACpC,sEAAsE;IACtE,qEAAqE;IACrE,6BAA6B;IAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;SAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,SAAS,oBAAoB;IAC3B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,YAAY;IAC1C,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,aAAa;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC"}

package/dist/esm/index.browser.d.ts

@@ -16,7 +16,7 @@ export { Paginator } from "./pagination.js";
 export type { CryptoOps } from "./crypto.js";
 export type { PublicKeyInfo } from "./verify.js";
 export { issuanceBytes, hexToBytes, bytesToHex } from "./verify.js";
-import type { PublicKeyInfo } from "./verify.js";
+import type { PublicKeyInfo, PublicKeyOptions } from "./verify.js";
 import type { VerificationResult, TransparencyResult } from "./models.js";
 type Cert = Record<string, unknown>;
 /** Verify all signatures on a deletion certificate offline. */
@@ -24,9 +24,7 @@ export declare function verifyCertificate(certificate: Cert, publicKeys: Map<str
 /** Verify the transparency proof embedded in a certificate. */
 export declare function verifyTransparency(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<TransparencyResult>;
 /** Construct a PublicKeyInfo from a hex-encoded Ed25519 public key. */
-export declare function publicKeyFromHex(hexKey: string, opts?: {
-    revoked?: boolean;
-}): Promise<PublicKeyInfo>;
+export declare function publicKeyFromHex(hexKey: string, opts?: PublicKeyOptions): Promise<PublicKeyInfo>;
 /** Verify a Merkle consistency proof between two tree states (RFC 6962). */
 export declare function verifyConsistency(oldSize: number, newSize: number, oldRoot: Uint8Array, newRoot: Uint8Array, proof: Uint8Array[]): Promise<boolean>;
 //# sourceMappingURL=index.browser.d.ts.map

package/dist/esm/index.browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../../src/index.browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE1E,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB"}
+{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../../src/index.browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASpE,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE1E,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB"}

package/dist/esm/index.browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../src/index.browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA8BtC,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,iBAAiB,IAAI,kBAAkB,EACvC,kBAAkB,IAAI,mBAAmB,EACzC,iBAAiB,IAAI,kBAAkB,EACvC,gBAAgB,IAAI,iBAAiB,GACtC,MAAM,aAAa,CAAC;AAMrB,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAC/B,WAAiB,EACjB,UAAsC;IAEtC,OAAO,kBAAkB,CAAC,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACpE,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAChC,WAAiB,EACjB,UAAsC;IAEtC,OAAO,mBAAmB,CAAC,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACrE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAA4B;IAE5B,OAAO,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAe,EACf,OAAmB,EACnB,OAAmB,EACnB,KAAmB;IAEnB,OAAO,kBAAkB,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../src/index.browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA8BtC,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,iBAAiB,IAAI,kBAAkB,EACvC,kBAAkB,IAAI,mBAAmB,EACzC,iBAAiB,IAAI,kBAAkB,EACvC,gBAAgB,IAAI,iBAAiB,GACtC,MAAM,aAAa,CAAC;AAMrB,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAC/B,WAAiB,EACjB,UAAsC;IAEtC,OAAO,kBAAkB,CAAC,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACpE,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAChC,WAAiB,EACjB,UAAsC;IAEtC,OAAO,mBAAmB,CAAC,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACrE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAAuB;IAEvB,OAAO,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAe,EACf,OAAmB,EACnB,OAAmB,EACnB,KAAmB;IAEnB,OAAO,kBAAkB,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC"}

package/dist/esm/index.d.ts

@@ -1,16 +1,17 @@
 /** BurnLedger TypeScript SDK — public API (Node.js entry point). */
-export { BurnLedger } from "./client.js";
+export { BurnLedger, MAX_BATCH_REVOKE } from "./client.js";
 export type { BurnLedgerOptions } from "./client.js";
-export { BurnLedgerError, ApiError, AuthenticationError, NotFoundError, ConflictError, ValidationError, RateLimitError, ServerError, TimeoutError, VerificationError, } from "./errors.js";
+export { BurnLedgerError, ApiError, AuthenticationError, NotFoundError, ConflictError, ValidationError, RateLimitError, ServerError, TimeoutError, VerificationError, CERTIFICATE_REVOKED, UNSUPPORTED_FORMAT_VERSION, } from "./errors.js";
 export { Transport } from "./http.js";
 export type { TransportOptions } from "./http.js";
-export type { ProofMode, AttestationStatus, CertificateStatus, TransparencyStatus, HealthStatus, TransportSecurity, ReadOnlyEnforcement, ConnectorType, HashScope, LogEntryType, VerificationResult, TransparencyResult, ApiKeyRole, System, SystemAttestation, Attestation, VerificationSystem, VerifyResult, CertificateResponse, RevocationStatus, Webhook, SignedTreeHead, LogEntry, InclusionProof, ConsistencyProof, BatchAttestationResponse, BatchAttestationError, MonthlyCount, CertificateStats, WebhookRotateResponse, WebhookDelivery, ApiKeyListItem, ApiKeyResponse, PlanUsage, Profile, SystemHealth, } from "./models.js";
+export type { PublicKeyOptions } from "./verify.js";
+export type { ProofMode, AttestationStatus, CertificateStatus, TransparencyStatus, HealthStatus, TransportSecurity, ReadOnlyEnforcement, ConnectorType, HashScope, LogEntryType, VerificationResult, TransparencyResult, ApiKeyRole, System, SystemAttestation, Attestation, VerificationSystem, VerifyResult, CertificateResponse, RevocationStatus, Webhook, SignedTreeHead, LogEntry, InclusionProof, ConsistencyProof, BatchAttestationResponse, BatchAttestationError, BatchRevokeResponse, BatchRevokeError, MonthlyCount, CertificateStats, WebhookRotateResponse, WebhookDelivery, ApiKeyListItem, ApiKeyResponse, PlanUsage, Profile, SystemHealth, } from "./models.js";
 export { parseSystem, parseCertificateResponse, parseWebhook } from "./models.js";
 export { Paginator } from "./pagination.js";
 export type { CryptoOps } from "./crypto.js";
 export type { PublicKeyInfo } from "./verify.js";
 export { issuanceBytes, hexToBytes, bytesToHex } from "./verify.js";
-import type { PublicKeyInfo } from "./verify.js";
+import type { PublicKeyInfo, PublicKeyOptions } from "./verify.js";
 import type { VerificationResult, TransparencyResult } from "./models.js";
 type Cert = Record<string, unknown>;
 /** Verify all signatures on a deletion certificate offline. */
@@ -33,14 +34,18 @@ export declare function verifyTransparency(certificate: Cert, publicKeys: Map<st
  * all, and every key they built looked unconditionally active. Widening only;
  * `revoked` still works and still means "unusable".
  */
-export declare function publicKeyFromHex(hexKey: string, opts?: {
-    revoked?: boolean;
-    keyStatus?: string;
-    notBefore?: string;
-    notAfter?: string;
-    compromisedFrom?: string;
-}): Promise<PublicKeyInfo>;
+export declare function publicKeyFromHex(hexKey: string, opts?: PublicKeyOptions): Promise<PublicKeyInfo>;
 /** Verify a Merkle consistency proof between two tree states (RFC 6962). */
 export declare function verifyConsistency(oldSize: number, newSize: number, oldRoot: Uint8Array, newRoot: Uint8Array, proof: Uint8Array[]): Promise<boolean>;
 export { verifyWebhookSignature, isTimestampFresh } from "./webhooks.js";
+/**
+ * Client-side connection-config sealing.
+ *
+ * Node only, and absent from the browser entry point on purpose: verifying an
+ * attestation document needs X.509 chain building, which browsers do not
+ * expose, and sealing a datastore credential is not something a browser should
+ * be doing.
+ */
+export { EnclaveAttestationError, ENVELOPE_MAGIC, HEADER_SIZE, NITRO_ROOT_G1_PEM, sealConnectionConfig, sealToKey, verifyEnclaveConfigSealKey, } from "./enclave-seal.js";
+export type { SealOptions } from "./enclave-seal.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,cAAc,EACd,SAAS,EACT,OAAO,EACP,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE1E,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IACL,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACA,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,cAAc,EACd,SAAS,EACT,OAAO,EACP,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUpE,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE1E,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/esm/index.js

@@ -1,6 +1,6 @@
 /** BurnLedger TypeScript SDK — public API (Node.js entry point). */
-export { BurnLedger } from "./client.js";
-export { BurnLedgerError, ApiError, AuthenticationError, NotFoundError, ConflictError, ValidationError, RateLimitError, ServerError, TimeoutError, VerificationError, } from "./errors.js";
+export { BurnLedger, MAX_BATCH_REVOKE } from "./client.js";
+export { BurnLedgerError, ApiError, AuthenticationError, NotFoundError, ConflictError, ValidationError, RateLimitError, ServerError, TimeoutError, VerificationError, CERTIFICATE_REVOKED, UNSUPPORTED_FORMAT_VERSION, } from "./errors.js";
 export { Transport } from "./http.js";
 // Raw-JSON → model parsers, for consumers that fetch API responses outside
 // the client (the dashboard's paginated list hooks) but render SDK types.
@@ -43,4 +43,13 @@ export function verifyConsistency(oldSize, newSize, oldRoot, newRoot, proof) {
     return _verifyConsistency(nodeCrypto, oldSize, newSize, oldRoot, newRoot, proof);
 }
 export { verifyWebhookSignature, isTimestampFresh } from "./webhooks.js";
+/**
+ * Client-side connection-config sealing.
+ *
+ * Node only, and absent from the browser entry point on purpose: verifying an
+ * attestation document needs X.509 chain building, which browsers do not
+ * expose, and sealing a datastore credential is not something a browser should
+ * be doing.
+ */
+export { EnclaveAttestationError, ENVELOPE_MAGIC, HEADER_SIZE, NITRO_ROOT_G1_PEM, sealConnectionConfig, sealToKey, verifyEnclaveConfigSealKey, } from "./enclave-seal.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA0CtC,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,iBAAiB,IAAI,kBAAkB,EACvC,2BAA2B,IAAI,4BAA4B,EAC3D,kBAAkB,IAAI,mBAAmB,EACzC,iBAAiB,IAAI,kBAAkB,EACvC,gBAAgB,IAAI,iBAAiB,GACtC,MAAM,aAAa,CAAC;AAMrB,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAC/B,WAAiB,EACjB,UAAsC;IAEtC,OAAO,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAiB,EACjB,UAAsC,EACtC,MAAuC,EACvC,GAAU;IAEV,OAAO,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAChC,WAAiB,EACjB,UAAsC;IAEtC,OAAO,mBAAmB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAMC;IAED,OAAO,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAe,EACf,OAAmB,EACnB,OAAmB,EACnB,KAAmB;IAEnB,OAAO,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA8CtC,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,iBAAiB,IAAI,kBAAkB,EACvC,2BAA2B,IAAI,4BAA4B,EAC3D,kBAAkB,IAAI,mBAAmB,EACzC,iBAAiB,IAAI,kBAAkB,EACvC,gBAAgB,IAAI,iBAAiB,GACtC,MAAM,aAAa,CAAC;AAMrB,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAC/B,WAAiB,EACjB,UAAsC;IAEtC,OAAO,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAiB,EACjB,UAAsC,EACtC,MAAuC,EACvC,GAAU;IAEV,OAAO,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAChC,WAAiB,EACjB,UAAsC;IAEtC,OAAO,mBAAmB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAAuB;IAEvB,OAAO,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAe,EACf,OAAmB,EACnB,OAAmB,EACnB,KAAmB;IAEnB,OAAO,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC"}

package/dist/esm/keys.d.ts

@@ -1,3 +1,4 @@
+import type { CryptoOps } from "./crypto.js";
 export type KeyEntry = {
     key_id: string;
     public_key: string;
@@ -9,6 +10,24 @@ export type KeyEntry = {
     not_after?: string | null;
     compromised_from?: string | null;
 };
+/**
+ * The published key set as /.well-known/burnledger-keys serves it: the `keys`
+ * array, and BESIDE it — in the same object — the fields of a signed
+ * key_list.v3 statement when the server signs one (ADR-017 §5a). A body with no
+ * `signature` is the unsigned list the endpoint has always served; that is not
+ * an error, it is the state of the world before §5a is deployed.
+ *
+ * Mirrors core.KeyListDocument.
+ */
+export type KeyListDocument = {
+    keys: KeyEntry[];
+    statement_issued_at?: string;
+    statement_expires_at?: string;
+    sth_tree_size?: number;
+    sth_root_hash?: string;
+    signature?: string;
+    key_id?: string;
+};
 /**
  * Normalize a parsed keys file to an array of key entries. Accepts a bare
  * JSON array (the generated keys.json shape), a { "keys": [...] } envelope,
@@ -16,4 +35,51 @@ export type KeyEntry = {
  * actually publishes. Throws on any other shape.
  */
 export declare function parseKeyEntries(parsed: unknown): KeyEntry[];
+/**
+ * Read a published key set in any shape this project has ever served — a bare
+ * array, a {"keys": [...]} object, or either inside the API's {"data": ...}
+ * envelope — keeping the statement fields when the object forms carry them.
+ * Mirrors core.ParseKeyListDocument, so this CLI, the Go CLI and the browser
+ * cannot disagree about which files are key sets.
+ */
+export declare function parseKeyListDocument(parsed: unknown): KeyListDocument;
+/** Verdicts about a key list. Mirrors core.KeyListResult, plus the one the CLI
+ * adds (SIGNING_KEY_NOT_IN_LIST) because core never reaches it: VerifyKeyList
+ * is told which key to trust, and this is the case where there is none to offer. */
+export declare const KEY_LIST_VALID = "VALID";
+export declare const KEY_LIST_MALFORMED = "MALFORMED_KEY_LIST";
+export declare const KEY_LIST_SIGNING_KEY_UNUSABLE = "KEY_LIST_SIGNING_KEY_UNUSABLE";
+export declare const KEY_LIST_INVALID_SIGNATURE = "INVALID_KEY_LIST_SIGNATURE";
+export declare const KEY_LIST_STALE = "KEY_LIST_STALE";
+export declare const KEY_LIST_SIGNING_KEY_ABSENT = "SIGNING_KEY_NOT_IN_LIST";
+/**
+ * What a run learned about where the key statuses and dates came from.
+ * Mirrors keyListEvidence in cmd/cli/keys.go: it is not a pass/fail input to
+ * certificate verification, it qualifies one. An auditor reading
+ * KEY_COMPROMISED needs to know whether that word arrived as evidence they can
+ * keep or as JSON from an endpoint trusted for one TCP connection.
+ */
+export interface KeyListEvidence {
+    /** Whether the file carried a signed statement at all. */
+    present: boolean;
+    result?: string;
+    /** The trusted key was taken from the list itself — trust-on-first-use, not proof. */
+    selfSigned: boolean;
+    /** statement_expires_at, normalized to the form Go prints. */
+    expiresAt?: string;
+}
+/**
+ * Check a key-list statement the way cmd/cli/keys.go does, so four verifiers
+ * agree: the trusted key is looked up IN THE LIST ITSELF (trust-on-first-use,
+ * and selfSigned says so), then core.VerifyKeyList's order — the list parses
+ * and has no duplicate, the signing key is usable at `now` under ADR-017's
+ * table, the signature verifies over the published entries, and only then
+ * freshness. A stale verdict is never returned for a signature never tested.
+ *
+ * THROWS where the Go CLI exits 2: an entry that does not parse, a key_id that
+ * is not sha256(public_key), or a statement whose fields will not read. Someone
+ * signed something the reader cannot read, and continuing as though the file
+ * were merely unsigned would throw that fact away.
+ */
+export declare function verifyKeyList(crypto: CryptoOps, doc: KeyListDocument, now: Date): Promise<KeyListEvidence>;
 //# sourceMappingURL=keys.d.ts.map

package/dist/esm/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/keys.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB;;0BAEsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,EAAE,CAO3D"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/keys.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAU7C,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB;;0BAEsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,EAAE,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAQrE;AAED;;oFAEoF;AACpF,eAAO,MAAM,cAAc,UAAU,CAAC;AACtC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAC7E,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AACvE,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,UAAU,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,eAAe,CAAC,CAmE1B"}

package/dist/esm/keys.js

@@ -1,4 +1,6 @@
-// Public-key file parsing shared by the CLI (and unit-testable in isolation).
+// Public-key file parsing shared by the CLI and the browser verifier, and the
+// key_list.v3 verdict (ADR-017 §5a) — unit-testable in isolation.
+import { buildKeyListPayload, evaluateKey, formatTimestamp, hexToBytes, keyIsUsable, publicKeyFromHex, } from "./verify.js";
 /**
  * Normalize a parsed keys file to an array of key entries. Accepts a bare
  * JSON array (the generated keys.json shape), a { "keys": [...] } envelope,
@@ -6,11 +8,131 @@
  * actually publishes. Throws on any other shape.
  */
 export function parseKeyEntries(parsed) {
+    return parseKeyListDocument(parsed).keys;
+}
+/**
+ * Read a published key set in any shape this project has ever served — a bare
+ * array, a {"keys": [...]} object, or either inside the API's {"data": ...}
+ * envelope — keeping the statement fields when the object forms carry them.
+ * Mirrors core.ParseKeyListDocument, so this CLI, the Go CLI and the browser
+ * cannot disagree about which files are key sets.
+ */
+export function parseKeyListDocument(parsed) {
     const root = parsed?.data ?? parsed;
-    const entries = Array.isArray(root) ? root : root?.keys;
+    if (Array.isArray(root))
+        return { keys: root };
+    const entries = root?.keys;
     if (!Array.isArray(entries)) {
         throw new Error('--keys file must be a JSON array of keys or a {"keys": [...]} object');
     }
-    return entries;
+    return root;
+}
+/** Verdicts about a key list. Mirrors core.KeyListResult, plus the one the CLI
+ * adds (SIGNING_KEY_NOT_IN_LIST) because core never reaches it: VerifyKeyList
+ * is told which key to trust, and this is the case where there is none to offer. */
+export const KEY_LIST_VALID = "VALID";
+export const KEY_LIST_MALFORMED = "MALFORMED_KEY_LIST";
+export const KEY_LIST_SIGNING_KEY_UNUSABLE = "KEY_LIST_SIGNING_KEY_UNUSABLE";
+export const KEY_LIST_INVALID_SIGNATURE = "INVALID_KEY_LIST_SIGNATURE";
+export const KEY_LIST_STALE = "KEY_LIST_STALE";
+export const KEY_LIST_SIGNING_KEY_ABSENT = "SIGNING_KEY_NOT_IN_LIST";
+/** The whole-second RFC 3339 form every published key date uses
+ * (core.KeyTimeFormat). Entry dates are validated against it strictly, as
+ * core.KeyEntry.PublicKeyInfo does, so a date Go refuses is refused here. */
+const KEY_TIME_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/;
+function requireKeyTime(keyId, field, value) {
+    if (typeof value !== "string" || !KEY_TIME_RE.test(value)) {
+        throw new Error(`key ${keyId}: ${field} is not YYYY-MM-DDTHH:MM:SSZ`);
+    }
+}
+function requireHex(field, value, bytes) {
+    if (typeof value !== "string" || value.length !== bytes * 2 || !/^[0-9a-fA-F]+$/.test(value)) {
+        throw new Error(`key list: ${field} is not ${bytes} bytes of hex`);
+    }
+    return hexToBytes(value);
+}
+/**
+ * Check a key-list statement the way cmd/cli/keys.go does, so four verifiers
+ * agree: the trusted key is looked up IN THE LIST ITSELF (trust-on-first-use,
+ * and selfSigned says so), then core.VerifyKeyList's order — the list parses
+ * and has no duplicate, the signing key is usable at `now` under ADR-017's
+ * table, the signature verifies over the published entries, and only then
+ * freshness. A stale verdict is never returned for a signature never tested.
+ *
+ * THROWS where the Go CLI exits 2: an entry that does not parse, a key_id that
+ * is not sha256(public_key), or a statement whose fields will not read. Someone
+ * signed something the reader cannot read, and continuing as though the file
+ * were merely unsigned would throw that fact away.
+ */
+export async function verifyKeyList(crypto, doc, now) {
+    if (doc.keys.length === 0)
+        throw new Error("keys file contains no keys");
+    const signed = doc.signature !== undefined && doc.signature !== "";
+    const keys = new Map();
+    let duplicate = false;
+    for (const e of doc.keys) {
+        if (typeof e.public_key !== "string")
+            throw new Error(`key ${e.key_id}: public_key is not a string`);
+        const pki = await publicKeyFromHex(crypto, e.public_key, {
+            keyStatus: e.key_status,
+            notBefore: e.not_before,
+            notAfter: e.not_after ?? undefined,
+            compromisedFrom: e.compromised_from ?? undefined,
+        });
+        // The strict Go loader rules — key_id is sha256(public_key), dates are
+        // whole-second UTC — apply to a SIGNED list, whose statement signs the
+        // published strings. An unsigned list keeps this CLI's existing
+        // tolerance (an absent key_id is allowed, and the map is keyed on the
+        // derived id either way); tightening the unsigned path would refuse files
+        // it accepts today.
+        if (signed) {
+            if (e.key_id !== pki.keyId) {
+                throw new Error(`key_id ${e.key_id} does not match sha256(public_key) (${pki.keyId})`);
+            }
+            if (e.not_before != null && e.not_before !== "")
+                requireKeyTime(e.key_id, "not_before", e.not_before);
+            if (e.not_after != null)
+                requireKeyTime(e.key_id, "not_after", e.not_after);
+            if (e.compromised_from != null)
+                requireKeyTime(e.key_id, "compromised_from", e.compromised_from);
+        }
+        if (keys.has(pki.keyId))
+            duplicate = true;
+        keys.set(pki.keyId, pki);
+    }
+    if (!signed) {
+        return { present: false, selfSigned: false };
+    }
+    // The statement's own fields. Refused rather than defaulted: a zero
+    // statement_expires_at would read as "expired", which is an answer.
+    requireHex("sth_root_hash", doc.sth_root_hash, 32);
+    const signature = requireHex("signature", doc.signature, 64);
+    if (typeof doc.key_id !== "string" || doc.key_id === "")
+        throw new Error("key list: key_id is missing");
+    if (typeof doc.sth_tree_size !== "number" || !Number.isInteger(doc.sth_tree_size) || doc.sth_tree_size < 0) {
+        throw new Error("key list: sth_tree_size is not a non-negative integer");
+    }
+    const issued = formatTimestamp(doc.statement_issued_at);
+    const expires = formatTimestamp(doc.statement_expires_at);
+    const evidence = { present: true, selfSigned: false, expiresAt: expires };
+    const signingKey = keys.get(doc.key_id);
+    if (signingKey === undefined) {
+        return { ...evidence, result: KEY_LIST_SIGNING_KEY_ABSENT };
+    }
+    evidence.selfSigned = true;
+    if (duplicate)
+        return { ...evidence, result: KEY_LIST_MALFORMED };
+    const at = formatTimestamp(now.toISOString());
+    if (!keyIsUsable(evaluateKey(signingKey, Math.floor(Date.parse(at) / 1000)))) {
+        return { ...evidence, result: KEY_LIST_SIGNING_KEY_UNUSABLE };
+    }
+    const payload = buildKeyListPayload(doc);
+    if (!(await crypto.ed25519Verify(signingKey.keyBytes, payload, signature))) {
+        return { ...evidence, result: KEY_LIST_INVALID_SIGNATURE };
+    }
+    if (at < issued || at >= expires) {
+        return { ...evidence, result: KEY_LIST_STALE };
+    }
+    return { ...evidence, result: KEY_LIST_VALID };
 }
 //# sourceMappingURL=keys.js.map

package/dist/esm/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/keys.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAc9E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,MAAM,IAAI,GAAI,MAA6B,EAAE,IAAI,IAAI,MAAM,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAA2B,EAAE,IAAI,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,OAAqB,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/keys.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,kEAAkE;AAGlE,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,UAAU,EACV,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAiCrB;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,MAAM,IAAI,GAAI,MAA6B,EAAE,IAAI,IAAI,MAAM,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAkB,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAI,IAA2B,EAAE,IAAI,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAuB,CAAC;AACjC,CAAC;AAED;;oFAEoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AACvD,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAC7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAmBrE;;6EAE6E;AAC7E,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAE7D,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa,EAAE,KAAc;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,KAAK,8BAA8B,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,KAAc,EAAE,KAAa;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAiB,EACjB,GAAoB,EACpB,GAAS;IAET,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwD,CAAC;IAC7E,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,8BAA8B,CAAC,CAAC;QACrG,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE;YACvD,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;YAClC,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;SACjD,CAAC,CAAC;QACH,uEAAuE;QACvE,uEAAuE;QACvE,gEAAgE;QAChE,sEAAsE;QACtE,0EAA0E;QAC1E,oBAAoB;QACpB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE;gBAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;YACtG,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI;gBAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAI;gBAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACxG,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC9D,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;IAE3B,IAAI,SAAS;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAElE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAyC,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AACjD,CAAC"}