@codespar/cli 0.14.0 → 0.16.0

package/dist/commands/mandate-verify.js

@@ -1,13 +1,37 @@
 import { CliError } from "../config.js";
 import { c, info, json, kv, success, warn } from "../output.js";
 import { agentDidFromKid, decodeToken, parsePubkeyHex, reconstructSigningString, verifyEd25519, } from "../mandate-codec.js";
-import { resolveDidKeys } from "../did.js";
-/** did:web platform issuer DID derived from an agent DID's host segment. */
+import { DidConfigError, didWebParts, parseBaseUrl, parseIdentityHost, resolveDidKeys, } from "../did.js";
+/** did:web platform issuer DID: the agent DID's validated host segment, alone. */
 function platformIssuerDid(agentDid) {
-    if (!agentDid.startsWith("did:web:"))
-        return null;
-    const host = agentDid.slice("did:web:".length).split(":")[0];
-    return host ? `did:web:${host}` : null;
+    const parts = didWebParts(agentDid);
+    return parts ? `did:web:${parts.hostSegment}` : null;
+}
+/**
+ * Say on stderr when a key did not come from the DID's own domain. A resolver
+ * is a third party the user opted into; the API route is the deployment's own
+ * service answering for its own domain. Either way the user should see that
+ * the domain itself did not answer.
+ */
+function announceSource(did, resolved) {
+    if (resolved.source === "resolver") {
+        warn(`${did}: keys came from the resolver at ${resolved.tried[resolved.tried.length - 1]}, ` +
+            `not from the domain's did:web document`);
+    }
+    else if (resolved.source === "fallback") {
+        info(`${did}: did:web document unreachable; keys came from the API's DID route`);
+    }
+}
+/** Turn a configuration error from the DID layer into a CliError naming the flag. */
+function cliConfig(flag, fn) {
+    try {
+        return fn();
+    }
+    catch (err) {
+        if (err instanceof DidConfigError)
+            throw new CliError(`${flag}: ${err.message}.`);
+        throw err;
+    }
 }
 /** Try a signature against a set of candidate keys; first hit wins. */
 function verifyAgainst(signingString, sig, keys) {
@@ -25,7 +49,11 @@ function verifyAgainst(signingString, sig, keys) {
  * Offline mode (any --agent-pubkey / --issuer-pubkey given): verify the named
  * signatures against the supplied raw Ed25519 keys with zero network calls.
  * Network mode (no pubkey flags): resolve the agent + issuer public keys from
- * their did:web documents (standard route, api.codespar.dev fallback) and verify.
+ * their did:web documents and verify. The domain named in the DID is the
+ * authority; the configured API's DID route is consulted only for a DID under
+ * one of the deployment's identity hosts whose document is unreachable, and
+ * `--resolver <url>` opts into a resolver for any DID, announced on stderr
+ * when it is the source. The two DIDs resolve in parallel.
  *
  * A signature the token carries must verify for an overall pass. In offline mode
  * a signature with no supplied key is "skipped" (not proven, not failed); at
@@ -50,8 +78,28 @@ export async function mandateVerifyCommand(token, opts) {
     const offline = Boolean(opts.agentPubkey || opts.issuerPubkey);
     const agentKid = t.kid ?? m.agent_kid ?? undefined;
     const agentDid = agentKid ? agentDidFromKid(agentKid) : undefined;
+    const issuerDid = opts.issuerDid ?? (agentDid ? platformIssuerDid(agentDid) : null);
+    // Validate every URL and host before any request, so a typo is a CliError
+    // and never a rejection inside the parallel resolution below.
+    const resolverUrl = opts.resolver === undefined
+        ? undefined
+        : cliConfig("--resolver", () => parseBaseUrl(opts.resolver, "--resolver").toString());
+    const didDomains = (opts.didDomains ?? []).map((h) => cliConfig("--did-domain", () => parseIdentityHost(h)));
+    if (!offline)
+        cliConfig("--base-url", () => parseBaseUrl(opts.baseUrl, "--base-url"));
+    // Network mode resolves both DIDs at once: sequentially, two unreachable
+    // documents with a resolver and a fallback each are four timeouts in a row.
+    const resolveOpts = { baseUrl: opts.baseUrl, resolverUrl, didDomains };
+    const [agentResolved, issuerResolved] = offline
+        ? [null, null]
+        : await Promise.all([
+            t.agent_sig && agentDid
+                ? resolveDidKeys(agentDid, { ...resolveOpts, preferredKid: agentKid })
+                : null,
+            t.issuer_sig && issuerDid ? resolveDidKeys(issuerDid, resolveOpts) : null,
+        ]);
     // ── Agent signature ──────────────────────────────────────────────
-    const agent = { present: Boolean(t.agent_sig), status: "skipped", source: "-" };
+    const agent = { present: Boolean(t.agent_sig), status: "skipped", source: null };
     if (t.agent_sig) {
         if (offline) {
             if (opts.agentPubkey) {
@@ -69,22 +117,21 @@ export async function mandateVerifyCommand(token, opts) {
             }
         }
         else {
-            agent.source = "did:web";
-            if (!agentDid) {
+            if (!agentDid || !agentResolved) {
                 agent.status = "failed";
+                agent.source = null;
                 agent.detail = "token carries no agent_kid to resolve";
             }
             else {
-                const keys = await resolveDidKeys(agentDid, {
-                    baseUrl: opts.baseUrl,
-                    preferredKid: agentKid,
-                });
-                if (keys.length === 0) {
+                const resolved = agentResolved;
+                agent.source = resolved.source;
+                if (resolved.keys.length === 0) {
                     agent.status = "failed";
-                    agent.detail = `could not resolve ${agentDid}`;
+                    agent.detail = `could not resolve ${agentDid}: ${resolved.detail}`;
                 }
                 else {
-                    const hit = verifyAgainst(signingString, t.agent_sig, keys);
+                    announceSource(agentDid, resolved);
+                    const hit = verifyAgainst(signingString, t.agent_sig, resolved.keys);
                     agent.status = hit ? "verified" : "failed";
                     agent.kid = hit?.kid ?? agentKid;
                 }
@@ -92,7 +139,7 @@ export async function mandateVerifyCommand(token, opts) {
         }
     }
     // ── Issuer signature ─────────────────────────────────────────────
-    const issuer = { present: Boolean(t.issuer_sig), status: "skipped", source: "-" };
+    const issuer = { present: Boolean(t.issuer_sig), status: "skipped", source: null };
     if (t.issuer_sig) {
         if (offline) {
             if (opts.issuerPubkey) {
@@ -109,22 +156,23 @@ export async function mandateVerifyCommand(token, opts) {
             }
         }
         else {
-            issuer.source = "did:web";
-            const issuerDid = opts.issuerDid ?? (agentDid ? platformIssuerDid(agentDid) : null);
-            if (!issuerDid) {
+            if (!issuerDid || !issuerResolved) {
                 issuer.status = "failed";
+                issuer.source = null;
                 issuer.detail = "no issuer DID (pass --issuer-did)";
             }
             else {
                 // The envelope names the agent kid, not the issuer's, so try every
                 // Ed25519 key the issuer document publishes.
-                const keys = await resolveDidKeys(issuerDid, { baseUrl: opts.baseUrl });
-                if (keys.length === 0) {
+                const resolved = issuerResolved;
+                issuer.source = resolved.source;
+                if (resolved.keys.length === 0) {
                     issuer.status = "failed";
-                    issuer.detail = `could not resolve ${issuerDid}`;
+                    issuer.detail = `could not resolve ${issuerDid}: ${resolved.detail}`;
                 }
                 else {
-                    const hit = verifyAgainst(signingString, t.issuer_sig, keys);
+                    announceSource(issuerDid, resolved);
+                    const hit = verifyAgainst(signingString, t.issuer_sig, resolved.keys);
                     issuer.status = hit ? "verified" : "failed";
                     issuer.kid = hit?.kid;
                 }
@@ -216,7 +264,7 @@ function sigLine(r) {
     const bits = [statusMark(r.status)];
     if (r.kid)
         bits.push(c.gray(`kid ${r.kid}`));
-    if (r.source && r.source !== "-")
+    if (r.source)
         bits.push(c.gray(`via ${r.source}`));
     if (r.detail)
         bits.push(c.gray(`(${r.detail})`));
@@ -227,7 +275,7 @@ function sigJson(r) {
         present: r.present,
         status: r.present ? r.status : "absent",
         kid: r.kid ?? null,
-        source: r.source === "-" ? null : r.source,
+        source: r.source,
         detail: r.detail ?? null,
     };
 }

package/dist/commands/mandate-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"mandate-verify.js","sourceRoot":"","sources":["../../src/commands/mandate-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,wBAAwB,EACxB,aAAa,GAEd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAe,MAAM,WAAW,CAAC;AAyBxD,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CACpB,aAAqB,EACrB,GAAW,EACX,IAAc;IAEd,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,aAAa,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,IAA0B;IAE1B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,OAAO,CAAC,KAAK,KAAK,4BAA4B;YAC5C,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,yEAAyE,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAiB,OAAO,CAAC,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,MAAM,aAAa,GAAG,wBAAwB,CAAC,CAAuC,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAElE,oEAAoE;IACpE,MAAM,KAAK,GAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC3F,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,QAAQ,CAAC,kEAAkE,CAAC,CAAC;gBACjG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;gBACtB,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACpG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3C,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;gBACzB,KAAK,CAAC,MAAM,GAAG,4BAA4B,CAAC;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;gBACxB,KAAK,CAAC,MAAM,GAAG,uCAAuC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE;oBAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,YAAY,EAAE,QAAQ;iBACvB,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;oBACxB,KAAK,CAAC,MAAM,GAAG,qBAAqB,QAAQ,EAAE,CAAC;gBACjD,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC5D,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAC3C,KAAK,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,QAAQ,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC7F,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACjB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,QAAQ,CAAC,mEAAmE,CAAC,CAAC;gBAClG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBACvB,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;gBAC1B,MAAM,CAAC,MAAM,GAAG,6BAA6B,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;gBACzB,MAAM,CAAC,MAAM,GAAG,mCAAmC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,6CAA6C;gBAC7C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;oBACzB,MAAM,CAAC,MAAM,GAAG,qBAAqB,SAAS,EAAE,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;oBAC7D,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAC5C,MAAM,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;IAC1E,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,SAAS,CAAC;IAE3C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAEzF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC;YACH,QAAQ;YACR,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACrC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,UAAU,EAAE;gBACV,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC;gBACzB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC;aAC5B;YACD,OAAO,EAAE;gBACP,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,QAAQ,IAAI,IAAI;gBAC3B,GAAG,EAAE,QAAQ,IAAI,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;gBAChC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC9B,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;gBACpC,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,yEAAyE;gBACzE,yBAAyB,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACvD,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,cAAc,EAAE,UAAU;gBAC1B,OAAO;gBACP,cAAc,EAAE,CAAC,CAAC,cAAc;aACjC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,IAAI,QAAQ;QAAE,OAAO,CAAC,2BAA2B,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC;;QACrF,IAAI,CAAC,+BAA+B,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC;IAElF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/C,EAAE,CAAC;QACD,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;KAChC,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,EAAE,CAAC;QACD,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACZ,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;QACxB,CAAC,WAAW,EAAE,QAAQ,IAAI,QAAQ,CAAC;QACnC,CAAC,KAAK,EAAE,QAAQ,IAAI,QAAQ,CAAC;QAC7B,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,eAAe,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7D;YACE,YAAY;YACZ,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;SAC/G;QACD,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,qHAAqH,CAAC,CAAC;QAC5H,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,CAAY;IAC3B,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,OAAO,CAAC,CAAY;IAC3B,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACvC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;KACzB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mandate-verify.js","sourceRoot":"","sources":["../../src/commands/mandate-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,wBAAwB,EACxB,aAAa,GAEd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,cAAc,GAIf,MAAM,WAAW,CAAC;AAgCnB,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,QAAuB;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,IAAI,CACF,GAAG,GAAG,oCAAoC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI;YACrF,wCAAwC,CAC3C,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,oEAAoE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAI,IAAY,EAAE,EAAW;IAC7C,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc;YAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CACpB,aAAqB,EACrB,GAAW,EACX,IAAc;IAEd,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,aAAa,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,IAA0B;IAE1B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,OAAO,CAAC,KAAK,KAAK,4BAA4B;YAC5C,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,yEAAyE,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAiB,OAAO,CAAC,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,MAAM,aAAa,GAAG,wBAAwB,CAAC,CAAuC,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpF,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,WAAW,GACf,IAAI,CAAC,QAAQ,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnD,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CACtD,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAEtF,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,WAAW,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACvE,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,GAAG,OAAO;QAC7C,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;QACd,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,CAAC,CAAC,SAAS,IAAI,QAAQ;gBACrB,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;gBACtE,CAAC,CAAC,IAAI;YACR,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;SAC1E,CAAC,CAAC;IAEP,oEAAoE;IACpE,MAAM,KAAK,GAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5F,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,QAAQ,CAAC,kEAAkE,CAAC,CAAC;gBACjG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;gBACtB,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACpG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3C,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;gBACzB,KAAK,CAAC,MAAM,GAAG,4BAA4B,CAAC;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;gBACxB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;gBACpB,KAAK,CAAC,MAAM,GAAG,uCAAuC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,aAAa,CAAC;gBAC/B,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC/B,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;oBACxB,KAAK,CAAC,MAAM,GAAG,qBAAqB,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACrE,CAAC;qBAAM,CAAC;oBACN,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACnC,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACrE,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAC3C,KAAK,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,QAAQ,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9F,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACjB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,QAAQ,CAAC,mEAAmE,CAAC,CAAC;gBAClG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBACvB,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;gBAC1B,MAAM,CAAC,MAAM,GAAG,6BAA6B,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;gBACzB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;gBACrB,MAAM,CAAC,MAAM,GAAG,mCAAmC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,6CAA6C;gBAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC;gBAChC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;oBACzB,MAAM,CAAC,MAAM,GAAG,qBAAqB,SAAS,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;oBACpC,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACtE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAC5C,MAAM,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;IAC1E,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,SAAS,CAAC;IAE3C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAEzF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC;YACH,QAAQ;YACR,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACrC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,UAAU,EAAE;gBACV,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC;gBACzB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC;aAC5B;YACD,OAAO,EAAE;gBACP,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,QAAQ,IAAI,IAAI;gBAC3B,GAAG,EAAE,QAAQ,IAAI,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;gBAChC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC9B,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;gBACpC,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,yEAAyE;gBACzE,yBAAyB,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACvD,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,cAAc,EAAE,UAAU;gBAC1B,OAAO;gBACP,cAAc,EAAE,CAAC,CAAC,cAAc;aACjC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,IAAI,QAAQ;QAAE,OAAO,CAAC,2BAA2B,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC;;QACrF,IAAI,CAAC,+BAA+B,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC;IAElF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/C,EAAE,CAAC;QACD,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;KAChC,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,EAAE,CAAC;QACD,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACZ,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;QACxB,CAAC,WAAW,EAAE,QAAQ,IAAI,QAAQ,CAAC;QACnC,CAAC,KAAK,EAAE,QAAQ,IAAI,QAAQ,CAAC;QAC7B,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,eAAe,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7D;YACE,YAAY;YACZ,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;SAC/G;QACD,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,qHAAqH,CAAC,CAAC;QAC5H,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,CAAY;IAC3B,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,OAAO,CAAC,CAAY;IAC3B,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACvC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;KACzB,CAAC;AACJ,CAAC"}

package/dist/config.js

@@ -1,6 +1,17 @@
 import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { DEFAULT_BASE_URL } from "./did.js";
+/** Split a comma-separated env value into trimmed, non-empty entries. */
+export function parseDidDomains(raw) {
+    if (!raw)
+        return undefined;
+    const list = raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    return list.length > 0 ? list : undefined;
+}
 const CONFIG_DIR = join(homedir(), ".codespar");
 const CONFIG_FILE = join(CONFIG_DIR, "config.json");
 export async function loadConfig() {
@@ -12,6 +23,7 @@ export async function loadConfig() {
         apiKey: process.env.CODESPAR_API_KEY || undefined,
         project: process.env.CODESPAR_PROJECT || undefined,
         baseUrl: process.env.CODESPAR_BASE_URL || undefined,
+        didDomains: parseDidDomains(process.env.CODESPAR_DID_DOMAINS),
     };
     let fromFile = {};
     try {
@@ -25,7 +37,11 @@ export async function loadConfig() {
     return {
         apiKey: fromEnv.apiKey ?? fromFile.apiKey,
         project: fromEnv.project ?? fromFile.project,
-        baseUrl: fromEnv.baseUrl ?? fromFile.baseUrl ?? "https://api.codespar.dev",
+        baseUrl: fromEnv.baseUrl ?? fromFile.baseUrl ?? DEFAULT_BASE_URL,
+        didDomains: fromEnv.didDomains ??
+            (Array.isArray(fromFile.didDomains)
+                ? fromFile.didDomains.filter((h) => typeof h === "string")
+                : undefined),
     };
 }
 export async function saveConfig(patch) {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiB1C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,mEAAmE;IACnE,2EAA2E;IAC3E,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,OAAO,GAAc;QACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;QACjD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;QAClD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS;KACpD,CAAC;IAEF,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,yEAAyE;IACzE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,0BAA0B;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAyB;IACxD,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvD,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAc,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,aAAa;IACf,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5E,qDAAqD;IACrD,MAAM,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAChB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC;;;;OAIG;IACM,IAAI,CAAU;IAEvB,YAAY,OAAe,EAAE,OAA0B,EAAE;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAyB5C,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,mEAAmE;IACnE,2EAA2E;IAC3E,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,OAAO,GAAc;QACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;QACjD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;QAClD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS;QACnD,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;KAC9D,CAAC;IAEF,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,yEAAyE;IACzE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,gBAAgB;QAChE,UAAU,EACR,OAAO,CAAC,UAAU;YAClB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACjC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACvE,CAAC,CAAC,SAAS,CAAC;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAyB;IACxD,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvD,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAc,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,aAAa;IACf,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5E,qDAAqD;IACrD,MAAM,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAChB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC;;;;OAIG;IACM,IAAI,CAAU;IAEvB,YAAY,OAAe,EAAE,OAA0B,EAAE;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;CACF"}

package/dist/did.js

@@ -3,40 +3,194 @@
  * document and extracts its raw Ed25519 public keys so the codec can verify a
  * presentation token's signatures.
  *
- * Resolution order (per the rollout in progress): try the standard did:web URL
- * mapping first, then fall back to the api.codespar.dev encoded route that
- * serves the same document today.
+ * The standard did:web URL mapping is the authority for every DID. Two other
+ * sources exist, and each is scoped:
+ *
+ *   - the API's `/v1/agents/<did>/did.json` route (the base URL the CLI is
+ *     configured with) is consulted only for a DID whose host is one of the
+ *     deployment's identity hosts — an explicit list, never derived from the
+ *     base URL's domain labels — and only when the standard document could
+ *     not be fetched. A DID under another host never falls back there: a
+ *     runtime must not become the authority over an identity it does not own.
+ *   - an explicit resolver (`--resolver <url>`) is consulted for any DID whose
+ *     standard document could not be fetched. It is opt-in and additive: a
+ *     miss there still falls through to the identity-host rule. The result
+ *     says where the keys came from so the caller can say so too.
+ *
+ * A standard document that was fetched but carries no Ed25519 key is the
+ * domain owner's answer, not an absence: no other source is consulted.
  *
  * Zero runtime deps — global `fetch` and the standard library only. Kept out of
  * `mandate-codec.ts` so the offline verifier path stays pure and network-free.
  */
+/** The base URL the CLI ships pointed at, whose identity host is known. */
+export const DEFAULT_BASE_URL = "https://api.codespar.dev";
+const DEFAULT_IDENTITY_HOST = "id.codespar.dev";
+/** A configuration value this module cannot work with: a URL or host that is not one. */
+export class DidConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DidConfigError";
+    }
+}
+/** A host: a DNS name or a bracketed IPv6 literal. No port, no path. */
+const HOST_RE = /^([a-z0-9.-]+|\[[0-9a-f:.]+\])$/;
+/** A did:web host segment after decoding: a host with an optional port. */
+const AUTHORITY_RE = /^([a-z0-9.-]+|\[[0-9a-f:.]+\])(:\d+)?$/;
+function decodeSegment(segment) {
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return null;
+    }
+}
 /**
- * Map a `did:web` identifier to its standard document URL.
- *   did:web:id.codespar.dev            → https://id.codespar.dev/.well-known/did.json
- *   did:web:id.codespar.dev:org:agent  → https://id.codespar.dev/org/agent/did.json
- * Colon-separated path segments become URL path segments; a `%3A` in the domain
- * segment decodes to a port. Returns null for a non-did:web input.
+ * Parse and validate a `did:web` identifier. The first segment must
+ * percent-decode to a host with an optional port (a decoded `/`, `@`, `?` or
+ * the like is rejected — `did:web:evil.example%2F.trusted.example` names no
+ * host); every path segment must decode to a non-empty name that is not `.`
+ * or `..` and carries no `/`, so no DID maps to a URL outside its own path.
+ * Null for a non-did:web or malformed input, including invalid
+ * percent-encoding.
  */
-export function didWebToUrl(did) {
+export function didWebParts(did) {
     if (!did.startsWith("did:web:"))
         return null;
     const rest = did.slice("did:web:".length);
     if (rest.length === 0)
         return null;
     const segments = rest.split(":");
-    const domain = decodeURIComponent(segments[0]);
-    const path = segments.slice(1).map((s) => decodeURIComponent(s));
-    if (path.length === 0) {
-        return `https://${domain}/.well-known/did.json`;
+    const hostSegment = segments[0];
+    const first = decodeSegment(hostSegment);
+    if (first === null)
+        return null;
+    const authority = first.toLowerCase();
+    if (!AUTHORITY_RE.test(authority))
+        return null;
+    const path = [];
+    for (const seg of segments.slice(1)) {
+        const decoded = decodeSegment(seg);
+        if (decoded === null || decoded.length === 0 || decoded === "." || decoded === "..") {
+            return null;
+        }
+        if (decoded.includes("/"))
+            return null;
+        path.push(decoded);
     }
-    return `https://${domain}/${path.join("/")}/did.json`;
+    return { host: authority.replace(/:\d+$/, ""), authority, hostSegment, path };
+}
+/** The host of a `did:web` identifier (see {@link didWebParts}); null when malformed. */
+export function didWebHost(did) {
+    return didWebParts(did)?.host ?? null;
 }
-/** The api.codespar.dev fallback route that serves the DID doc today. */
+/**
+ * Map a `did:web` identifier to its standard document URL.
+ *   did:web:id.codespar.dev            → https://id.codespar.dev/.well-known/did.json
+ *   did:web:id.codespar.dev:org:agent  → https://id.codespar.dev/org/agent/did.json
+ * Colon-separated path segments become URL path segments; a `%3A` in the domain
+ * segment decodes to a port. Returns null for a non-did:web or malformed input
+ * (see {@link didWebParts}).
+ */
+export function didWebToUrl(did) {
+    const parts = didWebParts(did);
+    if (!parts)
+        return null;
+    if (parts.path.length === 0) {
+        return `https://${parts.authority}/.well-known/did.json`;
+    }
+    return `https://${parts.authority}/${parts.path.map(encodeURIComponent).join("/")}/did.json`;
+}
+/**
+ * Parse a base URL the way the rest of the CLI does: only its origin counts,
+ * a path on it is ignored. Throws {@link DidConfigError} when it is not an
+ * absolute http(s) URL.
+ */
+export function parseBaseUrl(raw, what = "base URL") {
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        throw new DidConfigError(`${what} must be an absolute http(s) URL, got ${JSON.stringify(raw)}`);
+    }
+    if (u.protocol !== "https:" && u.protocol !== "http:") {
+        throw new DidConfigError(`${what} must be an http(s) URL, got ${u.protocol}//`);
+    }
+    return u;
+}
+/**
+ * The `/v1/agents/<did>/did.json` route at a base URL's origin. A path on the
+ * base URL is ignored, as every other CLI request ignores it.
+ */
 export function apiFallbackUrl(did, baseUrl) {
-    const base = baseUrl.replace(/\/+$/, "");
-    return `${base}/v1/agents/${encodeURIComponent(did)}/did.json`;
+    const origin = parseBaseUrl(baseUrl).origin;
+    return `${origin}/v1/agents/${encodeURIComponent(did)}/did.json`;
+}
+/**
+ * Normalise a configured identity host: a bare host or a URL, lowercased,
+ * without scheme, port, path or trailing slash. Throws {@link DidConfigError}
+ * when what remains is not a host.
+ */
+export function parseIdentityHost(raw) {
+    let value = raw.trim().toLowerCase();
+    if (value.includes("://")) {
+        try {
+            value = new URL(value).hostname;
+        }
+        catch {
+            throw new DidConfigError(`identity host must be a host or URL, got ${JSON.stringify(raw)}`);
+        }
+    }
+    else {
+        value = value.replace(/\/.*$/, "");
+        if (!value.startsWith("["))
+            value = value.replace(/:\d+$/, "");
+        else
+            value = value.replace(/\](:\d+)?$/, "]");
+    }
+    if (!HOST_RE.test(value)) {
+        throw new DidConfigError(`identity host must be a host or URL, got ${JSON.stringify(raw)}`);
+    }
+    return value;
+}
+/**
+ * The hosts whose DID documents the API at `baseUrl` may serve: the API's own
+ * host, exactly; `id.codespar.dev` only when the base URL is the shipped
+ * default; and whatever the caller configured (`--did-domain`, config
+ * `didDomains`). Nothing is derived from domain labels — with
+ * `https://runtime.com.br` that would make every `did:web:*.com.br` the
+ * runtime's own. Throws {@link DidConfigError} on a base URL or configured
+ * host it cannot parse.
+ */
+export function identityHosts(baseUrl, configured = []) {
+    const hosts = new Set();
+    const host = parseBaseUrl(baseUrl).hostname.toLowerCase();
+    hosts.add(host);
+    if (host === new URL(DEFAULT_BASE_URL).hostname)
+        hosts.add(DEFAULT_IDENTITY_HOST);
+    for (const h of configured)
+        hosts.add(parseIdentityHost(h));
+    return [...hosts];
 }
-async function fetchJson(url, timeoutMs) {
+/**
+ * Whether the API at `baseUrl` may serve `did`'s document: the DID's host
+ * equals one of the identity hosts or sits under one at a label boundary.
+ * Anything else is a third-party identity the API is not an authority on.
+ */
+export function isOwnDid(did, baseUrl, didDomains = []) {
+    const host = didWebHost(did);
+    if (!host)
+        return false;
+    return identityHosts(baseUrl, didDomains).some((h) => host === h || host.endsWith(`.${h}`));
+}
+/**
+ * Fetch a DID document. "absent" covers a non-2xx status, a network or
+ * timeout failure and a body that is not a JSON object; "document" is any
+ * JSON object, keys or not — the distinction the caller needs to tell "the
+ * domain did not answer" from "the domain answered without keys".
+ */
+async function fetchDocument(url, timeoutMs) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
@@ -45,11 +199,14 @@ async function fetchJson(url, timeoutMs) {
             signal: controller.signal,
         });
         if (!res.ok)
-            return null;
-        return (await res.json());
+            return { kind: "absent" };
+        const doc = (await res.json());
+        if (!doc || typeof doc !== "object" || Array.isArray(doc))
+            return { kind: "absent" };
+        return { kind: "document", doc: doc };
     }
     catch {
-        return null;
+        return { kind: "absent" };
     }
     finally {
         clearTimeout(timer);
@@ -76,31 +233,95 @@ function keysFromDocument(doc) {
     }
     return keys;
 }
+function describe(what, url, outcome) {
+    return outcome === "unreachable"
+        ? `${what} at ${url} could not be fetched`
+        : `${what} at ${url} answered a document with no Ed25519 key`;
+}
 /**
- * Resolve a `did:web` identifier to its Ed25519 public keys. Tries the standard
- * did:web URL, then the api.codespar.dev encoded fallback. Keys matching
- * `preferredKid` are ordered first so the caller can verify against the exact
- * signing key when the token names one. Returns [] if the document can't be
- * fetched or carries no Ed25519 keys.
+ * Resolve a `did:web` identifier to its Ed25519 public keys.
+ *
+ * Order: the standard did:web URL; then, only if that document could not be
+ * fetched at all, the explicit resolver when one is given; then the API's own
+ * route when the DID is under one of the deployment's identity hosts. A
+ * fetched standard document without keys ends the resolution with no keys.
+ * Keys matching `preferredKid` are ordered first so the caller can verify
+ * against the exact signing key when the token names one.
+ *
+ * Throws {@link DidConfigError} before any request when `baseUrl`,
+ * `resolverUrl` or a configured identity host cannot be parsed.
  */
 export async function resolveDidKeys(did, opts = {}) {
-    const baseUrl = opts.baseUrl ?? "https://api.codespar.dev";
+    const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
     const timeoutMs = opts.timeoutMs ?? 15_000;
-    const candidates = [];
-    const standard = didWebToUrl(did);
-    if (standard)
-        candidates.push(standard);
-    candidates.push(apiFallbackUrl(did, baseUrl));
-    for (const url of candidates) {
-        const doc = await fetchJson(url, timeoutMs);
-        const keys = keysFromDocument(doc);
-        if (keys.length > 0) {
-            if (opts.preferredKid) {
-                keys.sort((a, b) => a.kid === opts.preferredKid ? -1 : b.kid === opts.preferredKid ? 1 : 0);
-            }
-            return keys;
+    const hosts = identityHosts(baseUrl, opts.didDomains);
+    if (opts.resolverUrl !== undefined)
+        parseBaseUrl(opts.resolverUrl, "resolver URL");
+    const tried = [];
+    const reasons = [];
+    const ordered = (keys) => {
+        if (opts.preferredKid) {
+            keys.sort((a, b) => a.kid === opts.preferredKid ? -1 : b.kid === opts.preferredKid ? 1 : 0);
+        }
+        return keys;
+    };
+    const found = (source, keys, url) => ({
+        keys: ordered(keys),
+        source,
+        detail: `${keys.length} Ed25519 key(s) from ${url}`,
+        tried,
+    });
+    const none = (extra) => ({
+        keys: [],
+        source: null,
+        detail: [...reasons, ...(extra ? [extra] : [])].join("; "),
+        tried,
+    });
+    const consult = async (what, url) => {
+        tried.push(url);
+        const fetched = await fetchDocument(url, timeoutMs);
+        if (fetched.kind === "absent") {
+            reasons.push(describe(what, url, "unreachable"));
+            return { keys: [], outcome: "unreachable" };
+        }
+        const keys = keysFromDocument(fetched.doc);
+        if (keys.length === 0) {
+            reasons.push(describe(what, url, "keyless"));
+            return { keys, outcome: "keyless" };
         }
+        return { keys, outcome: "keys" };
+    };
+    const standard = didWebToUrl(did);
+    if (!standard) {
+        reasons.push(did.startsWith("did:web:")
+            ? `${did} is not a well-formed did:web identifier`
+            : `${did} is not a did:web identifier`);
+        return none();
+    }
+    const primary = await consult("the DID document", standard);
+    if (primary.outcome === "keys")
+        return found("did:web", primary.keys, standard);
+    if (primary.outcome === "keyless") {
+        return none("that is the domain's answer, so no other source was consulted");
+    }
+    if (opts.resolverUrl !== undefined) {
+        const url = apiFallbackUrl(did, opts.resolverUrl);
+        const viaResolver = await consult("the resolver", url);
+        if (viaResolver.outcome === "keys")
+            return found("resolver", viaResolver.keys, url);
+    }
+    if (isOwnDid(did, baseUrl, opts.didDomains)) {
+        const url = apiFallbackUrl(did, baseUrl);
+        const viaApi = await consult("the API route", url);
+        if (viaApi.outcome === "keys")
+            return found("fallback", viaApi.keys, url);
+        return none();
     }
-    return [];
+    const host = didWebHost(did) ?? did;
+    return none(`${host} is not one of this deployment's identity hosts (${hosts.join(", ")}), so the API ` +
+        `was not consulted for it` +
+        (opts.resolverUrl === undefined
+            ? ` (--resolver <url> opts into a resolver; --did-domain <host> declares an identity host)`
+            : ` (--did-domain <host> declares an identity host)`));
 }
 //# sourceMappingURL=did.js.map