@kya-os/contracts 1.8.0 → 1.9.0

package/dist/verifier.d.ts

@@ -9,6 +9,7 @@ export declare const AgentContextSchema: z.ZodObject<{
     scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     session: z.ZodString;
     confidence: z.ZodLiteral<"verified">;
+    outcome: z.ZodOptional<z.ZodEnum<["allowed", "denied", "step_up_required", "needs_authorization"]>>;
     delegationRef: z.ZodOptional<z.ZodString>;
     registry: z.ZodString;
     verifiedAt: z.ZodNumber;
@@ -22,6 +23,7 @@ export declare const AgentContextSchema: z.ZodObject<{
     verifiedAt: number;
     subject?: string | undefined;
     delegationRef?: string | undefined;
+    outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
 }, {
     did: string;
     kid: string;
@@ -31,6 +33,7 @@ export declare const AgentContextSchema: z.ZodObject<{
     verifiedAt: number;
     subject?: string | undefined;
     delegationRef?: string | undefined;
+    outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
     scopes?: string[] | undefined;
 }>;
 export declare const VerifierResultSchema: z.ZodObject<{
@@ -43,6 +46,7 @@ export declare const VerifierResultSchema: z.ZodObject<{
         scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         session: z.ZodString;
         confidence: z.ZodLiteral<"verified">;
+        outcome: z.ZodOptional<z.ZodEnum<["allowed", "denied", "step_up_required", "needs_authorization"]>>;
         delegationRef: z.ZodOptional<z.ZodString>;
         registry: z.ZodString;
         verifiedAt: z.ZodNumber;
@@ -56,6 +60,7 @@ export declare const VerifierResultSchema: z.ZodObject<{
         verifiedAt: number;
         subject?: string | undefined;
         delegationRef?: string | undefined;
+        outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
     }, {
         did: string;
         kid: string;
@@ -65,6 +70,7 @@ export declare const VerifierResultSchema: z.ZodObject<{
         verifiedAt: number;
         subject?: string | undefined;
         delegationRef?: string | undefined;
+        outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
         scopes?: string[] | undefined;
     }>>;
     error: z.ZodOptional<z.ZodObject<{
@@ -85,6 +91,12 @@ export declare const VerifierResultSchema: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     success: boolean;
+    error?: {
+        code: string;
+        message: string;
+        httpStatus: number;
+        details?: any;
+    } | undefined;
     headers?: Record<string, string> | undefined;
     agentContext?: {
         did: string;
@@ -96,15 +108,16 @@ export declare const VerifierResultSchema: z.ZodObject<{
         verifiedAt: number;
         subject?: string | undefined;
         delegationRef?: string | undefined;
+        outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
     } | undefined;
+}, {
+    success: boolean;
     error?: {
         code: string;
         message: string;
         httpStatus: number;
         details?: any;
     } | undefined;
-}, {
-    success: boolean;
     headers?: Record<string, string> | undefined;
     agentContext?: {
         did: string;
@@ -115,14 +128,9 @@ export declare const VerifierResultSchema: z.ZodObject<{
         verifiedAt: number;
         subject?: string | undefined;
         delegationRef?: string | undefined;
+        outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
         scopes?: string[] | undefined;
     } | undefined;
-    error?: {
-        code: string;
-        message: string;
-        httpStatus: number;
-        details?: any;
-    } | undefined;
 }>;
 export declare const StructuredErrorSchema: z.ZodObject<{
     code: z.ZodString;
@@ -169,15 +177,16 @@ export type AgentContext = z.infer<typeof AgentContextSchema>;
 export type VerifierResult = z.infer<typeof VerifierResultSchema>;
 export type StructuredError = z.infer<typeof StructuredErrorSchema>;
 export declare const AGENT_HEADERS: {
-    readonly DID: "KYA-Agent-DID";
-    readonly KEY_ID: "KYA-Agent-KeyId";
-    readonly SUBJECT: "KYA-Agent-Subject";
-    readonly SCOPES: "KYA-Agent-Scopes";
-    readonly SESSION: "KYA-Agent-Session";
-    readonly CONFIDENCE: "KYA-Agent-Confidence";
-    readonly DELEGATION_REF: "KYA-Delegation-Ref";
-    readonly REGISTRY: "KYA-Agent-Registry";
-    readonly VERIFIED_AT: "KYA-Verified-At";
+    readonly DID: "KYA-OS-Agent-DID";
+    readonly KEY_ID: "KYA-OS-Agent-KeyId";
+    readonly SUBJECT: "KYA-OS-Agent-Subject";
+    readonly SCOPES: "KYA-OS-Agent-Scopes";
+    readonly SESSION: "KYA-OS-Agent-Session";
+    readonly CONFIDENCE: "KYA-OS-Agent-Confidence";
+    readonly OUTCOME: "KYA-OS-Agent-Outcome";
+    readonly DELEGATION_REF: "KYA-OS-Delegation-Ref";
+    readonly REGISTRY: "KYA-OS-Agent-Registry";
+    readonly VERIFIED_AT: "KYA-OS-Verified-At";
 };
 export declare const VERIFIER_ERROR_CODES: {
     readonly PROOF_INVALID_TS: "XMCP_I_PROOF_INVALID_TS";
@@ -186,6 +195,7 @@ export declare const VERIFIER_ERROR_CODES: {
     readonly PROOF_SKEW_EXCEEDED: "XMCP_I_PROOF_SKEW_EXCEEDED";
     readonly SESSION_IDLE_EXPIRED: "XMCP_I_SESSION_IDLE_EXPIRED";
     readonly SERVER_TIME_INVALID: "XMCP_I_SERVER_TIME_INVALID";
+    readonly OUTCOME_NOT_ALLOWED: "XMCP_I_OUTCOME_NOT_ALLOWED";
 };
 export declare const ERROR_HTTP_STATUS: {
     readonly XMCP_I_EBADPROOF: 403;
@@ -202,4 +212,5 @@ export declare const ERROR_HTTP_STATUS: {
     readonly XMCP_I_PROOF_SKEW_EXCEEDED: 401;
     readonly XMCP_I_SESSION_IDLE_EXPIRED: 401;
     readonly XMCP_I_SERVER_TIME_INVALID: 500;
+    readonly XMCP_I_OUTCOME_NOT_ALLOWED: 403;
 };

package/dist/verifier.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ERROR_HTTP_STATUS = exports.VERIFIER_ERROR_CODES = exports.AGENT_HEADERS = exports.StructuredErrorSchema = exports.VerifierResultSchema = exports.AgentContextSchema = void 0;
 const zod_1 = require("zod");
+const proof_js_1 = require("./proof.js");
 /**
  * Verifier middleware schemas and headers
  */
@@ -12,6 +13,13 @@ exports.AgentContextSchema = zod_1.z.object({
     scopes: zod_1.z.array(zod_1.z.string()).default([]),
     session: zod_1.z.string().min(1),
     confidence: zod_1.z.literal("verified"),
+    // Policy outcome the verified proof attests to (ratified DIF decision).
+    // `confidence: "verified"` means the proof is authentic; `outcome` is the
+    // separate authorization dimension. A PEP must gate on `outcome === "allowed"`
+    // — a verified `denied` / `step_up_required` / `needs_authorization` proof is
+    // authentic but does NOT authorize the call. Optional for backward
+    // compatibility; the verifier always populates it (legacy proofs → "allowed").
+    outcome: proof_js_1.ProofOutcomeSchema.optional(),
     delegationRef: zod_1.z.string().optional(),
     registry: zod_1.z.string().url(),
     verifiedAt: zod_1.z.number().int().positive(),
@@ -44,15 +52,16 @@ exports.StructuredErrorSchema = zod_1.z.object({
 });
 // Header constants (frozen names)
 exports.AGENT_HEADERS = {
-    DID: "KYA-Agent-DID",
-    KEY_ID: "KYA-Agent-KeyId",
-    SUBJECT: "KYA-Agent-Subject",
-    SCOPES: "KYA-Agent-Scopes",
-    SESSION: "KYA-Agent-Session",
-    CONFIDENCE: "KYA-Agent-Confidence",
-    DELEGATION_REF: "KYA-Delegation-Ref",
-    REGISTRY: "KYA-Agent-Registry",
-    VERIFIED_AT: "KYA-Verified-At",
+    DID: "KYA-OS-Agent-DID",
+    KEY_ID: "KYA-OS-Agent-KeyId",
+    SUBJECT: "KYA-OS-Agent-Subject",
+    SCOPES: "KYA-OS-Agent-Scopes",
+    SESSION: "KYA-OS-Agent-Session",
+    CONFIDENCE: "KYA-OS-Agent-Confidence",
+    OUTCOME: "KYA-OS-Agent-Outcome",
+    DELEGATION_REF: "KYA-OS-Delegation-Ref",
+    REGISTRY: "KYA-OS-Agent-Registry",
+    VERIFIED_AT: "KYA-OS-Verified-At",
 };
 // Verifier-specific error codes
 exports.VERIFIER_ERROR_CODES = {
@@ -62,6 +71,7 @@ exports.VERIFIER_ERROR_CODES = {
     PROOF_SKEW_EXCEEDED: "XMCP_I_PROOF_SKEW_EXCEEDED",
     SESSION_IDLE_EXPIRED: "XMCP_I_SESSION_IDLE_EXPIRED",
     SERVER_TIME_INVALID: "XMCP_I_SERVER_TIME_INVALID",
+    OUTCOME_NOT_ALLOWED: "XMCP_I_OUTCOME_NOT_ALLOWED",
 };
 // HTTP status mappings
 exports.ERROR_HTTP_STATUS = {
@@ -80,4 +90,5 @@ exports.ERROR_HTTP_STATUS = {
     [exports.VERIFIER_ERROR_CODES.PROOF_SKEW_EXCEEDED]: 401,
     [exports.VERIFIER_ERROR_CODES.SESSION_IDLE_EXPIRED]: 401,
     [exports.VERIFIER_ERROR_CODES.SERVER_TIME_INVALID]: 500,
+    [exports.VERIFIER_ERROR_CODES.OUTCOME_NOT_ALLOWED]: 403,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/contracts",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Shared contracts, types, and schemas for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -142,6 +142,7 @@
   },
   "files": [
     "dist",
+    "parity-vectors",
     "package.json",
     "README.md"
   ],

package/parity-vectors/delegation-conformance.json

@@ -0,0 +1,265 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "Delegation chain conformance vectors",
+  "description": "Cascading-revocation, chain-integrity, per-hop attenuation, and multi-hop delegation chains (E3.5 / issue #2904). `core` = full reference semantics (mcp-i-core cascading-revocation + delegation-graph, contracts areChildConstraintsValid). `edge` = reduced-profile kya-os-engine verdict: single-hop is evaluated; multi-hop fails closed to Block(PolicyDenied) unless a higher-priority reason (Revoked/Expired) fires first.",
+  "version": "1.0.0",
+  "vectors": [
+    {
+      "id": "cascade-revoke-ancestor-revokes-leaf",
+      "category": "cascading-revocation",
+      "profiles": ["core", "edge"],
+      "description": "Two-hop chain whose root delegation is revoked while the leaf's own credential is clean. Core: leaf invalid via ancestor cascade. Edge: the engine sees only the leaf's top-level credentialStatus (clean) and cannot observe the ancestor revocation, so it fails closed on the multi-hop chain (PolicyDenied) rather than over-permitting.",
+      "input": {
+        "chain": [
+          {
+            "id": "cr-root",
+            "parentId": null,
+            "issuerDid": "did:web:org.example",
+            "subjectDid": "did:web:agent.example",
+            "grantedScopes": ["read:*"],
+            "credentialStatusId": "https://status.example/revocation/v1#5"
+          },
+          {
+            "id": "cr-leaf",
+            "parentId": "cr-root",
+            "issuerDid": "did:web:agent.example",
+            "subjectDid": "did:key:zSubLeaf",
+            "grantedScopes": ["read:email"],
+            "credentialStatusId": "https://status.example/revocation/v1#9"
+          }
+        ],
+        "requestedScope": "read:email",
+        "revokedStatusIds": ["https://status.example/revocation/v1#5"],
+        "currentTime": 1735689600
+      },
+      "expected": {
+        "core": {
+          "valid": false,
+          "failureReason": "cascaded-revocation",
+          "revokedAncestor": "cr-root"
+        },
+        "edge": {
+          "mode": "fail-closed",
+          "decision": {
+            "kind": "Block",
+            "reason": {
+              "kind": "PolicyDenied",
+              "detail": "multi-hop delegation chain (len=2) not evaluated by reduced edge profile; Layer-2 policy authoritative"
+            }
+          }
+        }
+      },
+      "note": "The leaf's own credentialStatus (#9) is NOT revoked, so the engine's Stage 3 does not fire Block(Revoked); the multi-hop guard yields PolicyDenied. If the leaf's own status WERE revoked, Stage 3's Revoked (priority 0) would outrank PolicyDenied — covered by the cross-runtime matrix, not here."
+    },
+    {
+      "id": "chain-integrity-broken-issuer-linkage",
+      "category": "chain-integrity",
+      "profiles": ["core", "edge"],
+      "description": "Two-hop chain where the leaf's issuer is NOT the root's subject (forged intermediate). Core: invalid-chain via delegation-graph linkage check. Edge: fails closed on the multi-hop chain.",
+      "input": {
+        "chain": [
+          {
+            "id": "ci-root",
+            "parentId": null,
+            "issuerDid": "did:web:org.example",
+            "subjectDid": "did:web:agent.example",
+            "grantedScopes": ["read:*"]
+          },
+          {
+            "id": "ci-leaf",
+            "parentId": "ci-root",
+            "issuerDid": "did:web:evil.example",
+            "subjectDid": "did:key:zSubLeaf",
+            "grantedScopes": ["read:email"]
+          }
+        ],
+        "requestedScope": "read:email",
+        "currentTime": 1735689600
+      },
+      "expected": {
+        "core": {
+          "valid": false,
+          "failureReason": "invalid-chain"
+        },
+        "edge": {
+          "mode": "fail-closed",
+          "decision": {
+            "kind": "Block",
+            "reason": {
+              "kind": "PolicyDenied",
+              "detail": "multi-hop delegation chain (len=2) not evaluated by reduced edge profile; Layer-2 policy authoritative"
+            }
+          }
+        }
+      },
+      "note": "delegation-graph.validateChain requires child.issuerDid === parent.subjectDid (delegation-graph.ts:243). did:web:evil.example breaks the linkage. The flat engine carries no per-hop issuer/subject, so it cannot detect this — fail-closed is the safe reduced-profile behavior."
+    },
+    {
+      "id": "attenuation-child-exceeds-parent-scope",
+      "category": "per-hop-attenuation",
+      "profiles": ["core", "edge"],
+      "description": "Two-hop chain where the child grants MORE than the parent (parent read:* via prefix, child write:billing). Core: attenuation-violation via areChildConstraintsValid. Edge: fails closed. This is the canonical over-permit case the reduced profile closes.",
+      "input": {
+        "chain": [
+          {
+            "id": "at-root",
+            "parentId": null,
+            "issuerDid": "did:web:org.example",
+            "subjectDid": "did:web:agent.example",
+            "grantedScopes": ["read:*"],
+            "constraints": {
+              "crisp": {
+                "scopes": [{ "resource": "read:", "matcher": "prefix" }]
+              }
+            }
+          },
+          {
+            "id": "at-leaf",
+            "parentId": "at-root",
+            "issuerDid": "did:web:agent.example",
+            "subjectDid": "did:key:zSubLeaf",
+            "grantedScopes": ["write:billing"],
+            "constraints": {
+              "crisp": {
+                "scopes": [{ "resource": "write:billing", "matcher": "exact" }]
+              }
+            }
+          }
+        ],
+        "requestedScope": "write:billing",
+        "currentTime": 1735689600
+      },
+      "expected": {
+        "core": {
+          "valid": false,
+          "failureReason": "attenuation-violation"
+        },
+        "edge": {
+          "mode": "fail-closed",
+          "decision": {
+            "kind": "Block",
+            "reason": {
+              "kind": "PolicyDenied",
+              "detail": "multi-hop delegation chain (len=2) not evaluated by reduced edge profile; Layer-2 policy authoritative"
+            }
+          }
+        }
+      },
+      "note": "Today the flat engine would flatten grants to [read:*, write:billing] and scope_satisfies('write:billing', ...) === true → silent Permit. areChildConstraintsValid rejects the widening (write:billing does not start with read:). Fail-closed converts the silent over-permit into Block(PolicyDenied)."
+    },
+    {
+      "id": "multihop-valid-chain-still-fail-closed",
+      "category": "multi-hop-valid",
+      "profiles": ["core", "edge"],
+      "description": "A WELL-FORMED two-hop chain: valid linkage, no revocation, child scopes within parent, request within leaf grant. Core: valid. Edge: STILL fails closed — the reduced profile does not certify multi-hop even when the chain is valid; the over-permit risk is structural, not data-dependent.",
+      "input": {
+        "chain": [
+          {
+            "id": "hp-root",
+            "parentId": null,
+            "issuerDid": "did:web:org.example",
+            "subjectDid": "did:web:agent.example",
+            "grantedScopes": ["read:email"],
+            "credentialStatusId": "https://status.example/revocation/v1#20",
+            "constraints": {
+              "crisp": {
+                "scopes": [{ "resource": "read:email", "matcher": "exact" }]
+              }
+            }
+          },
+          {
+            "id": "hp-leaf",
+            "parentId": "hp-root",
+            "issuerDid": "did:web:agent.example",
+            "subjectDid": "did:key:zSubLeaf",
+            "grantedScopes": ["read:email"],
+            "credentialStatusId": "https://status.example/revocation/v1#21",
+            "constraints": {
+              "crisp": {
+                "scopes": [{ "resource": "read:email", "matcher": "exact" }]
+              }
+            }
+          }
+        ],
+        "requestedScope": "read:email",
+        "revokedStatusIds": [],
+        "currentTime": 1735689600
+      },
+      "expected": {
+        "core": {
+          "valid": true
+        },
+        "edge": {
+          "mode": "fail-closed",
+          "decision": {
+            "kind": "Block",
+            "reason": {
+              "kind": "PolicyDenied",
+              "detail": "multi-hop delegation chain (len=2) not evaluated by reduced edge profile; Layer-2 policy authoritative"
+            }
+          }
+        }
+      },
+      "note": "Deliberate negative-of-convenience: proves the edge profile fails closed even on a VALID multi-hop chain. This is the honest cost of the reduced profile — Layer-2 tenant policy must opt these back in. Prevents a future maintainer from 'optimizing' the guard to permit valid-looking chains."
+    },
+    {
+      "id": "singlehop-scope-permit",
+      "category": "scope-match",
+      "profiles": ["edge"],
+      "description": "Single-hop delegation whose granted scope covers the requested scope. Edge: evaluated → Permit (regression guard that the multi-hop guard does NOT change the len<=1 path).",
+      "input": {
+        "chain": [
+          {
+            "id": "sh-permit",
+            "parentId": null,
+            "issuerDid": "did:web:org.example",
+            "subjectDid": "did:web:agent.example",
+            "grantedScopes": ["read:email"]
+          }
+        ],
+        "requestedScope": "read:email",
+        "currentTime": 1735689600
+      },
+      "expected": {
+        "edge": {
+          "mode": "evaluated",
+          "decision": { "kind": "Permit" }
+        }
+      },
+      "note": "Single-hop is within the engine's competence: it flattens the one step's grants and matches requestedScope. No core counterpart — for single-hop scope the engine is the reference."
+    },
+    {
+      "id": "singlehop-scope-out-of-scope",
+      "category": "scope-match",
+      "profiles": ["edge"],
+      "description": "Single-hop delegation whose granted scope does NOT cover the requested scope. Edge: evaluated → Block(OutOfScope). Proves the guard leaves the genuine single-hop scope rejection intact.",
+      "input": {
+        "chain": [
+          {
+            "id": "sh-oos",
+            "parentId": null,
+            "issuerDid": "did:web:org.example",
+            "subjectDid": "did:web:agent.example",
+            "grantedScopes": ["read:email"]
+          }
+        ],
+        "requestedScope": "write:billing",
+        "currentTime": 1735689600
+      },
+      "expected": {
+        "edge": {
+          "mode": "evaluated",
+          "decision": {
+            "kind": "Block",
+            "reason": {
+              "kind": "OutOfScope",
+              "requested": "write:billing",
+              "granted": ["read:email"]
+            }
+          }
+        }
+      },
+      "note": "Single-hop OutOfScope stays a genuine evaluated rejection (not fail-closed). granted is the flattened single-step grant set."
+    }
+  ]
+}

package/parity-vectors/did-key.json

@@ -0,0 +1,134 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "did:key resolution test vectors",
+  "description": "Test vectors for did:key resolution parity between TypeScript and Rust",
+  "version": "1.0.0",
+  "vectors": [
+    {
+      "id": "valid-ed25519-1",
+      "description": "Valid Ed25519 did:key",
+      "input": {
+        "did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
+      },
+      "expected": {
+        "success": true,
+        "keyType": "Ed25519",
+        "publicKeyHex": "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a",
+        "keyId": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK#z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
+      }
+    },
+    {
+      "id": "valid-ed25519-2",
+      "description": "Another valid Ed25519 did:key",
+      "input": {
+        "did": "did:key:z6MkfrNzYH9ygZbUjWKFW3BrN5SvXqWMQGQwYVaR8GGJqWLb"
+      },
+      "expected": {
+        "success": true,
+        "keyType": "Ed25519"
+      }
+    },
+    {
+      "id": "invalid-empty",
+      "description": "Empty DID string",
+      "input": {
+        "did": ""
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidFormat"
+      }
+    },
+    {
+      "id": "invalid-not-did-key",
+      "description": "Wrong DID method (did:web instead of did:key)",
+      "input": {
+        "did": "did:web:example.com"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidPrefix"
+      }
+    },
+    {
+      "id": "invalid-multibase-prefix",
+      "description": "Invalid multibase prefix (not z)",
+      "input": {
+        "did": "did:key:f6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidMultibase"
+      }
+    },
+    {
+      "id": "invalid-base58",
+      "description": "Invalid base58 encoding (contains 0, O, I, l)",
+      "input": {
+        "did": "did:key:z6Mk0OIl"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidBase58"
+      }
+    },
+    {
+      "id": "unsupported-curve-p256",
+      "description": "Unsupported curve (P-256)",
+      "input": {
+        "did": "did:key:zDnaeucDGfNLZfcPeDpQWAcfJMCvzNjrB5F9Xut7VH8fFYnDW"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "UnsupportedKeyType"
+      }
+    },
+    {
+      "id": "unsupported-curve-secp256k1",
+      "description": "Unsupported curve (secp256k1)",
+      "input": {
+        "did": "did:key:zQ3shNFbC9Wk5yXnNMEsNz1hL5NPcUHbBYC8TmUHxAHhVWFqe"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "UnsupportedKeyType"
+      }
+    },
+    {
+      "id": "invalid-key-length",
+      "description": "Invalid key length (too short)",
+      "input": {
+        "did": "did:key:z6MkTest"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidKeyLength"
+      }
+    },
+    {
+      "id": "valid-key-id-validation",
+      "description": "Validate key ID format",
+      "input": {
+        "did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+        "keyId": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK#z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
+      },
+      "expected": {
+        "success": true,
+        "keyIdValid": true
+      }
+    },
+    {
+      "id": "invalid-key-id-mismatch",
+      "description": "Key ID does not match DID",
+      "input": {
+        "did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+        "keyId": "did:key:z6MkfrNzYH9ygZbUjWKFW3BrN5SvXqWMQGQwYVaR8GGJqWLb#z6MkfrNzYH9ygZbUjWKFW3BrN5SvXqWMQGQwYVaR8GGJqWLb"
+      },
+      "expected": {
+        "success": false,
+        "keyIdValid": false,
+        "errorType": "KeyIdMismatch"
+      }
+    }
+  ]
+}