@kya-os/mcp 1.16.2 → 1.18.0

package/dist/card/resolve.js

@@ -162,8 +162,10 @@ async function fetchJson(url, fetch) {
  * fetched card to it: its `id` MUST equal that DID (normalized), else FAIL CLOSED. This closes the
  * cross-origin confusion where a DID document's `KyaOsEntityCard` service entry points at a card for
  * a DIFFERENT DID (or a compromised third-party endpoint), which would otherwise attribute another
- * entity's claims/capabilities to the resolved DID. The `{ cardUrl }` and A2A paths carry no
- * independent DID to bind against, so they pass no `expectedDid` (the URL itself is the trust root).
+ * entity's claims/capabilities to the resolved DID. The comparison is over canonical encoded forms
+ * ({@link normalizeDid}), never over decoded paths, so it cannot conflate two DIDs that merely map to
+ * look-alike URLs. The `{ cardUrl }` and A2A paths carry no independent DID to bind against, so
+ * they pass no `expectedDid` (the URL itself is the trust root).
  */
 async function fetchCard(url, fetch, expectedDid) {
     const card = parseCard(await fetchJson(url, fetch));
@@ -178,16 +180,19 @@ function parseDidWeb(did) {
     return { host: parts[0] ?? '', path: parts.slice(1).join('/') };
 }
 /**
- * Canonicalize a DID for identity comparison. For `did:web` the DNS host is case-INsensitive and the
- * segments are percent-decoded (reusing {@link parseDidWeb}), so `did:web:Example.com` binds to
- * `did:web:example.com`; other DID methods (e.g. `did:key`, case-sensitive base58) compare verbatim.
+ * Canonicalize a DID for identity comparison. For `did:web` the DNS host is case-INsensitive, so it
+ * is lowercased, and every `:`-separated segment is percent-decoded and RE-encoded, so two spellings
+ * of one DID (`%3a` vs `%3A`, a needlessly escaped letter) compare equal. The re-encode is what keeps
+ * distinct DIDs distinct: a decoded `:` inside a segment (the port of `did:web:host%3A8443`, or a
+ * user named `alice:agent`) goes back to `%3A`, so it never collapses into a segment separator and
+ * `did:web:host:users:alice%3Aagent` stays a different DID from `did:web:host:users:alice:agent`.
+ * Other DID methods (e.g. `did:key`, case-sensitive base58) compare verbatim.
  */
 function normalizeDid(did) {
     if (!did.startsWith('did:web:'))
         return did;
-    const { host, path } = parseDidWeb(did);
-    const base = `did:web:${host.toLowerCase()}`;
-    return path ? `${base}:${path.split('/').join(':')}` : base;
+    const [host = '', ...path] = did.slice('did:web:'.length).split(':').map(decodeURIComponent);
+    return `did:web:${[host.toLowerCase(), ...path].map(encodeURIComponent).join(':')}`;
 }
 /**
  * Map a `did:web` to its per-entity card URL:

package/dist/card/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/card/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAC;AAEhE,wFAAwF;AACxF,2FAA2F;AAE3F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAC1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AACrD,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACxD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAiB1E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAuB,EACvB,IAAqB;IAErB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,SAAS,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,YAAY,IAAI,KAAK;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjF,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,IAAI,YAAY,IAAI,KAAK;QAAE,OAAO,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5F,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,KAAgB;IACxD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,oCAAoC,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,UAAmB,EAAE,KAAgB;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mCAAmC,oBAAoB,SAAS,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1D,OAAO,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAc,EAAE,KAAgB;IAClE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,oBAAoB,kCAAkC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,6FAA6F;AAC7F,SAAS,sBAAsB,CAAC,MAAe,EAAE,GAAW;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IACE,QAAQ,CAAC,GAAG,CAAC;YACb,GAAG,CAAC,IAAI,KAAK,wBAAwB;YACrC,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,EACvC,CAAC;YACD,OAAO,GAAG,CAAC,eAAe,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,YAAY,wBAAwB,gBAAgB,CAC1F,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,UAAmB;IAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAgB;IACpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAgB,EAAE,WAAoB;IAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,IAAI,WAAW,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,EAAE,sBAAsB,WAAW,qCAAqC,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,4DAA4D,GAAG,mIAAmI,CACnM,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,2BAA2B,EAAE,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,IAAI,uBAAuB,CAAC;AAC5F,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/card/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAC;AAEhE,wFAAwF;AACxF,2FAA2F;AAE3F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAC1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AACrD,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACxD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAiB1E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAuB,EACvB,IAAqB;IAErB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,SAAS,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,YAAY,IAAI,KAAK;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjF,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,IAAI,YAAY,IAAI,KAAK;QAAE,OAAO,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5F,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,KAAgB;IACxD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,oCAAoC,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,UAAmB,EAAE,KAAgB;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mCAAmC,oBAAoB,SAAS,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1D,OAAO,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAc,EAAE,KAAgB;IAClE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,oBAAoB,kCAAkC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,6FAA6F;AAC7F,SAAS,sBAAsB,CAAC,MAAe,EAAE,GAAW;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IACE,QAAQ,CAAC,GAAG,CAAC;YACb,GAAG,CAAC,IAAI,KAAK,wBAAwB;YACrC,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,EACvC,CAAC;YACD,OAAO,GAAG,CAAC,eAAe,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,YAAY,wBAAwB,gBAAgB,CAC1F,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,UAAmB;IAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAgB;IACpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAgB,EAAE,WAAoB;IAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,IAAI,WAAW,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,EAAE,sBAAsB,WAAW,qCAAqC,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5C,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7F,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,4DAA4D,GAAG,mIAAmI,CACnM,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,2BAA2B,EAAE,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,IAAI,uBAAuB,CAAC;AAC5F,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC"}

package/dist/card/revocation.d.ts

@@ -99,4 +99,3 @@ export declare function createRevocationChecker(deps: RevocationCheckerDeps): Bi
  * simply omits all `credentialStatus` entries — it must consult at least one live status list.
  */
 export declare function evaluateRevocationChain(entries: readonly BitstringStatusListEntry[], check: BitstringRevocationChecker): Promise<RevocationChainResult>;
-//# sourceMappingURL=revocation.d.ts.map

package/dist/card/revocation.js

@@ -123,21 +123,33 @@ async function decodeStatusList(credential, decompress) {
     }
     return decodeStatusListPayload(encoded, decompress);
 }
-/** True iff `nowMs` falls inside the credential's `[validFrom, validUntil]` window (if declared). */
+/**
+ * True iff `nowMs` falls inside the credential's `[validFrom, validUntil]` window (if declared). A
+ * bound that is PRESENT but not a parseable date is not "absent": the list's validity window is then
+ * unknown, so it cannot vouch for a live read (`false`, never an open window).
+ */
 function isLive(credential, nowMs) {
-    const validUntil = parseDate(credential.validUntil ?? credential.expirationDate);
+    const validUntil = parseDate(firstPresent(credential.validUntil, credential.expirationDate));
+    const validFrom = parseDate(firstPresent(credential.validFrom, credential.issuanceDate));
+    if (validUntil === null || validFrom === null)
+        return false; // unknown window → not provably live
     if (validUntil !== undefined && validUntil < nowMs)
         return false; // stale → cached-OK at L2 only
-    const validFrom = parseDate(credential.validFrom ?? credential.issuanceDate);
     if (validFrom !== undefined && validFrom > nowMs)
         return false; // not yet valid
     return true;
 }
-/** Parse an ISO-8601 date string to epoch ms, or `undefined` when absent / unparseable. */
+/** The VC 2.0 property when present (even as `null`), else its VC 1.1 predecessor. */
+function firstPresent(current, legacy) {
+    return current !== undefined ? current : legacy;
+}
+/** Parse an ISO-8601 date to epoch ms: `undefined` when absent, `null` when present but unparseable. */
 function parseDate(value) {
-    if (typeof value !== 'string')
+    if (value === undefined)
         return undefined;
+    if (typeof value !== 'string')
+        return null;
     const ms = Date.parse(value);
-    return Number.isNaN(ms) ? undefined : ms;
+    return Number.isNaN(ms) ? null : ms;
 }
 //# sourceMappingURL=revocation.js.map

package/dist/card/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/card/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,GACd,MAAM,6BAA6B,CAAC;AAIrC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAsEtD,kFAAkF;AAClF,MAAM,WAAW,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,OAAO,KAAK,UAAU,KAAK,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjF,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA4C,EAC5C,KAAiC;IAEjC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,+DAA+D;IAC/F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,mBAAmB,GAAG,KAAK,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,eAAe,IAAI;wBAChF,+DAA+D;iBAClE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAElF,8FAA8F;AAC9F,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,KAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,UAAmC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,UAAmC,EACnC,UAAsB;IAEtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC;IAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,qGAAqG;AACrG,SAAS,MAAM,CAAC,UAAmC,EAAE,KAAa;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC;IACjF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACjG,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/card/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,GACd,MAAM,6BAA6B,CAAC;AAIrC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAsEtD,kFAAkF;AAClF,MAAM,WAAW,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,OAAO,KAAK,UAAU,KAAK,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjF,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA4C,EAC5C,KAAiC;IAEjC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,+DAA+D;IAC/F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,mBAAmB,GAAG,KAAK,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,eAAe,IAAI;wBAChF,+DAA+D;iBAClE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAElF,8FAA8F;AAC9F,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,KAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,UAAmC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,UAAmC,EACnC,UAAsB;IAEtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC;IAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,UAAmC,EAAE,KAAa;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,IAAI,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,qCAAqC;IAClG,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACjG,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,OAAgB,EAAE,MAAe;IACrD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC"}

package/dist/card/schema.d.ts

@@ -51,23 +51,25 @@ export declare const ProofPublicJwkSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strict>]>;
 /**
  * Deliberately NON-strict: the JSON Schema marks `CapabilityAttestation` as
- * `additionalProperties: true`, so extra keys alongside `vc` are permitted here.
+ * `additionalProperties: true`, so extra keys alongside `vc` are permitted here — and PRESERVED.
+ * A plain `z.object` strips unknown keys, which would hand the capability verifier an attestation
+ * missing sidecar members it may need (a `credentialStatus`, say).
  */
 export declare const CapabilityAttestationSchema: z.ZodObject<{
     vc: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
-}, z.core.$strip>;
+}, z.core.$loose>;
 export declare const Level2CapabilitySchema: z.ZodObject<{
     name: z.ZodString;
     attestations: z.ZodArray<z.ZodObject<{
         vc: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
 }, z.core.$strict>;
 /** L1 bare-string name, or an L2 object carrying attestations. */
 export declare const CapabilitySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
     name: z.ZodString;
     attestations: z.ZodArray<z.ZodObject<{
         vc: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
 }, z.core.$strict>]>;
 export declare const AttestationSchema: z.ZodObject<{
     type: z.ZodEnum<{
@@ -136,7 +138,7 @@ export declare const EntityCardSchema: z.ZodObject<{
         name: z.ZodString;
         attestations: z.ZodArray<z.ZodObject<{
             vc: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
-        }, z.core.$strip>>;
+        }, z.core.$loose>>;
     }, z.core.$strict>]>>>;
     conformanceLevel: z.ZodOptional<z.ZodEnum<{
         L1: "L1";
@@ -182,4 +184,3 @@ export type BitstringStatusListEntry = z.infer<typeof BitstringStatusListEntrySc
 export type EntityCard = z.infer<typeof EntityCardSchema>;
 /** Flatten capabilities (bare strings or attested objects) to their names. */
 export declare function capabilityNames(caps: Capability[]): string[];
-//# sourceMappingURL=schema.d.ts.map

package/dist/card/schema.js

@@ -34,11 +34,15 @@ export const ProofPublicJwkSchema = z.union([Ed25519PublicJwkSchema, P256PublicJ
 const VcValue = z.union([z.string(), z.record(z.string(), z.unknown())]);
 /**
  * Deliberately NON-strict: the JSON Schema marks `CapabilityAttestation` as
- * `additionalProperties: true`, so extra keys alongside `vc` are permitted here.
+ * `additionalProperties: true`, so extra keys alongside `vc` are permitted here — and PRESERVED.
+ * A plain `z.object` strips unknown keys, which would hand the capability verifier an attestation
+ * missing sidecar members it may need (a `credentialStatus`, say).
  */
-export const CapabilityAttestationSchema = z.object({
+export const CapabilityAttestationSchema = z
+    .object({
     vc: VcValue,
-});
+})
+    .passthrough();
 export const Level2CapabilitySchema = z
     .object({
     name: z.string().min(1),

package/dist/card/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;CACnC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,0DAA0D,CAAC;CAC1G,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,GAAG;IACP,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,2EAA2E;IAC3E,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC;IACF,mFAAmF;IACnF,mFAAmF;KAClF,MAAM,EAAE,CAAC;AAiBZ,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,EAAE,EAAE,OAAO;CACZ,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;CACnC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,0DAA0D,CAAC;CAC1G,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,GAAG;IACP,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,2EAA2E;IAC3E,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC;IACF,mFAAmF;IACnF,mFAAmF;KAClF,MAAM,EAAE,CAAC;AAiBZ,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/card/verify.d.ts

@@ -141,4 +141,3 @@ export declare function verifyCard(card: EntityCard, deps: VerifyCardDeps): Prom
  * `true` so 2-arg calls still compile; a `false` (unreachable/stale list) demotes L3 → L2.
  */
 export declare function deriveConformanceLevel(check: CapabilityCheckResult, proofOk: boolean, revocationFresh?: boolean): ConformanceLevel;
-//# sourceMappingURL=verify.d.ts.map

package/dist/delegation/audience-validator.d.ts

@@ -6,4 +6,3 @@
  */
 import type { DelegationRecord } from '../types/protocol.js';
 export declare function verifyDelegationAudience(delegation: DelegationRecord, serverDid: string): boolean;
-//# sourceMappingURL=audience-validator.d.ts.map

package/dist/delegation/bitstring.d.ts

@@ -42,4 +42,3 @@ export declare class BitstringManager {
  * reading as "not set".
  */
 export declare function isIndexSet(encodedList: string, index: number, decompressor: DecompressionFunction): Promise<boolean>;
-//# sourceMappingURL=bitstring.d.ts.map

package/dist/delegation/cascading-revocation.d.ts

@@ -34,12 +34,11 @@ export declare class CascadingRevocationManager {
         reason?: string;
         revokedAncestor?: string;
     }>;
+    private isStatusBitSet;
     getRevokedInSubtree(rootId: string): Promise<string[]>;
-    private parseCredentialStatus;
     validateDelegation(delegationId: string): Promise<{
         valid: boolean;
         reason?: string;
     }>;
 }
 export declare function createCascadingRevocationManager(graph: DelegationGraphManager, statusList: StatusList2021Manager): CascadingRevocationManager;
-//# sourceMappingURL=cascading-revocation.d.ts.map

package/dist/delegation/cascading-revocation.js

@@ -6,6 +6,7 @@
  *
  * Related Spec: KYA-OS §4.4, Delegation Chains
  */
+import { nodeStatusEntry } from './delegation-status-entry.js';
 export class CascadingRevocationManager {
     graph;
     statusList;
@@ -50,11 +51,21 @@ export class CascadingRevocationManager {
         if (dryRun) {
             return event;
         }
-        if (node.credentialStatusId) {
-            const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
-            if (credentialStatus) {
-                await this.statusList.updateStatus(credentialStatus, true);
-            }
+        // Mark the graph first (SPEC.md §6.5 step 1): it holds even when the node
+        // has no status list entry to flip (no status id, or one such as
+        // urn:uuid:… that names no list and index), or when publishing the bit
+        // below fails.
+        const marked = await this.graph.setRevoked(node.id, true);
+        const credentialStatus = nodeStatusEntry(node);
+        // With no bit to flip, the mark is the only record. If the storage
+        // provider dropped it, reporting success would leave the delegation live.
+        if (!marked && !credentialStatus) {
+            throw new Error(`Revocation of delegation ${node.id} was not recorded: it has no status list entry, and the ` +
+                `graph storage provider did not persist DelegationNode.revoked. A DelegationGraphStorageProvider ` +
+                `must store the revoked field to revoke delegations without a status list entry.`);
+        }
+        if (credentialStatus) {
+            await this.statusList.updateStatus(credentialStatus, true);
         }
         return event;
     }
@@ -69,35 +80,36 @@ export class CascadingRevocationManager {
             timestamp: Date.now(),
             reason: 'Restored',
         };
-        if (node.credentialStatusId) {
-            const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
-            if (credentialStatus) {
-                await this.statusList.updateStatus(credentialStatus, false);
-            }
+        // Clear the graph mark last: if clearing the status bit fails, the
+        // delegation still reads as revoked.
+        const credentialStatus = nodeStatusEntry(node);
+        if (credentialStatus) {
+            await this.statusList.updateStatus(credentialStatus, false);
         }
+        await this.graph.setRevoked(node.id, false);
         return event;
     }
     async isRevoked(delegationId) {
         // Walk root → target so ancestor revocation is detected before the
         // target's own (cascade-set) bit. getChain() already returns root-first order.
+        // A node counts as revoked when the graph marks it or its status bit is
+        // set; a node with no status list entry is read from the mark alone.
         const chain = await this.graph.getChain(delegationId);
         for (const node of chain) {
-            if (node.credentialStatusId) {
-                const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
-                if (credentialStatus) {
-                    const isRevoked = await this.statusList.checkStatus(credentialStatus);
-                    if (isRevoked) {
-                        return {
-                            revoked: true,
-                            reason: node.id === delegationId ? 'Directly revoked' : 'Ancestor revoked',
-                            revokedAncestor: node.id === delegationId ? undefined : node.id,
-                        };
-                    }
-                }
+            if (node.revoked || (await this.isStatusBitSet(node))) {
+                return {
+                    revoked: true,
+                    reason: node.id === delegationId ? 'Directly revoked' : 'Ancestor revoked',
+                    revokedAncestor: node.id === delegationId ? undefined : node.id,
+                };
             }
         }
         return { revoked: false };
     }
+    async isStatusBitSet(node) {
+        const credentialStatus = nodeStatusEntry(node);
+        return credentialStatus ? this.statusList.checkStatus(credentialStatus) : false;
+    }
     async getRevokedInSubtree(rootId) {
         const descendants = await this.graph.getDescendants(rootId);
         const revoked = [];
@@ -113,20 +125,6 @@ export class CascadingRevocationManager {
         }
         return revoked;
     }
-    parseCredentialStatus(credentialStatusId) {
-        const match = credentialStatusId.match(/^(.+)#(\d+)$/);
-        if (!match)
-            return null;
-        const [, statusListCredential, indexStr] = match;
-        const index = parseInt(indexStr, 10);
-        return {
-            id: credentialStatusId,
-            type: 'StatusList2021Entry',
-            statusPurpose: 'revocation',
-            statusListIndex: index.toString(),
-            statusListCredential: statusListCredential,
-        };
-    }
     async validateDelegation(delegationId) {
         const revokedCheck = await this.isRevoked(delegationId);
         if (revokedCheck.revoked) {

package/dist/delegation/cascading-revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cascading-revocation.js","sourceRoot":"","sources":["../../src/delegation/cascading-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuBH,MAAM,OAAO,0BAA0B;IAE3B;IACA;IAFV,YACU,KAA6B,EAC7B,UAAiC;QADjC,UAAK,GAAL,KAAK,CAAwB;QAC7B,eAAU,GAAV,UAAU,CAAuB;IACxC,CAAC;IAEJ,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,UAAsC,EAAE;QAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;QACzC,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CACrC,UAAU,EACV,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACf,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CACjC,UAAU,EACV,KAAK,EACL,iBAAiB,YAAY,EAAE,EAC/B,OAAO,CAAC,MAAM,EACd,YAAY,CACb,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAoB,EACpB,MAAe,EACf,MAAe,EACf,MAAgB,EAChB,QAAiB;QAEjB,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;SACP,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;SACnB,CAAC;QAEF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB;QAKlC,mEAAmE;QACnE,+EAA+E;QAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC7E,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;oBACtE,IAAI,SAAS,EAAE,CAAC;wBACd,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;4BAC1E,eAAe,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;yBAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,qBAAqB,CAAC,kBAA0B;QACtD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAS,EAAE,EAAE,CAAC,CAAC;QAEtC,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,YAAY;YAC3B,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,oBAAqB;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,YAAY,CAAC,eAAe;oBAClC,CAAC,CAAC,YAAY,YAAY,CAAC,eAAe,aAAa;oBACvD,CAAC,CAAC,uBAAuB;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA6B,EAC7B,UAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"cascading-revocation.js","sourceRoot":"","sources":["../../src/delegation/cascading-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAoB/D,MAAM,OAAO,0BAA0B;IAE3B;IACA;IAFV,YACU,KAA6B,EAC7B,UAAiC;QADjC,UAAK,GAAL,KAAK,CAAwB;QAC7B,eAAU,GAAV,UAAU,CAAuB;IACxC,CAAC;IAEJ,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,UAAsC,EAAE;QAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;QACzC,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CACrC,UAAU,EACV,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACf,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CACjC,UAAU,EACV,KAAK,EACL,iBAAiB,YAAY,EAAE,EAC/B,OAAO,CAAC,MAAM,EACd,YAAY,CACb,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAoB,EACpB,MAAe,EACf,MAAe,EACf,MAAgB,EAChB,QAAiB;QAEjB,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;SACP,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,uEAAuE;QACvE,eAAe;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAE1D,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,mEAAmE;QACnE,0EAA0E;QAC1E,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,EAAE,0DAA0D;gBAC3F,kGAAkG;gBAClG,iFAAiF,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;SACnB,CAAC;QAEF,mEAAmE;QACnE,qCAAqC;QACrC,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAE5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB;QAKlC,mEAAmE;QACnE,+EAA+E;QAC/E,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;oBAC1E,eAAe,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;iBAChE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAoB;QAC/C,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,YAAY,CAAC,eAAe;oBAClC,CAAC,CAAC,YAAY,YAAY,CAAC,eAAe,aAAa;oBACvD,CAAC,CAAC,uBAAuB;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA6B,EAC7B,UAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC"}

package/dist/delegation/chain-enforcement.d.ts

@@ -15,9 +15,15 @@ import { type DelegationCredential } from "../types/protocol.js";
 /** Union of a credential's delegation scopes and its constraint scopes. */
 export declare function getDelegationScopes(credential: DelegationCredential): string[];
 /**
- * A child re-delegation may only narrow (attenuate) its parent's authority.
- * Enforces flat-scope subset AND crisp-matcher subset (by matcher+resource),
- * failing closed on any widening. Pure; never throws.
+ * A child re-delegation may only narrow (attenuate) its parent's authority
+ * (SPEC.md §6.4). Scope authority comes in two representations (SPEC.md §6.3):
+ * flat scopes, matched exactly, and CRISP scope matchers. Both credentials are
+ * read as one typed authority ({@link scopeAuthority}), and every flat scope and
+ * matcher the child grants must be proven inside the parent's authority
+ * ({@link authorityContains}), whichever representation either side uses;
+ * anything unprovable, including a malformed entry, fails closed. A credential
+ * with no scopes of either kind is not scope-restricted: such a parent accepts
+ * any child, and such a child never attenuates a restricted parent. Pure.
  */
 export declare function validateScopeAttenuation(parentCredential: DelegationCredential, childCredential: DelegationCredential): {
     valid: boolean;
@@ -67,10 +73,36 @@ export interface ChainEnforcementDeps {
     statusListConfigured: boolean;
     /** Optional graph-backed ancestor-revocation check (see {@link RevocationChecker}). */
     revocationChecker?: RevocationChecker;
+    /**
+     * DIDs allowed to sign the chain's root credential (its Responsible Party).
+     * When set, a root signed by any other DID is rejected. Omit to accept any
+     * root issuer.
+     */
+    trustedRootIssuers?: readonly string[];
+    /**
+     * Local cost limit: the most credentials this verifier will verify in one
+     * chain, root to leaf inclusive. Each credential costs a signature check and
+     * possibly a DID resolution, and a resolver may return a chain of any length.
+     * This bounds the verifier's own work; it is not a protocol rule about how far
+     * authority may be delegated, which the base profile leaves unbounded. Omit to
+     * verify any length. A value that is not a positive integer rejects every
+     * chain.
+     *
+     * It is checked after `resolveDelegationChain` returns, so it does not bound
+     * the resolver itself: a resolver that walks `parentId` one fetch at a time
+     * should apply its own limit. The Entity Card profile's
+     * `validateDelegationChain` (`@kya-os/mcp/card`) takes the same option and
+     * counts the same way.
+     */
+    maxChainLength?: number;
 }
 export interface ChainValidationResult {
     valid: boolean;
     reason?: string;
+    /** Earliest verified credential/constraint expiry across the chain (ms epoch). */
+    expiresAt?: number;
+    /** Non-fatal inconsistencies worth logging, such as a root whose issuerDid is not its signer. */
+    warnings?: string[];
 }
 /**
  * Validate a delegation credential and (if re-delegated) its full chain:
@@ -78,9 +110,14 @@ export interface ChainValidationResult {
  * the §11.6 re-delegation audience-constraint requirement, parent↔child linkage
  * (parentId + issuerDid==parent.subjectDid), cycle detection, scope attenuation,
  * and — when a {@link RevocationChecker} is supplied — graph-backed ancestor
- * revocation. Never throws on a malformed input; returns `{ valid, reason }`.
+ * revocation. `skipSignature` applies only to the presented leaf whose JWT
+ * envelope the caller has verified; ancestors always require verification.
+ * Each child must also be signed by its parent's subject: the claimed
+ * `issuerDid` alone is not signed evidence of who issued it. When
+ * `trustedRootIssuers` is set, the root must be signed by one of them.
+ * Success includes the earliest applicable expiry for downstream grant storage.
+ * Never throws on a malformed input; returns `{ valid, reason }`.
  */
 export declare function validateDelegationChain(leafCredential: DelegationCredential, deps: ChainEnforcementDeps, options?: {
     skipSignature?: boolean;
 }): Promise<ChainValidationResult>;
-//# sourceMappingURL=chain-enforcement.d.ts.map