@awiki/anp-typescript-sdk 0.2.0 → 0.9.3

package/dist/index.cjs

@@ -7,6 +7,8 @@ var net = require('net');
 var canonicalize = require('canonicalize');
 var promises = require('fs/promises');
 var jose = require('jose');
+var p256 = require('@noble/curves/p256');
+var secp256k1 = require('@noble/curves/secp256k1');
 var path = require('path');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -46,6 +48,13 @@ var ProofError = class extends ANPError {
     this.name = "ProofError";
   }
 };
+var DeviceManifestError = class extends AuthenticationError {
+  constructor(message, cause) {
+    super(message, cause);
+    this.name = "DeviceManifestError";
+    Object.defineProperty(this, "code", { value: "DEVICE_MANIFEST_ERROR" });
+  }
+};
 var NetworkError = class extends ANPError {
   constructor(message, statusCode, cause) {
     super(message, "NETWORK_ERROR", cause);
@@ -2063,6 +2072,750 @@ function selectAnpMessageService(didDocument, serviceId, serviceEndpoint) {
   );
 }
 
+// src/authentication/device-manifest.ts
+var device_manifest_exports = {};
+__export(device_manifest_exports, {
+  DEVICE_MANIFEST_TYPE: () => DEVICE_MANIFEST_TYPE,
+  DeviceManifest: () => DeviceManifest,
+  DeviceManifestEntry: () => DeviceManifestEntry,
+  PROFILE_CORE_BINDING_V1: () => PROFILE_CORE_BINDING_V1,
+  PROFILE_CORE_BINDING_V2: () => PROFILE_CORE_BINDING_V2,
+  PROFILE_DIRECT_BASE_V1: () => PROFILE_DIRECT_BASE_V1,
+  PROFILE_DIRECT_BASE_V2: () => PROFILE_DIRECT_BASE_V2,
+  PROFILE_DIRECT_E2EE_V2: () => PROFILE_DIRECT_E2EE_V2,
+  PROFILE_GROUP_BASE_V1: () => PROFILE_GROUP_BASE_V1,
+  PROFILE_GROUP_BASE_V2: () => PROFILE_GROUP_BASE_V2,
+  PROFILE_GROUP_E2EE_V2: () => PROFILE_GROUP_E2EE_V2,
+  PROFILE_IDENTITY_DISCOVERY_V1: () => PROFILE_IDENTITY_DISCOVERY_V1,
+  PROFILE_IDENTITY_DISCOVERY_V2: () => PROFILE_IDENTITY_DISCOVERY_V2,
+  addDeviceToDidDocument: () => addDeviceToDidDocument,
+  buildVnextDidDocument: () => buildVnextDidDocument,
+  findEligibleDevice: () => findEligibleDevice,
+  parseDeviceManifest: () => parseDeviceManifest,
+  removeDeviceFromDidDocument: () => removeDeviceFromDidDocument,
+  updateDeviceInDidDocument: () => updateDeviceInDidDocument,
+  validateDeviceManifest: () => validateDeviceManifest
+});
+var DEVICE_MANIFEST_TYPE = "ANPDeviceManifest";
+var PROFILE_CORE_BINDING_V1 = "anp.core.binding.v1";
+var PROFILE_IDENTITY_DISCOVERY_V1 = "anp.identity.discovery.v1";
+var PROFILE_DIRECT_BASE_V1 = "anp.direct.base.v1";
+var PROFILE_GROUP_BASE_V1 = "anp.group.base.v1";
+var PROFILE_DIRECT_E2EE_V2 = "anp.direct.e2ee.v2";
+var PROFILE_GROUP_E2EE_V2 = "anp.group.e2ee.v2";
+var PROFILE_CORE_BINDING_V2 = "anp.core.binding.v2";
+var PROFILE_IDENTITY_DISCOVERY_V2 = "anp.identity.discovery.v2";
+var PROFILE_DIRECT_BASE_V2 = "anp.direct.base.v2";
+var PROFILE_GROUP_BASE_V2 = "anp.group.base.v2";
+var MANIFEST_FIELDS = /* @__PURE__ */ new Set(["type", "devices"]);
+var ENTRY_FIELDS = /* @__PURE__ */ new Set(["device_id", "signing_key_id", "e2ee_key_id", "profiles"]);
+var P5_DEPENDENCIES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V1,
+  PROFILE_IDENTITY_DISCOVERY_V1,
+  PROFILE_DIRECT_BASE_V1,
+  PROFILE_DIRECT_E2EE_V2
+]);
+var P6_DEPENDENCIES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V1,
+  PROFILE_IDENTITY_DISCOVERY_V1,
+  PROFILE_GROUP_BASE_V1,
+  PROFILE_GROUP_E2EE_V2
+]);
+var P5_LEGACY_DRAFT_DEPENDENCIES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V2,
+  PROFILE_IDENTITY_DISCOVERY_V2,
+  PROFILE_DIRECT_BASE_V2,
+  PROFILE_DIRECT_E2EE_V2
+]);
+var P6_LEGACY_DRAFT_DEPENDENCIES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V2,
+  PROFILE_IDENTITY_DISCOVERY_V2,
+  PROFILE_GROUP_BASE_V2,
+  PROFILE_GROUP_E2EE_V2
+]);
+var LEGACY_DRAFT_FOUNDATION_PROFILES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V2,
+  PROFILE_IDENTITY_DISCOVERY_V2,
+  PROFILE_DIRECT_BASE_V2,
+  PROFILE_GROUP_BASE_V2
+]);
+var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+var SIGNING_ALGORITHMS = /* @__PURE__ */ new Set(["Ed25519", "P-256", "secp256k1"]);
+var DeviceManifestEntry = class _DeviceManifestEntry {
+  constructor(deviceId, signingKeyId, e2eeKeyId, profiles) {
+    this.deviceId = deviceId;
+    this.signingKeyId = signingKeyId;
+    this.e2eeKeyId = e2eeKeyId;
+    this.profiles = profiles;
+  }
+  static fromWire(value) {
+    return new _DeviceManifestEntry(value.device_id, value.signing_key_id, value.e2ee_key_id, [
+      ...value.profiles
+    ]);
+  }
+  toDict() {
+    return {
+      device_id: this.deviceId,
+      signing_key_id: this.signingKeyId,
+      e2ee_key_id: this.e2eeKeyId,
+      profiles: [...this.profiles]
+    };
+  }
+};
+var DeviceManifest = class {
+  constructor(type, devices) {
+    this.type = type;
+    this.devices = devices;
+  }
+  toDict() {
+    return {
+      type: this.type,
+      devices: this.devices.map((device) => device.toDict())
+    };
+  }
+};
+function parseDeviceManifest(didDocument) {
+  if (!Object.prototype.hasOwnProperty.call(didDocument, "deviceManifest")) {
+    return null;
+  }
+  const rawManifest = didDocument.deviceManifest;
+  if (!isPlainObject(rawManifest)) {
+    throw new DeviceManifestError("deviceManifest must be an object");
+  }
+  requireExactFields(rawManifest, MANIFEST_FIELDS, "deviceManifest");
+  if (rawManifest.type !== DEVICE_MANIFEST_TYPE) {
+    throw new DeviceManifestError("deviceManifest.type must equal ANPDeviceManifest");
+  }
+  const rawDevices = rawManifest.devices;
+  if (!Array.isArray(rawDevices)) {
+    throw new DeviceManifestError("deviceManifest.devices must be an array");
+  }
+  const devices = [];
+  rawDevices.forEach((rawEntry, index) => {
+    const subject = `deviceManifest.devices[${index}]`;
+    if (!isPlainObject(rawEntry)) {
+      throw new DeviceManifestError(`${subject} must be an object`);
+    }
+    requireExactFields(rawEntry, ENTRY_FIELDS, subject);
+    const deviceId = requireString(rawEntry.device_id, `${subject}.device_id`);
+    const signingKeyId = requireString(rawEntry.signing_key_id, `${subject}.signing_key_id`);
+    const e2eeKeyId = requireString(rawEntry.e2ee_key_id, `${subject}.e2ee_key_id`);
+    const rawProfiles = rawEntry.profiles;
+    if (!Array.isArray(rawProfiles)) {
+      throw new DeviceManifestError(`${subject}.profiles must be a string array`);
+    }
+    const profiles = rawProfiles.map((profile) => requireString(profile, `${subject}.profiles[]`));
+    devices.push(new DeviceManifestEntry(deviceId, signingKeyId, e2eeKeyId, profiles));
+  });
+  return new DeviceManifest(DEVICE_MANIFEST_TYPE, devices);
+}
+function validateDeviceManifest(didDocument) {
+  const manifest = parseDeviceManifest(didDocument);
+  if (manifest === null) {
+    return null;
+  }
+  const did = requireNonEmptyString(didDocument.id, "DID document id");
+  const verificationMethods = didDocument.verificationMethod;
+  if (!Array.isArray(verificationMethods)) {
+    throw new DeviceManifestError("DID document verificationMethod must be an array");
+  }
+  const methodsById = /* @__PURE__ */ new Map();
+  for (const method of verificationMethods) {
+    if (!isPlainObject(method)) {
+      continue;
+    }
+    const methodId = method.id;
+    if (typeof methodId === "string") {
+      const existing = methodsById.get(methodId) ?? [];
+      existing.push(method);
+      methodsById.set(methodId, existing);
+    }
+  }
+  const seenDeviceIds = /* @__PURE__ */ new Set();
+  const seenKeyIds = /* @__PURE__ */ new Set();
+  for (const entry of manifest.devices) {
+    requireNonEmptyString(entry.deviceId, "device_id");
+    requireNonEmptyString(entry.signingKeyId, "signing_key_id");
+    requireNonEmptyString(entry.e2eeKeyId, "e2ee_key_id");
+    if (entry.profiles.length === 0) {
+      throw new DeviceManifestError("profiles must be non-empty");
+    }
+    for (const profile of entry.profiles) {
+      requireNonEmptyString(profile, "profile");
+    }
+    if (seenDeviceIds.has(entry.deviceId)) {
+      throw new DeviceManifestError("device_id must be unique");
+    }
+    seenDeviceIds.add(entry.deviceId);
+    if (entry.signingKeyId === entry.e2eeKeyId) {
+      throw new DeviceManifestError("signing_key_id and e2ee_key_id must be distinct");
+    }
+    for (const keyId of [entry.signingKeyId, entry.e2eeKeyId]) {
+      if (seenKeyIds.has(keyId)) {
+        throw new DeviceManifestError("a verification method can belong to only one device entry");
+      }
+      seenKeyIds.add(keyId);
+      validateSameDocumentMethod(did, keyId, methodsById);
+    }
+    const profileSet = new Set(entry.profiles);
+    if (profileSet.has(PROFILE_DIRECT_E2EE_V2)) {
+      requireDependencies(profileSet, P5_DEPENDENCIES, P5_LEGACY_DRAFT_DEPENDENCIES, "P5");
+      requireRelationship(didDocument, "assertionMethod", entry.signingKeyId, "P5 signing key");
+    }
+    if (profileSet.has(PROFILE_GROUP_E2EE_V2)) {
+      requireDependencies(profileSet, P6_DEPENDENCIES, P6_LEGACY_DRAFT_DEPENDENCIES, "P6");
+      requireRelationship(didDocument, "assertionMethod", entry.signingKeyId, "P6 binding key");
+      requireRelationship(didDocument, "authentication", entry.signingKeyId, "P6 origin-proof key");
+    }
+    requireRelationship(didDocument, "keyAgreement", entry.e2eeKeyId, "device E2EE key");
+  }
+  return manifest;
+}
+function findEligibleDevice(didDocument, deviceId, requiredProfile) {
+  const manifest = validateDeviceManifest(didDocument);
+  if (manifest === null) {
+    return null;
+  }
+  if (requiredProfile !== PROFILE_DIRECT_E2EE_V2 && requiredProfile !== PROFILE_GROUP_E2EE_V2) {
+    return null;
+  }
+  return manifest.devices.find(
+    (entry) => entry.deviceId === deviceId && entry.profiles.includes(requiredProfile)
+  ) ?? null;
+}
+function buildVnextDidDocument(baseDocument, rootKeyId, rootVerificationMethod, device, deviceSigningVerificationMethod, deviceE2eeVerificationMethod) {
+  requireCanonicalWriteProfiles(device);
+  const document = cloneDocument(baseDocument);
+  for (const field of [
+    "verificationMethod",
+    "authentication",
+    "assertionMethod",
+    "keyAgreement",
+    "deviceManifest",
+    "proof"
+  ]) {
+    if (field in document) {
+      throw new DeviceManifestError(`base DID document must not contain managed field ${field}`);
+    }
+  }
+  const did = documentDid(document);
+  validateRootMethod(did, rootKeyId, rootVerificationMethod);
+  validateDeviceMethods(
+    did,
+    rootKeyId,
+    device,
+    deviceSigningVerificationMethod,
+    deviceE2eeVerificationMethod
+  );
+  Object.assign(document, {
+    verificationMethod: [
+      structuredClone(rootVerificationMethod),
+      structuredClone(deviceSigningVerificationMethod),
+      structuredClone(deviceE2eeVerificationMethod)
+    ],
+    authentication: [device.signingKeyId],
+    assertionMethod: [rootKeyId, device.signingKeyId],
+    keyAgreement: [device.e2eeKeyId],
+    deviceManifest: {
+      type: DEVICE_MANIFEST_TYPE,
+      devices: [device.toDict()]
+    }
+  });
+  validateVnextDocument(document, rootKeyId);
+  return document;
+}
+function addDeviceToDidDocument(didDocument, rootKeyId, device, deviceSigningVerificationMethod, deviceE2eeVerificationMethod, retiredDeviceIds) {
+  requireCanonicalWriteProfiles(device);
+  const document = prepareDocumentForMutation(didDocument, rootKeyId);
+  const manifest = validateDeviceManifest(document);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required for device update");
+  }
+  if (manifest.devices.some((entry) => entry.deviceId === device.deviceId)) {
+    throw new DeviceManifestError("device_id already exists");
+  }
+  const retired = validateRetiredDeviceIds(retiredDeviceIds);
+  if (retired.has(device.deviceId)) {
+    throw new DeviceManifestError("retired device_id cannot be reused");
+  }
+  appendDeviceMaterial(
+    document,
+    rootKeyId,
+    device,
+    deviceSigningVerificationMethod,
+    deviceE2eeVerificationMethod
+  );
+  validateVnextDocument(document, rootKeyId);
+  return document;
+}
+function updateDeviceInDidDocument(didDocument, rootKeyId, device, deviceSigningVerificationMethod, deviceE2eeVerificationMethod) {
+  requireCanonicalWriteProfiles(device);
+  const document = prepareDocumentForMutation(didDocument, rootKeyId);
+  const manifest = validateDeviceManifest(document);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required for device update");
+  }
+  const oldEntry = manifest.devices.find((entry) => entry.deviceId === device.deviceId);
+  if (oldEntry === void 0) {
+    throw new DeviceManifestError("device_id does not exist");
+  }
+  removeDeviceMaterial(document, oldEntry);
+  appendDeviceMaterial(
+    document,
+    rootKeyId,
+    device,
+    deviceSigningVerificationMethod,
+    deviceE2eeVerificationMethod
+  );
+  validateVnextDocument(document, rootKeyId);
+  return document;
+}
+function removeDeviceFromDidDocument(didDocument, rootKeyId, deviceId) {
+  const document = prepareDocumentForMutation(didDocument, rootKeyId);
+  const manifest = validateDeviceManifest(document);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required for device update");
+  }
+  const oldEntry = manifest.devices.find((entry) => entry.deviceId === deviceId);
+  if (oldEntry === void 0) {
+    throw new DeviceManifestError("device_id does not exist");
+  }
+  removeDeviceMaterial(document, oldEntry);
+  validateVnextDocument(document, rootKeyId);
+  return document;
+}
+function cloneDocument(didDocument) {
+  if (!isPlainObject(didDocument)) {
+    throw new DeviceManifestError("DID document must be an object");
+  }
+  validateJsonValue(didDocument, "DID document");
+  return structuredClone(didDocument);
+}
+function documentDid(didDocument) {
+  return requireNonEmptyString(didDocument.id, "DID document id");
+}
+function prepareDocumentForMutation(didDocument, rootKeyId) {
+  const document = cloneDocument(didDocument);
+  validateVnextDocument(document, rootKeyId);
+  const manifest = validateDeviceManifest(document);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required");
+  }
+  for (const entry of manifest.devices) {
+    requireCanonicalWriteProfiles(entry);
+  }
+  delete document.proof;
+  return document;
+}
+function requireCanonicalWriteProfiles(device) {
+  if (device.profiles.some((profile) => LEGACY_DRAFT_FOUNDATION_PROFILES.has(profile))) {
+    throw new DeviceManifestError(
+      "legacy draft foundation profiles are read-only and cannot be published"
+    );
+  }
+}
+function validateVnextDocument(didDocument, rootKeyId) {
+  validateJsonValue(didDocument, "DID document");
+  rejectPrivateKeyMaterial(didDocument, "DID document");
+  const did = documentDid(didDocument);
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    throw new DeviceManifestError("DID document verificationMethod must be an array");
+  }
+  const rootMethods = methods.filter((method) => isPlainObject(method) && method.id === rootKeyId);
+  if (rootMethods.length !== 1 || !isPlainObject(rootMethods[0])) {
+    throw new DeviceManifestError("root key must resolve exactly once in verificationMethod");
+  }
+  const rootIdentity = validateRootMethod(did, rootKeyId, rootMethods[0]);
+  requireRelationship(didDocument, "assertionMethod", rootKeyId, "DID root key");
+  const manifest = validateDeviceManifest(didDocument);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required");
+  }
+  const seenMaterial = /* @__PURE__ */ new Set([rootIdentity.rawPublicKey]);
+  for (const entry of manifest.devices) {
+    if (rootKeyId === entry.signingKeyId || rootKeyId === entry.e2eeKeyId) {
+      throw new DeviceManifestError("DID root key cannot be a device key");
+    }
+    const signingMethod = uniqueMethod(didDocument, entry.signingKeyId);
+    const e2eeMethod = uniqueMethod(didDocument, entry.e2eeKeyId);
+    const [signingIdentity, e2eeIdentity] = validateDeviceMethods(
+      did,
+      rootKeyId,
+      entry,
+      signingMethod,
+      e2eeMethod
+    );
+    requireRelationship(didDocument, "authentication", entry.signingKeyId, "device signing key");
+    requireRelationship(didDocument, "assertionMethod", entry.signingKeyId, "device signing key");
+    requireRelationship(didDocument, "keyAgreement", entry.e2eeKeyId, "device E2EE key");
+    if (relationshipContains(didDocument, "keyAgreement", entry.signingKeyId)) {
+      throw new DeviceManifestError("device signing key must not be in keyAgreement");
+    }
+    if (relationshipContains(didDocument, "authentication", entry.e2eeKeyId) || relationshipContains(didDocument, "assertionMethod", entry.e2eeKeyId)) {
+      throw new DeviceManifestError("device E2EE key must not be a signing relationship");
+    }
+    for (const identity of [signingIdentity, e2eeIdentity]) {
+      if (seenMaterial.has(identity.rawPublicKey)) {
+        throw new DeviceManifestError("root and device public key material must be unique");
+      }
+      seenMaterial.add(identity.rawPublicKey);
+    }
+  }
+}
+function validateRootMethod(did, rootKeyId, verificationMethod) {
+  return validatePublicMethod(
+    did,
+    rootKeyId,
+    verificationMethod,
+    SIGNING_ALGORITHMS,
+    "DID root verification method"
+  );
+}
+function validateDeviceMethods(did, rootKeyId, device, signingMethod, e2eeMethod) {
+  if (rootKeyId === device.signingKeyId || rootKeyId === device.e2eeKeyId) {
+    throw new DeviceManifestError("DID root key cannot be a device key");
+  }
+  const standardObjectProof = device.profiles.some(
+    (profile) => profile === PROFILE_DIRECT_E2EE_V2 || profile === PROFILE_GROUP_E2EE_V2
+  );
+  const signingIdentity = validatePublicMethod(
+    did,
+    device.signingKeyId,
+    signingMethod,
+    standardObjectProof ? /* @__PURE__ */ new Set(["Ed25519"]) : SIGNING_ALGORITHMS,
+    "device signing verification method"
+  );
+  const e2eeIdentity = validatePublicMethod(
+    did,
+    device.e2eeKeyId,
+    e2eeMethod,
+    /* @__PURE__ */ new Set(["X25519"]),
+    "device E2EE verification method"
+  );
+  if (signingIdentity.rawPublicKey === e2eeIdentity.rawPublicKey) {
+    throw new DeviceManifestError("device key material must be unique across roles");
+  }
+  return [signingIdentity, e2eeIdentity];
+}
+function validatePublicMethod(did, expectedKeyId, method, allowedAlgorithms, subject) {
+  if (!isPlainObject(method)) {
+    throw new DeviceManifestError(`${subject} must be an object`);
+  }
+  validateJsonValue(method, subject);
+  if (method.id !== expectedKeyId) {
+    throw new DeviceManifestError(`${subject} id does not match its role`);
+  }
+  if (method.controller !== did) {
+    throw new DeviceManifestError(`${subject} controller must match the DID`);
+  }
+  validateSameDocumentKeyId(did, expectedKeyId);
+  rejectPrivateKeyMaterial(method, subject);
+  const methodType = requireNonEmptyString(method.type, `${subject}.type`);
+  const materialFields = ["publicKeyJwk", "publicKeyMultibase", "publicKeyBase58"].filter(
+    (field) => Object.prototype.hasOwnProperty.call(method, field)
+  );
+  if (materialFields.length !== 1) {
+    throw new DeviceManifestError(`${subject} must contain exactly one supported public key field`);
+  }
+  const materialField = materialFields[0];
+  let identity;
+  if (materialField === "publicKeyJwk") {
+    identity = decodePublicJwk(methodType, method[materialField], subject);
+  } else if (materialField === "publicKeyMultibase") {
+    identity = decodePublicMultikey(methodType, method[materialField], subject);
+  } else {
+    throw new DeviceManifestError(`${subject} publicKeyBase58 is not supported by vNext helpers`);
+  }
+  if (!allowedAlgorithms.has(identity.algorithm)) {
+    throw new DeviceManifestError(`${subject} uses the wrong key algorithm`);
+  }
+  return identity;
+}
+function validateSameDocumentKeyId(did, keyId) {
+  if (!keyId.startsWith(`${did}#`) || keyId === `${did}#`) {
+    throw new DeviceManifestError("key id must be a DID URL in the same document");
+  }
+}
+function decodePublicJwk(methodType, value, subject) {
+  if (methodType !== "JsonWebKey2020" && methodType !== "EcdsaSecp256k1VerificationKey2019" && methodType !== "EcdsaSecp256r1VerificationKey2019") {
+    throw new DeviceManifestError(`${subject} type is incompatible with publicKeyJwk`);
+  }
+  if (!isPlainObject(value)) {
+    throw new DeviceManifestError(`${subject}.publicKeyJwk must be an object`);
+  }
+  const kty = value.kty;
+  const curve = value.crv;
+  if (kty === "OKP" && (curve === "Ed25519" || curve === "X25519")) {
+    if (methodType !== "JsonWebKey2020") {
+      throw new DeviceManifestError(`${subject} type contradicts its JWK`);
+    }
+    const raw = decodeCanonicalBase64url32(value.x, `${subject}.x`);
+    return { algorithm: curve, rawPublicKey: encodeRaw(raw) };
+  }
+  if (kty === "EC" && (curve === "P-256" || curve === "secp256k1")) {
+    const expectedType = curve === "P-256" ? "EcdsaSecp256r1VerificationKey2019" : "EcdsaSecp256k1VerificationKey2019";
+    if (methodType !== "JsonWebKey2020" && methodType !== expectedType) {
+      throw new DeviceManifestError(`${subject} type contradicts its JWK`);
+    }
+    const x = decodeCanonicalBase64url32(value.x, `${subject}.x`);
+    const y = decodeCanonicalBase64url32(value.y, `${subject}.y`);
+    validateEcPoint(curve, x, y, subject);
+    return { algorithm: curve, rawPublicKey: encodeRaw(concatBytes(x, y)) };
+  }
+  throw new DeviceManifestError(`${subject} contains an unsupported public JWK`);
+}
+function decodePublicMultikey(methodType, value, subject) {
+  if (methodType !== "Multikey" && methodType !== "X25519KeyAgreementKey2019") {
+    throw new DeviceManifestError(`${subject} type is incompatible with publicKeyMultibase`);
+  }
+  if (typeof value !== "string" || !value.startsWith("z") || value.length === 1) {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase must be base58btc`);
+  }
+  let decoded;
+  try {
+    decoded = bs58__default.default.decode(value.slice(1));
+  } catch (error) {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase is invalid`, error);
+  }
+  if (`z${bs58__default.default.encode(decoded)}` !== value) {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase must be canonical`);
+  }
+  if (decoded.length !== 34) {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase must contain a 32-byte key`);
+  }
+  const prefix = decoded[0] * 256 + decoded[1];
+  let algorithm;
+  if (prefix === 60673) {
+    algorithm = "Ed25519";
+  } else if (prefix === 60417) {
+    algorithm = "X25519";
+  } else {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase uses an unsupported codec`);
+  }
+  if (methodType === "X25519KeyAgreementKey2019" && algorithm !== "X25519") {
+    throw new DeviceManifestError(`${subject} type contradicts its Multikey`);
+  }
+  return { algorithm, rawPublicKey: encodeRaw(decoded.slice(2)) };
+}
+function decodeCanonicalBase64url32(value, subject) {
+  if (typeof value !== "string" || !BASE64URL_RE.test(value)) {
+    throw new DeviceManifestError(`${subject} must be unpadded base64url`);
+  }
+  let decoded;
+  try {
+    decoded = decodeBase64Url(value);
+  } catch (error) {
+    throw new DeviceManifestError(`${subject} is invalid base64url`, error);
+  }
+  const canonical = encodeBase64Url(decoded);
+  if (decoded.length !== 32 || canonical !== value) {
+    throw new DeviceManifestError(`${subject} must canonically encode 32 bytes`);
+  }
+  return decoded;
+}
+function validateEcPoint(curve, x, y, subject) {
+  const uncompressed = new Uint8Array(65);
+  uncompressed[0] = 4;
+  uncompressed.set(x, 1);
+  uncompressed.set(y, 33);
+  try {
+    if (curve === "P-256") {
+      p256.p256.ProjectivePoint.fromHex(uncompressed);
+    } else {
+      secp256k1.secp256k1.ProjectivePoint.fromHex(uncompressed);
+    }
+  } catch (error) {
+    throw new DeviceManifestError(`${subject} contains an invalid EC point`, error);
+  }
+}
+function rejectPrivateKeyMaterial(value, subject) {
+  if (isPlainObject(value)) {
+    for (const [key, nested] of Object.entries(value)) {
+      const normalizedKey = key.toLowerCase().replaceAll("_", "").replaceAll("-", "");
+      if (normalizedKey.includes("privatekey") || key === "d" && "kty" in value) {
+        throw new DeviceManifestError(`${subject} must not contain private key material`);
+      }
+      rejectPrivateKeyMaterial(nested, subject);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const nested of value) {
+      rejectPrivateKeyMaterial(nested, subject);
+    }
+  }
+}
+function validateJsonValue(value, subject) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new DeviceManifestError(`${subject} contains a non-finite number`);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const nested of value) {
+      validateJsonValue(nested, subject);
+    }
+    return;
+  }
+  if (isPlainObject(value)) {
+    for (const [key, nested] of Object.entries(value)) {
+      if (typeof key !== "string") {
+        throw new DeviceManifestError(`${subject} contains a non-string object key`);
+      }
+      validateJsonValue(nested, subject);
+    }
+    return;
+  }
+  throw new DeviceManifestError(`${subject} contains a non-JSON value`);
+}
+function validateRetiredDeviceIds(retiredDeviceIds) {
+  if (typeof retiredDeviceIds === "string") {
+    throw new DeviceManifestError("retired_device_ids must be a string collection");
+  }
+  const values = [];
+  try {
+    for (const deviceId of retiredDeviceIds) {
+      values.push(deviceId);
+    }
+  } catch (error) {
+    throw new DeviceManifestError("retired_device_ids must be a string collection", error);
+  }
+  for (const deviceId of values) {
+    requireNonEmptyString(deviceId, "retired device_id");
+  }
+  return new Set(values);
+}
+function uniqueMethod(didDocument, keyId) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    throw new DeviceManifestError("DID document verificationMethod must be an array");
+  }
+  const matches = methods.filter((method) => isPlainObject(method) && method.id === keyId);
+  if (matches.length !== 1 || !isPlainObject(matches[0])) {
+    throw new DeviceManifestError("key id must resolve exactly once in verificationMethod");
+  }
+  return matches[0];
+}
+function appendDeviceMaterial(document, rootKeyId, device, signingMethod, e2eeMethod) {
+  const did = documentDid(document);
+  validateDeviceMethods(did, rootKeyId, device, signingMethod, e2eeMethod);
+  const methods = document.verificationMethod;
+  const authentication2 = document.authentication;
+  const assertionMethod = document.assertionMethod;
+  const keyAgreement = document.keyAgreement;
+  const manifest = document.deviceManifest;
+  if (!Array.isArray(methods) || !Array.isArray(authentication2) || !Array.isArray(assertionMethod) || !Array.isArray(keyAgreement) || !isPlainObject(manifest) || !Array.isArray(manifest.devices)) {
+    throw new DeviceManifestError("DID document relationships are invalid");
+  }
+  methods.push(structuredClone(signingMethod), structuredClone(e2eeMethod));
+  authentication2.push(device.signingKeyId);
+  assertionMethod.push(device.signingKeyId);
+  keyAgreement.push(device.e2eeKeyId);
+  manifest.devices.push(device.toDict());
+}
+function removeDeviceMaterial(document, device) {
+  const keyIds = /* @__PURE__ */ new Set([device.signingKeyId, device.e2eeKeyId]);
+  const methods = document.verificationMethod;
+  if (!Array.isArray(methods)) {
+    throw new DeviceManifestError("DID document verificationMethod must be an array");
+  }
+  document.verificationMethod = methods.filter(
+    (method) => !(isPlainObject(method) && typeof method.id === "string" && keyIds.has(method.id))
+  );
+  for (const relationship of ["authentication", "assertionMethod", "keyAgreement"]) {
+    const entries = document[relationship];
+    if (!Array.isArray(entries)) {
+      throw new DeviceManifestError(`${relationship} must be an array`);
+    }
+    document[relationship] = entries.filter(
+      (entry) => ![...keyIds].some((keyId) => relationshipEntryIs(entry, keyId))
+    );
+  }
+  const manifest = document.deviceManifest;
+  if (!isPlainObject(manifest) || !Array.isArray(manifest.devices)) {
+    throw new DeviceManifestError("deviceManifest.devices must be an array");
+  }
+  manifest.devices = manifest.devices.filter(
+    (entry) => !(isPlainObject(entry) && entry.device_id === device.deviceId)
+  );
+}
+function relationshipEntryIs(entry, keyId) {
+  return entry === keyId || isPlainObject(entry) && entry.id === keyId;
+}
+function relationshipContains(didDocument, relationship, keyId) {
+  const entries = didDocument[relationship];
+  return Array.isArray(entries) && entries.some((entry) => relationshipEntryIs(entry, keyId));
+}
+function requireExactFields(value, expected, subject) {
+  const actual = new Set(Object.keys(value));
+  if (actual.size !== expected.size || [...expected].some((field) => !actual.has(field))) {
+    throw new DeviceManifestError(
+      `${subject} must contain exactly ${[...expected].sort().join(", ")}`
+    );
+  }
+}
+function requireString(value, subject) {
+  if (typeof value !== "string") {
+    throw new DeviceManifestError(`${subject} must be a string`);
+  }
+  return value;
+}
+function requireNonEmptyString(value, subject) {
+  const result = requireString(value, subject);
+  if (!result) {
+    throw new DeviceManifestError(`${subject} must be a non-empty string`);
+  }
+  return result;
+}
+function validateSameDocumentMethod(did, keyId, methodsById) {
+  if (!keyId.startsWith(`${did}#`) || keyId === `${did}#`) {
+    throw new DeviceManifestError("device key IDs must be DID URLs in the same DID document");
+  }
+  const methods = methodsById.get(keyId) ?? [];
+  if (methods.length !== 1) {
+    throw new DeviceManifestError("device key ID must resolve exactly once in verificationMethod");
+  }
+}
+function requireDependencies(profiles, required, legacyDraft, profileName) {
+  const hasRequired = [...required].every((profile) => profiles.has(profile));
+  const hasLegacy = [...legacyDraft].every((profile) => profiles.has(profile));
+  if (!hasRequired && !hasLegacy) {
+    throw new DeviceManifestError(`${profileName} device profile dependencies are incomplete`);
+  }
+}
+function requireRelationship(didDocument, relationship, keyId, subject) {
+  const entries = didDocument[relationship];
+  if (!Array.isArray(entries)) {
+    throw new DeviceManifestError(`${subject} requires ${relationship}`);
+  }
+  for (const entry of entries) {
+    if (entry === keyId) {
+      return;
+    }
+    if (isPlainObject(entry) && entry.id === keyId) {
+      return;
+    }
+  }
+  throw new DeviceManifestError(`${subject} is not authorized by ${relationship}`);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function encodeRaw(bytes) {
+  return Buffer.from(bytes).toString("hex");
+}
+function concatBytes(left, right) {
+  const output = new Uint8Array(left.length + right.length);
+  output.set(left);
+  output.set(right, left.length);
+  return output;
+}
+
 // src/authentication/index.ts
 var didDocuments = {
   ANP_MESSAGE_SERVICE_TYPE,
@@ -2093,6 +2846,7 @@ var authentication = {
   didDocuments,
   legacyAuth,
   httpSignatures,
+  deviceManifest: device_manifest_exports,
   federation: {
     verifyRequest: verifyFederatedHttpRequest
   },
@@ -2271,12 +3025,206 @@ function isVerificationMethodAuthorized2(didDocument, verificationMethodId, veri
   throw new ProofError(`unsupported verification relationship: ${verificationRelationship}`);
 }
 
+// src/proof/rfc9421-origin.ts
+var rfc9421_origin_exports = {};
+__export(rfc9421_origin_exports, {
+  RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS: () => RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS,
+  RFC9421_ORIGIN_PROOF_DEFAULT_LABEL: () => RFC9421_ORIGIN_PROOF_DEFAULT_LABEL,
+  Rfc9421OriginProofError: () => Rfc9421OriginProofError,
+  TARGET_KIND_AGENT: () => TARGET_KIND_AGENT,
+  TARGET_KIND_GROUP: () => TARGET_KIND_GROUP,
+  TARGET_KIND_SERVICE: () => TARGET_KIND_SERVICE,
+  buildLogicalTargetUri: () => buildLogicalTargetUri,
+  buildRfc9421OriginSignatureBase: () => buildRfc9421OriginSignatureBase,
+  buildSignedRequestObject: () => buildSignedRequestObject,
+  canonicalizeSignedRequestObject: () => canonicalizeSignedRequestObject,
+  generateRfc9421OriginProof: () => generateRfc9421OriginProof,
+  quoteRfc3986Unreserved: () => quoteRfc3986Unreserved,
+  verifyRfc9421OriginProof: () => verifyRfc9421OriginProof
+});
+var RFC9421_ORIGIN_PROOF_DEFAULT_LABEL = "sig1";
+var RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS = IM_PROOF_DEFAULT_COMPONENTS;
+var TARGET_KIND_AGENT = "agent";
+var TARGET_KIND_GROUP = "group";
+var TARGET_KIND_SERVICE = "service";
+var ALLOWED_TARGET_KINDS = /* @__PURE__ */ new Set([TARGET_KIND_AGENT, TARGET_KIND_GROUP, TARGET_KIND_SERVICE]);
+var Rfc9421OriginProofError = class extends ProofError {
+  constructor(message, cause) {
+    super(message, cause);
+    this.name = "Rfc9421OriginProofError";
+  }
+};
+function buildSignedRequestObject(method, meta, body) {
+  if (typeof method !== "string" || !method.trim()) {
+    throw new Rfc9421OriginProofError("method is required");
+  }
+  if (!isPlainObject2(meta)) {
+    throw new Rfc9421OriginProofError("meta must be an object");
+  }
+  if (!isPlainObject2(body)) {
+    throw new Rfc9421OriginProofError("body must be an object");
+  }
+  return {
+    method,
+    meta: cloneJson(meta),
+    body: cloneJson(body)
+  };
+}
+function canonicalizeSignedRequestObject(signedRequestObject) {
+  const keys = Object.keys(signedRequestObject);
+  if (keys.length !== 3 || !keys.includes("method") || !keys.includes("meta") || !keys.includes("body")) {
+    throw new Rfc9421OriginProofError(
+      "signed request object must contain only method, meta, and body"
+    );
+  }
+  return canonicalizeJson({
+    method: signedRequestObject.method,
+    meta: signedRequestObject.meta,
+    body: signedRequestObject.body
+  });
+}
+function buildLogicalTargetUri(targetKind, targetDid) {
+  const normalizedKind = String(targetKind).trim();
+  if (!ALLOWED_TARGET_KINDS.has(normalizedKind)) {
+    throw new Rfc9421OriginProofError(`unsupported target kind: ${targetKind}`);
+  }
+  const normalizedDid = String(targetDid).trim();
+  if (!normalizedDid) {
+    throw new Rfc9421OriginProofError("target did is required");
+  }
+  return `anp://${normalizedKind}/${quoteRfc3986Unreserved(normalizedDid)}`;
+}
+function buildRfc9421OriginSignatureBase(method, logicalTargetUri, contentDigest, signatureInput) {
+  if (typeof method !== "string" || !method.trim()) {
+    throw new Rfc9421OriginProofError("method is required");
+  }
+  if (typeof logicalTargetUri !== "string" || !logicalTargetUri.trim()) {
+    throw new Rfc9421OriginProofError("logical_target_uri is required");
+  }
+  if (typeof contentDigest !== "string" || !contentDigest.trim()) {
+    throw new Rfc9421OriginProofError("content_digest is required");
+  }
+  const parsed = parseImSignatureInput(signatureInput);
+  validateParsedSignatureInput(parsed.label, parsed.components);
+  const componentValues = {
+    "@method": method,
+    "@target-uri": logicalTargetUri,
+    "content-digest": contentDigest
+  };
+  const lines = parsed.components.map(
+    (component) => `"${component}": ${componentValues[component]}`
+  );
+  lines.push(`"@signature-params": ${parsed.signatureParams}`);
+  return new TextEncoder().encode(lines.join("\n"));
+}
+function generateRfc9421OriginProof(method, meta, body, privateKey, keyId, options = {}) {
+  const label = options.label ?? RFC9421_ORIGIN_PROOF_DEFAULT_LABEL;
+  validateLabel(label);
+  const signedRequestObject = buildSignedRequestObject(method, meta, body);
+  const canonicalRequest = canonicalizeSignedRequestObject(signedRequestObject);
+  const logicalTargetUri = buildLogicalTargetUriFromMeta(signedRequestObject.meta);
+  const contentDigest = buildImContentDigest(canonicalRequest);
+  const signatureInput = buildImSignatureInput(keyId, {
+    components: [...RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS],
+    label,
+    created: options.created,
+    expires: options.expires,
+    nonce: options.nonce
+  });
+  const signatureBase = buildRfc9421OriginSignatureBase(
+    method,
+    logicalTargetUri,
+    contentDigest,
+    signatureInput
+  );
+  const proof2 = generateImProof(canonicalRequest, signatureBase, privateKey, keyId, {
+    components: [...RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS],
+    label,
+    created: options.created,
+    expires: options.expires,
+    nonce: options.nonce
+  });
+  const parsed = parseImSignatureInput(proof2.signatureInput);
+  validateParsedSignatureInput(parsed.label, parsed.components);
+  return proof2;
+}
+function verifyRfc9421OriginProof(originProof, method, meta, body, verification = {}) {
+  const signedRequestObject = buildSignedRequestObject(method, meta, body);
+  const canonicalRequest = canonicalizeSignedRequestObject(signedRequestObject);
+  const logicalTargetUri = buildLogicalTargetUriFromMeta(signedRequestObject.meta);
+  const signatureInput = requireProofField(originProof, "signatureInput");
+  const parsed = parseImSignatureInput(signatureInput);
+  validateParsedSignatureInput(parsed.label, parsed.components);
+  const signatureBase = buildRfc9421OriginSignatureBase(
+    method,
+    logicalTargetUri,
+    requireProofField(originProof, "contentDigest"),
+    signatureInput
+  );
+  return verifyImProof(
+    originProof,
+    canonicalRequest,
+    signatureBase,
+    {
+      didDocument: verification.didDocument,
+      verificationMethod: verification.verificationMethod,
+      verificationRelationship: IM_PROOF_RELATION_AUTHENTICATION
+    },
+    verification.options?.expectedSignerDid
+  );
+}
+function buildLogicalTargetUriFromMeta(meta) {
+  const target = meta.target;
+  if (!isPlainObject2(target)) {
+    throw new Rfc9421OriginProofError("meta.target is required");
+  }
+  return buildLogicalTargetUri(String(target.kind), String(target.did));
+}
+function validateLabel(label) {
+  if (label !== RFC9421_ORIGIN_PROOF_DEFAULT_LABEL) {
+    throw new Rfc9421OriginProofError("RFC 9421 origin proof requires signature label sig1");
+  }
+}
+function validateParsedSignatureInput(label, components) {
+  validateLabel(label);
+  const expected = [...RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS];
+  if (components.length !== expected.length || components.some((value, index) => value !== expected[index])) {
+    throw new Rfc9421OriginProofError(
+      'RFC 9421 origin proof requires covered components ("@method" "@target-uri" "content-digest")'
+    );
+  }
+}
+function requireProofField(proof2, field) {
+  const value = proof2[field];
+  if (!value) {
+    throw new Rfc9421OriginProofError(`missing proof field: ${field}`);
+  }
+  return value;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function quoteRfc3986Unreserved(value) {
+  let output = "";
+  for (const char of value) {
+    if (/[A-Za-z0-9\-._~]/.test(char)) {
+      output += char;
+      continue;
+    }
+    for (const byte of new TextEncoder().encode(char)) {
+      output += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+  }
+  return output;
+}
+
 // src/proof/index.ts
 var proof = {
   create: generateW3cProof,
   verify: verifyW3cProof,
   verifyDetailed: verifyW3cProofDetailed,
-  im: im_exports
+  im: im_exports,
+  rfc9421: rfc9421_origin_exports
 };
 
 // src/wns/types.ts
@@ -4879,7 +5827,11 @@ exports.AwikiImError = AwikiImError;
 exports.CRYPTOSUITE_DIDWBA_SECP256K1_2025 = CRYPTOSUITE_DIDWBA_SECP256K1_2025;
 exports.CRYPTOSUITE_EDDSA_JCS_2022 = CRYPTOSUITE_EDDSA_JCS_2022;
 exports.CryptoError = CryptoError;
+exports.DEVICE_MANIFEST_TYPE = DEVICE_MANIFEST_TYPE;
 exports.DIDWbaAuthHeader = DIDWbaAuthHeader;
+exports.DeviceManifest = DeviceManifest;
+exports.DeviceManifestEntry = DeviceManifestEntry;
+exports.DeviceManifestError = DeviceManifestError;
 exports.DidAuthHeaders = DIDWbaAuthHeader;
 exports.DidProfile = DidProfile;
 exports.DidWbaVerifier = DidWbaVerifier;
@@ -4895,19 +5847,36 @@ exports.IM_PROOF_DEFAULT_COMPONENTS = IM_PROOF_DEFAULT_COMPONENTS;
 exports.IM_PROOF_RELATION_ASSERTION_METHOD = IM_PROOF_RELATION_ASSERTION_METHOD;
 exports.IM_PROOF_RELATION_AUTHENTICATION = IM_PROOF_RELATION_AUTHENTICATION;
 exports.NetworkError = NetworkError;
+exports.PROFILE_CORE_BINDING_V1 = PROFILE_CORE_BINDING_V1;
+exports.PROFILE_CORE_BINDING_V2 = PROFILE_CORE_BINDING_V2;
+exports.PROFILE_DIRECT_BASE_V1 = PROFILE_DIRECT_BASE_V1;
+exports.PROFILE_DIRECT_BASE_V2 = PROFILE_DIRECT_BASE_V2;
+exports.PROFILE_DIRECT_E2EE_V2 = PROFILE_DIRECT_E2EE_V2;
+exports.PROFILE_GROUP_BASE_V1 = PROFILE_GROUP_BASE_V1;
+exports.PROFILE_GROUP_BASE_V2 = PROFILE_GROUP_BASE_V2;
+exports.PROFILE_GROUP_E2EE_V2 = PROFILE_GROUP_E2EE_V2;
+exports.PROFILE_IDENTITY_DISCOVERY_V1 = PROFILE_IDENTITY_DISCOVERY_V1;
+exports.PROFILE_IDENTITY_DISCOVERY_V2 = PROFILE_IDENTITY_DISCOVERY_V2;
 exports.PROOF_TYPE_DATA_INTEGRITY = PROOF_TYPE_DATA_INTEGRITY;
 exports.PROOF_TYPE_ED25519 = PROOF_TYPE_ED25519;
 exports.PROOF_TYPE_SECP256K1 = PROOF_TYPE_SECP256K1;
 exports.ProofError = ProofError;
+exports.RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS = RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS;
+exports.RFC9421_ORIGIN_PROOF_DEFAULT_LABEL = RFC9421_ORIGIN_PROOF_DEFAULT_LABEL;
 exports.RequestVerifier = DidWbaVerifier;
 exports.RequestVerifierError = DidWbaVerifierError;
+exports.Rfc9421OriginProofError = Rfc9421OriginProofError;
 exports.SubjectType = SubjectType;
+exports.TARGET_KIND_AGENT = TARGET_KIND_AGENT;
+exports.TARGET_KIND_GROUP = TARGET_KIND_GROUP;
+exports.TARGET_KIND_SERVICE = TARGET_KIND_SERVICE;
 exports.VM_KEY_AUTH = VM_KEY_AUTH;
 exports.VM_KEY_E2EE_AGREEMENT = VM_KEY_E2EE_AGREEMENT;
 exports.VM_KEY_E2EE_SIGNING = VM_KEY_E2EE_SIGNING;
 exports.VerificationMethod = VerificationMethod;
 exports.WbaUriParseError = WbaUriParseError;
 exports.WnsError = WnsError;
+exports.addDeviceToDidDocument = addDeviceToDidDocument;
 exports.authentication = authentication;
 exports.buildAgentMessageService = buildAgentMessageService;
 exports.buildAnpMessageService = buildAnpMessageService;
@@ -4916,10 +5885,15 @@ exports.buildGroupMessageService = buildGroupMessageService;
 exports.buildHandleServiceEntry = buildHandleServiceEntry;
 exports.buildImContentDigest = buildImContentDigest;
 exports.buildImSignatureInput = buildImSignatureInput;
+exports.buildLogicalTargetUri = buildLogicalTargetUri;
 exports.buildResolutionUrl = buildResolutionUrl;
+exports.buildRfc9421OriginSignatureBase = buildRfc9421OriginSignatureBase;
+exports.buildSignedRequestObject = buildSignedRequestObject;
 exports.buildUri = buildWbaUri;
+exports.buildVnextDidDocument = buildVnextDidDocument;
 exports.buildWbaUri = buildWbaUri;
 exports.canonicalizeBindingGeneration = canonicalizeBindingGeneration;
+exports.canonicalizeSignedRequestObject = canonicalizeSignedRequestObject;
 exports.compareBindingGenerations = compareBindingGenerations;
 exports.computeJwkFingerprint = computeJwkFingerprint;
 exports.computeMultikeyFingerprint = computeMultikeyFingerprint;
@@ -4942,28 +5916,35 @@ exports.extractHandleServiceFromDidDocument = extractHandleServiceFromDidDocumen
 exports.extractHandleServices = extractHandleServiceFromDidDocument;
 exports.extractPublicKey = extractPublicKey;
 exports.extractSignatureMetadata = extractSignatureMetadata;
+exports.findEligibleDevice = findEligibleDevice;
 exports.findVerificationMethod = findVerificationMethod;
 exports.generateAuthHeader = generateAuthHeader;
 exports.generateAuthJson = generateAuthJson;
 exports.generateHttpSignatureHeaders = generateHttpSignatureHeaders;
 exports.generateImProof = generateImProof;
+exports.generateRfc9421OriginProof = generateRfc9421OriginProof;
 exports.generateW3cProof = generateW3cProof;
 exports.httpSignatures = httpSignatures;
 exports.isAssertionMethodAuthorized = isAssertionMethodAuthorized;
 exports.isAuthenticationAuthorized = isAuthenticationAuthorized;
 exports.legacyAuth = legacyAuth;
 exports.normalizeHandle = normalizeHandle;
+exports.parseDeviceManifest = parseDeviceManifest;
 exports.parseImSignatureInput = parseImSignatureInput;
 exports.parseLegacyAuthHeader = extractAuthHeaderParts;
 exports.parseSignatureMetadata = extractSignatureMetadata;
 exports.parseUri = parseWbaUri;
 exports.parseWbaUri = parseWbaUri;
 exports.proof = proof;
+exports.quoteRfc3986Unreserved = quoteRfc3986Unreserved;
+exports.removeDeviceFromDidDocument = removeDeviceFromDidDocument;
 exports.resolveDidDocument = resolveDidDocument;
 exports.resolveDidWbaDocument = resolveDidWbaDocument;
 exports.resolveHandle = resolveHandle;
 exports.resolveHandleFromUri = resolveHandleFromUri;
 exports.resolveUri = resolveHandleFromUri;
+exports.updateDeviceInDidDocument = updateDeviceInDidDocument;
+exports.validateDeviceManifest = validateDeviceManifest;
 exports.validateDidBinding = validateDidDocumentBinding;
 exports.validateDidDocumentBinding = validateDidDocumentBinding;
 exports.validateHandle = validateHandle;
@@ -4983,6 +5964,7 @@ exports.verifyLegacyAuthHeader = verifyAuthHeaderSignature;
 exports.verifyLegacyAuthPayload = verifyAuthJsonSignature;
 exports.verifyProof = verifyW3cProof;
 exports.verifyProofDetailed = verifyW3cProofDetailed;
+exports.verifyRfc9421OriginProof = verifyRfc9421OriginProof;
 exports.verifySignatureHeaders = verifyHttpMessageSignature;
 exports.verifyW3cProof = verifyW3cProof;
 exports.verifyW3cProofDetailed = verifyW3cProofDetailed;