@kya-os/mcp-i-core 1.3.13 → 1.3.15

package/src/delegation/__tests__/vc-verifier.test.ts

@@ -1,922 +0,0 @@
-import { describe, it, expect, beforeEach, vi, Mock } from "vitest";
-import {
-  DelegationCredentialVerifier,
-  createDelegationVerifier,
-  type DIDResolver,
-  type StatusListResolver,
-  type SignatureVerificationFunction,
-  type DelegationVCVerificationResult,
-} from "../vc-verifier.js";
-import type { DelegationCredential } from "@kya-os/contracts";
-
-// Mock the contracts functions
-vi.mock("@kya-os/contracts", () => ({
-  isDelegationCredentialExpired: vi.fn(),
-  isDelegationCredentialNotYetValid: vi.fn(),
-  validateDelegationCredential: vi.fn(),
-}));
-
-describe("DelegationCredentialVerifier", () => {
-  let mockDidResolver: {
-    resolve: ReturnType<typeof vi.fn>;
-  };
-  let mockStatusListResolver: {
-    checkStatus: ReturnType<typeof vi.fn>;
-  };
-  let mockSignatureVerifier: Mock<SignatureVerificationFunction>;
-
-  let verifier: DelegationCredentialVerifier;
-
-  // Helper function to setup default contracts mocks
-  const setupDefaultContractsMocks = async () => {
-    // Import the mocked functions
-    const contracts = await import("@kya-os/contracts");
-
-    // Access the mocked functions and set return values
-    const validateDelegationCredential = vi.mocked(
-      contracts.validateDelegationCredential
-    );
-    const isDelegationCredentialExpired = vi.mocked(
-      contracts.isDelegationCredentialExpired
-    );
-    const isDelegationCredentialNotYetValid = vi.mocked(
-      contracts.isDelegationCredentialNotYetValid
-    );
-
-    // Setup default return values
-    validateDelegationCredential.mockReturnValue({
-      success: true,
-      data: mockValidVC,
-    });
-    isDelegationCredentialExpired.mockReturnValue(false);
-    isDelegationCredentialNotYetValid.mockReturnValue(false);
-
-    return {
-      validateDelegationCredential,
-      isDelegationCredentialExpired,
-      isDelegationCredentialNotYetValid,
-    };
-  };
-
-  const mockValidVC: DelegationCredential = {
-    "@context": ["https://www.w3.org/2018/credentials/v1"],
-    id: "urn:delegation:123",
-    type: ["VerifiableCredential", "DelegationCredential"],
-    issuer: "did:web:example.com:issuer",
-    issuanceDate: "2024-01-01T00:00:00Z",
-    credentialSubject: {
-      id: "did:web:example.com:subject",
-      delegation: {
-        id: "urn:delegation:123",
-        issuerDid: "did:web:example.com:issuer",
-        subjectDid: "did:web:example.com:subject",
-        constraints: {
-          scopes: ["read:profile"],
-        },
-        status: "active",
-      },
-    },
-    proof: {
-      type: "Ed25519Signature2020",
-      created: "2024-01-01T00:00:00Z",
-      verificationMethod: "did:web:example.com:issuer#key-1",
-      proofPurpose: "assertionMethod",
-      proofValue: "mock-proof-value",
-    },
-  };
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-
-    // Setup mocks as proper interface implementations with vitest mock types
-    mockDidResolver = {
-      resolve: vi.fn() as any,
-    };
-
-    mockStatusListResolver = {
-      checkStatus: vi.fn() as any,
-    };
-
-    mockSignatureVerifier = vi.fn();
-
-    verifier = new DelegationCredentialVerifier({
-      didResolver: mockDidResolver as DIDResolver,
-      statusListResolver: mockStatusListResolver as StatusListResolver,
-      signatureVerifier: mockSignatureVerifier,
-      cacheTtl: 1000, // Short TTL for testing
-    });
-  });
-
-  describe("constructor", () => {
-    it("should create verifier with default options", () => {
-      const defaultVerifier = new DelegationCredentialVerifier();
-      expect(defaultVerifier).toBeInstanceOf(DelegationCredentialVerifier);
-    });
-
-    it("should create verifier with custom options", () => {
-      const customVerifier = new DelegationCredentialVerifier({
-        cacheTtl: 5000,
-      });
-      expect(customVerifier).toBeInstanceOf(DelegationCredentialVerifier);
-    });
-  });
-
-  describe("createDelegationVerifier", () => {
-    it("should create a verifier instance", () => {
-      const verifier = createDelegationVerifier();
-      expect(verifier).toBeInstanceOf(DelegationCredentialVerifier);
-    });
-
-    it("should pass options to verifier", () => {
-      const options = { cacheTtl: 3000 };
-      const verifier = createDelegationVerifier(options);
-      expect(verifier).toBeInstanceOf(DelegationCredentialVerifier);
-    });
-  });
-
-  describe("verifyDelegationCredential - Basic Validation Stage", () => {
-    it("should reject expired credentials at basic validation stage", async () => {
-      const contractsMock = await setupDefaultContractsMocks();
-      contractsMock.isDelegationCredentialExpired.mockReturnValue(true);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Delegation credential expired");
-      expect(result.stage).toBe("basic");
-      expect(result.metrics?.totalMs).toBeGreaterThanOrEqual(0);
-      expect(result.checks?.basicValid).toBe(false);
-    });
-
-    it("should reject not-yet-valid credentials at basic validation stage", async () => {
-      const contractsMock = await setupDefaultContractsMocks();
-      contractsMock.isDelegationCredentialNotYetValid.mockReturnValue(true);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Delegation credential not yet valid");
-      expect(result.stage).toBe("basic");
-    });
-
-    it("should reject revoked credentials at basic validation stage", async () => {
-      await setupDefaultContractsMocks();
-
-      const revokedVC = {
-        ...mockValidVC,
-        credentialSubject: {
-          ...mockValidVC.credentialSubject,
-          delegation: {
-            ...mockValidVC.credentialSubject.delegation,
-            status: "revoked" as const,
-          },
-        },
-      };
-
-      const result = await verifier.verifyDelegationCredential(revokedVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Delegation status is revoked");
-      expect(result.stage).toBe("basic");
-    });
-
-    it("should reject expired status credentials at basic validation stage", async () => {
-      await setupDefaultContractsMocks();
-      const expiredVC = {
-        ...mockValidVC,
-        credentialSubject: {
-          ...mockValidVC.credentialSubject,
-          delegation: {
-            ...mockValidVC.credentialSubject.delegation,
-            status: "expired" as const,
-          },
-        },
-      };
-
-      const result = await verifier.verifyDelegationCredential(expiredVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Delegation status is expired");
-      expect(result.stage).toBe("basic");
-    });
-
-    it("should reject credentials without issuer DID", async () => {
-      await setupDefaultContractsMocks();
-      const invalidVC = {
-        ...mockValidVC,
-        credentialSubject: {
-          ...mockValidVC.credentialSubject,
-          delegation: {
-            ...mockValidVC.credentialSubject.delegation,
-            issuerDid: undefined,
-          },
-        },
-      } as any;
-
-      const result = await verifier.verifyDelegationCredential(invalidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Missing issuer or subject DID");
-      expect(result.stage).toBe("basic");
-    });
-
-    it("should reject credentials without subject DID", async () => {
-      await setupDefaultContractsMocks();
-      const invalidVC = {
-        ...mockValidVC,
-        credentialSubject: {
-          ...mockValidVC.credentialSubject,
-          delegation: {
-            ...mockValidVC.credentialSubject.delegation,
-            subjectDid: undefined,
-          },
-        },
-      } as any;
-
-      const result = await verifier.verifyDelegationCredential(invalidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Missing issuer or subject DID");
-      expect(result.stage).toBe("basic");
-    });
-
-    it("should reject credentials without proof", async () => {
-      await setupDefaultContractsMocks();
-      const invalidVC = { ...mockValidVC };
-      delete invalidVC.proof;
-
-      const result = await verifier.verifyDelegationCredential(invalidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Missing proof");
-      expect(result.stage).toBe("basic");
-    });
-
-    it("should reject invalid schema at basic validation stage", async () => {
-      const contractsMock = await setupDefaultContractsMocks();
-      // Create a mock ZodError-like object without importing zod
-      const mockZodError = {
-        issues: [{ code: "custom", path: [], message: "Invalid schema" }],
-        message: "Invalid schema",
-      };
-      contractsMock.validateDelegationCredential.mockReturnValue({
-        success: false,
-        error: mockZodError,
-      } as any);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Schema validation failed: Invalid schema");
-      expect(result.stage).toBe("basic");
-    });
-  });
-
-  describe("verifyDelegationCredential - Signature Verification", () => {
-    it("should skip signature verification when skipSignature is true", async () => {
-      await setupDefaultContractsMocks();
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-      mockSignatureVerifier.mockResolvedValue({ valid: false }); // This should not be called
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC, {
-        skipSignature: true,
-      });
-
-      expect(result.valid).toBe(true); // Only basic checks pass
-      expect(result.stage).toBe("complete");
-      expect(result.checks?.signatureValid).toBe(true); // Skipped = treated as valid
-      expect(mockSignatureVerifier).not.toHaveBeenCalled();
-    });
-
-    it("should skip signature verification when no resolver available", async () => {
-      await setupDefaultContractsMocks();
-      const verifierWithoutResolver = new DelegationCredentialVerifier({
-        statusListResolver: mockStatusListResolver,
-        // No signatureVerifier
-      });
-
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      const result =
-        await verifierWithoutResolver.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(true);
-      expect(result.checks?.signatureValid).toBe(true); // Trust but don't verify
-    });
-
-    it("should fail when DID resolution fails", async () => {
-      await setupDefaultContractsMocks();
-      mockDidResolver.resolve.mockResolvedValue(null);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe(
-        "Could not resolve issuer DID: did:web:example.com:issuer"
-      );
-      expect(result.stage).toBe("complete");
-      expect(result.checks?.signatureValid).toBe(false);
-    });
-
-    it("should fail when verification method not found", async () => {
-      await setupDefaultContractsMocks();
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [], // Empty array
-      });
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe(
-        "Verification method did:web:example.com:issuer#key-1 not found"
-      );
-      expect(result.checks?.signatureValid).toBe(false);
-    });
-
-    it("should fail when verification method missing public key", async () => {
-      await setupDefaultContractsMocks();
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            // Missing publicKeyJwk
-          },
-        ],
-      });
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Verification method missing publicKeyJwk");
-      expect(result.checks?.signatureValid).toBe(false);
-    });
-
-    it("should succeed when signature verification passes", async () => {
-      await setupDefaultContractsMocks();
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(true);
-      expect(result.stage).toBe("complete");
-      expect(result.checks?.signatureValid).toBe(true);
-      expect(result.checks?.statusValid).toBe(true);
-      expect(result.checks?.basicValid).toBe(true);
-    });
-
-    it("should fail when signature verification fails", async () => {
-      await setupDefaultContractsMocks();
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-
-      mockSignatureVerifier.mockResolvedValue({
-        valid: false,
-        reason: "Invalid signature",
-      });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe("Invalid signature");
-      expect(result.checks?.signatureValid).toBe(false);
-    });
-  });
-
-  describe("verifyDelegationCredential - Status Checking", () => {
-    it("should skip status checking when skipStatus is true", async () => {
-      await setupDefaultContractsMocks();
-      const vcWithoutStatus = { ...mockValidVC };
-      delete vcWithoutStatus.credentialStatus;
-
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(true); // Revoked - should not be called
-
-      const result = await verifier.verifyDelegationCredential(
-        vcWithoutStatus,
-        {
-          skipStatus: true,
-        }
-      );
-
-      expect(result.valid).toBe(true);
-      expect(result.checks?.statusValid).toBe(true); // Skipped = treated as valid
-      expect(mockStatusListResolver.checkStatus).not.toHaveBeenCalled();
-    });
-
-    it("should skip status checking when no status entry exists", async () => {
-      await setupDefaultContractsMocks();
-      const vcWithoutStatus = { ...mockValidVC };
-      delete vcWithoutStatus.credentialStatus;
-
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-
-      const result = await verifier.verifyDelegationCredential(vcWithoutStatus);
-
-      expect(result.valid).toBe(true);
-      expect(result.checks?.statusValid).toBe(true);
-      expect(mockStatusListResolver.checkStatus).not.toHaveBeenCalled();
-    });
-
-    it("should skip status checking when no resolver available", async () => {
-      await setupDefaultContractsMocks();
-      const verifierWithoutResolver = new DelegationCredentialVerifier({
-        didResolver: mockDidResolver,
-        signatureVerifier: mockSignatureVerifier,
-        // No statusListResolver
-      });
-
-      const vcWithStatus = {
-        ...mockValidVC,
-        credentialStatus: {
-          id: "https://example.com/status#123",
-          type: "StatusList2021Entry" as const,
-          statusPurpose: "revocation" as const,
-          statusListIndex: "123",
-          statusListCredential: "https://example.com/status",
-        },
-      };
-
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-
-      const result =
-        await verifierWithoutResolver.verifyDelegationCredential(vcWithStatus);
-
-      expect(result.valid).toBe(true);
-      expect(result.checks?.statusValid).toBe(true); // Trust but don't verify
-    });
-
-    it("should fail when credential is revoked", async () => {
-      await setupDefaultContractsMocks();
-      const vcWithStatus = {
-        ...mockValidVC,
-        credentialStatus: {
-          id: "https://example.com/status#123",
-          type: "StatusList2021Entry" as const,
-          statusPurpose: "revocation" as const,
-          statusListIndex: "123",
-          statusListCredential: "https://example.com/status",
-        },
-      };
-
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(true); // Revoked
-
-      const result = await verifier.verifyDelegationCredential(vcWithStatus);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toBe(
-        "Credential revoked via StatusList2021 (revocation)"
-      );
-      expect(result.checks?.statusValid).toBe(false);
-    });
-
-    it("should succeed when credential is not revoked", async () => {
-      await setupDefaultContractsMocks();
-      const vcWithStatus = {
-        ...mockValidVC,
-        credentialStatus: {
-          id: "https://example.com/status#123",
-          type: "StatusList2021Entry" as const,
-          statusPurpose: "revocation" as const,
-          statusListIndex: "123",
-          statusListCredential: "https://example.com/status",
-        },
-      };
-
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false); // Not revoked
-
-      const result = await verifier.verifyDelegationCredential(vcWithStatus);
-
-      expect(result.valid).toBe(true);
-      expect(result.checks?.statusValid).toBe(true);
-    });
-  });
-
-  describe("verifyDelegationCredential - Caching", () => {
-    it("should return cached result when available", async () => {
-      await setupDefaultContractsMocks();
-      // First call - should verify and cache
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      const result1 = await verifier.verifyDelegationCredential(mockValidVC);
-      expect(result1.valid).toBe(true);
-      expect(result1.cached).toBeUndefined();
-
-      // Second call - should return cached result
-      mockSignatureVerifier.mockClear();
-      mockStatusListResolver.checkStatus.mockClear();
-
-      const result2 = await verifier.verifyDelegationCredential(mockValidVC);
-      expect(result2.valid).toBe(true);
-      expect(result2.cached).toBe(true);
-
-      // Verifiers should not be called again
-      expect(mockSignatureVerifier).not.toHaveBeenCalled();
-      expect(mockStatusListResolver.checkStatus).not.toHaveBeenCalled();
-    });
-
-    it("should skip cache when skipCache is true", async () => {
-      await setupDefaultContractsMocks();
-      // First call
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      await verifier.verifyDelegationCredential(mockValidVC);
-
-      // Second call with skipCache
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: false }); // Different result
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC, {
-        skipCache: true,
-      });
-
-      expect(result.valid).toBe(false); // Should get new result, not cached
-      expect(result.cached).toBeUndefined();
-    });
-
-    it("should not cache failed verifications", async () => {
-      // First call - fails
-      const contractsMock = await setupDefaultContractsMocks();
-      contractsMock.isDelegationCredentialExpired.mockReturnValue(true);
-
-      const result1 = await verifier.verifyDelegationCredential(mockValidVC);
-      expect(result1.valid).toBe(false);
-
-      // Reset for second call
-      contractsMock.isDelegationCredentialExpired.mockReturnValue(false);
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      // Second call - should verify again (not cached)
-      const result2 = await verifier.verifyDelegationCredential(mockValidVC);
-      expect(result2.valid).toBe(true);
-      expect(result2.cached).toBeUndefined(); // Should not be cached
-    });
-  });
-
-  describe("cache management", () => {
-    it("should clear all cache entries", async () => {
-      await setupDefaultContractsMocks();
-      // Add to cache
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      await verifier.verifyDelegationCredential(mockValidVC);
-
-      // Clear cache
-      verifier.clearCache();
-
-      // Next call should verify again
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: false }); // Different result
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-      expect(result.valid).toBe(false);
-      expect(result.cached).toBeUndefined();
-    });
-
-    it("should clear specific cache entry", async () => {
-      await setupDefaultContractsMocks();
-      // Add to cache
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      await verifier.verifyDelegationCredential(mockValidVC);
-
-      // Clear specific entry
-      verifier.clearCacheEntry("urn:delegation:123");
-
-      // Next call should verify again
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: false });
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-      expect(result.valid).toBe(false);
-      expect(result.cached).toBeUndefined();
-    });
-  });
-
-  describe("performance metrics", () => {
-    it("should include timing metrics in results", async () => {
-      await setupDefaultContractsMocks();
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.metrics).toBeDefined();
-      expect(result.metrics?.totalMs).toBeGreaterThanOrEqual(0);
-      expect(result.metrics?.basicCheckMs).toBeGreaterThanOrEqual(0);
-      expect(result.metrics?.signatureCheckMs).toBeGreaterThanOrEqual(0);
-      expect(result.metrics?.statusCheckMs).toBeGreaterThanOrEqual(0);
-    });
-
-    it("should report zero timing for skipped checks", async () => {
-      await setupDefaultContractsMocks();
-      const result = await verifier.verifyDelegationCredential(mockValidVC, {
-        skipSignature: true,
-        skipStatus: true,
-      });
-
-      expect(result.metrics?.signatureCheckMs).toBe(0);
-      expect(result.metrics?.statusCheckMs).toBe(0);
-    });
-  });
-
-  describe("error handling", () => {
-    it("should handle DID resolver errors gracefully", async () => {
-      await setupDefaultContractsMocks();
-      mockDidResolver.resolve.mockRejectedValue(new Error("Network timeout"));
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toContain(
-        "Signature verification error: Network timeout"
-      );
-    });
-
-    it("should handle status list resolver errors gracefully", async () => {
-      await setupDefaultContractsMocks();
-      const vcWithStatus = {
-        ...mockValidVC,
-        credentialStatus: {
-          id: "https://example.com/status#123",
-          type: "StatusList2021Entry" as const,
-          statusPurpose: "revocation" as const,
-          statusListIndex: "123",
-          statusListCredential: "https://example.com/status",
-        },
-      };
-
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockRejectedValue(
-        new Error("Status list unavailable")
-      );
-
-      const result = await verifier.verifyDelegationCredential(vcWithStatus);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toContain(
-        "Status check error: Status list unavailable"
-      );
-    });
-
-    it("should handle signature verifier errors gracefully", async () => {
-      await setupDefaultContractsMocks();
-      mockDidResolver.resolve.mockResolvedValue({
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-        ],
-      });
-
-      mockSignatureVerifier.mockRejectedValue(
-        new Error("Signature algorithm unsupported")
-      );
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(false);
-      expect(result.reason).toContain(
-        "Signature verification error: Signature algorithm unsupported"
-      );
-    });
-  });
-
-  describe("findVerificationMethod", () => {
-    // This is a private method, but we can test it indirectly through the main verification flow
-    it("should find verification method by ID", async () => {
-      await setupDefaultContractsMocks();
-      const didDoc = {
-        id: "did:web:example.com:issuer",
-        verificationMethod: [
-          {
-            id: "did:web:example.com:issuer#key-1",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "mock-key" },
-          },
-          {
-            id: "did:web:example.com:issuer#key-2",
-            type: "Ed25519VerificationKey2020",
-            controller: "did:web:example.com:issuer",
-            publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: "other-key" },
-          },
-        ],
-      };
-
-      mockDidResolver.resolve.mockResolvedValue(didDoc);
-      mockSignatureVerifier.mockResolvedValue({ valid: true });
-      mockStatusListResolver.checkStatus.mockResolvedValue(false);
-
-      const result = await verifier.verifyDelegationCredential(mockValidVC);
-
-      expect(result.valid).toBe(true);
-      expect(mockSignatureVerifier).toHaveBeenCalledWith(mockValidVC, {
-        kty: "OKP",
-        crv: "Ed25519",
-        x: "mock-key",
-      });
-    });
-  });
-});