@kya-os/mcp 1.16.2 → 1.18.0

package/dist/card/delegation.d.ts

@@ -10,9 +10,9 @@
  * `MaxAmount`/`ValidUntil` ≤ parent, no parent caveat silently dropped, unknown caveats replicated
  * verbatim); top-level `validUntil` narrowing; CONTINUITY (the parent's delegate `invoker` MUST be
  * the child's `issuer` — you only re-delegate what was delegated to YOUR key — and
- * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; depth ≤
- * {@link MAX_DELEGATION_DEPTH}; ROOT `parentCapability` = the resource, `issuer`/`invocationTarget`
- * = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
+ * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; at most
+ * `ctx.maxChainLength` credentials, when the caller sets one; ROOT `parentCapability` = the resource,
+ * `issuer`/`invocationTarget` = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
  * {@link responsiblePartyOf} = `issuer(rootVC)`, {@link leafInvokerOf} = the leaf delegate a verifier
  * asserts equals `proof.did`. Revocation reuses the injected {@link BitstringRevocationChecker} seam from
  * `./revocation` (no status-list churn reaches callers; NO `mcp-i-core` runtime dep). Per-hop
@@ -119,6 +119,15 @@ export declare function attenuates(parent: DelegationCredential, child: Delegati
 export interface DelegationChainContext {
     resourceOwner?: string;
     resource?: string;
+    /**
+     * Local cost limit: the most credentials to accept in one chain, root to leaf inclusive. Each hop
+     * may cost a signature check and a status-list fetch. It bounds the verifier's own work, not how far
+     * authority may be delegated. Unset accepts any length; a value that is not a positive integer
+     * rejects every chain. {@link MAX_DELEGATION_DEPTH} is a suggested value. The base profile's
+     * `validateDelegationChain` (`@kya-os/mcp/delegation`) takes the same option and counts the same way.
+     */
+    maxChainLength?: number;
+    /** @deprecated Use `maxChainLength`, which takes precedence when both are set. */
     maxDepth?: number;
     /** Injectable clock (epoch ms) for the wall-clock expiry gate; default `Date.now` (deterministic tests inject it). */
     now?: () => number;
@@ -142,4 +151,3 @@ export interface DelegationChainEvaluation extends DelegationChainResult {
  *  fail-closed) cascade the injected {@link BitstringRevocationChecker} root→leaf via
  *  {@link evaluateRevocationChain}. A revoked ancestor invalidates the subtree. */
 export declare function evaluateDelegationChain(chain: DelegationChain, check: BitstringRevocationChecker, ctx?: DelegationChainContext): Promise<DelegationChainEvaluation>;
-//# sourceMappingURL=delegation.d.ts.map

package/dist/card/delegation.js

@@ -10,9 +10,9 @@
  * `MaxAmount`/`ValidUntil` ≤ parent, no parent caveat silently dropped, unknown caveats replicated
  * verbatim); top-level `validUntil` narrowing; CONTINUITY (the parent's delegate `invoker` MUST be
  * the child's `issuer` — you only re-delegate what was delegated to YOUR key — and
- * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; depth ≤
- * {@link MAX_DELEGATION_DEPTH}; ROOT `parentCapability` = the resource, `issuer`/`invocationTarget`
- * = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
+ * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; at most
+ * `ctx.maxChainLength` credentials, when the caller sets one; ROOT `parentCapability` = the resource,
+ * `issuer`/`invocationTarget` = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
  * {@link responsiblePartyOf} = `issuer(rootVC)`, {@link leafInvokerOf} = the leaf delegate a verifier
  * asserts equals `proof.did`. Revocation reuses the injected {@link BitstringRevocationChecker} seam from
  * `./revocation` (no status-list churn reaches callers; NO `mcp-i-core` runtime dep). Per-hop
@@ -25,7 +25,7 @@ export const DELEGATION_CONTEXT_V2 = 'https://www.w3.org/ns/credentials/v2'; //
 export const ZCAP_CONTEXT = 'https://w3id.org/security/zcap/v1'; // ZCAP-LD capability context
 export const KYA_OS_DELEGATION_CONTEXT = 'https://kya-os.org/ns/delegation/v1'; // KYA-OS ns
 export const DELEGATION_CREDENTIAL_TYPE = 'DelegationCredential'; // 2nd `type` after VerifiableCredential
-export const MAX_DELEGATION_DEPTH = 10; // fail-closed beyond this
+export const MAX_DELEGATION_DEPTH = 10; // a suggested `maxChainLength`; applied only when a caller passes it
 /** A monotone-narrowing constraint: `{type:'ValidUntil',date}` or `{type:'MaxAmount',limit,currency}`.
  *  The flat shape keeps typing clean; unknown caveat types are compared verbatim (fail-closed). */
 export const CaveatSchema = z
@@ -64,12 +64,23 @@ export const DataIntegrityProofSchema = z
     .object({ type: z.literal('DataIntegrityProof'), cryptosuite: z.literal('eddsa-jcs-2022') })
     .passthrough();
 const IssuerSchema = z.union([Did, z.object({ id: Did }).passthrough()]);
+/**
+ * VC `type`: MUST name both `VerifiableCredential` and `DelegationCredential`. Without the second,
+ * any VC whose subject happens to look like a ZCAP (a capability attestation, say) would be read as
+ * a delegation hop — type confusion.
+ */
+const DelegationCredentialTypeSchema = z
+    .array(z.string())
+    .min(2)
+    .refine((types) => types.includes('VerifiableCredential') && types.includes(DELEGATION_CREDENTIAL_TYPE), {
+    message: `type MUST include "VerifiableCredential" and "${DELEGATION_CREDENTIAL_TYPE}"`,
+});
 export const DelegationCredentialSchema = z
     .object({
     // >= 2 to match the published JSON Schema (VC 2.0 base + the ZCAP/KYA-OS delegation contexts).
     '@context': z.array(z.union([z.string(), z.record(z.string(), z.unknown())])).min(2),
     id: z.string().optional(),
-    type: z.array(z.string()),
+    type: DelegationCredentialTypeSchema,
     issuer: IssuerSchema,
     validFrom: z.string().optional(),
     validUntil: z.string().optional(),
@@ -103,23 +114,22 @@ export function statusEntryOf(vc) {
         return undefined;
     return { statusListCredential: status.statusListCredential, statusListIndex: status.statusListIndex };
 }
-function toScaled(dec) {
+/** A non-negative decimal split into its digit strings, or `undefined` when it is not one. */
+function decimalParts(dec) {
     const match = /^(\d+)(?:\.(\d+))?$/.exec(dec.trim());
-    if (!match?.[1])
-        return undefined;
-    const frac = (match[2] ?? '').padEnd(6, '0').slice(0, 6);
-    try {
-        return BigInt(match[1]) * 1000000n + BigInt(frac);
-    }
-    catch {
-        return undefined;
-    }
+    return match?.[1] ? { whole: match[1], fraction: match[2] ?? '' } : undefined;
 }
-// `child ≤ parent`, fail-closed (any unparseable value ⇒ false).
+// `child ≤ parent`, compared EXACTLY, fail-closed (any unparseable value ⇒ false). Both sides are
+// scaled to the longer fraction, never truncated: rounding to a fixed precision would let a child
+// whose excess sits below that precision (100.0000009 under a parent of 100) pass as a narrowing.
 function decimalLte(child, parent) {
-    const c = toScaled(child);
-    const p = toScaled(parent);
-    return c !== undefined && p !== undefined && c <= p;
+    const c = decimalParts(child);
+    const p = decimalParts(parent);
+    if (!c || !p)
+        return false;
+    const scale = Math.max(c.fraction.length, p.fraction.length);
+    const scaled = ({ whole, fraction }) => BigInt(whole + fraction.padEnd(scale, '0'));
+    return scaled(c) <= scaled(p);
 }
 function dateLte(child, parent) {
     const c = Date.parse(child);
@@ -246,15 +256,21 @@ function rootReasons(root, ctx) {
  *  are separate injected concerns (see {@link evaluateDelegationChain}). */
 export function validateDelegationChain(chain, ctx = {}) {
     const depth = chain.length;
-    const maxDepth = ctx.maxDepth ?? MAX_DELEGATION_DEPTH;
+    const maxChainLength = ctx.maxChainLength ?? ctx.maxDepth;
     if (depth === 0) {
         return { ok: false, reasons: ['empty delegation chain'], allowedAction: [], depth };
     }
     const root = chain[0];
     const leaf = chain[depth - 1];
     const reasons = [];
-    if (depth > maxDepth)
-        reasons.push(`delegation chain depth ${depth} exceeds the maximum of ${maxDepth}`);
+    if (maxChainLength !== undefined) {
+        if (!Number.isInteger(maxChainLength) || maxChainLength < 1) {
+            reasons.push(`maxChainLength must be a positive integer (got ${String(maxChainLength)})`);
+        }
+        else if (depth > maxChainLength) {
+            reasons.push(`delegation chain depth ${depth} exceeds the maximum of ${maxChainLength}`);
+        }
+    }
     reasons.push(...rootReasons(root, ctx));
     for (let i = 1; i < depth; i += 1) {
         reasons.push(...attenuates(chain[i - 1], chain[i]));

package/dist/card/delegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/card/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAiC,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC,CAAC,yBAAyB;AACtG,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC,CAAC,6BAA6B;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,CAAC,YAAY;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,CAAC,wCAAwC;AAC1G,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC,CAAC,0BAA0B;AAElE;mGACmG;AACnG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,WAAW,EAAE;KACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE;IACjD,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CAAC;AAEL,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxC,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAC3F,WAAW,EAAE,CAAC;AACjB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,+FAA+F;IAC/F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,iBAAiB,EAAE,oBAAoB;IACvC,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC7D,KAAK,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,WAAW,EAAE,CAAC;AAQjB,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,EAAwB;IAChD,OAAO,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,EAAwB;IACjD,OAAO,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;AACzE,CAAC;AACD,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AACD,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAsB;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AACD,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,EAAwB;IACpD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AACxG,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,QAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AACD,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,iGAAiG;QACjG,mGAAmG;QACnG,iGAAiG;QACjG,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC5F,OAAO,CACL,eAAe;YACf,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,oDAAoD;AACvF,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxG,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,+DAA+D,CAAC,CAAC;AACpG,CAAC;AAED;;mCAEmC;AACnC,MAAM,UAAU,UAAU,CAAC,MAA4B,EAAE,KAA2B;IAClF,MAAM,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnC,MAAM,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClC,MAAM,OAAO,GAAa;QACxB,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAClD,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;KACnD,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAsB,EAAE,KAAa;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC;iBACpF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,UAAU,kBAAkB,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;iBAClF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,SAAS,oBAAoB,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;qBACzF,IAAI,CAAC,GAAG,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,SAAS,WAAW,CAAC,IAA0B,EAAE,GAA2B;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,MAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,oBAAoB,CAAC;IACtD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,KAAK,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IACzG,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,+FAA+F;IAC/F,sFAAsF;IACtF,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,OAAO;QACP,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAC3C,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC;QACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB;QACzD,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa;QACnD,KAAK;KACN,CAAC;AACJ,CAAC;AAMD;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsB,EACtB,KAAiC,EACjC,MAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,KAAK,EAAqC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAA0B,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxF,OAAO;QACL,GAAG,UAAU;QACb,EAAE,EAAE,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/card/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAiC,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC,CAAC,yBAAyB;AACtG,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC,CAAC,6BAA6B;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,CAAC,YAAY;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,CAAC,wCAAwC;AAC1G,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC,CAAC,qEAAqE;AAE7G;mGACmG;AACnG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,WAAW,EAAE;KACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE;IACjD,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CAAC;AAEL,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxC,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAC3F,WAAW,EAAE,CAAC;AACjB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,CAAC;KACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjB,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE;IACvG,OAAO,EAAE,iDAAiD,0BAA0B,GAAG;CACxF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,+FAA+F;IAC/F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,8BAA8B;IACpC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,iBAAiB,EAAE,oBAAoB;IACvC,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC7D,KAAK,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,WAAW,EAAE,CAAC;AAQjB,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,EAAwB;IAChD,OAAO,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,EAAwB;IACjD,OAAO,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;AACzE,CAAC;AACD,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AACD,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAsB;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AACD,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,EAAwB;IACpD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AACxG,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAuC,EAAU,EAAE,CAClF,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AACD,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,iGAAiG;QACjG,mGAAmG;QACnG,iGAAiG;QACjG,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC5F,OAAO,CACL,eAAe;YACf,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,oDAAoD;AACvF,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxG,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,+DAA+D,CAAC,CAAC;AACpG,CAAC;AAED;;mCAEmC;AACnC,MAAM,UAAU,UAAU,CAAC,MAA4B,EAAE,KAA2B;IAClF,MAAM,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnC,MAAM,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClC,MAAM,OAAO,GAAa;QACxB,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAClD,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;KACnD,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAmBD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAsB,EAAE,KAAa;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC;iBACpF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,UAAU,kBAAkB,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;iBAClF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,SAAS,oBAAoB,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;qBACzF,IAAI,CAAC,GAAG,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,SAAS,WAAW,CAAC,IAA0B,EAAE,GAA2B;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,MAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC;IAC1D,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,kDAAkD,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC5F,CAAC;aAAM,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,0BAA0B,KAAK,2BAA2B,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,+FAA+F;IAC/F,sFAAsF;IACtF,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,OAAO;QACP,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAC3C,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC;QACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB;QACzD,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa;QACnD,KAAK;KACN,CAAC;AACJ,CAAC;AAMD;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsB,EACtB,KAAiC,EACjC,MAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,KAAK,EAAqC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAA0B,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxF,OAAO;QACL,GAAG,UAAU;QACb,EAAE,EAAE,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC"}

package/dist/card/emit.d.ts

@@ -130,4 +130,3 @@ export declare function toA2AExtension(card: EntityCard, opts?: CardUrlOverride
  * context. Optional fields are omitted when absent (claim-minimalism, deterministic output).
  */
 export declare function toAgentFacts(card: EntityCard): AgentFacts;
-//# sourceMappingURL=emit.d.ts.map

package/dist/card/index.d.ts

@@ -40,4 +40,3 @@ export * from './builder.js';
 export * from './middleware.js';
 export * from './revocation.js';
 export { createSafeFetch, fetchTransport, isBlockedAddress, type SafeFetch, type SafeFetchOptions, type SafeFetchResponse, type SafeFetchTransport, type TransportInit, type DnsLookup, type DnsAddress, } from '../utils/safe-fetch.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/card/middleware.d.ts

@@ -111,4 +111,3 @@ export declare function requireProof(deps: VerifyProofDeps, opts?: RequireProofO
  *  accepted for one major version); the canonical key wins when both are present. A legacy session
  *  proof under `org.kya-os/proof` is a different key and is simply not seen. */
 export declare function readCardProof(meta: unknown): unknown;
-//# sourceMappingURL=middleware.d.ts.map

package/dist/card/proof/build.d.ts

@@ -19,4 +19,3 @@ import { KYA_OS_CARD_PROOF_META_KEY, type BuildProofContext, type CardProofMeta,
 export declare function buildCardProof(req: ToolRequest, signer: ProofSigner, ctx: BuildProofContext): Promise<{
     [KYA_OS_CARD_PROOF_META_KEY]: CardProofMeta;
 }>;
-//# sourceMappingURL=build.d.ts.map

package/dist/card/proof/canonical.d.ts

@@ -63,4 +63,3 @@ export declare function coveredClaims(meta: CardProofMeta): Record<string, unkno
 export declare function canonicalPayloadBytes(meta: CardProofMeta): Uint8Array;
 /** Re-encode a base64url value (a JWS signature) as standard base64 (an RFC 9421 byte sequence). */
 export declare function base64urlToBase64(b64url: string): string;
-//# sourceMappingURL=canonical.d.ts.map

package/dist/card/proof/canonical.js

@@ -11,6 +11,7 @@
  */
 import { canonicalize } from 'json-canonicalize';
 import { base64ToBytes, base64urlDecodeToBytes, bytesToBase64 } from '../../utils/base64.js';
+import { isSmallOrderEd25519CryptoKey } from '../../utils/ed25519-public-key.js';
 const encoder = new TextEncoder();
 const ED25519 = { name: 'Ed25519' };
 const ES256_IMPORT = { name: 'ECDSA', namedCurve: 'P-256' };
@@ -40,7 +41,11 @@ export async function ed25519SignRaw(privateJwk, data) {
 export async function ed25519VerifyRaw(publicJwk, signature, data) {
     try {
         const s = subtle();
-        const key = await s.importKey('jwk', { kty: publicJwk.kty, crv: publicJwk.crv, x: publicJwk.x }, ED25519, false, ['verify']);
+        // Extractable (it is a public key) so the small-order check can read it back:
+        // WebCrypto verifies under a small-order key, where one signature fits every message.
+        const key = await s.importKey('jwk', { kty: publicJwk.kty, crv: publicJwk.crv, x: publicJwk.x }, ED25519, true, ['verify']);
+        if (await isSmallOrderEd25519CryptoKey(key))
+            return false;
         return await s.verify(ED25519, key, signature, data);
     }
     catch {

package/dist/card/proof/canonical.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/card/proof/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG7F,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAkClC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAC7C,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AACrE,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAE/D,mGAAmG;AACnG,SAAS,MAAM;IACb,MAAM,CAAC,GAAI,UAAyD,CAAC,MAAM,CAAC;IAC5E,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AAED,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAiB;IAC5C,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAyB,EAAE,IAAgB;IAC9E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAwB,EACxB,SAAqB,EACrB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7H,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAyB,EAAE,IAAgB;IAC5E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAwB,EACxB,SAAqB,EACrB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAC3B,KAAK,EACL,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAC1E,YAAY,EACZ,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAgB;IACvD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,gBAAsD,CAAC,CAAC,CACrF,CAAC;IACF,OAAO,YAAY,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1F,IAAI,CAAC,CAAC,OAAO,IAAK,MAAkC,CAAC;QAAE,OAAO,MAAM,CAAC;IACrE,MAAM,IAAI,GAA4B,EAAE,GAAI,MAAkC,EAAE,CAAC;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;mGACmG;AACnG,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAuC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,aAAa,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/card/proof/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAGjF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAkClC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAC7C,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AACrE,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAE/D,mGAAmG;AACnG,SAAS,MAAM;IACb,MAAM,CAAC,GAAI,UAAyD,CAAC,MAAM,CAAC;IAC5E,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AAED,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAiB;IAC5C,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAyB,EAAE,IAAgB;IAC9E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAwB,EACxB,SAAqB,EACrB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,8EAA8E;QAC9E,sFAAsF;QACtF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5H,IAAI,MAAM,4BAA4B,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAyB,EAAE,IAAgB;IAC5E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAwB,EACxB,SAAqB,EACrB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAC3B,KAAK,EACL,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAC1E,YAAY,EACZ,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAgB;IACvD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,gBAAsD,CAAC,CAAC,CACrF,CAAC;IACF,OAAO,YAAY,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1F,IAAI,CAAC,CAAC,OAAO,IAAK,MAAkC,CAAC;QAAE,OAAO,MAAM,CAAC;IACrE,MAAM,IAAI,GAA4B,EAAE,GAAI,MAAkC,EAAE,CAAC;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;mGACmG;AACnG,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAuC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,aAAa,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/card/proof/http-sig.d.ts

@@ -66,4 +66,3 @@ export declare function toHttpMessageSignature(proof: CardProofMeta): HttpMessag
  * `alg_key_mismatch` check in `verify.ts`); call it standalone only after that binding holds.
  */
 export declare function verifyHttpSignature(proof: CardProofMeta, key: ProofPublicJwk): Promise<boolean>;
-//# sourceMappingURL=http-sig.d.ts.map

package/dist/card/proof/index.d.ts

@@ -22,4 +22,3 @@ export * from './verify.js';
 export * from './http-sig.js';
 export * from './nonce-cache.js';
 export { computeRequestHash, digestsEqual } from './canonical.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/card/proof/nonce-cache.d.ts

@@ -8,12 +8,12 @@
  *   - {@link InMemoryNonceCache} — a single-process, race-free TTL cache. The check-and-set runs in
  *     one synchronous critical section (no `await` between read and write), so it cannot interleave
  *     with a concurrent replay within one process. Use it for a single instance / dev.
- *   - {@link consumeFromNonceCacheProvider} — composes the two-method `NonceCacheProvider`
- *     (`has()` + `add()`) into the atomic seam for a shared/distributed store (see the atomicity
- *     note on the function).
+ *   - {@link consumeFromNonceCacheProvider} — delegates to `NonceCacheProvider.consume`, which
+ *     a shared/distributed provider should implement atomically in its backend. Providers
+ *     without it fall back to `has()` then `add()` unless `requireAtomicNonce` is set.
  *
- * Type-only import of `NonceCacheProvider` — no runtime coupling to the legacy proof engine and no
- * `mcp-i-core` dependency.
+ * Type-only import of `NonceCacheProvider`. The shared admission helper is the only runtime
+ * dependency: no coupling to the legacy proof engine and no `mcp-i-core` dependency.
  */
 import type { NonceCacheProvider } from '../../providers/base.js';
 import { type ConsumeNonceIfFresh } from './types.js';
@@ -50,18 +50,19 @@ export declare class InMemoryNonceCache {
 }
 /** Options for {@link consumeFromNonceCacheProvider}. */
 export interface NonceCacheProviderAdapterOptions {
-    /** TTL applied to each recorded nonce, in seconds (default {@link NONCE_RETENTION_SEC}). */
+    /** Minimum TTL in seconds (default {@link NONCE_RETENTION_SEC}); verifier floors may raise it. */
     ttlSec?: number;
+    /** Refuse a provider without `consume()` instead of falling back to `has()` then `add()`. */
+    requireAtomicNonce?: boolean;
 }
 /**
- * Adapt a two-method {@link NonceCacheProvider} (`has()` + `add()`) into the atomic
- * {@link ConsumeNonceIfFresh} seam.
+ * Adapt {@link NonceCacheProvider.consume} into the {@link ConsumeNonceIfFresh} seam.
  *
- * ATOMICITY: `has()` then `add()` is only race-free when the provider serialises the pair — a
- * single-process store, or a backend with a native compare-and-set. For a SHARED distributed cache,
- * back it with a store that enforces atomic check-and-set (SPEC §12.2); otherwise two concurrent
- * replays can both observe `has() === false` before either `add()`s. The bundled
- * {@link InMemoryNonceCache} is race-free by construction and is the safer single-process default.
+ * Uses the provider's backend-native atomic test-and-set (SPEC §12.2) when it has one. A
+ * provider without `consume()` falls back to `has()` then `add()`, which cannot stop
+ * concurrent duplicates, and logs a warning once; under `requireAtomicNonce` this factory
+ * throws for such a provider instead. Storage failure rejects the call, which the verifier
+ * handles as failed nonce admission. The bundled {@link MemoryNonceCacheProvider} is atomic
+ * only within one cache instance.
  */
 export declare function consumeFromNonceCacheProvider(provider: NonceCacheProvider, opts?: NonceCacheProviderAdapterOptions): ConsumeNonceIfFresh;
-//# sourceMappingURL=nonce-cache.d.ts.map

package/dist/card/proof/nonce-cache.js

@@ -8,13 +8,14 @@
  *   - {@link InMemoryNonceCache} — a single-process, race-free TTL cache. The check-and-set runs in
  *     one synchronous critical section (no `await` between read and write), so it cannot interleave
  *     with a concurrent replay within one process. Use it for a single instance / dev.
- *   - {@link consumeFromNonceCacheProvider} — composes the two-method `NonceCacheProvider`
- *     (`has()` + `add()`) into the atomic seam for a shared/distributed store (see the atomicity
- *     note on the function).
+ *   - {@link consumeFromNonceCacheProvider} — delegates to `NonceCacheProvider.consume`, which
+ *     a shared/distributed provider should implement atomically in its backend. Providers
+ *     without it fall back to `has()` then `add()` unless `requireAtomicNonce` is set.
  *
- * Type-only import of `NonceCacheProvider` — no runtime coupling to the legacy proof engine and no
- * `mcp-i-core` dependency.
+ * Type-only import of `NonceCacheProvider`. The shared admission helper is the only runtime
+ * dependency: no coupling to the legacy proof engine and no `mcp-i-core` dependency.
  */
+import { admitNonce, checkNonceStore } from '../../providers/nonce-admission.js';
 import { NONCE_RETENTION_SEC } from './types.js';
 /** Inserts between amortised expired-entry sweeps (bounds memory without a timer/lifecycle). */
 const SWEEP_EVERY = 1000;
@@ -40,7 +41,7 @@ export class InMemoryNonceCache {
      * critical section — no `await` between the read and the write — so it is race-free within one
      * process. Arrow field so it stays bound when passed directly as the seam.
      */
-    consume = (nonce, did) => {
+    consume = (nonce, did, minTtlSec = 0) => {
         // NUL (`\0`) delimiter: `did` and `nonce` are opaque strings, so an ambiguous separator
         // (e.g. a space) could let one (did, nonce) pair collide with another. `\0` cannot appear
         // in a DID and is not a valid nonce byte, so the composite key stays unambiguous.
@@ -49,7 +50,11 @@ export class InMemoryNonceCache {
         const expiry = this.seen.get(key);
         if (expiry !== undefined && expiry > now)
             return false;
-        this.seen.set(key, now + this.ttlMs);
+        const ttlMs = Math.max(this.ttlMs, minTtlSec * 1000);
+        if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+            throw new RangeError('Nonce retention must be positive and finite');
+        }
+        this.seen.set(key, now + ttlMs);
         // Amortised eviction: sweep expired entries every SWEEP_EVERY inserts so a long-running
         // process cannot accumulate dead nonces unboundedly — no timer or lifecycle to manage.
         if (++this.insertsSinceSweep >= SWEEP_EVERY) {
@@ -67,22 +72,19 @@ export class InMemoryNonceCache {
     }
 }
 /**
- * Adapt a two-method {@link NonceCacheProvider} (`has()` + `add()`) into the atomic
- * {@link ConsumeNonceIfFresh} seam.
+ * Adapt {@link NonceCacheProvider.consume} into the {@link ConsumeNonceIfFresh} seam.
  *
- * ATOMICITY: `has()` then `add()` is only race-free when the provider serialises the pair — a
- * single-process store, or a backend with a native compare-and-set. For a SHARED distributed cache,
- * back it with a store that enforces atomic check-and-set (SPEC §12.2); otherwise two concurrent
- * replays can both observe `has() === false` before either `add()`s. The bundled
- * {@link InMemoryNonceCache} is race-free by construction and is the safer single-process default.
+ * Uses the provider's backend-native atomic test-and-set (SPEC §12.2) when it has one. A
+ * provider without `consume()` falls back to `has()` then `add()`, which cannot stop
+ * concurrent duplicates, and logs a warning once; under `requireAtomicNonce` this factory
+ * throws for such a provider instead. Storage failure rejects the call, which the verifier
+ * handles as failed nonce admission. The bundled {@link MemoryNonceCacheProvider} is atomic
+ * only within one cache instance.
  */
 export function consumeFromNonceCacheProvider(provider, opts = {}) {
     const ttlSec = opts.ttlSec ?? NONCE_RETENTION_SEC;
-    return async (nonce, did) => {
-        if (await provider.has(nonce, did))
-            return false;
-        await provider.add(nonce, ttlSec, did);
-        return true;
-    };
+    const admission = { requireAtomicNonce: opts.requireAtomicNonce ?? false };
+    checkNonceStore(provider, admission);
+    return (nonce, did, minTtlSec = 0) => admitNonce(provider, nonce, Math.max(ttlSec, minTtlSec), did, admission);
 }
 //# sourceMappingURL=nonce-cache.js.map

package/dist/card/proof/nonce-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"nonce-cache.js","sourceRoot":"","sources":["../../../src/card/proof/nonce-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,mBAAmB,EAA4B,MAAM,YAAY,CAAC;AAE3E,gGAAgG;AAChG,MAAM,WAAW,GAAG,IAAI,CAAC;AAWzB;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IAC7B,sCAAsC;IACrB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjC,KAAK,CAAS;IACd,KAAK,CAAe;IACrC,wFAAwF;IAChF,iBAAiB,GAAG,CAAC,CAAC;IAE9B,YAAY,OAAkC,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACM,OAAO,GAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrD,wFAAwF;QACxF,0FAA0F;QAC1F,kFAAkF;QAClF,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,wFAAwF;QACxF,uFAAuF;QACvF,IAAI,EAAE,IAAI,CAAC,iBAAiB,IAAI,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,0FAA0F;IAC1F,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;CACF;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA4B,EAC5B,OAAyC,EAAE;IAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;IAClD,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"nonce-cache.js","sourceRoot":"","sources":["../../../src/card/proof/nonce-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAA4B,MAAM,YAAY,CAAC;AAE3E,gGAAgG;AAChG,MAAM,WAAW,GAAG,IAAI,CAAC;AAWzB;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IAC7B,sCAAsC;IACrB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjC,KAAK,CAAS;IACd,KAAK,CAAe;IACrC,wFAAwF;IAChF,iBAAiB,GAAG,CAAC,CAAC;IAE9B,YAAY,OAAkC,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACM,OAAO,GAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE;QACpE,wFAAwF;QACxF,0FAA0F;QAC1F,kFAAkF;QAClF,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,UAAU,CAAC,6CAA6C,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;QAChC,wFAAwF;QACxF,uFAAuF;QACvF,IAAI,EAAE,IAAI,CAAC,iBAAiB,IAAI,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,0FAA0F;IAC1F,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;CACF;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA4B,EAC5B,OAAyC,EAAE;IAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;IAClD,MAAM,SAAS,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,KAAK,EAAE,CAAC;IAC3E,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,CACnC,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AAC7E,CAAC"}

package/dist/card/proof/signer.d.ts

@@ -29,4 +29,3 @@ export declare function es256SignerFromJwk(opts: {
     kid: string;
     privateJwk: P256PrivateJwk;
 }): Promise<ProofSigner>;
-//# sourceMappingURL=signer.d.ts.map

package/dist/card/proof/types.d.ts

@@ -47,8 +47,8 @@ export declare const DEFAULT_SKEW_SEC = 5;
  * accepting second is honoured in full (up to +999 ms), while a nonce first consumed at the very
  * start of the `created - skew` second is retained from there. Retaining for exactly `ttl + 2·skew`
  * therefore leaves a sub-second tail in which an evicted nonce lets a still-valid proof replay; the
- * `+ 1` closes it. Retention is measured from FIRST use. If a verifier widens `skewSec` beyond
- * {@link DEFAULT_SKEW_SEC}, widen the cache TTL to match.
+ * `+ 1` closes it. Retention is measured from FIRST use. The verifier also passes a retention
+ * floor for its effective skew to the consume seam; custom implementations MUST honor it.
  */
 export declare const NONCE_RETENTION_SEC: number;
 /** RFC 7638 confirmation key thumbprint (`cnf.jkt`) — the sender-constraint fusion anchor. */
@@ -164,10 +164,17 @@ export type ResolveDidKeys = (did: string) => ProofPublicJwk[] | Promise<ProofPu
  * the verifier treats a `true` return as proof the nonce is single-use, so a pure read that never
  * persists the nonce (e.g. `(n) => !seen.has(n)` where `seen` is never written) is a replay HOLE —
  * it compiles and provides ZERO protection. Scope the record by `did` to prevent cross-DID replay.
+ * The verifier supplies `minTtlSec`: retain the successful claim for AT LEAST that duration,
+ * preserving any longer configured TTL. Existing two-argument callbacks must be updated to
+ * honor this argument; their continued TypeScript assignability does not establish safety.
+ * Verifiers sharing a cache must agree on the acceptance window; widening that policy after
+ * records were admitted needs a retention-aware rollout.
  * Reach for the batteries-included {@link InMemoryNonceCache} (race-free) or
  * {@link consumeFromNonceCacheProvider} rather than hand-rolling this.
  */
-export type ConsumeNonceIfFresh = (nonce: string, did: string) => boolean | Promise<boolean>;
+export type ConsumeNonceIfFresh = (nonce: string, did: string, 
+/** Verifier-derived retention floor; implementations MUST retain at least this long. */
+minTtlSec?: number) => boolean | Promise<boolean>;
 /**
  * The verification seams. `resolveKey` resolves the signing key by `kid`. `resolveDidKeys` is the
  * INDEPENDENT RFC 7638 DID-membership proof (the signing key MUST be a verificationMethod the proof's
@@ -225,4 +232,3 @@ export interface ProofVerifyResult {
      */
     warnings?: string[];
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/card/proof/types.js

@@ -47,8 +47,8 @@ export const DEFAULT_SKEW_SEC = 5;
  * accepting second is honoured in full (up to +999 ms), while a nonce first consumed at the very
  * start of the `created - skew` second is retained from there. Retaining for exactly `ttl + 2·skew`
  * therefore leaves a sub-second tail in which an evicted nonce lets a still-valid proof replay; the
- * `+ 1` closes it. Retention is measured from FIRST use. If a verifier widens `skewSec` beyond
- * {@link DEFAULT_SKEW_SEC}, widen the cache TTL to match.
+ * `+ 1` closes it. Retention is measured from FIRST use. The verifier also passes a retention
+ * floor for its effective skew to the consume seam; custom implementations MUST honor it.
  */
 export const NONCE_RETENTION_SEC = MAX_TTL_SEC + 2 * DEFAULT_SKEW_SEC + 1;
 /**

package/dist/card/proof/verify.d.ts

@@ -24,4 +24,3 @@ import { type ProofVerifyResult, type VerifyProofDeps } from './types.js';
  * derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
  */
 export declare function verifyCardProof(proof: unknown, req: ToolRequest, deps: VerifyProofDeps): Promise<ProofVerifyResult>;
-//# sourceMappingURL=verify.d.ts.map

package/dist/card/proof/verify.js

@@ -18,6 +18,8 @@
  */
 import { calculateJwkThumbprint, flattenedVerify, importJWK } from 'jose';
 import { base64urlDecodeToString, base64urlEncodeFromBytes } from '../../utils/base64.js';
+import { nonceRetentionSeconds } from '../../providers/nonce-retention.js';
+import { isSmallOrderEd25519CryptoKey } from '../../utils/ed25519-public-key.js';
 import { canonicalPayloadBytes, computeRequestHash } from './canonical.js';
 import { CardProofMetaSchema, DEFAULT_SKEW_SEC, MAX_TTL_SEC, } from './types.js';
 /**
@@ -51,13 +53,16 @@ export async function verifyCardProof(proof, req, deps) {
     if (meta.requestHash !== computedHash)
         reasons.push('request_hash_mismatch');
     checkWindow(meta, deps, reasons);
-    await consumeNonce(meta, deps, reasons);
     if (key && algOk && !(await verifyDetachedJws(meta, key)))
         reasons.push('invalid_signature');
     const warnings = [];
     let level = 'L3-minus';
     if (key)
         level = await checkCnfFusion(meta, key, deps, reasons, warnings);
+    // Authenticate every binding before claiming state. The shared cache must
+    // atomically decide which validated request, if any, first admits this nonce.
+    if (reasons.length === 0)
+        await consumeNonce(meta, deps, reasons);
     const ok = reasons.length === 0;
     const withWarnings = warnings.length > 0 ? { warnings } : {};
     return ok
@@ -125,8 +130,14 @@ async function consumeNonce(meta, deps, reasons) {
         reasons.push('nonce_seam_missing');
         return;
     }
-    if (!(await consume(meta.nonce, meta.did)))
-        reasons.push('nonce_replayed');
+    try {
+        const minTtlSec = nonceRetentionSeconds(1, meta.expires + (deps.skewSec ?? DEFAULT_SKEW_SEC), deps.now?.() ?? Date.now());
+        if ((await consume(meta.nonce, meta.did, minTtlSec)) !== true)
+            reasons.push('nonce_replayed');
+    }
+    catch {
+        reasons.push('nonce_cache_unavailable');
+    }
 }
 /** Enforce the created/expires window: sane bounds, capped TTL, and ±skew freshness. */
 function checkWindow(meta, deps, reasons) {
@@ -157,6 +168,9 @@ async function verifyDetachedJws(meta, key) {
         return false;
     try {
         const pub = await importJWK(toJwk(key), meta.alg);
+        // jose verifies under a small-order Ed25519 key, where one signature fits every payload.
+        if (await isSmallOrderEd25519CryptoKey(pub))
+            return false;
         await flattenedVerify({
             protected: protectedB64,
             payload: base64urlEncodeFromBytes(canonicalPayloadBytes(meta)),

package/dist/card/proof/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/card/proof/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1E,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAG1F,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,GAKZ,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAc,EACd,GAAgB,EAChB,IAAqB;IAErB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAE1E,oGAAoG;IACpG,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9G,IAAI,GAAG;QAAE,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjE,kGAAkG;IAClG,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,GAAG,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAEpD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC7E,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAmB,UAAU,CAAC;IACvC,IAAI,GAAG;QAAE,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1E,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE;QACxD,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,IAAqB,EACrB,OAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAmB,EACnB,GAAW,EACX,IAAqB,EACrB,OAAiB;IAEjB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACzB,iFAAiF;QACjF,IAAI,CAAC,IAAI,CAAC,wBAAwB;YAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,IAAI,OAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,iGAAiG;QACjG,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAAmB,EACnB,IAAqB,EACrB,OAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC7E,CAAC;AAED,wFAAwF;AACxF,SAAS,WAAW,CAAC,IAAmB,EAAE,IAAqB,EAAE,OAAiB;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAmB,EAAE,GAAmB;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,YAAY,EAAE,AAAD,EAAG,YAAY,CAAC,GAAG,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,eAAe,CACnB;YACE,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC9D,SAAS,EAAE,YAAa;SACzB,EACD,GAAG,EACH,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CAAC,GAAmB,EAAE,GAAsB;IAChE,OAAO,GAAG,KAAK,OAAO;QACpB,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;QACzC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAmB,EACnB,GAAmB,EACnB,IAAqB,EACrB,OAAiB,EACjB,QAAkB;IAElB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;QACzF,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,IAAI,IAAI,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AACrD,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAmC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAmB;IACrC,OAAO,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,qGAAqG;AACrG,SAAS,KAAK,CAAC,GAAmB;IAChC,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI;QACrB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACjD,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/card/proof/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1E,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,GAKZ,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAc,EACd,GAAgB,EAChB,IAAqB;IAErB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAE1E,oGAAoG;IACpG,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9G,IAAI,GAAG;QAAE,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjE,kGAAkG;IAClG,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,GAAG,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAEpD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC7E,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAmB,UAAU,CAAC;IACvC,IAAI,GAAG;QAAE,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1E,0EAA0E;IAC1E,8EAA8E;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAElE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE;QACxD,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,IAAqB,EACrB,OAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAmB,EACnB,GAAW,EACX,IAAqB,EACrB,OAAiB;IAEjB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACzB,iFAAiF;QACjF,IAAI,CAAC,IAAI,CAAC,wBAAwB;YAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,IAAI,OAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,iGAAiG;QACjG,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAAmB,EACnB,IAAqB,EACrB,OAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,qBAAqB,CACrC,CAAC,EACD,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,EACjD,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,WAAW,CAAC,IAAmB,EAAE,IAAqB,EAAE,OAAiB;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAmB,EAAE,GAAmB;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,YAAY,EAAE,AAAD,EAAG,YAAY,CAAC,GAAG,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,yFAAyF;QACzF,IAAI,MAAM,4BAA4B,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,eAAe,CACnB;YACE,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC9D,SAAS,EAAE,YAAa;SACzB,EACD,GAAG,EACH,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CAAC,GAAmB,EAAE,GAAsB;IAChE,OAAO,GAAG,KAAK,OAAO;QACpB,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;QACzC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAmB,EACnB,GAAmB,EACnB,IAAqB,EACrB,OAAiB,EACjB,QAAkB;IAElB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;QACzF,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,IAAI,IAAI,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AACrD,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAmC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAmB;IACrC,OAAO,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,qGAAqG;AACrG,SAAS,KAAK,CAAC,GAAmB;IAChC,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI;QACrB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACjD,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC"}

package/dist/card/resolve.d.ts

@@ -94,4 +94,3 @@ export declare function didWebToCardUrl(did: string): string;
 export declare function didWebToDidDocUrl(did: string): string;
 /** Validate + parse an unknown value into an EntityCard (throws a ZodError on mismatch). */
 export declare function parseCard(value: unknown): EntityCard;
-//# sourceMappingURL=resolve.d.ts.map