@awiki/anp-typescript-sdk 0.2.0 → 0.9.4

package/dist/index.js

@@ -5,6 +5,8 @@ import { isIP } from 'net';
 import canonicalize from 'canonicalize';
 import { readFile, mkdir, writeFile, rename, chmod, unlink } from 'fs/promises';
 import { jwtVerify, SignJWT, importPKCS8, importSPKI } from 'jose';
+import { p256 } from '@noble/curves/p256';
+import { secp256k1 } from '@noble/curves/secp256k1';
 import { dirname } from 'path';
 
 var __defProp = Object.defineProperty;
@@ -39,6 +41,13 @@ var ProofError = class extends ANPError {
     this.name = "ProofError";
   }
 };
+var DeviceManifestError = class extends AuthenticationError {
+  constructor(message, cause) {
+    super(message, cause);
+    this.name = "DeviceManifestError";
+    Object.defineProperty(this, "code", { value: "DEVICE_MANIFEST_ERROR" });
+  }
+};
 var NetworkError = class extends ANPError {
   constructor(message, statusCode, cause) {
     super(message, "NETWORK_ERROR", cause);
@@ -2056,6 +2065,750 @@ function selectAnpMessageService(didDocument, serviceId, serviceEndpoint) {
   );
 }
 
+// src/authentication/device-manifest.ts
+var device_manifest_exports = {};
+__export(device_manifest_exports, {
+  DEVICE_MANIFEST_TYPE: () => DEVICE_MANIFEST_TYPE,
+  DeviceManifest: () => DeviceManifest,
+  DeviceManifestEntry: () => DeviceManifestEntry,
+  PROFILE_CORE_BINDING_V1: () => PROFILE_CORE_BINDING_V1,
+  PROFILE_CORE_BINDING_V2: () => PROFILE_CORE_BINDING_V2,
+  PROFILE_DIRECT_BASE_V1: () => PROFILE_DIRECT_BASE_V1,
+  PROFILE_DIRECT_BASE_V2: () => PROFILE_DIRECT_BASE_V2,
+  PROFILE_DIRECT_E2EE_V2: () => PROFILE_DIRECT_E2EE_V2,
+  PROFILE_GROUP_BASE_V1: () => PROFILE_GROUP_BASE_V1,
+  PROFILE_GROUP_BASE_V2: () => PROFILE_GROUP_BASE_V2,
+  PROFILE_GROUP_E2EE_V2: () => PROFILE_GROUP_E2EE_V2,
+  PROFILE_IDENTITY_DISCOVERY_V1: () => PROFILE_IDENTITY_DISCOVERY_V1,
+  PROFILE_IDENTITY_DISCOVERY_V2: () => PROFILE_IDENTITY_DISCOVERY_V2,
+  addDeviceToDidDocument: () => addDeviceToDidDocument,
+  buildVnextDidDocument: () => buildVnextDidDocument,
+  findEligibleDevice: () => findEligibleDevice,
+  parseDeviceManifest: () => parseDeviceManifest,
+  removeDeviceFromDidDocument: () => removeDeviceFromDidDocument,
+  updateDeviceInDidDocument: () => updateDeviceInDidDocument,
+  validateDeviceManifest: () => validateDeviceManifest
+});
+var DEVICE_MANIFEST_TYPE = "ANPDeviceManifest";
+var PROFILE_CORE_BINDING_V1 = "anp.core.binding.v1";
+var PROFILE_IDENTITY_DISCOVERY_V1 = "anp.identity.discovery.v1";
+var PROFILE_DIRECT_BASE_V1 = "anp.direct.base.v1";
+var PROFILE_GROUP_BASE_V1 = "anp.group.base.v1";
+var PROFILE_DIRECT_E2EE_V2 = "anp.direct.e2ee.v2";
+var PROFILE_GROUP_E2EE_V2 = "anp.group.e2ee.v2";
+var PROFILE_CORE_BINDING_V2 = "anp.core.binding.v2";
+var PROFILE_IDENTITY_DISCOVERY_V2 = "anp.identity.discovery.v2";
+var PROFILE_DIRECT_BASE_V2 = "anp.direct.base.v2";
+var PROFILE_GROUP_BASE_V2 = "anp.group.base.v2";
+var MANIFEST_FIELDS = /* @__PURE__ */ new Set(["type", "devices"]);
+var ENTRY_FIELDS = /* @__PURE__ */ new Set(["device_id", "signing_key_id", "e2ee_key_id", "profiles"]);
+var P5_DEPENDENCIES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V1,
+  PROFILE_IDENTITY_DISCOVERY_V1,
+  PROFILE_DIRECT_BASE_V1,
+  PROFILE_DIRECT_E2EE_V2
+]);
+var P6_DEPENDENCIES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V1,
+  PROFILE_IDENTITY_DISCOVERY_V1,
+  PROFILE_GROUP_BASE_V1,
+  PROFILE_GROUP_E2EE_V2
+]);
+var P5_LEGACY_DRAFT_DEPENDENCIES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V2,
+  PROFILE_IDENTITY_DISCOVERY_V2,
+  PROFILE_DIRECT_BASE_V2,
+  PROFILE_DIRECT_E2EE_V2
+]);
+var P6_LEGACY_DRAFT_DEPENDENCIES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V2,
+  PROFILE_IDENTITY_DISCOVERY_V2,
+  PROFILE_GROUP_BASE_V2,
+  PROFILE_GROUP_E2EE_V2
+]);
+var LEGACY_DRAFT_FOUNDATION_PROFILES = /* @__PURE__ */ new Set([
+  PROFILE_CORE_BINDING_V2,
+  PROFILE_IDENTITY_DISCOVERY_V2,
+  PROFILE_DIRECT_BASE_V2,
+  PROFILE_GROUP_BASE_V2
+]);
+var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+var SIGNING_ALGORITHMS = /* @__PURE__ */ new Set(["Ed25519", "P-256", "secp256k1"]);
+var DeviceManifestEntry = class _DeviceManifestEntry {
+  constructor(deviceId, signingKeyId, e2eeKeyId, profiles) {
+    this.deviceId = deviceId;
+    this.signingKeyId = signingKeyId;
+    this.e2eeKeyId = e2eeKeyId;
+    this.profiles = profiles;
+  }
+  static fromWire(value) {
+    return new _DeviceManifestEntry(value.device_id, value.signing_key_id, value.e2ee_key_id, [
+      ...value.profiles
+    ]);
+  }
+  toDict() {
+    return {
+      device_id: this.deviceId,
+      signing_key_id: this.signingKeyId,
+      e2ee_key_id: this.e2eeKeyId,
+      profiles: [...this.profiles]
+    };
+  }
+};
+var DeviceManifest = class {
+  constructor(type, devices) {
+    this.type = type;
+    this.devices = devices;
+  }
+  toDict() {
+    return {
+      type: this.type,
+      devices: this.devices.map((device) => device.toDict())
+    };
+  }
+};
+function parseDeviceManifest(didDocument) {
+  if (!Object.prototype.hasOwnProperty.call(didDocument, "deviceManifest")) {
+    return null;
+  }
+  const rawManifest = didDocument.deviceManifest;
+  if (!isPlainObject(rawManifest)) {
+    throw new DeviceManifestError("deviceManifest must be an object");
+  }
+  requireExactFields(rawManifest, MANIFEST_FIELDS, "deviceManifest");
+  if (rawManifest.type !== DEVICE_MANIFEST_TYPE) {
+    throw new DeviceManifestError("deviceManifest.type must equal ANPDeviceManifest");
+  }
+  const rawDevices = rawManifest.devices;
+  if (!Array.isArray(rawDevices)) {
+    throw new DeviceManifestError("deviceManifest.devices must be an array");
+  }
+  const devices = [];
+  rawDevices.forEach((rawEntry, index) => {
+    const subject = `deviceManifest.devices[${index}]`;
+    if (!isPlainObject(rawEntry)) {
+      throw new DeviceManifestError(`${subject} must be an object`);
+    }
+    requireExactFields(rawEntry, ENTRY_FIELDS, subject);
+    const deviceId = requireString(rawEntry.device_id, `${subject}.device_id`);
+    const signingKeyId = requireString(rawEntry.signing_key_id, `${subject}.signing_key_id`);
+    const e2eeKeyId = requireString(rawEntry.e2ee_key_id, `${subject}.e2ee_key_id`);
+    const rawProfiles = rawEntry.profiles;
+    if (!Array.isArray(rawProfiles)) {
+      throw new DeviceManifestError(`${subject}.profiles must be a string array`);
+    }
+    const profiles = rawProfiles.map((profile) => requireString(profile, `${subject}.profiles[]`));
+    devices.push(new DeviceManifestEntry(deviceId, signingKeyId, e2eeKeyId, profiles));
+  });
+  return new DeviceManifest(DEVICE_MANIFEST_TYPE, devices);
+}
+function validateDeviceManifest(didDocument) {
+  const manifest = parseDeviceManifest(didDocument);
+  if (manifest === null) {
+    return null;
+  }
+  const did = requireNonEmptyString(didDocument.id, "DID document id");
+  const verificationMethods = didDocument.verificationMethod;
+  if (!Array.isArray(verificationMethods)) {
+    throw new DeviceManifestError("DID document verificationMethod must be an array");
+  }
+  const methodsById = /* @__PURE__ */ new Map();
+  for (const method of verificationMethods) {
+    if (!isPlainObject(method)) {
+      continue;
+    }
+    const methodId = method.id;
+    if (typeof methodId === "string") {
+      const existing = methodsById.get(methodId) ?? [];
+      existing.push(method);
+      methodsById.set(methodId, existing);
+    }
+  }
+  const seenDeviceIds = /* @__PURE__ */ new Set();
+  const seenKeyIds = /* @__PURE__ */ new Set();
+  for (const entry of manifest.devices) {
+    requireNonEmptyString(entry.deviceId, "device_id");
+    requireNonEmptyString(entry.signingKeyId, "signing_key_id");
+    requireNonEmptyString(entry.e2eeKeyId, "e2ee_key_id");
+    if (entry.profiles.length === 0) {
+      throw new DeviceManifestError("profiles must be non-empty");
+    }
+    for (const profile of entry.profiles) {
+      requireNonEmptyString(profile, "profile");
+    }
+    if (seenDeviceIds.has(entry.deviceId)) {
+      throw new DeviceManifestError("device_id must be unique");
+    }
+    seenDeviceIds.add(entry.deviceId);
+    if (entry.signingKeyId === entry.e2eeKeyId) {
+      throw new DeviceManifestError("signing_key_id and e2ee_key_id must be distinct");
+    }
+    for (const keyId of [entry.signingKeyId, entry.e2eeKeyId]) {
+      if (seenKeyIds.has(keyId)) {
+        throw new DeviceManifestError("a verification method can belong to only one device entry");
+      }
+      seenKeyIds.add(keyId);
+      validateSameDocumentMethod(did, keyId, methodsById);
+    }
+    const profileSet = new Set(entry.profiles);
+    if (profileSet.has(PROFILE_DIRECT_E2EE_V2)) {
+      requireDependencies(profileSet, P5_DEPENDENCIES, P5_LEGACY_DRAFT_DEPENDENCIES, "P5");
+      requireRelationship(didDocument, "assertionMethod", entry.signingKeyId, "P5 signing key");
+    }
+    if (profileSet.has(PROFILE_GROUP_E2EE_V2)) {
+      requireDependencies(profileSet, P6_DEPENDENCIES, P6_LEGACY_DRAFT_DEPENDENCIES, "P6");
+      requireRelationship(didDocument, "assertionMethod", entry.signingKeyId, "P6 binding key");
+      requireRelationship(didDocument, "authentication", entry.signingKeyId, "P6 origin-proof key");
+    }
+    requireRelationship(didDocument, "keyAgreement", entry.e2eeKeyId, "device E2EE key");
+  }
+  return manifest;
+}
+function findEligibleDevice(didDocument, deviceId, requiredProfile) {
+  const manifest = validateDeviceManifest(didDocument);
+  if (manifest === null) {
+    return null;
+  }
+  if (requiredProfile !== PROFILE_DIRECT_E2EE_V2 && requiredProfile !== PROFILE_GROUP_E2EE_V2) {
+    return null;
+  }
+  return manifest.devices.find(
+    (entry) => entry.deviceId === deviceId && entry.profiles.includes(requiredProfile)
+  ) ?? null;
+}
+function buildVnextDidDocument(baseDocument, rootKeyId, rootVerificationMethod, device, deviceSigningVerificationMethod, deviceE2eeVerificationMethod) {
+  requireCanonicalWriteProfiles(device);
+  const document = cloneDocument(baseDocument);
+  for (const field of [
+    "verificationMethod",
+    "authentication",
+    "assertionMethod",
+    "keyAgreement",
+    "deviceManifest",
+    "proof"
+  ]) {
+    if (field in document) {
+      throw new DeviceManifestError(`base DID document must not contain managed field ${field}`);
+    }
+  }
+  const did = documentDid(document);
+  validateRootMethod(did, rootKeyId, rootVerificationMethod);
+  validateDeviceMethods(
+    did,
+    rootKeyId,
+    device,
+    deviceSigningVerificationMethod,
+    deviceE2eeVerificationMethod
+  );
+  Object.assign(document, {
+    verificationMethod: [
+      structuredClone(rootVerificationMethod),
+      structuredClone(deviceSigningVerificationMethod),
+      structuredClone(deviceE2eeVerificationMethod)
+    ],
+    authentication: [device.signingKeyId],
+    assertionMethod: [rootKeyId, device.signingKeyId],
+    keyAgreement: [device.e2eeKeyId],
+    deviceManifest: {
+      type: DEVICE_MANIFEST_TYPE,
+      devices: [device.toDict()]
+    }
+  });
+  validateVnextDocument(document, rootKeyId);
+  return document;
+}
+function addDeviceToDidDocument(didDocument, rootKeyId, device, deviceSigningVerificationMethod, deviceE2eeVerificationMethod, retiredDeviceIds) {
+  requireCanonicalWriteProfiles(device);
+  const document = prepareDocumentForMutation(didDocument, rootKeyId);
+  const manifest = validateDeviceManifest(document);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required for device update");
+  }
+  if (manifest.devices.some((entry) => entry.deviceId === device.deviceId)) {
+    throw new DeviceManifestError("device_id already exists");
+  }
+  const retired = validateRetiredDeviceIds(retiredDeviceIds);
+  if (retired.has(device.deviceId)) {
+    throw new DeviceManifestError("retired device_id cannot be reused");
+  }
+  appendDeviceMaterial(
+    document,
+    rootKeyId,
+    device,
+    deviceSigningVerificationMethod,
+    deviceE2eeVerificationMethod
+  );
+  validateVnextDocument(document, rootKeyId);
+  return document;
+}
+function updateDeviceInDidDocument(didDocument, rootKeyId, device, deviceSigningVerificationMethod, deviceE2eeVerificationMethod) {
+  requireCanonicalWriteProfiles(device);
+  const document = prepareDocumentForMutation(didDocument, rootKeyId);
+  const manifest = validateDeviceManifest(document);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required for device update");
+  }
+  const oldEntry = manifest.devices.find((entry) => entry.deviceId === device.deviceId);
+  if (oldEntry === void 0) {
+    throw new DeviceManifestError("device_id does not exist");
+  }
+  removeDeviceMaterial(document, oldEntry);
+  appendDeviceMaterial(
+    document,
+    rootKeyId,
+    device,
+    deviceSigningVerificationMethod,
+    deviceE2eeVerificationMethod
+  );
+  validateVnextDocument(document, rootKeyId);
+  return document;
+}
+function removeDeviceFromDidDocument(didDocument, rootKeyId, deviceId) {
+  const document = prepareDocumentForMutation(didDocument, rootKeyId);
+  const manifest = validateDeviceManifest(document);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required for device update");
+  }
+  const oldEntry = manifest.devices.find((entry) => entry.deviceId === deviceId);
+  if (oldEntry === void 0) {
+    throw new DeviceManifestError("device_id does not exist");
+  }
+  removeDeviceMaterial(document, oldEntry);
+  validateVnextDocument(document, rootKeyId);
+  return document;
+}
+function cloneDocument(didDocument) {
+  if (!isPlainObject(didDocument)) {
+    throw new DeviceManifestError("DID document must be an object");
+  }
+  validateJsonValue(didDocument, "DID document");
+  return structuredClone(didDocument);
+}
+function documentDid(didDocument) {
+  return requireNonEmptyString(didDocument.id, "DID document id");
+}
+function prepareDocumentForMutation(didDocument, rootKeyId) {
+  const document = cloneDocument(didDocument);
+  validateVnextDocument(document, rootKeyId);
+  const manifest = validateDeviceManifest(document);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required");
+  }
+  for (const entry of manifest.devices) {
+    requireCanonicalWriteProfiles(entry);
+  }
+  delete document.proof;
+  return document;
+}
+function requireCanonicalWriteProfiles(device) {
+  if (device.profiles.some((profile) => LEGACY_DRAFT_FOUNDATION_PROFILES.has(profile))) {
+    throw new DeviceManifestError(
+      "legacy draft foundation profiles are read-only and cannot be published"
+    );
+  }
+}
+function validateVnextDocument(didDocument, rootKeyId) {
+  validateJsonValue(didDocument, "DID document");
+  rejectPrivateKeyMaterial(didDocument, "DID document");
+  const did = documentDid(didDocument);
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    throw new DeviceManifestError("DID document verificationMethod must be an array");
+  }
+  const rootMethods = methods.filter((method) => isPlainObject(method) && method.id === rootKeyId);
+  if (rootMethods.length !== 1 || !isPlainObject(rootMethods[0])) {
+    throw new DeviceManifestError("root key must resolve exactly once in verificationMethod");
+  }
+  const rootIdentity = validateRootMethod(did, rootKeyId, rootMethods[0]);
+  requireRelationship(didDocument, "assertionMethod", rootKeyId, "DID root key");
+  const manifest = validateDeviceManifest(didDocument);
+  if (manifest === null) {
+    throw new DeviceManifestError("deviceManifest is required");
+  }
+  const seenMaterial = /* @__PURE__ */ new Set([rootIdentity.rawPublicKey]);
+  for (const entry of manifest.devices) {
+    if (rootKeyId === entry.signingKeyId || rootKeyId === entry.e2eeKeyId) {
+      throw new DeviceManifestError("DID root key cannot be a device key");
+    }
+    const signingMethod = uniqueMethod(didDocument, entry.signingKeyId);
+    const e2eeMethod = uniqueMethod(didDocument, entry.e2eeKeyId);
+    const [signingIdentity, e2eeIdentity] = validateDeviceMethods(
+      did,
+      rootKeyId,
+      entry,
+      signingMethod,
+      e2eeMethod
+    );
+    requireRelationship(didDocument, "authentication", entry.signingKeyId, "device signing key");
+    requireRelationship(didDocument, "assertionMethod", entry.signingKeyId, "device signing key");
+    requireRelationship(didDocument, "keyAgreement", entry.e2eeKeyId, "device E2EE key");
+    if (relationshipContains(didDocument, "keyAgreement", entry.signingKeyId)) {
+      throw new DeviceManifestError("device signing key must not be in keyAgreement");
+    }
+    if (relationshipContains(didDocument, "authentication", entry.e2eeKeyId) || relationshipContains(didDocument, "assertionMethod", entry.e2eeKeyId)) {
+      throw new DeviceManifestError("device E2EE key must not be a signing relationship");
+    }
+    for (const identity of [signingIdentity, e2eeIdentity]) {
+      if (seenMaterial.has(identity.rawPublicKey)) {
+        throw new DeviceManifestError("root and device public key material must be unique");
+      }
+      seenMaterial.add(identity.rawPublicKey);
+    }
+  }
+}
+function validateRootMethod(did, rootKeyId, verificationMethod) {
+  return validatePublicMethod(
+    did,
+    rootKeyId,
+    verificationMethod,
+    SIGNING_ALGORITHMS,
+    "DID root verification method"
+  );
+}
+function validateDeviceMethods(did, rootKeyId, device, signingMethod, e2eeMethod) {
+  if (rootKeyId === device.signingKeyId || rootKeyId === device.e2eeKeyId) {
+    throw new DeviceManifestError("DID root key cannot be a device key");
+  }
+  const standardObjectProof = device.profiles.some(
+    (profile) => profile === PROFILE_DIRECT_E2EE_V2 || profile === PROFILE_GROUP_E2EE_V2
+  );
+  const signingIdentity = validatePublicMethod(
+    did,
+    device.signingKeyId,
+    signingMethod,
+    standardObjectProof ? /* @__PURE__ */ new Set(["Ed25519"]) : SIGNING_ALGORITHMS,
+    "device signing verification method"
+  );
+  const e2eeIdentity = validatePublicMethod(
+    did,
+    device.e2eeKeyId,
+    e2eeMethod,
+    /* @__PURE__ */ new Set(["X25519"]),
+    "device E2EE verification method"
+  );
+  if (signingIdentity.rawPublicKey === e2eeIdentity.rawPublicKey) {
+    throw new DeviceManifestError("device key material must be unique across roles");
+  }
+  return [signingIdentity, e2eeIdentity];
+}
+function validatePublicMethod(did, expectedKeyId, method, allowedAlgorithms, subject) {
+  if (!isPlainObject(method)) {
+    throw new DeviceManifestError(`${subject} must be an object`);
+  }
+  validateJsonValue(method, subject);
+  if (method.id !== expectedKeyId) {
+    throw new DeviceManifestError(`${subject} id does not match its role`);
+  }
+  if (method.controller !== did) {
+    throw new DeviceManifestError(`${subject} controller must match the DID`);
+  }
+  validateSameDocumentKeyId(did, expectedKeyId);
+  rejectPrivateKeyMaterial(method, subject);
+  const methodType = requireNonEmptyString(method.type, `${subject}.type`);
+  const materialFields = ["publicKeyJwk", "publicKeyMultibase", "publicKeyBase58"].filter(
+    (field) => Object.prototype.hasOwnProperty.call(method, field)
+  );
+  if (materialFields.length !== 1) {
+    throw new DeviceManifestError(`${subject} must contain exactly one supported public key field`);
+  }
+  const materialField = materialFields[0];
+  let identity;
+  if (materialField === "publicKeyJwk") {
+    identity = decodePublicJwk(methodType, method[materialField], subject);
+  } else if (materialField === "publicKeyMultibase") {
+    identity = decodePublicMultikey(methodType, method[materialField], subject);
+  } else {
+    throw new DeviceManifestError(`${subject} publicKeyBase58 is not supported by vNext helpers`);
+  }
+  if (!allowedAlgorithms.has(identity.algorithm)) {
+    throw new DeviceManifestError(`${subject} uses the wrong key algorithm`);
+  }
+  return identity;
+}
+function validateSameDocumentKeyId(did, keyId) {
+  if (!keyId.startsWith(`${did}#`) || keyId === `${did}#`) {
+    throw new DeviceManifestError("key id must be a DID URL in the same document");
+  }
+}
+function decodePublicJwk(methodType, value, subject) {
+  if (methodType !== "JsonWebKey2020" && methodType !== "EcdsaSecp256k1VerificationKey2019" && methodType !== "EcdsaSecp256r1VerificationKey2019") {
+    throw new DeviceManifestError(`${subject} type is incompatible with publicKeyJwk`);
+  }
+  if (!isPlainObject(value)) {
+    throw new DeviceManifestError(`${subject}.publicKeyJwk must be an object`);
+  }
+  const kty = value.kty;
+  const curve = value.crv;
+  if (kty === "OKP" && (curve === "Ed25519" || curve === "X25519")) {
+    if (methodType !== "JsonWebKey2020") {
+      throw new DeviceManifestError(`${subject} type contradicts its JWK`);
+    }
+    const raw = decodeCanonicalBase64url32(value.x, `${subject}.x`);
+    return { algorithm: curve, rawPublicKey: encodeRaw(raw) };
+  }
+  if (kty === "EC" && (curve === "P-256" || curve === "secp256k1")) {
+    const expectedType = curve === "P-256" ? "EcdsaSecp256r1VerificationKey2019" : "EcdsaSecp256k1VerificationKey2019";
+    if (methodType !== "JsonWebKey2020" && methodType !== expectedType) {
+      throw new DeviceManifestError(`${subject} type contradicts its JWK`);
+    }
+    const x = decodeCanonicalBase64url32(value.x, `${subject}.x`);
+    const y = decodeCanonicalBase64url32(value.y, `${subject}.y`);
+    validateEcPoint(curve, x, y, subject);
+    return { algorithm: curve, rawPublicKey: encodeRaw(concatBytes(x, y)) };
+  }
+  throw new DeviceManifestError(`${subject} contains an unsupported public JWK`);
+}
+function decodePublicMultikey(methodType, value, subject) {
+  if (methodType !== "Multikey" && methodType !== "X25519KeyAgreementKey2019") {
+    throw new DeviceManifestError(`${subject} type is incompatible with publicKeyMultibase`);
+  }
+  if (typeof value !== "string" || !value.startsWith("z") || value.length === 1) {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase must be base58btc`);
+  }
+  let decoded;
+  try {
+    decoded = bs58.decode(value.slice(1));
+  } catch (error) {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase is invalid`, error);
+  }
+  if (`z${bs58.encode(decoded)}` !== value) {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase must be canonical`);
+  }
+  if (decoded.length !== 34) {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase must contain a 32-byte key`);
+  }
+  const prefix = decoded[0] * 256 + decoded[1];
+  let algorithm;
+  if (prefix === 60673) {
+    algorithm = "Ed25519";
+  } else if (prefix === 60417) {
+    algorithm = "X25519";
+  } else {
+    throw new DeviceManifestError(`${subject}.publicKeyMultibase uses an unsupported codec`);
+  }
+  if (methodType === "X25519KeyAgreementKey2019" && algorithm !== "X25519") {
+    throw new DeviceManifestError(`${subject} type contradicts its Multikey`);
+  }
+  return { algorithm, rawPublicKey: encodeRaw(decoded.slice(2)) };
+}
+function decodeCanonicalBase64url32(value, subject) {
+  if (typeof value !== "string" || !BASE64URL_RE.test(value)) {
+    throw new DeviceManifestError(`${subject} must be unpadded base64url`);
+  }
+  let decoded;
+  try {
+    decoded = decodeBase64Url(value);
+  } catch (error) {
+    throw new DeviceManifestError(`${subject} is invalid base64url`, error);
+  }
+  const canonical = encodeBase64Url(decoded);
+  if (decoded.length !== 32 || canonical !== value) {
+    throw new DeviceManifestError(`${subject} must canonically encode 32 bytes`);
+  }
+  return decoded;
+}
+function validateEcPoint(curve, x, y, subject) {
+  const uncompressed = new Uint8Array(65);
+  uncompressed[0] = 4;
+  uncompressed.set(x, 1);
+  uncompressed.set(y, 33);
+  try {
+    if (curve === "P-256") {
+      p256.ProjectivePoint.fromHex(uncompressed);
+    } else {
+      secp256k1.ProjectivePoint.fromHex(uncompressed);
+    }
+  } catch (error) {
+    throw new DeviceManifestError(`${subject} contains an invalid EC point`, error);
+  }
+}
+function rejectPrivateKeyMaterial(value, subject) {
+  if (isPlainObject(value)) {
+    for (const [key, nested] of Object.entries(value)) {
+      const normalizedKey = key.toLowerCase().replaceAll("_", "").replaceAll("-", "");
+      if (normalizedKey.includes("privatekey") || key === "d" && "kty" in value) {
+        throw new DeviceManifestError(`${subject} must not contain private key material`);
+      }
+      rejectPrivateKeyMaterial(nested, subject);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const nested of value) {
+      rejectPrivateKeyMaterial(nested, subject);
+    }
+  }
+}
+function validateJsonValue(value, subject) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new DeviceManifestError(`${subject} contains a non-finite number`);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const nested of value) {
+      validateJsonValue(nested, subject);
+    }
+    return;
+  }
+  if (isPlainObject(value)) {
+    for (const [key, nested] of Object.entries(value)) {
+      if (typeof key !== "string") {
+        throw new DeviceManifestError(`${subject} contains a non-string object key`);
+      }
+      validateJsonValue(nested, subject);
+    }
+    return;
+  }
+  throw new DeviceManifestError(`${subject} contains a non-JSON value`);
+}
+function validateRetiredDeviceIds(retiredDeviceIds) {
+  if (typeof retiredDeviceIds === "string") {
+    throw new DeviceManifestError("retired_device_ids must be a string collection");
+  }
+  const values = [];
+  try {
+    for (const deviceId of retiredDeviceIds) {
+      values.push(deviceId);
+    }
+  } catch (error) {
+    throw new DeviceManifestError("retired_device_ids must be a string collection", error);
+  }
+  for (const deviceId of values) {
+    requireNonEmptyString(deviceId, "retired device_id");
+  }
+  return new Set(values);
+}
+function uniqueMethod(didDocument, keyId) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    throw new DeviceManifestError("DID document verificationMethod must be an array");
+  }
+  const matches = methods.filter((method) => isPlainObject(method) && method.id === keyId);
+  if (matches.length !== 1 || !isPlainObject(matches[0])) {
+    throw new DeviceManifestError("key id must resolve exactly once in verificationMethod");
+  }
+  return matches[0];
+}
+function appendDeviceMaterial(document, rootKeyId, device, signingMethod, e2eeMethod) {
+  const did = documentDid(document);
+  validateDeviceMethods(did, rootKeyId, device, signingMethod, e2eeMethod);
+  const methods = document.verificationMethod;
+  const authentication2 = document.authentication;
+  const assertionMethod = document.assertionMethod;
+  const keyAgreement = document.keyAgreement;
+  const manifest = document.deviceManifest;
+  if (!Array.isArray(methods) || !Array.isArray(authentication2) || !Array.isArray(assertionMethod) || !Array.isArray(keyAgreement) || !isPlainObject(manifest) || !Array.isArray(manifest.devices)) {
+    throw new DeviceManifestError("DID document relationships are invalid");
+  }
+  methods.push(structuredClone(signingMethod), structuredClone(e2eeMethod));
+  authentication2.push(device.signingKeyId);
+  assertionMethod.push(device.signingKeyId);
+  keyAgreement.push(device.e2eeKeyId);
+  manifest.devices.push(device.toDict());
+}
+function removeDeviceMaterial(document, device) {
+  const keyIds = /* @__PURE__ */ new Set([device.signingKeyId, device.e2eeKeyId]);
+  const methods = document.verificationMethod;
+  if (!Array.isArray(methods)) {
+    throw new DeviceManifestError("DID document verificationMethod must be an array");
+  }
+  document.verificationMethod = methods.filter(
+    (method) => !(isPlainObject(method) && typeof method.id === "string" && keyIds.has(method.id))
+  );
+  for (const relationship of ["authentication", "assertionMethod", "keyAgreement"]) {
+    const entries = document[relationship];
+    if (!Array.isArray(entries)) {
+      throw new DeviceManifestError(`${relationship} must be an array`);
+    }
+    document[relationship] = entries.filter(
+      (entry) => ![...keyIds].some((keyId) => relationshipEntryIs(entry, keyId))
+    );
+  }
+  const manifest = document.deviceManifest;
+  if (!isPlainObject(manifest) || !Array.isArray(manifest.devices)) {
+    throw new DeviceManifestError("deviceManifest.devices must be an array");
+  }
+  manifest.devices = manifest.devices.filter(
+    (entry) => !(isPlainObject(entry) && entry.device_id === device.deviceId)
+  );
+}
+function relationshipEntryIs(entry, keyId) {
+  return entry === keyId || isPlainObject(entry) && entry.id === keyId;
+}
+function relationshipContains(didDocument, relationship, keyId) {
+  const entries = didDocument[relationship];
+  return Array.isArray(entries) && entries.some((entry) => relationshipEntryIs(entry, keyId));
+}
+function requireExactFields(value, expected, subject) {
+  const actual = new Set(Object.keys(value));
+  if (actual.size !== expected.size || [...expected].some((field) => !actual.has(field))) {
+    throw new DeviceManifestError(
+      `${subject} must contain exactly ${[...expected].sort().join(", ")}`
+    );
+  }
+}
+function requireString(value, subject) {
+  if (typeof value !== "string") {
+    throw new DeviceManifestError(`${subject} must be a string`);
+  }
+  return value;
+}
+function requireNonEmptyString(value, subject) {
+  const result = requireString(value, subject);
+  if (!result) {
+    throw new DeviceManifestError(`${subject} must be a non-empty string`);
+  }
+  return result;
+}
+function validateSameDocumentMethod(did, keyId, methodsById) {
+  if (!keyId.startsWith(`${did}#`) || keyId === `${did}#`) {
+    throw new DeviceManifestError("device key IDs must be DID URLs in the same DID document");
+  }
+  const methods = methodsById.get(keyId) ?? [];
+  if (methods.length !== 1) {
+    throw new DeviceManifestError("device key ID must resolve exactly once in verificationMethod");
+  }
+}
+function requireDependencies(profiles, required, legacyDraft, profileName) {
+  const hasRequired = [...required].every((profile) => profiles.has(profile));
+  const hasLegacy = [...legacyDraft].every((profile) => profiles.has(profile));
+  if (!hasRequired && !hasLegacy) {
+    throw new DeviceManifestError(`${profileName} device profile dependencies are incomplete`);
+  }
+}
+function requireRelationship(didDocument, relationship, keyId, subject) {
+  const entries = didDocument[relationship];
+  if (!Array.isArray(entries)) {
+    throw new DeviceManifestError(`${subject} requires ${relationship}`);
+  }
+  for (const entry of entries) {
+    if (entry === keyId) {
+      return;
+    }
+    if (isPlainObject(entry) && entry.id === keyId) {
+      return;
+    }
+  }
+  throw new DeviceManifestError(`${subject} is not authorized by ${relationship}`);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function encodeRaw(bytes) {
+  return Buffer.from(bytes).toString("hex");
+}
+function concatBytes(left, right) {
+  const output = new Uint8Array(left.length + right.length);
+  output.set(left);
+  output.set(right, left.length);
+  return output;
+}
+
 // src/authentication/index.ts
 var didDocuments = {
   ANP_MESSAGE_SERVICE_TYPE,
@@ -2086,6 +2839,7 @@ var authentication = {
   didDocuments,
   legacyAuth,
   httpSignatures,
+  deviceManifest: device_manifest_exports,
   federation: {
     verifyRequest: verifyFederatedHttpRequest
   },
@@ -2264,12 +3018,206 @@ function isVerificationMethodAuthorized2(didDocument, verificationMethodId, veri
   throw new ProofError(`unsupported verification relationship: ${verificationRelationship}`);
 }
 
+// src/proof/rfc9421-origin.ts
+var rfc9421_origin_exports = {};
+__export(rfc9421_origin_exports, {
+  RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS: () => RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS,
+  RFC9421_ORIGIN_PROOF_DEFAULT_LABEL: () => RFC9421_ORIGIN_PROOF_DEFAULT_LABEL,
+  Rfc9421OriginProofError: () => Rfc9421OriginProofError,
+  TARGET_KIND_AGENT: () => TARGET_KIND_AGENT,
+  TARGET_KIND_GROUP: () => TARGET_KIND_GROUP,
+  TARGET_KIND_SERVICE: () => TARGET_KIND_SERVICE,
+  buildLogicalTargetUri: () => buildLogicalTargetUri,
+  buildRfc9421OriginSignatureBase: () => buildRfc9421OriginSignatureBase,
+  buildSignedRequestObject: () => buildSignedRequestObject,
+  canonicalizeSignedRequestObject: () => canonicalizeSignedRequestObject,
+  generateRfc9421OriginProof: () => generateRfc9421OriginProof,
+  quoteRfc3986Unreserved: () => quoteRfc3986Unreserved,
+  verifyRfc9421OriginProof: () => verifyRfc9421OriginProof
+});
+var RFC9421_ORIGIN_PROOF_DEFAULT_LABEL = "sig1";
+var RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS = IM_PROOF_DEFAULT_COMPONENTS;
+var TARGET_KIND_AGENT = "agent";
+var TARGET_KIND_GROUP = "group";
+var TARGET_KIND_SERVICE = "service";
+var ALLOWED_TARGET_KINDS = /* @__PURE__ */ new Set([TARGET_KIND_AGENT, TARGET_KIND_GROUP, TARGET_KIND_SERVICE]);
+var Rfc9421OriginProofError = class extends ProofError {
+  constructor(message, cause) {
+    super(message, cause);
+    this.name = "Rfc9421OriginProofError";
+  }
+};
+function buildSignedRequestObject(method, meta, body) {
+  if (typeof method !== "string" || !method.trim()) {
+    throw new Rfc9421OriginProofError("method is required");
+  }
+  if (!isPlainObject2(meta)) {
+    throw new Rfc9421OriginProofError("meta must be an object");
+  }
+  if (!isPlainObject2(body)) {
+    throw new Rfc9421OriginProofError("body must be an object");
+  }
+  return {
+    method,
+    meta: cloneJson(meta),
+    body: cloneJson(body)
+  };
+}
+function canonicalizeSignedRequestObject(signedRequestObject) {
+  const keys = Object.keys(signedRequestObject);
+  if (keys.length !== 3 || !keys.includes("method") || !keys.includes("meta") || !keys.includes("body")) {
+    throw new Rfc9421OriginProofError(
+      "signed request object must contain only method, meta, and body"
+    );
+  }
+  return canonicalizeJson({
+    method: signedRequestObject.method,
+    meta: signedRequestObject.meta,
+    body: signedRequestObject.body
+  });
+}
+function buildLogicalTargetUri(targetKind, targetDid) {
+  const normalizedKind = String(targetKind).trim();
+  if (!ALLOWED_TARGET_KINDS.has(normalizedKind)) {
+    throw new Rfc9421OriginProofError(`unsupported target kind: ${targetKind}`);
+  }
+  const normalizedDid = String(targetDid).trim();
+  if (!normalizedDid) {
+    throw new Rfc9421OriginProofError("target did is required");
+  }
+  return `anp://${normalizedKind}/${quoteRfc3986Unreserved(normalizedDid)}`;
+}
+function buildRfc9421OriginSignatureBase(method, logicalTargetUri, contentDigest, signatureInput) {
+  if (typeof method !== "string" || !method.trim()) {
+    throw new Rfc9421OriginProofError("method is required");
+  }
+  if (typeof logicalTargetUri !== "string" || !logicalTargetUri.trim()) {
+    throw new Rfc9421OriginProofError("logical_target_uri is required");
+  }
+  if (typeof contentDigest !== "string" || !contentDigest.trim()) {
+    throw new Rfc9421OriginProofError("content_digest is required");
+  }
+  const parsed = parseImSignatureInput(signatureInput);
+  validateParsedSignatureInput(parsed.label, parsed.components);
+  const componentValues = {
+    "@method": method,
+    "@target-uri": logicalTargetUri,
+    "content-digest": contentDigest
+  };
+  const lines = parsed.components.map(
+    (component) => `"${component}": ${componentValues[component]}`
+  );
+  lines.push(`"@signature-params": ${parsed.signatureParams}`);
+  return new TextEncoder().encode(lines.join("\n"));
+}
+function generateRfc9421OriginProof(method, meta, body, privateKey, keyId, options = {}) {
+  const label = options.label ?? RFC9421_ORIGIN_PROOF_DEFAULT_LABEL;
+  validateLabel(label);
+  const signedRequestObject = buildSignedRequestObject(method, meta, body);
+  const canonicalRequest = canonicalizeSignedRequestObject(signedRequestObject);
+  const logicalTargetUri = buildLogicalTargetUriFromMeta(signedRequestObject.meta);
+  const contentDigest = buildImContentDigest(canonicalRequest);
+  const signatureInput = buildImSignatureInput(keyId, {
+    components: [...RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS],
+    label,
+    created: options.created,
+    expires: options.expires,
+    nonce: options.nonce
+  });
+  const signatureBase = buildRfc9421OriginSignatureBase(
+    method,
+    logicalTargetUri,
+    contentDigest,
+    signatureInput
+  );
+  const proof2 = generateImProof(canonicalRequest, signatureBase, privateKey, keyId, {
+    components: [...RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS],
+    label,
+    created: options.created,
+    expires: options.expires,
+    nonce: options.nonce
+  });
+  const parsed = parseImSignatureInput(proof2.signatureInput);
+  validateParsedSignatureInput(parsed.label, parsed.components);
+  return proof2;
+}
+function verifyRfc9421OriginProof(originProof, method, meta, body, verification = {}) {
+  const signedRequestObject = buildSignedRequestObject(method, meta, body);
+  const canonicalRequest = canonicalizeSignedRequestObject(signedRequestObject);
+  const logicalTargetUri = buildLogicalTargetUriFromMeta(signedRequestObject.meta);
+  const signatureInput = requireProofField(originProof, "signatureInput");
+  const parsed = parseImSignatureInput(signatureInput);
+  validateParsedSignatureInput(parsed.label, parsed.components);
+  const signatureBase = buildRfc9421OriginSignatureBase(
+    method,
+    logicalTargetUri,
+    requireProofField(originProof, "contentDigest"),
+    signatureInput
+  );
+  return verifyImProof(
+    originProof,
+    canonicalRequest,
+    signatureBase,
+    {
+      didDocument: verification.didDocument,
+      verificationMethod: verification.verificationMethod,
+      verificationRelationship: IM_PROOF_RELATION_AUTHENTICATION
+    },
+    verification.options?.expectedSignerDid
+  );
+}
+function buildLogicalTargetUriFromMeta(meta) {
+  const target = meta.target;
+  if (!isPlainObject2(target)) {
+    throw new Rfc9421OriginProofError("meta.target is required");
+  }
+  return buildLogicalTargetUri(String(target.kind), String(target.did));
+}
+function validateLabel(label) {
+  if (label !== RFC9421_ORIGIN_PROOF_DEFAULT_LABEL) {
+    throw new Rfc9421OriginProofError("RFC 9421 origin proof requires signature label sig1");
+  }
+}
+function validateParsedSignatureInput(label, components) {
+  validateLabel(label);
+  const expected = [...RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS];
+  if (components.length !== expected.length || components.some((value, index) => value !== expected[index])) {
+    throw new Rfc9421OriginProofError(
+      'RFC 9421 origin proof requires covered components ("@method" "@target-uri" "content-digest")'
+    );
+  }
+}
+function requireProofField(proof2, field) {
+  const value = proof2[field];
+  if (!value) {
+    throw new Rfc9421OriginProofError(`missing proof field: ${field}`);
+  }
+  return value;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function quoteRfc3986Unreserved(value) {
+  let output = "";
+  for (const char of value) {
+    if (/[A-Za-z0-9\-._~]/.test(char)) {
+      output += char;
+      continue;
+    }
+    for (const byte of new TextEncoder().encode(char)) {
+      output += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+  }
+  return output;
+}
+
 // src/proof/index.ts
 var proof = {
   create: generateW3cProof,
   verify: verifyW3cProof,
   verifyDetailed: verifyW3cProofDetailed,
-  im: im_exports
+  im: im_exports,
+  rfc9421: rfc9421_origin_exports
 };
 
 // src/wns/types.ts
@@ -4863,6 +5811,6 @@ function isBareDomainDidWba(value) {
   return normalized.startsWith(prefix) && isDomainName(normalized.slice(prefix.length));
 }
 
-export { ANPError, ANP_HANDLE_SERVICE_TYPE, ANP_MESSAGE_SERVICE_TYPE, AuthMode, AuthenticationError, AwikiImError, CRYPTOSUITE_DIDWBA_SECP256K1_2025, CRYPTOSUITE_EDDSA_JCS_2022, CryptoError, DIDWbaAuthHeader, DIDWbaAuthHeader as DidAuthHeaders, DidProfile, DidWbaVerifier, DidWbaVerifierError, HandleBindingError, HandleGoneError, HandleMovedError, HandleNotFoundError, HandleResolutionError, HandleStatus, HandleValidationError, IM_PROOF_DEFAULT_COMPONENTS, IM_PROOF_RELATION_ASSERTION_METHOD, IM_PROOF_RELATION_AUTHENTICATION, NetworkError, PROOF_TYPE_DATA_INTEGRITY, PROOF_TYPE_ED25519, PROOF_TYPE_SECP256K1, ProofError, DidWbaVerifier as RequestVerifier, DidWbaVerifierError as RequestVerifierError, SubjectType, VM_KEY_AUTH, VM_KEY_E2EE_AGREEMENT, VM_KEY_E2EE_SIGNING, VerificationMethod, WbaUriParseError, WnsError, authentication, buildAgentMessageService, buildAnpMessageService, buildContentDigest, buildGroupMessageService, buildHandleServiceEntry, buildImContentDigest, buildImSignatureInput, buildResolutionUrl, buildWbaUri as buildUri, buildWbaUri, canonicalizeBindingGeneration, compareBindingGenerations, computeJwkFingerprint, computeMultikeyFingerprint, createAwikiImClient, createDidWbaDocument as createDidDocument, createDidWbaDocumentWithKeyBinding as createDidDocumentWithKeyBinding, createDidWbaDocument, createDidWbaDocumentWithKeyBinding, buildHandleServiceEntry as createHandleServiceEntry, generateAuthHeader as createLegacyAuthHeader, generateAuthJson as createLegacyAuthPayload, generateW3cProof as createProof, generateHttpSignatureHeaders as createSignatureHeaders, createVerificationMethod, decodeImSignature, didDocuments, encodeImSignature, extractAuthHeaderParts, extractHandleServiceFromDidDocument, extractHandleServiceFromDidDocument as extractHandleServices, extractPublicKey, extractSignatureMetadata, findVerificationMethod, generateAuthHeader, generateAuthJson, generateHttpSignatureHeaders, generateImProof, generateW3cProof, httpSignatures, isAssertionMethodAuthorized, isAuthenticationAuthorized, legacyAuth, normalizeHandle, parseImSignatureInput, extractAuthHeaderParts as parseLegacyAuthHeader, extractSignatureMetadata as parseSignatureMetadata, parseWbaUri as parseUri, parseWbaUri, proof, resolveDidDocument, resolveDidWbaDocument, resolveHandle, resolveHandleFromUri, resolveHandleFromUri as resolveUri, validateDidDocumentBinding as validateDidBinding, validateDidDocumentBinding, validateHandle, validateLocalPart, verifyAuthHeaderSignature, verifyAuthJsonSignature, verifyHandleBinding as verifyBinding, verifyContentDigest, verifyDidKeyBinding as verifyDidBinding, verifyDidKeyBinding, verifyFederatedHttpRequest, verifyHandleBinding, verifyHttpMessageSignature, verifyImContentDigest, verifyImProof, verifyAuthHeaderSignature as verifyLegacyAuthHeader, verifyAuthJsonSignature as verifyLegacyAuthPayload, verifyW3cProof as verifyProof, verifyW3cProofDetailed as verifyProofDetailed, verifyHttpMessageSignature as verifySignatureHeaders, verifyW3cProof, verifyW3cProofDetailed, wns };
+export { ANPError, ANP_HANDLE_SERVICE_TYPE, ANP_MESSAGE_SERVICE_TYPE, AuthMode, AuthenticationError, AwikiImError, CRYPTOSUITE_DIDWBA_SECP256K1_2025, CRYPTOSUITE_EDDSA_JCS_2022, CryptoError, DEVICE_MANIFEST_TYPE, DIDWbaAuthHeader, DeviceManifest, DeviceManifestEntry, DeviceManifestError, DIDWbaAuthHeader as DidAuthHeaders, DidProfile, DidWbaVerifier, DidWbaVerifierError, HandleBindingError, HandleGoneError, HandleMovedError, HandleNotFoundError, HandleResolutionError, HandleStatus, HandleValidationError, IM_PROOF_DEFAULT_COMPONENTS, IM_PROOF_RELATION_ASSERTION_METHOD, IM_PROOF_RELATION_AUTHENTICATION, NetworkError, PROFILE_CORE_BINDING_V1, PROFILE_CORE_BINDING_V2, PROFILE_DIRECT_BASE_V1, PROFILE_DIRECT_BASE_V2, PROFILE_DIRECT_E2EE_V2, PROFILE_GROUP_BASE_V1, PROFILE_GROUP_BASE_V2, PROFILE_GROUP_E2EE_V2, PROFILE_IDENTITY_DISCOVERY_V1, PROFILE_IDENTITY_DISCOVERY_V2, PROOF_TYPE_DATA_INTEGRITY, PROOF_TYPE_ED25519, PROOF_TYPE_SECP256K1, ProofError, RFC9421_ORIGIN_PROOF_DEFAULT_COMPONENTS, RFC9421_ORIGIN_PROOF_DEFAULT_LABEL, DidWbaVerifier as RequestVerifier, DidWbaVerifierError as RequestVerifierError, Rfc9421OriginProofError, SubjectType, TARGET_KIND_AGENT, TARGET_KIND_GROUP, TARGET_KIND_SERVICE, VM_KEY_AUTH, VM_KEY_E2EE_AGREEMENT, VM_KEY_E2EE_SIGNING, VerificationMethod, WbaUriParseError, WnsError, addDeviceToDidDocument, authentication, buildAgentMessageService, buildAnpMessageService, buildContentDigest, buildGroupMessageService, buildHandleServiceEntry, buildImContentDigest, buildImSignatureInput, buildLogicalTargetUri, buildResolutionUrl, buildRfc9421OriginSignatureBase, buildSignedRequestObject, buildWbaUri as buildUri, buildVnextDidDocument, buildWbaUri, canonicalizeBindingGeneration, canonicalizeSignedRequestObject, compareBindingGenerations, computeJwkFingerprint, computeMultikeyFingerprint, createAwikiImClient, createDidWbaDocument as createDidDocument, createDidWbaDocumentWithKeyBinding as createDidDocumentWithKeyBinding, createDidWbaDocument, createDidWbaDocumentWithKeyBinding, buildHandleServiceEntry as createHandleServiceEntry, generateAuthHeader as createLegacyAuthHeader, generateAuthJson as createLegacyAuthPayload, generateW3cProof as createProof, generateHttpSignatureHeaders as createSignatureHeaders, createVerificationMethod, decodeImSignature, didDocuments, encodeImSignature, extractAuthHeaderParts, extractHandleServiceFromDidDocument, extractHandleServiceFromDidDocument as extractHandleServices, extractPublicKey, extractSignatureMetadata, findEligibleDevice, findVerificationMethod, generateAuthHeader, generateAuthJson, generateHttpSignatureHeaders, generateImProof, generateRfc9421OriginProof, generateW3cProof, httpSignatures, isAssertionMethodAuthorized, isAuthenticationAuthorized, legacyAuth, normalizeHandle, parseDeviceManifest, parseImSignatureInput, extractAuthHeaderParts as parseLegacyAuthHeader, extractSignatureMetadata as parseSignatureMetadata, parseWbaUri as parseUri, parseWbaUri, proof, quoteRfc3986Unreserved, removeDeviceFromDidDocument, resolveDidDocument, resolveDidWbaDocument, resolveHandle, resolveHandleFromUri, resolveHandleFromUri as resolveUri, updateDeviceInDidDocument, validateDeviceManifest, validateDidDocumentBinding as validateDidBinding, validateDidDocumentBinding, validateHandle, validateLocalPart, verifyAuthHeaderSignature, verifyAuthJsonSignature, verifyHandleBinding as verifyBinding, verifyContentDigest, verifyDidKeyBinding as verifyDidBinding, verifyDidKeyBinding, verifyFederatedHttpRequest, verifyHandleBinding, verifyHttpMessageSignature, verifyImContentDigest, verifyImProof, verifyAuthHeaderSignature as verifyLegacyAuthHeader, verifyAuthJsonSignature as verifyLegacyAuthPayload, verifyW3cProof as verifyProof, verifyW3cProofDetailed as verifyProofDetailed, verifyRfc9421OriginProof, verifyHttpMessageSignature as verifySignatureHeaders, verifyW3cProof, verifyW3cProofDetailed, wns };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map