@kya-os/mcp 1.16.2 → 1.17.0

package/dist/delegation/scope-matcher.d.ts

@@ -1,4 +1,4 @@
-import type { DelegationCredential } from '../types/protocol.js';
+import type { DelegationCredential, CrispScope } from '../types/protocol.js';
 export type ScopeMatcher = 'exact' | 'prefix' | 'path-prefix' | 'regex';
 /**
  * Match a single requested scope/resource value against a pattern by matcher kind.
@@ -22,6 +22,30 @@ export type ScopeMatcher = 'exact' | 'prefix' | 'path-prefix' | 'regex';
  * engine (e.g. RE2).
  */
 export declare function matchScope(pattern: string, matcher: ScopeMatcher, value: string): boolean;
+/** Opt-in CrispScope[] entries (constraints.crisp.scopes), if any. Null-safe. */
+export declare function crispScopes(credential: DelegationCredential): CrispScope[];
+/**
+ * A credential's whole scope authority in one typed form: its flat scopes as
+ * `exact` matchers, then its CRISP matchers (SPEC.md §6.3). A value is granted
+ * exactly when one of these matches it, which is what {@link scopeSatisfies}
+ * decides. Null-safe.
+ */
+export declare function scopeAuthority(credential: DelegationCredential): CrispScope[];
+/**
+ * Whether `outer` grants every value `inner` grants, proven by a sound rule and
+ * never by sampling. An `exact` inner is decided by {@link matchScope} itself.
+ * Only an identical pattern contains a `regex`, and an empty base or a
+ * malformed entry proves nothing, so an unprovable case is `false` and
+ * attenuation fails closed. Never throws.
+ */
+export declare function matcherContains(outer: CrispScope, inner: CrispScope): boolean;
+/**
+ * Whether some entry of `authority` contains `scope` ({@link matcherContains}),
+ * built once per authority so a check stays linear in the common cases: an
+ * identical entry is found in a set, and only pattern entries are searched,
+ * because an `exact` entry contains nothing but itself.
+ */
+export declare function authorityContains(authority: readonly CrispScope[]): (scope: CrispScope) => boolean;
 export interface ScopeSatisfaction {
     satisfied: boolean;
     /**
@@ -37,4 +61,3 @@ export interface ScopeSatisfaction {
  * `constraints.crisp.scopes[]` entries are honored per their declared matcher.
  */
 export declare function scopeSatisfies(requiredScopeId: string, credential: DelegationCredential): ScopeSatisfaction;
-//# sourceMappingURL=scope-matcher.d.ts.map

package/dist/delegation/scope-matcher.js

@@ -6,6 +6,17 @@ const MAX_VALUE_LEN = 256;
  * `(.{1,9})+`. This is a heuristic reject, NOT a proof of safety.
  */
 const NESTED_QUANTIFIER = /\([^()]*[+*?{][^()]*\)\s*[+*{]/;
+/** A `prefix` pattern's base: one trailing `*` is optional sugar. */
+function prefixBase(pattern) {
+    return pattern.endsWith('*') ? pattern.slice(0, -1) : pattern;
+}
+/** A `path-prefix` pattern's base: a trailing `*` and trailing `/`s are optional sugar. */
+function pathBase(pattern) {
+    let base = prefixBase(pattern);
+    while (base.endsWith('/'))
+        base = base.slice(0, -1);
+    return base;
+}
 /**
  * Match a single requested scope/resource value against a pattern by matcher kind.
  *
@@ -32,16 +43,14 @@ export function matchScope(pattern, matcher, value) {
         case 'exact':
             return pattern === value;
         case 'prefix': {
-            const base = pattern.endsWith('*') ? pattern.slice(0, -1) : pattern;
+            const base = prefixBase(pattern);
             // Refuse to grant universal scope via an empty/`*`-only prefix.
             if (base.length === 0)
                 return false;
             return value.startsWith(base);
         }
         case 'path-prefix': {
-            let base = pattern.endsWith('*') ? pattern.slice(0, -1) : pattern;
-            while (base.endsWith('/'))
-                base = base.slice(0, -1);
+            const base = pathBase(pattern);
             // Refuse to grant universal scope via an empty/`*`-only prefix.
             if (base.length === 0)
                 return false;
@@ -74,9 +83,70 @@ function flatScopes(credential) {
     return [...(d?.scopes ?? []), ...(d?.constraints?.scopes ?? [])];
 }
 /** Opt-in CrispScope[] entries (constraints.crisp.scopes), if any. Null-safe. */
-function crispScopes(credential) {
+export function crispScopes(credential) {
     return credential?.credentialSubject?.delegation?.constraints?.crisp?.scopes ?? [];
 }
+/**
+ * A credential's whole scope authority in one typed form: its flat scopes as
+ * `exact` matchers, then its CRISP matchers (SPEC.md §6.3). A value is granted
+ * exactly when one of these matches it, which is what {@link scopeSatisfies}
+ * decides. Null-safe.
+ */
+export function scopeAuthority(credential) {
+    return [
+        ...flatScopes(credential).map((resource) => ({ resource, matcher: 'exact' })),
+        ...crispScopes(credential),
+    ];
+}
+/**
+ * Sound containment rules for pattern matchers, keyed `<inner>:<outer>` and
+ * applied to non-empty bases: each holds only when every value the inner
+ * pattern matches, the outer one matches too.
+ */
+const CONTAINMENT = new Map([
+    ['prefix:prefix', (inner, outer) => inner.startsWith(outer)],
+    ['path-prefix:path-prefix', (inner, outer) => inner === outer || inner.startsWith(`${outer}/`)],
+    ['path-prefix:prefix', (inner, outer) => inner.startsWith(outer)],
+    ['prefix:path-prefix', (inner, outer) => inner.startsWith(`${outer}/`)],
+]);
+const baseOf = (scope) => scope.matcher === 'path-prefix' ? pathBase(scope.resource) : prefixBase(scope.resource);
+/** Credentials are untrusted input: an entry without a string resource and matcher is not a scope. */
+function isCrispScope(scope) {
+    const entry = scope;
+    return typeof entry?.resource === 'string' && typeof entry.matcher === 'string';
+}
+const scopeKey = (scope) => `${scope.matcher}\u0000${scope.resource}`;
+/**
+ * Whether `outer` grants every value `inner` grants, proven by a sound rule and
+ * never by sampling. An `exact` inner is decided by {@link matchScope} itself.
+ * Only an identical pattern contains a `regex`, and an empty base or a
+ * malformed entry proves nothing, so an unprovable case is `false` and
+ * attenuation fails closed. Never throws.
+ */
+export function matcherContains(outer, inner) {
+    if (!isCrispScope(outer) || !isCrispScope(inner))
+        return false;
+    if (outer.matcher === inner.matcher && outer.resource === inner.resource)
+        return true;
+    if (inner.matcher === 'exact')
+        return matchScope(outer.resource, outer.matcher, inner.resource);
+    const rule = CONTAINMENT.get(`${inner.matcher}:${outer.matcher}`);
+    const [innerBase, outerBase] = [baseOf(inner), baseOf(outer)];
+    return rule !== undefined && innerBase.length > 0 && outerBase.length > 0 && rule(innerBase, outerBase);
+}
+/**
+ * Whether some entry of `authority` contains `scope` ({@link matcherContains}),
+ * built once per authority so a check stays linear in the common cases: an
+ * identical entry is found in a set, and only pattern entries are searched,
+ * because an `exact` entry contains nothing but itself.
+ */
+export function authorityContains(authority) {
+    const granted = authority.filter(isCrispScope);
+    const identical = new Set(granted.map(scopeKey));
+    const patterns = granted.filter((entry) => entry.matcher !== 'exact');
+    return (scope) => isCrispScope(scope) &&
+        (identical.has(scopeKey(scope)) || patterns.some((entry) => matcherContains(entry, scope)));
+}
 /**
  * Decide whether a required scope id is satisfied by a credential.
  *

package/dist/delegation/scope-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-matcher.js","sourceRoot":"","sources":["../../src/delegation/scope-matcher.ts"],"names":[],"mappings":"AAEA,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAI3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAqB,EAAE,KAAa;IAC9E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,OAAO,KAAK,KAAK,CAAC;QAC3B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACpE,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa;gBAAE,OAAO,KAAK,CAAC;YACjF,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YAClD,IAAI,CAAC;gBACH,OAAO,IAAI,MAAM,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,UAAgC;IAClD,MAAM,CAAC,GAAG,UAAU,EAAE,iBAAiB,EAAE,UAAU,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,UAAgC;IACnD,OAAO,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;AACrF,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,eAAuB,EACvB,UAAgC;IAEhC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"scope-matcher.js","sourceRoot":"","sources":["../../src/delegation/scope-matcher.ts"],"names":[],"mappings":"AAEA,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAI3D,qEAAqE;AACrE,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CAAC,OAAe;IAC/B,IAAI,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAqB,EAAE,KAAa;IAC9E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,OAAO,KAAK,KAAK,CAAC;QAC3B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/B,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa;gBAAE,OAAO,KAAK,CAAC;YACjF,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YAClD,IAAI,CAAC;gBACH,OAAO,IAAI,MAAM,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,UAAgC;IAClD,MAAM,CAAC,GAAG,UAAU,EAAE,iBAAiB,EAAE,UAAU,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,UAAgC;IAC1D,OAAO,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,UAAgC;IAC7D,OAAO;QACL,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAc,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,GAAG,WAAW,CAAC,UAAU,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAmE,IAAI,GAAG,CAAC;IAC1F,CAAC,eAAe,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,yBAAyB,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC/G,CAAC,oBAAoB,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC,oBAAoB,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;CACxF,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAE1F,sGAAsG;AACtG,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,KAAK,GAAG,KAA+C,CAAC;IAC9D,OAAO,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;AAClF,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,SAAS,KAAK,CAAC,QAAQ,EAAE,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,KAAiB;IAClE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAgC;IAChE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACtE,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,YAAY,CAAC,KAAK,CAAC;QACnB,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,eAAuB,EACvB,UAAgC;IAEhC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC"}

package/dist/delegation/status-cache.d.ts

@@ -6,4 +6,3 @@ export interface StatusCacheOptions {
     maxEntries?: number;
 }
 export declare function withStatusCache(resolver: StatusListResolver, options: StatusCacheOptions): StatusListResolver;
-//# sourceMappingURL=status-cache.d.ts.map

package/dist/delegation/statuslist-manager.d.ts

@@ -30,7 +30,11 @@ export declare class StatusList2021Manager {
     private decompressor;
     private statusListBaseUrl;
     private defaultListSize;
-    /** Per-status-list mutex to serialize updateStatus calls and prevent race conditions. */
+    /**
+     * Per-status-list mutex. Every read-modify-write of a list (status updates
+     * and first creation) runs inside it, so no writer can overwrite another's
+     * bit with a stale copy.
+     */
     private updateLocks;
     constructor(storage: StatusListStorageProvider, identity: StatusListIdentityProvider, signingFunction: VCSigningFunction, compressor: CompressionFunction, decompressor: DecompressionFunction, options?: {
         statusListBaseUrl?: string;
@@ -38,10 +42,23 @@ export declare class StatusList2021Manager {
     });
     allocateStatusEntry(purpose: 'revocation' | 'suspension'): Promise<CredentialStatus>;
     updateStatus(credentialStatus: CredentialStatus, revoked: boolean): Promise<void>;
+    /**
+     * Run `task` once every earlier task on the same status list has settled,
+     * serializing read-modify-write per list. The task's own error reaches the
+     * caller; the chain stores a non-rejecting copy so later tasks still run.
+     */
+    private withListLock;
     private doUpdateStatus;
     checkStatus(credentialStatus: CredentialStatus): Promise<boolean>;
     getRevokedIndices(statusListId: string): Promise<number[]>;
+    /**
+     * Create the status list on first use and return its capacity in entries.
+     * Runs inside the list's lock and re-reads the list there: a creation that
+     * raced past another must not replace a list that has since recorded a
+     * revocation with a fresh, empty one.
+     */
     private ensureStatusListExists;
+    private createStatusListIfMissing;
     getStatusListBaseUrl(): string;
     getDefaultListSize(): number;
 }
@@ -49,4 +66,3 @@ export declare function createStatusListManager(storage: StatusListStorageProvid
     statusListBaseUrl?: string;
     defaultListSize?: number;
 }): StatusList2021Manager;
-//# sourceMappingURL=statuslist-manager.d.ts.map

package/dist/delegation/statuslist-manager.js

@@ -17,7 +17,11 @@ export class StatusList2021Manager {
     decompressor;
     statusListBaseUrl;
     defaultListSize;
-    /** Per-status-list mutex to serialize updateStatus calls and prevent race conditions. */
+    /**
+     * Per-status-list mutex. Every read-modify-write of a list (status updates
+     * and first creation) runs inside it, so no writer can overwrite another's
+     * bit with a stale copy.
+     */
     updateLocks = new Map();
     constructor(storage, identity, signingFunction, compressor, decompressor, options) {
         this.storage = storage;
@@ -31,7 +35,12 @@ export class StatusList2021Manager {
     async allocateStatusEntry(purpose) {
         const statusListId = `${this.statusListBaseUrl}/${purpose}/v1`;
         const index = await this.storage.allocateIndex(statusListId);
-        await this.ensureStatusListExists(statusListId, purpose);
+        const capacity = await this.ensureStatusListExists(statusListId, purpose);
+        // An index past the end of the list can never be read or set, so refuse
+        // it (SPEC.md §6.7) rather than mint a credential that cannot be revoked.
+        if (index >= capacity) {
+            throw new Error(`Status list ${statusListId} is full: index ${index} is outside its ${capacity} entries`);
+        }
         const credentialStatus = {
             id: `${statusListId}#${index}`,
             type: 'StatusList2021Entry',
@@ -42,15 +51,18 @@ export class StatusList2021Manager {
         return credentialStatus;
     }
     async updateStatus(credentialStatus, revoked) {
-        const { statusListCredential } = credentialStatus;
-        // Serialize updates per status list to prevent concurrent read-modify-write races.
-        // Each call chains on the previous operation for the same list.
-        const previous = this.updateLocks.get(statusListCredential) ?? Promise.resolve();
-        const operation = previous.then(() => this.doUpdateStatus(credentialStatus, revoked));
-        // Store a non-rejecting version so the chain continues even if one update fails
-        this.updateLocks.set(statusListCredential, operation.catch(() => { }));
-        // Propagate the actual error to the caller
-        await operation;
+        await this.withListLock(credentialStatus.statusListCredential, () => this.doUpdateStatus(credentialStatus, revoked));
+    }
+    /**
+     * Run `task` once every earlier task on the same status list has settled,
+     * serializing read-modify-write per list. The task's own error reaches the
+     * caller; the chain stores a non-rejecting copy so later tasks still run.
+     */
+    withListLock(statusListId, task) {
+        const previous = this.updateLocks.get(statusListId) ?? Promise.resolve();
+        const operation = previous.then(task);
+        this.updateLocks.set(statusListId, operation.then(() => undefined, () => undefined));
+        return operation;
     }
     async doUpdateStatus(credentialStatus, revoked) {
         const { statusListCredential, statusListIndex } = credentialStatus;
@@ -59,7 +71,9 @@ export class StatusList2021Manager {
             throw new Error(`Status list not found: ${statusListCredential}`);
         }
         const manager = await BitstringManager.decode(statusList.credentialSubject.encodedList, this.compressor, this.decompressor);
-        const index = parseInt(statusListIndex, 10);
+        // Same strict parse as checkStatus: a lenient one reads "5abc" as 5 and
+        // would flip another credential's bit.
+        const index = parseStatusListIndex(statusListIndex);
         manager.setBit(index, revoked);
         const encodedList = await manager.encode();
         const updatedCredential = {
@@ -103,10 +117,20 @@ export class StatusList2021Manager {
         const manager = await BitstringManager.decode(statusList.credentialSubject.encodedList, this.compressor, this.decompressor);
         return manager.getSetBits();
     }
-    async ensureStatusListExists(statusListId, purpose) {
+    /**
+     * Create the status list on first use and return its capacity in entries.
+     * Runs inside the list's lock and re-reads the list there: a creation that
+     * raced past another must not replace a list that has since recorded a
+     * revocation with a fresh, empty one.
+     */
+    ensureStatusListExists(statusListId, purpose) {
+        return this.withListLock(statusListId, () => this.createStatusListIfMissing(statusListId, purpose));
+    }
+    async createStatusListIfMissing(statusListId, purpose) {
         const existing = await this.storage.getStatusList(statusListId);
         if (existing) {
-            return;
+            const decoded = await BitstringManager.decode(existing.credentialSubject.encodedList, this.compressor, this.decompressor);
+            return decoded.getSize();
         }
         const manager = new BitstringManager(this.defaultListSize, this.compressor, this.decompressor);
         const encodedList = await manager.encode();
@@ -133,6 +157,8 @@ export class StatusList2021Manager {
             proof,
         };
         await this.storage.setStatusList(statusListId, signedCredential);
+        // Capacity as a reader decodes it: whole bytes of the encoded bitstring.
+        return manager.getRawBits().length * 8;
     }
     getStatusListBaseUrl() {
         return this.statusListBaseUrl;

package/dist/delegation/statuslist-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;AACxG,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAsBrE,MAAM,OAAO,qBAAqB;IAOtB;IACA;IACA;IACA;IACA;IAVF,iBAAiB,CAAS;IAC1B,eAAe,CAAS;IAChC,yFAAyF;IACjF,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,YACU,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EAC3C,OAGC;QARO,YAAO,GAAP,OAAO,CAA2B;QAClC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,oBAAe,GAAf,eAAe,CAAmB;QAClC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAM3C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAoC;QAC5D,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEzD,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE;YAC9B,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,YAAY;SACnC,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,gBAAkC,EAAE,OAAgB;QACrE,MAAM,EAAE,oBAAoB,EAAE,GAAG,gBAAgB,CAAC;QAElD,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtF,gFAAgF;QAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,2CAA2C;QAC3C,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,gBAAkC,EAAE,OAAgB;QAC/E,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,oBAAoB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,iBAAiB,GAA6B;YAClD,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,UAAU,CAAC,iBAAiB;gBAC/B,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,kBAAkB,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAQ,kBAA8C,CAAC,OAAO,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,iBAAiB;YACpB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAClD,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,0BAA0B,oBAAoB,uCAAuC,CACtF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,6FAA6F;QAC7F,8CAA8C;QAC9C,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEhG,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,+FAA+F;QAC/F,+EAA+E;QAC/E,MAAM,KAAK,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,YAAoB,EACpB,OAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,kBAAkB,GAAG;YACzB,UAAU,EAAE;gBACV,wCAAwC;gBACxC,yCAAyC;aACtB;YACrB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAqB;YAC9E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC9B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,iBAAiB,EAAE;gBACjB,EAAE,EAAE,GAAG,YAAY,OAAO;gBAC1B,IAAI,EAAE,gBAAyB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,kBAAkB;YACrB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EACnC,OAGC;IAED,OAAO,IAAI,qBAAqB,CAC9B,OAAO,EACP,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,CACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;AACxG,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAsBrE,MAAM,OAAO,qBAAqB;IAWtB;IACA;IACA;IACA;IACA;IAdF,iBAAiB,CAAS;IAC1B,eAAe,CAAS;IAChC;;;;OAIG;IACK,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,YACU,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EAC3C,OAGC;QARO,YAAO,GAAP,OAAO,CAA2B;QAClC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,oBAAe,GAAf,eAAe,CAAmB;QAClC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAM3C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAoC;QAC5D,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,mBAAmB,KAAK,mBAAmB,QAAQ,UAAU,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE;YAC9B,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,YAAY;SACnC,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,gBAAkC,EAAE,OAAgB;QACrE,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAClE,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAC/C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAI,YAAoB,EAAE,IAAsB;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,YAAY,EACZ,SAAS,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CACF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,gBAAkC,EAAE,OAAgB;QAC/E,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,oBAAoB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,iBAAiB,GAA6B;YAClD,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,UAAU,CAAC,iBAAiB;gBAC/B,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,kBAAkB,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAQ,kBAA8C,CAAC,OAAO,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,iBAAiB;YACpB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAClD,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,0BAA0B,oBAAoB,uCAAuC,CACtF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,6FAA6F;QAC7F,8CAA8C;QAC9C,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEhG,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,+FAA+F;QAC/F,+EAA+E;QAC/E,MAAM,KAAK,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACK,sBAAsB,CAC5B,YAAoB,EACpB,OAAoC;QAEpC,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,CAC1C,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,OAAO,CAAC,CACtD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,YAAoB,EACpB,OAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EACtC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;YACF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,kBAAkB,GAAG;YACzB,UAAU,EAAE;gBACV,wCAAwC;gBACxC,yCAAyC;aACtB;YACrB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAqB;YAC9E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC9B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,iBAAiB,EAAE;gBACjB,EAAE,EAAE,GAAG,YAAY,OAAO;gBAC1B,IAAI,EAAE,gBAAyB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,kBAAkB;YACrB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACjE,yEAAyE;QACzE,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EACnC,OAGC;IAED,OAAO,IAAI,qBAAqB,CAC9B,OAAO,EACP,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/delegation/storage/memory-graph-storage.d.ts

@@ -27,7 +27,12 @@ export declare class MemoryDelegationGraphStorage implements DelegationGraphStor
      * Save a delegation node
      */
     setNode(node: DelegationNode): Promise<void>;
-    /** Performs parent validation, child insert, and parent link in one serialization point. */
+    /**
+     * Performs parent validation, child insert, and parent link in one
+     * serialization point. An id that is already stored is left untouched: a
+     * repeat of the same registration is a no-op, and a conflicting one throws
+     * rather than replace the node's revocation state and children.
+     */
     registerNodeAtomic(node: DelegationNode): Promise<void>;
     /**
      * Get all children of a delegation
@@ -65,8 +70,9 @@ export declare class MemoryDelegationGraphStorage implements DelegationGraphStor
         maxDepth: number;
     };
     /**
-     * Synchronous chain retrieval (for stats)
+     * Walk parent links from `delegationId` up to the root, returning the chain
+     * root first. Throws on a parent cycle instead of looping forever: a cycle
+     * has no root, so no chain through it is valid.
      */
     private getChainSync;
 }
-//# sourceMappingURL=memory-graph-storage.d.ts.map

package/dist/delegation/storage/memory-graph-storage.js

@@ -6,6 +6,7 @@
  *
  * SOLID: Implements DelegationGraphStorageProvider interface
  */
+import { registrationConflict } from '../delegation-registration.js';
 /**
  * Memory-based Delegation Graph storage
  *
@@ -30,8 +31,24 @@ export class MemoryDelegationGraphStorage {
     async setNode(node) {
         this.nodes.set(node.id, node);
     }
-    /** Performs parent validation, child insert, and parent link in one serialization point. */
+    /**
+     * Performs parent validation, child insert, and parent link in one
+     * serialization point. An id that is already stored is left untouched: a
+     * repeat of the same registration is a no-op, and a conflicting one throws
+     * rather than replace the node's revocation state and children.
+     */
     async registerNodeAtomic(node) {
+        if (node.parentId === node.id) {
+            throw new Error(`Delegation ${node.id} cannot be its own parent`);
+        }
+        const existing = this.nodes.get(node.id);
+        if (existing !== undefined) {
+            const conflict = registrationConflict(existing, node);
+            if (conflict === undefined) {
+                return;
+            }
+            throw new Error(`Delegation ${node.id} is already registered with a different ${conflict}`);
+        }
         const parent = node.parentId === null ? null : this.nodes.get(node.parentId);
         if (node.parentId !== null && parent === undefined) {
             throw new Error(`Parent delegation not found: ${node.parentId}`);
@@ -63,17 +80,7 @@ export class MemoryDelegationGraphStorage {
      * Get the full chain from root to this delegation
      */
     async getChain(delegationId) {
-        const chain = [];
-        let currentId = delegationId;
-        // Walk up the tree to root
-        while (currentId) {
-            const node = this.nodes.get(currentId);
-            if (!node)
-                break;
-            chain.unshift(node); // Add to front (root first)
-            currentId = node.parentId;
-        }
-        return chain;
+        return this.getChainSync(delegationId);
     }
     /**
      * Get all descendants (children, grandchildren, etc.)
@@ -145,16 +152,23 @@ export class MemoryDelegationGraphStorage {
         };
     }
     /**
-     * Synchronous chain retrieval (for stats)
+     * Walk parent links from `delegationId` up to the root, returning the chain
+     * root first. Throws on a parent cycle instead of looping forever: a cycle
+     * has no root, so no chain through it is valid.
      */
     getChainSync(delegationId) {
         const chain = [];
+        const visited = new Set();
         let currentId = delegationId;
         while (currentId) {
+            if (visited.has(currentId)) {
+                throw new Error(`Delegation graph has a parent cycle at ${currentId}`);
+            }
+            visited.add(currentId);
             const node = this.nodes.get(currentId);
             if (!node)
                 break;
-            chain.unshift(node);
+            chain.unshift(node); // Add to front (root first)
             currentId = node.parentId;
         }
         return chain;

package/dist/delegation/storage/memory-graph-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory-graph-storage.js","sourceRoot":"","sources":["../../../src/delegation/storage/memory-graph-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH;;;;;;;;;GASG;AACH,MAAM,OAAO,4BAA4B;IAG/B,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAElD;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,kBAAkB,CAAC,IAAoB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,YAAY,GAAG;gBACnB,GAAG,MAAM;gBACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;oBACtB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;aAClC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEvB,OAAO,MAAM,CAAC,QAAQ;aACnB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAA0B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,IAAI,SAAS,GAAkB,YAAY,CAAC;QAE5C,2BAA2B;QAC3B,OAAO,SAAS,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,MAAM;YAEjB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B;YACjD,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,MAAM,WAAW,GAAqB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YAEjC,mDAAmD;YACnD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAS;YACrC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,wBAAwB;YACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,SAAS,EAAE,CAAC;wBACd,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,QAAQ;QAMN,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAEtE,sBAAsB;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,YAAoB;QACvC,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,IAAI,SAAS,GAAkB,YAAY,CAAC;QAE5C,OAAO,SAAS,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,MAAM;YAEjB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpB,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"memory-graph-storage.js","sourceRoot":"","sources":["../../../src/delegation/storage/memory-graph-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,OAAO,4BAA4B;IAG/B,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAElD;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAoB;QAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE,2CAA2C,QAAQ,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,YAAY,GAAG;gBACnB,GAAG,MAAM;gBACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;oBACtB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;aAClC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEvB,OAAO,MAAM,CAAC,QAAQ;aACnB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAA0B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,MAAM,WAAW,GAAqB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YAEjC,mDAAmD;YACnD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAS;YACrC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,wBAAwB;YACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,SAAS,EAAE,CAAC;wBACd,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,QAAQ;QAMN,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAEtE,sBAAsB;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,YAAoB;QACvC,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,SAAS,GAAkB,YAAY,CAAC;QAE5C,OAAO,SAAS,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,MAAM;YAEjB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B;YACjD,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/delegation/storage/memory-statuslist-storage.d.ts

@@ -19,4 +19,3 @@ export declare class MemoryStatusListStorage implements HistoricalStatusListStor
     clear(): void;
     getAllStatusListIds(): string[];
 }
-//# sourceMappingURL=memory-statuslist-storage.d.ts.map

package/dist/delegation/utils.d.ts

@@ -6,10 +6,10 @@
 /**
  * Canonicalize a JSON value using RFC 8785 (JSON Canonicalization Scheme).
  *
- * Wraps `json-canonicalize` with input validation to reject values that are
- * not representable in JSON (Infinity, NaN, undefined, functions, symbols,
- * bigints). The underlying library silently coerces these to `"null"` or
- * `"undefined"`, which is dangerous for cryptographic canonicalization where
+ * Delegates to the strict canonicalizer, which rejects values that are not
+ * representable in JSON (Infinity, NaN, undefined, functions, symbols,
+ * bigints) instead of coercing them to `"null"` or `"undefined"` as JSON
+ * serialization does. That matters for cryptographic canonicalization, where
  * distinct inputs must produce distinct outputs.
  *
  * @throws {TypeError} If `obj` is not a valid JSON value
@@ -25,6 +25,7 @@ export interface VCJWTPayload {
     sub?: string;
     aud?: string | string[];
     exp?: number;
+    nbf?: number;
     iat?: number;
     jti?: string;
     vc: Record<string, unknown>;
@@ -46,4 +47,3 @@ export declare function parseVCJWT(jwt: string): {
     signature: string;
     signingInput: string;
 } | null;
-//# sourceMappingURL=utils.d.ts.map

package/dist/delegation/utils.js

@@ -8,10 +8,10 @@ import { canonicalizeJson } from '../utils/canonical-json.js';
 /**
  * Canonicalize a JSON value using RFC 8785 (JSON Canonicalization Scheme).
  *
- * Wraps `json-canonicalize` with input validation to reject values that are
- * not representable in JSON (Infinity, NaN, undefined, functions, symbols,
- * bigints). The underlying library silently coerces these to `"null"` or
- * `"undefined"`, which is dangerous for cryptographic canonicalization where
+ * Delegates to the strict canonicalizer, which rejects values that are not
+ * representable in JSON (Infinity, NaN, undefined, functions, symbols,
+ * bigints) instead of coercing them to `"null"` or `"undefined"` as JSON
+ * serialization does. That matters for cryptographic canonicalization, where
  * distinct inputs must produce distinct outputs.
  *
  * @throws {TypeError} If `obj` is not a valid JSON value

package/dist/delegation/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/delegation/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAsBD,MAAM,UAAU,mBAAmB,CACjC,EAA2B,EAC3B,UAAgC,EAAE;IAQlC,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GACV,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,CAAC,CAAG,EAAE,CAAC,QAAQ,CAA6B,EAAE,CAAC,IAAI,CAAY,CAAC;IACpE,MAAM,OAAO,GAAI,EAAE,CAAC,mBAAmB,CAA6B,EAAE,CAAC,IAAI,CAE9D,CAAC;IAEd,IAAI,GAAuB,CAAC;IAC5B,IAAI,GAAuB,CAAC;IAE5B,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,OAAO,EAAE,CAAC,gBAAgB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,OAAO,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IACjC,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAiB;QAC5B,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,cAAc;KACnB,CAAC;IAEF,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;IACnC,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAErE,MAAM,aAAa,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAE1D,OAAO;QACL,MAAM;QACN,OAAO;QACP,aAAa;QACb,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IACnE,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IAMpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAgB,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAiB,CAAC;QAExD,OAAO;YACL,MAAM;YACN,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,CAAC,CAAE;YACpB,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE;SACxC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/delegation/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAuBD,MAAM,UAAU,mBAAmB,CACjC,EAA2B,EAC3B,UAAgC,EAAE;IAQlC,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GACV,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,CAAC,CAAG,EAAE,CAAC,QAAQ,CAA6B,EAAE,CAAC,IAAI,CAAY,CAAC;IACpE,MAAM,OAAO,GAAI,EAAE,CAAC,mBAAmB,CAA6B,EAAE,CAAC,IAAI,CAE9D,CAAC;IAEd,IAAI,GAAuB,CAAC;IAC5B,IAAI,GAAuB,CAAC;IAE5B,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,OAAO,EAAE,CAAC,gBAAgB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,OAAO,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IACjC,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAiB;QAC5B,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,cAAc;KACnB,CAAC;IAEF,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;IACnC,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAErE,MAAM,aAAa,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAE1D,OAAO;QACL,MAAM;QACN,OAAO;QACP,aAAa;QACb,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IACnE,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IAMpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAgB,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAiB,CAAC;QAExD,OAAO;YACL,MAAM;YACN,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,CAAC,CAAE;YACpB,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE;SACxC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/delegation/vc-issuer.d.ts

@@ -53,4 +53,3 @@ export declare class DelegationCredentialIssuer {
     getIssuerKeyId(): string;
 }
 export declare function createDelegationIssuer(identity: IdentityProvider, signingFunction: VCSigningFunction): DelegationCredentialIssuer;
-//# sourceMappingURL=vc-issuer.d.ts.map

package/dist/delegation/vc-jwt-verify.d.ts

@@ -26,6 +26,12 @@ import type { DIDResolver, DelegationVCVerificationResult } from "./vc-verifier.
  * an issuer other than the key that actually signed the envelope.
  */
 export declare function credentialIssuerDid(credential: DelegationCredential): string | undefined;
+/**
+ * Clock-skew allowance for `nbf` (RFC 7519 section 4.1.5 permits "some small
+ * leeway"). A wallet that stamps `nbf` at issuance must not fail on a verifier
+ * whose clock runs a few seconds behind. `exp` gets no leeway.
+ */
+export declare const JWT_NBF_LEEWAY_SECONDS = 30;
 /** A parsed, structurally-valid VC-JWT plus the coordinates to look up its key. */
 export type PreparedVcJwt = {
     vc: DelegationCredential;
@@ -55,7 +61,6 @@ export interface VcJwtSignatureResult {
  * (or the first when `kid` is absent), imports its `publicKeyJwk`, and checks
  * the compact JWS with `jose` — `algorithms` pinned to `EdDSA`, so a token
  * cannot downgrade the suite or claim `alg: none`. Fail-closed: any
- * resolution, key-import, or verification problem denies.
+ * resolution, key-import, or verification problem denies, and none throws.
  */
 export declare function verifyVcJwtSignature(jwt: string, issuerDid: string, kid: string | undefined, didResolver: DIDResolver | undefined): Promise<VcJwtSignatureResult>;
-//# sourceMappingURL=vc-jwt-verify.d.ts.map