@kya-os/mcp 1.16.2 → 1.17.0

package/dist/delegation/delegation-graph.d.ts

@@ -6,13 +6,27 @@
  *
  * Related Spec: KYA-OS §4.4, Delegation Chains
  */
+import type { CredentialStatus } from '../types/protocol.js';
 export interface DelegationNode {
     id: string;
     parentId: string | null;
     children: string[];
     issuerDid: string;
     subjectDid: string;
+    /**
+     * Reference to the node's status list entry. Revocation flips a status bit
+     * only when it has the form `<statusListCredential>#<index>`; prefer
+     * {@link credentialStatus}, which needs no parsing.
+     */
     credentialStatusId?: string;
+    /** The node's status list entry, as carried in the credential. */
+    credentialStatus?: CredentialStatus;
+    /**
+     * Set when the delegation is revoked in the graph (SPEC.md §6.5 step 1).
+     * Recorded independently of the status list bit, so revocation holds even
+     * for a delegation that has no status list entry.
+     */
+    revoked?: boolean;
 }
 export interface DelegationGraphStorageProvider {
     getNode(delegationId: string): Promise<DelegationNode | null>;
@@ -24,6 +38,13 @@ export interface DelegationGraphStorageProvider {
 }
 /** Optional transaction seam for providers that can link parent and child atomically. */
 export interface AtomicDelegationGraphStorageProvider extends DelegationGraphStorageProvider {
+    /**
+     * Insert `node` and link it under its parent in one step. When the id is
+     * already stored, a node identical in every registered field is a no-op,
+     * and any other SHOULD be rejected: overwriting would drop the stored node's
+     * revocation state and children. `DelegationGraphManager` checks first, but
+     * only the provider can close the race between that check and the write.
+     */
     registerNodeAtomic(node: DelegationNode): Promise<void>;
 }
 export declare class DelegationGraphManager {
@@ -35,9 +56,18 @@ export declare class DelegationGraphManager {
         issuerDid: string;
         subjectDid: string;
         credentialStatusId?: string;
+        credentialStatus?: CredentialStatus;
     }): Promise<DelegationNode>;
     private addChildToParent;
     getNode(delegationId: string): Promise<DelegationNode | null>;
+    /**
+     * Record (or clear) the graph's revocation mark on one node, and report
+     * whether the stored node now carries it. The node is read back because a
+     * provider that persists a fixed set of node fields may silently drop
+     * `revoked`. Descendants are left to the caller; cascading revocation walks
+     * the subtree itself.
+     */
+    setRevoked(delegationId: string, revoked: boolean): Promise<boolean>;
     getChildren(delegationId: string): Promise<DelegationNode[]>;
     getDescendants(delegationId: string): Promise<DelegationNode[]>;
     getChain(delegationId: string): Promise<DelegationNode[]>;
@@ -50,4 +80,3 @@ export declare class DelegationGraphManager {
     removeDelegation(delegationId: string): Promise<void>;
 }
 export declare function createDelegationGraph(storage: DelegationGraphStorageProvider): DelegationGraphManager;
-//# sourceMappingURL=delegation-graph.d.ts.map

package/dist/delegation/delegation-graph.js

@@ -6,6 +6,7 @@
  *
  * Related Spec: KYA-OS §4.4, Delegation Chains
  */
+import { registrationConflict } from './delegation-registration.js';
 function supportsAtomicRegistration(storage) {
     return 'registerNodeAtomic' in storage &&
         typeof storage.registerNodeAtomic === 'function';
@@ -23,13 +24,29 @@ export class DelegationGraphManager {
             issuerDid: params.issuerDid,
             subjectDid: params.subjectDid,
             credentialStatusId: params.credentialStatusId,
+            ...(params.credentialStatus ? { credentialStatus: params.credentialStatus } : {}),
         };
+        if (params.parentId === params.id) {
+            throw new Error(`Delegation ${params.id} cannot be its own parent`);
+        }
         if (params.parentId) {
             const parent = await this.storage.getNode(params.parentId);
             if (!parent) {
                 throw new Error(`Parent delegation not found: ${params.parentId}`);
             }
         }
+        // Registering an id again is a no-op when nothing registered changes, so
+        // a retry is safe. Anything else would replace the stored node, losing its
+        // revocation state and children or relinking it under its own descendant,
+        // so it is refused.
+        const existing = await this.storage.getNode(params.id);
+        if (existing) {
+            const conflict = registrationConflict(existing, node);
+            if (conflict === undefined) {
+                return existing;
+            }
+            throw new Error(`Delegation ${params.id} is already registered with a different ${conflict}`);
+        }
         if (supportsAtomicRegistration(this.storage)) {
             await this.storage.registerNodeAtomic(node);
         }
@@ -65,6 +82,22 @@ export class DelegationGraphManager {
     async getNode(delegationId) {
         return this.storage.getNode(delegationId);
     }
+    /**
+     * Record (or clear) the graph's revocation mark on one node, and report
+     * whether the stored node now carries it. The node is read back because a
+     * provider that persists a fixed set of node fields may silently drop
+     * `revoked`. Descendants are left to the caller; cascading revocation walks
+     * the subtree itself.
+     */
+    async setRevoked(delegationId, revoked) {
+        const node = await this.storage.getNode(delegationId);
+        if (!node) {
+            throw new Error(`Delegation not found: ${delegationId}`);
+        }
+        await this.storage.setNode({ ...node, revoked });
+        const stored = await this.storage.getNode(delegationId);
+        return (stored?.revoked ?? false) === revoked;
+    }
     async getChildren(delegationId) {
         return this.storage.getChildren(delegationId);
     }

package/dist/delegation/delegation-graph.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation-graph.js","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyBH,SAAS,0BAA0B,CACjC,OAAuC;IAEvC,OAAO,oBAAoB,IAAI,OAAO;QACpC,OAAO,OAAO,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,sBAAsB;IACb;IAApB,YAAoB,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAE/D,KAAK,CAAC,kBAAkB,CAAC,MAMxB;QACC,MAAM,IAAI,GAAmB;YAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;SAC9C,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,aAAa,CAAC,EACtB,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,YAAoB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAExB,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,UAAU,EAAE;iBAC1H,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBACjC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,aAAa,KAAK,CAAC,QAAQ,yBAAyB,MAAM,CAAC,EAAE,EAAE;iBAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAuC;IAEvC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"delegation-graph.js","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AA6CpE,SAAS,0BAA0B,CACjC,OAAuC;IAEvC,OAAO,oBAAoB,IAAI,OAAO;QACpC,OAAO,OAAO,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,sBAAsB;IACb;IAApB,YAAoB,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAE/D,KAAK,CAAC,kBAAkB,CAAC,MAOxB;QACC,MAAM,IAAI,GAAmB;YAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,EAAE,2BAA2B,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,oBAAoB;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,EAAE,2CAA2C,QAAQ,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,aAAa,CAAC,EACtB,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB,EAAE,OAAgB;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,KAAK,OAAO,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,YAAoB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAExB,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,UAAU,EAAE;iBAC1H,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBACjC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,aAAa,KAAK,CAAC,QAAQ,yBAAyB,MAAM,CAAC,EAAE,EAAE;iBAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAuC;IAEvC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/delegation/delegation-registration.d.ts

@@ -0,0 +1,22 @@
+/**
+ * When registering an already-registered delegation id is a harmless repeat
+ * and when it is a conflict — one rule shared by `DelegationGraphManager` and
+ * the memory store's atomic path.
+ *
+ * Internal: not re-exported from the delegation barrel.
+ */
+import type { DelegationNode } from './delegation-graph.js';
+/**
+ * The first caller-supplied field on which `incoming` differs from the stored
+ * node, or `undefined` when registering it again would change nothing.
+ *
+ * Compared: every field a caller passes to `registerDelegation` — `parentId`,
+ * `issuerDid`, `subjectDid`, `credentialStatusId` and `credentialStatus`. An
+ * absent field, `undefined` and `null` are the same, since a store that
+ * persists nodes may drop or null out any of them. Not compared: `children`,
+ * which later registrations of other nodes derive, and `revoked`, which
+ * revocation sets. A repeat registration supplies neither, so it must leave
+ * both as stored: overwriting them is what read a revoked subtree as live
+ * again.
+ */
+export declare function registrationConflict(stored: DelegationNode, incoming: DelegationNode): string | undefined;

package/dist/delegation/delegation-registration.js

@@ -0,0 +1,51 @@
+/**
+ * When registering an already-registered delegation id is a harmless repeat
+ * and when it is a conflict — one rule shared by `DelegationGraphManager` and
+ * the memory store's atomic path.
+ *
+ * Internal: not re-exported from the delegation barrel.
+ */
+/**
+ * The first caller-supplied field on which `incoming` differs from the stored
+ * node, or `undefined` when registering it again would change nothing.
+ *
+ * Compared: every field a caller passes to `registerDelegation` — `parentId`,
+ * `issuerDid`, `subjectDid`, `credentialStatusId` and `credentialStatus`. An
+ * absent field, `undefined` and `null` are the same, since a store that
+ * persists nodes may drop or null out any of them. Not compared: `children`,
+ * which later registrations of other nodes derive, and `revoked`, which
+ * revocation sets. A repeat registration supplies neither, so it must leave
+ * both as stored: overwriting them is what read a revoked subtree as live
+ * again.
+ */
+export function registrationConflict(stored, incoming) {
+    if ((stored.parentId ?? null) !== (incoming.parentId ?? null))
+        return 'parentId';
+    if (stored.issuerDid !== incoming.issuerDid)
+        return 'issuerDid';
+    if (stored.subjectDid !== incoming.subjectDid)
+        return 'subjectDid';
+    if ((stored.credentialStatusId ?? undefined) !== (incoming.credentialStatusId ?? undefined)) {
+        return 'credentialStatusId';
+    }
+    if (!sameStatusEntry(stored.credentialStatus, incoming.credentialStatus)) {
+        return 'credentialStatus';
+    }
+    return undefined;
+}
+/**
+ * Member-wise equality of two status entries, in any member order. Members are
+ * compared by value when they are strings, as every standard member is;
+ * anything nested compares by identity, so an unusual entry reads as a
+ * conflict rather than a repeat.
+ */
+function sameStatusEntry(a, b) {
+    if (!a || !b) {
+        return !a && !b;
+    }
+    const left = a;
+    const right = b;
+    const keys = new Set([...Object.keys(left), ...Object.keys(right)]);
+    return [...keys].every((key) => (left[key] ?? undefined) === (right[key] ?? undefined));
+}
+//# sourceMappingURL=delegation-registration.js.map

package/dist/delegation/delegation-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-registration.js","sourceRoot":"","sources":["../../src/delegation/delegation-registration.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsB,EACtB,QAAwB;IAExB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACjF,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAAE,OAAO,WAAW,CAAC;IAChE,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO,YAAY,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,IAAI,SAAS,CAAC,EAAE,CAAC;QAC5F,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,CAAsC,EACtC,CAAsC;IAEtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,CAAuC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAuC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/delegation/delegation-status-entry.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The status list entry behind a delegation graph node — one reading shared by
+ * cascading revocation, which flips and reads it.
+ *
+ * Internal: not re-exported from the delegation barrel.
+ */
+import type { CredentialStatus } from '../types/protocol.js';
+import type { DelegationNode } from './delegation-graph.js';
+/**
+ * Read a legacy `credentialStatusId` as a revocation status list entry, or
+ * `undefined` when it does not name a list and an index. A W3C
+ * `credentialStatus.id` may be any URI (`urn:uuid:…`, say); such a node has no
+ * bit to flip, and the graph's own `revoked` mark carries its revocation. An
+ * index past the safe integer range throws: it names an entry, just not one
+ * any list can hold, so it must not read as "no entry".
+ */
+export declare function parseCredentialStatusId(credentialStatusId: string): CredentialStatus | undefined;
+/**
+ * The node's status list entry: the structured `credentialStatus` when stored,
+ * else the parsed legacy `credentialStatusId`, else `undefined` (no entry).
+ */
+export declare function nodeStatusEntry(node: DelegationNode): CredentialStatus | undefined;

package/dist/delegation/delegation-status-entry.js

@@ -0,0 +1,42 @@
+/**
+ * The status list entry behind a delegation graph node — one reading shared by
+ * cascading revocation, which flips and reads it.
+ *
+ * Internal: not re-exported from the delegation barrel.
+ */
+import { parseStatusListIndex } from '../utils/statuslist-bits.js';
+/** `<statusListCredential>#<index>`, the form the status list manager mints. */
+const STATUS_ENTRY_ID = /^(.+)#(\d+)$/;
+/**
+ * Read a legacy `credentialStatusId` as a revocation status list entry, or
+ * `undefined` when it does not name a list and an index. A W3C
+ * `credentialStatus.id` may be any URI (`urn:uuid:…`, say); such a node has no
+ * bit to flip, and the graph's own `revoked` mark carries its revocation. An
+ * index past the safe integer range throws: it names an entry, just not one
+ * any list can hold, so it must not read as "no entry".
+ */
+export function parseCredentialStatusId(credentialStatusId) {
+    const match = STATUS_ENTRY_ID.exec(credentialStatusId);
+    if (!match) {
+        return undefined;
+    }
+    const [, statusListCredential, index] = match;
+    return {
+        id: credentialStatusId,
+        type: 'StatusList2021Entry',
+        statusPurpose: 'revocation',
+        statusListIndex: String(parseStatusListIndex(index)),
+        statusListCredential: statusListCredential,
+    };
+}
+/**
+ * The node's status list entry: the structured `credentialStatus` when stored,
+ * else the parsed legacy `credentialStatusId`, else `undefined` (no entry).
+ */
+export function nodeStatusEntry(node) {
+    if (node.credentialStatus) {
+        return node.credentialStatus;
+    }
+    return node.credentialStatusId ? parseCredentialStatusId(node.credentialStatusId) : undefined;
+}
+//# sourceMappingURL=delegation-status-entry.js.map

package/dist/delegation/delegation-status-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-status-entry.js","sourceRoot":"","sources":["../../src/delegation/delegation-status-entry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,gFAAgF;AAChF,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,kBAA0B;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IAC9C,OAAO;QACL,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qBAAqB;QAC3B,aAAa,EAAE,YAAY;QAC3B,eAAe,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAM,CAAC,CAAC;QACrD,oBAAoB,EAAE,oBAAqB;KAC5C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC"}

package/dist/delegation/did-key-resolver.d.ts

@@ -65,4 +65,3 @@ export declare function createDidKeyResolver(): DIDResolver;
  * @returns DID Document or null if invalid
  */
 export declare function resolveDidKeySync(did: string): DIDDocument | null;
-//# sourceMappingURL=did-key-resolver.d.ts.map

package/dist/delegation/did-key-resolver.js

@@ -21,6 +21,14 @@ import { logger } from '../logging/index.js';
 export const ED25519_MULTICODEC_PREFIX = new Uint8Array([0xed, 0x01]);
 /** Ed25519 public key length */
 export const ED25519_PUBLIC_KEY_LENGTH = 32;
+/**
+ * Longest base58btc part (after `did:key:z`) worth decoding. Every Ed25519
+ * did:key encodes exactly 34 bytes (the 0xed01 prefix and the 32-byte key),
+ * which is always 47 characters, so a longer string cannot be one. The bound
+ * leaves headroom over 47 while keeping an attacker-sized DID (a proof's
+ * `meta.did`, a credential's issuer or subject) away from the decoder.
+ */
+const MAX_DID_KEY_BASE58_LENGTH = 64;
 /**
  * Check if a DID is a valid did:key with Ed25519 key
  *
@@ -49,10 +57,13 @@ export function extractPublicKeyFromDidKey(did) {
         const multibaseKey = did.replace('did:key:', '');
         // Remove the 'z' multibase prefix (base58btc)
         const base58Encoded = multibaseKey.slice(1);
-        // Decode from base58
-        const multicodecBytes = base58Decode(base58Encoded);
-        // Check for Ed25519 multicodec prefix (0xed 0x01)
-        if (multicodecBytes.length < ED25519_MULTICODEC_PREFIX.length + ED25519_PUBLIC_KEY_LENGTH ||
+        // Bounded before decoding (base58 decoding is quadratic in input length):
+        // anything longer than an Ed25519 did:key throws here, unread, and the
+        // catch below returns null.
+        const multicodecBytes = base58Decode(base58Encoded, MAX_DID_KEY_BASE58_LENGTH);
+        // Exactly the Ed25519 multicodec prefix (0xed 0x01) and a 32-byte key:
+        // trailing bytes are not part of any key.
+        if (multicodecBytes.length !== ED25519_MULTICODEC_PREFIX.length + ED25519_PUBLIC_KEY_LENGTH ||
             multicodecBytes[0] !== ED25519_MULTICODEC_PREFIX[0] ||
             multicodecBytes[1] !== ED25519_MULTICODEC_PREFIX[1]) {
             return null;

package/dist/delegation/did-key-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"did-key-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-key-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEtE,gCAAgC;AAChC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5C,qBAAqB;QACrB,MAAM,eAAe,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAEpD,kDAAkD;QAClD,IACE,eAAe,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,GAAG,yBAAyB;YACrF,eAAe,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;YACnD,eAAe,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC,EACnD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kDAAkD;QAClD,OAAO,eAAe,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,cAA0B;IAKvD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,GAAW,EAA+B,EAAE;YAC1D,uCAAuC;YACvC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,yBAAyB;YACzB,MAAM,cAAc,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,iBAAiB;YACjB,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;YAEpD,uDAAuD;YACvD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAEjD,oCAAoC;YACpC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAErC,MAAM,kBAAkB,GAAuB;gBAC7C,EAAE,EAAE,GAAG,GAAG,IAAI,QAAQ,EAAE;gBACxB,IAAI,EAAE,4BAA4B;gBAClC,UAAU,EAAE,GAAG;gBACf,YAAY;gBACZ,kBAAkB,EAAE,YAAY;aACjC,CAAC;YAEF,wCAAwC;YACxC,OAAO;gBACL,EAAE,EAAE,GAAG;gBACP,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;gBACxC,cAAc,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;gBACtC,eAAe,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;aACxC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,kBAAkB,GAAuB;QAC7C,EAAE,EAAE,GAAG,GAAG,IAAI,QAAQ,EAAE;QACxB,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,GAAG;QACf,YAAY;QACZ,kBAAkB,EAAE,YAAY;KACjC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,GAAG;QACP,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACxC,cAAc,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QACtC,eAAe,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"did-key-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-key-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEtE,gCAAgC;AAChC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5C,0EAA0E;QAC1E,uEAAuE;QACvE,4BAA4B;QAC5B,MAAM,eAAe,GAAG,YAAY,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;QAE/E,uEAAuE;QACvE,0CAA0C;QAC1C,IACE,eAAe,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM,GAAG,yBAAyB;YACvF,eAAe,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;YACnD,eAAe,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC,EACnD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kDAAkD;QAClD,OAAO,eAAe,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,cAA0B;IAKvD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,GAAW,EAA+B,EAAE;YAC1D,uCAAuC;YACvC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,yBAAyB;YACzB,MAAM,cAAc,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,iBAAiB;YACjB,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;YAEpD,uDAAuD;YACvD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAEjD,oCAAoC;YACpC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAErC,MAAM,kBAAkB,GAAuB;gBAC7C,EAAE,EAAE,GAAG,GAAG,IAAI,QAAQ,EAAE;gBACxB,IAAI,EAAE,4BAA4B;gBAClC,UAAU,EAAE,GAAG;gBACf,YAAY;gBACZ,kBAAkB,EAAE,YAAY;aACjC,CAAC;YAEF,wCAAwC;YACxC,OAAO;gBACL,EAAE,EAAE,GAAG;gBACP,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;gBACxC,cAAc,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;gBACtC,eAAe,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;aACxC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,kBAAkB,GAAuB;QAC7C,EAAE,EAAE,GAAG,GAAG,IAAI,QAAQ,EAAE;QACxB,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,GAAG;QACf,YAAY;QACZ,kBAAkB,EAAE,YAAY;KACjC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,GAAG;QACP,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACxC,cAAc,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QACtC,eAAe,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/delegation/did-linkage.d.ts

@@ -20,4 +20,3 @@ export declare function verifyDidLinkage(options: VerifyDidLinkageOptions): DidL
 export declare function hasAlsoKnownAs(document: DIDDocument, did: string): boolean;
 export declare function normalizeDid(did: string): string;
 export declare function isDidDocument(value: unknown): value is DIDDocument;
-//# sourceMappingURL=did-linkage.d.ts.map

package/dist/delegation/did-resolver-registry.d.ts

@@ -4,4 +4,3 @@ export type DIDResolverFactory = (fetchProvider: FetchProvider) => DIDResolver;
 export type DIDResolverRegistryEntry = DIDResolver | DIDResolverFactory;
 export type DIDResolverRegistry = Record<string, DIDResolverRegistryEntry>;
 export declare function buildDidResolverRegistry(entries: DIDResolverRegistry | undefined, fetchProvider: FetchProvider | undefined): Record<string, DIDResolver>;
-//# sourceMappingURL=did-resolver-registry.d.ts.map

package/dist/delegation/did-web-resolver.d.ts

@@ -141,4 +141,3 @@ export interface BuildDidWebDocumentOptions {
  */
 export declare function buildDidWebDocument(identity: Identity | Identity[], options?: BuildDidWebDocumentOptions): DIDDocument;
 export {};
-//# sourceMappingURL=did-web-resolver.d.ts.map

package/dist/delegation/did-web-resolver.js

@@ -69,6 +69,31 @@ function isValidVerificationMethod(value) {
 export function isDidWeb(did) {
     return did.startsWith('did:web:');
 }
+/**
+ * Decode and validate the host component of a did:web DID. It is
+ * percent-decoded whole, as before, so a port (`%3A`), a bracketed IPv6
+ * literal and an internationalized name still resolve. What it decodes to
+ * must still be a host and nothing more: `@`, `/`, `\`, `?` or `#` would let
+ * it supply userinfo, a path, a query or a fragment and fetch from a host or
+ * resource other than the one the DID names, and so would whitespace, a
+ * control character, or a `:` beyond one port separator (a bracketed IPv6
+ * literal keeps its own colons). Returns the host with its optional `:port`,
+ * or `null`.
+ */
+function parseDidWebHost(label) {
+    let host;
+    try {
+        host = decodeURIComponent(label);
+    }
+    catch {
+        return null;
+    }
+    if (host.length === 0 || /[@/\\?#\s\p{Cc}]/u.test(host)) {
+        return null;
+    }
+    const afterLiteral = host.startsWith('[') ? host.slice(host.indexOf(']') + 1) : host;
+    return afterLiteral.split(':').length <= 2 ? host : null;
+}
 /**
  * Parse a did:web DID into its components
  *
@@ -86,13 +111,23 @@ export function parseDidWeb(did) {
     }
     // Split by ':' to get domain and path components
     const parts = remainder.split(':');
-    // First part is the domain (URL-decoded)
-    const domain = decodeURIComponent(parts[0]);
-    if (domain.length === 0) {
+    const domain = parseDidWebHost(parts[0]);
+    if (domain === null) {
+        return null;
+    }
+    // Remaining parts form the path. Each is one segment: a decoded separator
+    // or dot-segment would move the fetch to a different resource.
+    let path;
+    try {
+        path = parts.slice(1).map((p) => decodeURIComponent(p));
+    }
+    catch {
+        return null;
+    }
+    const isSegment = (segment) => segment !== '' && segment !== '.' && segment !== '..' && !/[/\\?#]/.test(segment);
+    if (!path.every(isSegment)) {
         return null;
     }
-    // Remaining parts form the path
-    const path = parts.slice(1).map((p) => decodeURIComponent(p));
     return { domain, path };
 }
 /**

package/dist/delegation/did-web-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"did-web-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAUvD;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,sCAAsC;IACtC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,KAAgC,CAAC;IAE5C,gDAAgD;IAChD,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,yCAAyC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEhC,gBAAgB;IAChB,6CAA6C;IAC7C,IAAI,GAAG,GAAG,WAAW,MAAM,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,yCAAyC;QACzC,GAAG,IAAI,uBAAuB,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,aAAa,CAAgB;IAC7B,KAAK,CAA4D;IACjE,QAAQ,CAAS;IAEzB,YAAY,aAA4B,EAAE,OAA+B;QACvE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,oBAAoB;IACpE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,iBAAiB;QACjB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,aAAa;YACb,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,uDAAuD,GAAG,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;aACtC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oCAAoC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACvG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA+B;IAE/B,OAAO,IAAI,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,2EAA2E;AAC3E,MAAM,yBAAyB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,wBAAwB,GAAsB;IAClD,8BAA8B;IAC9B,kDAAkD;CACnD,CAAC;AAoBF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAA+B,EAC/B,OAAoC;IAEpC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEnE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,iEAAiE,GAAG,IAAI,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAC/C,oBAAoB,CAAC,EAAE,EAAE,GAAG,CAAC,CAC9B,CAAC;IAEF,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,kBAAkB,EAAE,MAAM;QAClD,CAAC,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC9D,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;IAElC,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,EAAE,EAAE,GAAG;QACP,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,kBAAkB;QAClB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,WAAmB;IAEnB,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,gEAAgE,QAAQ,CAAC,GAAG,gBAAgB,WAAW,GAAG,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,GAAG,sCAAsC,WAAW,GAAG,CACvG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,GAAG;QAChB,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,WAAW;QACvB,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC;QAC5C,kBAAkB,EAAE,sBAAsB,CAAC,cAAc,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,eAAuB;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,iEAAiE,KAAK,CAAC,MAAM,4BAA4B,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,cAA0B;IACxD,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,yBAAyB,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CACzD,CAAC;IACF,UAAU,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"did-web-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAUvD;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,sCAAsC;IACtC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,KAAgC,CAAC;IAE5C,gDAAgD;IAChD,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,OAAe,EAAW,EAAE,CAC7C,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEhC,gBAAgB;IAChB,6CAA6C;IAC7C,IAAI,GAAG,GAAG,WAAW,MAAM,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,yCAAyC;QACzC,GAAG,IAAI,uBAAuB,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,aAAa,CAAgB;IAC7B,KAAK,CAA4D;IACjE,QAAQ,CAAS;IAEzB,YAAY,aAA4B,EAAE,OAA+B;QACvE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,oBAAoB;IACpE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,iBAAiB;QACjB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,aAAa;YACb,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,uDAAuD,GAAG,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;aACtC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oCAAoC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACvG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA+B;IAE/B,OAAO,IAAI,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,2EAA2E;AAC3E,MAAM,yBAAyB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,wBAAwB,GAAsB;IAClD,8BAA8B;IAC9B,kDAAkD;CACnD,CAAC;AAoBF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAA+B,EAC/B,OAAoC;IAEpC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEnE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,iEAAiE,GAAG,IAAI,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAC/C,oBAAoB,CAAC,EAAE,EAAE,GAAG,CAAC,CAC9B,CAAC;IAEF,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,kBAAkB,EAAE,MAAM;QAClD,CAAC,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC9D,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;IAElC,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,EAAE,EAAE,GAAG;QACP,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,kBAAkB;QAClB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,WAAmB;IAEnB,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,gEAAgE,QAAQ,CAAC,GAAG,gBAAgB,WAAW,GAAG,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,GAAG,sCAAsC,WAAW,GAAG,CACvG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,GAAG;QAChB,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,WAAW;QACvB,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC;QAC5C,kBAAkB,EAAE,sBAAsB,CAAC,cAAc,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,eAAuB;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,iEAAiE,KAAK,CAAC,MAAM,4BAA4B,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,cAA0B;IACxD,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,yBAAyB,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CACzD,CAAC;IACF,UAAU,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;AACxC,CAAC"}

package/dist/delegation/holder-binding.d.ts

@@ -21,25 +21,22 @@
  * legitimate traffic. Callers MUST surface that gap (e.g. log it) rather than
  * treat `not_applicable` as success.
  */
+import { isKyaOsControlArg } from '../proof/covered-request.js';
 import type { ProofVerifier } from '../proof/verifier.js';
 import type { ToolRequest, ToolResponse, ProofAgentIdentity } from '../proof/generator.js';
 import type { DetachedProof } from '../types/protocol.js';
 import type { CryptoProvider } from '../providers/base.js';
-/**
- * Whether an argument key is reserved KYA-OS protocol envelope (`_kyaos*`:
- * `_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`, …) rather than caller
- * tool intent. The SINGLE predicate behind both the holder-binding request hash
- * and the middleware's handler-arg stripping, so the set excluded from the bound
- * hash and the set withheld from the handler cannot drift — a proof binds exactly
- * the call the handler runs.
- */
-export declare function isKyaOsControlArg(key: string): boolean;
+export { isKyaOsControlArg };
 /**
  * The canonical request a holder-binding proof binds: the tool name plus the
  * caller's business arguments, with protocol control args stripped. SHARED by
  * the client (when minting the proof) and the PEP (when verifying it) so the two
  * cannot drift — the request hash is computed over the identical shape on both
  * sides regardless of which control args rode along.
+ *
+ * This is the legacy shape 1.x clients sign. The PEP's verifier also accepts a
+ * proof over the SPEC §7.3 `tools/call` request for the same call, so a client
+ * that follows the specification is bound too.
  */
 export declare function toHolderBindingRequest(toolName: string, args: Record<string, unknown>): ToolRequest;
 export interface GenerateRequestProofInput {
@@ -91,7 +88,11 @@ export interface AssertHolderBindingInput {
     proof: DetachedProof;
     /** The delegation subject DID the proof must be bound to. */
     subjectDid: string;
-    /** The request the proof must bind (content binding). */
+    /**
+     * The request the proof must bind (content binding). A proof over either
+     * shape of this call, the legacy one or the SPEC §7.3 `tools/call` request,
+     * is accepted.
+     */
     request: ToolRequest;
     /**
      * The response the proof binds, when the proof carries one. Inbound request
@@ -125,4 +126,3 @@ export interface HolderBindingResult {
  *   property each branch enforces.
  */
 export declare function assertHolderBinding(input: AssertHolderBindingInput): Promise<HolderBindingResult>;
-//# sourceMappingURL=holder-binding.d.ts.map

package/dist/delegation/holder-binding.js

@@ -24,30 +24,21 @@
 import { extractPublicKeyFromDidKey, publicKeyToJwk } from './did-key-resolver.js';
 import { getDidMethod, didKeyFragment } from '../utils/did-helpers.js';
 import { ProofGenerator } from '../proof/generator.js';
+import { isKyaOsControlArg } from '../proof/covered-request.js';
 import { base64urlEncodeFromBytes } from '../utils/base64.js';
-/**
- * The control-arg key prefix. Args beginning with this are protocol envelope
- * (`_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`), not the caller's
- * tool intent, so they are excluded from the holder-binding request hash.
- */
-const KYAOS_CONTROL_PREFIX = '_kyaos';
-/**
- * Whether an argument key is reserved KYA-OS protocol envelope (`_kyaos*`:
- * `_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`, …) rather than caller
- * tool intent. The SINGLE predicate behind both the holder-binding request hash
- * and the middleware's handler-arg stripping, so the set excluded from the bound
- * hash and the set withheld from the handler cannot drift — a proof binds exactly
- * the call the handler runs.
- */
-export function isKyaOsControlArg(key) {
-    return key.startsWith(KYAOS_CONTROL_PREFIX);
-}
+// The control-arg predicate lives with the request-hash rules it feeds; it is
+// re-exported here, where the middleware and package entry point import it.
+export { isKyaOsControlArg };
 /**
  * The canonical request a holder-binding proof binds: the tool name plus the
  * caller's business arguments, with protocol control args stripped. SHARED by
  * the client (when minting the proof) and the PEP (when verifying it) so the two
  * cannot drift — the request hash is computed over the identical shape on both
  * sides regardless of which control args rode along.
+ *
+ * This is the legacy shape 1.x clients sign. The PEP's verifier also accepts a
+ * proof over the SPEC §7.3 `tools/call` request for the same call, so a client
+ * that follows the specification is bound too.
  */
 export function toHolderBindingRequest(toolName, args) {
     const params = {};

package/dist/delegation/holder-binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"holder-binding.js","sourceRoot":"","sources":["../../src/delegation/holder-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAO9D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,IAA6B;IAE7B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,cAAc,GAAG,SAAS,IAAI,OAAO,wBAAwB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;QACjD,SAAS,EAAE,cAAc;QACzB,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAY5D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,0BAA0B,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAoCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAExF,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,eAAe,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EACJ,yDAAyD;gBACzD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,SAAS,oCAAoC;SAChF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,+EAA+E;IAC/E,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,+BAA+B;SACxC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,gEAAgE;IAChE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,2CAA2C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,CAAe,CAAC;IACjE,UAAU,CAAC,GAAG,GAAG,GAAG,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE;QACtE,OAAO;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"holder-binding.js","sourceRoot":"","sources":["../../src/delegation/holder-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAO9D,8EAA8E;AAC9E,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,IAA6B;IAE7B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,cAAc,GAAG,SAAS,IAAI,OAAO,wBAAwB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;QACjD,SAAS,EAAE,cAAc;QACzB,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAY5D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,0BAA0B,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAwCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAExF,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,eAAe,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EACJ,yDAAyD;gBACzD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,SAAS,oCAAoC;SAChF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,+EAA+E;IAC/E,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,+BAA+B;SACxC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,gEAAgE;IAChE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,2CAA2C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,CAAe,CAAC;IACjE,UAAU,CAAC,GAAG,GAAG,GAAG,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE;QACtE,OAAO;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/delegation/index.d.ts

@@ -26,4 +26,3 @@ export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUr
 export { verifyDidLinkage, type DidLinkageVerificationResult, type VerifyDidLinkageOptions, } from './did-linkage.js';
 export { MemoryStatusListStorage } from './storage/memory-statuslist-storage.js';
 export { MemoryDelegationGraphStorage } from './storage/memory-graph-storage.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/delegation/outbound-headers.d.ts

@@ -76,4 +76,3 @@ export interface OutboundDelegationHeaders {
  * ```
  */
 export declare function buildOutboundDelegationHeaders(context: OutboundDelegationContext): Promise<OutboundDelegationHeaders>;
-//# sourceMappingURL=outbound-headers.d.ts.map

package/dist/delegation/outbound-proof.d.ts

@@ -40,4 +40,3 @@ export interface DelegationProofOptions {
  */
 export declare function buildDelegationProofJWT(options: DelegationProofOptions): Promise<string>;
 export declare function buildChainString(delegation: DelegationRecord): string;
-//# sourceMappingURL=outbound-proof.d.ts.map